Matt

Este foarte bine cum e acum, se vede ok.

Reporturi aiurea? 4. Unele categorii au regulament intern. Verific? dac? exist? un regulament sticky înainte de a posta într-o anumite categorie. În special categoriile "CERERI"(minim 10 posturi de CALITATE), "AJUTOR"(minim 10 posturi de CALITATE) sau "Bloguri ?i Bloggeri"(minim 50 posturi CALITATE). Arata-mi un report aiurea referitor la userii cu 1 post si anume cerere invitatie. Explica-mi ce nu se potriveste ca eu nu ma prind. N-am comentat niciodata cand am primit WARN, cei care mi-au dat pot confirma.Si nu am primit doar 1 sau 2 warn-uri. Scuze penibile tot gasesti, solutii nu.

Am observat ca cei care doresc sa se respecte regulamentul doresc sa ajunga pe o pozitie administrativa.Este replica tuturor de aici pentru atat le permite gradul de inteligenta. @Kabron : Bineinteles ca subscrii ce a zis Zatarra.Nu faci asta toata ziua? Pai, cine iti mai admira tie pozele cu muschi pe chat? @Zatarra : Nu se merita sa-ti raspund stiu ca doar atata poti.Eu ca user nu imi permit sa jignesc un moderator dar un moderator isi permita sa jigneasca un user. Inteleg.Dar acei useri au un simplu post sau pana in maxim 4-5 unde sunt doar invitatii filelist. Ce evolutie au ? Ca in primul post cer invitatie filelist si in al doilea pussytorrents? De ce se mai numeste RST daca incurajezi "valul de invitatii" ? De ce mai este Regulament daca nu se respecta ?

Saracutul de tine.Exact ala care respecta cel mai mult regulamentul este pe nedrept invinovatit.Ce ne facem acuma? Ia sa vedem cum respecta Kabron regulamentul : http://shareimage.ro/images/k30c27l86991v4243wd.png http://shareimage.ro/images/s4lnbwice0nk2n3i8nss.png + Multe altele pe care multi useri care stau pe chat le pot confirma.

Nu am treaba cu administratorii.Administratorii platesc hostul, se ocupa de partea tehnica e de inteles. Pentru restul de treburi sunt asa-numitii Moderatori.

