Blog: Father of SSL Says Despite Attacks, the Security Linchpin Has Lots of Life Left

Father of SSL Says Despite Attacks, the Security Linchpin Has Lots of Life Left
Network World (10/11/11) Tim Greene

Despite high-profile exploits, secure sockets layer/transport layer security (SSL/TLS), the protocol that safeguards e-commerce security, can remain viable through proper upgrades as it becomes necessary, says SSL co-creator Taher Elgamal in an interview. He says the problem is not rooted in SSL/TLS itself, but rather in the surrounding trust framework and the problems it causes when it comes time to patch the protocol to correct vulnerabilities. "If there is a way that we can separate who we trust from the vendor of the browsers, then that would be the best thing to do," Elgamal notes. "And the root of the trust should be the Internet with its built-in reputation ecosystem." Elgamal says that in such a scenario, if people were to notice that a specific certificate authority is issuing bad certificates, then the reputation would jettison it immediately with no need to issue patches. What is needed is the construction of an automatic update mechanism, and Elgamal believes the technology to facilitate self-updating exists. "I hope people look for these things because honestly, every protocol will have roles for self-updating things," he notes. "Nothing will remain secure forever."

View Full Article

Blog: Novel High-Performance Hybrid System for Semantic Factoring of Graph Databases

Novel High-Performance Hybrid System for Semantic Factoring of Graph Databases
Pacific Northwest National Laboratory (09/21/11) Kathryn Lang; Christine Novak

Researchers at the Pacific Northwest National Laboratory, Sandia National Laboratories, and Cray have developed an application that can analyze gigabyte-sized data sets. The application uses semantic factoring to organize data, revealing hidden connections and threads. The researchers used the application to analyze the massive datasets for the Billion Triple Challenge, an international competition aimed at demonstrating capability and innovation for dealing with very large semantic graph databases. The researchers utilized the Cray XMT architecture, which allowed all 624 gigabytes of input data to be held in RAM. The researchers are now developing a prototype that can be adapted to a variety of application domains and datasets, including working with the bio2rdf.org and future billion-triple-challenge datasets in prototype testing and evaluation.

View Full Article

Blog: Web Search Is Ready for a Shakeup, Says UW Computer Scientist

Web Search Is Ready for a Shakeup, Says UW Computer Scientist
UW News (08/03/11) Hannah Hickey

University of Washington (UW) professor Oren Etzioni recently called on the international academic community and engineers to be more ambitious in designing how users find information online. The main obstacle to progress "seems to be a curious lack of ambition and imagination," Etzioni writes. "Despite all the talent and the data they have, I don't think they've been ambitious enough." When IBM's Watson supercomputer recently beat the best human players at Jeopardy, it showed how far the technology has come in being able to answer complex questions. However, as the ability to perform intelligent searches increases, so does the demand. "People are going to be clamoring for more intelligent search and a more streamlined process of asking questions and getting answers," Etzioni says. Instead of looking for strings of text, a Web search engine should identify basic entities, such as people, places and things, and discover the relationships between them, which is the goal of UW's Turing Center. The center has developed ReVerb, an open source tool that uses Web information to determine the relationship between two entities.

View Full Article

Blog: Internet's Memory Effects Quantified in Computer Study

Internet's Memory Effects Quantified in Computer Study
BBC News (07/16/11) Jason Palmer

Recent experiments have shown that computers and the Internet are changing the nature of human memory, as people presented with difficult questions began to think of computers. If the participants knew that the facts would be available on a computer later, they had poor recall of the answers but enhanced recall of where they were stored, according to the study, which described the Internet as serving as a transactive memory. Transactive memory "is an idea that there are external memory sources--really storage places that exist in other people," says Columbia University's Betsy Sparrow. The researchers used a modified Stroop test to study how people thought about difficult questions and whether they relied on computers for the answers. The researchers provided a stream of facts to participants, and half were told to file them away on a computer, and the other half were told the facts would be erased. Those who knew the information would not be available later performed significantly better than those who filed the information away. However, those who expected the information to be available were very good at remembering in which folder they had stored it.

View Full Article

Blog: Machines to Compare Notes Online?

Machines to Compare Notes Online?
AlphaGalileo (07/15/11)

Autonomous machines, networks, and robots should publish their own suggestions for upgrading the technology on the Internet, says the University of Southampton's Sandor Veres. Giving machines and systems a greater degree of self-control will be the best way to improve them in the future, but humans will be more likely to guide and trust them if their dialogue is transparent, Veres says. An autonomously operating technical system would have some modeling of a changing environment; learning of various skills in feedback interaction with the environment; symbolic recognition of events and actions to perform logic-based computation; the ability to explain reasons of own actions to humans; and efficient transfer of rules, goals, values, and skills from human users to the autonomous system. Veres says the natural language programming sEnglish system could be used to achieve the last three technical features. "The adoption of a 'publications for machines' approach can bring great practical benefits by making the business of building autonomous systems viable in some critical areas where a high degree of intelligence is needed and safety is paramount," Veres says.

