If you’ve seen the 1983 movie “WarGames,” in which a young Matthew Broderick accidentally uses computers to bring the world to the edge of “global thermonuclear war,” then you have a pretty good idea what hackers and security researchers are super-concerned about these days — in real life.

Here at the Black Hat hacker conference at Caesars Palace, computer security experts have shown ways they can use virtual tools to tap into and tamper with all kinds of stuff in the real world, which is the gist of what made “WarGames” so scary.

No longer limited to the digital domain, hackers — many of them working for good — are now targeting prison systems, the power grid and automobiles. They’ll target anything with a mini-computer inside of it. These days, that’s pretty much everything.

Researcher Don Bailey pointed out that there’s even a pill bottle with a cellular connection, so that it can remind its owner when to take his or her medicine.

His first thought: “I’m not sure if that’s a good idea.”

A computer worm called Stuxnet is the main reason hackers and security types are focusing on these “real-world exploits” right now. While Stuxnet isn’t grabbing as many headlines these days as Anonymous and LulzSec — two hacking groups that have been stealing personal data and taking over big-name websites — in-the-know security experts and ex-government officials say the idea behind that worm is actually far scarier.

“The Stuxnet attack is the Rubicon of our future,” Cofer Black, the former head of the CIA’s Counterterrorism Center, said during a keynote talk here.

Stuxnet showed, for the first time, that a bit of malicious computer code could control industrial systems. The common wisdom is that the worm, which spread all over the Internet last year, was designed to attack and possibly blow up nuclear facilities in Iran.

No one knows for sure who wrote that worm, and its powers were never put to use. But the code is out there, and security researchers and hackers are jumping at the chance to study that code and figure out what else it — or something like it — could do.

The examples surfacing at Black Hat and DEF CON, a companion hacker conference attended by 15,000 people, sound like they’re pulled from a Hollywood thriller.

Tiffany Rad, a computer science professor by day, showed that a little-known electronic component in correctional facilities could be hacked and used to throw open all the doors that lock prisoners in their cells.

“Where there exists a computer, there’s still a chance of breaking that computer,” said Teague Newman, who worked with Rad on the hack. The two say they have gone to the federal government with their research. They won’t publish the exact code someone could use to tap into prison lock systems for fear that such an event would actually occur.

The prison hack wasn’t even that hard, they said. Working in a home basement in Virginia on a budget of $2,000, it took the duo only two hours to figure out and exploit the bug, which attacks a Siemens networking component called a programmable logic controller.

“It was not difficult,” Newman said.

Siemens is working on a fix, but it won’t necessarily come quickly.

“We need time to go after those vulnerabilities,” said a Siemens engineer who asked not to be named because he’s not authorized to speak on the record. “It’s not like in the IT world where you can quickly create a patch. We are really talking about critical systems here … so if you create a patch you want to make sure the patch doesn’t influence operations and the PLC (the networking component) is still running afterwards as designed.”

Rad and Newman said that company doesn’t deserve all the blame. The way prison security systems are networked, and the way employees use them, are also at fault.

Central computers that control locks should not be hooked up to the Internet, for example, but they often are, the researchers said.

Other Black Hat speakers discussed the vulnerabilities of electrical grid and water systems, which, theoretically, could be attacked using similar methods. And further attacks focused on holes in cellular networks.

Again, the targets are real-world, not virtual.

Bailey of iSEC Partners demonstrated a way to hack into the mobile components on many cars to unlock or start the vehicles with a few texts from his Android phone. But breaking into cars isn’t the scary part, Bailey said in an interview.

“I could care less if I could unlock a car door,” he said. “It’s cool. It’s sexy. But the same system is used to control phone, power, traffic systems. I think that’s the real threat.”

As for solutions, Bailey said the problem is the cost and lack of regulation.

“The issue is not just architecture but its cost,” he said. “A lot of the errors and the vulnerabilities I’m seeing (are) in overall architecture. It’s all systems — whether it’s your car or your tracking device or your pill bottle or whatever.

“It’s the issue of no regulations, no standards and no one enforcing any semblance of security.”

Security professionals need to step back from the technology and look at how these real-world systems — from prisons to power plants — are designed, said Tom Parker, vice president of security services at FusionX, a computer security company.

“We’re making the same mistakes over and over again,” he said, adding that these at-risk networking components are doing more than they were designed to do.

None of the researchers argue that society should stop putting little computers inside everything. Instead, they said, we need to work harder to make those little computers secure. And if we don’t, they say, the consequences could be huge.

“We have been frustrated with our efforts [...]]]> Mozilla is planning to shunt 12 million users, who are still surfing the web on its aged Firefox 3.5 browser, over to a more recent version. “We need a plan to obsolete [sic] Firefox 3.5 as we can’t support it into perpetuity,” said Mozilla.

