Source code standoff in breathalyzer case
200623
Minnesota officials haven't met a court-imposed deadline for turning over the source code to a breath-test device, which could lead to dropped DUI charges.
579956
Suspect accused of stealing and distributing source code over the Internet.
228766
Student detained after attacks on Estonian websites &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
749361
An NFL player's repeated drunken driving arrests have helped expose a loophole in a national registry that allows some offenders to remain behind the wheel even after a state suspends their licenses.
104107
Embedded Problems &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
246161
(InfoWorld) - A recent federal court ruling pertaining to open-source software in model railroads could derail enforcement of open-source licenses altogether, according to Mark Radcliffe, general counsel for the Open Source Initiative. If allowed to stand, the decision could withhold an important and expected remedy from open-source licensors, that being the ability to get an injunction against license violations, Radcliffe said. But the case does not necessarily set a precedent for other judges to follow, countered Eben Moglen, founding director of the Software Freedom Law Center. In the case, the plaintiff, Robert Jacobsen, claimed that the defendant, Matthew Katzer, sought royalties from Jacobsen on software covered by invalid patents obtained on open-source software. The software in this case was from the JMRI (Java Model Railroad Interface) Project, with which Jacobsen is involved. The original complaint is viewable here. According to court filings by Jacobsen, Katzer filed a patent application tailored to the capabilities of JMRI three days after the release of new JMRI software in 2002. The plaintiff alleged breach of the obscure Artistic License for open-source software and copyright infringement due to the removal of original copyright notices and substituting the name of Katzen's company, Radcliffe said.Â  But in a ruling on the case in San Francisco on August 17, Judge Jeffrey S. White denied a motion by the plaintiff seeking a preliminary injunction from infringing copyrighted open-source material. To establish copyright infringement, the plaintiff needs to show ownership of the copyrights and copying by the defendants, the judge said. Defendants, meanwhile, said they voluntarily ceased all potentially infringing activities. "This is one of the first cases about enforcement of any open-source licenses," Radcliffe said. In his ruling, the judge said the Artistic License was a contract and the failure to include copyright notices was not a restriction on the scope of the license, according to Radcliffe. Jacobsen sought to have Katzer put copyright notices in his software reflecting that it was open source. "What the court said was that remedy is not available," said Radcliffe. The remedy for contract violations under US law is damages, not injunctive relief, in which the court would order a party to cease a violation, Radcliffe wrote in his blog. The case, Radcliffe said, is a blow to the fundamental basis of open-source software, he said. "Most people in open source believe if you violate the license, you're outside it, Radcliffe said. "What this case indicates is that expectation may be wrong," he said. Assessing damages for use of open-source software is difficult because the software is given away free, according to Victoria Hall, attorney for the plaintiff. "What are the damages for an open-source project? These aren't your typical contract damages," she said. The case raises questions about the rights of those who release software via open source. "What rights do they have, and how strong are those rights?" Hall asked. But she and Moglen pointed out that the case does not necessarily set a precedent for future cases. "It seems to me a not very important ruling," said Moglen, who has not been involved in the case. The Software Freedom Law Center provides free legal services to those who make and distribute free and open-source software. "I do believe that the use of a more carefully drafted and more industry-tested license will probably help courts and other parties to deal with software in a more informed and accurate way," Moglen said. To avoid the lack of clarity in the Artistic License, the JMRI Project will switch to the GNU General Public License. "I think the big advantage [of GPL] is the automatic license revocation that is present in GPL that is not present in Artistic License," said Hall. Jacobsen also plans to appeal the judge's ruling, said Hall. Katzer defined to comment on the case. His attorneys did not return phone calls from InfoWorld. The judge set a September 14 date for a case management conference to further deliberate on the matter.
124078
I think I've mentioned this before but on Saturday Feb 12th I'll be talking  about the Jakarta FeedParser at CodeCon  in San Francisco.  I published an outline  of the talk on the FeedParser wiki.  I'm hoping to have a 0.5 release done before then and havepotentially another suprise in the works.
222395
As reported here on Secunia (as discovered by shinnai), there's a code execution vulnerability in PHP's glob function:    The vulnerability is caused due to an error in the handling of an uninitialized structure inside the "glob()" function. This can be exploited to execute arbitrary code, which may lead to security restrictions (e.g. the "disable_functions" directive) being bypassed.   The vulnerability is confirmed in the 5.2.3 win32 installer. Other versions may also be affected.    The issue is marked as "less critical" and can be avoided easily by only allowing trusted users the correct permissions to execute PHP code on the server.
98178
A series of security holes in three common Linux components has led open-source vendors to rush out several updates. Two of them, rated &quot;highly critical&quot; by security company Secunia, are in libpng, a library
202946
Ken Dunham of iDefense called the availability of the Cabir source code on ominous sign. &quot;Whenever you see the source code available on the underground, the more likely it is to be exploited,&quot; he said.
739150
Platform-independent tool for Authenticode signing of EXE/CAB files - uses OpenSSL and libcurl. It also supports timestamping.   Includes padding fix and support for signing of already signed files.
551774
A Microsoft lawyer said the arrest was &quot;significant,&quot; given the value of the source code. &quot;It is our secret recipe, our secret formula like the Coke formula,&quot; associate general counsel Tom Rubin said.
