The Number of TOR Users Has Doubled Since Snowden's NSA Leak

English: Tor Logo (Photo credit: Wikipedia)

I have been telling people to use TOR to protect their browsing privacy since SOPA and PIPA started snaking their way through Congress, but people didn't really get the gravity of online privacy, and government abuse until Edward Snowden spilled the beans about the NSA's PRISM program.

Now apparently the TOR Project has seen the usage of TOR in the United States double!

From RT:

Internet users throughout the world have signed up in droves for anonymity software that allows them to live and interact online without international governments being able to monitor their activity.

The Tor Project reported that the number of people subscribed to its service has doubled since June, when former National Security agency contractor, Edward Snowden, revealed that United States intelligence analysts were secretly tracking global internet activity. Short for “The Onion Project,” which implies of layers anonymity, Tor conceals a computer’s location and relays an individual’s messages, search queries, and other functions through a series of encryptions.

While the numbers have not been directly attributed to the NSA leak, the number of Americans using Tor jumped 75 percent between June 1, just days before the Snowden leak, and August 27, 2013. US citizens now make up 17.54 percent of the daily Tor traffic, making Americans the only nationality to surpass 10 percent of the networks’ user base. 

Like I said before, I'm a huge proponent of online anonymity, and have even put TOR on Bauer-Puntu Linux by default to help keep "the man" out of your business.

Do you use TOR? Why or why not? Let us know in the comments.

Related articles

• Tor anonymity network membership has doubled since NSA leak
• Tor anonymity network membership has doubled since NSA leak
• Tor usage doubles after Snowden's surveillance revelations
• Tor Project Doubles Members Number Since NSA Leaks

Read more »

Popular Free Hash Cracker Can Now Break Passwords Up To 55 Characters

Hacker inside (Photo credit: Wikipedia)

How many of you think your systems are secure because you use complex passwords of 8 characters or more? How many of you think that passwords in your applications are safe because they are stored using a complex hash algorithm? If you think you are secure, you are wrong.

The popular hash cracking program oclHashcat-plus now has the ability of cracking the hashes for passwords or passphrases of up to 55 characters!

From Ars:

Until now, ocl-Hashcat-plus, the Hashcat version that can use dozens of graphics cards to simultaneously crack huge numbers of cryptographic hashes, has limited guesses to 15 or fewer characters. (oclHashcat-lite and Hashcat have supported longer passwords, but these programs frequently take much longer to work.) Released over the weekend, ocl-Hashcat-plus version 0.15 can generally accommodate passwords with lengths of 55 characters. Depending on the hash that's being targeted and the types of cracking techniques being used, the maximum can grow as high as 64 characters or as low as 24. The long sought-after improvement targets one of the last remaining defenses people employ to make their passwords resistant to cracking.

"This was by far one of the most requested features," Jens Steube, the lead Hashcat developer who also goes by the handle Atom, wrote in the release notes for the new version. "We resisted adding this 'feature' as it would force us to remove several optimizations, resulting in a decrease in performance for most algorithms. The actual performance loss depends on several factors (GPU, attack mode, etc.), but typically averages around 15 percent."

As leaked lists of real-world passwords proliferate, many people have turned to passwords and passphrases dozens of characters long in hopes of staying ahead of the latest cracking techniques. Crackers have responded by expanding the dictionaries they maintain to include phrases and word combinations found in the Bible, common literature, and in online discussions. For instance, independent password researcher Kevin Young recently decoded one particularly stubborn hash as the cryptographic representation of "thereisnofatebutwhatwemake." Such cracks are known as "offline attacks" because they target the hashes leaked as a result of a database compromise, allowing the person who recovers the hashes to try an unlimited number of guesses until the correct plaintext passwords are found. Once the underlying credentials are revealed, a hacker can use them to compromise the online account they secure.

