What if a hacker could log every key you typed on your PC by placing a cellphone nearby? US researchers have shown how this is possible using any smartphone available today.

At a conference in Chicago on Thursday, a group of computer researchers from Georgia Tech will report on another potential threat. The researchers have shown that the accelerometer and orientation sensor of a phone resting on a surface can be used to eavesdrop as a password is entered using a keyboard on the same surface. They were able to capture the words typed on the keyboard with as much as 80 percent accuracy.

Normally when security researchers describe spyware on smartphones, they mean malicious code that can be used to snoop on calls, or to steal the data held on mobile phones.In this case, however, researchers have described how they have put software on smartphones to spy on activity outside the phone itself – specifically to track what a user might be doing on a regular desktop keyboard nearby.

The typing detection works by “using a smartphone accelerometer – the internal device that detects when and how the phone is tilted – to sense keyboard vibrations as you type to decipher complete sentences with up to 80% accuracy,” according to the Institute.

“We first tried our experiments with an iPhone 3GS, and the results were difficult to read,” said Patrick Traynor of Georgia Tech. “But then we tried an iPhone 4, which has an added gyroscope to clean up the accelerometer noise, and the results were much better. We believe that most smartphones made in the last two years are sophisticated enough to do this attack.”

As phone technology improves, attacks via the accelerometer could become more feasible. The researchers’ initial experiments used Apple’s iPhone 3GS, but the phone’s accelerometer lacked the necessary sensitivity. The researchers then moved to the iPhone 4, which uses a gyroscope to remove noise from the accelerometer data, and had much greater success.

“The way we see this attack working is that you, the phone’s owner, would request or be asked to download an innocuous-looking application, which doesn’t ask you for the use of any suspicious phone sensors,” said Henry Carter, one of the study’s co-authors . “Then the keyboarddetection malware is turned on, and the next time you place your phone next to the keyboard , it starts listening.”

Source: http://thehackernews.com/2011/10/iphone-can-be-used-as-spy-phone-to-get.html

iPhone: The Ultimate Spying Gadget is a post from: IT Support New Jersey

The Stuxnet cyberworm could soon be modified to attack vital industrial facilities in the US and abroad, cybersecurity experts warned Wednesday at a Senate hearing.

Computer security companies agree that these virus is unprecedented and it means the dawn of a new world. Stuxnet and Duqu were not designed to steal money or send spam but to sabotage plants and cause damage in industrial environments. Expect the appearance of additional copies.

The Stuxnet virus that attacked Iran’s nuclear program can cripple the country’s nuclear facilities for two years, a German computer expert announced on Wednesday, December 15, 2010.

From what researchers can tell, Duqu’s mission is to gather intelligence data and assets from entities like industrial control system manufacturers, to more easily conduct a future attack against another third party.

According to Symantec, the next threat, dubbed “DuQu” because the code has the code string ~DQ within it, is a surveillance-based Trojan horse, designed to relay information back to a command and control center. DuQu uses mock .jpg files along with other dummy files, all encrypted, to exfiltrate data. Unlike Stuxnet, which specifically damaged Siemens PCS 7 systems, DuQu appears to be only collecting information about the design of other industrial control systems. DuQu only has an active lifetime of about 36 days, but this is probably to limit its discovery.

The Symantec report states “the threat was written by the same authors, or those that have access to the Stuxnet source code, and appears to have been created after the last Stuxnet file we recovered.” F-Secure’s Mikko Hypponen tweeted “Duqu’s kernel driver (JMINET7.SYS) is so similar to Stuxnet’s driver (MRXCLS.SYS) that our back-end systems actually thought it’s Stuxnet.”

At this time DuQu does not propagate and has been released only within targeted industries, although Symantec admits it may also be elsewhere and not yet discovered. The original compile dates on some of the variants of DuQu so far analyzed suggest it may have existed as far back as November 3, 2010. Stuxnet compile dates were between June 2009 and March 2010 and therefore pre-date DuQu.
More from the Symantec Security Response blog:


Key points are:
• Executables developed after Stuxnet using the Stuxnet source code have been discovered.
• The executables are designed to capture information such as keystrokes and system information.
• Current analysis shows no code related to industrial control systems, exploits, or self-replication.
• The executables have been found in a limited number of organizations, including those involved in the manufacturing of industrial control systems.
• The exfiltrated data may be used to enable a future Stuxnet-like attack.

Clues to DuQu’s origin do exist. For example, it uses a digital certificate set to expire August 2, 2012, issued from a company in Taipei, Taiwan. F-Secure’s Hypponen thinks the certificate was stolen from C-Media in Taiwan. Symantec says that certificate was revoked on October 14, 2011.

