By BeauHD from Slashdot's fake-it-till-you-break-it department
An anonymous reader quotes a report from ZDNet: A team of academics from the Ruhr-University Bochum in Germany say they've managed to break the digital signing system and create fake signatures on 21 of 22 desktop PDF viewer apps and five out of seven online PDF digital signing services. This includes apps such as Adobe Acrobat Reader, Foxit Reader, and LibreOffice, and online services like DocuSign and Evotrust --just to name the most recognizable names. The five-person research team has been working since early October 2018 together with experts from Germany's Computer Emergency Response Team (BSI-CERT) to notify impacted services. The team went public with their findings over the weekend after all affected app makers and commercial companies finished patching their products. In research published today, the Ruhr-University Bochum team described three vulnerabilities that they found in the digital signing process used by several desktop and web-based PDF signing services. Summarized, they are:
1. Universal Signature Forgery (USF) -- vulnerability lets attackers trick the signature verification process into showing users a fake panel/message that the signature is valid.
2. Incremental Saving Attack (ISA) -- vulnerability lets attackers add extra content to an already signed PDF document via the "incremental saving (incremental update)" mechanism, but without breaking the already-existing signature.
3. Signature Wrapping (SWA) -- vulnerability is similar to ISA, but the malicious code also contains extra logic to fool the signature validation process into "wrapping" around the attacker's extra content, effectively digitally signing the incremental update. Additional details about the three vulnerabilities are available in this PDF research paper [1, 2], this blog post, and this dedicated website.Read Replies (0)
By BeauHD from Slashdot's reorganization-plans department
bbsguru writes: Windstream Holdings Inc. of Arkansas filed for Chapter 11 bankruptcy on Monday, less than two weeks after a federal court judge found that the 2015 spinoff of its fiber and copper assets into a separate company ran afoul of bond covenants, exposing the company to a $310 million judgment. Windstream, a spinoff of the old Alltel Corp. of Arkansas, reported $5.8 billion in revenue in 2017. It employs about 13,000 companywide. CEO Tony Thomas said in a press release that the reorganization is "a necessary step to address the financial impact" of the judge's decision and "the impact it would have on consumers and businesses across the states in which we operate." "Taking this proactive step will ensure that Windstream has access to the capital and resources we need to continue building on Windstream's strong operational momentum while we engage in constructive discussions with our creditors regarding the terms of a consensual plan of reorganization," Thomas said. "We acted decisively to secure the long-term financial stability of Windstream, and we are confident that, upon completion of the reorganization process, we will be even better positioned to invest in our business, expand our speed and capabilities for our customers and compete for the long term." A court approval of a reorganization plan will allow the company to continue paying its employees and maintain relationships with vendors, business partners and customers, Thomas said.Read Replies (0)
By msmash from Slashdot's future department
Last week, a SpaceX Falcon 9 rocket carried an Israeli-made spacecraft named Beresheet beyond the grasp of Earth's gravity and sent it on its way to the surface of the moon. On board Beresheet is a specially designed disc encoded with a 30-million-page archive of human civilization built to last billions of years into the future. From a report: The backup for humanity has been dubbed "The Lunar Library" by its creator, the Arch Mission Foundation (AMF). "The idea is to place enough backups in enough places around the solar system, on an ongoing basis, that our precious knowledge and biological heritage can never be lost," the nonprofit's co-founder Nova Spivack told CNET via email.