Yiannis Chrysanthou, a security researcher who recently completed his MSc thesis on modern password cracking, was able to crack the password "Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn1." That's the fictional occult phrase from the H.P. Lovecraft short story The Call of Cthulhu. It would have been impossible to use a brute-force attack or even a combined dictionary to crack a phrase of that length. But because the phrase was contained in this Wikipedia article, it wound up in a word list that allowed Chrysannthou to crack the phrase in a matter of minutes.

Until now, hackers and security consultants who cracked such words had to use software controlling the central processing unit of their computer or that used one or more graphics cards to crack a single hash. This weekend's update means that for the first time, Hashcat users can achieve speeds as high as eight billion guesses per second on a virtually unlimited number of compromised hashes. Breaking the 15-character limit is just one of several improvements designed to bring increased speed and precision to the password cracking program.

So what options do you have to fight this? You can make even longer passwords that are even harder to remember, or you can implement two factor authentication.

Here is a video I did for Tech Chop talking about a really cool free two factor authentication program called Phone Factor that might do the trick for you.



What do you think about this? What are you doing to keep your network safe? Let us know in the comments.

Related articles

• It's Now Easier For Hackers To Crack Crazy-Complex Passwords
• "thereisnofatebutwhat­wemake" - Turbo-charged cracking comes to long passwords
• Updated Cracking Software Uses Bible Terms, Literature for Cracking Passwords
• Password breaker successfully tackles 55 character sequences

Read more »

Dumping DSL? Making the Switch to 4G Internet

Simply thinking about switching your Internet services can lead to information overload as you take note of the dozens of available options. Dial-up, DSL, 3G service, 4G service, fiber optic technology: there are so many technical terms involved in establishing a new Internet service, it can be tough to know which one is best for you. For households with numerous mobile devices, switching to 4G Internet might make the most sense.

What is 4G Internet Anyway?

The “G” in the 4G label refers to "generation" of wireless technology. At its most basic level, 4G simply means 4th generation wireless Internet service. But what does that get you? Well, the first generation of wireless technology refers to old analog cell phones primarily used in the ‘80s and ‘90s, according to PC Mag. 2G technology brought basic digital technology to mobile devices -- these are now dubbed “feature phones” and typically offer voice and texting services. With 3G technology, mobile devices took a leap forward, connecting to the Internet and running apps.
The advent of 4G Internet technology may render 3G service obsolete, according to Huffington Post (2). The primary advantage of 4G wireless service is its blazing fast speeds. With more users on 3G networks, data traffic has slowed 3G service considerably. Most 4G Internet users get speeds of 10 to 30 Mbps, significantly higher than DSL or 3G connections.

Consider Your Coverage Area

Although Sprint, CLEAR, Verizon, T-Mobile, AT&T, and other carriers now offer 4G service, coverage varies by provider. Before making your choice, check out coverage maps offered by each Internet provider in your area. Most providers offer 3G service even if 4G is not yet available in your region. People living in very rural areas may not yet have access to 4G coverage, making DSL a better choice.

Deciding on an Internet Service That Is Best for You

Before making the switch to 4G service, consider key factors that may influence your choice:

• Type of mobile devices: Manufacturers are in an arms race to come up with the best devices to offer 4G service. Check the technical specs on your laptop, smartphone, tablet, and other mobile devices. Nearly all of the latest devices offer 4G access, but those that are several years old may not be compatible with 4G service.
  
• Typical Internet use: Think about your patterns of Internet use. Are you a heavy gamer? Someone who loves to stream Netflix, Hulu, or YouTube videos from your phone? Or do you mostly just send emails and surf the web? Individuals who frequently stream video, download songs, or upload pictures online will notice significant improvements in their Internet experience with 4G service.
  
• Where do you need Internet access? Consider where you typically use the Internet and the places you need access the most. If you spend most of your online time at home, check out home 4G Internet solutions. People who love to browse the web while on the go may be content with mobile access.
  
• Budget considerations: Keep in mind how much you’re willing to spend on Internet service. Faster 4G service might cause you to burn through data more quickly, resulting in higher bills. Comparison shop for the best rates in your area, paying close attention to data caps and overage charges before making the switch.
  