The best research into Duqu so far has been done by Symantec. They’ve been at it for a while, and have today published a 46-page whitepaper on it.

Source: http://thehackernews.com/2011/10/duqu-next-major-cyber-weapon-like.html

Duqu – Son of Stuxnet is a post from: IT Support New Jersey

MiraCloud delivers the promise of a multi-tiered cloud platform with options that range from self-managed cloud computing to a private enterprise cloud with the ability to choose elements from each tier to suit various mission critical needs, creating a hybrid solution.

For example, companies can choose different MiraCloud tiers for various applications, multiple hypervisor support, and mixed needs within the Contegix public cloud and a customer’s private cloud. In addition, each platform type can be supported by Contegix at the level of service determined by the customer.

MiraCloud is a self-service platform for customers who want complete control of hosting capabilities. MiraCloud offers numerous benefits:

• A simple web interface that allows customers to easily manage and access cloud resources, including budgets and overall spend.
• Easy migration, from a seamless transition of physical hosts to virtual hosts, to the use of approved appliances and the creation of custom user templates.
• The ability to pay for compute capacity by the hour or monthly, and to choose on a per system basis, with guaranteed CPU and RAM resources.
• Advanced network capability, including VLANs, to create private virtual data centers, as well as integrated Virtual Private Network (VPN) and load balancing.
• Compliance made simple with standardized reports, controls and processes to move sensitive workloads into the cloud by addressing their specific regulatory and compliance requirements.
• Access to Contegix’s award-winning technical support of Tier 3 engineers who are available 24/7/365.
• An open, RESTful API that allows enterprises to build intelligence into their applications, initiate and shut down extra capacity, and process data and manage increased usage of their applications.
• Ability for customers to choose their tier of cloud service – from hypervisor to storage.

Source: http://www.net-security.org/secworld.php?id=11810

Hybrid Options on Customizable Cloud Services is a post from: IT Support New Jersey

It has the same capabilities of Nagios, and even more with advanced built-in facilities such as load balanced and high availability monitoring.

Shinken comes with an easy to use discovery module, able to scan your entire network to help you run your monitoring solution in a few minutes. It can automatically discover:

• Systems (Windows, Gnu/Linux)
• Classic network applications (HTTP, FTP, DNS, etc)
• Databases (MySQL, Oracle)
• Network equipments (Cisco, Nortel).

You can define objects dependencies in Shinken like a server being connected to a switch, a web page being dependent of a database, or your virtual machine hosted on a VMware server. It allows Shinken to only alert you about the real problems and give the list of impacted elements:

• Ability to define network host hierarchy, allowing detection of and distinction between hosts that are down and those that are unreachable
• Contact notifications for service or host problems and resolution (via e-mail, pager, SMS, or any user-defined method through plugin system)
• Contact notifications for service or host problems and resolution (via e-mail, pager, SMS, or any Ability to define event handlers to be run during service or host events for proactive problem resolution
• Contact notifications for service or host problems and resolution (via e-mail, pager, SMS, or any Dynamically compute the “criticity” of the root problem to help you fix the most business impacting application first.

Source: http://www.net-security.org/secworld.php?id=11805

Shinken: IT Systems Monitoring Tool is a post from: IT Support New Jersey

Cisco introduced additions to its data center networking portfolio that address these needs and deliver architectural flexibility and scale for physical, virtual or cloud computing environments.

The new Cisco switching products introduced today augment the Cisco Unified Fabric portfolio, which consists of Nexus data center switches and MDS storage switches that connect servers, data storage, and corporate networks seamlessly within the data center and cloud.

Cisco unveiled second generation capabilities for the Nexus 7000 Series and Cisco FabricPath support for the Nexus 5500 switch; together they provide industry-leading data center fabric scalability, supporting over 12,000 10GE server ports: twice the current offering on the marketat less than half the cost.

Cisco also added new switches with sub-microsecond latency to the Nexus 3000 ultra-low latency switching series, and introduced a virtualized version of its popular ASA security appliance to deliver consistent security for virtualized and cloud environments.

Cisco also expanded its security portfolio to add a virtual firewall for secure multi-tenant and cloud environments. The Cisco Adaptive Security Appliance (ASA) – the industry’s most deployed firewall with more than one million installed appliances– will be available in a virtual form factor: the new Cisco ASA 1000V cloud firewall, which integrates with the Nexus 1000V software switch.

