Monthly Archives: May 2015

AVG

Three reasons to be excited about: 3D printing

The fledgling industry has grown rapidly and is estimated to be valued around $16 billion by 2018. Now it seems that almost anything is possible. Here are some of the three great uses of 3D printing technology emerging today.

 

Clinical testing

Cosmetics company L’Oreal has started developing 3D printed skin to help them test cosmetics without the need for animals or real human skin. Working in collaboration with bio engineering company organovo, L’Oreal said “Our partnership will not only bring about new advances in vitro methods for evaluating product safety and performance, but the potential for where this new field of technology and research can take us is boundless.”

This is clearly a big step forward for a whole range of cosmetics and can help build a future less dependent on animal testing.

3D Skin

Image courtesy of BBC

 

Fashion and textiles

While it most fashion conscious people may take some convincing before they agree to don a garment made out of 3D printed fabrics, the emerging industry shows a lot of promise and potential.

The opportunity to create custom pieces, built to specific physical dimensions could potentially give clothes of the future a convenience and suitability rarely found in traditional clothes.

It doesn’t stop there though, when you consider the market for fashion bags and accessories, the possibilities for customization and personalization are as broad as they are deep.

Video

3D Printed Fashion Accessories

 

Body Parts

Perhaps the biggest success story for 3D printing thus far has been in the area of prosthetic limbs and body parts. Recently, a seven year old California girl received a new 3D printed prosthetic hand that was created for only $50.

Video

3D Printed Prosthetics

Clearly this is one of the most inspiring and uplifting ways that 3D printing technology can touch lives for the better, but it’s not just for humans.

In the last few days, a loggerhead turtle that was gravely wounded in an accident with a boat propeller received a brand new 3D printed jaw. Without its brand new 3D printed titanium jaw, the turtle would have had to spend a lifetime in captivity, unable to fend for itself in the wild.

3D Turtle Jaw

Photo: BTech Innovation

 

What most excites you about 3D printing. I’d love to hear from you on Twitter or Facebook.

Title image courtesy of CNN.com

AVG

Three reasons to be excited about: 3D printing

The fledgling industry has grown rapidly and is estimated to be valued around $16 billion by 2018. Now it seems that almost anything is possible. Here are some of the three great uses of 3D printing technology emerging today.

 

Clinical testing

Cosmetics company L’Oreal has started developing 3D printed skin to help them test cosmetics without the need for animals or real human skin. Working in collaboration with bio engineering company organovo, L’Oreal said “Our partnership will not only bring about new advances in vitro methods for evaluating product safety and performance, but the potential for where this new field of technology and research can take us is boundless.”

This is clearly a big step forward for a whole range of cosmetics and can help build a future less dependent on animal testing.

3D Skin

Image courtesy of BBC

 

Fashion and textiles

While it most fashion conscious people may take some convincing before they agree to don a garment made out of 3D printed fabrics, the emerging industry shows a lot of promise and potential.

The opportunity to create custom pieces, built to specific physical dimensions could potentially give clothes of the future a convenience and suitability rarely found in traditional clothes.

It doesn’t stop there though, when you consider the market for fashion bags and accessories, the possibilities for customization and personalization are as broad as they are deep.

Video

3D Printed Fashion Accessories

 

Body Parts

Perhaps the biggest success story for 3D printing thus far has been in the area of prosthetic limbs and body parts. Recently, a seven year old California girl received a new 3D printed prosthetic hand that was created for only $50.

Video

3D Printed Prosthetics

Clearly this is one of the most inspiring and uplifting ways that 3D printing technology can touch lives for the better, but it’s not just for humans.

In the last few days, a loggerhead turtle that was gravely wounded in an accident with a boat propeller received a brand new 3D printed jaw. Without its brand new 3D printed titanium jaw, the turtle would have had to spend a lifetime in captivity, unable to fend for itself in the wild.

3D Turtle Jaw

Photo: BTech Innovation

 

What most excites you about 3D printing. I’d love to hear from you on Twitter or Facebook.

Title image courtesy of CNN.com

AVG

Distracted Drivers Pose a Greater Challenge on our Roads than Driverless Cars

Google announced last Friday that a prototype of its own self-driving car will hit the streets in its hometown of Mountain View, CA in a pilot test.  Each car will be equipped with a human ready to take over the wheel, if needed, and the car speed will be capped at 25 mph.

