Panda feeds safer transactions
96677
Panda Security launched a new application on Tuesday aimed at thwarting customized attacks carried out against users of online transactional systems.The system, Panda Security for Internet Transactions, promises to utilize real-time data aggregated from the machines of the company's existing customers to allow the application to protect against highly customized threats.As server-side polymorphism and other malware authoring techniques have allowed for the creation of nearly endless numbers of attack variants and made traditional signature-based methods of exploit prevention less effective, many industry watchers have begun to recommend that security vendors move to embrace more proactive defensive strategies.By using their customers' machines as frontline malware collectors and feeding data about newly emerging attacks back to their central operations -- and then passing that data on to their other clients -- Panda and other vendors contend that they can defend against nascent threats more effectively.Built around the company's Collective Intelligence system -- which claims to track targeted attacks by associating new malware strains with those being sent to other users of its software in the cloud -- Panda claims to have invented a product that can help people avoid legitimate transactional sessions secretly under the watch of spyware programs.In the world of online transaction, that system is particularly useful for helping to protect users against banking Torjans, spyware, and attacks on legitimate sites, including so-called cross-site scripting threats, company officials maintain."Hackers are constantly developing new malware techniques and actively testing their work to see what anti-virus software catches it. By using the behavioral information displayed by individual attacks to identify them and sending that information back to be correlated with other data, we can create vaccines for new attacks much faster," said Ryan Sherstobitoff, chief corporate evangelist at Panda. "We think that we're setting ourselves apart with what we do with the gathered intelligence and how we reference that with previous data on previous attacks in a structured model."The notion is simple: Once a Panda customer has encountered a specific attack and information on the threat has been sent to the company's central systems, a vaccine for the exploit can be created and shared with the firm's other users, the company maintains.When a user of the new Panda application logs onto to an e-commerce or e-banking site armed with the application, the tool completes a scan of their machine to search for any potential attacks, which takes roughly five seconds to complete, the company claims. Once the scan is completed, they are allowed to move forward and carry out their intended business.By working with banks and e-commerce sites to stay abreast of the latest attacks on their specific brands, and protecting customers against those threats, the vendor contends that the system can help block many popular forms of fraud, particularly through the use of Trojans that lie in wait until users go to specific Web sites where they might share valuable data.Even though transaction-based virus scans have not found favor with users in the past -- based largely on their slow performance -- Panda officials promise that their application moves quickly and does not interrupt normal online behavior.By communicating with threat data stored in the cloud versus attempting to save that information onto end-user's machines, the system works much faster than previous transaction-based technologies, the company said."To do a scan at the time of the transaction hasn't traditionally worked, but through using collective intelligence, we're able to provide broader and immediate protection, to know what's going on right at that moment," said Gary Leibowitz, head of U.S. security operations at Panda."The end-user merely downloads an ActiveX client once, and then the e-commerce or banking sites invoke the scan at the time of the transaction; we believe this provides companies and end-users with the ability to make smarter decisions about whether or not to allow something to go through," said Leibowitz.Some analysts are pushing for more anti-malware vendors to begin using their customers' computers as harvesting points for new attacks based on the wide variety of threats being distributed on the Web today.Andrew Jaquith, analyst with Yankee Group, has dubbed the approach as "herd mentality" for security."By turning every end point into a malware collector, the herd network effectively turns into a giant honeypot that can see more than existing monitoring networks," said Jaquith. "Scale enables the herd to counter malware authors' strategy of spraying huge volumes of unique malware samples with, in essence, an Internet-sized sensor network."
118932
Be mindful of stocks trading with high multiples.
385883
Photocopying wallet information pays off.
230802
In a new post to his blog today, Danne Lundqvist shares his method for creating a blog aggregator (in the style of the planet-planet sites) to re-aggregate all of the feeds back ou tinto one.   Lately I have begun to get more and more annoyed with my feed reader. I use a simple feed reader which lack most features except for subscribing to and reading feeds. The one thing that annoys me the most is that it can't aggregate several feeds into one feed. Yesterday I finally decided to scratch that itch.   His method uses the Zend Framework to accomplish the goal - and "the whole website logic (both model and controller) is about 200 lines of code". There's no exception or error handling in it, but it works and the Zend_Feed module works well to grab just about any kind of feed.
