Posts Tagged “Security”

[Glenn's comment: Make sure you understand the implications of the last paragraph]

Source: European Parliament

HAARP ArrayReport on the environment, security and foreign policy (14 Feb 1999)

HAARP – a weapons system which disrupts the climate

On 5 February 1998 Parliament’s Subcommittee on Security and Disarmament held a hearing the subject of which included HAARP. NATO and the US had been invited to send representatives, but chose not to do so. The Committee regrets the failure of the USA to send a representative to answer questions, or to use the opportunity to comment on the material submitted.(21)

HAARP (High Frequency Active Auroral Research Project) is run jointly by the US Air Force and Navy, in conjunction with the Geophysical Institute of the University of Alaska, Fairbanks. Similar experiments are also being conducted in Norway, probably in the Antarctic, as well as in the former Soviet Union.(22) HAARP is a research project using a ground based apparatus, an array of antennae each powered by its own transmitter, to heat up portions of ionosphere with powerful radio beams.(23) The energy generated heats up parts of the ionosphere; this results in holes in the ionosphere and produces artificial ‘lenses’.

HAARP can be used for many purposes. Enormous quantities of energy can be controlled by manipulating the electrical characteristics of the atmosphere. If used as a military weapon this can have a devastating impact on an enemy. HAARP can deliver millions of times more energy to a given area than any other conventional transmitter. The energy can also be aimed at a moving target which should constitute a potential anti-missile system.

The project would also allow better communications with submarines and manipulation of global weather patterns, but it is also possible to do the reverse, to disrupt communications. By manipulating the ionosphere one could block global communications while transmitting one’s own. Another application is earth-penetrating, tomography, x-raying the earth several kilometres deep, to detect oil and gas fields, or underground military facilities. Over-the-horizon radar is another application, looking round the curvature of the earth for in-coming objects.

From the 1950s the USA conducted explosions of nuclear material in the Van Allen Belts(24) to investigate the effect of the electro-magnetic pulse generated by nuclear weapon explosions at these heights on radio communications and the operation of radar. This created new magnetic radiation belts which covered nearly the whole earth. The electrons travelled along magnetic lines of force and created an artificial Aurora Borealis above the North Pole. These military tests are liable to disrupt the Van Allen belt for a long period. The earth’s magnetic field could be disrupted over large areas, which would obstruct radio communications. According to US scientists it could take hundreds of years for the Van Allen belt to return to normal. HAARP could result in changes in weather patterns. It could also influence whole ecosystems, especially in the sensitive Antarctic regions.

Another damaging consequence of HAARP is the occurrence of holes in the ionosphere caused by the powerful radio beams. The ionosphere protects us from incoming cosmic radiation. The hope is that the holes will fill again, but our experience of change in the ozone layer points in the other direction. This means substantial holes in the ionosphere that protects us.

With its far-reaching impact on the environment HAARP is a matter of global concern and we have to ask whether its advantages really outweigh the risks. The environmental impact and the ethical aspect must be closely examined before any further research and testing takes place. HAARP is a project of which the public is almost completely unaware, and this needs to be remedied.

HAARP has links with 50 years of intensive space research for military purposes, including the Star Wars project, to control the upper atmosphere and communications. This kind of research has to be regarded as a serious threat to the environment, with an incalculable impact on human life. Even now nobody knows what impact HAARP may have. We have to beat down the wall of secrecy around military research, and set up the right to openness and democratic scrutiny of military research projects, and parliamentary control.

A series of international treaties and conventions (the Convention on the prohibition of military or any other hostile use of environmental modification techniques, the Antarctic Treaty, the Treaty on principles governing the activities of states in the exploration and use of outer space including the moon and other celestial bodies, and the UN Convention on the Law of the Sea) casts considerable doubt on HAARP on legal as well as humanitarian and political grounds. The Antarctic Treaty lays down that the Antarctic may be used exclusively for peaceful purposes.(25) This would mean that HAARP is a breach of international law. All the implications of the new weapons systems should be examined by independent international bodies. Further international agreements should be sought to protect the environment from unnecessary destruction in war.

