GCSE/IGCSE and AS/A Level ICT-Applied ICT

Today i’ve seen this video on youtube showing how you can view your friends live chats and pending friend requests on facebook. This was one of the biggest security hole on facebook which has been made public.

[youtube]http://www.youtube.com/watch?v=ny8ui4delEo[/youtube]

After a short time Facebook announced that they have fixed the problem.

Here is the update from Facebook:

“For a limited period of time, a bug permitted some users’ chat messages and pending friend requests to be made visible to their friends by manipulating the “preview my profile” feature of Facebook privacy settings. When we received reports of the problem, our engineers promptly diagnosed it and temporarily disabled the chat function. We also pushed out a fix to take care of the visible friend requests which is now complete. Chat will be turned back on across the site shortly. We worked quickly to resolve this matter, ensuring that once the bug was reported to us, a solution was quickly found and implemented.”

John Young is a brave and tenacious man, an architect based in New York whose website, cryptome.org, has been a safe online repository for documents that someone, somewhere does not want published.

Since 1996 he has resisted pressure from governments, companies and individuals, using the strong protection against prior restraint provided by the US Bill of Rights to publish information about secret surveillance, spying, war crimes and many other topics.

Thanks to a robust policy on the part of his current internet service provider, his site has remained online despite the best efforts of those who are embarrassed by its contents.

Until last month, that is, when cryptome.org disappeared from the internet after Network Solutions disabled access to the site’s domain.

Mr Young had not revealed military secrets that put the lives of soldiers at risk, or published the finer details of Britain’s nuclear deterrent capability.

The document that got the site kicked offline was not a detailed map of the presidential escape route from the White House, or a list of the lobbyists who have visited Downing Street in the last year, but a 22-page document written by Microsoft.

It details how US government agencies can request access to customer data stored on Microsoft servers, like your Hotmail messages, and Microsoft used copyright law to achieve what the US government could not.

The company has since withdrawn its complaint, noting that it only wanted one document removed and was not attempting to restrict access to the whole of Cryptome.

Network Solutions has put it back online – with the offending file still present. But the fact that laws passed to protect the commercial interests of creators of original content can evidently have more force than national security concerns should make us all pause.

Comic capers

John Young is not the only one in trouble at the moment. My friend Mark Kobayashi-Hillary had uploaded more than 900 videos to YouTube over the years, most of them related to his specialist area of globalisation and outsourcing, but his account has been removed because of claims that he is infringing copyright.

After some investigation Mark has been told that since he has had three videos removed at the request of rights holders he is a “repeat offender”.

His account was terminated to comply with Federal law after comedian Jimmy Carr’s management company complained of a video he had taken at a recent Carr performance.

YouTube is a US company, so applying US rules seems reasonable, but there has been no legal process and his account was closed without any notice being given to him, so he had no opportunity to question it in advance.

And what tips this particular case over from mere irritation into something worthy of Kafka is that the camera phone clip that got Mark’s account removed showed the audience waiting for Jimmy Carr to appear on stage, and not a second of the comic’s performance.

Yet Chambers Management claims that it holds the copyright in any material filmed inside the venue and so his video is infringing.

I haven’t seen Mark’s ticket and it may well be that he has assigned copyright to the company by agreeing to the terms and conditions printed in one-point on the back, but even if this is so the absurdity remains.

Source: http://news.bbc.co.uk/2/hi/technology/8544935.stm

Computer hacker Albert Gonzalez has been jailed for 20 years in the US for his part in stealing the details of more than 130m credit and debit cards.

One judge described the crime as “the largest and most costly example of computer hacking in US history”.

The 28-year-old pleaded guilty to three cases of fraud at his trial last year.

Gonzalez was sentenced to 20 years for the first two cases on Thursday, and 20 years and one day on Friday for the third. The terms will run concurrently.

The judge in the third case said he had to serve the extra 24 hours because the crime had been committed when he was working for the US Secret Service as an informant, reportedly receiving as much as $75,000 a year.

As part of a plea agreement, Gonzalez also agreed to hand over $1m that he had buried in his parents’ garden, a condo in his hometown of Miami, a car, a diamond ring and several expensive watches.

‘Powerful message’

Gonzalez was accused last August, along with two Russian co-conspirators, of hacking into the payment systems of retailers.

They targeted more than 250 US companies including payment processor Heartland Payment Systems, food and drink store 7-Eleven and American supermarket Hannaford Brothers Co.

Gonzalez was found to have used SQL injection attacks to exploit weaknesses in payment software programmes and access data, stealing millions of customer card details.

He blamed “curiosity and addiction” for his crimes.

Assistant Attorney General Lanny Breuer of the Department of Justice said that on a daily basis “cyber criminals try to steal the debit and credit card numbers of unsuspecting American consumers.”

“These sentences – some of the longest ever imposed for hacking crimes – send a powerful message to hackers around the globe that US law enforcement will not allow them to breach American computer networks and payment systems, or illegally obtain identities.”

Amichai Shulman, chief technology officer of cyber security firm Imperva, warned that hackers “continue to put up a persistent and very real threat to enterprise systems”.

“The current data security spend is focused on enterprise networks, yet the Gonzalez attacks took distinct advantage of weaknesses in the database and applications. This is an industry-wide problem.”

Source: http://news.bbc.co.uk/2/hi/technology/8588642.stm

Social media could transform the NHS and other public services in the same way that file-sharing changed the music industry, a conference has heard.