753808
I've not made much of a secret of the fact that I've been working on a new product, and am getting close to offering it as a public pre-alpha thing for Mac users only.  It's fairly Flickr-centric, sucking photos down from Flickr in a variety of ways and pushing up photos in others. Like Radio 8 and Google Reader, it has the ability to maintain an output feed of stuff you want to pass on to friends and associates. As I was developing this I wished that Flickr had the ability to store simple text files, because I needed a place to put an RSS 2.0 feed with enclosures on behalf of each user. Of course I used Amazon S3, but I had to implement my own lightweight identity system so that Juan couldn't accidentally or intentionally replace Alice's feed. If only every user had a place where they could store stuff that's net accessible so that once and for all we could stop inventing new places. I was inspired to write about this when I read an Uncov review of Pownce where they reminded me that they were reselling S3 storage at a big markup. What if the users had their own S3 storage that they paid for themselves?  Then it occurred to me to ask if people thought S3 could be an end-user thing. I'd like to find out, so if some non-technical users who have Amazon accounts would like to try setting up an S3 account, I'd be interested in hearing how it goes. Here's an idea of how you get started. 1. You must already have an Amazon account. Nothing special about it, if you buy shirts or books or stereo equipment from Amazon, you use the same account for S3 storage. Already that's pretty easy, millions of people have Amazon accounts, right? 2. Visit this page on Amazon, ignore all the stuff about objects and buckets. In the right margin is a big button that says "Sign up for this web service." Click the button. A very familiar page appears, asking you to sign into your Amazon account as if you were going to buy something (you are!). 3. From there, I'm not sure what you see, because I have already enabled my account. But the end result of signing up is that you get two strings with weird names: Your Access Key ID and Your Secret Access Key. Any software that would save a document in S3-space on your behalf would need these two strange strings. In return each document would have a URL just like any other document on the web. Nothing strange about that.  4. You could also use the space to store stuff using an FTP-like app that runs in Firefox called S3 Organizer. It's about as hard to use as the Mac Finder or the Windows Explorer, i.e. it's no challenge for a moderately geeky user. The cool thing about it is that you're able to share anything you upload into S3 space with anyone else. You can even use BitTorrent to access any file to save you bandwidth bills and distribute the load round the net. It's all very easy to do, imho. As a developer who has to pay for his users' storage needs I would very much like to see users learn how to use S3 to store their stuff, so I can focus on writing software and fixing bugs instead of paying to store your stuff.
270604
It's possible to find out quickly which fish to buy and which to avoid.
349398
The Hardened-PHP Project has issued another advisory today, this time effecting the popular database administration package phpMyAdmin.    During an audit of phpMyAdmin's protection against CSRF: Cross Site Request Forgeries we discovered that there were multiple ways to bypass the protection.   The failure of phpMyAdmin's CSRF protection obviously means that a potential attacker can use CSRF attacks to trick the browser of a phpMyAdmin user to execute any kind of SQL queries on the victims database server.    The advisory mentions the source of the problem - a random token that is in the user's session that could be exploited to gain unauthorized access to an account. Their recommendation is to update to the latest version of phpMyAdmin (2.9.0.1 as of the time of this post) to help resolve the issue.
742487
By Randy Myers, Contra Costa Times, Walnut Creek, Calif.  Jun. 15--Good deeds hold more value than fat wallets in the tight weave of the Friendly Favors Web community.
154380
Paul Reinheimer, one of two behind the funcaday website (providing details on one PHP function each day and special content on the weekends) has posted a supplement to this weekend's posting covering escaping.   The disadvantage with the escape for now, not for later approach is simple. If you save a user's post to the database, then that user's post is displayed 2,000 times there will be some serious differences. [...] You will need to balance your security concerns with performance needs.   The comments on his post back up his suggestions (and include other tips like a recommendation to cache on an even higher level - page blocks).
680506
(Source: Plasmon)  In this white paper, Heidi Biggar of Enterprise Strategy Group discusses the ideal solution that creates a multi-tiered active archive for cost-effective, long-term accessibility to compliance data.   According to Biggar, organizations cannot continue keeping non-transactional data on primary storage systems. Archive platforms make better economic sense. Download this white paper to learn more!
81452
The leading vendors in the data warehousing market are running scared of new entrants to the market that are offering data warehouse appliances (i.e. pre-integrated hardware, software, storage combinations) that can offer greatly superior performance at a significantly lower price.  In this white paper we will dispel the 'fog of war' that currently pervades the data warehousing landscape, dismissing those question marks that are irrelevant and gratuitous, but highlighting any genuine issues that need to be addressed.
511267
Yesterday China Herald tipped me that the Yahoo.com website (the English version) didn&#8217;t resolve. I checked, saw that it was true and thought I would check back the next day if the situation had changed.  At times these things happen here in China and it could have been a technical problem instead of a block. [...]
215943
No alarm. No idea Leaked information from databases is becoming an increasingly serious concern, yet when it comes to plugging the wholes many organisations are running so many databases they hardly know where to start.â¦
50343
Czech firm aims to maul Panda and other critters Czech anti-virus firm GRISoft is targeting the small and medium sized business market with revamped versions of its network security products.â¦
433460
Tech-savvy giant pandas can now pick up their email or browse the web to find a perfect panda partner thanks to the deployment of a campus-wide broadband and wireless network in China&#39;s Wolong Nature Reserve.
690606
Investing: Taming China's Dragon Market
393868
Make sure your investment's revenue stream is diversified -- or you could get hurt.