Related articles

• Can 4G wireless take on traditional broadband?
• Zuckerberg: These Internet Services Should Be Free For Everyone
• Intel partners with LG on mobile Internet devices
• 10 percent of Americans use smartphones for Internet. Are they better off than people with traditional Internet?

Read more »

Handy GUI Tool To Configure SSL on Your Windows Server For PCI/DSS or FIPS 104-2 Compliance

I've written a number of posts on making your servers PCI compliant. It's one of the many duties I'm tasked with at my day job. The hardest part in my opinion is getting your SSL certificates squared away.

In Windows 2003 you had to manually edit the registry to disable ciphers and protocals. In Windows 2008 and above you have to set a local security policy to modify the cipher suite order. It's all a bit of a pain.

Well I found a free tool that lets you make the necessary changes with the click of a button. It's called IIS Crypto! From their page:

IIS Crypto is a free tool that gives administrators the ability to enable or disable protocols, ciphers, hashes and key exchange algorithms on Windows Server 2003, 2008 and 2012. It also lets you reorder SSL/TLS cipher suites offered by IIS and mitigate the BEAST attack. 

Here is a screen shot:

I originally found this tool because I was looking to see if there was a way to avoid restricting all ciphers to 128 bit RC4 on Windows 2003. I was hoping this tool would allow me to change the cipher order, but sadly it just isn't supported in Server 2003, so restricting all ciphers to 128 bit RC4 is still the only way to mitigate against The BEAST.

In Windows Server 2008 R2 at least it makes changing the SSL Cipher Suite order super easy.

All-in-all it's still a great tool for making your servers compliant, and more secure.

Related articles

• Configuring Apache, Nginx, and OpenSSL for Forward Secrecy
• Elastic Load Balancer SSL Support Options
• OpenSSL basic.call.flow
• PCI Council Reports on Expected Changes to PCI DSS and PA-DSS

Read more »

Four Light Linux Distributions For Older PC's

I received several free Powered By Ubuntu stickers requests in the mail over the weekend, and in one of them a guy wrote a letter saying that he was starting a non-profit where he re-purposed older machines and put Linux on them. He wanted to know what Linux distributions I recommended for older machines.

I mean a lot of people like standard Ubuntu, but with Unity it can be a resource hog on Pentium 4 machines right? So here are the four distributions I recommended for older hardware:

• Lubuntu - Lubuntu is a fast and lightweight operating system developed by a community of Free and Open Source enthusiasts. The core of the system is based on Linux and Ubuntu . Lubuntu uses the minimal desktop LXDE, and a selection of light applications.
  


• Puppy Linux - Linux is a free operating system, and Puppy Linux is a special build of Linux meant to make computing easy and fast.
  
• Xubuntu - Xubuntu is an elegant and easy-to-use operating system. Xubuntu comes with Xfce, which is a stable, light and configurable desktop environment. Xubuntu is perfect for those who want the most out of their desktops, laptops and netbooks with a modern look and enough features for efficient, daily usage. It works well on older hardware too.
  
• DSL (Damn Small Linux) - Damn Small Linux is a very versatile 50MB mini desktop oriented Linux distribution. DSL has a nearly complete desktop, and a tiny core of command line tools. All applications have been chosen for the best balance of functionality, size and speed.
  

With so many distros out there to choose from I'm sure there are many more that are light-weight and perfect for older machines. What do you suggest? Let us know in the comments!

Related articles

• Linux Users Have Luxury of Choosing from Diverse Desktop Options
• Crunchbang - Beautiful Minimalism
• Top Ten Operating Systems for Computers
• What if there were only one Linux distribution?

Read more »

Windows Evolution Shown Using Houses

[Via Imgur]

Read more »

It's About Time: 5 of the Newest, Coolest Apps for BlackBerry Q10

It may have been a slow start, but app developers have finally started creating great apps for BlackBerry devices. With a full offering of smartphones, BlackBerry has shown itself to be serious about remaining at the top of the mobile phone game, and now with the release of the BlackBerry Q10, the apps are appearing in an ever-increasing flow. Those who've steadfastly remained true to their first cell phone love might be overwhelmed with the choices, so here's cream of the BlackBerry Q10 app crop.

