Download the new Switched app for your iPhone

Skip to Content

AOL Tech

security posts

Computers

Hacker Cracks Security Chip Known as 'Digital Fort Knox'

Hacker Christopher Tarnovsky has accomplished what many thought was nearly impossible: cracking the Trusted Platform Module (TPM). Described by some as a "digital Fort Knox," the TPM is a specialized processor dedicated to encrypting data and keeping sensitive information from prying eyes. The chips, found in many PCs, are an important line of defense for businesses and governments who need to protect their secrets.

Tarnovsky was able to crack the flagship model from Infineon, which is one of the market leaders and has chips in PCs, smartphones, set-top boxes, and the Xbox 360.

Read more →

Computers

17-Year-Old Windows Bug Surfaces, Squashed by Microsoft

Usually, Microsoft is pretty good about patching up any gaps in security. But with technology changing at breakneck speeds, some mistakes are bound to go unnoticed. According to BBC News, a man recently discovered a bug in Windows that's been around for 17 years. How does a vulnerability go unnoticed long enough for three different presidents to occupy the White House? Honestly, we're not sure. But Tavis Ormandy, the Google security researcher who discovered the bug, found it in a utility that lets newer versions of Windows run programs from the DOS era. Basically, the loophole could allow hackers to hijack a users PC. The bug has been hiding in every version of the operating system since Windows NT 3.1 -- when some of you were just a twinkle in your daddy's eye.

Since Ormandy enlightened the folks at Microsoft about the bug, the company announced it will fix it with a patch that'll be released this month. With this patch, Microsoft will also fix 25 other bugs -- five of which are rated "critical" by security experts. With all this recent bad publicity surrounding Microsoft's security, it doesn't seem like 2010 is starting out how the company would like. [From: BBC News]

Computers, Web

Latest Internet Explorer Flaw Exposes Any File on Your PC

Latest IE Flaw Exposes Any File on Your PC
Internet Explorer is no stranger to security vulnerabilities, but a flaw revealed by Microsoft on Wednesday is one of the most stunning we've ever seen. The flaw affects IE6, IE7, and IE8 on Windows XP as well as IE7 and IE8 on Vista and Windows 7 if protected mode has been disabled (though protected mode is turned on by default).

The exploit would allow a hacker to access any file on your system by forcing IE to incorrectly render data from local files, exposing it to outside parties. The flaw, which is actually several smaller security holes combined in an ingenious way, would require tricking a victim into visiting a Web site through e-mail or IM, and then the attacker know the location and name of the file they'd wish to access. Unfortunately, many programs store sensitive data using a standardized structure that would be easy to find though guesswork.

Read more →

Google, Web

Google and NSA Forging Cyber-Alliance in Wake of China Hack

2009 was an abysmal year in terms of cybersecurity, as cyberattacks and data breaches doubled from 2008. The most publicized event occurred when Google became embroiled in a heated dispute with China over the nation's involvement in a hack on the search engine. Google even threatened to shutter its Google China service because of the incident, which Director of National Intelligence Dennis C. Blair called a "wake-up call."

Blair believes the Google hack may only represent the beginning of a wave cyber-assaults, as he recently predicted a massive attack on U.S. telecommunications and computer networks to occur within the next six months. The federal government and Google aren't going to sit idly by though, and are reacting to the "wake-up call" by forging a cyber-alliance. According to the Washington Post, Google and the National Security Agency are partnering in order to intensely scrutinize the China attack, identify weaknesses, and then take precautionary measures in order to improve cyber-security.

Read more →

Computers, Web

Malware Purveyors Paying Third Parties to Distribute Infections


Affiliate programs are nothing new to online retailers; but, now, distributors of malware are taking that model and offering "pay per install" programs, rewarding immoral Web users for installing pieces of malware on other people's computers.

The practice was described to attendees of the Black Hat DC conference by Kevin Stevens, an analyst at SecureWorks. Sites like Earnings4U are paying anywhere from $180 (for U.S.-based PCs) to $6 (for machines in Asia) for every 1,000 installs. According to Technology Review, Stevens said such sites constantly change their names to avoid the authorities, and have forums loaded with advice and software tools for effectively spreading the infections.