Besides from that, Mozilla has committed to continuing to support Firefox 3.6, allowing older machines, such as Power PC Macs, to be able to connect to the interwebulator via that version of the browser.

To get the message across to Firefox 3.5 holdouts, Mozilla plans to issue a warning to all such users telling them they are running an out-of-date browser that is no longer supported against the threat of online attacks.

The message will be displayed through Google’s default search page starting tomorrow.

“At the same time we also put a big warning on all Mozilla web properties, pointing them [users] to the new version to download,” it said.

Anyone with automatic updates switched on will have Firefox 3.6.18 pushed out to them on 21 June, the same day Firefox 5 is expected to be released.

Mozilla released Firefox 3.5 in June 2009 six months later than scheduled.

Sofa will be shipped out from Amsterdam to Palo Alto, California in the next few weeks and said it would take [...]]]> Facebook bought Netherlands start-up Sofa for an undisclosed sum yesterday. The company, which in the past has developed Apple Mac software and design projects, announced the takeover on its blog.

“We expected to keep working at Sofa forever. But after Facebook first made contact, we were quickly convinced to join forces,” said Sofa.

“Facebook is full of talent and has a great culture. We feel challenged and at home at the same time, and can really get things done there. But equally important, we believe that at Facebook, we will be making a real difference to a lot of people’s lives.”

Unsurprisingly, Facebook hasn’t acquired Sofa’s full kit ‘n’ kaboodle of Apple-flavoured products. Its Kaleidoscope and Versions software didn’t form part of the buyout, said the Dutch firm. Instead those Mac developer tools will be separate from Sofa.

The apps are temporarily unavailable in the Mac App Store, presumably while the Facebook acquisition rumbles on. Sofa said it was talking to Apple about this and hoped to make the tools available via Cupertino’s online store soon.

“We’re also working with our joint venture partner to provide the smoothest transition and best possible future for Checkout, Enstore and their collective customers,” it said.

The partner in question is Acclivity, which will sell and support the products from here on in. There was no mention in the statement, however, that the apps would get any further developer love.

Sofa will be folded into Facebook’s design team, which presumably wants to prettify its offerings.

Google Chrome OS is a Linux-based operating system designed to work exclusively with web applications. Chrome netbooks running the new OS will be available from Google’s partners Samsung and Acer from [...]]]> A leading security researcher has warned that Google risks repeating Apple’s mistakes on security with its new Chrome OS.

Google Chrome OS is a Linux-based operating system designed to work exclusively with web applications. Chrome netbooks running the new OS will be available from Google’s partners Samsung and Acer from June. In a launch announcement, Google boasted of an end to patching and anti-virus updates woes.

Rik Ferguson, a security consultant at Trend Micro, criticised this line as marketing rhetoric. Google risks repeating the security mistakes of Apple, he warns.

Security features of Chrome OS include process sandboxing (so any app is unable to interfere with other apps on a system), automatic updating and a reversion to the last known good state if any problems are detected. This latter feature is possible because user files are stored in the cloud (and encrypted), with only system files held locally.

In addition, every application in Chrome OS will run inside the browser, with only (sandboxes) browser plug-ins running locally.

However this sterile environment is unlikely to last long, not least because Google has created a a Software Development Kit that allows the creation of Chrome “native apps”, according to Ferguson, who reckons this open the door towards the creation of malware.

Sandboxing technology ought to prevent any bad apps that are created getting out of their play pen. But Ferguson warns that sandboxing technology is no panacea for security woes.

“Exploits that break out of sandboxing have already been demonstrated for Internet Explorer, for Java, for Google Android and of course for the Chrome browser (to name but a few), while the Google sandbox is effective, it is not impenetrable and to rely on it for 100 per cent security would be short-sighted,” he said.

Rebooting laptops and storing data in the cloud is just “moving the goalposts” for scammers, Ferguson further argues. Instead of stealing data on a compromised device, the motivation will shift towards swiping authentication keys. “If I can infect you for one session and steal your keys, well then I’ll get what I can while I’m in there and then continue accessing your stuff in the cloud; after all I’ve got your keys now, I don’t need your PC anymore,” Ferguson writes.

Ferguson praises Google for its engineering work but questions its apparent suggestion that switching OSes is a “silver bullet” capable of killing off the modern myriad of security woes. He draws a comparison between Google’s claim that Chrome needs no anti-virus and similar claims in the past by Apple.

In the typically bizarre correspondence, LulzSec describes itself as a “band of pirate-ninjas” and claims not to mean any harm to the department.

Setting the tone, Lulzsec [...]]]> Notorious hacker collective LulzSec has targeted the NHS, publishing an email sent to the health organisation which highlights holes in its security systems.

In the typically bizarre correspondence, LulzSec describes itself as a “band of pirate-ninjas” and claims not to mean any harm to the department.

Setting the tone, Lulzsec begins: “We’re a somewhat known band of pirate-ninjas that go by LulzSec. Some time ago, we were traversing the Internets for signs of enemy fleets.”