BlackBerry Q10 image by Janitors via Flickr.

360 Panorama

BlackBerry Q10 phones come with an excellent high-def resolution camera on board. But for less than $3 you can turn that already highly functional camera into one that takes spectacular panoramic shots as simply and easily as taking a normal picture. The 360 Panorama app gives you the capability to save or instantly send and post your panoramic pics, to preserve and share breathtaking vistas and landscapes or even capture the whole gang at the class reunion for posterity.

Pacemaker

Be the DJ you always knew you could be with the Pacemaker app for BlackBerry Q10. You'll feel like a musical wizard as you alter tracks and tempos, bend the pitch, craft synchronized loops midstream and sync the tempo of two different tracks to blend them into your own marvelous audio creation. With a cross fader and other pro-level features, the sky's the limit. The best part is how user-friendly Pacemaker is. The app does all the work, you take all the credit.

Backup Contacts

Never worry about losing a contact from your list when you have the Backup Contacts app. With just one click all your contacts get backed up — yes, all contacts on your BlackBerry Q10, the SD card and even email. You can send, view and restore your backup via email and there's a feature to automate a daily backup so your list is always up to date.

Blaq

The best description of the Blaq app: a Twitter cloud for your BlackBerry Q10. It's a necessity for those with multiple Twitter accounts because Blaq takes the place of various Twitter apps you needed in the past to wrangle all the accounts. Blaq will sign you into your complete list of accounts and allow you to Tweet from them simultaneously or just from one, plus it has direct messages, mentions and real-time streaming. The Blaq app is a power Tweeter's dream come true.

Skype

Skype for BlackBerry is the app users have been anticipating most. Available since the BlackBerry Q10 was launched, Skypers can now make video and voice calls from their BlackBerry Q10 and message family and friends anywhere in the world regardless of the receiver's device.
That's just for starters. Now that the developers are on a roll bringing BlackBerry Q10 apps to the masses, they're not likely to stop. The field is wide-open for usable applications that make your already essential BlackBerry even more indispensable.

Related articles

• A Close And Personal Look at Blaq, The Twitter App for BlackBerry 10
• Blaq for the BlackBerry PlayBook Updated to v1.8.9 With Bug Fixes
• Skype Mobile for BlackBerry, Android (video)
• Blaq For BlackBerry Playbook Updated To v1.8.9 In BlackBerry World

Read more »

To "Cloud" or Not To "Cloud"? From A Security Standpoint, That is The Question. The Answer? You Probably Should Avoid The Cloud.

At my day job, like in many organizations, we are constantly looking at whether or not we should move to the cloud. I mean, the cost of standing up cloud virtual machines rather than running virtual machines at a data center can be significantly cheaper in most cases.

If you move to the cloud, is your data secure though? That is the ultimate question isn't it? I mean, all cloud providers say they are secure right? Look at Amazon, they tout that they are SSAE-16 compliant, as well as PCI-DSS compliant. They must be secure right? Not necessarily.

From Computer World:

While online data storage services claim your data is encrypted, there are no guarantees. With recent revelations that the federal government taps into the files of Internet search engines, email and cloud service providers, any myth about data "privacy" on the Internet has been busted.

Experts say there's simply no way to ever be completely sure your data will remain secure once you've moved it to the cloud.

"You have no way of knowing. You can't trust anybody. Everybody is lying to you," said security expert Bruce Schneier. "How do you know which platform to trust? They could even be lying because the U.S. government has forced them to."

While providers of email, chat, social network and cloud services often claim -- even in their service agreements -- that the data they store is encrypted and private, most often they -- not you -- are the ones who hold the keys. That means a rogue employee or any government "legally" requesting encryption keys can decrypt and see your data.

Even when service providers say only customers can generate and maintain their own encryption keys, Schneier said there's no way to be sure others won't be able to gain access.

