Compose Thread
All Threads
Your Threads
Newest Posts
Search
Tags:Newest Posts
» Topic: Chrome barks "Your profile cannot be used"
|
HostCheetah  | |
| If you downgrade from Chrome or Chrome Beta , you may get: When starting Chrome, the program generates a message 'Your profile cannot be used because it is from newer version of Google Chrome. Some features may be unavailable. please specify a different profile directory or use a newer version ofChrome.' Here is the fix / at least one of them: (Example) c:\Users\HP\AppData\Local\Google\Chrome\User Data\Default\Web Data I deleted the Web Data folder. Closed Windows Explorere, Opened Chrome *** If you have a MAC , this may apply I ran into the same problem and just fixed it. What other users suggested here works - the trick is to find the right Library folder. Depending on how your Mac was setup, you may have more than one Library folders - one under your Macintosh HD and another under Users folder. I found my Google (profile) folder under Users folder. The following is the steps to fix the problem: 1. Click to open your Users folder, then open the folder for your current user, say "Tom", open "Tom" folder, then open the Library folder. 2. Open Application Supper folder; 3. Find Google folder (if you want to sure to get the right one, click to open it, there should be Chrome sub-folder in it); 4. Delete this Google folder and all folders inside it. 5. Restart Chrome; 6. You can enjoy Chrome again without that annoying message! Note: If you sync your google settings before, you can re-sync and get your bookmarks back. |
||
» Topic: The Mona Lisa's Twin Painting Discovered
|
|
HostCheetah | |
| Source and Audio Playback KERA Off subject from Hosting / Technology but none the less quite interesting! The Mona Lisa is one of the most enigmatic and iconic pieces of Western art. It has inspired countless copies, but one replica at the Madrid's Museo del Prado is generating its own buzz: conservators say that it was painted at the same time as the original — and possibly by one of the master's pupils, perhaps even a lover. Juxtaposing the two paintings — and using infrared technology which works like an x-ray, allowing one to see beneath the paint to see previous, obscured versions — conservators say that Leonardo and the painter of the replica made exactly the same changes at the same time. "The changes mirrored the changes which Leonardo made on the original," Martin Bailey, correspondent with The Art Newspaper in London, tells NPR's Melissa Block. "[Conservators] concluded that the two pictures had been done side-by-side in the studio, and it was probably on easels which were two or three yards away from each other." The copy brings da Vinci's studio to life — and stirs up questions. Who was this mystery painter? According to Bailey, the artist is likely to have been one of Leonardo's main assistants: Melzi or Salai (who was rumored to have been da Vinci's lover). Side by side, the pictures look noticeably different: the copy is significantly brighter and more colorful, even Mona Lisa's famously coy smile takes on a new cast. "The original Mona Lisa in the Louvre is difficult to see – it's covered with layers of varnish which has darkened over the decades and the centuries, and even cracked," Bailey says. "What is wonderful about the copy is how vivid it is, and you see Lisa in a quite different light. I thought her eyes are enticing. And you see her enigmatic smile in a way that you don't quite get in the original." Bailey says that the find will be relevant to historians and laypeople, that paradoxically a copy might bring viewers to the original with fresh eyes. "It is after all the world's most famous painting, but people don't look at it fresh," he says. "They look at it almost as an icon. If you go to the Louvre, people aren't actually really looking at the painting; they just want to be in the same room with it. For me, the beauty of the copy is that it actually makes us look at the painting as a painting, and I hope it will have that effect on other people, too." Original Mona Lisa Click Here Copy of Mona Lisa click here Source and Audio Playback KERA News |
||
» Topic: Apple Ships Huge Set of Patches for OS X
|
|
HostCheetah | |
| Apple has released a massive set of patches for a wide range of security vulnerabilities in a number of its products and components, including OSX Lion and QuickTime. The patches fix a slew of serious bugs, many of which can be used to execute remote code on vulnerable machines. One of the more serious vulnerabilities Apple fixed is the flaw that researchers Juliano Rizzo and Thai Duong discovered in the TLS 1.0 and SSL 3.0 protocols last year. The vulnerability, for which they wrote a proof-of-concept exploit tool called BEAST, is fixed in the new version of Apache that Apple included in yesterday's patches. Exploiting the flaw enables an attacker to decrypt some SSL sessions. "There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. Apache disabled the 'empty fragment' countermeasure which prevented these attacks. This issue is addressed by providing a configuration parameter to control the countermeasure and enabling it by default," Apple said in its advisory. Apple also pushed out an update that revokes trust in some of the certificates issued by Malaysian CA DigiCert that were found last year to contain weak cryptographic keys. "Two certificate authorities in the list of trusted root certificates have independently issued intermediate certificates to DigiCert Malaysia. DigiCert Malaysia has issued certificates with weak keys that it is unable to revoke. An attacker with a privileged network position could intercept user credentials or other sensitive information intended for a site with a certificate issued by DigiCert Malaysia. This issue is addressed by configuring default system trust settings so that DigiCert Malaysia's certificates are not trusted," Apple's advisory said. Among the other components that Apple patched on Wednesday are PHP, QuickTime and SquirrelMail. Source : ThreatPost |
||
» Topic: Report: Anonymous Targets Neo-Nazis
|
|
HostCheetah | |
| The Anonymous Internet collective’s campaign against groups with whom they disagree surged into 2012 with “Operation Blitzkrieg,” which is targeting Neo-Nazi groups in Germany. Their latest effort includes a Wikileaks-style Website, Nazi-leaks.net, to uncover and expose the identities of individuals affiliated with and sympathetic to Germany’s nationalist, far-right National Democratic Party (NDP) often associated with Neo-Nazi beliefs. The site contains lists of names, locations, email addresses, and phone numbers belonging to NDP donors, and those who have visited, communicated or otherwise done business with any number of Web sites. It also includes the names and contact details of persons that have written for the Junge Freiheit, the central publication of Germany’s New Right movement According to Deutsche Welle, the attack is being heavily criticized. Simone Rafael, an anti-Nazi blogger, is cited as having said that it was good “to remove filth from the Net for a few days,” but then went on to criticize the illegal publication of personal information on the Internet. Recent Anonymous activities indicate shifts within the shadowy Internet collective’s ideology in line with calls for online actions with a social bent. In recent months, the group has launched attacks against sites containing and encouraging child pornography and used its heft online to promote the Occupy Wall Street protests. However, the group has also continued in its anti establishment bent, hacking into systems used or frequented by law enforcement and military personnel and spilling their personal information online. ThreatPost.com |
||
» Topic: Lilupophilupop SQL Injection Attack
|
|
HostCheetah | |
