Think INFORMATION. Think SECURITY.

Hacking is an ACT of WAR: The Pentagon

2011-05-31T16:09:00.001+08:00

If the attack is a threat to national security, or the attack is directed to the military, then this should be considered and act of war. But to whom do you send the missile to? Where the IP address is located?

And if this stand will be taken by every country that shall be hacked, can you picture now what's the world situation going to be?

The Pentagon is sending a warning to nations who are considering engaging the US in cyber-warfare and has concluded that attacks coming from another country can constitute an “act of war,” which gives U.S. the right to respond using traditional military force, according to a report from The Wall Street Journal.

Similar to how international treaties guided traditional wars, the Pentagon is now laying out its first formal cyber strategy to be discussed with its allies, which represents an early attempt to adjust to a changing world where even hackers could pose as a significant threat to the U.S.

“If you shut down our power grid, maybe we will put a missile down one of your smokestacks,” said a military official.

The Pentagon, which believes that most sophisticated computer attacks are supported by a country’s government, is proposing the notion of “equivalence” wherein:

“If a cyber attack produces the death, damage, destruction or high-level disruption that a traditional military attack would cause, then it would be a candidate for a “use of force” consideration, which could merit retaliation.”

The proposal, however, is sure to spark debate over a range of sensitive issues the Pentagon has left unresolved, including the certainty of an attack’s origin, and the kinds of cyber attack that would constitute the use of force.

The Journal says that many military planners believe the trigger for retaliation should be the amount of damage—actual or attempted—caused by the attack.
These reports come shortly after the U.S. government outlined a new strategy for cyberspace, which included references to security.

Editor's Note: Cross post from: TNW

Eyes on the Big Boys now! PBS News Site Hacked!

2011-05-30T23:04:00.000+08:00

Epsilon, Sony, Lockheed, PBS News, who is next?
The latest hack on the PBS News site is the best hack ever.

Tupac Shakur is alive!

Not.

Check off the main news website for the Public Broadcasting System, PBS NewsHour, as the latest victim of a hacking attempt that has interrupted the site’s main activity. Hackers from “LulzSec” were able to break into the site and posted a fake story that said rapper Tupac Shakur was still alive.

This is (now) the third high-profile cyber attack in a little more than a month on important computer networks that are increasingly seeming vulnerable to cyber attacks. A cyber attack on Sony’s PlayStation Network (PSN) led to hackers stealing sensitive information from potentially more than 100 million PSN and Station.com users. Hackers were able to break into Sony’s network on April 19, forcing the company to bring it down and beef up security.

Defense contractor Lockheed Martin was also hit by a cyber attack last week, but the company said it successfully fended off the “tenacious and significant attack” and said no information was compromised. While sensitive information about 100 million consumers was at risk during the PSN attack, sensitive information about defense contracts and advanced technology could have been at risk during the attack on Lockheed Martin’s private network.

Hacker group “LulzSec” has apparently claimed responsibility for the attack, according to its Twitter feed. But it was quick to remind the general public that it was not a part of hacktivist group Anonymous — which regularly takes up political causes and sometimes commits hacks like this for amusement. Those within Anonymous — an amorphous and loosely associated group of hackers that are regulars on message boards like 4chan — typically use the term “lulz” to describe the amusement they get out of hacks like these.

“We aren’t Anonymous you unresolved cow-shart,” the group posted in its main Twitter feed.

And, for a little while according to PBS NewsHour, he was alive and well in New Zealand 15 years after he was reportedly killed. The news publication furiously denied the story was true with its Twitter account and has been tirelessly communicating with its audience to tell everyone that the story is fake. As a reminder, Tupac Shakur died from his wounds suffered in a drive-by shooting in 1996. The rapper was known for his lyrics that glamorized the life of a “player.”

A full transcript of LulzSec’s admission to the hack is pasted below, which makes reference to a PBS story called “WikiSecrets: The inside story of Bradley Manning, Julian Assange and the largest intelligence breach in U.S. history”.

“Greetings, Internets. We just finished watching WikiSecrets and were less than impressed. We decided to sail our Lulz Boat over to the PBS servers for further… perusing. As you should know by now, not even that fancy-ass fortress from the third… Pirates of the Caribbean movie (first one was better!) can withhold our barrage of chaos and lulz. Anyway, unnecessary sequels aside… wait, actually: second and third Matrix movies sucked too! Anyway, say hello to the insides of the PBS servers, folks. They best watch where they’re sailing next time.”

Editor's Note: Cross post from www.venturebeat.com

Other reference: PBS hacked in retribution for Fronline Wikileaks episode

STOP! - LOOK! - OBSERVE! Bad People Around

2011-05-30T18:25:00.000+08:00

Sometimes we get too technical that once we protect ourselves from external threats we feel confident and safe already. And we become too trusting to the people within our organization. Well, stop, look around and observe vigilantly.

Just recall the most recent $10M incident in Bank of America, where an insider sold customer data to outsiders. Yeah, an insider did it!

A survey showed that 40% of IT staff admit that they could hold their employers hostage - even after they’ve left for other employment - by making it difficult or impossible for their bosses to access vital data by withholding or hiding encryption keys.

A third of the Venafi survey respondents said that their knowledge of and access to encryption keys and certificates, used for both system authentication and data protection, means they could bring the company to a grinding halt with minimal effort and little to stop them. This is due to lack of oversight and poor management of their organisation’s encryption keys.

They claim that even after they have left they still could cause havoc with their knowledge of the encryption keys, shared passwords and weak controls. 40% of respondents admitted that they would still have access to vital information and could manipulate it to their own ends—both to their company's financial and reputational detriment.

31% of respondents astonishingly said that they could still access organisational data because they could easily retain the encryption keys when they left and access the information remotely.

Finally, 24% of respondents to the survey admitted that their fear of losing encryption keys is what is deterring them from investing in encryption key and certificate solutions to protect digital assets and secure sensitive system communications.

The survey shows that 82% of companies now use digital certificates and encryption keys, however, 43% admit to being locked out from their own information - because people have left the organization or keys are lost - and 76% would use automation if they knew it existed.

