Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. ×
Security

Apache Subversion Fails SHA-1 Collision Test, Exploit Moves Into The Wild (arstechnica.com) 17

WebKit's bug-tracker now includes a comment from Friday noting "the bots all are red" on their git-svn mirror site, reporting an error message about a checksum mismatch for shattered-2.pdf. "In some cases, due to the corruption, further commits are blocked," reports the official "Shattered" web site. Slashdot reader Artem Tashkinov explains its significance: A WebKit developer who tried to upload "bad" PDF files generated from the first successful SHA-1 attack broke WebKit's SVN repository because Subversion uses SHA-1 hash to differentiate commits. The reason to upload the files was to create a test for checking cache poisoning in WebKit.

Another news story is that based on the theoretical incomplete description of the SHA-1 collision attack published by Google just two days ago, people have managed to recreate the attack in practice and now you can download a Python script which can create a new PDF file with the same SHA-1 hashsum using your input PDF. The attack is also implemented as a website which can prepare two PDF files with different JPEG images which will result in the same hash sum.

Hardware Hacking

Open Source Car-Hacking Tool Successfully Crowdfunded (kickstarter.com) 24

An anonymous reader writes: Two geeks are crowdfunding an open source car hacking tool that will allow builders to experiment with diagnostics, telematics, security, and prototyping. "Cars have become complicated and expensive to work with," they explain on a Kickstarter page. "Macchina wants to use open source hardware to help break down these barriers and get people tinkering with their cars again." After years developing a beta prototype, they announced a tiny plug-and-play device/development platform (that can also be hardwired under the hood) on an Arduino Due board with a 32-bit ARM microcontroller. They almost immediately reached their $25,000 funding goal, and with 24 days left to go they've already raised $41,672, and they're now also selling t-shirts to benefit the EFF's "Right to Repair" activism.

Challenging "the closed, unpublished nature of modern-day car computers," their M2 device ships with protocols and libraries "to work with any car that isn't older than Google." With catchy slogans like "root your ride" and "the future is open," they're hoping to build a car-hacking developer community, and they're already touting the involvement of Craig Smith, the author of the Car Hacker's Handbook from No Starch Press.

"The one thing that all car hobbyists can agree on is that playing with cars isn't cheap," argues the campaign page. "Open source hardware is the answer!"
The Military

The US Department Of Defense Announces An Open Source Code Repository (defense.gov) 29

"The Pentagon is the latest government entity to join the open-source movement," writes NextGov. An anonymous reader quotes their report: The Defense Department this week launched Code.mil, a public site that will eventually showcase unclassified code written by federal employees. Citizens will be able to use that code for personal and public projects... The Defense Department's Digital Service team, whose members are recruited for short-term stints from companies including Google and Netflix, will be the first to host its code on the site once the agreement is finalized... "This is a direct avenue for the department to tap into a worldwide community of developers to collectively speed up and strengthen the software development process," a DOD post announcing the initiative said. The Pentagon also aims to find software developers and "make connections in support of DOD programs that ultimately service our national security."
Interestingly, there's no copyright protections on code written by federal employees, according to U.S. (and some international) laws, according to the site. "This can make it hard to attach an open source license to our code, and our team here at Defense Digital Service wants to find a solution. You can submit a public comment by opening a GitHub issue on this repository before we finalize the agreement at the end of March."
Transportation

Did Silicon Valley Lose The Race To Build Self-Driving Cars? (autoblog.com) 81

schwit1 quotes Autoblog: Up until very recently the talk in Silicon Valley was about how the tech industry was going to broom Detroit into the dustbin of history. Companies such as Apple, Google, and Uber -- so the thinking went -- were going to out run, out gun, and out innovate the automakers. Today that talk is starting to fade. There's a dawning realization that maybe there's a good reason why the traditional car companies have been around for more than a century.

Last year Apple laid off most of the engineers it hired to design its own car. Google (now Waymo) stopped talking about making its own car. And Uber, despite its sky high market valuation, is still a long, long way from ever making any money, much less making its own autonomous cars. To paraphrase Elon Musk, Silicon Valley is learning that "Making rockets is hard, but making cars is really hard."