For example, Apple's SMS/MMS-like communications platform, iMessage, claims both voice and text are encrypted and can't be heard or seen by third parties. But because the product isn't open source, "there's no way for us to know how it works," said Dan Auerbach, a staff technologist with the Electronic Frontier Foundation (EFF). "It seems because of the way it works on functionality, they do have a way to access it. The same goes for iCloud."

Freedom of Information Act requests by the American Civil Liberties Union (ACLU) revealed earlier this year that the U.S. government claims the right to read personal online data without warrants.

"It is the case everywhere in the world that governments seem to believe that if data is recorded and available, they should be able to access it," said Jay Heiser, an analyst at research firm Gartner. "It's not unique to the U.S., although the United States brags about it to a unique degree."

So it would seem that if making sure your data is truly secure, the rule of thumb in the surveillance state we live in is that you can't trust anybody. Your data could easily be turned over to the feds without a warrant, and without your knowlege.

If you truly want to protect your data, especially from Uncle Sam, then you have to host it yourself.

Do you agree? Disagree? Why or why not? Let us know in the comments.

Read more »

"Anti-PRISM" Firefox OS Powered ZTE Open Smartphone To Sell on Ebay For $80

The first non-Android and non-iOS powered smartphone based on Linux is expected to be available soon for the low price of $80 on Ebay. I am talking about the widely anticipated ZTE Open:

This is huge news for those of us who want to ditch Android and iPhones after news that Google and Apple are a part of the NSA's PRISM program broke. Right now our only viable alternative is a Windows smartphone, but Microsoft was named in the PRISM documents as well.

From Digital Spy:

The budget handset will arrive on the auction website unlocked, allowing the customer to sign up with the carrier of their choice.

Geared towards "first-time smartphone buyers", the Firefox OS relies on the internet to power the smartphone's user interface and is backed up by the Firefox Marketplace app store.

Powered by a 1GHz single-core processor, the ZTE Open features a 3.5-inch screen, 256MB of RAM and a price tag of just €39.

Other features include a 3.2-megapixel camera, WiFi support and native apps for Twitter, Facebook and Nokia's Here Maps.

Telefonica has already begun selling the handset in South America following its debut in Spain this summer.

The ZTE Open will be available for $79.99 in the US and £59.99 in the UK. A specific release date is yet to be confirmed.

Here is a video introducing the phone:



What do you think of this? Are you going to make the switch? Why or why not? Let us know in the comments.

Read more »

"Powered By Ubuntu" Sticker Action Shot!

I've received the first action shot from Bauer-Power reader Bryan Cunneen of his laptop sporting his new free Powered By Ubuntu stickers that he requested from us! Check it out!

Looking good right? When anyone requests their free Powered By Ubuntu stickers from me using the Paypal option, I always reply back when I drop them in the mail asking for action shots so I can share them with everyone.

I really want to spread Ubuntu far and wide, and get people off of Windows when I can. I think by giving these stickers away so people can replace their Windows stickers with them will certainly help in this effort!

What do you think? Do you already have some of the new Powered By Ubuntu Stickers? If so, tweet us your action shots (@bpowmedia)! If you haven't yet, get your stickers here: (Free Powered By Ubuntu Stickers)

Read more »

How To Configure Ubuntu As A Domain Controller Using Samba

In this video we learn how to setup a primary domain controller (PDC) on Ubuntu using Samba that you can use as a central Active Directory server for Windows clients.

The host is using Ubuntu 10.04 and Samba 3.5.6, but the steps are essentially the same in Ubuntu 13.04 and Samba 4.

[Via Youtube]

Read more »

5 Safety Steps for Routine Server Maintenance

If you manage a server environment, your web host is probably performing preventative-maintenance tasks for you, but it never hurts to double-check that your server is in tip-top shape. Here are five steps to keep your server up and running, no matter what the virtual world throws at it.