Ca urmare a marelui val de useri nou-inregistrati care isi fac cont doar pentru a cersi invitatii/conturi si alte cacaturi m-am hotarat sa adun toate posturile ale userilor cu 1 singur post sau 2-3 CARE s-au inregistrat aici doar pentru a cersi aceste invitatii. Regulament 4. Unele categorii au regulament intern. Verific? dac? exist? un regulament sticky înainte de a posta într-o anumite categorie. În special categoriile "CERERI"(minim 10 posturi de CALITATE), "AJUTOR"(minim 10 posturi de CALITATE) sau "Bloguri ?i Bloggeri"(minim 50 posturi CALITATE). 11. Exist? buton de report post. 13. F?r? posturi despre Adf.ly, bux, tox, mux sau cum se mai cheam? site-urile pentru chineji care fac 2 dolari pe lun? ?i se bucur?. Se va l?sa cu warn. Am folosit de fiecare data frumos butonul "report" insa de asemenea nu s-a intamplat nimic / In fiecare semnatura se gasesc link-uri catre "metin hack" ; "Adf.ly" etc. Thread-urile in speta sunt : https://rstforums.com/forum/72745-gratis-conturi-filelist-si-alte-trackere.rst https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip.rst https://rstforums.com/forum/68563-ofer-invitatii-filelist.rst https://rstforums.com/forum/66136-invitatii-filelist-gratis.rst https://rstforums.com/forum/70177-invita-ii-myxz-org-xtremezone-gratuite.rst https://rstforums.com/forum/72733-cineva-o-invitatie-pe-filelist.rst https://rstforums.com/forum/46182-conturi-trackere-externe.rst https://rstforums.com/forum/71558-cont-filelist.rst https://rstforums.com/forum/71053-conturi-trackere.rst Toate aceste threaduri trebuiesc inchise.De ce ? Uitati de ce : https://rstforums.com/forum/24670-invitatii-filelist-invitatie-demonoid-invitatie-lasttorrents-invitatii-trackere.rst Simplu si la obiect. Mai jos este o lista cu toate link-urile la posturi ; acei useri merita banati si dusi la gunoi : https://rstforums.com/forum/72745-gratis-conturi-filelist-si-alte-trackere-2.rst#post472977 https://rstforums.com/forum/72745-gratis-conturi-filelist-si-alte-trackere-2.rst#post473116 https://rstforums.com/forum/72745-gratis-conturi-filelist-si-alte-trackere-2.rst#post474700 https://rstforums.com/forum/72745-gratis-conturi-filelist-si-alte-trackere-2.rst#post474928 https://rstforums.com/forum/72745-gratis-conturi-filelist-si-alte-trackere-2.rst#post477330 https://rstforums.com/forum/72745-gratis-conturi-filelist-si-alte-trackere-3.rst#post477335 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip.rst#post433447 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip.rst#post435995 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip.rst#post444297 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-2.rst#post451742 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-2.rst#post452069 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-2.rst#post463740 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-3.rst#post464202 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-3.rst#post467701 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-3.rst#post467702 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-3.rst#post472656 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-4.rst#post473988 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-4.rst#post474234 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-4.rst#post474936 https://rstforums.com/forum/63486-ofer-invitatii-filelist-vip-4.rst#post477752 https://rstforums.com/forum/66136-invitatii-filelist-gratis.rst#post434864 https://rstforums.com/forum/66136-invitatii-filelist-gratis.rst#post432681 https://rstforums.com/forum/66136-invitatii-filelist-gratis.rst#post432682 https://rstforums.com/forum/66136-invitatii-filelist-gratis.rst#post433508 https://rstforums.com/forum/66136-invitatii-filelist-gratis.rst#post434484 https://rstforums.com/forum/66136-invitatii-filelist-gratis-2.rst#post435127 https://rstforums.com/forum/66136-invitatii-filelist-gratis-2.rst#post435128 https://rstforums.com/forum/66136-invitatii-filelist-gratis-2.rst#post435810 https://rstforums.com/forum/66136-invitatii-filelist-gratis-2.rst#post435822 https://rstforums.com/forum/66136-invitatii-filelist-gratis-2.rst#post436742 https://rstforums.com/forum/66136-invitatii-filelist-gratis-3.rst#post436933 https://rstforums.com/forum/66136-invitatii-filelist-gratis-3.rst#post438350 https://rstforums.com/forum/66136-invitatii-filelist-gratis-3.rst#post438818 https://rstforums.com/forum/66136-invitatii-filelist-gratis-3.rst#post439447 https://rstforums.com/forum/66136-invitatii-filelist-gratis-3.rst#post440346 https://rstforums.com/forum/66136-invitatii-filelist-gratis-3.rst#post442168 https://rstforums.com/forum/66136-invitatii-filelist-gratis-3.rst#post443288 https://rstforums.com/forum/66136-invitatii-filelist-gratis-4.rst#post445889 https://rstforums.com/forum/66136-invitatii-filelist-gratis-4.rst#post446912 https://rstforums.com/forum/66136-invitatii-filelist-gratis-4.rst#post447075 https://rstforums.com/forum/66136-invitatii-filelist-gratis-4.rst#post447210 https://rstforums.com/forum/66136-invitatii-filelist-gratis-4.rst#post461129 https://rstforums.com/forum/66136-invitatii-filelist-gratis-4.rst#post467435 https://rstforums.com/forum/66136-invitatii-filelist-gratis-5.rst#post467889 https://rstforums.com/forum/66136-invitatii-filelist-gratis-5.rst#post468900 https://rstforums.com/forum/66136-invitatii-filelist-gratis-5.rst#post470208 https://rstforums.com/forum/66136-invitatii-filelist-gratis-5.rst#post471918 https://rstforums.com/forum/66136-invitatii-filelist-gratis-6.rst#post477148 https://rstforums.com/forum/68141-invitatii-filelist-gratis.rst#post440485 https://rstforums.com/forum/68141-invitatii-filelist-gratis.rst#post440901 https://rstforums.com/forum/68141-invitatii-filelist-gratis.rst#post441066 https://rstforums.com/forum/68141-invitatii-filelist-gratis-2.rst#post441085 https://rstforums.com/forum/68141-invitatii-filelist-gratis-2.rst#post441573 https://rstforums.com/forum/68141-invitatii-filelist-gratis-2.rst#post441659 https://rstforums.com/forum/68141-invitatii-filelist-gratis-2.rst#post441778 https://rstforums.com/forum/68141-invitatii-filelist-gratis-2.rst#post443156 https://rstforums.com/forum/68141-invitatii-filelist-gratis-2.rst#post445175 https://rstforums.com/forum/68141-invitatii-filelist-gratis-2.rst#post446788 https://rstforums.com/forum/68141-invitatii-filelist-gratis-3.rst#post447552 https://rstforums.com/forum/68141-invitatii-filelist-gratis-3.rst#post448650 https://rstforums.com/forum/68141-invitatii-filelist-gratis-3.rst#post451207 https://rstforums.com/forum/68141-invitatii-filelist-gratis-3.rst#post454529 https://rstforums.com/forum/68141-invitatii-filelist-gratis-3.rst#post462617 https://rstforums.com/forum/68141-invitatii-filelist-gratis-3.rst#post465111 https://rstforums.com/forum/68141-invitatii-filelist-gratis-3.rst#post466054 https://rstforums.com/forum/68141-invitatii-filelist-gratis-3.rst#post467704 https://rstforums.com/forum/68141-invitatii-filelist-gratis-4.rst#post468899 https://rstforums.com/forum/68141-invitatii-filelist-gratis-4.rst#post475310 https://rstforums.com/forum/68141-invitatii-filelist-gratis-4.rst#post475529 https://rstforums.com/forum/68141-invitatii-filelist-gratis-4.rst#post477146 Sunt absolut sigur ca nu se va intampla nimic dupa acest thread si anume ca niciunul dintre acei useri nu vor fi banati. Este mai usor sa fie banati userii pe forum pentru ce se intampla pe chat ( vezi cazul Oust ), la o adica daca cineva indrazneste "Doamne fereste" sa-i zica ceva domnului moderator cu culoarea Kabron automat primeste si ban pe forum de la anumiti catelusi. Este mai greu sa fie banati userii care nu respecta regulamentul. Domnule "Zatarra", mi-a luat maxim 5 minute sa gasesc acesti useri si imi ia maxim 10 minute sa ii banez si sa inchid aceste threaduri. ( Asta pentru ca spuneai ca nu te poti ocupa de aceste posturi deoarece n-ai un sistem sa ii cureti ). Postul se refera strict la "Regulament" nu am nimic personal cu niciunul dintre voi vreau doar sa ajut.

o pula nu vrei ? Iti faci cont sa cersesti invitatii pe trackere bagami_as pula invitatiile voastre !