The article argues the big auto-makers launched "vigorous in-house autonomous programs" which became fully competitive with Silicon Valley's efforts, and that Silicon Valley may have a larger role crunching the data that's collected from self-driving cars. "Last year in the U.S. market alone Chevrolet collected 4,220 terabytes of data from customer's cars... Retailers, advertisers, marketers, product planners, financial analysts, government agencies, and so many others will eagerly pay to get access to that information."
Security

Ask Slashdot: How Are You Responding To Cloudbleed? (reuters.com) 75

An anonymous IT geek writes: Cloudflare-hosted web sites have been leaking data as far back as September, according to Gizmodo, which reports that at least Cloudflare "acted fast" when the leak was discovered, closing the hole within 44 minutes, and working with search engines to purge their caches. (Though apparently some of it is still lingering...) Cloudflare CEO Matthew Prince "claims that there was no detectable uptick in requests to Cloudflare-powered websites from September of last year...until today. That means the company is fairly confident hackers didn't discover the vulnerability before Google's researchers did."

And the company's CTO also told Reuters that "We've seen absolutely no evidence that this has been exploited. It's very unlikely that someone has got this information... We do not know of anybody who has had a security problem as a result of this." Nevertheless, Fortune warns that "So many sites were vulnerable that it doesn't make sense to review the list and change passwords on a case-by-case basis." Some sites are now even resetting every user's password as a precaution, while site operators "are also being advised to wipe their sites' cookies and security certificates, and perform their own web searches to see if site data leaked." But I'd like to know what security precautions are being taken by Slashdot's readers?

Leave your own answers in the comments. How did you respond to Cloudbleed?
Open Source

Linus Torvalds On Git's Use Of SHA-1: 'The Sky Isn't Falling' (zdnet.com) 178

Google's researchers specifically cited Git when they announced a new SHA-1 attack vector, according to ZDNet. "The researchers highlight that Linus Torvald's code version-control system Git 'strongly relies on SHA-1' for checking the integrity of file objects and commits. It is essentially possible to create two Git repositories with the same head commit hash and different contents, say, a benign source code and a backdoored one,' they note." Saturday morning, Linus responded: First off - the sky isn't falling. There's a big difference between using a cryptographic hash for things like security signing, and using one for generating a "content identifier" for a content-addressable system like git. Secondly, the nature of this particular SHA1 attack means that it's actually pretty easy to mitigate against, and there's already been two sets of patches posted for that mitigation. And finally, there's actually a reasonably straightforward transition to some other hash that won't break the world - or even old git repositories...

The reason for using a cryptographic hash in a project like git is because it pretty much guarantees that there is no accidental clashes, and it's also a really really good error detection thing. Think of it like "parity on steroids": it's not able to correct for errors, but it's really really good at detecting corrupt data... if you use git for source control like in the kernel, the stuff you really care about is source code, which is very much a transparent medium. If somebody inserts random odd generated crud in the middle of your source code, you will absolutely notice... It's not silently switching your data under from you... And finally, the "yes, git will eventually transition away from SHA1". There's a plan, it doesn't look all that nasty, and you don't even have to convert your repository. There's a lot of details to this, and it will take time, but because of the issues above, it's not like this is a critical "it has to happen now thing".

In addition, ZDNet reports, "Torvalds said on a mailing list yesterday that he's not concerned since 'Git doesn't actually just hash the data, it does prepend a type/length field to it', making it harder to attack than a PDF... Do we want to migrate to another hash? Yes. Is it game over for SHA-1 like people want to say? Probably not."
Government

FCC To Halt Rule That Protects Your Private Data From Security Breaches (arstechnica.com) 117

According to Ars Technica, "The Federal Communications Commission plans to halt implementation of a privacy rule that requires ISPs to protect the security of its customers' personal information." From the report: The data security rule is part of a broader privacy rulemaking implemented under former Chairman Tom Wheeler but opposed by the FCC's new Republican majority. The privacy order's data security obligations are scheduled to take effect on March 2, but Chairman Ajit Pai wants to prevent that from happening. The data security rule requires ISPs and phone companies to take "reasonable" steps to protect customers' information -- such as Social Security numbers, financial and health information, and Web browsing data -- from theft and data breaches. The rule would be blocked even if a majority of commissioners supported keeping them in place, because the FCC's Wireline Competition Bureau can make the decision on its own. That "full commission vote on the pending petitions" could wipe out the entire privacy rulemaking, not just the data security section, in response to petitions filed by trade groups representing ISPs. That vote has not yet been scheduled. The most well-known portion of the privacy order requires ISPs to get opt-in consent from consumers before sharing Web browsing data and other private information with advertisers and other third parties. The opt-in rule is supposed to take effect December 4, 2017, unless the FCC or Congress eliminates it before then. Pai has said that ISPs shouldn't face stricter rules than online providers like Google and Facebook, which are regulated separately by the Federal Trade Commission. Pai wants a "technology-neutral privacy framework for the online world" based on the FTC's standards. According to today's FCC statement, the data security rule "is not consistent with the FTC's privacy standards."
Android