Check For Script Updates

One of the biggest security holes in servers are out-of-date scripts, especially if you're using popular scripts such as WordPress. Keep a list of all of the script installations on your servers, and ensure they have the latest security updates. Some scripts automatically update when one is available, but this typically requires open permissions on a folder or files on your server. If you want to keep your server optimally secure, avoid having open permissions, and update it manually.

Check Folder Permissions

Each file and folder on your web server has specific read-and-write privileges. Some files are read-only. Others require certain users for editing while others can be written and read to by anyone — keep permissions restrictive to thwart hackers. It adds time to your server usage, but it's worth the potential trouble of clearing out a hacker from your servers. Most scripts provide you with the exact permissions needed to run properly, so don't deviate from that if you need to open up permissions for it to work. To find web hosts that give you access to your file and folder permissions through a web-based file manager and host control panel, check sites such as WebHostingBlueBook.com.

Audit Your Databases

Improperly coded web forms that save data to a database create a huge security risk. Why? Because a web form doesn't have a restriction on the type of characters sent through the form. A hacker can send along commands that cause tables to get created or dropped from a database. As a result, your databases are accessible. Since many scripts are database-driven, a hacker can see sensitive data and other records. Check your contact and other text submission forms to ensure only alphanumeric characters can be submitted. As a follow-up, use PHPMyAdmin or another database manager to see whether any foreign tables are added or existing tables are altered.

Update Your Operating System

Similar to a desktop computer, server operating systems frequently release security and major feature updates. Prevent the operating system from being compromised on your server by applying the latest updates and confirming their stability. In many cases, even in unmanaged hosting, the host updates the operating system directly.

Change Your Passwords

Despite its inconvenience, changing your passwords regularly for your hosting account, email addresses through the account, and FTP log-in information is essential to stay safe. If you're using the same log-in and password information on your server and a website that's hacked, a hacker has a better change to attack your web host and gain access to your account.
Do you have any server maintenance tips to share? Tell us in the comments.

Read more »

Alternative To XScreenSaver in Xubuntu Linux

I've been using Bauer-Puntu Linux on my work computer for the last few weeks, and it's been working swimmingly. I've managed to get everything setup so that managing my company's Windows network is just as easy to do as it was with a Windows 7 workstation.

One of the things that's been bothering me, even though it's not really a big deal, is that when I lock my computer if I step away from my desk I have to unlock it with the ugly XScreenSaver login prompt.

It's functional, but it looks like crap. I decided to get rid of it and replace it with Gnome-Screensaver instead which uses the same login screen you see when you first boot up.

To install it just run the following from the terminal:

sudo apt-get install gnome-screensaver

To remove XScreenSaver run the following from the terminal:

sudo apt-get remove xscreensaver --purge

That's it, after that you will have a little more aesthetically pleasing lock screen in Xubuntu, or in my case Bauer-Puntu!

By the way, if you love Ubuntu you might want to get yourself some FREE Ubuntu Stickers!

Read more »

In Resonse To The Feds Hacking Firefox To Snoop on Tor Users, The Tor Project Says To Stop Using Windows and Javascript

We reported last Tuesday that some malicious code was found that exploits a vulnerability in Firefox, and is used to snoop on Tor users. All evidence says that the exploit was developed and deployed by U.S. government contractors for the NSA.

In response to the news the folks at the Tor Project have issued a warning to Tor users; STOP USING WINDOWS, AND STOP USING JAVASCRIPT!

From IT World:

The TOR Project is advising that people stop using Windows after the discovery of a startling vulnerability in Firefox that undermined the main advantages of the privacy-centered network.

The zero-day vulnerability allowed as-yet-unknown interlopers to use a malicious piece of JavaScript to collect crucial identifying information on computers visiting some websites using The Onion Router (TOR) network.

"Really, switching away from Windows is probably a good security move for many reasons," according to a security advisory posted Monday by The TOR Project.

The TOR Project's reasoning comes from the characteristics of the malicious JavaScript that exploited the zero-day vulnerability. The script was written to target Windows computers running Firefox 17 ESR (Extended Support Release), a version of the browser customized to view websites using TOR.