These same companies are unaware of how to manage their keys and certificates, leaving them exposed to unplanned system outages, security risks and reduced access to critical data.

Jeff Hudson, Venafi CEO, said: “It’s a shame that so many people have been sold encryption but not the means or knowledge to manage it. They have found out the hard way—after being locked out from their own information—that they need an automated solution to manage the thousands of keys and certificates they have. Once the data's protected with encryption, the key becomes the data and the thing that must be managed and protected. Key Encryption is only half the solution. IT departments must track where the keys are and monitor and manage who has access to them. What this survey reveals is that organisations need to quickly come to terms with how crucial encryption keys are to safeguarding the entire enterprise as well as the heightened need for automated key and certificate management with access controls, separation of duties and improved polices. It’s no longer rocket science. Yet recent, costly breaches at Sony, Epsilon and elsewhere reinforce the need for both more encryption and effective management. There are some great solutions on the market that can manage and automate these assets at a click of a switch.”

Get the complete survey information from here.

Editor's Note: Cross post from Help Net Security.

Online Safety in the office: YES, But how about the CHILDREN at HOME?

2011-05-30T16:16:00.000+08:00

The Internet didn’t arrive for most of today’s parents until after they had passed adolescence. Online behavior was something they were able to approach with the disposition of an adult (even if some chose not to).

Their children, however, were born into a very different situation. It’s not uncommon to see an iPad next to the crib, and 7.5 million children younger than 13 have Facebook profiles.

If parents don’t teach online safety, their children might not recognize imprudent online actions or realize their consequences.

“Younger kids certainly don’t know that what they post is out there for everyone,” explains Jeff Godlis, the director of communications for Internet literacy education publisher i-Safe. “As you get older, the kids keep pushing the barriers… Parents need to be parents, and they have to be involved.”

1. Understand Internet Safety Before You Explain It

Many adults aren’t savvy Internet users themselves. A 2010 study, for instance, found that only 51% of participants recognized that ad companies frequently determine what ads to show based on the history of prior websites that they visited.

“Kids are learning about all of the facets of social media online. It’s happening much earlier,” explains Hilary DeCesare, the CEO of tween social network Everloop. “It’s parents that aren’t keeping up…The real dilemma is, how do you teach kids about something that you’re uncomfortable with?”

For instance, DeCesare says, many parents list their first and last names on social networking sites, and may not realize that their children shouldn’t do the same.

Fortunately, it’s easy to brush up on Internet safety guidelines. The American Academy of Pediatrics, theFederal Bureau of Investigation and the Federal Trade Commission are just a few organizations that provide robust resources.

2. Teach, Don’t Rule

“We have always been on the education side,” Godlis says. “Teach someone and they’ll learn it and they’ll understand it. They are empowered to do the right thing.”

The right message, DeCesare says, is “I care.” Not, “if you do X, I’ll ban the Internet.” When it comes to keeping your children safe on the web, the goal is to ingrain positive behaviors rather than just enforcing strict rules. Threatening children with revoked Internet privileges might even create a dangerous environment.

“Kids aren’t comfortable telling adults (about problems they encounter online like cyberbullying) because they think they’re going to get in trouble, or worse, they’re worried that they will pull their privileges of being able to use the Internet,” she says.

3. Consider Age-Appropriate Social Networks

Legally speaking, children younger than 13 shouldn’t be on Facebook, MySpace or Twitter. The Children’s Online Privacy Protection Act prevents websites from collecting information from children without their parents’ permission. Many children bypass this law, even on sites that enforce it, by simply adjusting their birthday. But DeCesare says that parents should still be wary of social sites designed for adults.

“Facebook was never intended for kids younger than 13,” she says. “Kids click on things. Which can be a problem, not just with friending people, but also the malware they pick up online.”

In a recent study by the Kaiser Family Foundation, 75% of 7th through 12th graders surveyed said they had a profile on a social media site. Parents would have a hard time barring social media sites entirely, but they can easily introduce age-appropriate social networks to their children instead of the grown up standards.

Most of these networks restrict content and provide a parental oversight component, either by alerting parents when something seems fishy or asking them to approve certain actions, like new friends.

4. Monitor With Care

No matter your price range or parenting philosophy, there’s an appropriate software option for monitoring your children’s online safety.

But Godlis cautions parents against the notion that using such a service alone is sufficient.

“I think that filters and monitors give parents a false sense of security — as long as the filters are on, I don’t have to worry,” he says. “They certainly can over-rely on it. Kids are pretty smart and they get around everything. They know how to use proxy servers and they know how to do things that parents don’t.”

Editor Note: This is a cross post from: http://goo.gl/LMIXR by Sarah Kessler

Social Engineering gains ever more credibility.

2011-05-25T19:04:00.000+08:00

ignosecond – ig no sec ond – \‘ig nə se kənd – The time between the moment one does something inherently stupid and the moment one realizes that it is too late to stop the results of that action. Examples include pushing a locked car door closed and realizing that the keys are in the ignition or opening an attachment or clicking on a link in an email message from supposedly a business associate or friend and recognizing the telltale signs of a phishing scam.

It is turning out that the latest breaches were the result of an ‘ignosecond’ by one or more employees that in turn caused a security breach to be possible. All it took was an email message to personnel that included a piece of malware hidden in a file attachment that exploited a vulnerability that then allowed the installation of a backdoor and viola, another compromise.

This should be a wakeup call to all security professionals. It does not matter how sophisticated your security technology is, it only takes one person to cancel all that out. This is why the PCI DSS dedicates requirements in 12.6 to security awareness. The requirements in 12.6 state:Implement a formal security awareness program to make all personnel aware of the importance of cardholder data security.

Educate personnel upon hire and at least annually. Note: Methods can vary depending on the role of the personnel and their level of access to the cardholder data.
Require personnel to acknowledge at least annually that they have read and understood the security policy and procedures.