Description : WATOBO, the Web Application Toolbox, is a tool that enables security professionals to perform highly efficient (semi-automated) web application security audits. It acts like a local proxy and analyzes the traffic on the fly for helpful information and vulnerabilities. It also has automated scanning capabilities, e.g. SQL injection, cross site scripting and more. Author : Andreas Schmidt Download : HERE

IDG News Service - Oracle has revamped the user interface for its MySQL Workbench administration software, streamlining a number of routine operations and adding some new time-saving features as well. "The enhanced design in the multi-platform GUI not only increases usability and productivity of the tool, but also offers new database management capabilities," wrote Oracle senior product manager Mike Frank, in a blog post announcing the new release. Overall, Oracle made over 200 changes to the community edition to the software, based on user feedback, according to the company. Run by itself, Oracle's open-source MySQL database management system can only be operated from the command line, so MySQL Workbench, which is a separate application, provides a GUI administration interface that provides point-and-click operations to many MySQL administration tasks, as well as visual tools for SQL development and data modeling. Prior to this release, the Workbench offered a boxy and occasionally clunky user interface, so the updated look and feel brings it more into line with other more modern programs. The developers also took this opportunity to add in some new features. Managing schemas gets easier in a number of ways, thanks to the update. A new schema inspector provides details of all the objects in a schema, and provides access to maintenance operations such as analyze and optimize table. It can now also synchronize entity-relationship models with live schemas. The software can now display the results of queries as column/value pair lists, which promises to better display those queries that result in many columns, but comparatively few rows. It can reduce the work on some routine operations, such as cascading delete commands for rows referenced by foreign keys, which minimizes the tedious chore of executing a number of delete commands individually. A new table data search function provides a way to search for text across multiple tables and schemas. On the administration side, MySQL Workbench now provides a summary of a the operational status and configuration of a server running MySQL. It also provides a way to migrate databases from other database management systems, specifically from Microsoft SQL Server, Sybase Adaptive Server Enterprise and PostgreSQL. Additional support has also been added for Sybase SQL Anywhere and SQLite. The community edition of MySQL Workbench is available free of charge under the open source GPL (GNU General Public License) license. The commercial edition of the product is included in the MySQL Enterprise Edition subscription. The updated enterprise edition comes with a number of exclusive new features. The backup utility now can set up, schedule and run backups, as well as view their progress as they run. Also, restoration of data can now be automated. The new enterprise edition also comes with an audit log inspector to browse, filter, search and analyze audit MySQL log data. Oracle has prepared MySQL Workbench to work on computers running Microsoft Windows, Mac OS X (versions 10.6+ and newer), Red Hat Enterprise Linux 6, Oracle Linux 6, Fedora 18, Ubuntu 12.04 and Ubuntu 13.04 The company will hold a seminar Thursday 15 to explain in more detail the new features of the software. Joab Jackson covers enterprise software and general technology breaking news for The IDG News Service. Follow Joab on Twitter at @Joab_Jackson. Joab's e-mail address is Joab_Jackson@idg.com Source ComputerWorld.Com

TEXAS : A student named Marshall Williams,18 allegedly hacked into a secure school network and printing sensitive data, earlier this year student complained that his English teacher would not accept a report on guns. Williams has been arrested on felony charges on Thursday for allegedly hacking into a secure school network and printing sensitive data. Local police in Denton, Texas, arrested Marshall Williams, 18, and charged him with the breach of government computer security, My Fox 4 in Dallas-Fort Worth reported. Williams hacked Denton High school’s WiFi security in March and April using a stolen ID and password. The teen hacker was able to gain access to sensitive data including alarm codes, the school’s crisis plan, a master key list, employee records and student test results. He even reportedly printed out the test results and security codes on campus, using school printers. It’s not clear whether or not Williams did anything with that information, according to My Fox 4. Williams now being held in the Denton City Jail. Source HackersNewsBulletin.Com

In a report by The Telecommunication Service Providers of Kenya (TESPOK) which analyzes the cyber threats that target the country’s systems, China is the country from where most of the Malicious software found on Kenyan systems. China is closely followed by the United States and Korea, but Brazil, South Africa and India are also on the list, Daily Nation informs. The report is based on data collected from various Kenyan organizations by TESPOK’s Industry Computer Security and Incident Response Team (ICSIRT) over a period of three months ending in June 2013. Malwares which were identified in most of the place are the Slammer Worm and Mariposa Trojan. VoIP services have been identified as being a favorite attack vector for phishing scams, toll fraud, denial-of-service (DOS) attacks and eavesdropping. Source HackersNewsBulletin.Com

