Archive for the “Technology” Category
Here’s an early Christmas present for all those going in and out of Greensboro, Piedmont Triad Airport, FREE Wifi courtesy of Google. Unlike the typical $10 or more per day to get that twenty minutes of browsing before your flight you will be able to check that last email all thanks to Google. On top of this if your flying Virgin America, probably not for most of us, you will also be able to browse the Internet on any flight.
Word of warning as I’ve posted here before on using public WiFi:
- Always use a software firewall, XP’s built in Firewall will suffice
- Do not browse any site where you will enter private data unless that site is SSL, even then there is a risk of a man in the middle attack
- NEVER send private data via email, on a Public WiFi or not!
- Always assume your browsing is monitored when on a Public WiFi
No Comments »
Through our retail partners, Microsoft is introducing an all-new Product Key Card to help consumers more easily access and experience Office 2010 on new PCs that have been pre-loaded with Office 2010. The Product Key Card is a single license card (with no DVD media) that will be sold at major electronic retail outlets.
The key number contained on the card will unlock Office 2010 software that has been pre-loaded by the PC manufacturers on their PCs, and enables a simpler and faster path for consumers to begin using any one of three full versions of Microsoft Office – Office Home & Student 2010, Office Home & Business 2010, or Office Professional 2010.
As part of Office 2010 software that will be pre-loaded by the PC manufacturers on their PCs, we’re introducing Microsoft Office Starter 2010.
Office Starter 2010 will include Office Word Starter 2010 and Office Excel Starter 2010, with the basic functionality for creating, viewing and editing documents. Office Starter 2010 will replace Microsoft Works.
No Comments »
Severity: High
5 November, 2009
Summary:
§ This vulnerability affects: Adobe Shockwave Player 11.5.1.601 and earlier, running on Windows and Macintosh computers
§ How an attacker exploits it: By enticing your users to visit a website containing a malicious Flash file
§ Impact: An attacker can execute code on your computer, potentially gaining control of it
§ What to do: Download and install the latest version of Adobe Shockwave Player
Exposure:
Adobe Shockwave Player displays interactive, animated web content called Shockwave (.SWF) files. According to Adobe, Shockwave Player is installed on some 450 million PCs.
In a security bulletin released late Tuesday, Adobe warned of critical vulnerabilities that affect Adobe Shockwave Player 11.5.1.601 for Windows and Macintosh (as well as all earlier versions). Adobe’s bulletin refers to five CVE numbers, which suggests that their update fixes five security vulnerabilities. The bulletin doesn’t describe the flaws in much technical detail. However, it does warn that if an attacker can entice one of your users to visit a malicious website containing specially crafted Shockwave (SWF) content, he could exploit this unspecified vulnerability to execute code on that user’s computer, with that user’s privileges. If your Windows users have local administrator privileges, an attacker could exploit this flaw to gain full control of their PC.
If you deploy Adobe Shockwave throughout your network, we recommend you download and install the latest version as soon as you can.
Solution Path
Adobe has released a new version of Shockwave Player, version 11.5.2.602. If you use Adobe Flash in your network, we recommend you download and deploy this updated player as soon as possible.
Status:
Adobe has released a Shockwave Player update to fix these vulnerabilities.
References:
§ Adobe Security Bulletin
This alert was researched and written by Corey Nachreiner, CISSP.
|
No Comments »
T-Mobile has a message on their website saying customers may be experiencing trouble with both voice and data services.

No Comments »
As we all know Carbonite is dirt cheap and although I have issues with it nor would I recommend it there are clearly a large number of people that do. Recently however there has been a growing voice of concern with statements in Carbonite’s Terms of Service and Privacy Policy which has reached the general masses.