Google also revealed its track record for autonomous vehicle safety with impressive results thus far. In the 1.7 million miles of the manual and autonomous driving Google has logged in the past six years, there have only been 11 minor accidents—all of which were caused by other drivers—and none resulting in injuries.

Google’s Chris Urmson, director of its driverless car program, said in a statement: “…not once was the self-driving car the cause of the accident.”

These early numbers are impressive, especially since these driverless cars have been on the road for 10,000 miles a week and in some crazy driving conditions.

About those accidents, Urmson noted: “Rear-end crashes are the most frequent accidents in America, and often there’s little the driver in front can do to avoid getting hit; we’ve been hit from behind seven times, mainly at traffic lights but also on the freeway. We’ve also been side-swiped a couple of times and hit by a car rolling through a stop sign.”

You can see a detailed report by Urmson in his article on Medium.

Video

Ready for the road

Though some continue to question the safety of testing driverless vehicles on public highways, and we have a ways to go before autonomous driving hits prime time… it’s also good to keep in perspective the impact of human error (the cause of 94% of accidents) and the risk of distracted drivers.

Lot’s of people aren’t paying attention on our roadways, which Google’s driverless cars have experienced.

People are eating, drinking, smoking, talking on cell phones, adjusting their entertainment consoles, navigating via digital maps, or you name it.  On any given day, Distracted.gov estimates over 660,000 vehicles are being driven by someone using a hand-held cell phone… And it has been shown that a lot of our distraction has to do with drivers using smartphone technology while behind the wheel.

In fact, AT&T this week released an alarming new survey that shows that motorists have expanded their behind-the-wheel activities from just talking and texting to use of Facebook, Twitter, taking selfies and even videos.

Here are a few of AT&T’s salient numbers of smartphone activities undertaken while driving:

  • 70% people engage in smartphone activities while driving
  • 61% text
  • Nearly 40% use social media
  • About 30% surf the net and/or use Facebook
  • 17% snap selfies
  • 14% use Twitter, Integra
  • Around 10%-plus use video chat and Snap Chat

 

AT&T revealed the research along with its launch of its expanded “It Can Wait” ad campaign, moving its focus from just texting while driving to include other smartphone driving distractions.

Other recent studies indicate that anything that takes your attention away from the road for just two seconds or longer can increase the risk of an accident from four to 24 times…Sending or reading a text takes your eyes off the road for 5 seconds, according to info collected by Distracted.gov. Imagine the seconds devoted to viewing real-time social media feeds, or framing a selfie?

People very well should be concerned about bumps in the road for fully autonomous cars, which are a lot more than smartphones on wheels. But the usage of smartphone technology inside our autos poses another and very real safety challenge and far bigger threat today that we need to be more focused on and deal with!

I applaud AT&Ts effort and those of others to educate the public on the problem of technology-induced distracted driving – although a lot more than education needs to be done.

And I also applaud Google’s goal to have smart self-driving cars in the future to at least share the burden of driving with humans. It may not solve all of our roadway safety problems in the future – but it sure may help!

In the meantime, it’s incumbent upon all of us in technology industry who are contributing to our increasingly connected mobile future, to be vigilant about all aspects of our products’ safety, security, and privacy.

Title image courtesy of Google.

AVG

Distracted Drivers Pose a Greater Challenge on our Roads than Driverless Cars

Google announced last Friday that a prototype of its own self-driving car will hit the streets in its hometown of Mountain View, CA in a pilot test.  Each car will be equipped with a human ready to take over the wheel, if needed, and the car speed will be capped at 25 mph.

Google also revealed its track record for autonomous vehicle safety with impressive results thus far. In the 1.7 million miles of the manual and autonomous driving Google has logged in the past six years, there have only been 11 minor accidents—all of which were caused by other drivers—and none resulting in injuries.

Google’s Chris Urmson, director of its driverless car program, said in a statement: “…not once was the self-driving car the cause of the accident.”

These early numbers are impressive, especially since these driverless cars have been on the road for 10,000 miles a week and in some crazy driving conditions.