Afghanistan hackers launched a massive cyber attack against Pakistan, claiming a response to the rocket attacks of Pakistan military on Kunar and Jalalabad Provinces of Afghanistan. Today, the group has defaced more than 100 high profile Pakistan website that includes few Government websites and Educational websites. The hacked government websites : Web Design Company(ajklgrd.gov.pk), Society of Facilitators and Trainers (SOFT) Pakistan(lg.gok.pk), lgrdd.gok.pk, lgrd.gok.pk. International Islamic Grammar School(IIGS.edu.pk) also defaced in the recent cyber attack. The full list of hacked websites can be found here : 100 High Profile Pakistani websites Got Hacked by Afghan Cyb - Pastebin.com At the time of writing, most of the websites are still defaced or showing some error messages. Source EhackingNews.COm

Earlier Today, a Pakistani Hacker with online handle "Dr@cul@" hacked into several Indian websites including one Indian Government website and defaced them. The hacked government website is "envisddd.gov.in". I'm not able to find the exact usage of this website. The google cache displays "account suspended" page. Another Pakistani hacker with handle "Hasnain Haxor" claimed to have hacked more than 500 Indian websites and defaced them. "Indian's Be ready cyber war begin " The hacker send a warning message. At the time of writing, the Government domain "envisddd.gov.in" is taken offline, few other websites displays "under construction" message. Source EHackingNews.Com

A leader of the US congressional insurrection against the National Security Agency's bulk surveillance programs has accused his colleagues of withholding a key document from the House of Representatives before a critical surveillance vote. Justin Amash, the Michigan Republican whose effort to defund the NSA's mass phone-records collection exposed deep congressional discomfort with domestic spying, said the House intelligence committee never allowed legislators outside the panel to see a 2011 document that described the surveillance in vague terms. The document, a classified summary of the bulk phone records collection effort justified under Section 215 of the Patriot Act, was declassified by the Obama administration in late July. The Justice Department and intelligence agencies prepared it for Congress before a 2011 vote to reauthorize the Patriot Act, and left it for the intelligence committees in Congress to make the document available to their colleagues. "It is not acceptable for the intelligence committee, or any other committee, to withhold critically important information pertaining to a program prior to the vote," Amash told the Guardian. While the document does not go into great detail about the program, first revealed by the Guardian through documents provided by former NSA contractor Edward Snowden, it does tell legislators that NSA is collecting phone records in "bulk" from Americans. The Obama administration and intelligence agencies have pointed to the availability of the document as an example of keeping Congress fully informed about controversial NSA surveillance. "We believe that making this document available to all members of Congress, as we did with a similar document in December 2009, is an effective way to inform the legislative debate about the reauthorization of Section 215," assistant attorney general Ronald Weich wrote to the Republican and Democratic leaders of the House intelligence committee on February 2 2011. The hundreds of members of Congress who did not serve on the intelligence committee were to be told they could read the document in a secured facility. But Amash claimed on his Facebook page that never happened. "I can now confirm that the House permanent select committee on intelligence did not, in fact, make the 2011 document available to representatives in Congress," Amash wrote late Sunday, "meaning that the large class of representatives elected in 2010 did not receive either of the now declassified documents detailing these programs." A spokeswoman for the House intelligence committee, Susan Phelan, did not return a message from the Guardian on Monday. The committee staff said only Phelan was authorized to address the press. But one of Amash's Democratic colleagues, a former member of the House intelligence committee, backed Amash's claim. "I was not aware of the document," Rush Holt, a New Jersey Democrat, told the Guardian. "This is another example of the difficulty in Congress exerting any oversight of the intelligence community, because the information is frequently not made available to all members." The intelligence committees in Congress receive access to classified information that non-members rarely receive. Legislators not on the secretive panels often look to their colleagues who serve on them as barometers of opinion about the appropriateness of intelligence activities. Amash said that he had no reason to believe that a similar summary document about the bulk phone records collection, prepared for release in 2009, was similarly withheld. That raised the specter of the intelligence committee, which is charged with overseeing the NSA, withholding information from members elected in the 2010 election, when many libertarian and Tea Party Republicans uncomfortable with government power – like Amash – won office. "Nobody I've spoken to in my legislative class remembers seeing any such document," Amash told the Guardian. "We checked back with the committee, and it was not offered to members." Amash speculated that congressional leaders and intelligence committee leaders were "concerned the Patriot Act would not pass" if the newer class of legislators knew about the NSA's bulk phone records collection. "In fact, the first time it was brought up, it was brought up under suspension, and it did not pass," Amash said. The accusation represents an escalation between Amash and the intelligence leadership, which fiercely fought his late-July effort to end the NSA's bulk collection of American phone records. The panel chairman, Amash's fellow Michigan Republican Mike Rogers, swiped at the younger congressman during a raucous July 24 floor debate: "Are we so small that we can only look at our Facebook "likes" today in this chamber?" Rogers has pledged to introduce greater privacy protections over the bulk phone records program when his committee takes up the annual intelligence funding bill after the August congressional recess. Amash, meanwhile, has pledged to renew his efforts to vastly restrict the NSA's ability to collect phone data on Americans without individual suspicion of wrongdoing. Asked if it would be possible to work with the Rogers and the House intelligence committee leadership after learning the committee withheld the document, Amash replied: "I don't know." Source TheGuardian.Com

