8/9/2008

Yahoo to let visitors decline more targeted ads

Filed under: — Aviran Mordo

Yahoo Inc. will let its Web visitors decline ads targeted to their browsing habits, becoming the latest Internet company to break from a common industry practice as Congress steps up scrutiny of customized advertising and consumer privacy.

Yahoo has been offering that opt-out choice only to ads the company runs on outside, partner sites. Yahoo said Friday it now would extend that option to ads displayed on its own sites, to boost users’ trust - and in doing so, perhaps draw visitors from its rivals.

The option will likely be available by the end of the month.

Hackers mull physical attacks on a networked world

Filed under: — Aviran Mordo

Want to break into the computer network in an ultra-secure building? Ship a hacked iPhone there to a nonexistent employee and hope the device sits in the mailroom, scanning for nearby wireless connections.

How about stealing someone’s computer passwords? Forget trying to fool the person into downloading a malicious program that logs keystrokes. A tiny microphone hidden near the keyboard could do the same thing, since each keystroke emits slightly different sounds that can be used to reconstruct the words the target is typing.

Hackers at the DefCon conference here were demonstrating these and other novel techniques for infiltrating facilities Friday.

Vista’s Security Rendered Completely Useless by New Exploit

Filed under: — Aviran Mordo

This week at the Black Hat Security Conference two security researchers will discuss their findings which could completely bring Windows Vista to its knees.

Mark Dowd of IBM Internet Security Systems (ISS) and Alexander Sotirov, of VMware Inc. have discovered a technique that can be used to bypass all memory protection safeguards that Microsoft built into Windows Vista. These new methods have been used to get around Vista’s Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP) and other protections by loading malicious content through an active web browser. The researchers were able to load whatever content they wanted into any location they wished on a user’s machine using a variety of objects, such as Java, ActiveX and even .NET objects. This feat was achieved by taking advantage of the way that Internet Explorer (and other browsers) handle active scripting in the Operating System.

While this may seem like any standard security hole, other researchers say that the work is a major breakthrough and there is very little that Microsoft can do to fix the problems. These attacks work differently than other security exploits, as they aren’t based on any new Windows vulnerabilities, but instead take advantage of the way Microsoft chose to guard Vista’s fundamental architecture. According to Dino Dai Zovi, a popular security researcher, “the genius of this is that it’s completely reusable. They have attacks that let them load chosen content to a chosen location with chosen permissions. That’s completely game over.”

Powered by WordPress