Friday, January 6, 2012

Crowded Animal Shelter Society giving away cats Saturday #Caturday

Crowded Animal Shelter Society giving away cats Saturday | Zanesville Times Recorder |

ZANESVILLE -- Cats and kittens will be given away for free this weekend at the Animal Shelter Society to help relieve some overcrowding.

Executive Director Larry Hostetler said the shelter is full with more than 200 cats and this time of the year tends to be slow for adoptions.

"We've done this twice before and were very successful," Hostetler said. "It comes down to boarding all the cats or giving them away. It's more feasible to give them away at this point."

The Animal Shelter had financial difficulty in 2011, forcing it to lay off its shelter manager to save money in June. The shelter operates on a $1 million budget for expenses each year. The money comes from adoption fees, clinic fees, private donations and revenue from Mass Bingo at the Bingo Hall on West Main Street.

At one point in 2011, the shelter had 250 cats and 125 dogs.

The shelter is a no-kill operation, so it strives to find homes for all the animals it brings in. The giveaway, which will be from 10 a.m. to 4 p.m. Saturday at the Newark Road shelter, will allow people to waive the normal $50 adoption fee for cats.

Most of the felines at the shelter are adults, Hostetler said. But there are some kittens.

All have been spayed or neutered, all have their vaccinations, been wormed, been given their FIV shot and have been checked by the veterinarian.

"You're not only getting a great deal if you want a cat, but you're getting a friend forever," Hostetler said.

Those who want to adopt a cat still will have to fill out the proper paperwork.

And if you rent, you will be required to bring a letter or lease from your landlord stating you are allowed to have pets.

"But we're pretty overwhelmed with the cat population," Hostetler said. "Last time, we had one of these, we gave away 79 cats, and the time prior, we gave 149 cats away."

Hostetler said he thinks this will be the last free cat day the shelter sponsors.

"We feel by doing this we are saving lives and money," Hostetler said. "Adoptions are really slow this time of year and we know a lot of people would like a pet but can't afford the adoption fees. This helps not only our cats out, but our patrons."

Posted via email from Tony Burkhart

Ramnit worm goes social, steals Facebook passwords

Ramnit worm goes social, steals Facebook passwords

Ramnit - the file-infecting, financial-data-stealing worm that has been around since April 2010 - has been modified again and is now bent on stealing Facebook login credentials, warn the researchers of security company Seculert.

They discovered the fact after having accessed one of the command and control servers to which the worm sends the stolen credentials, and have seen and exfiltrated a list of 45,000 credentials (mostly from users in the UK and France), which the consequently delivered to Facebook.

"We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims' Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware's spread even further," say the researchers.

"In addition, cybercriminals are taking advantage of the fact that users tend to use the same password in various web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.) to gain remote access to corporate networks."

This variant and this capability of the Ramnit worm are quite new. When it first appeared, the worm concentrated its efforts on infecting .EXE, .SCR, .DLL., .HTML and other types of files and stealing FTP credentials and browser cookies.

Last year Trusteer warned that the worm had acquired the ability to inject HTML code into a web browser, which it is using to bypass two-factor authentication and transaction signing systems used by financial institutions to protect online banking sessions. By reverse-engineering samples of this variant, the researchers found the method used to configure Ramnit to target a specific bank is identical to the one used by Zeus.

Posted via email from Tony Burkhart

Symantec Investigating Possible Theft of Norton AV Source Code | SecurityWeek.Com

Symantec Investigating Possible Theft of Norton AV Source Code

A group of hackers claim to have stolen source code for Symantec’s Norton Antivirus software.

Update: 01/06/12 12:20AM EST - Symantec has confirmed with SecurityWeek that hackers have accessed source code related to an"older enterprise product." Full update coming shortly.

The group is operating under the name Dharmaraja, and claims it found the data after compromising Indian military intelligence servers.

Hackers Threaten To Release Norton Source Code“So far we have discovered within the Indian Spy Programme source codes of a dozen software companies which have signed agreements with Indian TANCS programme and CBI,” according to a post on Pastebin that has since been deleted. “Now we release confidential documentation we encountered of Symantec Corporation and it’s [sic] Norton AntiVirus source code which we are going to publish later on, we are working out mirrors as of now since we experience extreme pressure and censorship from US and India government agencies.”