About those accidents, Urmson noted: “Rear-end crashes are the most frequent accidents in America, and often there’s little the driver in front can do to avoid getting hit; we’ve been hit from behind seven times, mainly at traffic lights but also on the freeway. We’ve also been side-swiped a couple of times and hit by a car rolling through a stop sign.”

You can see a detailed report by Urmson in his article on Medium.

Video

Ready for the road

Though some continue to question the safety of testing driverless vehicles on public highways, and we have a ways to go before autonomous driving hits prime time… it’s also good to keep in perspective the impact of human error (the cause of 94% of accidents) and the risk of distracted drivers.

Lot’s of people aren’t paying attention on our roadways, which Google’s driverless cars have experienced.

People are eating, drinking, smoking, talking on cell phones, adjusting their entertainment consoles, navigating via digital maps, or you name it.  On any given day, Distracted.gov estimates over 660,000 vehicles are being driven by someone using a hand-held cell phone… And it has been shown that a lot of our distraction has to do with drivers using smartphone technology while behind the wheel.

In fact, AT&T this week released an alarming new survey that shows that motorists have expanded their behind-the-wheel activities from just talking and texting to use of Facebook, Twitter, taking selfies and even videos.

Here are a few of AT&T’s salient numbers of smartphone activities undertaken while driving:

  • 70% people engage in smartphone activities while driving
  • 61% text
  • Nearly 40% use social media
  • About 30% surf the net and/or use Facebook
  • 17% snap selfies
  • 14% use Twitter, Integra
  • Around 10%-plus use video chat and Snap Chat

 

AT&T revealed the research along with its launch of its expanded “It Can Wait” ad campaign, moving its focus from just texting while driving to include other smartphone driving distractions.

Other recent studies indicate that anything that takes your attention away from the road for just two seconds or longer can increase the risk of an accident from four to 24 times…Sending or reading a text takes your eyes off the road for 5 seconds, according to info collected by Distracted.gov. Imagine the seconds devoted to viewing real-time social media feeds, or framing a selfie?

People very well should be concerned about bumps in the road for fully autonomous cars, which are a lot more than smartphones on wheels. But the usage of smartphone technology inside our autos poses another and very real safety challenge and far bigger threat today that we need to be more focused on and deal with!

I applaud AT&Ts effort and those of others to educate the public on the problem of technology-induced distracted driving – although a lot more than education needs to be done.

And I also applaud Google’s goal to have smart self-driving cars in the future to at least share the burden of driving with humans. It may not solve all of our roadway safety problems in the future – but it sure may help!

In the meantime, it’s incumbent upon all of us in technology industry who are contributing to our increasingly connected mobile future, to be vigilant about all aspects of our products’ safety, security, and privacy.

Title image courtesy of Google.

Avira

Unlimited Free Coffee at Starbucks? A Hacker Made It Happen

Egor Homakov made it actually happen. In his blogpost he describes how he managed to find a way to generate an unlimited amount of money on Starbucks gift cards.

If you are like me the only thing you want to know now is “HOW?!” (and your second thought will probably be: I want this so bad!).  So let me curve your enthusiasm right now: Homakov of course did the right thing and reported the exploit to Starbucks.

Now back to topic! What the security expert did was to use a vulnerability called “race condition”. He bought three Starbucks card for $5 each and tried to use the vulnerability to transfer money between the cards without it being deduced.

“So the transfer of money from card1 to card2 is stateful: first request POST /step1?amount=1&from=wallet1&to=wallet2 saves these values in the session and the second POST/step2?confirm actually transfers the money and clears the session”, Homakov writes and continues: “After 5 failed attempts I was about to give up. Race condition is a kind of a vulnerability when you never know if the app is vulnerable, you just need to try some more. […]But yeah, the 6th request created two $5 transfers from wallet1 with 5 dollars balance. Now we have 2 cards with 15 and 5 (20 in total).”

The only thing left to do was to buy something with this money in order to deliver the  proof of concept. One chicken sandwich, a few bottles of water, and some gum later the new balance on his cards was $5.70.

Starbucks was pretty unhappy with the stunt despite Homakov adding the $10 to his account from his credit card and disclosing the bug immediately.  They might have been even unhappier though, if a lot of hungry and coffee addicted customers would have abused the system …

The post Unlimited Free Coffee at Starbucks? A Hacker Made It Happen appeared first on Avira Blog.

