Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror

Comment Re:Working on it (Score 1) 148

You claim it's not a transponder, but admit it's an active system, so that implies some sort of RF transmitter -- which opens up the question of spectrum access.

You claim that it operates below the RF floor. That implies it knows the signal it should be looking for, otherwise there's some fancy DSP footwork going on that smells like the wrong end of a cow in the size and weight you're talking about, particularly if you include the power and antenna setup for a transceiver, and still have the range you're talking about.

If you are making an SSR-type system, then that saves on power / weight, but you're in the class of TCAS, IFF, ADS-B, TACAN (Air-to-Air), and back into the world of transponders.

If there's two elements to the sense component, you've recreated the sense rails from an NDB / ADF, but that doesn't provide ranging, even with a known rate of crossing, and signal strength alone is never relied upon for ranging in the airborne environment.

If it's below the RF floor as you claim, then fit it to two mountain bikes and ride them at each other for the testing, as it's unlikely to have much of a RADHAZ distance. Or, fit it to your car. Or anything. You don't go and test things like this by bolting it to aircraft straight up. You'll also get more repeatable and falsifiable results.

I'm not saying it's impossible, or whether what you've come up with is close to anything else that already exists. I suspect it's the latter but, unless you've spent a lot of time around those sort of systems, you're not going to know what does and doesn't exist.

Security

Submission + - Apple and Microsoft Release Critical Patches (beskerming.com)

SkiifGeek writes: "Both Microsoft and Apple have released major security updates in the last 24 hours.

Microsoft's single update (MS09-017) addresses fourteen distinct vulnerabilities across all supported versions of PowerPoint, but it isn't how many vulnerabilities that are patched that is causing trouble. Instead, the decision to release the patch for Windows versions while OS X and Works versions remain vulnerable to the same remote code execution risks (including one that is currently being exploited) hasn't gone down well with some people. Microsoft have given various reasons why this is the case, but this mega-update-in-a-patch is still interesting for other reasons.

Apple have updated OS X 10.5 to 10.5.7 as part of the 2009-002 Security Update (available right here), as well as a cumulative update for Safari 3 and the Public Beta for 4. As well as addressing numerous significant security risks, the 10.5.7 update provides a number of stability and capability enhancements and incorporates the Safari 3 update patch. Probably the most surprising element of the Apple update is the overall size of it, 442MB for the point update, and 729MB for the ComboUpdate."

Security

Submission + - PDF Vulnerability Now Exploitable With no Clicking (beskerming.com)

SkiifGeek writes: "With Adobe's patch for the current PDF vulnerability still some time away, news has emerged of more techniques that are available to exploit the vulnerability, this time without needing the victim to actually open a malicious file. Instead, the methods make use of a Windows Explorer Shell Extension that is installed alongside Adobe Reader, and which will trigger the exploitable code when the file is interacted with in Windows Explorer. Methods have been demonstrated of successful exploitation with a single click, with thumbnail view, and with merely hovering the mouse cursor over the affected file.

There are many ways that exploits targeting the JBIG2 vulnerability could be hidden inside a PDF file, and it seems that the reliability of detection for these varying methods is spotty, at best."

Security

Submission + - SquirrelMail Repository Poisoned (beskerming.com)

SkiifGeek writes: "Late last week the SquirrelMail team posted information on their site about a compromise to the main download repository for SquirrelMail that resulted in a critical flaw being introduced into two versions of the webmail application (1.4.11 and 1.4.12).

After gaining access to the repository through a release maintainer's compromised account (it is believed), the attackers made a slight modification to the release packages, modifying how a PHP global variable was handled. As a result, it introduced a remote file inclusion bug — leading to an arbitrary code execution risk on systems running the vulnerable versions of SquirrelMail.

The poisoning was identified after it was reported to the SquirrelMail team that there was a difference in MD5 signatures for version 1.4.12.

Version 1.4.13 is now available."

Security

Submission + - Critical .mdb flaw Found - Microsoft may Never fix (beskerming.com) 4

SkiifGeek writes: "When independent security researcher cocoruder found a critical bug with the JET engine, via the .mdb (Access) file format, he reported it to Microsoft, but Microsoft's response came as a surprise to him — it appears that Microsoft are not inclined to fix a critical arbitrary code execution vulnerability with a data technology that is at the heart of a large number of essential business and hobby applications.

Where should vendors be required to draw the line when supporting deprecated file formats and technology? In this case, leaving a serious vulnerability active in a deprecated technology could have serious effects if an exploit were to target it, but it is a matter of finding the right balance of security and usability such that Microsoft's users are not exposed to too great a danger for continuing to use Microsoft products."

Privacy

Submission + - AntiSocial Response to OpenSocial (beskerming.com)

SkiifGeek writes: "Microsoft employees have already openly criticised Google's OpenSocial initiative (covered here), and now there's news that one of the first OpenSocial applications, emote — by Plaxo, was hacked within 45 minutes of appearing on the net (it was subsequently pulled while Plaxo looked into fixing the holes). Although coding errors can happen to anyone, leaving evidence of lax programming discipline when all it takes to view your code is 'View Source' is poor form.