The problem is that a lot of security professionals give only lip service to security awareness training. Let us face it; security awareness training is not as sexy as security technologies like SEIM and WIPS. And besides, our users are, well, users. Even if you train them, they still make mistakes, so why bother with security awareness training? However, at the end of the day, everything in an organization’s security posture comes down to the people that interact with the information you are trying to protect. As I stated earlier, it only takes one person having a bad day or a “bad apple” to make all of an organization’s security technology and other controls impotent

This is why security awareness is such an important part of an organization’s security posture. Whether you like it or not, there are human beings in the equation and human beings are fallible. The only way to address this situation is to educate your fellow employees on how to make things secure and avoid being taken in. But remember, human beings are fallible, so no matter how hard you press security awareness in your organization, you are still going to have incidents. Therefore, the goal of security awareness training is to minimize the number and impact of those “ignoseconds.”

But we need to be honest about all of this. Human beings are fallible and we all have our “moments.” As a result, even with a lot of appropriate security awareness training and periodic reminders, one or more personnel can have a “moment” and create the possibility of a breach. Even with defense in depth, all it takes is one well crafted attack, a fallible human and your security is breached. As I have repeatedly stated, security is not and never will be perfect. And this is particularly true when human beings are involved.

My favorite story about such a situation is from years ago when I was conducting a social engineering attack against a subsidiary of a Fortune 500 company. We had crafted a very real looking email message from a known Human Resources consulting firm indicating that they were conducting a survey of the subsidiary’s employees on behalf of the corporate parent. We instructed recipients to log into a phony Web site and take the survey. All they had to do was use their network logon credentials to gain access to the survey. We only got two hits before the parent company’s HR department sent out an urgent email message telling employees that our message was bogus. One of the two people caught was the CFO of the subsidiary that had hired us. His comment when confronted with the fact of his “moment?” “I suppose I shouldn’t have done that.” What an understatement!

But this story points out the problem all security professionals face and this is one problem that technology is not going to solve. In the end, people are always going to make mistakes and all we can do is minimize the impact of those mistakes. Minimizing the impact means real security awareness training coupled with social engineering testing to assess how the security awareness training is working. In addition, you need to structure your preventative, detective and corrective controls such that you address any points in your controls where one “moment” results in a compromise. In some cases, you may need to restrict peoples’ access to certain resources or divide up responsibilities.

Most security professionals loathe social engineering tests and rightly so. As someone famously said a while back, “When on a witch hunt, you are always going to find at least one witch.” As I have already stated, everyone has their moments and as social engineers such as Kevin Mitnick have shown, there are always ways to social engineer your way into any organization. Not that organizations have done themselves any favors in this area. For the last quarter of a century, most organizations have been focused on customer service improvements. A by-product of this customer service improvement focus has been to train employees to be customer friendly to a fault. It is those faults that are now being used against them by social engineers. While good customer service is necessary, customer service training needs to be coupled with a healthy dose of skepticism to ensure that information is not provided without proper authorization.

The best example of customer service gone awry is from the 2010 DEF CON “How Strong Is Your Schmooze” contest. This contest was a social engineering exercise against large companies that resulted in some very embarrassing results. Contestants had two weeks to prepare for their social engineering exercise by conducting research on their target. Of the 15 organizations contacted and 25 available “flags” that could be obtained, 14 gave up one or more “flags.” To add insult to injury, the social engineers had only 25 minutes to perform their telephone calls in front of a live audience. If you have read the report you may have issues with the 25 “flags” that were used (God knows the FBI was very concerned and advised the DEF CON people on what they considered okay information to obtain), but you must remember that if this sort of information was obtainable, then probably just about anything could be obtained.

The lesson to be learned in all of this is that if you are not worrying about social engineering and conducting security awareness training, then you are kidding yourself if you think your organization is truly secure. Yes, there is little you can do to stop human beings from having “ignoseconds.” But you can take steps to minimize the impact and one of the most important is to get serious about your security awareness training and to follow that training up with social engineering testing. Just acting on those two items can make a significant difference in the impact of a social engineering attack.

Let's always keep in mind that information security is a human enterprise. Keeping your people in the organization out of participation in protecting your information is just as good as making your weakest link in the information security infrastructure.

Editor's Note: This is a cross-post from PCI Guru.

Information Security is a Human Enterprise

2011-05-20T17:43:00.004+08:00

Editor's Note: This is a cross post from the article of Robb Reck at InfoReck

Security is viewed as a non-negotiable requirement of being ‘in business'. [Allen, Julia. “Governing for Enterprise Security: An Introduction.” June, 2005. ]

Everytime I do a lecture, seminar, workshop, training on Security I always emphasize the point that Information Security implementation is a human enterprise. No organization will be successful enough to implement Information security without getting to the end-point (the users).

The problem of not involving every employee in the implementation of Information Security, in my observation is if you allow your IT people to totally implement it. Almost everything becomes a technical wish list at the end of the day!

Here's a good article written by Robb Reck, Every Employee, a Security Partner. And I totally subscribe to this.

The information security department is responsible for writing policies, creating awareness training, tracking compliance, and generally leading the data security program at an organization. But when it comes down to it, we are not the ones who do most of the practicing. The ground-level implementation of security in the organization simply cannot be the work of a few information security employees; it needs to be performed by every employee in their day to day tasks.

The information security team is responsible for the creation of the policies and standards. This is the framework that a security program is built on. By using a well-tested framework we can ensure that our organization’s security needs are adequately documented. The policies are critical, but they are only the framework. To flesh out the program we need the actual implementation, and that’s where the rest of the staff comes in.

Another essential role of information security is in properly distributing the policies. Having a perfect set of policies and standards is one thing, but if it’s never put into the hands of those who do the work, it is of very limited value. Security awareness training must be more than just a checkbox we check to get through an audit. Awareness of corporate policies and standards should be provided through formal training, but also gorilla marketing, regular staff meetings, reminder emails, and performance reviews.

Once the policies are in the hands of our entire staff, it is up to them to successfully implement data security. Whether the policy is password complexity rules, sensitive data handling, or secure coding standards, we depend completely on our employees to implement it. We cannot overlook any employee group; even the least likely-seeming employee will have access to our organization, and could be used as a jumping off point for an attack. A thorough and consistent security message, delivered to every area of the organization, is required.