Network security firm Palo Alto Networks announced new capabilities in its WildFire malware analysis sandbox, saying that the technology can now analyze Android applications in the APK file format to detect threats embedded within Android applications. Introduced in November 2011, WildFire helps combat modern malware, which is often highly targeted, unknown, and evasive. WildFire’s sandbox helps identify unknown malicious files by executing them in a virtual cloud-based environment, in an attempt to identify malicious behavior, even if the files have never been seen before or identified as malicious elsewhere. The company said that its WildFire technology now searches major Android marketplaces for new applications to analyze and generates a signature for apps determined to be malicious that can be downloaded by Palo Alto Networks customers to protect their networks from these mobile threats. Unlike most security solutions that focus on the endpoint, Palo Alto Networks WildFire captures malware in the network and in the wild, and actively analyzes it in a virtualized Android environment to proactively protect networks against new APK-based malware, the company explained. According to the International Data Corporation (IDC) Worldwide Quarterly Mobile Phone Tracker, Android maintained its leadership position in Q2 2013 with a 79.3% market share based on 187.4 million units shipped. With such a high market share, Android’s popularity makes it an increasingly attractive target for cyber criminals. According to ESET research, from 2011 to 2012, Android malware grew by a factor of 17. According to a report from Trend Micro released last week, the number of malicious and high-risk Android apps jumped by more than 40 percent during the past few months. The number of risky apps hit 718,000 at the end of the second quarter compared to 509,000 in the first quarter, Trend Micro said. Palo Alto Networks said that it currently has coverage for more than 300,000 pieces of Android malware. According to Wade Williamson, a SecurityWeek columnist and Senior Security Analyst at Palo Alto Networks, while threats targeting mobile devices are still relatively rare compared to what we see in terms of malware targeting PCs, security teams need to prepare for these emerging threats. “As security professionals, it’s our job to see around the corner whenever possible,” Williamson noted in a recent SecurityWeek column. “While the sky is not falling, if controlling mobile malware isn’t on your radar, it definitely should be.” Source Securityweek.com

According to new research from soon-to-go-public security firm FireEye, the threat actors behind the attacks against the New York Times late last year appear to be using upgraded versions of the malware they use, and are conducting a new wave of attacks. These new attacks appear to be the “first significant stirrings from the group since it went silent in January” after a report exposed the group and its exploits, which security researchers believe is a massive spying operation stemming from China. The newest campaign uses updated versions of Aumlib and Ixeshe, FireEye said. According to the security firm, Aumlib now encodes certain HTTP communications and FireEye researchers spotted the latest malware variant when analyzing a recent attack against an organization involved in shaping economic policy. FireEye also said a new version of Ixeshe uses new network traffic patterns, possibly to evade traditional network security systems. The Ixeshe attacks, which have been traced back to at least July 2009, have been used to secretly gain access to large multinational corporations. Trend Micro previously found that Ixeshe was targeting East Asian governments, electronics manufacturers, and telecommunications companies, and had used compromised servers housed inside targeted organizations as command-and-control (C&C) servers. In a previous interview, Tom Kellermann, vice president of cybersecurity at Trend Micro, told SecurityWeek that the technique of using compromised servers as C&C servers was being adopted by elite hacker crews, and he rated the sophistication of the Ixeshe campaign as a 9.3 out of 10. Interestingly, despite the assumed success of the attacks, the Aumlib malware itself had not changed since at least May 2011, and Ixeshe had not evolved since at least December 2011, FireEye said, noting that the recent updates are significant for both malware families. “When a larger, successful threat actor changes up tactics, the move always piques our attention,” FireEye researchers Ned Moran and Nart Villeneuve noted in a blog post Monday. “Naturally, our first priority is ensuring that we detect the new or altered techniques, tactics, or procedures (TTPs). But we also attempt to figure out why the adversary changed — what broke? — so that we can predict if and when they will change again in the future.” “We cannot say for sure whether the attackers were responding to the scrutiny they received in the wake of the episode,” the researchers continued. “But we do know the change was sudden. Akin to turning a battleship, retooling TTPs of large threat actors is formidable. Such a move requires recoding malware, updating infrastructure, and possibly retraining workers on new processes.” FireEye said a sample of Aumlib (Backdoor.APT.Aumlib) was found being used against an organization involved in shaping economic policy, that incorporated subtle changes could be enough to evade existing IDS signatures designed to detect older variants of the Aumlib family. For Ixeshe (Backdoor.APT.Ixeshe), FireEye analyzed a sample that appears to have targeted entities in Taiwan, activity consistent with previous Ixeshe targets. According to FireEye, the new Ixeshe variant revealed network traffic that does not match the earlier pattern and also has the potential to evade existing network traffic signatures designed to detect Ixeshe related infections. "Innovative and clever" attacks such as the one against the New York Times is why security experts recommend organizations deploy layered security mechanisms and not just rely on one single mode of protection, Kurt Hagerman, the director of information security at FireHost, told SecurityWeek in February. The best defense for Web applications and software is an intelligent security model, which incorporates numerous layers of protection, including DDoS mitigation, IP Reputation Filtering, web application protection, virtual and hardware based firewalling, and IDS/IPS, Hagerman said. “Knowing how attackers’ strategy is shifting is crucial to detecting and defending against today’s advanced threats,” Moran and Villeneuve noted. “But knowing the ‘why’ is equally important. That additional degree of understanding can help organizations forecast when and how a threat actor might change their behavior — because if you successfully foil their attacks, they probably will.” Source SecurityWeek.Com