It seems that the battle lines have been drawn between Microsoft and Google through their social networking proxies, with Facebook getting ready to fire the next salvo in the social networking battle."

Internet Explorer

Submission + - AntiVirus Products fail to find Simple IE malware (beskerming.com) 4

SkiifGeek writes: "Didier Stevens recently took a closer look at some Internet Explorer malware that he had uncovered and found that most antivirus products that it was tested against (courtesy of VirusTotals) failed to identify the malware through one of the most basic and straight forward obfuscation techniques — the null-byte. With enough null-bytes between each character of code, it is possible to fool all antivirus products (though additional software will trap it), yet Internet Explorer was quite happy to render the code.

Whose responsibility is it to fix this behaviour? Both the antivirus / antimalware companies and Microsoft's IE team have something to answer for."

Networking

Submission + - Aussie Claims Copper Broadband now 200x Faster (beskerming.com)

SkiifGeek writes: "Winner of Melbourne University's Chancellor's Prize for Excellence, Dr John Papandriopoulos could soon find himself the focus of a number of networking companies and government agencies interested in wringing more performance from existing network infrastructure.

Dr John developed a set of algorithms (US and Aussie patents pending) that reduce the impact of cross talk on data streams sharing the same physical copper line, taking less than a year to achieve the breakthrough. It is claimed that the algorithms can produce up to 200x improvement over existing copper broadband performance (quoted as being between one and 25 mbit/sec), with up to 200 mbit/sec apparently being deliverable. If the mathematical theories are within even an order of magnitude of the actual gains achieved, Dr John's work is likely to have widespread implications for future bandwidth availability across the globe."

Security

Submission + - 92% of Users Think They're Protected -Only 51% Are (beskerming.com)

SkiifGeek writes: "A survey (PDF) carried out by McAfee and the NCSA found that while more than 90% of users believed that they were protected by antivirus or antimalware products that were updated at least once a week, only 51% actually were.

What sort of an effect does this sort of thinking, and practice, have on the overall security of your systems, networks, and efforts to educate?"

Security

Submission + - Chinese Security Site Under Unique Attack (beskerming.com)

SkiifGeek writes: "The main site for the Chinese Internet Security Response Team (CISRT) has been serving up infrequent attacks against site visitors through the use of an injected IFRAME tag that attempts to download and install numerous pieces of malicious software.

While the source of the attack has yet to be identified, suspicion is that it might be an ARP attack being hosted by the CISRT's hosting provider. Rather than a straight up infection attempt against all site visitors (as was the case with the Bank of India hack), it is an interesting evolution to see intermittent attack attempts against site visitors."

Space

Submission + - French Threat to ID Secret US Satellites (beskerming.com)

SkiifGeek writes: "Space.com has reported that the French have identified numerous objects in orbit that do not appear in the ephemeris data reported by the US Space Surveillance Network. Since the US has claimed that if it doesn't appear in the ephemeris data, then it doesn't exist, and the French claim that at least some of the objects have solar arrays, it seems that the French have found secret US satellites.

While the French don't plan to release the information publicly, they are planning to use it as leverage to get the US to suppress reporting of sensitive French satellites in their published ephemeris.

The Graves surveillance radar (the French system) and a comparable German system may form the basis of a pan-European Space Surveillance network — another system that the Europeans don't want to rely on the US for."

Security

Submission + - Hacked Bank of India Site Labelled Trustworthy (beskerming.com) 1

SkiifGeek writes: "When the team at Sunbelt Software picked up on a sneaky hack present on the Bank of India website, it became a unique opportunity to see how the various anti-phishing and website trust verification tools were handling a legitimate site that had been attacked.

Unfortunately, the results showed that not one of the sites or tools identified that the Bank of India website was compromised and serving malware to all visitors. This isn't the first time that trust verification sites have had trouble identifying web content, with noted web application researcher RSnake recently taking umbrage at the classification that SiteAdvisor applies to his site."

Privacy

Submission + - Bugging Catches up to SIP Phones (beskerming.com)

SkiifGeek writes: "After news at the end of last year that mobile phones could be remotely eavesdropped, and there being a long history of remote eavesdropping possible on normal telephones, it was only a matter of time until VoIP devices were found to have the same capability (whether intentional or not).

In the last week there have been several exploit code releases and it seems that some vendors who chose to write their own SIP networking stacks are at risk of their devices being easily eavesdropped on."

Security

Submission + - Strict German Computer Crime Law Now in Effect (beskerming.com)

SkiifGeek writes: "With little fanfare, section 202c of the German computer crime laws came into effect over the weekend. Worryingly for Security professionals, the laws make the mere possession of (creates, obtains or provides access to, sells, yields, distributes or otherwise allows access to) many useful tools illegal. A similar law was proposed for the UK, however it was modified prior to passing through parliament due to the outcry from the industry.

Phenoelit, KisMAC, the CCC, and the Month of PHP Bugs are just some of the relatively high profile projects and groups to have already taken measures to remove or modify content under this law."

Slashdot Top Deals

Truly simple systems... require infinite testing. -- Norman Augustine

Working...