Thus far, the information posted by the hackers includes a document dated April 28, 1999, that Symantec describes as defining the application programming interface (API) for the virus Definition Generation Service.

“This document explains how the software is designed to work (what inputs are accepted and what outputs are generated) and contains function names, but there is no actual source code present,” Cris Paden, senior manager of corporate communication for Symantec told SecurityWeek.

A second post entitled ‘Norton AV source code file list’ includes a list of file names reputedly contained within Norton AntiVirus source code package.

Symantec said it is still in the process of analyzing the data in the second post, Paden said.

What if the Norton Source Code has Been Stolen?

"If the rumors turn out to be true, the implications of the anti-virus code leakage will not keep the Symantec folks awake too late at night, and certainly not their customers," noted Rob Rachwald, Director of Security Strategy at Imperva. "After all, there isn’t much hackers can learn from the code which they hadn’t known before." Why? "Most of the anti-virus product is based on attack signatures," he said. "By basing defenses on signatures, malware authors continuously write malware to evade signature detection."

"The workings of most of the anti-virus’ algorithms have also been studied already by hackers in order to write the malware that defeats them. A key benefit of having the source code could be in the hands of the competitors."

But hackers could use the source code to search out and exploit vulnerabilities in the software itself. "If the source code is recent and hackers find serious vulnerabilities, it could be possible to exploit the actual anti-virus program itself. But that is a big if and no one but Symantec knows what types of weaknesses hackers could find," Rachwald concluded.

Norton is one of the most widely used anti-virus products, being used by millions of users around the world.

Brian Prince is a Contributing Writer for SecurityWeek.
Previous Columns by Brian Prince:

<div class="disqus-noscript">View the discussion thread.</div>

Posted via email from Tony Burkhart

EFF Raises Concerns About the New AOL Instant Messenger | Electronic Frontier Foundation

EFF Raises Concerns About the New AOL Instant Messenger

The new preview version of AOL Instant Messenger raised privacy concerns for us when it was first introduced, first because it started storing more logs of communications and second, because it apparently scanned all private IMs for URLs and pre-fetched any URLs found in them. We met with AOL to discuss how these features work and why the company should take greater care with your data, and we’re happy to say that AOL is promising to make some important changes as a result, especially in response to our second concern.

However, we still recommend that AIM users do not switch to the new version, as it introduces important privacy-unfriendly features. Unfortunately, AOL's moves are in keeping with a general trend toward more pervasive cloud-based services in which your personal chat data is centrally stored in plain text and an easy target for law enforcement and criminals. This shift toward central logging is troubling in many situations, including in chat.  

Chat Logging and the One-Way Toggle: More Change Needed

When you first sign into the new AIM, a flag is permanently set on your account to begin storing all of your conversations on AOL’s servers for up to two months, and perhaps indefinitely. AOL's intent is to make it easy to see the same messaging history even if you sign in from a different device, but the danger is that your private conversations are now available to, for instance, law enforcement agents with a warrant or a national security letter, or to criminals in the event of a data breach. In the case of government access AOL might not even be required (or allowed) to inform you that your private communications are no longer private. Because this concern will arise whenever your data is stored with cloud services or other kinds of third-party servers, EFF has long argued that whenever possible, no logs are good logs.

One important and good step AOL took was the inclusion of an "off the record" mode which disables logging of conversations on a per-contact basis. (Note: this mode should not be confused with Off The Record Messaging, or OTR, discussed below). However, we think they should go further. You cannot go "off the record" if you are using an alternative client like iChat or Pidgin, or if you switch back to an earlier version of AIM. And if the other participant in the chat is not using the new AIM, that person cannot toggle the conversation off the record, such that it is not stored by AOL. Finally, there is no off the record mode for the new group chat feature at all. All group chats on AIM will be logged.

All of these should change. AOL should not set logging as the default and it should not be permanent. Instead, logging should be opt-in and "off-the-record" mode should be robust and prominent in the user interface. Until AOL has either made this change or, better yet, worked to encrypt all of your logged conversations in such a way that only you can read them—a much harder solution, we admit, but doable—current AIM users who are worried about other parties accessing their data should think twice about upgrading.

