Categories
Computing Microsoft

Removing administrator rights fixes 90 percent of Windows 7 vulnerabilities

Ars Technica reports that 90 percent of Windows 7 flaws fixed by removing admin rights

After tabulating all the vulnerabilities published in Microsoft’s 2009 Security Bulletins, it turns out 90 percent of the vulnerabilities can be mitigated by configuring users to operate without administrator rights, according to a report by BeyondTrust.

Ars Technica describes this as being good news for IT departments who can reduce security breaches by mandating the use of the ‘Standard User’ account, but it is still not common practice for home users to do the same.

Categories
Computing

The fundamental problem with the PDF format

Mikko of F-Secure argues that the ongoing security problems with Adobe Acrobat Reader, which is now the primary vector for malware having overtaken Microsoft Word sometime in 2009, is to do with fundamental issues with the PDF format itself.

Looking at the 756 page specification document (PDF format naturally) one finds details about how to embed all kinds of things from multimedia to executable JavaScript into PDF files.

So using an alternative to Adobe Acrobat Reader such as the Foxit Reader is not the solution as it is just as vulnerable due to including the same functionality as Adobe Acrobat Reader. There might be alternative PDF readers that simply render the documents without the additional functions but another secure workaround is to open them up in Google Docs.

Categories
Computing Politics

Kentucky election fraudsters found guilty

What might be just another run of the mill vote-buying scandal is made all the more interesting by the fact that some of the corrupting of the electoral process was down to exploiting a flaw in electronic voting machines.

The exploit was far more low-tech than those uncovered by the likes of Ed Felten as it exploited the poorly designed user interface which required voters to confirm their vote after they had pressed the button to make their voting selection. [via]

Edit: Bruce Schneier has of course covered the same story and has links to much deeper analyses of the situation.

Categories
Computing

Frenchman hacked President Obama’s Twitter account

BBC News reports that an unemployed man has been arrested by French police for hacking the Twitter accounts of US President Barack Obama and celebrities.

The unemployed 25-year-old was arrested on Tuesday after an operation lasting several months, conducted by French police with agents from the FBI.

He gained access to Twitter accounts by simply working out the answers to password reminder questions on targets’ e-mail accounts, according to investigators.

This is the same method that was famously used to hack into Sarah Palin’s Yahoo! webmail account and is yet another real world example of the failure of the typical password reminder function that the study by the University of Cambridge’s Computer Laboratory showed.

As I wrote previously that until such time as the companies that use password reminder questions as a security method change the system they use I recommend that people give a nonsense answer to the question. Particularly people such as President Obama where such information is easily researched.

Categories
Uncategorized

The Enchantress of Numbers

Today the 24th March is Ada Lovelace day whereby blogger around the world celebrate the achievements of women in technology and science by choosing one to profile and write about. This year I’m cheating a little and am linking to an excellent animation produced by Brainpop about the life of the lady herself who was called “The Enchantress of Numbers” by Charles Babbage.

Categories
Computing

Twitter phishing attack via Direct Messages

The F-Secure blog reports on a clever little phishing attack which uses Twitter’s own Direct Message service and URL shortening services.

Unsuspecting users will click the link provided in the message which comes from somebody they know as Direct Messages can only come from people you follow on Twitter. However the message is likely coming from a hijacked account and points to a URL which hosts a phishing page that looks like Twitter and is asking you to sign in.

Once they have your credentials they then send messages to all your contacts and their web of hijacked accounts grows exponentially.

The good news is that Twitter has reacted quickly to this attack and are closing down the avenues of attack.

Categories
Computing TV

Playboy TV content played on children’s television

BBC News reports that adult content from Playboy was accidentally played out on children’s TV.

TV bosses in the US have apologised after preview clips of the Playboy channel were accidentally played out on two children’s channels.

“We’re very, very sorry it happened – we know parents are concerned,” spokesman Keith Poston told local news station WRAL.

“It took about an hour or so once we were notified of the problem to actually get it fixed.

“It was a technical glitch and unfortunately it hit at the worst possible time on the worst possible channels,” he added.