| Lilupophilupop SQL Injection Attack Tops 1 Million Infected URLs At any given time, there are probably dozens of somewhat serious SQL injection attacks going on in various portions of the Internet. But many of them never get noticed by most people, either because they're not widespread enough or they're not hitting high-profile targets. There's one that's been ongoing for several weeks now that has hit a threshold that commands some attention: more than a million infected URLs. The attack was first identified and disclosed by researchers at the SANS Internet Storm Center back in early December, and at the time there were only a few thousand infected pages. The attacks seemed to be targeting sites with backends running on IIS, ASP or Microsoft SQL Server, and there were some indications that the attackers had been doing reconnaissance on the infected sites for some time before the actual attack took place. The attack, which included a script that redirected users to a url at lilupophilupop.com, was similar to some other mass SQL injection attacks that have surfaced in recent years. "Sources of the attack vary, it is automated and spreading fairly rapidly. The trail of the files ends up on "adobeflash page" or fake AV. Blocking access to the lilupophilupop site will prevent infection of clients should they hit an infected site and be redirected," Mark Hofman of the SANS ISC wrote in the initial analysis of the attack. The goal of the attack, like many others, seems to be to drive victims to a site that's peddling fake AV or scareware. That's where the monetization portion of the scheme comes in, with the attackers trying to lure victims into paying a license fee for a fake AV program they not only don't need but that will likely cause other problems on their machines, as well. Hofman said in a new analysis of the lilupophilupop SQL injection attack that the number of infected URLs is now more than one million, although there may be some duplicates included in that number. But, it's not necessarily the raw number of infected URLs that's most important in these attacks, but rather which sites are infected and where those pages live. Hofman's analysis shows that the sites infected with the lilupophilupop code are all over the map, with tens of thousands of compromised pages in the U.K., the Netherlands, Germany, France and Denmark. Large-scale SQL injection attacks have become a common method of compromise for attackers looking to find large numbers of victims with relatively little effort. Well-known attacks such as LizaMoon and another targeting IIS installations in 2010 have claimed huge numbers of compromised sites. ThreatPost.com |
||
» Topic: Windows 8 Theme for Windows 7
|
|
HostCheetah | |
| New Windows 8 Theme For Windows 7 I’m sure many of you have been following the events revolving around Windows 8 over on our sister blog windows8news. Those of you who have will know by now that we have got some primitive looks at the new Windows 8 user interface. Of course there is still a long way to go with it, but that hasn’t stopped several graphic designers from coming up with new Windows 8 themes for Windows 7. The Windows 8 user interface that we’ve seen to date already looks much cleaner and more polished than Windows 7. Even though it’s far from finished Deviantart has got one of the first theme’s to transform your Windows 7 desktop into Windows 8. Unfortunately because it is not an official Microsoft approved theme it’s not an easy one click install job which is commonplace with most themes. Download It doesn’t affect how Windows operates in anyway so don’t worry about that. It just makes it look a little bit more polished and refined, as well as adding the user icon to the bottom right. It works on both 32-bit and 64-bit editions of Windows 7 (according to the developer 32-bit is better) It is necessary to patch a couple of system files before you install that (more on that here) It should work with all languages Be sure to make a backup of your system just to be sure Some reports claim that it doesn’t work too well on multiple monitors It’s constantly being updated so be sure to check for updates over time For the most part these themes are fairly simple and straightforward to install and shouldn’t cause too much trouble. But just beware they are not official Microsoft themes. Download Here: http://www.windows7news.com/download-center/?did=284 |
||
» Topic: Spammers Get Up Close and Personal
|
|
HostCheetah | |
| You may have noticed that your email inbox has less spam — you're getting fewer offers to sell cheap pharmaceuticals or help a deposed Nigerian prince. Yes, the volume of junk email is down — dramatically. Symantec, which makes Norton antivirus software, estimates that spam peaked in July 2010 with an average 225 billion messages sent each day, compared with less than 50 billion a year later. See also: Don't get hooked by a phishing expedition. In spearfishing, scammers try to hook you with a personal touch; using your name, for instance. — Photo by Corbis Some of the credit goes to law enforcement and corporate cyber-cops for busting major criminal networks that were sending the stuff out through "botnets," home or business computers that have been stealthily linked to forward spam.  In April, the FBI helped seize control of one botnet, called Coreflood, and scrubbed 19,000 computers infected with its spam-sending software. And in the same month, Microsoft managed to dismantle the infamous Rustock botnet, which once distributed nearly half of all spam.Related Does your computer secretly send spam? Read Avoid spam, viruses and phishing scams. Read Free ID theft protection. Read Targeting you But there's another reason for the drop: The crooks are narrowing their targets. Rather than sending out masses and masses of generic, one-size-fits-all messages and hoping to hear back from just a tiny fraction of recipients, they are shifting to lower-volume but more personalized attacks. Their emails are addressed to you alone and appear to come from people you know. The new tactic is called "spearphishing." And its personal touch pays off. Between June 2010 and June 2011, according to a report by the network company Cisco (pdf), money that spearphishers squeezed out of victims quadrupled from $50 million to $200 million. During the same period, money made from traditional spam dropped from $1 billion to $500 million. Scammers realize that these days you're likely to ignore a "Dear Friend" request asking for your bank account number. But when the same request comes in an email purportedly from your bank — and addresses you by name — the odds greatly increase that you'll give the sender the hoped-for response. The same applies to a "Dear Mr. [your name here]" letter asking for your credit card number because of an alleged problem with a recent purchase and noting details of that transaction. It's much more credible than one that's addressed "Dear Customer" and that contains no personal details. How do spearphishers get your particulars? Sometimes, the info is collected on social networks such as Facebook or Twitter, which, in addition to revealing your friends and family, could include posts about that new camera you purchased at the mall last weekend. Or maybe your employer's website lists your name and those of coworkers. Other personal information can come from data breaches — the hacking of big institutional computers — and from the cyber-crime black market that has a wealth of information about you and companies with which you do business. Five ways to avoid spearphishing Always maintain a healthy dose of suspicion about email that names you, just as you should with generic come-ons. This is rule number one for preventing the "friendly fraud" of spearphishing scams. Keep in mind that banks, government agencies and legitimate businesses don't send emails demanding that you update personal information or provide financial account or Social Security numbers. If an email appears to come from a friend and suggests you click on a link, a quick phone call to that friend makes for easy verification. Be less social on social networks. Don't easily accept new "friends" or readily post potentially exploitable details of your life or those of your family and friends. Watch for "scammer grammar." Spam has changed, but tone and style haven't. Spearphishers often operate from overseas and aren't native speakers of English, so look for frequent misspellings and word misuse, the giveaways of old-line spam. Authored by: Sid Kirchheimer, Author of Scam-Proof Your Life (HC) HostCheetah.com  (HCTV) HostCheetah.tv  (ME) MailEdge.net  |
||
» Topic: WHMCS V5 Out Now!