Growing use of tools, such as Facebook and Twitter, offered an opportunity to reinvent services, delegates heard.

The MyPublicServices event debated ways to harness these conversations, many of which are critical, to make services better and more inclusive.

If this was not done, many services would be undermined, speakers said.

“It’s happened to the music and travel industries and it’s going to happen to public services,” said Dr Paul Hodgkin, founder of the Patient Opinion site that organised the MyPublicServices conference.

Said Dr Hodgkin: “The question is how do we cope with it in a useful and productive way and not spend decades beating each other up?”

Source: http://news.bbc.co.uk/2/hi/technology/8382252.stm

Microsoft Corp issued its biggest software patch on record on Tuesday to fix a range of security issues in its programs, including the yet to be released Windows 7 operating system.

In a monthly update sent to users of its software, Microsoft released 13 security bulletins, or patches, to address 34 vulnerabilities it identified across its Windows, Internet Explorer, Silverlight, Office and other products.

It said six of the patches were high priority and should be deployed immediately. The patches — which update software to write over glitches — are designed to protect users from hackers or malicious software downloaded from the Internet.

Several of the patches affect Windows 7, the software maker’s new operating system, which will be officially unveiled next week, but has been widely used in test versions.

Such an early sign of security issues on Windows 7 is potentially worrisome for Microsoft, which is hoping its new operating system will erase bad feelings among many customers who bought the predecessor, Vista.

A Microsoft spokesperson could not immediately say whether the company had identified further security problems with Windows 7. The company generally does not disclose such problems until it has patches available.

The vulnerabilities in Windows 7, including the risk of having a PC taken over by a hacker, were serious flaws, but to be expected, according to Dave Marcus, senior researcher at software security firm McAfee Inc.

“As long as human beings are writing code there are always going to be vulnerabilities,” he said.

Tuesday’s update included the largest number of patches to be issued on a single day by Microsoft.

Corporate users will need to test the patches before they deploy them to make sure they do not cause machines to crash because of compatibility issues with existing software.

Source: http://www.reuters.com

In what it is calling Operation Phish Phry, the F.B.I. began arresting 53 people on Wednesday on charges of conducting a vast financial fraud based on phishing — the act of tricking Internet users into revealing their passwords and other information.

The arrests were in Southern California, Nevada and North Carolina, while the authorities in Egypt sought to arrest 47 people whom the F.B.I. said were co-conspirators.

An 86-page indictment, filed in the United States District Court for the Central District of California in Los Angeles, accuses the defendants of tricking people into giving up their bank account information. The F.B.I. said that this was the largest number of defendants ever charged in a cybercrime case, and that they had stolen at least $2 million from 2007 to last month.

The scams victimized people with accounts at Bank of America and Wells Fargo, two of the nation’s largest banks. The online component of the fraud was perpetrated in Egypt, Keith B. Bolcar, the acting chief of the F.B.I.’s Los Angeles bureau, said. The defendants there sent mass e-mail messages that appeared to be authentic communication from the banks, the F.B.I. said.

The people who clicked on those e-mail messages were sent to fake Web sites made to look identical to the real banking sites, where they were asked to enter personal information like their bank account numbers, passwords, Social Security numbers and drivers’ license numbers.

http://www.nytimes.com

According the news posted on Neowin; an anonymous user posted details of the accounts on October 1 at pastebin.com, a site commonly used by developers to share code snippets. The details have since been removed but Neowin has seen part of the list posted and can confirm the accounts are genuine and most appear to be based in Europe. The list details over 10,000 accounts starting from A through to B, suggesting there could be additional lists. Currently it appears only accounts used to access Microsoft’s Windows Live Hotmail have been posted, this includes @hotmail.com, @msn.com and @live.com accounts.

Neowin has reported this immediately to Microsoft’s Security Response Center and to Microsoft’s PR teams in the UK and US and we are currently awaiting feedback on the situation. As this is a breaking story please check back frequently as the story will be updated as soon as more information becomes available.

If you are a Windows Live Hotmail user Neowin recommends that you change your password and security question immediately.

Read more at http://www.neowin.net

The threat of cybercrime is rising sharply, experts have warned at the World Economic Forum in Davos.

They called for a new system to tackle well-organised gangs of cybercriminals.

Online theft costs $1 trillion a year, the number of attacks is rising sharply and too many people do not know how to protect themselves, they said.

The internet was vulnerable, they said, but as it was now part of society’s central nervous system, attacks could threaten whole economies.

The past year had seen “more vulnerabilities, more cybercrime, more malicious software than ever before”, more than had been seen in the past five years combined, one of the experts reported.

But does that really put “the internet at risk?”, was the topic of session at the annual Davos meeting.

On the panel discussing the issue were Mozilla chairwoman Mitchell Baker (makers of the Firefox browser), McAfee chief executive Dave Dewalt, Harvard law professor and leading internet expert Jonathan Zittrain, Andre Kudelski of Kudelski group, which provides digital security solutions, and Tom Ilube, the boss of Garlik, a firm working on online web identity protection.

They were also joined by Microsoft’s chief research officer, Craig Mundie.

To encourage frank debate, Davos rules do not allow the attribution of comments to individual panellists

Read more at http://news.bbc.co.uk/2/hi/business/davos/7862549.stm