Google Renames Messenger To Android Messages as the Company Pushes RCS (betanews.com) 90

We have come a long way from the age of flip phones and nine-key texting. Even as if group messaging and instant messengers took over, the SMS has largely retained its core standard over the years. Google wants to change that, and for this, it has been working with hundreds of carriers and manufacturers around the world to bring the text message into the 21st century. Using a standard called Rich Communications Services, the group plans to make a texting app that comes with your phone and is every bit as powerful as those dedicated messaging apps. This would make all the best features available to everyone with an Android phone. From a report on BetaNews: Just last week we were talking about Google's championing of RCS (Rich Communication Services), the successor to SMS. Now the company has renamed its Messenger app to Android Messages as it aims to become not just the default SMS app, but the default RCS app for Android users. Part of the reason for the name change is to convey the idea that the app is now about more than just one type of message. Google is betting big on RCS and this is hinted at in the app update description which says it adds "Simpler sign-up for enhanced features on supported carriers."
Google

With No Fair Use, It's More Difficult to Innovate, Says Google (torrentfreak.com) 62

Unlike the United States where 'fair use' exemptions are entrenched in law, Australia has only a limited "fair dealing" arrangement. This led head of copyright at Google to conclude that Australia wouldn't be a safe place for his company to store certain data, a clear hindrance to innovation and productivity. From a report on TorrentFreak: The legal freedom offered by fair use is a cornerstone of criticism, research, teaching and news reporting, one that enables the activities of thousands of good causes and enriches the minds of millions. However, not all countries fully embrace the concept. Perhaps surprisingly, Australia is currently behind the times on this front, a point not lost on Google's Senior Copyright Counsel, William Patry. Speaking with The Australian, Patry describes local copyright law as both arcane and not fit for purpose, while acting as a hindrance to innovation and productivity. "We think Australians are just as innovative as Americans, but the laws are different. And those laws dictate that commercially we act in a different way," Patry told the publication. "Our search function, which is the basis of the entire company, is authorized in the US by fair use. You don't have anything like that here." Australia currently employs a more restrictive "fair dealing" approach, but itâ(TM)s certainly possible that fair use could be introduced in the near future.
Apple

Treasure Trove of Internal Apple Memos Discovered in Thrift Store (gizmodo.com) 28

An anonymous reader shares a Gizmodo report: Peeking inside a book bin at a Seattle Goodwill, Redditor vadermeer caught an interesting, unexpected glimpse into the early days of Apple: a cache of internal memos, progress reports, and legal pad scribbles from 1979 and 1980, just three years into the tech monolith's company history. The documents at one point belonged to Jack MacDonald -- then the manager of systems software for the Apple II and III (in these documents referred to by its code name SARA). The papers pertain to implementation of Software Security from Apple's Friends and Enemies (SSAFE), an early anti-piracy measure. Not much about MacDonald exists online, and the presence of his files in a thrift store suggests he may have passed away, though many of the people included in these documents have gone on to long and lucrative careers. The project manager on SSAFE for example, Randy Wigginton, was Apple's sixth employee and has since worked for eBay, Paypal, and (somewhat tumultuously) Google. Apple co-founder Steve Wozniak also features heavily in the implementation of these security measures.
Google

Alphabet's Waymo Sues Uber For Allegedly Stealing Self-Driving Secrets (bloomberg.com) 63

An anonymous reader quotes a report from Bloomberg: It took Alphabet Inc.'s Waymo seven years to design and build a laser-scanning system to guide its self-driving cars. Uber Technologies Inc. allegedly did it in nine months. Waymo claims in a lawsuit filed Thursday that was possible because a former employee stole the designs and technology and started a new company. Waymo accuses several employees of Otto, a self-driving startup Uber acquired in August for $680 million, of lifting technical information from Google's autonomous car project. The "calculated theft" of Alphabet's technology earned Otto's employees more than $500 million, according to the complaint in San Francisco federal court. The claims in Thursday's case include unfair competition, patent infringement and trade secret misappropriation. Waymo was inadvertently copied on an e-mail from one of its vendors, which had an attachment showing an Uber lidar circuit board that had a "striking resemblance" to Waymo's design, according to the complaint. Anthony Levandowski, a former manager at Waymo, in December 2015 downloaded more than 14,000 proprietary and confidential files, including the lidar circuit board designs, according to the complaint. He also allegedly created a domain name for his new company and confided in some of his Waymo colleagues of plans to "replicate" its technology for a competitor. Levandowski left Waymo in January 2016 and went on in May to form Otto LLC, which planned to develop hardware and software for autonomous vehicles.
Bug