View Full Article

Blog: The Cyberweapon That Could Take Down the Internet

The Cyberweapon That Could Take Down the Internet
New Scientist (02/11/11) Jacob Aron

University of Minnesota researchers have developed a cyberweapon that turns the structure of the Internet against itself, but ultimately could be used to make the Internet more secure. Minnesota's Max Schuchard and colleagues built on the ZMW attack, which disrupts the connection between two routers by interfering with the Border Gateway Protocol (BGP) to make it seem as if links are offline, spreading the disruption through the entire Internet. The method uses a large botnet to develop a map of the connections between computers, identify a common link, and launch a ZMW attack that can bring down the entire system. As the system routes traffic around the disrupted link, the attack would launch again, disrupting a different connection. Eventually, every router in the world would be receiving more updates than it could handle. "Once this attack got launched, it wouldn't be solved by technical means, but by network operators actually talking to each other," Schuchard says. However, the researchers predict that this type of attack would never be launched by malicious hackers because mapping the network is such a technically complex job, and the botnet needed would be so large that it is more likely to be rented out for a profit. Although simulations show that current BGP defenses cannot protect against this attack, a solution could be to send BGP updates via a different network.

View Full Article - May Require Free Registration

Blog: DARPA Seeks Security Expertise From a Nontraditional Source: the Hacker Community

DARPA Seeks Security Expertise From a Nontraditional Source: the Hacker Community
NextGov.com (02/04/11) Dawn Lim

The U.S. Defense Advanced Research Projects Agency (DARPA) recently launched the Cyber Fast Track program, which will reward security research done quickly and inexpensively, criteria designed to attract nontraditional developers such as hobbyists, startups, and hackers. "Since the early '80s there has been some contingent of cyber researchers and hobbyists operating in low-budget settings," says DARPA's Peiter Zatko. He says limited resources force these groups to be extremely creative. DARPA also wants to apply the Cyber Fast Track process to other areas of defense. Zatko says the agency is looking toward unconventional solutions to cybersecurity problems because the current strategy of layering costly defensive security applications onto large IT infrastructures isn't sustainable. DARPA found that defensive applications contained about 10 million lines of code, while 9,000 samples of malware used only 125 lines of code. Although it is counterintuitive, more lines of code makes a system more vulnerable to attacks. An IBM metric suggests that for every 1,000 lines of code, there could be as many as five bugs introduced to the system. "You're spending all this effort layering on all this extra security, and it turns out that's introducing more vulnerabilities," Zatko says.

View Full Article

Blog: Beating the Competition [a single new connection can dramatically enhance the size of a network ...]

Beating the Competition
Max Planck Gessellschaft (01/17/11) Birgit Krummheuer

Researchers from the Max Planck Institute for Dynamics and Self-Organization, the Bernstein Center for Computational Neuroscience Gottingen, and the University of Gottingen have mathematically described the influence of single additional links in a network. Using computer simulations, the researchers tracked the growth of networks link by link. Their study found that a single new connection can dramatically enhance the size of a network, whether the connection is an additional link in the Internet, a new acquaintance for a circle of friends, or a connection between two nerve cells in the brain. The researchers focused on the intermediate growth stage, when elements are beginning to sporadically connect into small groups, but before the entire system is linked. After a certain number of new links, there is a sudden growth spurt, as the size of the largest network in the system is enhanced dramatically. The researchers would like to determine which forms of competition in natural systems from biology and physics imply this rapid growth and study the consequences of growth spurts.

View Full Article

Blog: Professor Wendy Hall Speaks [on Web Science; why Semantic Web failed to emerge]

Professor Wendy Hall Speaks
Inquirer (UK) (10/01/10) Wendy M. Grossman

Wendy Hall, dean of the University of Southampton's new Faculty of Physical and Applied Sciences, helped found the Web Science Research Initiative for the purpose of facilitating a formal understanding of the Web. "Partly what I'm passionate about in Web science ... [is] what makes the Web what it is, how it evolves and will evolve, what are the scenarios that could kill it or change it in ways that would be detrimental to its use," she says. Hall says the need for the initiative was demonstrated when she discussed with Web pioneer Tim Berners-Lee why the semantic Web has failed to emerge. Berners-Lee determined that the semantic Web concept was commandeered by the artificial intelligence community for the purpose of solving massive problems, when what was needed was for the data to be freed up so that people's use of it could be observed. "What creates the Web are us who put the content on it, and that's not natural or engineered," Hall says. Among the subjects she says can be explored through Web science is how to construct a better future Web by predicting what people would and would not do with it.