It’s not Star Wars, you know

“While you aren’t considered an enemy – your work is of course brilliant – we did stumble upon several of your admin passwords, which are as follows…”

Here followed a number of passwords, although LulzSec was kind enough to blank them out when it published the email on Twitter.

It also clarified in a later tweet exactly where it had been poking around: “Subdomain NHS access compromised 5 core admins and contact info of several affiliates. Luckily they stored nothing of importance on that DB.”

The Department of Health, meanwhile, is keen to stress that it’s no big deal. A spokesperson told the BBC, “This is a local issue affecting a very small number of website administrators.

“No patient information has been compromised. No national NHS information systems have been affected. The Department has issued guidance to the local NHS about how to protect and secure all their information assets.”

Bones and that

Concluding on a somewhat irrelevant note, LulzSec stresses that it merely wants to help the NHS with its “local issue”:

“We mean you no harm and only want to help you fix your tech issues. Also, we hope that little girls feasts on the bones of many giving souls. All the best.”

The weird point about the little girls feasting on bones is a reference to Alice Pyne, a 15-year-old girl with terminal cancer whose bucket list includes a wish to “make everyone sign up to be a bone marrow donor.”

Advantages – Security is often cited as the primary reason for users switching from MSIE to Firefox. Security is of utmost importance for software [...]]]> Most of Firebird’s advantages are MSIE’s disadvantages, and vice-versa. This article will look at some of the advantages and disadvantages of Firefox in relation to MSIE.

Advantages – Security is often cited as the primary reason for users switching from MSIE to Firefox. Security is of utmost importance for software that interacts with remote computers, in an era of high security risk activities such as online banking.

Firefox has fewer security holes and a tighter schedule of disclosing them. The enhanced security in Firefox is due to a multitude of factors the system’s inclusion of more source code reviewers and a better bug reporting system and exclusion of VBScript/ActiveX, often the source of vulnerabilities.

Meanwhile, Microsoft has been clamoring for years to try to clamp down on the MSIE security holes. It acquired an anti-spyware product, which it released under the banner of Microsoft AntiSpyware. It also promises its new Windows Vista platform will be more secure. However, Microsoft’s track record to date has done little to boost the confidence of today’s user.

Standards compliance – Firefox has vaulted ahead of MSIE with improved support for standard web protocols, such as its superior stylesheet compatibility. Since MSIE had a leading marketshare, the company had less interest in conforming to web standards, and instead focused on proprietary protocols, with the goal of maintaining their market position. That is, the focus of Microsoft was to try to convert as much of its userbase to writing webpages and web applications that required a proprietary MSIE-approach, so that down the road, users would be less able to move off a Microsoft platform.

As a result, Microsoft neglected for years to improve support for basic open standards. For example, transparent PNG graphics did not work all the way through to MSIE version 6.

Multiple operating system platforms – Firefox is available for users who runs Windows (Windows 98 through to Windows XP), Mac OS X, all the leading versions of Linux, as well as some lesser-used operating systems. In comparison, Microsoft has dropped development for Mac, and other non-Windows systems. Furthermore, Microsoft has ceased new development even on their own versions of Windows, making the new MSIE only available to users who have a license for Windows XP.

Firefox also has a similar user interface among the different operating platforms. For deployments that have a mix of operating platforms (such as Linux for the techs, Macs for the graphic designers, and Windows for the accounts department), moving to Firefox for everyone thus brings technical support costs down.

Time-saving browser innovations Internet communication and interaction is a core component for most modern businesses. Efficient use of web browser time translates to increased profits, so innovations to help workers do their tasks faster are welcomed. Firefox leads MSIE in this regard, with out-of-the-box features such as integrated Google search in the toolbar, placing the find-within-page box at the bottom of the browser window so as not to obscure the text, and so on.

Disadvantages Retraining – Any switch of software incurs a retraining cost. However, a switch from MSIE to Firefox requires only a mild amount of retraining. The switch from MSIE to Firefox is designed to be easy, with proper import of bookmarks and other settings. Browser interfaces are becoming standard, so understanding how to get up and running is not usually a problem. There are some only minor adjustments. For example, “Internet Files” in MSIE is called “Cache” in Firefox. One can use a downloaded MSIE theme so that the Firefox user interface even more closely resembles that of MSIE.

Incomplete migration – In a business with Windows computers, if the switch from MSIE to Firefox is incomplete, it can cost more to offer technical support for both browsers. This argument would only apply to shops whose Windows computers are all Windows XP. Since the new MSIE is only available for Windows XP, if there are different Windows versions (such as Windows NT or 2000), then the technical support team already needs to support different types of MSIE browsers. Another consideration, however, is that even an incomplete switch from MSIE to Firefox could result in less technical support, since the Firefox users would be less likely to need help with fixing their computer after an MSIE-related security breach.