Cloudflare Leaks Sensitive User Data Across the Web (theregister.co.uk) 86

ShaunC writes: In a bug that's been christened "Cloudbleed," Cloudflare disclosed today that some of their products accidentally exposed private user information from a number of websites. Similar to 2014's Heartbleed, Cloudflare's problem involved a buffer overrun that allowed uninitialized memory contents to leak into normal web traffic. Tavis Ormandy, of Google's Project Zero, discovered the flaw last week. Affected sites include Uber, Fitbit, and OK Cupid, as well as unnamed services for hotel booking and password management. Cloudflare says the bug has been fixed, and Google has purged affected pages from its search index and cache. Further reading: The Register, Ars Technica
Iphone

Cellebrite Can Now Unlock Apple iPhone 6, 6 Plus (cyberscoop.com) 103

Patrick O'Neill writes: A year after the battle between the FBI and Apple over unlocking an iPhone 5c used by a shooter in the San Bernardino terrorist attack, smartphone cracking company Cellebrite announced it can now unlock the iPhone 6 and 6 Plus for customers at rates ranging from $1,500 to $250,000. The company's newest products also extract and analyze data from a wide range of popular apps including all of the most popular secure messengers around. From the Cyberscoop report: "Cellebrite's ability to break into the iPhone 6 and 6 Plus comes in their latest line of product releases. The newest Cellebrite product, UFED 6.0, boasts dozens of new and improved features including the ability to extract data from 51 Samsung Android devices including the Galaxy S7 and Galaxy S7 Edge, the latest flagship models for Android's most popular brand, as well as the new high-end Google Pixel Android devices."
Piracy

Google Says Almost Every Recent 'Trusted' DMCA Notices Were Bogus (torrentfreak.com) 81

Reader AmiMoJo writes: In comments submitted to a U.S. Copyright Office consultation, Google has given the DMCA a vote of support, despite widespread abuse. Noting that the law allows for innovation and agreements with content creators, Google says that 99.95% of URLs it was asked to take down last month didn't even exist in its search indexes. "For example, in January 2017, the most prolific submitter submitted notices that Google honored for 16,457,433 URLs. But on further inspection, 16,450,129 (99.97%) of those URLs were not in our search index in the first place."
Google

Google Has Demonstrated a Successful Practical Attack Against SHA-1 (googleblog.com) 139

Reader Artem Tashkinov writes: Ten years after of SHA-1 was first introduced, Google has announced the first practical technique for generating an SHA-1 collision. It required two years of research between the CWI Institute in Amsterdam and Google. As a proof of the attack, Google has released two PDF files that have identical SHA-1 hashes but different content. The amount of computations required to carry out the attack is staggering: nine quintillion (9,223,372,036,854,775,808) SHA1 computations in total which took 6,500 years of CPU computation to complete the attack first phase and 110 years of GPU computation to complete the second phase.

Google says that people should migrate to newer hashing algorithms like SHA-256 and SHA-3, however it's worth noting that there are currently no ways of finding a collision for both MD5 and SHA-1 hashes simultaneously which means that we still can use old proven hardware accelerated hash functions to be on the safe side.

Facebook

'Social Media Needs A Travel Mode' (idlewords.com) 143

Maciej CegÅowski, a Polish-American web developer, entrepreneur, and social critic, writes on a blog post: We need a 'trip mode' for social media sites that reduces our contact list and history to a minimal subset of what the site normally offers. Not only would such a feature protect people forced to give their passwords at the border, but it would mitigate the many additional threats to privacy they face when they use their social media accounts away from home. Both Facebook and Google make lofty claims about user safety, but they've done little to show they take the darkening political climate around the world seriously. A 'trip mode' would be a chance for them to demonstrate their commitment to user safety beyond press releases and anodyne letters of support. What's required is a small amount of engineering, a good marketing effort, and the conviction that any company that makes its fortune hoarding user data has a moral responsibility to protect its users. To work effectively, a trip mode feature would need to be easy to turn on, configurable (so you can choose how long you want the protection turned on for) and irrevocable for an amount of time chosen by the user once it's set. There's no sense in having a 'trip mode' if the person demanding your password can simply switch it off, or coerce you into switching it off.
Google