Read the complete report : European Parliament

Comments No Comments »

Adobe Reader X (10.0) (link to FTP-server) is now available for Windows, Mac OS X and Android – a Linux version has yet to be released. The most exciting change is the sandbox (included only in the Windows version), which should improve the PDF reader’s overall security. It aims to prevent vulnerabilities in Reader from being used to infect PCs. The function, dubbed ‘Protected Mode’ by Adobe, blocks attempts by infected PDFs to write and execute code. It should also prevent infected files from making registry changes. Future versions will reportedly control read access to prevent attackers from reading confidential data from the file system.

Sandbox functionality has been achieved by implementing a range of technologies. The actual PDF process for rendering text and images now runs in a user-independent process with restricted privileges. If specific actions need to be performed outside the sandbox environment, the renderer calls additional ‘broker processes‘ to interact with the outside world. The broker process checks whether the requested action is permitted against a set security policy. Previously, injected malicious code was executed with the user’s privileges and had unrestricted access to the entire system.

Adobe released version 9.4.1, which fixed 19 vulnerabilities just days ago. In introducing a sandbox, Adobe is reacting to the multiplicity of criminal attacks on Adobe Reader, which exploit vulnerabilities to infect Windows PCs with malware. The vendor is frank about the fact that the sandbox is not bullet-proof. However, in recent months attacks on Reader have already started to drop, with Java vulnerabilities taking over as the most popular target for drive-by virus downloads.

The new version of the free Reader also includes additional functions. Acrobat is no longer required to add comments and notes – Reader X is now able to perform this function. Experienced users can now also customise printer options in greater detail. One example – in RGB, grey is interpreted as a mixture of different colours. It is now possible to specify grey as an ink-saving K-only. Like Acrobat X Pro, Reader now contains a pallet area for performing functions such as sending PDF files as emails.

The Reader browser plug-in has a semi-transparent ‘heads up display’ containing commonly used functions. A very old irritation has finally been confined to the dustbin of history – pressing Ctrl+P in the browser plug-in now launches Reader’s print dialogue, rather than the browser’s.

Comments Comments Off

At the 27th Chaos Communication Congress (27C3) in Berlin, security researcher Julia Wolf of US company FireEye pointed out numerous, previously hardly known, security problems in connection with Adobe’s PDF standard. For instance, a PDF can reportedly contain a database scanner that becomes active and scans a network when the document is printed on a network printer. Wolf said that the document format is also full of other surprises. For example, it is reportedly possible to write PDFs which display different content in different operating systems, browsers or PDF readers – or even depending on a computer’s language settings.

Many businesses and authorities use PDF as their standard file format for maintaining presentation consistency across heterogeneous computer environments. According to Wolf, however, the PDF standard has long had too many functions that can be exploited to launch attacks and wreak other havoc. These functions range from database connections without security features to options that can blindly trigger the execution of arbitrary programs in Acrobat Reader. The researcher said that other risks are generated through the support of inherently insecure script languages such as JavaScript, formats such as XML, RFID tags and digital rights management (DRM) technologies. According to Wolf, Adobe itself calls PDF a “container format” which may indeed hold a variety of things. For example, it is possible to integrate Flash files, which themselves offer many points of attack, as well as audio and video files.

Wolf said that there are generally many places for hiding arbitrary data and code in a PDF. The researcher explained that, for instance, all document and meta data can be read and edited via JavaScript. Even files compressed in formats such as ZIP, which allow further arbitrary objects to be embedded via comments, can reportedly be integrated. Wolf added that it is also possible to generate very small PDF files which only execute JavaScript, and that certain objects can be referenced multiple times to trigger different responses when opening a file.

In the researcher’s experience, the security debacle is made worse because most anti-virus programs are incapable of detecting malicious software in PDFs. When running tests with various known exploits, Wolf said that more than half of the 40 scanners she tested didn’t respond, even in cases where the corresponding advisories were several months old. When malicious code in JavaScript is compressed, the detection rate is apparently even lower.

Update - Adobe see the sandbox introduced with Reader X (Reader version 10.0) as the remedy for these problems, which allows code to be executed separately in ‘protected mode’.

