« novembre 2015 | Principale | gennaio 2016 »
451 Unavailable For Legal Reasons This status code indicates that the server is denying access to the resource as a consequence of a legal demand. The server in question might not be an origin server. This type of legal demand typically most directly affects the operations of ISPs and search engines.
Da parte dell'Internet Engineering Steering Group.
Scritto alle 18:51 | Permalink | Commenti (0) | TrackBack (0)
An operating system used to manage firewalls sold by Juniper Networks contains unauthorized code that surreptitiously decrypts traffic sent through virtual private networks, officials from the company warned Thursday.
It's not clear how the code got there or how long it has been there. An advisory published by the company said that NetScreen firewalls using ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20 are affected and require immediate patching. Release notes published by Juniper suggest the earliest vulnerable versions date back to at least 2012 and possibly earlier. There's no evidence right now that the backdoor was put in other Juniper OSes or devices.
"During a recent internal code review, Juniper discovered unauthorized code in ScreenOS that could allow a knowledgeable attacker to gain administrative access to NetScreen devices and to decrypt VPN connections," Juniper Chief Information officer Bob Worrall wrote. "Once we identified these vulnerabilities, we launched an investigation into the matter, and worked to develop and issue patched releases for the latest versions of ScreenOS."
A separate advisory from Juniper says there are two separate vulnerabilities, but stops short of describing either as "unauthorized code." The first flaw allows unauthorized remote administrative access to an affected device over SSH or telnet. Exploits can lead to complete compromise. "The second issue may allow a knowledgeable attacker who can monitor VPN traffic to decrypt that traffic," the advisory said. "It is independent of the first issue. There is no way to detect that this vulnerability was exploited."
Whodunit?
As involved as that process was, getting unauthorized code covertly installed into an official operating system and keeping it there for years would appear to be an even more complicated—and brazen—undertaking. This 2013 article published by Der Spiegel reported that an NSA operation known as FEEDTHROUGH worked against Juniper firewalls and gave the agency persistent backdoor access.
"This malware burrows into Juniper firewalls and makes it possible to smuggle other NSA prog
via arstechnica.com
Questo fatto è molto grave.
Chissà in Italia quanti sono vulnerabili e in quali organizzazioni.
Certo, se il sw fosse aperto, sarebbe ispezionabile..
Scritto alle 10:19 | Permalink | Commenti (11)
A month after temporarily blocking social media sites including Facebook and WhatsApp, the Bangladeshi government has now taken steps to take down Microsoft’s online chat software Skype and social networking service Twitter.
via thestack.com
per "sicurezza nazionale"
cosi' non ci saranno più attentati in Bangladesh.
certo.
Scritto alle 09:21 | Permalink | Commenti (0) | TrackBack (0)