One of the tricks that allows these middlemen to make significant amounts of cash off of the scam is to use a Trojan download manager. While this commercial piece of software costs hundreds of dollars up front, once a PC has been compromised, the tool can be used to load it with several different malware packages, each of which is counted individually. These programs can even be used to harvest data for finding more victim PCs.

Read more →

Web, Social Networking

Twitter Resetting Passwords Following Phishing Attack

Twitter Resetting Passwords Following Phishing Attack
This morning, many Twitter users found themselves effectively locked out of their accounts. Following a phishing attack, Twitter took the unprecedented measure of locking down several users' accounts and requiring them to reset their passwords. The owners of the accounts were sent messages that read, "Due to concern that your account may have been compromised in a phishing attack that took place off-Twitter, your password was reset."

According to The Next Web, unconfirmed reports from users claim that the attack is associated with @THCx, a service that purports to offer helpful tips and tutorials. The service has picked up 42,000 followers in recent days, but doesn't follow any accounts in return. It's suspected that the exploited flaw resides in NutshellMail, which allows the e-mail-like managing of tweets.

Read more →

Web, Social Networking

Facebook Poses Greatest Social Networking Threat to Corporate Security, Study Says


The threat that Facebook poses to our workplace reputations is already well-documented. But a study now claims that the social networking site may compromise overall office security, not just proper office sensibilities. According to a report published yesterday by Sophos, 60-percent of surveyed corporate executives claimed that Facebook was a bigger threat to firm-wide security than any other social networking site, due in large part to the malware, spam and phishing attacks with which the site is sometimes afflicted. As All Facebook reports, employers also cited the risky online behavior that Facebook can encourage, as well as the potential loss of proprietary data that could arise if employees get a bit too Wall-post-happy.

It's important to keep in mind, though, that the study restricts its scope solely to the social networking sphere, so it makes sense that the most pervasive site would arouse the most fear in corporate gatekeepers. It seems to us, then, that the report demonstrates Facebook's ubiquity more than it does some distinctly dangerous quality of the site. As Sophos points out, social networking is "a vital part of many marketing and sales strategies." Instead of erecting barriers between corporate and Facebook worlds, then, companies should embrace social networking phenomena under tightly controlled conditions, and with the help of "a unified approach providing sensible, granular access control, secure encryption and data monitoring, and comprehensive malware protection." In other words, Facebook may present some dangers, but combating those with impermeable digital borders would only put companies at a greater loss. [From: All Facebook]

Web, Social Networking

'Ex-Girlfriend' Worm Squirms its Way Through Facebook

Whether you own up to it or not, we're all guilty of using Facebook to excavate everyone's dirtiest laundry. While trolling through your friends' list to find out who broke up with who may be guiltily pleasurable, you could also spread an insidious digital worm that feeds on the innate human penchant for gossip.

If you've come across any wall posts on Facebook saying something to the effect of "My Ex-Girlfriend Cheated on me... Here is my revenge!", don't click on the link. As All Facebook reports, it's actually some sort of worm that will automatically repost the exact same message to your wall, and then sit and wait for your other gossip-hungry friends to click on it. The picture alongside the post, of course, isn't any of your friends, or girlfriends, or even any one in particular. However, it seems that an anonymous blonde and salacious phrase is enough of a carrot for many gossip hungry Facebookers to bite on; as a result, the fake mini-scandal has started to spread.

Read more →

Web, Social Networking

Facebook Hole Reveals Friend's App Activity

Facebook Security Flaw Reveals Your App Activity
Facebook's little snafu with the 'un named app' is nothing compared to the latest bug discovered by All Facebook. The social network's new dashboard features, which at the moment are only available if you have the Facebook Developer app installed, allows you to see what applications your friends have or had installed -- whether they want you to or not.

The applications and games dashboards are expected to be rolled out to general users soon, and we hope that Facebook will patch this flaw before the release. But for now, anyone can install the Facebook Developer app and see what their friends are doing. We set the developer's app up, and it works just as described. Without some tasteful censoring the screen shot above would reveal which of our friends was interested in determining what deadly sin they were. Facebook doesn't prompt users to ask if they want to share that information, which makes it all that more disconcerting that you can easily launch the applications dashboard and see which of your friends is using the 'How Perverted are You?' app.