AOL Downloading Private Message URLs: Improvement

Another new feature of the new AIM is the ability to embed an image or a video in a conversation simply by pasting a link. While this is a reasonable goal, AOL first implemented it in a massively overbroad manner: AOL has been scanning the text of all your messages for links and then having their servers follow that link to see if it refers to displayable media1. The goal is to have the central server render the image or video for you, with a possible speed gain, but this approach meant that all of your chats were scanned and links followed and fetched to AOL's servers in Virginia.

While we were pleased to hear that AOL was not planning to log, cache or store any of the data pulled down by this scanning and fetching, the approach was still tremendously overbroad. It was also likely to cause privacy and security issues for AOL's users. It meant scraping all the links out of private chats, even when no one in the chat is using the new AIM and even when the links did not go to embedded photos or video (which is of course likely to be only a small number of links shared). We pointed out that this implementation would reach private server links, links that might contain authentication data in the URL, or even one-time use pages like unsubscribe links, all of which were problematic.

But good news: after meeting with us, AOL agreed to limit the types of sites and URLs crawled by this technology, and to provide better notices to its users about how the links it sends will be used. The company also agreed to disable this "scan and pre-fetch" functionality for conversations that have been marked "off the record." We appreciate AOL’s willingness to discuss this with us and their openness to changing course in response to our concerns and will continue to watch to see how they implement what they've promised.

And bad news: unfortunately, it does not look like there will be a way to permanently opt out of the link downloading behavior. Since conversations can only be marked "off the record" from inside the new AIM, users of older versions or alternate clients will always be prone to having some of the links they send scraped, even though they won’t see them rendered. AOL’s planned changes limit the scope of the privacy concerns around this a great deal, but the only way to prevent it completely is to use end-to-end message encryption like OTR Messaging—a good idea in any case if you don't want your IM provider to record your conversations.

Notice and Opt-In

Another concern we raised with AOL was the lack of notice or control options it gave to their users about this change. AOL had given no clear indication of its aggressive URL-fetching behavior or logging in their terms of service or privacy policy.  And this fetching behavior started even before the new version of the client had been introduced. We didn’t see any notice in their marketing materials, either. The new client software does advertise the ability to embed graphics and video, but it doesn't explain how this happens, and users of older versions and alternate clients had no indication that anything had changed.

As Facebook recently learned, failing to be up-front with your users about what you’re doing with their private data can create big problems. Happily, AOL now says that it will give clear notice to its users2. We look forward to that, and will be watching to see that users are clearly told that AOL will be parsing their private communications over AIM, following certain types of links transmitted in those private communications (with a clear statement of which kinds of links or to which websites), and downloading the content on those links to AOL servers in the United States, something that may matter to AOL's international customers who did not intend for any part of their communications to be subject to U.S. law and legal processes.

But notice isn't enough.  AOL should also give users who upgrade initial notice with an opt-in check box, as well as an explanation in the terms of service that is clear and specific.

AOL and OTR Messaging Plugin: Cause for Concern

Many alternate clients such as Pidgin and Adium include the OTR messaging plugin, keeping anyone but your intended recipient from reading your IMs. Because we think the ability to have a secret conversation is vital to human rights activists, whistleblowers, businesses in "stealth mode" and many others, we gave a Pioneer Award to Ian Goldberg, one of OTR’s creators in 2011. Sadly, AOL has indicated to us that these clients may not always be able to operate with AIM, which is unfortunate since we viewed that option as one of AIM’s key features and we urge the company to reconsider. Luckily, OTR works with a number of other messaging protocols.


We appreciate AOL's willingness to discuss these changes with us and we're extremely pleased to see AOL taking some steps to safeguard their users' privacy and give better notice, which only becomes more important as the company moves toward providing more cloud-based services. Nevertheless, we think there’s more AOL should do to respect its customers' privacy and to fully inform them about, and get opt-in agreement to, these significant changes.

Bottom line: Because signing onto the new version of AIM permanently changes your account settings to log all conversations to AOL’s servers by default, we recommend that existing AIM users do not upgrade. As always, we recommend users stay safer online by using chat clients that are compatible with OTR.

Posted via email from Tony Burkhart