|
|
HostCheetah | |
| We've done it! WHMCS Version 5 is all packaged up and ready to go... We've reached every goal we set ourselves for Version 5, tested it thoroughly for the past 6 weeks (special thanks go to every one of our beta testing team who have helped with finding issues and providing their feedback), written clear and detailed documentation for all of the new features, improved our existing documentation where possible; we've also found time to rebrand and update the look of our own website to better showcase what we do and what we're all about, and here we are, finally ready to reveal what we've been working on to the world at large... We're really excited about this release, more so than any release we've ever done before, and we know a lot of you are too! So without further delay, I want to introduce you to our WHMCS V5 Release Announcement PDF, which showcases everything we've been working so hard on for the past 5 months. As you'll see, there's quite a lot! Download the WHMCS V5 Release Guide & Overview PDF So now you know what's in it, you can't wait to upgrade right?!?  Well ok then... The new V5 upgrade is available for download from our client area as of the time of this post. And it follows the same simple and straightforward upgrade process as every upgrade that has come before. For help upgrading, please refer to the How to Upgrade link below. As per normal, our Professional Upgrade Service, where we upgrade your WHMCS installation for you, is also available, and we have more staff on hand than ever to be able to process upgrades as quickly as possible for those of you who just can't wait to try out the new version! The fee has been increased slightly for this update, from $19.95 to $24.95, but this still offers great value for money. ......................... So all that leaves is for me to thank all of you who have chosen WHMCS, and continue to use it daily, and who send in your feedback and requests to us. Your loyalty, support, feedback and the work you do in referring WHMCS to your friends and colleagues, is what allows us to develop upgrades like this, and developing, innovating and improving is what we like doing most. A couple of links that you might need... V5 Discussion Thread: http://forum.whmcs.com/showthread.php?t=43260 V5 What's New Overview: http://www.whmcs.com/whats-new/ V5 Release Notes: http://docs.whmcs.com/Version_5.0_Release_Notes How to Upgrade: http://docs.whmcs.com/Upgrading Download: http://www.whmcs.com/download Posted by Matt on Thursday, November 24th, 2011 (HC) HostCheetah.com (HCTV) HostCheetah.tv |
||
» Topic: SonicWall SSL VPN Client for iPad iPhone
|
|
HostCheetah | |
| Source: http://www.sonicwall.com/us/products/Mobile_Connect.html 12/01/2011 SSL VPN Secure Remote Access Platforms SonicWALL® Mobile Connect™ SonicWALL® Mobile Connect™ unified client app for Apple® iOS™, downloadable from the App StoreSM, lets Apple® iPad®, iPhone®, and iPod touch® users connect safely to work or school networks over encrypted SSL VPN connections to ensure confidentiality and data integrity for users outside the network perimeter. Used in conjunction with SonicWALL Next-Generation Firewalls, it creates a Clean VPN™ that scans and cleans malware embedded in iOS traffic before it enters the network. Additionally, SonicWALL Application Intelligence and Control lets IT define and control application and bandwidth usage. When connecting over a wireless connection inside the network, Mobile Connect enforces WiFi security and control in adherence with organizational policies. Easy deployment and centralized management. SonicWALL Mobile Connect provides secure SSL VPN connections to SonicWALL Aventail E-Class Secure Remote Access (SRA), SRA for SMB and SonicWALL Next-Generation Firewall appliances. Unified policy control simplifies access control configuration for the administrator. Integration behind almost any firewall lets companies use existing equipment to help iOS devices safely access the network. Encryption, two-factor authentication and tight access policy makes sending data secure Easy to use secure remote access for iOS. Full network-level access lets iOS enabled device users connect to shared folders, client-server software, intranet sites email and Virtual Desktop Infrastructure (VDI) solutions. Personalized web portals show only the network resources that are available to Apple iPad, iPhone, and iPod touch users based on company policy. VPN on Demand1 automatically uses SSL VPN when an iPad, iPhone, or iPod touch user requests access to an application, web site or host. SonicWALL Clean VPN solution. When deployed with a SonicWALL Next-Generation Firewall, SonicWALL Mobile Connect creates an integrated Clean VPN solution. SonicWALL Clean VPN delivers the critical dual protection of high-performance Next-Generation Firewall and SSL VPN to clean and secure SSL VPN traffic before it enters the network. In combination with a SonicWALL Next-Generation Firewall, application intelligence and control enables IT to identify and define how applications and bandwidth are used. SonicWALL Mobile Connect can be used over WiFi inside the network to deliver secure, simple and cost-effective distributed wireless networking, and it works in combination with a SonicWALL firewall for deep packet inspection, application control and content filtering. ** Supported for SonicWALL E-Class SRA platform only. SonicGuard.com VirtualGraffiti.com |
||
» Topic: Major DNS Cache Poisoning Attack
|
|
HostCheetah | |
| November 7, 2011, 7:44AM Source: Threat Post Major DNS Cache Poisoning Attack Hits Brazilian ISPs There is a large-scale DNS cache-poisoning attack going on in Brazil at the moment, with potentially millions of users affected by a tactic that is forcing the to install a malicious Java applet before they can reach many popular sites, including Google, Gmail and Hotmail. The attack has been going on for some time already, researchers say, and the effects could be quite widespread, given the scope of the problem. Several large ISPs in the highly connected country have been affected by the attack, and police have made at least one arrest in connection with the operation. An analysis of the attack by Fabio Assolini, a Kaspersky Lab researcher in Brazil, shows that attackers have been able to poison the DNS cache records for several major Web sites at some large ISPs. So when users attempt to connect to a site such as Google through one of the affected ISPs, they are redirected to a site that insists they install a small Java applet in order to continue. That applet, of course, is malware. Specifically, it's turned out to be a banker Trojan in most cases, which is far and away the weapon of choice for Brazilian attackers. The IP address being used to host the exploit includes a slew of other exploits as well, such as files that attempt to exploit vulnerabilities in older versions of Java, a comon tactic for drive-by downloads. "It asks the customer to download and install the so-called “Google Defence” software required to use the search engine. In