The unnamed “computer specialist” told US-based entertainment publication RadarOnline that 32,000 emails from Clinton’s private server are on offer to the highest bidder. However, the whole claim is weakly substantiated.

The hacker shared a sample of subject lines of emails of “what appear to be legitimate messages” with RadarOnline, according to reports.

But even a foreign policy expert would struggle to verify the claims here and the whole exercise might just as easily be the work of an enterprising chancer.

Nonetheless, the supposed auction adds to ongoing concerns about Clinton’s use of a private email server to conduct government business between 2009 and 2013, a scandal that blew up in March 2015, and which threatens to derail the Democratic Party frontrunner’s presidential bid.

Clinton admits that using a private email server “for convenience” was ill advised.

Her attempt to hold the line that she did not handle classified information via her private server has come under severe scrutiny.

The Intelligence Community Inspector General said some of the emails hosted on the server contain sensitive information which should have been classified as secret. The FBI launched an investigation into the server’s security last month. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: TheReg http://go.theregister.com/feed/www.theregister.co.uk/2015/09/04/clinton_email_auction_twist_secure_hacker/

A cross-site scripting flaw affecting the web payment service was fixed last month, but another flaw is yet to be resolved. The unresolved vulnerability creates a means to bypass the security approval procedure and two-factor authentication applied by the payment service, according to bug finders at Vulnerability Laboratory.

An attacker might be able to bypass the authentication for PayPal accounts or blocked accounts using a session vulnerability in PayPal’s iOS app.

“The attack is not limited to a blocked or restricted PayPal account. The security approval checks the identity of a device user. The 2FA is two factor auth,” Benjamin Kunz Mejri the founder of Vulnerability Laboratory told El Reg.

Vulnerability Laboratory published an advisory on the 0day security bug together with screenshots and a video here. El Reg forwarded the advisory to PayPal, which responded by saying it was looking into the issue. There’s no suggestion that the flaw is under active attack by hackers at this point. In any case, the bug – if verified – would be more undesirable than disastrous. It doesn’t present a direct risk of fraudulent exploitation, at least on its own.

Mejri added: “The issue was reported by using the iPad and iPhone to trick the website into an error exception that allows to bypass both secure procedures (sec approval 2FA). The video shows how we used a blocked account that was not able to login to the website via mobile browser or desktop browser.”

“After that we used stored session cookies that appeared to be persistent after a PayPal app update. Then we bypassed the sec approval and the connected 2FA request site. At the end I was logged into my account and was able to change values inside my profile,” he added.

A second issue involving a cross-site scripting flaw on PayPal’s website has already been resolved. Left unresolved, the flaw created a means to upload maliciously crafted files, capable of performing attacks on registered users of the service.

There’s no evidence any malfeasance along these lines actually happened and the bug was, in any case, fixed last month, a PayPal representative told El Reg.

PayPal takes the security of our customers’ data, money and account information extremely seriously and worked quickly to resolve an issue related to a Cross-Site Scripting (XSS) flaw and promptly fixed it on July 10, 2015. We have no evidence to suggest that any PayPal accounts were impacted in any way.

Security researchers at BitDefender discovered that the way PayPal processes and encrypts URLs that transport uploaded files was flawed. BitDefender’s proof-of-concept used an HTML-formatted XML file, which is transferred to the “Create an Invoice” section.

By tampering with the URL that pulls upload files from PayPal’s servers, BitDefender was able to force the execution of a malicious payload on PayPal’s server. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: TheReg http://go.theregister.com/feed/www.theregister.co.uk/2015/09/04/paypal_bug_brace_xss_2fa_bypass/

Hours later self-styled “King of Infidelity” Noel Biderman quit as chief exec of Avid Life Media, the parent firm of Ashley Madison. We’re not claiming any credit. Our thoughts were initially spurred by noticing that ALM had weeks-old unfilled vacancies for a data analyst and a senior system administrator.

For the benefit of those returning from a month’s holiday in Outer Mongolia, all hell has broken loose since hackers raided affair-arranging site Ashley Madison website in July and then leaked databases containing 36 million accounts, plus source code and Biderman’s company emails weeks later. Avid Life Media – which has pledged to continue running – faces class-action lawsuits as well as negative media coverage over suicides linked to the outing of its love-rat users.

To cap it all, security experts who have been through the leaked info have uncovered evidence that many of the female profiles were actually bots, an allegation strongly denied by Avid Life Media earlier this week.