Security

Sendio ESP Information Disclosure

Core Security Technologies Advisory – Sendio ESP (E-mail Security Platform) is a network appliance which provides anti-spam and anti-virus solutions for enterprises. Two information disclosure issues were found affecting some versions of this software, and can lead to leakage of sensitive information such as user’s session identifiers and/or user’s email messages.

Fedora

Fedora 20 Security Update: fail2ban-0.9.2-1.fc20

Resolved Bugs
1169026 – fail2ban jail.conf needs to list multiple log paths in logpath on multiple lines
1128152 – fail2ban pam-generic jail uses /var/log/auth.log, which does not exist
1169024 – Please upgrade to fail2ban 0.9.1
1047436 – Fail2ban fails to start because of /var/log/secure not found<br
ver. 0.9.2 (2015/04/29) – better-quick-now-than-later
———-
– Fixes:
* infinite busy loop on _escapedTags match in substituteRecursiveTags gh-907. Thanks TonyThompson
* port[s] typo in jail.conf/nginx-http-auth gh-913. Thanks Frederik Wagner (fnerdwq)
* $ typo in jail.conf. Thanks Skibbi. Debian bug #767255
* grep’ing for IP in *mail-whois-lines.conf should now match also at the beginning and EOL. Thanks Dean Lee
* jail.conf
– php-url-fopen: separate logpath entries by newline
* failregex declared direct in jail was joined to single line (specifying of multiple expressions was not possible).
* filters.d/exim.conf – cover different settings of exim logs
details. Thanks bes.internal
* filter.d/postfix-sasl.conf – failregex is now case insensitive
* filters.d/postfix.conf – add ‘Client host rejected error message’ failregex
* fail2ban/__init__.py – add strptime thread safety hack-around
* recidive uses iptables-allports banaction by default now.
Avoids problems with iptables versions not understanding ‘all’ for protocols and ports
* filter.d/dovecot.conf
– match pam_authenticate line from EL7
– match unknown user line from EL7
* Use use_poll=True for Python 2.7 and >=3.4 to overcome “Bad file
descriptor” msgs issue (gh-161)
* filter.d/postfix-sasl.conf – tweak failregex and add ignoreregex to ignore system authentication issues
* fail2ban-regex reads filter file(s) completely, incl. ‘.local’ file etc. (gh-954)
* firewallcmd-* actions: split output into separate lines for grepping (gh-908)
* Guard unicode encode/decode issues while storing records in the database.
Fixes “binding parameter error (unsupported type)” (gh-973), thanks to kot for reporting
* filter.d/sshd added regex for matching openSUSE ssh authentication failure
* filter.d/asterisk.conf:
– Dropped “Sending fake auth rejection” failregex since it incorrectly targets the asterisk server itself
– match “hacking attempt detected” logs
– New Features:
– New filters:
– postfix-rbl Thanks Lee Clemens
– apache-fakegooglebot.conf Thanks Lee Clemens
– nginx-botsearch Thanks Frantisek Sumsal
– drupal-auth Thanks Lee Clemens
– New recursive embedded substitution feature added:
– `<HOST>` becomes “ for PREF=`IPV4`;
– `<HOST>` becomes `1.2.3.4` for PREF=`IPV4` and IPV4HOST=`1.2.3.4`;
– New interpolation feature for config readers – `%(known/parameter)s`. (means last known option with name `parameter`). This interpolation makes possible to extend a stock filter or jail regexp in .local file (opposite to simply set failregex/ignoreregex that overwrites it), see gh-867.
– Monit config for fail2ban in files/monit/
– New actions:
– action.d/firewallcmd-multiport and action.d/firewallcmd-allports Thanks Donald Yandt
– action.d/sendmail-geoip-lines.conf
– action.d/nsupdate to update DNSBL. Thanks Andrew St. Jean
– New status argument for fail2ban-client — flavor:
fail2ban-client status [flavor]
– empty or “basic” works as-is
– “cymru” additionally prints (ASN, Country RIR) per banned IP (requires dnspython or dnspython3)
– Flush log at USR1 signal
– Enhancements:
* Enable multiport for firewallcmd-new action. Closes gh-834
* files/debian-initd migrated from the debian branch and should be suitable for manual installations now (thanks Juan Karlo de Guzman)
* Define empty ignoreregex in filters which didn’t have it to avoid warnings (gh-934)
* action.d/{sendmail-*,xarf-login-attack}.conf – report local