In order to ensure that each employee hears the appropriate message, we need to customize their training to their daily experiences. There are some areas that every employee should be taught (secure password rules, avoiding tailgaters, how to spot an intruder), there are many others that are essential in departments, but unnecessary for others (secure coding standards, firewall configuration rules). By tailoring the training to the intended recipients we successfully reduce the amount they need to be taught, while make the training both more interesting and more effective.

Employees partnering in security can give us granular security knowledge that InfoSec cannot otherwise have.

Once we get our employees to view themselves as our partners in security, they will start to point out areas we missed. This provides us significantly improved insight to the organization as a whole. When we have the accounting team providing suggestions on how to improve accounting security, the DBAs helping with database security, and the call-center reps with our customer service process, we get the kind of granular level insight that one central InfoSec team could never have.

Another benefit that this kind of enterprise-wide security implementers is that our employees can work as a human intrusion detection system (IDS). As an example, last year when the “Here You Have” worm hit the internet, the employees at Intel immediately recognized this as malicious and provided the central IT/InfoSec departments a heads-up so they could take immediate actions to prevent exploitation in their organization. The same thing can be said for any type of persistent threat. A server admin may notice continued bad authorization attempts from a specific IP, a receptionist may notice a stranger lingering around the entryway, or a HR employee may forward on suspicious emails that seem specifically targeted against the organization. In any of these situations, our employees can be a first line of defense, and prevent more serious exploits from occurring.

By integrating all employees as information security partners we not only improve the overall quality of our information security program, but we educate our employees to make better choices, both at work and home. By partnering with all our employees we add value to all sides. That sounds pretty good, doesn’t it?

Great article and well said Robb.

People can become the most effective layer in an organization's defense-in-depth strategy with [Ernst & Young. "Global Information Security Survey 2004." ]:

proper training
education
motivation

And most of all, the implementation of Information Security in any organization should be championed by the executives, and the executives themselves should adhere to it, otherwise, the initiative is a waste of effort and resources.

Will this control HUMAN in the (very near) future?

2011-05-17T00:28:00.000+08:00

This one is definitely fantastic but mind boggling!

Ed Boyden, in this presentation shows the world that by inserting a light-sensitive algae gene into brain cells (virus-like), one can selectively activate or de-activate specific neurons with fiber-optic implants. In the field of medicine, I would say this is a great discovery as neural prosthetics in on the horizon.

Here's the 19min video presentation of Ed Boyden at TED.

Ed Boyden leads the Synthetic Neurobiology Group, which invents technologies to reveal how cognition and emotion arise from brain networks at the MIT Media Labs.

But is that about all? In my honest opinion, this is something that can be used to program human and be controlled, totally. NWO?

I use to say that the human mind has no firewall, is this the start of putting a firewall in the human mind?

What's your take?

BitDefender is Best AV (Q1.2011), Launches BitDefender Scan

2011-05-06T23:03:00.001+08:00

The BitDefender Internet Security 2011 garnered the highest Top Protection Score against other leading AV in the market. (Cross post)

BitDefender®, an award-winning provider of innovative internet security solutions, has performed best overall in the Q1/2011 testing from leading security testing organisation AV-Test.

The report looked at twenty-two security software suites in the categories of protection, repair and performance. BitDefender Internet Security 2011 was found to have the joint-best overall score, alongside another product that uses BitDefender technology. It was also the only product to receive the maximum score for protection.

The results further establish BitDefender’s position as a leader for internet security technology, and come soon after independent testing organisation AV Comparatives also gave the company a top rating for its performance.

Andreas Marx, AV-Test CEO, commented:

“BitDefender offered the best protection during our tests, which ran for the full first quarter of 2011. Besides this, it also reached very good scores for cleaning up already infected systems without slowing-down the system too much or producing a lot of false positives. That's a very impressive result."

Viorel Canja, Head of BitDefender Labs, said:

“Technical testing of security software by organisations like AV-Test is very important to us, so it is always great to see us perform so well.

“Crucially, not only has BitDefender technology performed very well in this test, we also had four of the top seven places in the latest AV Comparatives test, too. This really highlights how we are leading the field in providing internet security solutions.”

See the test result details here.

BitDefender also luanched the BitDefender Security Scan. A tool to provide information on the speed, stability and security of Windows machines.

Read more about the BitDefender Security Scan here.

To know more about BitDefender, you can send email to info(AT)isens.(DOT)asia or visit Touch Solutions Incorporated (www.touchgroup.net).

Osama Bin Laden: Still a Threat, even after his death

2011-05-03T00:20:00.000+08:00

The death of Osama Bin Laden is definitely a blockbuster news all over the Internet. Specially that the blow by blow (almost) account of the operation was witnessed by a blogger and twitted to the Internet community.

The popularity of the issue will definitely be capitalized by the cyber crooks, and I believe while I'm writing this blog, they are already compromising facebook and twitter users.

Osama Bin Laden when he was alive was a peace and physical security threat. Now that he is dead, he becomes a threat to information security.

So, be careful when clicking those links being sent to you about the Bin Laden thing. It maybe another trap!

We all knew Bin Laden to be the bad guy. In fairness to him (Osama), is he really the bad guy as what we have know him?

“Throughout the world ... its agents, client states and satellites are on the defensive — on the moral defensive, the intellectual defensive, and the political and economic defensive. Freedom movements arise and assert themselves. They're doing so on almost every continent populated by man — in the hills of Afghanistan, in Angola, in Kampuchea, in Central America ... [They are] freedom fighters.” - This is a cross post from this site.

The final take is yours. My primary concern here is to warn the Internet users on cyber crooks maximizing the death of Bin Laden.

Additional articles you can read:

To DOs After a Fresh Natty (Ubuntu 11.04) install or a Natty Upgrade

2011-04-29T20:14:00.003+08:00

sThe long wait is over! The latest version of Ubuntu operating system 11.04 a.k.a Natty Narwhal is finally released!