Dmitriy Smilianets was allegedly involved in the biggest hacking scheme ever prosecuted in the U.S., which cost Heartland, 7-Eleven, JetBlue, and others more than $300 million. One of the five men accused of perpetrating the largest hacking scheme ever prosecuted in the U.S., which culminated with the theft of more than 160 million credit card numbers, pleaded not guilty on Monday, according to Reuters. The charges levied against Dmitriy Smilianets, 29, include conspiracy to commit wire fraud, wire fraud, and unauthorized access to computers. If convicted, he could spend the next 65 years in prison. Smilianets is originally from Russia but was extradited to the U.S. from the Netherlands last year. On Monday, he entered his not guilty plea in federal court in Newark, N.J. According to Reuters, his lawyer plans to fight the charges and look for irregularities around Smilianets' arrest in the Netherlands. The massive breach that Smilianets was allegedly involved in including hacks into a handful of prominent companies, such as Heartland Payment Systems, 7-Eleven, JetBlue Airways, and J.C. Penny. The hack is said to have cost the companies a combined total of more than $300 million. According to Reuters, Nasdaq was also breached, but this information wasn't released until last month when the feds accused the group of five of carrying out the massive hacking scheme. Prosecutors told Reuters the Nasdaq breach didn't include the stock trading platform and that the hackers weren't able to get any money from this specific breach. The hacking group's cyberattacks began in 2005 and lasted at least until the summer of 2012, according to federal prosecutors. Of the five accused, one other accused hacker is in custody, while the three others are still considered on the run. The group of hackers allegedly visited the stores of certain retailers to discover any holes in their payment systems. They were also allegedly able to install software on some of the company's computer systems, opening up a back door into the systems. They were said to have used computers around the world for storing malware and stolen data and launching attacks. Once they allegedly obtained stolen credit card numbers, the hackers supposedly sold the numbers to others who then encoded the data onto magnetic stripes of blank cards. These blank cards could then be used to withdraw thousands of dollars from ATM machines. The alleged mastermind behind one of the attacks, Albert Gonzalez, was caught and charged in 2008, and sentenced to 20 years in prison in 2009. According to Reuters, Smilianets allegedly worked with Gonzalez but once the mastermind was arrested, Smilianets broke off on his own and allegedly carried out more cyberattacks. Source CNET.COM

Google has increased the amount it will pay security researchers for information about flaws in its Chrome browser, having already shelled out more than $2m in bug bounties across its various security reward programs. "In a nutshell, bugs previously rewarded at the $1,000 level will now be considered for reward at up to $5,000," Chris Evans and Adam Mein, the Chocolate Factory's "masters of coin", wrote in a blog post on Monday. The higher rewards will be offered to researchers who discover bugs that pose "a more significant threat to user safety," and who provide an accurate analysis of the threats and how easy they would be for attackers to exploit. Even with the increased reward amounts, Google will continue to offer additional bonuses for certain types of bug disclosures, such as when a researcher finds a bug in an area of the code that was thought to be stable, or when a bug also has consequences for other software besides Chrome. The online ad-slinger says it has already paid out more than $1m in bounties through its Chromium Vulnerability Reward Program and its Pwnium competition, plus another $1m or so for its Google Web Vulnerability Reward Program. The bounties have been good business for some hackers, several of whom have claimed multiple awards. One of the most frequently rewarded Chrome bug hunters, Sergey Glazunov, has claimed bounties totaling more than $150,000 to date. But then, that's still peanuts compared to what Google would have to pay Glazunov and his fellow bug-bounty winners to work as security staffers on the Chrome team. In fact, a recent paper published by researchers at the University of California at Berkeley found that over a three-year period, Google's bug bounty programs cost it less than it would likely have paid a single full-time employee. In effect, Monday's rate increase means Google's crowdsourced, virtual security researcher just got a raise – albeit not a very big one. Hackers who are interested in cutting themselves a slice of Google's bug-bounty pie are directed to the company's guidelines for reward eligibility, as well as to its directions explaining how to do a good job of reporting bugs. ® Source TheRegister.co.uk

Linux 3.11 rc 5 emerges on an important day Linus Torvalds has issued release candidate five for Linux 3.11, but is a little upset with the fact the final release missed a serendipitous anniversary. The date in question is August 11th, 1993, as it was on that day that Windows 3.11 emerged blinking and howling into the world. Torvalds liked the idea that Linux 3.11 would debut on that day, but has written “Sadly, the numerology doesn't quite work out, and while releasing the final 3.11 today would be a lovely coincidence (Windows 3.11 was released twenty years ago today), it is not to be.” The good news is that “3.11-rc5 … is showing signs of calming down, and is noticeably smaller than previous rc's (both in number of commits and in size of patch).” “There really doesn't seem to be anything major here,” he adds. “The radeon changes are likely the most noticeable, but many of them are for the dynamic power management that is still off by default.. Other than that, misc media fixes, arch updates, some small filesystem updates etc. Nothing really stands out.” ® Source TheRegister.co.uk