Ashley Madison is in urgent need of a trouble-shooter, preferably someone with ninja like security skills matched with fearsome business acumen. Who would be up for the difficult, perhaps impossible, job of turning around the fortunes of the hacker-raided Tinder-for-cheaters site? We suggested some candidates and put it to the vote. Here are the results…

1. John McAfee – 363 votes
2. Someone with a TARDIS or a DeLorean – 269
3. Chuck Norris – 226
4. Infosec Taylor Swift – 84
5. Angelina Jolie as Acid Burn from Hackers – 72

So there you have it. The wild man of IT is preferred over Marty McFly and even Chuck Norris to do for a website what Gordon Ramsey does for struggling lodging places in Hotel Hell. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: TheReg http://go.theregister.com/feed/www.theregister.co.uk/2015/09/04/ashley_madison_poll_results/

See Also

When Good Technology announced Friday that it had sold itself to its long-standing rival BlackBerry for $425 million in cash, it was a moment of triumph for Good CEO Christy Wyatt.

Good has one of the longest, craziest histories we’ve ever heard of, filled with exits, near-exits, pivots, and reinvention.

Today, Good Technology is known for its enterprise mobile security products, which helps enterprises track and protect fleets of smartphones and tablets.

But it began life back in 2000 as a company called SpringThings, an email reader device that got crushed during BlackBerry’s heyday.

By 2002, it had changed its name and shifted focus to software, plugging along until Motorola bought it in 2006 for somewhere between $400 million and $540 million.

Then Motorola sold it off, and shortly after, Good found its calling managing devices, an area where its old rival BlackBerry also competed.

Once a hot market, Good raised about $146 million in venture funding while its competitors were being snatched up by SAP, IBM, and even VMware, which bought AirWatch for $1.54 billion.

Throughout all those years, Good started and stopped various attempts to IPO.

In 2013, Good hired former Motorola executive Christy Wyatt to replace outgoing CEO King Lee. She promptly shook up the management staff and raised $65 million in private equity investment.

In May 2014, Good filed paperwork hoping for a $100 million IPO. It never happened.

Instead, Wyatt raised another $80 million in private funding and debated what an exit would look like.

When talks with the CEO of BlackBerry began, the two CEOs opted to keep an open mind. They didn’t know if their staffs would do the same, so they arranged a meeting at a “secret location” in Palo Alto attended by key product managers and engineers, Wyatt told us.

During the meeting, everyone jelled, she said — it was like each company was looking at “its twin across the room.”

So Good sold itself to its biggest competitor for a respectable sum and Wyatt doesn’t know if she’ll be joining the team at BlackBerry or not.

Whether this is really Good’s happy ending or just another chapter in its long, wild ride, we’ll have to wait and see.

Article source: SAI http://feedproxy.google.com/~r/typepad/alleyinsider/silicon_alley_insider/~3/6i6kiFjw770/how-christy-wyatt-sold-good-to-blackberry-2015-9

The partnership will reportedly focus on luxury, with Uber sidling up to high-end brands commonly found on New York’s 5th avenue. It has also been in talks with Bigcommerce and Shopify to create easy interfaces for retailers to partner with the company.

This wouldn’t be the first time that Uber has flirted with e-commerce delivery — its UberRUSH program partnered with luxury e-commerce site Gilt Groupe to offer fast delivery in NYC.  But it will be interesting to see whether this new program will specifically delineate itself as a luxury courier service — after all, why shouldn’t your recently-purchased Louis Vuitton bag come straight to you via black car?

This report comes hot on the heels after a similar one indicated that Uber has been inquiring about partnerships with smaller on-demand companies that rely on a driver fleet to deliver their goods. It’s unlikely that these two modes of business are going to overlap — Uber has a penchant for targeting and catering to its high-end audience away from the plebes like me who rely on UberPool to get downtown.

But whether its targeting services considered too swanky to provide delivery or those who rely on the practice to pull in revenue, Uber is clearly trying to capitalize on the worth of its driver fleet outside of picking up and transporting passengers. While Uber continues to provide UberEATS in a handful of places and UberRUSH in New York City, don’t be surprised if it starts to expand its capabilities shortly.

➤ Uber to Unveil Big E-Commerce Delivery Program With Retailers in the Fall [Re/code]

Article source: TNW http://feedproxy.google.com/~r/TheNextWeb/~3/o1j3lXamBdI/

Read more about these great GIFs, and view their source material, below:

Double-Decker Dog

Do you know what is better than a dog? A dog that magically turns into two dogs! Meet Goldie and Ami, a golden retriever brother-sister pair who were about a year old when they performed their magic trick for their owner, YouTube user Jimmie Theodorus, in 2014. They live in Japan and have quite a few videos of their antics, but it’s this short video that propelled them to Internet fame.

Their video made it onto /r/videos, which then circulated the pair through a media whirlwind including Mashable, Boing Boing, and The Dodo, bringing smiles via GIF wherever they went. After all, who doesn’t love a secret dog?