reality, though, this file is a Trojan banker detected by Kaspersky’s heuristic engine. Research into this IP highlighted several malicious files and exploits hosted there," Assolini wrote in his analysis of the cache poisoning attack. "In fact the file ad.html is an encrypted script, exploiting CVE-2010-4452 and running arbitrary code in an old installation of JRE. The exploit detected by us as Exploit.Java.CVE-2010-4452.a calls up one of the files in this list." Assolini said that all of the infections seen in this specific attack have been in Brazil. He added that some enterprises in the country also had reported that their routers and internal networking devices had been compromised and the attackers had modified the DNS configurations in order to force users to malicious sites. DNS cache poisoning attacks have have been going on for a long time, both smaller, targeted attacks and more widespread ones against a large ISP. They were more prevalent a few years ago, but still crop up from time to time. They can be executed in a number of ways, but the simplest method is for a malicious insider who has access to the DNS records at an ISP or large company to go in and change the record to point to the desired malicious site. Brazil has nearly 76 million Internet users, fifth most in the world right now. (HC) HostCheetah.com (HCTV) HostCheetah.tv |
||
» Topic: Facebook Worm Spreading
|
|
HostCheetah | |
| November 29, 2011, 8:00AM Source: Threat Post A new worm has popped up on Facebook, using apparently stolen user credentials to log in to victims' accounts and then send out malicious links to their friends. The worm also downloads and installs a variety of malware on users' machines, including a variant of the Zeus bot. The worm is making the rounds now, and detection of the malicious file that's being used to drop the malware on victims' machines is quite low. Researchers at CSIS in Denmark analyzed the worm's behavior and found that it appears to be using stolen Facebook credentials to log in to user accounts. It then sends out messages to the victim's Facebook friends with a link that's supposedly to a photo file. However, the file that's linked to is a screensaver that has a JPG extension. If a user opens the file, it will then install a series of malicious programs. CSIS says that the worm's code was written in Visual Basic and uses a handful of techniques to make analysis in virtual machine environments difficult. After the user executes the malicious file, the infection routine kicks off. "Whereupon the following file is attempted copied to the system: c: users [% user profile%] m-1-52-5782-8752-5245winsvc.exe," a translation of the CSIS analysis says. "The worm carries a cocktail of malware onto your machine, including a Zbot / ZeuS variant which is a serious threat and stealing sensitive information from the infected machine." Zeus is a common tool in the arsenal of many attackers these days, and is used in a wide variety of attacks and campaigns now. It used to be somewhat less common, but the appearance of cracked versions of the Zeus code has made it somewhat easier for lower-level attackers to get their hands on the malware. Zeus has a range of capabilities, and specializes in stealing sensitive user data such as banking credendtials, from infected machines. CSIS also said that the worm is spreading from some domains outside of Facebook, and that those compromised servers are being used to gather additional information about the infected machines and to stage the malware that's subsequently downloaded onto victims' machines. (HC) HostCheetah.com |
||
» Topic: Ruckus Wireless Introduces ChannleFly
|
|
HostCheetah | |
| SUNNYVALE, CA – November 28, 2011 – Ruckus Wireless™ today introduced ChannelFly™, a new technology innovation specifically developed to address the growing need to deliver more reliable Wi-Fi performance within noisy and crowded RF environments caused by the invasion of smart, Wi-Fi-only devices onto enterprise and service provider networks. ChannelFly leverages the same Ruckus-patented adaptive antenna approach, BeamFlex™, that constantly learns and selects the best signal path for any given Wi-Fi transmission. A statistical adaptive channel selection technique, ChannelFly applies similar principles to automatically determine the best radio operating frequency (RF channel) to be used that will yield the highest client throughput. As more users and devices are connecting to Wi-Fi networks, channel capacity is becoming a scarce and valuable resource. Because the level of interference and activity in the Wi-Fi spectrum varies as function of location, frequency and time, it is critical that client devices use the Wi-Fi channel with the lowest activity level and interference level to assure the best possible performance. A contention-based medium, Wi-Fi uses the unlicensed 2.4 and 5GHz bands, making it highly susceptible to congestion and interference. A proven key to delivering superior performance within a Wi-Fi environment is the extent to which a wireless system can learn and adapt to constant environmental changes that degrade client performance. “Historical approaches to Wi-Fi channel selection use spectrum analysis or packet sniffing techniques to basically guess the impact of interference on Wi-Fi capacity,” said Bill Kish, co-founder and chief technology officer at Ruckus Wireless. “But with Wi-Fi, what an AP hears doesn’t necessarily determine capacity. We skip those needless and disruptive steps and just measure the wireless capacity directly.” Kish noted that traditional approaches to automate channel selection don’t provide a complete view of what is really happening on a given channel. “ChannelFly was conceived to turn the traditional model on its head by using statistical analysis of real-time channel performance to discover the true capacity of any channel at any time,” said Kish, the inventor of ChannelFly. A Predictive Model to Wi-Fi Channel Selection Unlike alternative channel optimization approaches that passively listen for packet retries, transmission errors and RF interference on other channels when the Wi-Fi access point (AP) is not sending or receiving data, ChannelFly is based on a predictive model that uses actual channel activity to learn what channels will yield the most capacity to provide the highest client speeds. Armed with this knowledge, ChannelFly quickly avoids interference within congested and noisy environments while maintaining maximum network throughput. ChannelFly assesses all available channels within the 2.4 and 5GHz bands. Now integrated within every Ruckus ZoneFlex Smart Wi-Fi AP, ChannelFly operates automatically without any human intervention. And because ChannelFly is based on actual channel throughput measurements, no background scanning is required for ongoing channel optimization. This eliminates the need for APs to be out of service when performing off-channel scanning. ChannelFly operates with or without client activity. During the first several hours of operation, each Ruckus AP determines the channel with