"The Ubuntu team is pleased to announce Ubuntu 11.04, code-named “Natty Narwhal”. 11.04 continues Ubuntu’s proud tradition of integrating the latest and greatest open source technologies into a high-quality,easy-to-use Linux distribution. This tutorial will explain How to upgrade from ubuntu 10.10 (Maverick) to ubuntu 11.04 (Natty)"

As I have mentioned in my earlier post, the new version of Ubuntu is using a new interface called the Unity. Great work and presents a lot of promise for a better user experience.

Here are some of the "must do" things after your upgrade or fresh install of Ubuntu 11.04.

Install Ubuntu Tweak to help you install common applications you will need.
- On the terminal, issue the following commands. (or you copy paste).
  - sudo add-apt-repository ppa:tualatrix/ppa
  - sudo apt-get update
  - sudo apt-get install ubuntu-tweak
Add the Medibuntu Repository so you will be able to install codecs and other applications with patent issues.
- On the terminal issue the following commands.
  - sudo wget --output-document=/etc/apt/sources.list.d/medibuntu.list http://www.medibuntu.org/sources.list.d/$(lsb_release -cs).list
  - sudo apt-get update
  - sudo apt-get --allow-unauthenticated install medibuntu-keyring
    - Note: If the Medibuntu keyring will not install, try:
      - sudo apt-get install medibuntu-keyring
  - sudo apt-get update
- This will make the applications from the Medibuntu Repository to appear in the Ubuntu Software Center.
  - sudo apt-get install app-install-data-medibuntu apport-hooks-medibuntu
Enable the partner repositories in the source.list file.
- sudo nano /etc/apt/sources.list
- Uncomment the following lines:
  - deb http://archive.canonical.com/ubuntu natty partner
  - deb-src http://archive.canonical.com/ubuntu natty partner
Install media application and codecs
- Install VLC
  - sudo apt-get install vlc
- Install codec needed to play your multimedia files
  - sudo apt-get install non-free-codecs libxine1-ffmpeg gxine mencoder libquicktime1 flac faac faad sox ffmpeg2theora libmpeg2-4 uudeview flac libmpeg3-1 mpeg3-utils mpegdemux liba52-dev mpeg2dec vorbis-tools id3v2 mpg321 mpg123 libflac++6 ffmpeg libmp4v2-0 totem-mozilla icedax tagtool easytag id3tool lame nautilus-script-audio-convert libmad0 libjpeg-progs
Install encrypted DVD support application.
Install flashplugin so you will be able to watch videos and websites using flash
- for 32 bit architecture
  - sudo apt-get install flashplugin-installer
- for 64 bit architecture (note: use at your own risk, this is a development release.
  - sudo add-apt-repository ppa:sevenmachines/flash
  - sudo apt-get update
  - sudo apt-get install flashplugin64-installer
Install Openshot Video Editor. So far the best video editor I have used in Linux
- You can use Ubuntu Tweak to install this or
  - sudo add-apt-repository ppa:jonoomph/openshot-edge
  - sudo apt-get update
  - sudo apt-get install openshot openshot-doc
Install Instant Messengers. Although empathy is good enough, you may want to use pidgin and skype
- sudo apt-get install pidgin
- sudo apt-get install skype (make sure the partner repositories are enabled)
Install the latest JRE (Java runtime environment). This is needed by some applications.
- sudo add-apt-repository ppa:ferramroberto/java
- sudo apt-get update
- sudo apt-get install sun-java6 sun-java6-plugin sun-java6-fonts
Install archive management applications:
- sudo apt-get install unace unrar zip unzip p7zip-full p7zip-rar sharutils rar uudeview mpack lha arj cabextract file-roller
Install Gimp and/or Pinta. These image editors allow you to create, edit images like the pro does.
- Gimp. You can install this using Ubuntu-tweak or by the following commands.
  - sudo -add-apt-repository ppa:matthaeus123/mrw-gimp-svn
  - sudo apt-get update
  - sudo apt-get install gimp gimp-data gimp-plugin-registry gimp-data-extras
- Pinta
  - sudo add-apt-repository ppa:nilarimogard/webupd8
  - sudo apt-get update
  - sudo apt-get install pinta
Install CompizConfig Settings Manager so you will be able to tweak Unity at your own taste
- sudo apt-get install compizconfig-settings-manager
Make LibreOffice use the Global Menu bar
- sudo apt-get install lo-menubar
If you want to have a weather indicator in your panel, Unity does not have it by default. To display weather indicator:
- sudo apt-get install indicator-weather
- after the installation, you can run it from dash by pressing the Super key and type weather. Double-lick the icon to run the appllication.
Unity2D - If your computer is quite old and the graphics will not be able to support the Unity, don't despair yet. You can still use the Unity by installing the Unity2D.
- sudo add-apt-repository ppa:unity-2d-team/unity-2d-daily
- sudo apt-get update
- sudo apt-get install unity-2d

If you cannot adjust using the Unity interface, you can always use the Gnome2 Interface. But I tell, don't dismiss the Unity without giving it a try. It's really nice. Or you can try installing the new Gnome3 Shell. But note that once you install the Gnome3 Shell, your Unity will not be working anymore. As of the moment, the two desktop environment can't just co-exist.

You can download the installer here for the 32bit architecture and here for the 64bit architecture.

Red Hat Fix for Critical Vulnerabilities

2011-04-29T15:28:00.000+08:00

Red Hat announced earlier a fix for security vulnerabilities on the following applications, rated as severe:

Firefox

CVE-2011-0065 CVE-2011-0066 CVE-2011-0067 CVE-2011-0069 CVE-2011-0070 CVE-2011-0071 CVE-2011-0072 CVE-2011-0073 CVE-2011-0074 CVE-2011-0075 CVE-2011-0077 CVE-2011-0078 CVE-2011-0080 CVE-2011-0081 CVE-2011-1202

Thunderbird

CVE-2011-0070 CVE-2011-0071 CVE-2011-0073 CVE-2011-0074 CVE-2011-0075 CVE-2011-0077 CVE-2011-0078 CVE-2011-0080 CVE-2011-0081

Seamonkey

CVE-2011-0072 CVE-2011-0073 CVE-2011-0074 CVE-2011-0075 CVE-2011-0077 CVE-2011-0078 CVE-2011-0080

Affected Red Hat products for Firefox vulnerabilities are:

RHEL Desktop Workstation (v. 5 client), Red Hat Desktop (v. 4), Red Hat Enterprise Linux (v. 5 server), Red Hat Enterprise Linux AS (v. 4), Red Hat Enterprise Linux AS (v. 4.8.z), Red Hat Enterprise Linux Desktop (v. 5 client), Red Hat Enterprise Linux Desktop (v. 6), Red Hat Enterprise Linux ES (v. 4), Red Hat Enterprise Linux ES (v. 4.8.z), Red Hat Enterprise Linux EUS (v. 5.6.z server), Red Hat Enterprise Linux HPC Node (v. 6), Red Hat Enterprise Linux Long Life (v. 5.6 server), Red Hat Enterprise Linux Server (v. 6) Red Hat Enterprise Linux WS (v. 4), Red Hat Enterprise Linux Workstation (v. 6)

Full details of can be found in the following links:

As mentioned, these vulnerabilities are rated severe and patches should be applied immediately.

Stay protected!

The new Yahoo! Mail Interface - its about time!

2011-04-25T18:07:00.008+08:00

After a long time that I have not been checking my Yahoo! Mail, earlier today, something pushed me today to check it. So I did!

There's no argument, Yahoo! Mail is one of the most popular if not really the most popular free web mail service in the Internet World. Sometime ago I stopped using my Yahoo! Mail since I got tired of its interface and some of its functionalities have not really improved overtime.

But today, here's what I got in my inbox when I opened my mail. An invitation to upgrade my email account to the newest version of Yahoo! Mail. I am under the impression that not all Yahoo! Mail users have been sent the invitation already. (Maybe no, maybe yes).

When I finally clicked the upgrade button, I was happy with what I saw. Its new interface is just right and fantastic for me.

The interface is cleaner than before and the theme colors from the selection are just right for the eyes.

Here's the link if you want to see what's inside the new Yahoo! Mail now and how it works.

Here are some of the screen shots.

The landing page after login.

The Inbox. (Crop out my mail info)

The Contact management screen.

The theme selection screen.

The mail option/settting screen.

The Update screen, for you FB and Twitter account/s

Overall, the new Yahoo! Mail is better than before. So go ahead and check your mail now.

And hopefully, this will bring life to Yahoo! again. :)

The Cloud Crisis and the Cloud Crisis!

2011-04-22T00:10:00.000+08:00

Few days back, former US Vice President Al Gore and the advocates of the climate change have renewed their call to doctors and military leaders to help save our earth from destruction.

"Doctors must take a leading role in highligthing the dangers of climate change, which will lead to conflict, desease and ill-health, and threatens global security, according to a stark warning from an unusual alliance of physiscians and military leaders." (Source here: http://goo.gl/2xO2m)

While they are trying to resolve the current "cloud crisis" in order to save the human race, some people are trying to promote another crisis in the cloud. This time the Internet (Cloud). Users in some parts of the world are facing serious threats to their Internet freedom. (Source here: http://goo.gl/ti40y - PDF)

Here's some highlights in the past (or a little over) two months:

Egypt, Internet in the entire country was shut down during the civil unrest against their former President Mubarak
Egypt, 10 April 2011, Mikael Sanad Nabil was sentenced to three years in prison for "insulting the military" in his blog postings
Bahrain, Zakariya Rashid Hassan who ran an oline forum for residents of his village died in military custody after being arrested and charged for "spreading false news". He was inlcuded amongst the 450 people arrested apparently for being a "political activist". (Elsewhere in the Internet, some news is saying that Zakariya was beaten to death.) Source here: http://goo.gl/B1ys7
UAE, three bloggers were arrested - Ahmed Mansoor, Fahad Salem and Nasser bin Ghaith. (Source here: http://goo.gl/q522p)
China, arrested and detained Ai Weiwei, an artist and an activist. (Source here: http://goo.gl/ZRjP1)
Libya, Internet was shutdown due to a wide spread protest against the 41 year-old rule of Gadhafi. (Source here: http://goo.gl/RQzH7)
Iran, China, Tunisia - Internet restrictions are very high, killing the purpose of the Internet already
Uganda, the government asked the ISPs to shutdown access to Facebook and Twitter. (Source here: http://goo.gl/569yf)

And just yesterday at Facebook Town Hall event, US President Obama said this:

"I want people to feel the same about the next Internet breakthrough as they did about the moonwalk."

Honestly, I love the statement, but sadly my question is:

"How can the users of the Internet would feel that same excitement if they are being oppressed?"

Let us not forget that Internet is for everyone.

It may be used in both good and bad intentions but that should not stop everyone from using the Internet technology.

We should keep the Internet innovating for the benefit of the people using it. And we should protect and keep the type of freedom we experience in using the Internet.

"Internet for EVERYONE." (www.isoc.org)

What's your take?

Change.Org is under attack! Why should we be denied access?

2011-04-20T12:31:00.002+08:00

Image via Wikipedia
Change.org is a s platform that allows anyone from anywhere to launch an online petition or social campaign. The site has been blocked in China for some years already.

The website is s experiencing a heavy denial of service attack from apparently hackers from China since Monday this week.

Although the reason of the hackers are not clear yet, it seems that this petition is the aim of the service disruption. A petition calling for the release of Ai Weiwei.

On April 3, internationally acclaimed Chinese artist Ai Weiwei was detained at the Beijing airport while en route to Hong Kong, and his papers and computers were seized from his studio compound. Now the Guggenheim Foundation is leading the call for his release

Ai has been in custody in Beijing since early this month. The petition for the release of Ai have already registered about 90,000 users from 175 countries.

Ai Weiwei is both an artist and an activist. One of his most recent artwork is the artistic design of the Beijing National Olympics Stadium, where he collaborated with Sweden architects and one of his activist work that probably caught the ire of the Chinese government was his expose of the corruption scandal in the rebuilding of the Sichuan schools which were destroyed by the 2008 Sichuan earthquake.

Ai is an Internet user and uses this to communicate with people from China.

