Secure your WordPress Blog

If you use WordPress, check out this link on Hardening your WordPress Blog.

http://codex.wordpress.org/Hardening_WordPress

Pwn a Car?

The computer systems used to control modern cars are very vulnerable to attack, say experts.

An investigation by security researchers found the systems to be "fragile" and easily subverted.

The researchers showed how to kill a car engine remotely, turn off the brakes so the car would not stop and make instruments give false readings.

Despite their success, the team said it would be hard for malicious attackers to reproduce their work.

The team of researchers, led by Professor Stefan Savage from the University of California-San Diego, and Tadayoshi Kohno from the University of Washington set out to see what resilience cars had to an attack on their control systems.

"Our findings suggest that, unfortunately, the answer is 'little,'" wrote the researchers from the Center for Automotive Embedded Systems Security.

The researchers concentrated their attacks on the electronic control units (ECUs)scattered throughout modern vehicles which oversee the workings of many car components. It is thought that modern vehicles have about 100 megabytes of binary code spread across up to 70 ECUs.

Individual control units typically oversee one sub-system but ECUs communicate so that many different systems can be controlled as the situation demands. For instance, in a crash seat belts may be pre-tensioned, doors unlocked and air bags deployed.

The attackers created software called CarShark to monitor communications between the ECUs and insert fake packets of data to carry out attacks.

The team got at the ECUs via the communications ports fitted as standard on most cars that enable mechanics to gather data about a vehicle before they begin servicing or repair work.

The researchers mounted a series of attacks against a stationary and moving vehicle to see how much of the car could fall under their control.

"We are able to forcibly and completely disengage the brakes while driving, making it difficult for the driver to stop," wrote the researchers. "Conversely, we are able to forcibly activate the brakes, lurching the driver forward and causing the car to stop suddenly."

In one attack, the team transformed the instrument panel into a clock that counted down to zero from 60 seconds. In the final seconds the horn honks and as zero is reached the car engine shuts off and the doors are locked.

They found that almost every system in the car, including engine, brakes, heating and cooling, lights, instrument panel, radio and locks was vulnerable.

The team concluded that the car control software was "fragile" and easy to subvert. In some cases simply sending malformed packets of data, rather than specific control code, was enough to trigger a response.

The team are presenting a paper on their results at the IEEE symposium on Security and Privacy in California on 19 May.

"Cars benefit from the fact that they are (hopefully) not connected to the internet (yet) and currently are not able to be remotely accessed," said Rik Fergson, a security analyst at Trend Micro. "So in order to carry out a successful attack you would already need to have physical access to the vehicle, as a break-in or as a mechanic, seem the two most likely scenarios."

"As cars, and everything else in life up to and including even pacemakers or fridges, become steadily more connected and externally accessible, research such as this should be taken increasingly seriously by manufacturers," he added.

"This represents an opportunity to head off a problem before it starts, in the not-too-distant future it may represent a real risk to life."

http://news.bbc.co.uk/2/hi/technology/10119492.stm

Facebook CEO says users are "Dumb fucks"



Today, Facebook is having an emergency meeting to discuss their site's privacy problem. But these instant messages, supposedly sent by CEO Mark Zuckerberg in Facebook's early days, suggest that user privacy may have always been an afterthought.

The messages were uncovered by Silicon Alley Insider, who is no stranger to excavating the unsavory details of Facebook's past. They read:

Zuck: Yeah so if you ever need info about anyone at Harvard

Zuck: Just ask.

Zuck: I have over 4,000 emails, pictures, addresses, SNS

[Redacted Friend's Name]: What? How'd you manage that one?

Zuck: People just submitted it.

Zuck: I don't know why.

Zuck: They "trust me"

Zuck: Dumb fucks.

As SAI points out, there's no context for Zuckerberg's remarks, if they are indeed his, and there's no way to tell if these comments reflect how he really viewed matters of privacy when he was building Facebook.

But the allegation that Zuckerberg once used information from Facebook's logs to hack into Harvard Crimson reporters' email accounts certainly doesn't help his track record on this sort of thing, and Facebook's official response to the messages doesn't deny that they came from Zuckerberg:

The privacy and security of our users' information is of paramount importance to us. We're not going to debate claims from anonymous sources or dated allegations that attempt to characterize Mark's and Facebook's views towards privacy.

While the vast majority of Facebook's users might not think twice about what the site does with the information they post in their profiles, the contingent that is concerned is growing in size and becoming increasingly vocal. Yesterday, an open source Facebook alternative called Diaspora was lavished with attention and subsequently received a deluge of funding—it has now raised over $100,000. And even though these messages don't paint the whole picture by any means, I wouldn't be surprised if they drive a lot more funding in Diaspora's direction.

 http://gizmodo.com/5538489/19+year+old-facebook-ceo-didnt-take-your-privacy-seriously-either

Sorry, Adobe: Flash is the new Vista

Here’s some advice, Adobe. The first step on the road to recovery is admitting that you have a problem.

http://www.zdnet.com/blog/bott/sorry-adobe-flash-is-the-new-vista/2139

Best Google Hack

Alec Brownstein wanted a job in advertising, so he made pages that showed up as the first result when several big New York creative directors Googled themselves. 

Well, it worked. Ian Reichenthal, creative director at Young and Rubicam, an ad agency in New York City, was a part of the ad campaign. He Googled himself, found Alec's ad, and hired him after calling him in for an interview.

He has a job!