People using Linux and OS X were not affected, but that doesn't mean they couldn't be targeted in the future. "This wasn't the first Firefox vulnerability, nor will it be the last," The TOR Project warned.

If you haven't switched to Linux yet I recommend doing so now. If you didn't know, I have my own flavor of Linux called Bauer-Puntu Linux that has many anti-government encryption and security tools installed by default to protect your privacy.

Read more »

Dat ASCII!

I'm a huge fan of ASCII art. I love using it in my MOTD's on my Linux servers at the office. It sort of breaks up the monotany that way. Until now though, I've never seen ASCII art put into a gif!

What do you think? Let me know in the comments!

[Via Imgur]

Read more »

Are The Feds Actively Trying To Hack Tor?

One of the ways I recommend to get around the widely unpopular NSA's domestic Internet surveillance is to use Tor. I like it so much that I've installed the Tor Browser Bundle by default in Bauer-Puntu Linux so you can surf the Interwebs in peace without fear of government snooping, the way the internet was originally intended.

Well a new piece of malware has been discovered that takes advantage of a vulnerability in Firfox that will allow the FBI to track your online activity while using the Tor network.

From Wired:

Security researchers tonight are poring over a piece of malicious software that takes advantage of a Firefox security vulnerability to identify some users of the privacy-protecting Tor anonymity network.

The malware showed up Sunday morning on multiple websites hosted by the anonymous hosting company Freedom Hosting. That would normally be considered a blatantly criminal “drive-by” hack attack, but nobody’s calling in the FBI this time. The FBI is the prime suspect.

“It just sends identifying information to some IP in Reston, Virginia,” says reverse-engineer Vlad Tsyrklevich. “It’s pretty clear that it’s FBI or it’s some other law enforcement agency that’s U.S.-based.”

If Tsrklevich and other researchers are right, the code is likely the first sample captured in the wild of the FBI’s “computer and internet protocol address verifier,” or CIPAV, the law enforcement spyware first reported by WIRED in 2007.

Court documents and FBI files released under the FOIA have described the CIPAV as software the FBI can deliver through a browser exploit to gather information from the target’s machine and send it to an FBI server in Virginia. The FBI has been using the CIPAV since 2002 against hackers, online sexual predators, extortionists, and others, primarily to identify suspects who are disguising their location using proxy servers or anonymity services, like Tor.

It would appear that even Tor might not be safe these days. As far as we know though, PGP is still secure, so make sure to keep using PGP for email and IM encryption.

What do you think about this? Scary or what? Let us know your take in the comments.

Read more »

Windows Update Fails On A Windows 2008 R2 Server With Error 8024A006

I was trying to run updates on one of my companies internal servers the other day, but it kept failing with error # 8024A006. None of my other servers were having that issue, so i did some StartPaging around and found a fix.

• Open services.msc, right click on Windows Update and select Stop
• Browse to c:\windows\ and rename the SoftwareDistribution directory to SoftwareDistribution_OLD
• Open services.msc, righ click on Windows Update and select Start

After that I was able to check for updates without an issue.

[Via KOTD]

Read more »

Where The F*(K Can I Find 3Ware Drivers For XenServer?

The other night I was running a rolling upgrade of my XenServers from 5.6 SP2 to 6.2. Everything was going swimmingly until I got to the last server in my resource pool which happens to be using a 3Ware 9750-4i RAID controller card.

Well the upgrade for that one failed miserably, and I pretty much had to force remove that host from the resource pool and re-install using the XenServer 6.2 disk. The reason it failed was the 3Ware driver for 5.6 is not compatible for 6.2

Awesome right? So I went to the 3Ware site, and searched around for XenServer drivers. No luck. I couldn't remember where I got the 5.6 drivers, so I started Googling around, and after about an hour I landed on 3Ware's stupidly named support site called mycusthelp.info. (Way to do SEO LSI/3Ware!)

So anyway, if you are looking for 3Ware drivers for XenServer you can get them at the following link, by doing a search for XenServer (3Ware Drivers For XenServer)

Read more »