Over the weekend, it emerged that a flaw in Android's Java-derived pseudo-random number generator (PRNG) created a vulnerability that allowed the theft of Bitcoins. The individual responsible identifying the nasty bug, Jean-Pierre Rupp, has now contacted The Register by e-mail to confirm how he was able to track down the problem. Rupp says his investigations began as the result of a complaint from a friend, who suspected that his Android phone had been hacked. However, Rupp says, he considered a successful remote Bitcoin-theft hack was unlikely. This, Rupp told Vulture South, led him instead to speculate that “somebody found his private key through cryptanalysis on the Bitcoin blockchain (the public ledger where all transactions are kept).” Rupp's investigations then led him to a similar complaint in July (here). His reply to that post (as user Xeno-Genesis) reported his friends experience and noted that he was investigating the problem. “The common factor seemed to be Android, and I immediately thought about the possibility of a flaw in its pseudo-random number generator (PRNG),” Rupp told The Register. Rupp identified this conference paper, also linked in The Register's earlier story, and brought it to the attention of Google security engineer Mike Hearn. “I also pointed to him that his BitcoinJ code was using that PRNG in the regular non-seeded way, which triggered the flaw,” Rupp told The Register. “I originally suggested that private key collisions may have being found and exploited. Later on the weekend a reply to the Bitcoin forum post by johoe clarified that the issue with the PRNG was leading to collisions in the random number parameter /k/ that the elliptic curve signature algorithm needs in order to be secure, making it trivial to extract the private key from two transactions that used the same /k/,” Rupp told Vulture South. Hearn has told The Register that one of the posts, referred to in yesterday's story relates to a different key-collision issue. “Nils' [ Schneider] blog post isn't anything to do with this incident. If you read to the end, the bad transaction he found was generated using a prototype hardware wallet not an Android device. His blog post is a nice walkthrough of the maths involved with recovering a private key given two colliding signatures, but it has no relevance beyond that.” The Register is happy to include this correction. We have also asked Google to comment on why developers were not warned earlier about issues with using SecureRandom, given the March publication date of the RSA conference paper. ® Source TheRegister.co.uk

British author H.M. Forsyth was working on a book in the British Library last week when he needed to read Shakespeare's Hamlet, so he did what anyone would do these days: he Googled it, safe in the knowledge that MIT has put the Bard's entire output online. And that's when something nasty happened: The Library's WiFi denied him access to the play because it was deemed too violent for the gentle folk who uses its networks. Forsyth felt blocking Hamlet was a fine example of how conscience doth make cowards of us all, felt it best not to endure the the slings and arrows of outrageous fortune and instead decided to take arms against a sea of troubles by approaching Library staff to ask what was going on. The woman he spoke too had no idea what was going on and doth protest too much. Feeling something was rotten in the state of Denmark and that madness in great ones must not unwatched go, Forsyth fired off what he's described as “an angry e-mail”. He also penned the blog post we've linked to above and hit Twitter to publicise it. The Library quickly responded, on Twitter, that it has fixed its filters so The Bard is no longer barred. Forsyth's now rather happier that Shakespeare, who has been described in the Twitter stream flowing from his original posts as “an important British author”, is now available over the Library's WiFi. Here at The Reg, we think Forsyth's actions recallanother Hamlet quote: Source TheRegister.co.uk

Deutsche Telekom and United Internet have launched a super-secure German email service that they claim defeats the data-sniffing shenanigans of the likes of the NSA. The partners announced that they were starting an initiative for "secure email communication across Germany". "Germans are deeply unsettled by the latest reports on the potential interception of communication data," René Obermann, CEO of Deutsche Telekom, said in a statement. "Our initiative is designed to counteract this concern and make email communication throughout Germany more secure in general. Protection of the private sphere is a valuable commodity." The head of United Internet, Ralph Dommermuth, added that the initiative, dubbed "Email made in Germany", would be open to other providers, as long as they "commit to the standards set out". "Alongside email encryption and the designation of secure e-mail addresses, a third key element relates to data processing and archiving, which is carried out in Germany. This ensures that Germany's stringent data privacy laws are complied with," he said. German broadcaster Deutsche Welle reports (in English) that email traffic sent via the new system will “be encrypted while in transit between the sender and receiver”. Access to third parties “is to be granted only in compliance with German law”. The new service appears to be a reaction to the revelations from NSA whistleblower Edward Snowden that the US National Security Agency has been peeking at email, text and call data from around the world. While encrypted email may sound like a great idea, it may not work with email sent outside of Germany and the EU. Indeed, Deutsche Welle's report confirms that the encryption will only apply to emails sent between German email providers T-Online, GMX and Web.de. Emails sent to addresses on servers outside of the country will therefore be outside Germany's purview, and will not necessarily be automatically encrypted. ® Source TheRegister.co.uk

