NetFlipper.com

In a 10-month investigation into Chinese cyber espionage against Tibetan institutions, researchers found that hackers tapped into foreign embassies, ministries of foreign affairs, and international organizations.

Security investigators from the Information Warfare Monitor (IWM), a public-private venture between a Canadian think tank and an academic group at the University of Toronto, found a network of 1,295 infected hosts in 103 countries. The investigators were asked by the Dalai Lama, the Tibetan Government in Exile, and others to investigate computer systems.

GhostNet Found

Researchers revealed a malware-based cyber espionage network called GhostNet. The discovery showed insecure, Web-based interfaces to four control servers that let operators send information to and receive information from compromised computers, according to a 53-page report. Audio and video hardware were also controlled, according to the report.

Although the network is small, the concentration of high-value systems is significant.

Nearly 30 percent of the computers being controlled belonged to ministries of foreign affairs of Iran, Taiwan, Tibet and several other countries; the Asian Development Bank; and unclassified computers at NATO headquarters.

Principal investigators Ron Deibert and Rafal Rohozinski said their research serves as a world wake-up call on how easily someone can create a spynet and shows how policymakers and the information-security community need to come to terms with the problem.

Path Leads to China

Security researchers were able to confirm that computers were being controlled in real time from commercial Internet access accounts on the island of Hainan, in the People’s Republic of China.

They were, however, not able to confirm whether the hackers intentionally penetrated the hosts or if the sensitive information to which they had access was exploited for commercial or intelligence value.

IP addresses assigned to the People’s Republic of China have linked with connections to infected computers, but the IWM said that isn’t enough to point fingers at China because…

WALTHAM, Mass., March 30, 2009 – An analysis of 1,311 open source projects revealed that open source developers reused code from those projects in other projects more than 365,000 times, saving the open source community over 316,000 staff years and tens of billions of dollars in development costs. The study conducted by Black Duck Software, a leading provider of products and services for accelerating software development through the managed use of open source software (OSS), points to the dramatic efficiencies and cost savings of open source code reuse.

In the review of well-known open source projects, Black Duck examined instances where reusable binary components from one open source project were included in the downloadable release of another project. GNU Automake leads the list of the most-re-used code, appearing as a component of 12,469 other project releases.

To conduct the analysis Black Duck selected 1,311 popular open source projects, a small fraction of the roughly 200,000 open source projects catalogued in the Black Duck KnowledgeBase. Projects in the study contained about 491 million total lines of software source code. With an approximate reuse rate of one percent in each of the hundreds of thousands of reuses, developers were able to avoid writing some 1.4 billion lines of source code.

Black Duck spiders the Internet collecting open source and other downloadable code into a repository called the Black Duck KnowledgeBase; a repository of more than 200,000 open source projects with tens of billions of lines of code from over 4,100 unique Internet sites. The Black Duck KnowledgeBase is the largest and fastest-growing repository of open source code in the industry.

The table below lists the top reused open source projects in the Black Duck survey.

Component Name: GNU Automake
Reuse Count: 12,469

Component Name: Autoconf
Reuse Count: 6,621

Component Name: X Free 86
Reuse Count: 5,925

Component Name: Foxtrot
Reuse Count:…

For eager Apple fans, it’s an excruciating seventy-three days until the much-anticipated Apple Worldwide Developers Conference (WWDC) opens at the Moscone West convention center in San Francisco. The wait won’t be much easier for tech journalists, who face 10 weeks of stubborn silence from the Apple press office and a rumbling herd of rumors to track down.

The main categories of rumors are well defined, in descending order of likelihood: Mac OS X Snow Leopard, a new iPhone, CEO Steve Jobs, and the as-yet-mythical Apple touchscreen netbook. Many of the rumors constitute a wish list for fans and journalists alike, but at least a few are grounded in practical realities: Apple’s consistently higher prices, relatively small market share, and somewhat uncertain corporate future, given Jobs’ forced sabbatical for health reasons.

Need versus Preference

Undoubtedly, there are many things that Apple would like to announce at the upcoming WWDC, but the much more interesting question from the tech industry point of view, is what Apple needs to announce. Put another way, when developers and journalists fly home on Saturday, June 13, what is the most important thing they will have heard?

Greg Sterling, an industry analyst and founding principal of Sterling Market Intelligence, listed two possible answers to that question.

First, he said, “Apple needs to announce upgraded iPhone hardware that adds new speed and perhaps video and/or other capabilities, beyond the 3.0 software upgrade that was already unveiled.”

The iPhone has proven enormously successful, even more than Apple predicted. Consumers have purchased 17 million iPhones in a little more than a year. However, Apple’s smartphone accounts for just eight percent of the smartphone market, with Nokia (43 percent) and RIM (17 percent) both ahead by comfortable margins. And Apple will face growing pressure from Android-based phones in the months to come.