Complementing Cisco’s Virtual Security Gateway (VSG), the ASA 1000V extends firewall capabilities to provide consistent security for physical, virtual, and cloud infrastructures.

ASA provides best-of-breed firewall capabilities, comprehensive real-time threat defense, effective, always-on, highly secure remote access, and comprehensive network security for networks of all sizes. The Cisco ASA 1000V firewall complements the zone-based security capabilities of the Cisco Virtual Security Gateway (VSG) and provides multi-tenant edge security, default gateway functionality, and protection against network-based attacks.

Dynamic, policy-driven, multi-tenant management is delivered through the Cisco Virtual Network Management Center (VNMC), which is a centralized management solution for both the Cisco ASA 1000V firewall and the Cisco Virtual Security Gateway.

Source: http://www.net-security.org/secworld.php?id=11806

Cisco expands data center networking portfolio is a post from: IT Support New Jersey

CNET has recently confirmed with Google that the Android 4.0 Ice Cream Sandwich update will let users disable any application, even those apps that the manufacturer and carrier preinstall as part of their business deals.

The ability to shut down unwanted apps also extends to the browser and Gmail.

For years, Android users have been harassed by the presence of apps that were locked into the phone and impossible to uninstall. Users who didn’t want any of these preinstalled apps had to lump it, and turn an unseeing eye to the offending apps.

While you won’t be able to remove the app completely, disabling will keep the app from running and will remove the icon from the app tray and home screen.

That is, of course, unless they’re part and parcel with Ice Cream Sandwich to begin with.

Source:  http://reviews.cnet.com/8301-19736_7-20122931-251/ice-cream-sandwich-say-goodbye-to-bloatware/?part=rss&subj=news&tag=2547-1_3-0-20

Android 4.0 Ice Cream: Bye Bloatware! is a post from: IT Support New Jersey

A New Mexico firm claims the “BBX” name is protected by trademarks it holds and is threatening to take legal action againstRIM unless it stops using the moniker.

The firm, Abuquerque-based Basis International, said it had already trademarked the “BBx” name for its own software language, database and toolset.

“Our patent attorney has sent them a cease and desist letter, invoking the U.S. trademark act … requesting a response by October 31,” Basis Chief Executive Nico Spence told Reuters on Thursday. “Failing that, we’ll take the next logical legal step.”

While legal action may never materialize, the threat may prove yet another embarrassment for a company that has suffered its fair share of them recently. The latest was a three-day global outage of BlackBerry service, which followed a series of profit warnings and botched product rollouts.

On top of that, its management has been scolded for what its critics say is an arrogant and insular style.

Earlier this week, RIM announced the new BBX platform for its next-generation devices at a developers conference in San Francisco. It provided no timetable for the rollout, however.

RIM SEES NO PROBLEM

“RIM has not yet received a copy of the legal complaint described in Basis International’s press release, but we do not believe the marks are confusing, particularly since our respective companies are in different lines of business,” the Waterloo, Ontario-based company told Reuters by email.

Basis, founded in 1985, operates on five continents but is focused mainly on the U.S. and Latin American markets.

The firm said it has thousands of product licenses installed worldwide with the “BBx” prefix that run on Windows, Linux and Mac operating systems, among others.

“We are fielding numerous customer inquiries voicing their confusion about the RIM announcement,” Spence said.

RIM’s BBX would replace the antiquated software that now powers the BlackBerry with a package built around the QNX system, already the engine behind the PlayBook.

RIM wants to reverse a growing consumer preference for faster and more intuitive devices by Apple and devices powered by Google’s Android.

The San Francisco conference was the first public stage for the Canadian company since last week’s global disruption of BlackBerry service, which added to a series of setbacks for RIM over the past year.

Law firms in the United States and Canada are exploring possible consumer lawsuits against RIM for the BlackBerry outages, which crippled email and messaging for tens of millions of users around the world.

Source: http://news.yahoo.com/blackberry-maker-accused-infringing-bbx-trademark-193023595.html

BlackBerry maker accused of infringing BBX is a post from: IT Support New Jersey

A year ago, when Apple introduced the iPad, it was the first tablet of its kind on the market. Now there are as many iPad competitors as Dalmatians. Meanwhile, the iPad has become a critical revenue stream for the company — so there’s far less margin for error.

And one more thing: Apple (AAPL,Fortune 500) will likely be without its charismatic leader at the San Francisco event, which kicks off at 1 p.m. ET. Steve Jobs remains on amedical leave of absence. Investors will be keeping a close eye on the presenters to evaluate how the company is being led in Jobs’ stead.

That’s not an insignificant amount of pressure.