the highest capacity even before users begin to associate. This enables Ruckus APs to offer a high-quality user experience without the service disruptions caused by interference or background scanning. With ChannelFly, Ruckus APs can automatically self-tune before any client devices are connected, thereby avoiding service disruptions that can often be associated with RF channel changes. Once clients are active, to ensure seamless operation with end devices, ChannelFly uses the IEEE 802.11h protocol to automatically advertise when a change to a better Wi-Fi channel is necessary. Ruckus Wireless Introduces ChannelFly™, the Industry’s First Predictive Capacity Management Technology Posted on November 28, 2011 “We see ChannelFly as a truly important step in the evolution of more reliable Wi-Fi networks,” said Arthur Giftakis, VP of engineering at Towerstream. “Operating a pervasive Wi-Fi network in one of the most exciting locations on the planet, New York City, we’ve found ChannelFly to be instrumental in yielding higher levels of network capacity within this constantly changing environment. Innovations like ChannelFly are essential to making Wi-Fi carrier class.” Available immediately at no cost within a new release of Ruckus ZoneFlex software (v. 9.3), ChannelFly is a selectable feature that operates automatically on every Ruckus ZoneFlex access point. More Ruckus Wireless News Ruckus Security |
||
» Topic: iCloud MobileMe: Using mac.com and me.com
|
|
HostCheetah | |
| New iCloud email address for all new users to iCloud would be @me.com In order to option MAC O/S Tiger you will need to select iMap Below are the iCloud / me.com server address provisioning info for setting up iMail Summary If you were a .Mac subscriber before the launch of MobileMe, you had a username@mac.com email address. Now that we have converted to MobileMe, you have also been granted a username@me.com address. These email addresses are aliases of one another, so they are one and the same and share the same inbox. You can choose to use either email address to send and receive mail on your computer, iPhone, or iPod touch and set up your MobileMe Contact and Calendar syncing. Products Affected MobileMe Mail, .Mac Mail, iPod touch, iPhone Using me.com and/or mac.com addresses with Mail in Mac OS X 10.5 When you set up your MobileMe email in OS X 10.5 Mail, it will automatically list all of your MobileMe email addresses in the "From" drop-down box in messages you are composing. This allows you to choose to use your @mac.com address or your @me.com address anytime you compose a new message, including any aliases you may have set up. Note: Any aliases you created (and didn't delete) before the .Mac-to-MobileMe should have both @mac.com and @me.com versions. Aliases created after the transition can only be used with @me.com. Set up MobileMe email in Mac OS X 10.5. Using me.com and/or mac.com addresses with Mail in Mac OS X 10.4.11 Your MobileMe email address work the same in Mac OS X 10.4.11 as they do in 10.5. If you were an existing .Mac member and simply want to keep sending and receiving using your membername@mac.com address, you don't have to do anything. Note that all MobileMe features will appear as ".Mac" in Tiger, even if you are a new MobileMe member. Note: Any aliases you created (and didn't delete) before the .Mac-to-MobileMe should have both @mac.com and @me.com versions. Aliases created after the transition can only be used with @me.com. If you want to also use your new @me.com address, see the Mac OS X 10.4 section of this article. Using me.com and/or mac.com addresses with a third-party email application You can configure a third-party email application to use either your @mac.com or @me.com email address. However, depending on the email application you use, you may not be given the opportunity to choose to send from your other email address in the same way that Mail in Mac OS X allows. See this article. Note: Any aliases you created (and didn't delete) before the .Mac-to-MobileMe should have both @mac.com and @me.com versions. Aliases created after the transition can only be used with @me.com. Using your iPhone or iPod touch with a me.com or mac.com address When using MobileMe Mail on your iPhone or iPod touch, it is recommended that you choose either your @mac.com address OR your @me.com address. Just choose the address you'd like to use and set it up on your iPhone or iPod touch. Note: Aliases are not currently supported on iPhone or iPod touch. Set up MobileMe email on your iPhone or iPod touch (see source URL) Source: http://support.apple.com/kb/HT2857 iCloud: Mail server information Summary iCloud Mail uses IMAP and SMTP standards supported by most modern email applications. While applications not manufactured by Apple are not supported by Apple, you can use the server information below to manually configure your email application for use with iCloud. Products Affected iCloud For more information on how to use this information with your email application, consult your application's documentation. IMAP (Incoming Mail Server) information: Server name: imap.mail.me.com SSL Required: Yes Port: 993 Username: example@me.com (use your @me.com address from your iCloud account) Password: Your iCloud password SMTP (outgoing mail server) information: Server name: smtp.mail.me.com SSL Required: Yes Port: 587 SMTP Authentication Required: Yes Username: example@me.com (use your @me.com address from your iCloud account) Password: Your iCloud password Additional Information SSL is required for both IMAP and SMTP connection with iCloud. POP is not supported by iCloud. Important: Information about products not manufactured by Apple is provided for information purposes only and does not constitute Apple’s recommendation or endorsement. Please contact the vendor for additional information. Source: http://support.apple.com/kb/HT4864 HostCheetah.com |
||
» Topic: Google Implements Forward Secrecy
|
|
HostCheetah | |
| Google is stepping up their security game in a big way for the second time this year: introducing a more secure browsing method known as forward secrecy in Gmail and a number of other Web-based services, according to a post on the GoogleOnlineSecurity blog. In recent months, the Silicon Valley search giant addressed the immediate, implementing secure (HTTPS) browsing by default. Their latest move focuses on long-term data security, putting to rest almost any concerns that hackers could store encrypted communications then use improved technology in the future to crack it and view the contents. “Forward secrecy requires that the private keys for a connection are not kept in persistent storage” explains Google Security Team member Adam Langley. “An adversary that breaks a single key will no longer be able to decrypt months’ worth of connections; in fact, not even the server operator will be able to retroactively decrypt HTTPS sessions.” See more on this here: http://threatpost.com/en_us/blogs/google-implements-forward-secrecy-112311 (HC)HostCheetah.com |
||
» Topic: Faxing over SIP (VoIP) Some tips...