Check out the original video below:

Cheetos Obama Guy

A popular spin on the ‘Thanks Obama’ meme, this guy spilled his Cheetos and can’t believe the president made him do it. This is actually the first scene for a parody commercial ribbing the ineptitude of people in infomercials, advertising a fake product called the Lap n’ Snack. Follow that deep tunnel down, and the Lap n’ Snack parody was actually developed as an ad campaign for Subaru, called “Maybe you should get out more.”

If you look closely, a later scene also has a very popular Cheeto-spilling GIF. These guys really know how to fail at eating chips.

Check out the original parody commercial for the Lap n’ Snack below:

Cube-eating Putty

No, what you’re seeing isn’t some kind of movie magic. It’s science! This magnetic putty is actually absorbing a rare-earth magnet. This GIF is a clip of a time-lapse of that process, which might not look as impressive to the naked eye: the putty’s process takes 90 minutes.

The reason this can happen is because the putty is infused with ferrous particles, making it look and feel like regular putty but actually attracted to metal. When placed next to the neodymium iron boron cube, the putty becomes magnetized and forms itself around the magnet. It won’t stop until it’s evenly coated around the whole cube. Neat.

Check out the time-lapse below:

Do you have a favorite GIF with mysterious origins? Feel free to email us at tips@thenextweb.com. We’ll come back with a fresh batch next week.

Article source: TNW http://feedproxy.google.com/~r/TheNextWeb/~3/VWaz_IzPJ8U/

Hardware

OnHub is plastic-y, and light. AirPort Extreme is also plastic, but feels a bit sturdier and dense. As aesthetics go, it comes down to color and shape; do you want a dark blue cylinder, or a squared white tower?

Around back, AirPort Extreme has more ports than OnHub. Google’s new router basically wants to connect you to the internet and let you roam free. The AirPort Extreme lets users connect more peripherals, like hard drives or printers. The ability to access a central storage solution on the network is something many may find handy.

Both offer 802.11ac Wi-Fi, with the AirPort Extreme having six antennae (three for 2.4GHz, and three for 5GHz). OnHub has 13 antennae; double what AirPort offers, and one “congestion-sensing” antenna.

Performance

I gotta say — I was a bit surprised here. The two routers are pretty much dead even when it comes to performance on my network. I actually saw no discernible issues or laudable spikes from either. Both offer a stellar signal throughout my home, even when I put more space (and walls) between hardware.

The signal strength also translates to mobile devices; dead even, across the board. As signal strength goes, Google and Apple are on the same path. Google doubling down on antennas doesn’t seem to matter here, nor does the circular arrangement of them.

Software

So far, I’d give the edge to Apple. AirPort’s additional ports and denser build give it a leg-up, and the performance is very even between the two. The software edge goes to Google, though.

While OnHub doesn’t offer a desktop app (yet, at least), its Google On mobile app is damn good. It offers a dead-simple set-up process, which is great for those who may be intimidated by setting up a router.

Apple’s AirPort Utility for mobile is also helpful once you plug your AirPort Extreme in, but it’s just not as polished as OnHub. It’ll walk you through the basic steps for setting up Apple’s router, but little else.

Apple offers a solid view of your network’s information like the IP address and connection status, but the software is very Mac-centric. If you don’t have a Mac, you won’t get to see all the info AirPort can offer.

I also like Google’s performance insights. It can run a network test for you, which match Speedtest pretty accurately. It piles on by giving you an efficiency score, which lets you know if your devices are taking full advantage of the data transfer speeds.

While a desktop app is nice to have, it’s unnecessary for many consumers. All told, the Google On app offers what AirPort Utility does — and more. It’s also available for iOS or Android.

Which should you buy?

The answer here isn’t surprising. Apple’s hardware is meant for Apple households; if you’re a Mac owner with an iPhone (and/or iPad), the Apple AirPort Extreme is your best bet.

I find the AirPort Utility app for Mac better than the fairly static view its mobile app offers, as that’s where Apple tucks all the functionality. If I want to set up an AirPort extreme to increase signal strength, doing it on the desktop is almost a requirement.

I like the ability to attach a hard drive to my AirPort Extreme, and the Time Capsule models offer internal storage for backing devices up. As someone with a Mac, the AirPort Extreme is easily my winner.

OnHub offers the same data transfer speeds as AirPort Extreme, and when you step outside of Apple’s universe — it’s a toss-up between the two. If you’ve got an Android device, you’ll probably want OnHub, specifically for the app. It really is that user friendly. Those with an iPhone and a Windows computer should probably consider OnHub, too.

OnHub doesn’t encourage me to ditch my AirPort Time Capsule. At all. If I weren’t a Mac user, I’d be remiss not to take a hard look at OnHub. Performance is equally impressive between the two.

Apple made the AirPort Extreme router for Apple users, and that’s just fine. I prefer the plethora of ports, because I like having a few hard drives hooked up. If I were a different kind of user, though, OnHub would probably be my choice, here.