I just would like to remind people that "Internet is for EVERYONE" (www.isoc.org). Internet is a place for us to express our freedom.

Do we really need to be denied access to a certain site just for the political interest of somebody else?

Stay protected people when you connect to the wired world!

Trying the Ubuntu 11.04 (a.k.a Natty Narwhal) Beta 1

2011-04-10T18:14:00.000+08:00

The Beta version 1 of Ubuntu 11.04 a.k.a. Natty Narwhal was released early this month. This is the first of the 2 beta series before the final release of Natty is made on April 28, 2011.

The release of Beta 2 will be on April 14, 2011.

There's a lot of new things to expect in Natty. Here are some of the few new things worth noting:

Ubuntu 11.04 is not sporting a new desktop shell called unity. (The twitter icon is not included in the default installation, btw. I just added gwibber)

Ubuntu 11.04 have reinvent the scroll bar
Ubuntu 11.04 now features the global menu bar (MacOS type)

Ubuntu 11.04 Ubuntu Software Center has now rating and reviews.
Ubuntu 11.04 now includes a new safe upgrade option (from 10.10 to 11.04) during the installation

Ubuntu 11.04 now supports multiarch library support.

This means that it will allow users to install 32 bit applications even if the are using a 64-bit version of Ubuntu 11.04. More details can be found here.

Ubuntu 11.04 now comes with Kernel 2.6.38.x.

Shotwell 0.9
Firefox 4.0 RC2
Libreoffice 3.3.2
Xserver 1.10
Banshee 1.9.5 (now the default player)
Nautilus 2.32.2 (file manager)
Evolution 2.32.2 and
Gnome 2.32.1.

Ubuntu 11.04 Unity launcher is now dock on the left side.

The launcher auto-hides to give more screen space to the application.
To get the launcher back, just click on the upper left hand of the screen.

Ubuntu 11.04 now sports lenses.

This is where you get the application you need that is not present on the launcher.

The Ubuntu 11.04 really comes with a long list of new features, but the one that really stand out is the unity. Unity has so much to give, but there are still tons of tweaking and bug fixing that is needed.

I've come across an article saying that Ubuntu 11.04 is by far the worst edition that Canonical have released. I don't subscribe to the idea. It is a matter of being unique.

If you want to give this Ubuntu 11.04 spin, you can download it here. And since this is still in beta, don't expect full stability in the system (although I have it installed already in my production machine and using it!)

Some notes before trying this out.

If your video graphic device is ATI, it may not be worth your time to try this at the moment since the unity support for ATI graphics is not stable yet.
If you are using Intel graphics, make sure that you blacklist the radeon module from loading, otherwise you will experience intermittent problem during boot-up and while using your machine.

So there you go!

Linux turns 20! - And still getting better each year!

2011-04-10T15:00:00.000+08:00

You may have been using Linux for quite sometime already, but do not have a good idea on how it started.

Or you may have been hearing alot about Linux and wonder what really is this operating system.

Twenty years ago this summer (1991), the guy named Linus Torvalds braved to share his operating system to the computing world. He then opted to licensed it under the General Public License (GPL) on 1992.

Since then, the computing world has never been the same. The following are the major milestone in the 20 years success of Linux.

On 1993, Slackware became the most widely used distribution
On 1996, Penguin becomes the official mascot of Linux
On 1998, the giants like IBM begin announcing their platform support for Linux
On 1999, Red Hat goes public. The first commercial Linux distribution
On 2003, IBM runs the most famous Linux ads during the super bowl
On 2005, Linux was hailed as a business success
On 2007, Linux Foundation was formed to promote, protect and standardize Linux
On 2010, Android, a Linux base Mobile OS ships out
And 2011, Linux turns 20 and powers the worlds super computers, stock exchange, mobile phones, ATMs, healthcare and more.

A good graphical view of this milestone can be found here.

Here's a good commemorative infographic and video entitled The story of Linux.

I salute all the people behind this incredible and powerful operating system. Well done!

So go ahead and try Linux now if you haven't experienced the beauty, power and speed of this operating system.

If your organization needs some assistance in implementing Linux, iSeNS Asia can help you. Send them an email at info(at)isens(dot)asia.

Opera launches Opera Mail - GREAT!

2011-04-10T13:59:00.003+08:00

Opera, one of the most popular cross-platform browser has just launched its Opera Mail.

I'm a happy user of the Opera browser for several years now. And their browser just keep on improving. Its fast and does the job you need of a browser.

So are they competing with Google Mail?

My answer is no. Opera is just expanding its service offerings to its users. And this is a good alternative for those who have been looking for a good email service for a change. Once you create your account, you will have an automatic @myopera.com extension.

I just tried making an account to see how its interface looks like. It's pretty neat! I'm happy with its interface and pleasing to the eyes.

The new Opera Mail service is still in beta and I'm sure that the Opera Mail Team will have more coming for its users.

Go ahead and give it a spin! And you will be surely delighted.

If you wish to download Opera browser, you can find it in the following links:

If you're using Ubuntu, you can install Opera browser from its PPA so you get the updates automatically. Fire up your terminal and issue the following commands:

Prepare the sources list:

sudo sh -c 'echo "deb http://deb.opera.com/opera stable non-free >> /etc/apt/sources.list.d/opera.list'

Get the key:

sudo sh -c 'wget -0 - http://deb.opera.com/archive.key | apt-key add -'

Update the Package list:

sudo apt-get update

Install the Opera browser:

sudo apt-get install opera

They also have the Opera Mini for your mobile phones and tablets.

10 Tips to Help You and Your Family During Earthquake

2011-04-01T13:43:00.002+08:00

Okay. This is not a techie post at all, but I feel the importance to post something like this in order to spread awareness to the readers on what to do in case of an earthquake. Remember, as always, awareness is the key.

We have been experiencing more tremors lately than in past, specially after the Japan incident. The most recent major earthquake in Japan is the strongest quake recorded in their history.

The following tips will definitely help you and your family in case of an earthquake. So please spread the word. Share the link to your family and friends.