Read more →

Web, Social Networking

Facebook 'Un Named App' Not Dangerous, For Now

Facebook
Lets say this right off the bat: if you've spotted an "un named app" in your settings on Facebook, don't freak out. It's not malware or anything dangerous. It's just a head-scratcher of a glitch that has been plaguing Facebook users for the last day or so. The bug was causing particular panic following a string of status updates that read something along the lines of:
Has your facebook been running slow lately? Check your 'application settings', go into 'added to profile'. If you see one in there called "un named app" delete it... Its an internal spybot. Pass it on.
Ultimately, it was an error on the part of Facebook, which has said it fixed the problem, but has also declined to comment further. If you did remove "un named app," you would have noticed that the "boxes" tab was missing from your profile.

Read more →

Web

More Flaws Discovered in Internet Explorer Could Pose Threat

It doesn't seem like the the furor over China's recent cyber attacks on Google will ever die down. Last week, Microsoft patched up the vulnerabilities in its Web browser, Internet Explorer, that allowed the attacks. According to a report from Reuters, a Boston-based security research firm discovered yet more flaws that could leave Internet Explorer users open to similar malicious attacks.

Representatives of Core Security Technologies said Friday that individually the four or five flaws aren't a huge threat. However, hackers could link them together and gain remote access to everything stored on a person's computer by overwhelming the browser when the user clicks a bad link.

A Microsoft spokesperson tried to ease concerns, telling Ars Technica, "
Microsoft is investigating a responsibly disclosed vulnerability in Internet Explorer." The spokesperson continued, "[Customers] are at reduced risk due to responsible disclosure." Jorge Luis Alvarez Medina, a consultant with Core, confirmed to Reuters that his company is working with the software giant in order to minimize the threat and fix the problem.

Read more →

Web

RockYou Breach Reveals More Lazy '123456' Passwords

RockYou Breach Reveals More Lazy Passwords

We thought we had this all sorted out some time ago. If you choose an easy-to-guess password -- like, say "123456" -- it puts your accounts and personal data in danger. So we were horrified a few months ago when a sampling of 10,000 hacked Hotmail, MSN, and Live.com accounts revealed that the most popular password was, in fact, "123456." But, like most other tech blogs and magazines, we rushed to your rescue, dear reader. We offered advice for strengthening your passwords and managing a cadre of unique phrases for all of your different accounts.

Two months later, in December, RockYou, maker of obnoxious social networking apps like 'GlitterText', suffered a security breach that exposed the e-mails and passwords of some 32 million users. So, when it was discovered that the most popular password was, yet again, "123456," we were less worried and more disappointed. Looking at the top 10 passwords used by RockYou users reveals that an alarming number of surfers are both careless and lazy.

Read more →

Web

Web Will Be More Secure Thanks to DNS Security Extensions

The domain name system, or DNS, is an essential part of keeping the Internet running. Without it, URLs can't be translated to IP addresses, and browsers become useless. But DNS has a serious flaw: a lack of basic security features. It's because of this that hackers are able to easily perpetrate attacks, like the one the Iranian Cyber Army recently launched against Twitter.

To address this glaring flaw in the system, DNSSEC (domain name system security extensions) were developed -- in their most primitive form back in 1999. But adoption has been nearly non-existent. That is finally about to change as both ICANN and VeriSign (operator of the .com and .net domains) have agreed to introduce those extensions to their root DNS servers over the next several months. Seeing as those servers prop up much of the Internet, it's about time.

Read more →

Web, Social Networking

Facebook Users Vulnerable to Clickjacking

Facebook Users Vulnerable to Clickjacking
Privacy and security news for Facebook just keeps getting worse. No doubt, thanks in part to its ubiquity, Facebook is quickly becoming the Microsoft of social networking. The latest research shows that not only has certain user information been made available by the site without warning, but additional information can also be harvested with the use of simple clickjacking schemes.

Noted security consultant and researcher Nitesh Dhanjani has discovered that Facebook has changed its policy regarding third-party applications. It used to be that any app or external site would have to be given express permission by a user to access any profile information. Now, according to Facebook spokesman Simon Axten, Facebook is providing apps and services with "implicit authorization" to access "publicly available information."

Read more →

Web

Build-Your-Own Phishing Kits Make Cybercrime Easier than Ever

DIY Phishing Kits Make Cybercrime Easier than Ever
DIY is all the rage these days. People are building musical instruments, beer keg-monitoring robots, baby rocking machines, and iPhone-controlled cars, and gaining the satisfaction of making something with their own hands while saving a little cash. Bad news for the Web browsing public however, the DIY fad has spread to cybercrime and phishing scams.