|
|
HostCheetah | |
| By : spamizbad I currently have a small office that depends on faxing. I'd ditch fax if I could, but my clients are funny in their ways. Anyway, I'm using Asterisk 1.6.2 with FreePBX 2.0 and Broadvox is my SIP provider. My system is set up to receive faxes on the Asterisk PBX and email them to a mailing list of employees (this is configured through FreePBX). I also have a Grandstream GXW-4004 to provide FXS ports for the fax machine and analog phones that aren't important enough to replace with expensive VOIP handsets. Note: I never got the analog fax machine to send and receive. Depending on how I set the fax detect on the Grandstream, I could do either-or, but not both. So my PBX receives faxes and my machine sends them. This is likely a PEBKAC matter, but I can't really be bothered to put forth the time to work this final gremlin out of my system. My advice to anyone doing faxing over VoIP is the following: 1) If possible, don't. 2) Make sure your SIP provider supports VOIP faxing. Some don't with good reason: it's a bitch to support. 3) Make sure your SIP provider support G.711 with T.38. 4) Make sure your ISP does not strip QoS headers (In this case DiffServ EF)from IP packets. Your ISP will ignore them, obvious, but you definitely don't want them stripped or overwritten. 5) Make sure your VOIP packets have a DiffServ EF value in their headers. 6) Make sure any router(s) and switch(es) are configured properly to give top priority to your VOIP traffic. Failure to do so will likely result in jitter on your calls and you'll be unable to successfully send/receive faxes. 7a) If possible, don't run your primary PBX in a virtualized enivornment. Competition for system resources may create unwanted latency on your Asterisk VM resulting in jitter and failed faxes. 7b)With that said, I would definitely keep a cold or hot "spare" PBX running in a VM to spin up in the event of an outage. Good luck! |
||
» Topic: HYPER-V VS. VIRTUOZZO
|
|
HostCheetah | |
| HYPER-V VS. VIRTUOZZO VPS virtualization based on a container concept provided by OpenVZ/Virtuozzo is NOT the same as hypervisor virtualization provided by MS Hyper-V and as such can NOT replace a Dedicated server and should not be used instead of a Dedicated server If you need a lot of CPU, memory, and I/O resources VPS based on a container concept will NOT work for you If your application requires a lot of heavy I/O such as Database, Streaming, lots of web traffic - you should go with a Dedicated Cloud server or virtualization provided through a hypervisor technology such as Hyper-V. The container based VPS bottleneck is I/O resources which at some point become a major bottleneck and you will be forced to upgrade to a Dedicated server VPS based on OpenVZ/Virtuozzo should NOT be used for mission critical applications! If the uptime and performance are critical factor than a Dedicated server is a MUST have and here is why: NOT all VPS resources in a container are reserved ONLY for your VPS. For example I/O sharing, network port sharing, and “burstable” memory sharing can impact your site and account performa. On the other side a hypervisor virtualization provides dedicated or guaranteed system resources for your VPS The container based VPS performance and stability maybe impacted if the actual hardware node hosting your VPS becomes unstable which can happen in certain cases if another VPS is abusing the shared I/O resources of the node or if there is a problem with the node (for example operating system crash). Such problems are not present or at least are much better isolated in a hypervisor VPS implementation The Linux/Windows VPS kernel in a container based platform can not be updated. You can not update on your own your VPS operating system and can not perform any system related updates. This is not the case with a hypervisor virtualization Low level drivers, which requires kernel changes/updates cannot be installed in the container based virtualization. For example some VPN software won't work in container environments. All of these are possible with a hypervisor virtualization You can NOT use swap in the container based VPS platform, which means that your VPS will be limited to the actual VPS memory. With a hypervisor virtualization your VPS can use a swap space You cannot perform custom OS updates as all updates have to be first verified by the VPS software vendor. With a hypervisor VPS you can perform any OS updates |
||
» Topic: How to preview web site in WebSitePanel
|
|
HostCheetah | |
| How can i preview website pre-propagation in WebsitePanel You transfer website from another server and want to check if website works ok before changing dns? Option 1: When you add domain & create website In WebsitePanel, you need to tick the check box "Create Instant Alias" which will create domain alias for previewing website. ------- Option 2: If you do not select the option when adding hosting account, you can create instant alias to preview website by: Go to hosting space -> select Domains -> click on domain you want to preview. Select "Create Instant Alias" to create preview link. ------- Option 3: You can manually add subdomain of server hostname as domain alias to preview website: 1. Go to Domains, select Add Domains -> Domain Alias. 2. Add domain alias yourdomain.XYZ.m6.net where XYZ.m6.net is server hostname. Please contat support if you don't know server hostname. |
||
» Topic: Capturing Customers by using a VAR
|
|
HostCheetah | |
| RT @TopsyRT: How Working with a Value Added Reseller Can Maximize Your Business http://bit.ly/n8vWLm How Working with a Value Added Reseller Can Maximize Your Business Do you know what a “Value Added Reseller” is? If you are a decision maker at your company — no matter the size — and you are in need of IT solutions such as a wireless router, firewall or anti-virus software, you should be familiar with VARs. A VAR is a technology company that adds features or services to an existing hardware or software product, then resells it as an integrated product or complete turn-key solution. The added value comes from the VAR offering professional services such as customizing, consulting, training and implementation. Choosing to work with the right VAR could improve your company’s IT capabilities, save your company money and overall improve the efficiency of your business. This week I spoke with the founder and CEO of Virtual Graffiti, Hillel Sackstein, which is based in Irvine, California. Virtual Graffiti is a VAR and a comprehensive IT solutions provider. They work with companies in business, government, healthcare and education ranging from Fortune 500 companies to small businesses with less than 10 employees. Their business model has led to them being one of the fastest growing IT solution providers in the nation. Below, Hillel explains three important factors that Virtual Graffiti uses to offer value to their customers: Read more of the story here: OCMetro.com |
||
» Topic: Attackers Evade Reputation Systems
|
|
HostCheetah | |
| BARCELONA--As in life, reputations on the Internet take time to build up. Attackers interested in making a quick buck aren't necessarily the most patient lot, so as the various repuation systems on the Web have gotten more sophisticated and accurate, the bad guys have had to adjust their tactics and find new ways to evade them and plant their command-and-control servers. One of the consequences of the exhaustion of the IPV4 address space is that not only are legitimate companies having a hard time finding IP blocks to use, so are the attackers. The number of IP addresses required for large scale botnets to operate effectively can be considerable, and finding large IP blocks to use for them can be difficult. And if they do find them, the IP addresses often are blacklisted quickly by reputation systems and are then useless for the attackers. Now, in one effort to get around these systems, some attackers are taking advantage of the lack of IPV4 space by either purchasing or renting blocks of IP space with good reputations that have been built up over the course of several years. A number of legitimate trading and auction sites have appeared as the IPV4 space became scarcer, and the attackers have gotten involved as well, getting their hands on known good IP blocks and using them for C&C or hosting malware. "The bad guys can buy or rent these as well, getting inside known good IP blocks so that the reputation systems don't blacklist them as quickly," Gunter Ollmann, VP of research at Damballa, said in a presentation at the Virus Bulletin conference here Friday. That technique can be a boon for the attackers, who get the advantage of having some time to use the domains and not having to hop around from block to block in order to evade detection. But it also can have consequences for the legitimate owners of the IP blocks, as the repuations of those IP addresses and domains will be damaged as the systems begin to pick up on the malicious activity. Once that happens, it can be quite difficult to recover a domain's good reputation and get it back in the good graces of the security companies. Read More at ThreatPost.com (ME) MailEdge.net | Email - Secured (HC) HostCheetah.tv | Free Hosting Tutorials (VG) VirtualGraffiti.com | Technology Solutions |