Google Releases an AI Tool For Publishers To Spot and Weed Out Toxic Comments (bbc.com) 194

Google today launched a new technology to help news organizations and online platforms identify and swiftly remove abusive comments on their websites. The technology, called Perspective, will review comments and score them based on how similar they are to comments people said were "toxic" or likely to make them leave a conversation. From a report on BBC: The search giant has developed something called Perspective, which it describes as a technology that uses machine learning to identify problematic comments. The software has been developed by Jigsaw, a division of Google with a mission to tackle online security dangers such as extremism and cyberbullying. The system learns by seeing how thousands of online conversations have been moderated and then scores new comments by assessing how "toxic" they are and whether similar language had led other people to leave conversations. What it's doing is trying to improve the quality of debate and make sure people aren't put off from joining in.
Google

Google Releases Open Source File Sharing Project 'Upspin' On GitHub (betanews.com) 58

BrianFagioli quotes a report from BetaNews: Today, Google unveiled yet another way to share files. Called "Upspin," the open source project aims to make sharing easier for home users. With that said, the project does not seem particularly easy to set up or maintain. For example, it uses Unix-like directories and email addresses for permissions. While it may make sense to Google engineers, I am dubious that it will ever be widely used. "Upspin looks a bit like a global file system, but its real contribution is a set of interfaces, protocols, and components from which an information management system can be built, with properties such as security and access control suited to a modern, networked world. Upspin is not an "app" or a web service, but rather a suite of software components, intended to run in the network and on devices connected to it, that together provide a secure, modern information storage and sharing network," says Google. The search giant adds: "Upsin is a layer of infrastructure that other software and services can build on to facilitate secure access and sharing. This is an open source contribution, not a Google product. We have not yet integrated with the Key Transparency server, though we expect to eventually, and for now use a similar technique of securely publishing all key updates. File storage is inherently an archival medium without forward secrecy; loss of the user's encryption keys implies loss of content, though we do provide for key rotation."
Cellphones

Cellphones As a Fifth-Order Elaboration of Maxwell's Theory (ieee.org) 129

schwit1 shares a report from IEEE Spectrum that reflects on the "Stages of Electronics" based on James Clerk Maxwell's theory: Now that the world has become addicted to portable electronics, billions of people have come to see the companies providing these gadgets as the most innovative, and the people who head those companies as the most exalted, of all time. "Genius" is a starter category in this discussion. But clever and appealing though today's electronic gadgets may be, to the historian they are nothing but the inevitable fifth-order elaborations of two fundamental ideas: electromagnetic radiation, the theory of which was formulated by James Clerk Maxwell in the 1860s, and miniaturized fabrication, which followed Richard Feynman's 1959 dictum [PDF] that "there's plenty of room at the bottom." Maxwell was a true genius. The history of science offers few examples of work as brilliant as unifying electricity, magnetism, and light as aspects of a single phenomenon: electromagnetic waves. As Max Planck put it, "in doing so he achieved greatness unequalled."

Vaclav Smil writes via IEEE: "As I pass the zombielike figures on the street, oblivious to anything but their cellphone screens, I wonder how many of them know that the most fundamental advances enabling their addictions came not from Nokia, Apple, Google, Samsung, or LG. These companies' innovations are certainly admirable, but they amount only to adding a few fancy upper floors to a magnificent edifice whose foundations were laid by Maxwell 152 years ago and whose structure depends on decades-old advances that made it possible to build electronics devices ever smaller."

Businesses

The Death of the Click (axios.com) 129

Sara Fischer, writing for Axios: For the past 10 years, we've operated on the premise that the most important digital metric is the click that refers a person to a website. That click usually comes from a social distribution channel, like Facebook or Twitter, or a search engine, like Google or Bing. But according to industry experts, the click referral is becoming an idea of the past, soon to be replaced by content exposure. [...] Most publishers have designed their websites to measure user interaction through clicks, not scroll rates or time spent on stories. As the industry moves away from click-through rates (CTR's) as the most meaningful marketing metric, those publishers will have a difficult time justifying the effectiveness of their platforms for marketers.

Slashdot Top Deals