“This event is not to be taken lightly,” said Brian White, analyst at Ticonderoga Securities. “Apple must make a convincing case for why the iPad 2 is better than the plethora of competitors coming to market.”

Increased competition: The good and the bad news for Apple is that the year-old iPad still rates highly among even its newest rivals.

That’s good news, because Apple should again have the best-in-its-class tablet if the iPad 2 is as improved as the rumors say it will be.

But that’s also bad news: How much thinner, lighter, faster, better — and perhaps most importantly, cheaper — can the iPad get? Did Apple shoot itself in the foot by making its first generation tablet too good?

Tim Cook, Phil Schiller or whichever Apple executive introduces the iPad 2 will need to offer some impressive specs, lest Apple fans walk away disappointed.

Rival tablets have front- and rear-facing cameras, dual-core processors, four times as much RAM as the iPad, HDMI output and Adobe Flash support. Other than Flash, Apple is expected to at least meet all of its competition’s features — and to significantly slim down iPad 2 compared to the original.

If that’s all Apple does, its fans will probably be unimpressed. Apple may need to have something “magical” up its sleeve, as Jobs likes to say, to wow its potential customers.

Though it’s not facing a whole lot of price pressure from its rivals, cost will also be an important factor. Only the 32 gigabyte $599 Motorola Xoom tablet gives the iPad a real run for its money in cost: It is a full $130 cheaper (if you shell out for a a required Verizon data plan) than the similarly sized $729 iPad 3G, which has an optional data plan for an additional price.

With a strong marketing campaign and hype-machine behind the Xoom, Apple may opt to drop the price of the iPad 2. Alternatively, some analysts expect Apple to slash the cost of the original iPad and keep iPad 2 prices steady.

The importance of the iPad: Getting it right is so crucial because Apple is becoming increasingly reliant on the revenue it generates from iPad sales.

In 2010, Apple sold $9.6 billion worth of iPads, which represented 12.5% of Apple’s revenue. That surpassed iPods and iMacs in net revenue. Not too shabby for a device that Apple started selling in April.

And while Apple’s Macintosh computers have always struggled for traction in the business world, the iPad is generating strong crossover interest from business customers. Around 80% of Fortune 100 companies have deployed the tablet for their employees.

“The iPad is a critical device to Apple,” said Colin Gillis, analyst at BGC Partners. “The iPad is remaking a landscape for consumers, and it’s even making its way into the enterprise.”

The Jobs factor: It’s unlikely that Steve Jobs will be presenting the iPad this year (though he’s reportedly definitely maybe thinking about the possibility of going there, perhaps).

Jobs was not present at the unveiling of the iPhone 3GS, deferring to Phil Schiller, Apple’s marketing head. Everything went swimmingly, and Apple’s shares rose nearly $5 after he began his presentation.

But this is Jobs’ third leave of absence in seven years. Investors are concerned about the company’s future post-Jobs. Some shareholders are clamoring for a succession plan, and people want to know how the company is being run without Jobs overseeing day-to-day operations.

All of that will be scrutinized on Wednesday.

“With this company, every piece of minutia analyzed to nth degree, sometimes to levels that are not rational,” Gillis said. “People are very concerned about Steve.”

Source: http://money.cnn.com/2009/06/08/technology/apple_wwdc/index.htm?iid=EL

Why Apple needs to kill it with the iPad 2 event is a post from: IT Support New Jersey

Meet GroupMe. The current darling of the New York tech scene, the group-text-messaging startup created its prototype product in May during a 24-hour “hackathon” at TechCruch’s Disrupt conference. Fast forward seven months: GroupMe just closed a funding round rumored at $9 million.

As giants Twitter and Facebook continue to expand, a number of startups are searching for ways to cut through the social-networking noise. Cofounders Jared Hecht and Steve Martocci — startup veterans who previously worked at Gilt Group and Tumblr — saw a need for a group texting service that can essentially serve as a chat room between friends.

“We’re sort of in this age of broadcast overload,” Hecht says. “We have these wonderful publishing platforms where we can really express ourselves freely to the entire world, but what we don’t have is a good product or platform that scopes that down.”

GroupMe isn’t the first startup to create a way for groups to text each other. There’s also TextPlus, Beluga, and most recently, BrightKite.

But GroupMe backer Andy Weissman, co-founder of investment firm Betaworks, thinks GroupMe launched at exactly the right moment.

“If you think about the different success factors, timing is one of them. You can be way ahead of the market or way behind the market,” he says. “In terms of the apps people are using, the devices people are using, [GroupMe's timing] was exactly right.”