The disc aboard Beresheet is about the size and thickness of a DVD, but consists of 25 stacked thin nickel films that AMF insists can resist radiation, extreme temperatures and other harsh conditions found in space for billions of years. There is, of course, no way to test how long it will last, but if it survives as long as hoped, the disc may even be around longer than the moon itself. The top four layers are actually filled with 60,000 pages of tiny analog images that can be viewed with optical microscope technology that's been around for centuries. The images include a sort of users' guide explaining human language, the contents of the disc and how to access the deeper layers containing compressed digital data.Read Replies (0)
By msmash from Slashdot's growing-concerns department
Leading US paleontologists are calling for a worldwide halt to the sale of vertebrate dinosaur fossils. The booming market for specimens, driven by their popularity with wealthy private collectors, including Hollywood stars, is pushing up prices and putting them out of reach of museums and scientists, they say. From a report: While the art market is organized around brand-name artists, dinosaur sales are all about celebrity species, with a tyrannosaurus rex skeleton fetching up to $10m, although the velociraptor is the most prized. The price tag for a triceratops's skull is $170,000 to $400,000, and a diplodocus is $570,000 to $1.1m. Last year a complete egg of an aepyornis maximus, otherwise known as an elephant bird, sold for $130,000 -- roughly five times what it would have gone for a decade earlier.
Last year the US Society of Vertebrate Palaeontology (SVP) called on the Parisian auction house Aguttes to cancel a sale inside the Eiffel tower that contained just one lot: a 29-foot-long dinosaur of a yet-to-be identified species. The winning bidder paid $2.3m for the piece. Executive members of the society drew attention to the claim that the winning bidder could name the species, calling that assertion "misleading because the naming of new species is governed by the rules of the International Code of Nomenclature." "The sale of all fossils is inappropriate," says Catherine Badgley, former president of the SVP, which represents more than 2,200 international palaeontologists. "Many, particularly vertebrate fossils, are rarely common, and it's certainly not the case for dinosaurs. The commodification is in principle inappropriate because it motivates unscrupulous people."Read Replies (0)
By msmash from Slashdot's end-of-life department
Drupal 7, which was first released in January 2011, will reach end of life (EOL) in November of 2021, the Drupal Association said today. What this means for your Drupal 7 sites is, as of November 2021: 1. Drupal 7 will no longer be supported by the community at large. The community at large will no longer create new projects, fix bugs in existing projects, write documentation, etc. around Drupal 7.
2. There will be no more core commits to Drupal 7.
3. The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 core or contributed modules, themes, or other projects. Reports about Drupal 7 vulnerabilities might become public creating 0 day exploits.
4. All Drupal 7 releases on all project pages will be flagged as not supported. Maintainers can change that flag if they desire to.
5. On Drupal 7 sites with the update status module, Drupal Core will show up as unsupported.
6. After November 2021, using Drupal 7 may be flagged as insecure in 3rd party scans as it no longer gets support.
7. Best practice is to not use unsupported software, it would not be advisable to continue to build new Drupal 7 sites.
8. Now is the time to start planning your migration to Drupal 8.Read Replies (0)
By BeauHD from Slashdot's too-vague department
A federal judge has blocked Washington State's 2004 cyberstalking law after ruling that a key provision violated First Amendment protections for free speech due to vague terms. "Its prohibitions against speech meant to 'harass, intimidate, torment or embarrass' weren't clearly defined, according to the judge, and effectively criminalized a 'large range' of language guarded under the Constitution," reports Engadget. "You could theoretically face legal action just by criticizing a public figure." From the report: The ruling came after a retired Air Force Major, Richard Rynearson III, sued to have the law overturned. He claimed that Kitsap County threatened to prosecute him under the cyberstalking law for criticizing an activist involved with a memorial to Japanese victims of U.S. internment camps during World War II. While Rynearson would use "invective, ridicule, and harsh language," the judge said, his language was neither threatening nor obscene.