Un studiu realizat de Google Apps in Anglia dezvaluie cele mai comune parole alese de internauti, care nu garanteaza un nivel de securitate prea ridicat. Retele de socializare, adrese de mail, operatiuni bancare online, aplicatii de tot felul sunt tot atatea instrumente securizate unde este nevoie de parole, scrie lefigaro.fr. Se pare insa ca internautii nu se gandesc prea mult cand isi aleg parolele, adesea obisnuite sau putin personalizate, ceea ce le face usor de ghicit. Intr-un studiu recent, Google Apps arata, de exemplu, ca un internaut britanic din sase foloseste ca parola numele animalului de companie. Tot atatia utilizeaza o data speciala pentru ei, cum ar fi data nasterii sau a casatoriei. Sunt ghicitori usor de dezlegat de internauti rau intentionati. Alte parole nerecomandate si totusi folosite pe scara larga sunt numele unui copil din familie, numele unui alt membru al familiei, locul nasterii utilizatorului, locul preferat pentru vacanta, sportul favorit sau numele unei echipe sportive... Unii internauti folosesc chiar termenul "password". Cele mai proaste 25 de parole Site-ul splashdata a publicat un studiu in care enumera cele mai nefericite 25 de parole din 2012. Printre acestea, suita de numere "123456", "abc123", "dragon", "baseball", "iloveyou", dar si "jesus", "welcome" sau "football". In studiu se mai mentioneaza ca 48% din cei intervievati au declarat ca au comunicat parola unei alte persoane, in timp ce 3% spun ca si-au scris parola pe o bucata de hartie pusa aproape de calculator. Recomandarea este ca parola sa fie complicata, dar si usor de retinut. Acesta este pretul securitatii, incheie lefigaro.fr. Source TheRegister.co.uk

Locuitorii oraselului Green Bank din Virginia de Vest, Statele Unite, par sa duca o viata extrem de aspra, deoarece nu au acces la radio sau telefoane mobile. Situatia este cauzata de faptul ca micutul orasel cu 149 de locuitori se afla in mijlocul unei zone de peste 33.000 de kilometri patrati in care comunicatiile ce folosesc unde electronice sunt interzise. Oamenii de stiinta folosesc aceasta zona pentru comunicatiile spatiale si nu permit echipamentelor electronice personale sa perturbe semnalele. Acest lucru inseamna ca zona trebuie sa fie fara radio, TV, WIFI, telefoane mobile sau bluetooth. Green Bank gazduieste cel mai mare radiotelescop rotativ din lume. Pentru a permite telescopului sa functioneze fara probleme, orasul a interzis complet folosirea echipamentelor electronice pentru comunicatii, iar patrulele politiei verifica orice semnal electronic ce ar incalca interdictia. Un singur telefon public pentru toata localitatea Numai serviciile de interventie au voie sa foloseasca radioul, iar in localitate exista un singur telefon public. Localnicii au acces la internet, dar la vitezele oferite de conexiunile de tip dial-up. Evident ca toate acestea fac dificil traiul modern pentru rezidentii din zona, insa sunt privite pozitiv de multi alti oameni care au venit aici, incepand cu mijlocul anilor 2000, in incercarea de a scapa de tehnologie. Multi dintre cei nou veniti spun ca sufera de hipersensibilitate electromagnetica (EHS), maladie nerecunoscuta de comunitatea medicala. Unii oameni cred ca undele provocate de echipamentele electrice ii fac sa se simta rau, sa aiba alergii, iar Green Bank este unul din putinele locuri unde pot trai sanatosi. "Viata nu este perfecta aici", spune o femeie. "Nu exista magazine, restaurante sau un spital apropiat. Dar cel puti aici sunt sanatoasa. Pot sa fac diverse lucruri. Nu stau tot timpul in pat cu dureri de cap". Source Business24.Ro

All-flash storage vendor Violin Memory claims to be closing the gap between the cost of solid state drive (SSD) storage and that of traditional spinning disks media with the launch of its latest array. Announced today, Violin's 6264 flash memory array fits 64TB of flash memory into a 3U rack-mount chassis. With this capacity, it delivers twice the density and three times the economics of its predecessor, according to the firm, while significantly reducing power consumption as well. Thanks to Violin's partnership with Toshiba, the new array is based on Toshiba's latest generation of 19nm flash technology, which enables it to deliver the performance and reliability needed to enable an all-flash product to replace traditional hard drives. The Violin 6264 is capable of 750,000 4KB-sized input/output operations per second (IOPS), compared with 500,000 for its predecessor. However, its power consumption has actually been reduced to 1500W from 1750W in the earlier model. Don Basile, chief executive of Violin Memory said that the firm's Violin Memory Operating System (VMOS) that its arrays run enables it to offer the reliability and performance that customers require. "Violin's unique flash management IP enables us to increase performance and capacity in the same footprint while ensuring the data resiliency required in Tier 1 enterprise storage deployments. Our goal is to deliver memory storage at the cost of legacy disk," he said. The Violin 6264 supports 8Gbps Fibre Channel, 10Gbps Ethernet iSCSI, and 40Gbps Infiniband host connectivity options. Violin declined to disclose the exact price of the Violin 6264, and instead told V3 that the array would cost under $5 (£3.22) per gigabyte street price. Source V3.co.uk