You can buy Apple’s AirPort Extreme at an Apple Store, Best Buy or via Amazon. Google’s OnHub is available directly from Google, or via Best Buy. Both retail for $199.99.

Article source: TNW http://feedproxy.google.com/~r/TheNextWeb/~3/BJ2TTL2fv4g/

With an aim to encourage the adoption of cloud CRM solutions in regulated industries, Salesforce recently announced the launch of a new platform called Salesforce Shield, which came shortly after Box introduced the general availability of Box Governance. Like Shield, it also focuses on ensuring cloud customers meet legal, regulatory and business policies regarding data storage and transfer.

For organizations that operate in the healthcare, finance and legal industries, both Salesforce Shield and Box Governance may bring the highly sought after flexibility to cloud services without disrupting the organizations’ security requirements. Meanwhile, companies providing cloud-based services to these regulated industries provides a new opportunity to increase marketshare — and in doing so, change the landscape for cloud services. Here’s how…

Cloud adoption in finance and health care

The fact that the leading cloud CRM and cloud collaboration providers have launched solutions for the regulated industries almost at the same time could indicate a new trend that isn’t likely to disappear. Namely, after several years of struggles with cloud implementations, organizations that have strict data security policies have started changing their attitudes towards the cloud. A recent survey by Cloud Security Alliance revealed that the cloud adoption in the finance sector increased significantly in 2014.

Also, 61 percent of professionals working in the finance sector are in the process of creating a cloud strategy within their organizations, according to the same survey. Conversely, only 18 percent say they are planning to continue using the private clouds.

Similarly, the healthcare industry is also seeing an accelerated adoption of cloud solutions. Skyhigh Q2 2015 report on the cloud adoption and risk in health care suggests that more institutions are embracing the cloud to increase employee productivity and cut costs.

Compared to previous years, the use of private clouds in these industries is gradually decreasing — mainly thanks to the growing number of secure cloud solutions designed in accordance with the national security standards. Among them, Salesforce Shield and Box Governance are probably the products that would revolutionize the industries and enable even more organizations to migrate sensitive data to the cloud.

Secure offerings

With the ability to support the strict regulations for data access and retention, Salesforce Shield opens a new door for the organizations that were previously limited to using private clouds for security reasons. The service includes a number of security features designed to enable clients to safely work with the cloud without fear of violating federal regulations. More specifically, organizations in regulated industries will now have access to:

• Platform encryption native to the Salesforce1 platform.
• Data archive designed to help organizations cut costs by keeping data in “nearline storage.”
• A field audit trail that enables companies to keep track of changes and ensure they are using only the most accurate data.
• Event monitoring for the purposes of increasing visibility of the actions associated with the data use.

Unlike Salesforce, which enables organizations to build trusted cloud apps “using clicks, not code,” Box Governance is a new add-on service that adds advanced security features to Box’s widely used sharing and collaboration SaaS. The company has introduced three key capabilities in order to adjust the service to the needs of organizations that need to ensure compliance:

• Retention management, which helps administrators control preservation and deletion schedules of their sensitive documents.
• Content security policies that protect clients’ sensitive data.
• Defensible eDiscovery to comply with data discovery requests.

The impact

Historically, the cloud has been associated with numerous security risks, which is why its adoption in the regulated industries has been notably slow. While the enterprises managed to find an intermediary solution by implementing hybrid clouds, businesses in regulated industries took more time to actually develop efficient public cloud strategies.

This is especially true for the health care industry, which has probably seen the tightest constraints regarding IT infrastructure innovation. The challenges here range from managing employee productivity apps to authentication, access and audit paradigms, as mentioned in a study by SecureLink. Working with highly sensitive citizens’ data, healthcare institutions have had a limited number of IT solutions at their disposal.

For the past few months, however, we’ve been seeing a significant increase in the number of apps that support HIPAA and FINRA compliance for healthcare and finance organizations. Unsurprisingly, this contributed to accelerating the adoption of new IT solutions in the sector, with the cloud leading the innovation process.

The new offerings by Salesforce and Box are likely to become leaders in the regulated industries market given their already established reputation of reliable cloud providers. The precisely-defined features are likely to be welcomed by numerous organizations worldwide, significantly changing the landscape in the regulated industries, as previously mentioned.

However, this does not mean that their struggles associated with IT innovation will be over. Salesforce Shield and Box Governance may make a deep impact on the way regulated industries use the cloud, but a number of other IT challenges will remain.

This mostly relates to the trends of outsourcing IT components and managing their implementation, which will force these industries to keep improving their strategies until they’re sure they’ve found all the right solutions for their needs.

Article source: GigOM http://feedproxy.google.com/~r/OmMalik/~3/6KwW6X5CMNs/