Hydrogen cars set to take to the streets in Wales
Twitter Users Snared in Dark Web's Brisk Password Trade
Data stolen from more than 32 million Twitter users has been offered for sale on the dark web for 10 bitcoin, or around US$5,800, LeakedSource reported Wednesday. LeakedSource has added the account and email information to its searchable repository of compromised credentials.
The data set came from someone called "Tessa88@exploit.im," who has been connected to other large collections of compromised data, including the credentials for 425 million MySpace accounts. The Twitter information consists of 32,888,300 records, LeakedSource said, with each record containing such information as email addresses, usernames and passwords.
The information likely came from compromised user systems rather than from a breach of Twitter's systems, according to LeakedSource.
The hackers were able to infect tens of millions of users' systems with malware that collected saved username and password information from browsers like Chrome and Firefox, the firm explained.
Wide-Reaching Impact
"We have investigated reports of Twitter usernames/passwords on the dark web, and we're confident that our systems have not been breached," tweeted Twitter's Trust and Information Security Officer Michael Coats.
"We are working with @leakedsource to obtain this info & take additional steps to protect users," he added.
Although it doesn't appear that Twitter's systems were breached, the compromised data presents a serious problem to users and service providers around the world, noted Joe Siegrist, vice president and general manager of LastPass.
"It looks like plain text passwords have been stolen from over 32 million consumers, most likely from their browsers -- IE, Chrome, Firefox, Safari," he told TechNewsWorld.
"While it is heavily weighted towards Russian consumers, it's impacting people all over the world," he said.
LeakedSource found in its Twitter data more than 5 million email addresses with the ".ru" domain in them.
"It also means that this isn't just a Twitter attack -- that's just the data source that's being traded," Siegrist continued.
"It means this is an end user plain text password scrape attack which will impact every account the end user saved. Every service provider in the world needs to be on the lookout for nefarious activity," he warned.
Two-Factor Authentication
For some Twitter users -- those who have turned on two-factor authentication -- compromised passwords won't pose much risk to their accounts. Two-factor authentication requires that in addition to a password, a code -- typically sent in the form of a text message to a mobile phone -- also must be entered by an account holder.
"If log-in verification is enabled, then the attacker should not be able to access their account, because they don't have the physical device that's used to authorize the log-in," Symantec Senior Security Response Manager Satnam Narang told TechNewsWorld.
While 2FA will protect a user's Twitter account from compromise, other accounts might be at risk.
"If the Twitter password is reused elsewhere, Twitter two-factor authentication isn't going to help you on those other accounts," Trend Micro Global Threat Communications Manager Christopher Budd told TechNewsWorld.
Not reusing passwords may be difficult for many users, though. After all, even Facebook CEO Mark Zuckerberg reused a password for his Twitter account, which was compromised earlier this week.
To Reuse Is Human
"Many of us reuse our passwords. It's a human habit," said Rajneesh Chopra, vice presdent for product management at Netskope.
"Just last week, Netflix notified some of its users that they should change their passwords because it was the same one they used for LinkedIn," he told TechNewsWorld.
Another dubious practice highlighted in the Twitter incident is the storing of credentials in browsers.
"Browsers aren't the most secure way to store credentials, but it's the most convenient place to do it," Chopra said. "Given that we live our digital life in the browser these days, it ends up being the place where people store their passwords."
Leaks that expose millions of passwords feed the hacker ecosystem, noted Craig Young, a senior security researcher for Tripwire.
"Every password dump helps attackers refine their toolkits," he told TechNewsWorld, and the passwords can be used to hijack accounts and send spam and malicious links to the accounts' followers.
Facebook Turns On Safety Check Following Orlando Slaughter
Facebook on Sunday activated its Safety Check feature for the first time in the United States, in the aftermath of the mass shooting at an Orlando, Florida, night club that left 49 people dead and scores more wounded.
Last year's terrorist attacks in Paris marked the first time Facebook activated the feature for a crisis other than a natural disaster. Safety Check lets users notify loved ones and friends that they're safe. Users can check on people thought to be in the affected area, and mark friends and loved ones as safe when they receive confirmation.
Facebook earlier this month announced that it had tweaked Safety Check to streamline deployment anywhere.
"Many people practically live on Facebook, so this feature is a convenient way for people to notify others of their status," said Mike Jude, a program manager at Stratecast/Frost & Sullivan.
"Rather than having to call many people discretely, this allows anyone on your Facebook network to obtain your status," he told TechNewsWorld.
How It Works
"We're excited to continue working on Facebook's role in crisis response over the coming year, as well as to test new ways for the community to initiate and spread Safety Check in the coming weeks," Facebook's Peter Cottle wrote on June 2 -- little knowing that the upgraded system would be needed just 10 days later.