Marc Rossi, R&D manager at Symantec, told USA Today that DIY cybercrime kits sell for between $400 and $700, and are largely responsible for the explosion of phishing scams and malware infections in late 2009. The kits are apparently so easy to use, that if you're tech savvy enough to download an album or a movie, you can use one to create a custom and convincing looking messages from UPS, Facebook, or Microsoft. The messages usually contain links that install malware capable of stealing banking information and turning the victim's PC into a bot in the attacker's vast network of controlled spam machines.

Read more →

Follow Switched on Twitter

Deals of the Day

Our Writers

Thomas Houston

Editor-in-chief

RSS Feed

Leila Brillson

Managing Editor

RSS Feed

View more Writers

Latest Reviews from CNET.com

CNET provides the latest tech news, unbiased reviews, videos, podcasts, software, and downloads, making tech products easy to find, understand and use.

Top Product Reviews

  • Home Audio Reviews

    9.0 out of 10

    Definitive Technology BPX
    Works great with Dolby Pro Logic and Dolby Digital. Full Review

    8.8 out of 10

    KEF KHT3005 (silver)
    The KEF KHT-3005 is one compact, beautifully designed speaker package with solid aluminum satellites that feature unique driver technology to produce incredible clarity. Meanwhile, the equally astounding dual 10-inch, 250-watt powered subwoofer delivers ultradeep bass. Full Review

    8.8 out of 10

    Aperion Intimus 4T Hybrid SD (cherry)
    Six-piece home theater speaker package with slender towers; compact center and surround speakers; remote controlled subwoofer with adjustable equalization; gorgeous furniture grade real cherry wood or black gloss finishes; 10 year warranty; 30 day in-home trial; free shipping. Full Review

  • Cell Phone Reviews

    8.7 out of 10

    SignalBoost Mobile Professional Amplifier Kit
    The Mobile Professional Amplifier delivers a powerful signal boost to your cell phone. Also, it offers a compact design and easy setup. Full Review

    8.6 out of 10

    Wi-Ex zBoost YX510-PCS-CEL cell phone signal extender
    The Wi-Ex zBoost YX510-PCS-CEL significantly boosts your cell phone reception and is easy to operate. Also, it uses a wireless connection to your phone. Full Review

    8.3 out of 10

    Sanyo SCP-5300 (Sprint)
    Vibrant color display; built-in camera with flash; compatible with Sprint PCS Business Connection software; comes with extended battery; solid call quality. Full Review

  • Digital Camera Reviews

    9.3 out of 10

    Canon EOS 1D Mark III
    Extremely fast, 10-megapixel continuous shooting; very low noise; highly customizable; well-designed body with weather sealing; 3-inch LCD; abundant optional accessories. Full Review

    9.0 out of 10

    Canon EOS-1Ds Mark III
    Very low noise, high quality images; 21.1 megapixels; live view shooting; pro-level build-quality and performance. Full Review

    8.9 out of 10

    Canon EOS 1Ds Mark II (body only)
    Tremendous resolution; professional body; many improvements over original EOS 1Ds; superior handling; optional wireless photo transfer. Full Review

  • Desktop Reviews

    8.9 out of 10

    Velocity Micro Edge Z30 (Intel Core i7)
    Best value among midrange gaming PCs; Velocity Micro's consistently high build quality; compact case makes few sacrifices; second graphics card slot previously uncommon at this price. Full Review

    8.4 out of 10

    Velocity Raptor Signature Edition Gaming PC
    One of the fastest PCs we've tested; a PCI Express RAID card helps media encoding performance; typically immaculate Velocity Micro assembly; strong, three-year warranty. Full Review

Featured Galleries

Lady Gaga at Monster
Lady Gaga at Polaroid
Geneva at Digital Experience
Motorola Backflip: Hands On
Hannspree at CES
Parrot AR.Drone
Chase Jarvis
Nathaniel Mellor
Mario Bros. Wii

 

Switched Desktop

Get the New Switched Desktop

Latest tech news, Switched mail, and more.

AOL Tech Network

Resources

Autoblog

DailyFinance

Download Squad

Engadget

Joystiq

Urlesque

Fanhouse Main

WalletPop

Gadling