8226
In what may be the first action of its kind in the U.S., a lawsuit has been filed to enforce an open-source license.
350929
As Ed Finkler points out there's a new article posted (written by him) on the C7Y site (from php|architect) talking about his Inspekt library - an introduction to the filtering library showing how to help make your applications safer.   Inspekt is a library for PHP4 and PHP5 that aims to make safe input handing easier, and unsafe actions more difficult. Inspekt establishes a new development approach by wrapping input within "cage" objects, and requiring the developer to use validation and filtering methods to test and manipulate the input data. This article provides a brief introduction to Inspekt and its capabilities.   The article covers all of the basics - what the library can do for you, how it integrates into your application and how it helps to protect you from potential problems with the data in your superglobals ($_GET, $_POST, $_REQUEST, etc).
118388
Microsoft offers Apple security advice &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
299952
(InfoWorld) - A California attorney claims he has unraveled part of the mystery behind a questionable software program and is prepared to go to court. Attorney Joseph M. Bochner filed a class-action civil suit last September in California Superior Court in Santa Clara County against two men the suit alleges are behind Winfixer, a purported security software. The lawsuit names Marc J. Cohen of Florida, and was amended last week to add James Reno of Ohio as an additional defendant, Bochner said. It seeks compensation and a halt to the distribution of Winfixer, among other remedies. The suit was filed on behalf of Beatrice Ochoa, a mother of two who paid US$39.95 for Winfixer after it badgered her with repeated pop-up warnings that her computer had security threats. The program eventually rendered her computer's hard drive unusable, Bochner said. The suit counts another 100 anonymous victims. "All of these people are being defrauded and they're just ordinary folks," Bochner said. "They buy a computer, they surf the Internet, they're not doing anything unreasonable and suddenly they're defrauded." Indecision over whether Winfixer is a legitimate product may be the reason it still pervades the Internet. Winfixer has been a moving target for security experts, at times going by the names ErrorSafe, WinAntiSpyware, WinAntiVirus, SystemDoctor and DriveCleaner. Security software from vendors such as Sophos PLC and Symantec Corp. will detect it, but give users the option of whether they want to remove it. Sophos calls it "adware" that hypes security threats and then implores users to buy the software. Microsoft Corp., however, pulled no punches last month whenÂ Winfixer ads began show up on its instant-messaging program, calling it "malware," a shorter term for "malicious software." Experts have also seen it install itself on computers via security vulnerabilities in browsers or OSes. However, the lawsuit could face hurdles in court. Web sites are frequently registered under false names or under stolen identifies and the real owners can be difficult to trace, said Sandi Hardmeier, a computer security authority who writes about Winfixer on her blog "Spyware Sucks." Proving the link to the alleged perpetrators, their connections to Winfixer all the way through to the effects on Ochoa's computer will be very difficult, she said. "Forensics is everything," she said. Bochner acknowledges it's hard work to track down fraudsters who use the Internet's anonymity to commit crimes, but the criminals are real people who can be located. Bochner said he has compelling documentation to link the defendants named in the suit to Winfixer. By researching IP (Internet Protocol) addresses that hosted the versions of Winfixer and their owners, Bochner alleges he has uncovered a fraud based in the U.S. that has escaped law enforcement scrutiny. Reno ran a Web hosting company called ByteHosting Internet Service LLC with a postal address in Amelia, Ohio. Bochner said at one time, a support number for Winfixer support also rang through to ByteHosting, which led in part to Reno being added to the suit. Reno, along with other co-defendants and ByteHosting, was sued by Symantec Corp. in 2004 for allegedly creating pop-up ads that told consumers their Symantec software was about to expire. The ads then directed users to fake software that looked similar to Symantec products. Court records show Reno and Symantec reached a confidential settlement in December 2004. Cohen was named for his connections with vipfares.com, a now-defunct travel Web site, Bochner said. At one time, the Winfixer software would hijack the user's browser and suddenly show vipfares.com, he said. Efforts to reach Cohen and Reno for comment were unsuccessful on Wednesday and Thursday. However, Cohen's attorney, Judy Silverstein, appeared on a San Francisco TV news program on Feb. 26 regarding Winfixer and her client. Silverstein said, "His [Cohen's] position is he's done nothing wrong. He's done nothing improper or illegal, and he's had no ownership interested in those Web sites." Bochner said he has turned over some of his research to law enforcement agencies such as the U.S. Federal Bureau of Investigation and Secret Service along with California authorities. While researching IP addresses that linked to Winfixer, Bochner said he suddenly came upon a database detailing sales of Winfixer and the other versions of the programs. The multi-gigabyte database -- apparently left unsecured and open to the Internet -- contained names, addresses, credit-card numbers, transaction amounts and the version of Winfixer that was sold, he said. For example, on Jan. 20, 2006, the data showed 2,351 sales to users worldwide, with an average transaction amount of $40, Bochner said. The database covers transactions made from January 2005 through January 2006. One of the records shows a transaction made by someone who lives across the street from his law office, Bochner said. The data, while incomplete, allows a view of the fraud ring's broad reach and scope, he said. "I think this is far larger than anyone has ever expected," Bochner said. "It's not inconceivable that these people have made $150 million or more over the last few years." Â
194775
Another data security bill in the works &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29