Other security experts recommend using special tools to remove meta data from PDFs or check the file syntax for conformity issues beforehand.

Comments No Comments »

Strong passwords are the first line of defense against identity theft.

Read the original post from Iolo

We use passwords so often that it’s easy to lose sight of just how critical a password really is: one of the best defenses we have against cybercrime is often the one we take the least seriously.

After a hacking incident in 2009, InformationWeek analyzed the login information of the site’s 20,000 users and found that most passwords were ones a hacker could guess in seconds. The most common passwords? 123456 and password.

Don’t make it this easy for the cyber criminals—create strong passwords that are easy for you to remember but hard for others to guess.

Strong Passwords

Why you need strong passwords

It can be tempting to use an easy-to-remember sequence like a birth date or cell phone number as a password. But don’t. Many systems have been broken into due to weak passwords, which are passwords that can be easily guessed or can be quickly decoded by a cracking program.

A password cracking program is a tool that runs through a list of possible passwords, one-by-one, until it hits on the right combination; it can process tens of thousands of different passwords in one second. The list of possible passwords the program uses can include commonly used passwords, dictionary words, and information specific to you, such as your birth date.

Once your password is known, a hacker can tap into your private information and do all sorts of damage, ranging from reading your personal emails and creating fake postings on your profile page to robbing your bank accounts and stealing your identity.

Tips for creating a strong password

4 Password Dos

4 Password Dos
  • Use long passwords. The longer your password is, the better. Use a password that has at least 8 characters, and for your high-security accounts, security experts recommend even longer passwords: at least 14 characters. (How can you remember 14 characters? See “Consider building passwords based on phrases” below for some ideas.)
  • Mix it up. Use a mix of uppercase letters, lowercase letters, numbers, and symbols—the more types of characters you use in your password, the harder it is to guess.

    To illustrate: For an 8-character password with all lowercase letters, a cracking tool would be able to run through every possible combination in 2.42 days. By mixing in uppercase letters, numbers, and symbols, the tool would take 210 years to run through every combination.

  • Use text that’s not in a dictionary. A password cracking program can check millions of dictionary words in seconds. Avoid “real” words that can be found in a dictionary.
  • Change passwords regularly. Change your passwords on a regular basis. Every 60-90 days is the recommendation of most security advisors; you may want to change them more or less often depending on the security of the information the password is protecting.

4 Password Don’ts

4 Password Donts
  • Don’t use ‘password’. The word password and variations such as password1, passwd, p@$$w0rd, and drowssap (password spelled backwards) are so common that many hackers start with these.
  • Don’t use easy-to-guess patterns. Don’t use a sequence of characters (like 123456 or abc123), repeated characters (ioioio), or patterns that use characters that are close together on the keyboard (qwerty).
  • Don’t use your name or other personal characteristics. Don’t use your first or last name, and don’t use terms associated with your personal life that others may know, like the name of your spouse or children, names of pets, license plate numbers, and phone numbers.
  • Don’t use the same passwords for every account. The risk in using the same password for multiple accounts is that if someone figures out one password, that person now has access to everything else. For the utmost in security, use a different password for every password-protected program, web site, and account that you use. It’s particularly critical that you not re-use your email account password on web sites because once it’s compromised, the door is opened to all your accounts that have your email address on file.
build passwords

Consider building passwords based on phrases

The truth is that a long string of random characters can be hard to remember, especially when you have a lot of different passwords to keep track of.

One strategy is to use passwords that are built from easily remembered phrases. You take the first letters from each of the words in the phrase, and you also mix in some symbols and numbers in place of certain words, like using & to replace “and.”

Here are a few examples of strong passwords built on phrases:

  • M2010nyri2l15# (”My 2010 new year’s resolution is to lose 15 pounds”)
  • Lmu?i:Wayd4o? (”Life’s most urgent question is: What are you doing for others?”)
  • Iw2Tls&cw2gb! (”I went to Texas last summer and can’t wait to go back!”)

TIP: A number of online password checkers like The Password Meter can be used to check the strength of your password.

Make any security questions strong, too

questions

Automated password resetting is a process that lets you reset your password if you ever forget your current one; it’s typically implemented by you setting up one or more security questions that you have to answer in order to gain access to your account. But if these questions are too simple, someone else may be able to easily guess the answers.