Here's how it works:
- When a crisis erupts, Facebook runs a small piece of code, or hook, that executes after every News Feed load.
- When someone in the affected area loads their News Feed, Facebook invites that person to mark himself or herself safe with a feed prompt and a notification.
- It then searches for that person's friends in the area. Each friend gets a push notification inviting participation in Safety Check, and Facebook then searches that person's friends to see who might be in the affected area.
- It takes Facebook a few minutes to go through about 100,000 people, and 10-15 minutes to go through millions of people at full capacity.
Facebook has created a proactive testing system that performs shadow launches every 12 hours for a variety of geographic areas, sending out notifications to a database rather than to members.
The number of people "found" is compared against historical expected bounds, and the results are reported.
Facebook has built an internal tool that enables trained teams across time zones to activate Safety Check any time of day for any event anywhere, without needing an engineer to do so.
An internal bot built for Messenger continuously monitors new launches and provides on-demand data reports.
What's Good About Safety Check
"Police tend to get inundated during [emergencies], and they have very little information until well after the event is over," observed Rob Enderle, principal analyst at the Enderle Group.
"This is more real time and lets people communicate en masse," he told TechNewsWorld.
Facebook's "massive user base could make Safety Check a valuable resource for people trying to establish the whereabouts and condition of loved ones," said Charles King, principal analyst at Pund-IT.
Safety Check's effectiveness depends on how -- and how well -- users utilize it," he told TechNewsWorld. "If they don't buy in, Safety Check will be, at best only partially successful."
If users leave geolocation off, that could be a problem. "You could always enable geolocation after the fact, but most people will have their hands too full coping in a disaster to fiddle with their smartphones," King noted.
Safety Check will probably "get a big spike initially. Then, as time goes on -- three or six months or a year later -- people will get complacent," suggested Laura DiDio, a research director at Strategy Analytics.
Issues With Safety Check
One potential Safety Check problem is the possibility that it might send out a false alarm.
Facebook earlier this year apologized for mistakenly sending notifications to the wrong people following a suicide bombing in Pakistan. Some users in New York and Virginia got text messages on their mobile phones asking if they were affected by the explosion with no mention of where it had taken place.
Safety Check "is a good thing but it's not foolproof," DiDio told TechNewsWorld. "Still, it's better than nothing."
Google's Desktop OS
What is it? It's everything, or so it seems. Google Checkout provides an alternative to PayPal. Street View is well on its way to taking a picture of every house on every street in the United States. And the fun is just starting: Google's early-beta Chrome browser earned a 1 percent market share in the first 24 hours of its existence. Android, Google's cell phone operating system, is hitting handsets as you read this, becoming the first credible challenger to the iPhone among sophisticated customers.
When is it coming? Though Google seems to have covered everything, many observers believe that logically it will next attempt to attack one very big part of the software market: the operating system.
The Chrome browser is the first toe Google has dipped into these waters. While a browser is how users interact with most of Google's products, making the underlying operating system somewhat irrelevant, Chrome nevertheless needs an OS to operate.
To make Microsoft irrelevant, though, Google would have to work its way through a minefield of device drivers, and even then the result wouldn't be a good solution for people who have specialized application needs, particularly most business users. But a simple Google OS--perhaps one that's basically a customized Linux distribution--combined with cheap hardware could be something that changes the PC landscape in ways that smaller players who have toyed with open-source OSs so far haven't been quite able to do.
Check back in 2011, and take a look at the not-affiliated-with-Google gOS, thinkgos in the meantime.
32-Core CPUs From Intel and AMD
What is it? With the gigahertz race largely abandoned, both AMD and Intel are trying to pack more cores onto a die in order to continue to improve processing power and aid with multitasking operations. Miniaturizing chips further will be key to fitting these cores and other components into a limited space. Intel will roll out 32-nanometer processors (down from today's 45nm chips) in 2009.
When is it coming? Intel has been very good about sticking to its road map. A six-core CPU based on the Itanium design should be out imminently, when Intel then shifts focus to a brand-new architecture called Nehalem, to be marketed as Core i7. Core i7 will feature up to eight cores, with eight-core systems available in 2009 or 2010. (And an eight-core AMD project called Montreal is reportedly on tap for 2009.)
After that, the timeline gets fuzzy. Intel reportedly canceled a 32-core project called Keifer, slated for 2010, possibly because of its complexity (the company won't confirm this, though). That many cores requires a new way of dealing with memory; apparently you can't have 32 brains pulling out of one central pool of RAM. But we still expect cores to proliferate when the kinks are ironed out: 16 cores by 2011 or 2012 is plausible (when transistors are predicted to drop again in size to 22nm), with 32 cores by 2013 or 2014 easily within reach. Intel says "hundreds" of cores may come even farther down the line.