“Carbonite may disclose your Personal Information to third parties if we believe that such action is necessary to (1) comply with a law, regulation, or governmental or judicial warrant, rule, or order; (2) protect and defend the rights or property of Carbonite; (3) enforce the Carbonite Terms and Conditions of Use and/or this Privacy Policy. Carbonite may also provide access to your Backup Data to government authorities if Carbonite suspects or believes that the data contain child pornography or other prohibited data, or that the data or the Carbonite Products or Services are being used for illegal purposes. Carbonite will provide access to your Backup Data to your surviving spouse and/or your executor upon presentation of a death certificate and identification which Carbonite reasonably believes to be valid and sufficient, or in response to a court order, warrant, subpoena or other judicial or administrative legal process.”
http://www.carbonite.com/privacy/
The above statement that Carbonite can and will provide access to stored, encrypted, data is an obvious concern but could also violate Federal regulations on data security. For example the only way I can see how a medical office can store data to an online service is if they can show there is no possible path to that data becoming compromised. With eSecureBackups we are secure in the belief that all data is encrypted locally with a key only the local computer (keyfile) or user knows.
Your pass phrase is encrypted twice before it is stored on the server to prevent anyone but you from recovering the stored pass phrase. The system is designed so that recovering a pass phrase requires action from two people: the person that created the key and a senior level server technician. Neither person can recover the pass phrase without the cooperation of the other person. The system is also designed so that only the creator of the pass phrase can view the pass phrase once it is recovered. Data blocks are compressed, encrypted with AES-256-bit and your private pass phrase, digitally signed for integrity verification upon restore, and tagged with multiple strong checksums to provide data integrity assurance. The encrypted data is then encrypted again as it enters the Internet, until it reaches one of the secure data centers.
Per the Carbonite paragraph they are clearly saying they have the ability to bypass encryption. If data can be accessed by a third party either through legal warrant or nefarious act then the requirements of HIPAA or PCI would prevent use of such services by most businesses. With eSecureBackups the Pass Phrase is wrapped twice using only data known to the end user as one of those protections. With the use of specific questions and answers known only to the end user the Pass Phrase cannot be recovered and without the Pass Phrase the data cannot be decrypted.
Bottom line just because a service says your data is secure or encrypted it is still up to the end user to do some basic checking to see how the process is designed to work, does work and how any potential regulatory needs may apply. Also for the true security geek or totally paranoid there is nothing preventing you from encrypting your data manually by way of a third party application such as TrueCypt prior to using an online service.
No Comments »
What an excellent title to a blog, unfortunately it’s not mine but from The Silicon Valley Watcher. The topic of the post was a recent event hosted by Google called Breakthrough Learning in a Digital Age. This two day event brought together 200 of the nation’s top thought leaders in science and technology, informal and formal education, entertainment media, research, philanthropy, and policy to create and act upon a breakthrough strategy for scaling-up effective models of teaching and learning for children. The forum will showcase cutting edge research, proven and promising models to challenge decision-makers in key sectors to help "refresh and reboot" American global leadership in education.
For those who don’t know the history of Google the co-founder Sergey Brin dropped out of Stanford to start Google and is now the 26th richest man in the world. Both of Brin’s parents were well educated with his father being a mathematics professor. Brin followed his fathers interest in mathematics but also was interested in computer science and was in the graduate computer science program before he dropped out. He is quoted from this event as saying:
"It’s important for students to be put in touch with real-world problems," Brin said. "The curriculum should include computer science. Mathematics should include statistics. The curriculums should really adjust."
So far they have not posted a recording of the event but hopefully that will be forthcoming.
No Comments »
So Mayor Joines has told Dell he expects them to repay some 26.5 Million Dollars in direct payments and expenses linked to bring Dell to North Carolina and in theory it appears Dell has agreed in their reply letter. Of course this does not include any of the cost associated with road projects completed for Dell, wine and dines that surely took place, travel by city and county officials, etc, etc.

No Comments »
This is pretty sad to see Dell charge two different prices for the same product or service.
On the Dell Business site go select a Dell Inspiron 15 and at a base price of $659 it cost $100 to upgrade to Windows 7 Professional from Windows 7 Home Premium:
If however you select a Vostro 220 based priced at $419 and want to upgrade from Windows 7 Home Premium to Windows 7 Professional it’s $70. The difference is the Vostro runs x86 or a 32 bit OS and the Inpiron x64 or a 64 bit OS for which Microsoft does not charge a difference.
No Comments »
|