One example of this technique happened in 2008 when the email account of Sarah Palin, a nominee for Vice President of the United States, was broken into. The hacker was able to answer three security questions and illegally access Palin’s email simply by researching her zip code, her birthday, and where she met her husband.

For any account that offers password resetting, be sure to set up strong questions as well.

keep passwords secret

And remember–keep your passwords secret

The strongest of passwords won’t protect you if others can readily access it. Have you ever seen someone’s password written on a sticky note taped to their monitor? This is a bit like taping your car keys to the windshield—you can easily find your keys, but so can anyone else.

Here are a few tips on safeguarding your passwords:

  • Don’t respond to any email that asks for your password or asks you to verify your password by sending it in. Reputable companies don’t use email to ask their customers for this information.
  • When using public computers such as in airport lounges, internet cafes, and libraries, don’t access any sites that require a password. In these insecure locations, hackers can easily capture everything you type using keylogging devices. (Read more about keyloggers.)
  • The old advice was to never write down your passwords, but with today’s reality, you can end up with dozens of different passwords—and it’s better to use multiple passwords than to just use the one or two passwords that you can memorize. So it’s OK to write down your passwords: just be sure to keep the list in a secure place that others can’t access, such as a locked drawer or a safe deposit box.

Read the original post from Iolo

——————————————————-

Comments Comments Off

By Renai LeMay, Delimiter.com.au on April 7th, 2010

Microsoft appears to have accidentally deleted six years of blog archives hosted on its free Windows Live Spaces platform belonging to Australian mobile technology evangelist Shane Williamson.

“About 3 weeks ago my Windows Live Spaces blog was deleted by Microsoft for no reason,” Williamson wrote on his site over the weekend. “That is over six years of blogging on mobile, technology and convergence gone … Microsoft claims they cannot reclaim any part of the data lost, or will they give a reason why it was lost.”

“This should be a major concern to anyone who is, or thinking of, using Windows Live SPaces as a serious blog or any other type of cloud computing services from Microsoft.” Delimiter couldn’t reach Williamson for a comment today.

When contacted about the issue today, Microsoft Australia’s public relations agency punted the question to ninemsn, which operates the Windows Live brands in Australia courtesy of its joint venture relationship with the software giant.

A spokesperson for the company said it was investigating the issue back in Microsoft headquarters in the US — as that was where the Windows Live Spaces blogs were administered from, although it hoped to provide further information on Williamson’s case in due course.

Previously known as MSN Spaces, Windows Live Spaces was initially released in 2004, and is broadly seen as competitor to other free hosted blogging platforms such as Wordpress.com and Google’s Blogger offering.

Williamson himself is seen as one of Australia’s foremost experts on the mobile technology space. In the past he’s held senior roles focused on the mobile space at a number of companies such as Microsoft, Optus and Hutchison Australia (before the merger with Vodafone). He is also the co-founder of the Mobile Monday Sydney chapter, which attempts to bring mobile industry professionals together.

Read the blog post on Zdnet

Comments Comments Off

By now, you’ve probably heard that Facebook has made some big changes that affect your privacy. However, you might not know what they are.

So far, the changes have been explained in the language of the people that they benefit: companies and app developers. What about us, the end users?

Here’s a handy collection of the best tips that we could find for protecting your privacy on Facebook’s wild new frontier.

Read More on Download Squad

Comments Comments Off

In its rush to take on Facebook and Google Buzz, Microsoft is now collecting and displaying personal information on your Hotmail page — information you may never have wanted to broadcast.

Exactly how it’s mining this information is something of a mystery, but if you use Hotmail or Windows Live, it’s time to review your privacy settings — lest something you said or did comes back to haunt you.

One user signed in to her Hotmail account recently and was greeted with Microsoft’s new, improved social networking splash page.

What’s wrong with this picture? All three What’s new with your network entries contain potentially embarrassing information that the authors never dreamed would appear on someone else’s Hotmail sign-in page.

Read More on Windows Secrets: http://windowssecrets.com/comp/100422#story1

Comments Comments Off