Google unveils Daydream to create a VR ecosystem for Android
Google’s VR efforts have come a long way since two years ago when Google introduced its inexpensive phone-base VR viewer, Cardboard. Today, as part of the IO Keynote, Google’s Clay Bavor previewed Google Daydream — the company’s upcoming VR platform. Bavor stressed the need for a systems approach to VR, especially as it relates to reducing latency — often called the Motion to Photon time. Daydream isn’t a specific piece of hardware or software, but a set of reference designs and Android enhancements that are aimed at creating a vibrant VR ecosystem on Android devices.
Look for Daydream-Ready Smartphones, with support in Android N
Gogle will be publishing the specs for smartphones that it believes are sufficient for a good Daydream VR experience. Those include requirements on the sensors, display, and compute power of the SoC. Most of the major phone vendors are already working with Google on Daydream-Ready devices, and Google expects them to start coming to market this fall. One interesting note, though, is that Daydream is designed to achieve a latency of under 20ms. That is much slower than desktop VR companies consider acceptable for either comfortable viewing of interactive content or action gaming. HTC and Oculus both push for 11ms (providing a 90fps frame rate). Obviously, they also require a lot more GPU horsepower, but it will be interesting to see how many experiences will work in the slower 50fps world of Daydream, and how much discomfort may result.
Android N will include system support for low-latency, as well as a VR system UI, which will help avoid the problem with smartphone-based VR today, where you need to keep going back and forth between VR apps and the Android UI on the phone screen.
Headset & Controller
Google isn’t announcing a headset, but is making available a reference design for headsets. The sketch they showed (included to the right) looks a lot like Gear VR. Some Daydream-capable headsets are expected to be in the market by Fall. The controller reference design looks like a typical Bluetooth remote, but in addition to a button and a touch-sensitive pad also has an orientation sensor like a Wiimote. As you’d expect, you can therefore use it a bit like a magic wand to control your VR experience.
VR Apps & Ecosystem
Google Play for VR will allow users to find, install, and launch VR apps. Your VR apps will then be incorporated into a Daydream Home screen, that looks very much like the one Oculus uses. It’ll be interesting to see what happens when Oculus meets Google on Android phones — will we have both an Oculus Home and a Daydream Home?
Google is also making a major push to add VR support to its core media offerings. Google Play Movies will allow you to view your Play video content in a Virtual Movie Theater, and Google StreetView will be fully VR-ready — you can already use Gear VR and Cardboard with 360-degree photos in Maps through the StreetView app. YouTube is being rebuilt with VR support, including discovery & playlists in VR, with support for spatial audio.
For those hoping Google would upset the apple cart with a stunning new piece of hardware that would bridge the performance, price and complexity gap between Gear VR and the dedicated headsets like Rift and Vive (like me), that didn’t happen. But Google is certainly making the right moves to provide a vibrant ecosystem for VR content creators and users on the Android platform.
Eiffel Tower - Google Street View
The Eiffel tower was built by Alexander Gustave Eiffel as the entrance arch to the 1889 World's Fair. Since then, almost 250 million have visited this iconic monument in Paris.
Eiffel Tower - View 1
Erected in 1889 as the entrance arch to the 1889 World's Fair, it has become both a global cultural icon of France and one of the most recognizable structures in the world. The tower is the tallest structure in Paris and the most-visited paid monument in the world.
Eiffel Tower - View 2
Erected in 1889 as the entrance arch to the 1889 World's Fair, it has become both a global cultural icon of France and one of the most recognizable structures in the world. The tower is the tallest structure in Paris and the most-visited paid monument in the world.
Eiffel Tower - View 3
Erected in 1889 as the entrance arch to the 1889 World's Fair, it has become both a global cultural icon of France and one of the most recognizable structures in the world. The tower is the tallest structure in Paris and the most-visited paid monument in the world.
Eiffel Tower - View 4
Erected in 1889 as the entrance arch to the 1889 World's Fair, it has become both a global cultural icon of France and one of the most recognizable structures in the world. The tower is the tallest structure in Paris and the most-visited paid monument in the world.
Eiffel Tower - View 5
Erected in 1889 as the entrance arch to the 1889 World's Fair, it has become both a global cultural icon of France and one of the most recognizable structures in the world. The tower is the tallest structure in Paris and the most-visited paid monument in the world.
Subscribe to:
Posts (Atom)