GroupMe’s biggest advantage is the so-called “normal factor.” While companies like Foursquare have to sell users on the benefits of sharing their location, and Twitter took years to convince the world that tweeting is useful for things beyond broadcasting your breakfast choices, group text messaging isn’t such foreign concept. Users don’t even need smartphones to do it.

“For some people who don’t really understand Twitter or the concept of a status update, they do understand conversing with their friends or conversing with the families,” Martocci says.

GroupMe’s founders won’t disclose how much venture capital they’ve taken, but the company’s backers include big-name investors like Betaworks, First Round Capital, Lerer Ventures, and Ron Conway. The company’s valuation is believed to be around $30 million — and there’s talk that a bidding war broke out.

“It’s a great idea at a great time,” Hecht says of the company’s golden run. GroupMe was able to quickly raise cash and start hiring — it now has a staff of 10.

Charlie O’Donnell, one of GroupMe’s first investors, says deals are moving quickly, especially for startups targeting the consumer market.

“There’s a lot of money competing to get into a small number of deals that are showing traction,” he says. “The company has very significant traction in terms of user base and usage, and any company that’s showing hockey-stick charts is going to have a lot of people interested.”

The investor swarm that descends on promising ventures has the tech fieldmuttering about a new bubble. O’Donnell says he isn’t concerned about the soaring valuations — but he admits that the talent war is getting fierce.

“If there’s a bubble anywhere, it’s a talent bubble of how much engineers cost,” he says.

GroupMe cofounders Martocci and Hecht agree.

In a market where everyone seems to have the next big idea, “it’s engineering talent that’s determining whether your idea is created — not necessarily the money,” Martocci says.

Of course, there’s always the money question. Cool ideas don’t necessarily translate to profits.

GroupMe’s founders say their business model will rely on sponsorships and advertising. A recent test run at the Austin City Limits music festival experimented with how sponsored groups can work at live events. The next big push is for South by Southwest in March — an event known for launching tech stars.

Not everyone is convinced that GroupMe will take off.

Richard Wong, a partner at Accel who has backed ventures including Facebook and Twitter, took a pass on investing.

“Even though it’s much easier to start companies and get them off the ground, it’s still a limited number of companies that actually have the chance to become broad-scale,” he says. He likes GroupMe, but isn’t sure how the business plan will pan out.

But O’Donnell — and other investors — think they’ve found a winning horse.

“It’s easy to see the fundraising numbers and prices and to say that could get out of hand,” O’Donnell says. “But which of the following things do I think the public wants to do more: tweet to over 500 people or talk to small private groups? The potential market for something like GroupMe is way bigger.”

Source: http://money.cnn.com/2011/01/03/technology/groupme_texting/index.htm?iid=EL

GroupMe Group Texting is a post from: IT Support New Jersey

Financial terms of the deal were not disclosed.

The move gives Facebook both the Beluga service and, more significantly, the engineering team behind it. Beluga has a small but skilled staff of three, all of whom are former Google employees. Based in Palo Alto, Calif., the company is located just a few miles away from Facebook’s new Menlo Park headquarters.

Group texting — services that let you send messages to multiple recipients at once — is a tiny, niche field right now, but it’s expected to be in the spotlight at the upcoming South By Southwest (SXSW) conference. That gathering is known as a launch pad for social media technology: Both Twitter and Foursquare took off after drawing attention at past SXSW shows.

Beluga, which just hit the “1 million messages sent” milestone, said its decision to sell to Facebook would expand its user base.

“We talked to people at Facebook, we saw how much our visions aligned,” co-founder Ben Davenport told CNNMoney.

“We have a lot of fans of the app inside Facebook, and we think that by joining forces, we will have an opportunity to build something very powerful for many many more users,” he said.

For the time being, the service will “continue to function as it does today,” the team wrote on their blog.

Facebook also suggested that it doesn’t plan to tamper with the core Beluga concept. “We’re excited that the team will continue their vision for groups and mobile communication as part of Facebook,” Facebook spokesman Jonny Thaw said.

Also on Tuesday, Beluga rival GroupMe rolled out a new version of its app. The update allows users to share their locations through Foursquare and share photos within the app.

Another contender, Fast Society, plans to release an updated version of its group messaging service next week — just ahead of SXSW.

“We think it’s going be evolution of not only of our product, but of the space in general, ” Fast Society co-founder Matthew Rosenberg said.

Source : http://money.cnn.com/2011/03/01/technology/facebook_acquires_beluga/index.htm

Facebook buys Beluga SMS Service is a post from: IT Support New Jersey