Additional iPhone features, some of which…

The ability to share Twitter feeds is among the latest batch of changes unveiled this week at YouTube, which Alexa, a Web traffic analyzer, ranks as the world’s third most popular Web property after Yahoo and Google.

Given that so many people are on Twitter these days, YouTube said it has added Twitter to the share options so users can easily send a video into their Twitter streams. Other YouTube video-sharing options include Facebook, MySpace, Digg and Hi5.

When users click to share with Twitter, a pop-up window opens that routes users to their twitter accounts and formulates a Tweet telling recipients to “check out this video,” with the title and URL added to the message.

“This was a big internal request, but we know many of you asked for it, too,” YouTube’s development team said. “We don’t currently shorten the video URL automatically, but hope to get to it down the road.”

A Wider Strategy

YouTube owner Google announced last December that it had integrated Twitter with its Google Friend Connect — an online service that gives users the ability to connect with friends on different Web sites. “This means that when you join a friend-connected site, you can choose to use your Twitter profile, discover people you follow on Twitter who are also members of the site, and quickly tweet that you have found a cool Web site,” said product manager Mussie Shore.

Google’s latest moves to include Twitter capabilities is just one part of the search giant’s wider strategy of making it easier for users to share content as well as make comments about video clips, articles and blogs in a way that is readily accessible to their friends. Earlier this month, Google unveiled a slew of new features, such as the ability to choose friends and share items with a…

DUBLIN, OH, Mar. 23, 2009 -– The Dot Net Factory today announced the availability of EmpowerID 2009, the newest version of the world’s first and only Identity Management platform built on Microsoft’s Windows Workflow Foundation.

EmpowerID 2009 dramatically accelerates Identity Management and compliance efforts by simplifying the process of automating complex business processes with visually designed and intuitive workflows that set a new standard for flexibility and ease of use.

A New Breed of Identity Management

EmpowerID 2009 features Role Enforcer modules with workflows and web-based interfaces that can be rapidly deployed, including: multi-directory user provisioning (including support for HR, ERP and custom applications); password self-service reset; group management; Active Directory reporting; corporate white pages; Exchange provisioning and security; and SharePoint provisioning and security.

For organizations that desire custom workflows developed to their specific business requirements, EmpowerID 2009 offers a complete workflow automation platform, featuring a modular “drag and drop” visual designer that turns complex tasks into role-based, event-driven workflows. Included “What You See Is What You Get” (WYSIWYG) designers deliver code-free Silverlight and ASP.NET web user interfaces. EmpowerID 2009′s job function and location-based role hierarchy reflects changes in an organization immediately and automatically adapts to the changed security requirements. EmpowerID 2009 is a single and unified platform and code base that deploys quickly, cuts costs, and grows easily to accommodate future needs.

“The workflow engine in EmpowerID continues to be exceptional, unlike anything I’ve seen in other products within this category. It is intrinsically integrated with entitlement management at every step in the way,” said Felix Gaehtgens, senior analyst, Kuppinger Cole + Partner. “The Dot Net Factory is quick to point out that this simplifies deployment and rapid prototyping, and that is correct of course – but in our opinion the benefits are even greater after deployment, when business requirements…

April Fool’s Day is just around the corner. Will malware make a fool of millions of computer users, or is the release date of the next version of the menacing Conficker worm just a red herring? And if so, what is really in store for computer security this spring?

“It’s quite possible that Conficker will not do anything significant on April 1,” said Graham Cluley, a senior security consultant at Sophos. “The truth is that Conficker is not set to activate a specific payload on that date. Rather, on April 1 Conficker will begin to attempt to contact the 50,000-a-day potential call-home Web servers from which it may receive updates.”

Indeed, Cluley said it’s just as likely that Conficker will do something on March 28, or April 2, or April 14 as it will on April 1. He called the emphasis by some media outlets on April 1 “really unfortunate.”

A Y2K Repeat?

From reading the news coverage, one might think a Y2K-esque doomsday is coming shortly as the computer-security world awaits the Conficker release. The Sun newspaper in London said, “Millions of computers around the world could go into meltdown on April 1 because of a deadly virus. The Windows worm called Conficker could give a hacker unrestricted access to every infected machine on the planet.”

Meanwhile, Canada’s The Globe and Mail reported, “Deep within the World Wide Web, there is an undercurrent of potential chaos building — a malicious piece of code that has already prompted the French military to ground some fighter planes.”

Like Sophos, security firm F-Secure is also making it clear that it’s unlikely anything major will happen on April 1. F-Secure noted there is always widespread media hype when a worm has a date trigger.

“There is not going to be a ‘global virus attack,’” F-Secure said. “The machines that…