The error occurred on the Kids On Demand and Kids Preschool On Demand channels where clips from Playboy TV appeared in the top right hand corner.

I suppose it could have been a glitch, but if it was then it was by accident the worst possible mix up of TV programming possible.

Also it seems to have taken quite a while for it to have been fixed once they had been notified. Could they not have simply taken the entire channel off the air?

It seems more likely to me that this was a deliberate and malicious act by somebody, perhaps a disgruntled former employee, that has access to the computer system used to automate the process of putting content on air.

Categories
Movies Reviews

Review: The Girl with the Dragon Tattoo

The Girl with the Dragon Tattoo

The original Swedish title Män som hatar kvinnor translates to Men Who Hate Women, which is I think is a little literal. I prefer the enigmatic English title, but I think that this is typical of what I believe is a fundamental difference between Swedes and Brits.

Categories
TV

Lost: Which dead people are really the man in black

It has been established that the Man in Black is the Smoke Monster and has now taken the form of Locke.

Illana says that since Jacob is now dead that the Smoke Monster cannot taken any other form other than that of Locke. http://lostpedia.wikia.com/wiki/The_Substitute

Back in episode http://lostpedia.wikia.com/wiki/The_Man_Behind_the_Curtain Ben follows his mother into the jungle and then has a meeting with Richard who asks whether his mum died on the island?

We now know that the Man in Black can take the form of dead people whose corpses are on the island

But what about people who died elsewhere?

Can Jacob perform that feat but the Man in Black cannot? Was the vision of Emily Linus a manifestation of Jacob?

Categories
Politics

James Dyson’s report Ingenious Britain

BBC News: Conservative-endorsed report calls for science boost

Entrepreneur Sir James Dyson has produced a report titled Ingenious Britain for the Conservative Party urging a raising of the profile of science in the UK to help diversify the economy and boost growth. The pdf of Ingenious Britain can be downloaded here.

James Dyson makes the same argument that he made in 2004 when he gave the Richard Dimbleby Lecture, that the British economy cannot be sustained as merely a service economy. Manufacturing is the key to future success and it should lie in high tech goods where we have a competitive advantage. In fact things are now worse since his 2004 lecture as Design and Technology has been phased out of the curriculum at many schools since it was made non-statutory.

The part of Dyson’s report title Education: Getting young people excited about science and engineering made me think about James May’s Toy Stories which showed that although children initially thought stuff like Airfix and Meccano was boring that given the chance to play with it they really changed their minds. I think that if each class of maybe Year Six in schools were given a Meccano set then we’d end up with a lot more people going into engineering. Ironically Meccano is a British engineering success story that due to lessening interest in engineering in this country ended up becoming a foreign success story. Meccano is the only French manufacturer of toys that are internationally recognized, manufacturing part of its line in France.

Dyson believes that his company represents a good model for future British economic growth whereby the assembly of the products is done overseas but all the important engineering research and design is done in the UK. If this is to be the case for future success for British companies then we need to produce more engineers in our universities. In fact our universities are producing many excellent engineers unfortunately rather than being homegrown a large proportion of these are from overseas and many then return home to work.

Analysts of the current British economic crisis argue that the pound needs to remain low in order to boost are exports. But I believe that this does not need to be the case if the products we are exporting are competitive in ways more than just price. The Dyson vacuum cleaner is an excellent example, it is more expensive than rival vacuums but the benefits are worth the premium and it sells extremely well overseas even when the strong pound created an even greater premium in price than seen in the UK. Truly innovative products which are protected by patents can sell well and command a premium overseas.

Much of the British economic growth of the last few decades has been due to greater consumerism but the recession has brought that to a head and we are unlikely to see growth in the same way. We need to be more than just a nation of shopkeepers and because engineers are generally paid better than people in the service sector then a move to a greater proportion of the workforce being comprised of engineers is a good thing in many ways.

As well as the encouragement of engineering as a career choice Dyson recommends that tax breaks should be given in order to encourage investment into the development of innovations which do not necessarily produce a quick return on investment but do represent good long term growth.