||
» Topic: Dell Box Service Tag by Command Line
|
|
HostCheetah | |
| Dell Box Service Tag by Command Line Pretty cool, especially if you don’t have physical access to a Dell machine (obviously you can run these commands on your own machine). 1. In Windows, RDP into a machine run the following at a command prompt: wmic bios get serialnumber 2. To get the make, model and service tag: wmic csproduct get vendor,name,identifyingnumber 3. To get the info remotely: wmic /user:vg\<adminUser> /node:<hostname> bios get serialnumber 4. In Linux, login via SSH and run: [remote-host]# dmidecode -s system-serial-number |
||
» Topic: ShoreTel Call Manager not connecting
| methylbromid | ||
| If reinstalling does not fix (it did not for me), I modified the last set of instructions as follows: Because I had tried to uninstall/reinstall, I now had two instances of the Shoretel TAPI entry. I removed one and modified the properties of the other. For the one I was modifying, I manually input the server name, username, and password in the TAPI config. I restarted the Shoretel software and it worked perfectly. |
||
» Topic: Web Site Security 101 and SiteLock
|
|
HostCheetah | |
| SQL Injection What is it? SQL injection, is an extremely damaging attack in which hackers will attempt to access information stored in your database, such as customer data or user ID's and passwords. SQL stands for Structured Query Language and is the programming language understood by databases. By inserting commands from this programming language into fields on your website's input forms, hackers can gain access to the database records of vulnerable sites, stealing credit card data, passwords, e-mail addresses and any additional data available in the database. What is the impact? The impacts of this type of attack can be devastating. A recent example is the attack carried out on Sony's networks, in which thousands of credit cards were stolen. The company has spent millions to recover. It can also badly damage your company's reputation by exposing your customers' private data to criminals. How does SiteLock protect me? Our patent-pending 360-degree scan technology tests each input box on your website to ensure that they are not vulnerable to this type of attack. We verify the safety of each input box on your website by inserting code in the way hackers would. We do not read or collect any data, however. We use safe test procedures and code and if we discover a vulnerability in our testing, we report it to you immediately. Our Expert Services team can also help you remove these issues from your site. What can I do about it? Make sure any applications you use are kept up-to-date and limit the use of third-party plug-in's where possible as they can be a source of many issues and may be updated less frequently or created by unscrupulous publishers. Use a website scanning service that includes SQL injection scans, such as SiteLock Premium or SMB. If you are writing your own code, be sure to validate your input fields for special characters and ensure you are checking for this type of hacking in your database procedures called from the website. Cross-Site Scripting (XSS) What is it? Cross-Site Scripting, or XSS, is a type of attack used by hackers to control the content of your web pages. Hackers will insert a piece of code into your site, usually through an input field such as a search box, user ID, or Name/Address box. If your website is vulnerable to this type of attack, the hacker can control the content of your page, including the user's cookies or session variables. What is the impact? Hackers use this type of attack to trick your visitors into providing personal data. Since visitors believe they are providing this information to your site, they are likely to provide sensitive information to hackers, since they trust your business. Hackers use information collected, such as user names, passwords, credit card information, etc. to carry out identity theft and other criminal activities. How does SiteLock protect me? Our patent-pending 360-degree scan technology tests each input box on your website to ensure that they are not vulnerable to this type of attack. We verify the security of each input box on your website by inserting code in the way hackers would. Instead of taking over your page, though, we simply use harmless test procedures. What can I do about it? Make sure any applications you use are kept up-to-date and limit the use of third-party plug-in's where possible as they can be a source of many issues and may be updated less frequently or created by unscrupulous publishers. Use a website scanning service that features XSS scripting scans, such as SiteLock Premium or SMB. If you are writing your own code, be sure to validate your input fields for special characters and ensure that the settings for your code are frequently updated and hardened for security. You can also take advantage of SiteLock's Expert Services team to correct any issues we identify in our scans. Application scanning What is it? Application scanning will verify the applications you've installed on your website against known vulnerabilities. As application versions age (like Windows 2000 or Wordpress 1.0), hackers will find ways to attack these programs. The publishers then update them with newer versions, which you need to upgrade to in order to stay safe. We verify your version against catalogs of vulnerabilities to ensure you are running safe software on your site. What is the impact? The impacts of this type of attack are wide-ranging, as it depends a great deal on the type of application. For most web applications, the vulnerabilities are likely to be Cross-Site Scripting or SQL injection. How does SiteLock protect me? Our scanners identify applications you have installed and which version you have. We compare that to industry and proprietary lists to determine the security of your installation. If we discover a vulnerability in our testing, we report it to you immediately and can help you upgrade your and secure your site. What can I do about it? Make sure any applications you use are kept up-to-date and limit the use of third-party plug-in's where possible as they can be a source of many issues and may be updated less frequently or created by unscrupulous publishers. Use a website scanning service that includes Application vulnerability scans, such as SiteLock Premium or SMB. Virus scanning (drive-by downloads) What is it? If your site has been compromised by hackers, they may be using your website to distribute virus-infected software to your visitors without your knowledge. Your visitors may be getting software installed on their computers when they visit your site without knowing that is happening. What is the impact? Your visitors will have their computers infected with viruses after visiting your site. Of course, this causes frustration, anger, and distrust with your visitors. How does SiteLock protect me? Our scanner reviews all files and applications on your website against industry and proprietary databases of virus software. If we identify a virus on your site, we notify you immediately and can help you remove it. What can I do about it? Use a website scanning service that includes virus scanning, such as SiteLock Enterprise. Reputation monitoring What is it? SiteLock's patent-pending 360-degree scan helps you make sure your website and communications are reaching your visitors as intended in three key ways: Malware blacklist monitoring: We monitor search engine and proprietary lists of sites reported as malware to make sure visitors arrive at your site, not a "Red Screen" warning from their browser or search engine E-mail spam blacklist monitoring: We compare your e-mail address, domain name, and e-mail server to industry and proprietary lists used by popular e-mail programs to identify which messages to mark as "Spam". This ensures that your e-mails reach your customers' inbox - not their spam folder. SSL Scanning: If you have an SSL certificate installed on your site for data encryption, we