timezone not UTC time/zone. Closes gh-911
* Conditionally log Ignore IP with reason (dns, ip, command). Closes gh-916
* Absorbed DNSUtils.cidr into addr2bin in filter.py, added unittests
* Added syslogsocket configuration to fail2ban.conf
* Note in the jail.conf for the recidive jail to increase dbpurgeage (gh-964)
– Update to 0.9.1:
Refactoring (IMPORTANT — Please review your setup and configuration):
iptables-common.conf replaced iptables-blocktype.conf (iptables-blocktype.local should still be read) and now also provides defaults for the chain, port, protocol and name tags
Fixes:
start of file2ban aborted (on slow hosts, systemd considers the server has been timed out and kills him), see gh-824
UTF-8 fixes in pure-ftp thanks to Johannes Weberhofer. Closes gh-806.
systemd backend error on bad utf-8 in python3
badips.py action error when logging HTTP error raised with badips request
fail2ban-regex failed to work in python3 due to space/tab mix
recidive regex samples incorrect log level
journalmatch for recidive incorrect PRIORITY
loglevel couldn’t be changed in fail2ban.conf
Handle case when no sqlite library is available for persistent database
Only reban once per IP from database on fail2ban restart
Nginx filter to support missing server_name. Closes gh-676
fail2ban-regex assertion error caused by miscount missed lines with multiline regex
Fix actions failing to execute for Python 3.4.0. Workaround for http://bugs.python.org/issue21207
Database now returns persistent bans on restart (bantime < 0)
Recursive action tags now fully processed. Fixes issue with bsd-ipfw action
Fixed TypeError with “ipfailures” and “ipjailfailures” action tags. Thanks Serg G. Brester
Correct times for non-timezone date times formats during DST
Pass a copy of, not original, aInfo into actions to avoid side-effects
Per-distribution paths to the exim’s main log
Ignored IPs are no longer banned when being restored from persistent database
Manually unbanned IPs are now removed from persistent database, such they wont be banned again when Fail2Ban is restarted
Pass “bantime” parameter to the actions in default jail’s action definition(s)
filters.d/sieve.conf – fixed typo in _daemon. Thanks Jisoo Park
cyrus-imap — also catch also failed logins via secured (imaps/pop3s). Regression was introduced while strengthening failregex in 0.8.11 (bd175f) Debian bug #755173
postfix-sasl – added journalmatch. Thanks Luc Maisonobe
postfix* – match with a new daemon string (postfix/submission/smtpd). Closes gh-804 . Thanks Paul Traina
apache – added filter for AH01630 client denied by server configuration.
New features:
New filters:
monit Thanks Jason H Martin
directadmin Thanks niorg
apache-shellshock Thanks Eugene Hopkinson (SlowRiot)
New actions:
symbiosis-blacklist-allports for Bytemark symbiosis firewall
fail2ban-client can fetch the running server version
Added Cloudflare API action
Enhancements
Start performance of fail2ban-client (and tests) increased, start time and cpu usage rapidly reduced. Introduced a shared storage logic, to bypass reading lots of config files (see gh-824). Thanks to Joost Molenaar for good catch (reported gh-820).
Fail2ban-regex – add print-all-matched option. Closes gh-652
Suppress fail2ban-client warnings for non-critical config options
Match non “Bye Bye” disconnect messages for sshd locked account regex
courier-smtp filter:
match lines with user names
match lines containing “535 Authentication failed” attempts
Add tag to iptables-ipsets
Realign fail2ban log output with white space to improve readability. Does not affect SYSLOG output
Log unhandled exceptions
cyrus-imap: catch “user not found” attempts
Add support for Portsentry
– Fix php-url-fopen logpath

Fedora

Fedora 20 Security Update: ufraw-0.21-1.fc20

Resolved Bugs
1221249 – CVE-2015-3885 dcraw: input sanitization flaw leading to buffer overflow
1221258 – CVE-2015-3885 ufraw: dcraw: input sanitization flaw leading to buffer overflow [fedora-all]<br
This update contains a fix for a bug which could cause dcraw write past array boundaries.
Additionally, it updates ufraw to version 0.21, an upstream bugfix release.