Officials had contended that the law held up because it targeted conduct, not the speech itself. They also maintained that Rynearson hadn't shown evidence of a serious threat -- just that the prosecutor's office would see how Rynearson behaved and take action if necessary. A county court had already tossed out the activist's restraining order against Rynearson over free speech. It's not clear whether Washington will appeal the decision. If the ruling stays, though, it could force legislators to significantly narrow the scope if it wants a cyberstalking law to remain in place. This might also set a precedent that could affect legislation elsewhere in the country. The Electronic Frontier Foundation praises the judge's decision, adding: "This is all valuable speech that is protected by the First Amendment, and no state law should be allowed to undermine these rights. We are pleased that the judge has agreed."Read Replies (0)
By BeauHD from Slashdot's data-is-power department
theodp writes: Facebook may be facing the threat of a multi-billion dollar FTC fine for privacy lapses that included allowing companies to obtain users' email addresses from their friends, but that didn't discourage Bill Gates from taking to Twitter to urge his 46.5 million followers to give up the names and email addresses of teachers so they can be contacted by tech-bankrolled Code.org for a chance to receive a "Computer Science Scholarship" (attend Professional Development workshops). Or Amazon. Or Google. "The success of our professional learning program depends on the work of our partners to spread the word," explained Code.org in a Medium Post. "Corporate partners like Amazon, Infosys, and Google are rallying their employees and communities to nominate a teacher, and so are fellow teachers, parents, and students. We couldn't do it without you! [...] Code.org (and these scholarships) are supported by: Amazon, Bill and Melinda Gates Foundation, Facebook, Google, Infosys Foundation USA, Microsoft [...] Code.org has prepared almost 100,000 educators to teach our courses, and they give our program rave reviews. We welcome teachers from all subject areas-no CS experience needed!"
< article continued at Slashdot's data-is-power department
>Read Replies (0)
By BeauHD from Slashdot's more-the-merrier department
An anonymous reader writes from a report via NPR: Netflix announced this week that it has acquired the rights to stream Chinese sci-fi blockbuster "The Wandering Earth," which has already grossed more than $600 million globally and hit number two in the all-time Chinese box office rankings since it was released in theaters Feb. 5. Netflix will translate the movie into 28 languages and release it in more than 190 countries. The movie, based on a short story by Hugo award winner Liu Cixin (author of "Three Body Problem" and "Ball Lighting") is set in a distant future in which the earth is about to be devoured by the sun. Using propulsive engines, humans turn earth into a spaceship and try to launch it out of the solar system and the planet is saved by a Chinese hero (rather than American ones as typically seen in Hollywood sci-fi movies.) For China's film industry, the release marks a major milestone. "Filmmakers in China see science fiction as a holy grail," Raymond Zhou, an independent critic, told The New York Times. "It's like the coming-of-age of the industry." Two sci-fi movies, "The Wandering Earth" and "Crazy Alien," which is also inspired by Liu's work, topped this Chinese New Year movie season. Inkoo Kang wrote at Slate that the film "understands what American blockbusters are still loath to admit: Responding to climate change will pose infrastructural challenges on a massive order and require drastic measures on a planetary scale. Perhaps it takes a country like China, which is accustomed to a manic rate of construction and grandness of organizational possibility, to seriously consider how dramatically humanity will have to reimagine our ways of life to survive such a catastrophic force."Read Replies (0)
By BeauHD from Slashdot's latest-and-greatest department
LG's flagship G8 smartphone has been officially launched today, bringing many expected features that were teased over the past few months and several not-so-expected features. One such unusual feature in the G8 is its palm vein recognition, dubbed Hand ID, which LG claims is the first to offer this capability. TechCrunch reports: From the company's press materials, "LG's Hand ID identifies owners by recognizing the shape, thickness and other individual characteristics of the veins in the palms of their hands." It turns out, like faces and fingerprints, everyone's got a unique set of hand veins, so once registered, you can just however your hot blue blood tubes over the handset to quickly unlock in a few seconds. The Z camera also does depth-sensing face unlock that's a lot harder to spoof than the kind found on other Android handsets. LG's also put the tech to use for a set of Air Motion gestures, which allow for hands-free interaction with various apps like the camera (selfies) and music (volume control). Other features of the G8 include a 6.1-inch QHD+ "Crystal Sound OLED" display that uses the screen as an audio amplifier. There's a Snapdragon 855 processor with 6GB of RAM and 128GB internal storage, three cameras on the rear including a 16-megapixel Super Wide (F1.9), 12-megapixel Standard (F1.5), and 12-megapixel Telephoto (F2.4), a 3,500mAh battery that charges via USB-C, a headphone jack, and 32-bit Hi-Fi Quad DAC.Read Replies (0)