will scan that certificate to verify that it is not expired or otherwise out-of-compliance with web browser expectations. This prevents users from seeing warnings about data security when they visit your site. What is the impact? Failure to keep up with and monitor any of these items can result in lost customers, abandoned visits to your website, and wasted marketing and website design efforts. How does SiteLock protect me? Our scanner verifies your website, e-mail, and SSL to ensure uninterrupted communication with your customers. If you ever do get included on one of these blacklists or non-compliance lists, our Expert Services team can help get you back up and running normally in a hurry. What can I do about it? Use a website scanning service that includes reputation management, such as SiteLock Basic, Premium or SMB. Network security vulnerabilities What is it? Network servers have devices on them known as ports. Each port is set up to understand a certain type of language. There are ports, for instance, for database applications, website content, e-mail, instant messaging/chat, etc. They are similar to channels on television or a CB radio. Each port is either open or closed to the outside world, meaning it will "listen" to requests for that type of service. If a port is open, it is an opportunity for a hacker to attempt to access data or files on that server. Some ports need to be open, such as the port for web content on your Internet server. Others should not be (like the e-mail or database ports on the same server). Opening unnecessary ports can expose sensitive data and systems to hackers. What is the impact? If hackers are able to access your network, the damage they can do is extensive. Depending on what parts of the server/network they reach, they could steal data, deface your website, or worse. How does SiteLock protect me? We check each port (thousands) on your servers to make sure that only the appropriate ones are open for the type of server you are using (e-mail ports for e-mail servers, web ports for web servers, etc.). We'll notify you if anything looks out of the ordinary so you can correct the issue. What can I do about it? Close all unnecessary ports. Make sure your ports that are open are protected using strong security. Use a website scanning service that includes network scanning, such as SiteLock Premium or SMB. Our Expert Services team can also help you lock down your network to prevent attacks. (ME) MailEdge.net (PH) ParagonHost.com (VG) VirtualGraffiti.com |
||
» Topic: Virtual Graffiti | Technology Solutions
|
|
HostCheetah | |
| Virtual Graffiti is one of the fastest growing IT solutions providers for business, government and education. Our unique approach to technology starts with comprehensive product knowledge and outstanding customer support, ensuring our customers find the right solution. We assist buyers of all levels of experience from the earliest stages of decision-making through product fulfillment and post-sales support. Network security and related solutions are our specialty. You benefit from award-winning product teams built around dedicated engineers with in-depth technical expertise. We are certified and trained on every solution we offer, giving customers a single go-to source to guide them in making smart IT buying decisions that fit their unique requirements. Our team is available to provide timely answers to your most critical questions. In addition, we support customers with product renewal notifications, updates and enhancements. Let our experts suggest complementary solutions or new technologies to secure your assets. We have experienced tremendous growth and success by consistently meeting our customers’ expectations. This allows us to build strong relationships and work closely with our clients. We know you expect more than just a quote from your technology partner – and that is the Virtual Graffiti difference. http://www.VirtualGraffiti.com |
||
» Topic: For those in need of VoIP Support | DrVoIP!
|
|
HostCheetah | |
| A bit about DrVoIP.com PETER S. BUSWEL l (a.k.a DrVoIP) – began his telecommunications career with AT&T Technologies in 1970. Over the last 35 years, Peter has been singularly responsible for the founding, funding, management and growth of several industry-defining companies, including National Communications Industries, AMBI Voice/Data Systems and Cobotyx Corporation. In the early 1980′s he served as Manager of Strategic Planning for the Communications Systems Group of Exxon Enterprises, the venture capital wing of Exxon Oil. He was insturmental in brining the InteCom PBX to market along with other Exxon back office product like Delphi Messaging. He has served in management capacities at IT&T as Director of Product Line Management and was the product manager for the CS-1024 ACD offered by IT&T at that time. At Datapoint he served as Manager of Program Development for the Infoswitch family of Call Center products. He has also held key executive positions as CMO or COO in several public telecommunications companies including Intervoice/Brite; and the Farmstead Telephone Group (FTG). Peter served as CMO of tAA and helped put the fledgling Voice Mail company on the Inc. Magizines Fastest growing 100companies in both 95′ and 96′. In 1998 Peter became COO of Franklin Telecommunications, a VoIP Gateway manufacture, and rang the opening bell the morning of March 13, 1999 the day the company went public on the AMEX! Before forming LANtelligence in September of 2001, Peter was Executive V.P. & COO of COM 2001 a company that produced a family of internet based telecommunications products including Alexis, the first voice recognition based Un-PBX build on Microsoft Technology. Peter retains his position as and Industry luminary, Business Telecommunications Development Consultant, Speaker and Published Author. His guide to VoIP Planning is one of the most widely downloaded books on the net! A graduate of Marymount College with a BS degree in Business & Information Technology Management, Peter is an active leader in the VoIP community and demonstrates his commitment by holding the following current industry certifications: He is a CISCO Professional holding current CCNA, CCDA, CCNP, CCDP and the CCVP certifications. He is also a ShoreTel Certified VoIP Engineer and has been certified by SONUS. He is generally know as “Dr VoIP” in local telecom community! As a Master Mason, Peter is a member of the Vista Lodge #687 of F&AM and is a 32° Mason in the Scottish Rite of Freemasonry, Valley of San Diego Orient of California. An avid private pilot an aircraft owner he is FAA certified with an Instrument rating in both Single and Multi-Engine aircraft. He is an AOPA and Bonanza Society member, a card carring member of the NRA, a future rock star (plays guitar, keyboard, CD’s) speaks several Latin languages and enjoys digital film making. Contact: Peter@DrVoIP.com http://www.DrVoIp.com Technology Solutions and more @ http://www.VirtualGraffiti.com |
||
» Topic: Hackers break SSL encryption / TLS
|
|
HostCheetah | |
| Hackers break SSL encryption used by millions of sites Beware of BEAST decrypting secret PayPal cookies By Dan Goodin in San Francisco • Get more from this author Posted in ID, 19th September 2011 21:10 GMT Free whitepaper – The Changing Requirements of WAN Optimization Researchers have discovered a serious weakness in virtually all websites protected by the secure sockets layer protocol that allows attackers to silently decrypt data that's passing between a webserver and an end-user browser. The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer technology that serves as the internet's foundation of trust. Although versions 1.1 and 1.2 of TLS aren't susceptible, they remain almost entirely unsupported in browsers and websites alike, making encrypted transactions on PayPal, GMail, and just about every other website vulnerable to eavesdropping by hackers who are able to control the connection between the end user and the website he's visiting. At the Ekoparty security conference in Buenos Aires later this week, researchers Thai Duong and Juliano Rizzo plan to demonstrate proof-of-concept code called BEAST, which is short for Browser Exploit Against SSL/TLS. The stealthy piece of JavaScript works with a network sniffer to decrypt encrypted cookies a targeted website uses to grant access to restricted user accounts. The exploit works even against sites that use HSTS, or HTTP Strict Transport Security, which prevents certain pages from loading unless they're protected by SSL. Get more on this story here! (HC) HostCheetah.com (ME) MailEdge.net : Email | Secured - Coming soon! |
||