1. Have an emergency kit.

Flashlights
Portable radio
Batteries
Water supply that will last at least for 2 weeks
First-aid kit

2. Prepare your home.

Inspect heavy objects that may fall on you during earthquake like cabinets, book shelves, etc.
Check if your house sits on a fault line.
Know the strongest portion of your house

3. Know your surroundings.

Set a meeting place for your family in case you get disperse during the quake
Know the closest emergency stations in your place
Know the quickest path to get out of your place to move to a safer place

4. Subscribe to alert services.

Check if your local government provides emergency alert services and subscribe to it
Subscribe to SMS emergency alert services if your provider is offering one
Subscribe to email emergency alert services within your community

5. Plan for your pet.

Your pet can detect in-coming disaster better than you are
Bring extra water for your pet too
And your pet doesn't leave you no matter what

6. If you are inside a house or building during an earthquake.

Drop and take cover underneath a strong piece of furniture
Expert says do not run to the doorway unless you live in an old house
Stay away from areas where heavy object will fall

7. If you are outside during an earthquake.

Stay in the open
Stay away from the buildings as much as possible
Stay away from power lines

8. If your driving during an earthquake.

Stop safely and turn your hazard lights on
Stay away from buildings, trees or from any heavy objects that may fall on your vehicle
Stay away from flyovers, bridges, overpasses, underpasses

9. After earthquake, beware of gas leaks.

Do not use matches, lighters or any ignition sources if you are not sure if a possible gas leak is present
Double check gas pipes and gas tanks to make sure that there is no gas leak

10. After the earthquake, expect aftershocks.

Make sure you are still on alert after a major earthquake
Aftershocks will definitely follow and sometimes more destructive

You can get more details of these tips here.

You can also refer to the list below for more information in what "TO DO" in case of earthquake.

What to do in case of an earthquake (PDF)
Earthquake safety tips
Protect Yourself During an Earthquake... Drop, Cover and Hold on!
How to prepare and what to do in case of earthquake
Worst case scenario: Earthquake Survival (Video)

Stay Safe Always!

The Internet 10 years from now

2011-03-28T20:20:00.000+08:00

I'm sure by now most people who are using the Internet and have made Internet part of their daily life would not be able to imagine life with out the Internet.

Internet technology empowers people to do what they want to do. To speak what they want to speak. It made people even more creative and made them learn new things that they never imagined they can learn before . Internet technology made the distance between individuals closer.

The Internet Society (ISOC), which is a nonprofit organization founded in 1992 to provide leadership in the Internet related standards, education and policy has developed four future Internet scenarios that reveal plausible courses of events that could impact the health of the internet in the future.

Here are the four scenarios during the ISOC Internet exercise.

1. The Common Pool Scenario

2. The Boutique Network Scenario

3. The Moats and Drawbridges Scenario

4. The Porous Garden Scenario

So what do you think is the biggest threat facing the Internet? Get more details here and share your thoughts by filling out the poll.

Understanding Information Security (Part 1)

2011-03-28T14:14:00.001+08:00

I have been in the IT industry for quite sometime and one of the areas that I'm really challenged is information security.

The phrase "Information Security", for most individuals and/or organization, is something like an alien phrase. During the several Information Security seminars and fora that I have conducted, I can see question mark(?) in their faces whenever I mentioned the term information security.

Most of them will tell me, "we have an anti-virus here, so our computers are safe", or some will say "we have purchased one of the most expensive firewalls in the market so we are safe". And they will ask me, are these things not enough?

Information security is one of the most important aspect of an IT infrastructure. At the same time it is the least understood by most organizations and individuals participating in the inter-connected world. It is most of the time being ignored/neglected and in the bottom of the priority lists. Most individuals believe that if they have their AV installed and an updated virus definition file in their computers, and they have an Internet gateway security up and running, nothing bad will happen in the network. No information will leak out. No attacks can penetrate.

Well, maybe in the beginning of the Internet days, those contentions/belief are true. In fact, network security (not even information security) are left to the network security professionals and experts. Users doesn't care. But this is no longer true today.

The heavy development of services running over the Internet, the Web 2.0, the proliferation of Social Networking sites and many more have made information security a more complex task than what it was before.

Security can only be achieved through constant change, through discarding old ideas that have outlived their usefulness and adapting others to current facts. - William O. Douglas

Information security is the process or the ability to protect information. The three (3) basic security concepts important to information in the Internet are confidentiality, integrity, and availability.

And the three (3) information security concepts relating to people who uses the information are authentication, authorization and non-repudiation.

I will continue to discuss information security on my next article. For now, what is important is for everyone to realize and know that information security is a human enterprise, and you as a user of the inter-connected world is the last line of defense to secure either your own personal information or your organizations' information.

Think INFORMATION. Think SECURITY.

Hacking is an ACT of WAR: The Pentagon

Eyes on the Big Boys now! PBS News Site Hacked!

STOP! - LOOK! - OBSERVE! Bad People Around

Online Safety in the office: YES, But how about the CHILDREN at HOME?

1. Understand Internet Safety Before You Explain It

2. Teach, Don’t Rule

3. Consider Age-Appropriate Social Networks

4. Monitor With Care

Social Engineering gains ever more credibility.

Information Security is a Human Enterprise

Employees partnering in security can give us granular security knowledge that InfoSec cannot otherwise have.

Will this control HUMAN in the (very near) future?

BitDefender is Best AV (Q1.2011), Launches BitDefender Scan

Related articles

Osama Bin Laden: Still a Threat, even after his death

Related articles

To DOs After a Fresh Natty (Ubuntu 11.04) install or a Natty Upgrade

Red Hat Fix for Critical Vulnerabilities

The new Yahoo! Mail Interface - its about time!

The Cloud Crisis and the Cloud Crisis!

Change.Org is under attack! Why should we be denied access?

Related articles

Trying the Ubuntu 11.04 (a.k.a Natty Narwhal) Beta 1

Linux turns 20! - And still getting better each year!

Opera launches Opera Mail - GREAT!

10 Tips to Help You and Your Family During Earthquake

The Internet 10 years from now

Understanding Information Security (Part 1)