View Full Article

Blog: New Data Analysis System Could Do Double Duty

New Data Analysis System Could Do Double Duty
UT Dallas News (05/04/10) Moore, David

A new system for identifying potential Internet threats has been developed by researchers at the University of Texas (UT) at Dallas. Designed to analyze behavioral data, the system monitors network traffic and provides an alert when it notices worrisome deviations in normal activity. "We proposed a novel platform that thoroughly analyzes network traffic behavior to identify potential Internet threats," says UT Dallas professor Mehrdad Nourani. The technology uses two subsystems that work in parallel to reach a high speed and use memory efficiently, which allows for faster results and optimal use of resources. A bell-shaped curve of normal activity is built, and it can achieve nearly zero false positives and negatives when identifying abnormalities outside the curve. Nourani says the technology also could be used to analyze health data and detect abnormal health issues such as heart arrhythmia, sleep apnea, or epileptic seizure.

View Full Article

Blog: Scientists Work to Keep Hackers Out of Implanted Medical Devices

Scientists Work to Keep Hackers Out of Implanted Medical Devices
CNN (04/16/10) Sutter, John D.

Researchers are developing ways to prevent hackers from accessing and remotely controlling medical devices that emit wireless signals. For example, Oak Ridge National Laboratory's Nathanael Paul is designing a more secure insulin pump that cuts some of the wireless connections between parts of the system. Other researchers are looking for security solutions for pacemakers and cardiac defibrillators. Some researchers have suggested protecting the devices with passwords, but doctors and nurses would have to be able to control the devices in the case of an emergency. "If you have a patient that's unconscious on the ground, you really don't want the medical staff to have to figure out what security system they're using," said University of Washington's Tamara Denning at the recent CHI 2010 conference. The passwords could be tattooed in the form of a barcode on the patient's skin, either with visible ink or ink that can only be seen under ultraviolet light, Denning said. Security issues for medical devices will increase when these devices are connected to phones, the Internet, and other computers, notes University of Massachusetts at Amherst professor Kevin Fu.

View Full Article

Blog: First Test for Election Cryptography

First Test for Election Cryptography
Technology Review (11/02/09) Naone, Erica

An election in Tacoma Park, Md., held this November will be the first to use Scantegrity, a new vote-counting system that uses cryptography to ensure that votes are cast and recorded accurately. Scantegrity's inventors say the system could eliminate the need for recounts and provide better assurance that an election was conducted properly. Scantegrity allows voters to check online to ensure their votes were counted correctly, and officials and independent auditors can check to make sure ballots were tallied properly without seeing how an individual voted. Scantegrity developer David Chaum says the system uses a familiar paper ballot, which requires that voters fill in the bubble next to the name of their preferred candidate. The ballot is then fed into a machine that scans it and secretly records the result. The difference from other systems is that a special type of ink and pen are used, and when the voter fills in a bubble on the ballot a previously invisible secret code appears. The voter can record the code or codes and check them online later. If the code appears in the online database, the ballot was counted correctly. Every ballot has its own randomly assigned codes, which prevents the process from revealing which candidates a voter selected. Auditors can ensure all votes were counted correctly by comparing a list of codes corresponding to votes and a list of the results. University of Maryland, Baltimore County professor Alan Sherman says Scantegrity is fundamentally better than other systems in regards to integrity, and makes it possible to audit elections with much greater accuracy and certainty.

View Full Article

Blog: Testing the Accessibility of Web 2.0

Testing the Accessibility of Web 2.0
University of Southampton (ECS) (10/27/09) Lewis, Joyce

The University of Southampton's School of Electronics and Computer Science (ECS) is launching a study that will explore how well people with disabilities can access Web services such as blogs, wikis, and social networking sites. The study, led by Mike Wald and E.A. Draffan in ECS' Learning Societies Lab, is based on an accessibility toolkit that will enable users to test the accessibility of Web 2.0 services. The accessibility tools were developed as a result of the LexDis project, which identified strategies learners can use to enhance their e-learning experience. Part of the toolkit, Web2Access, provides an online checking system for any interactive Web-based service such as Facebook. Another key feature of the accessibility kit is Study Bar, which can work with all browsers and reads text out loud, spell checks, provides a dictionary, and can enlarge or change text fonts and colors to make text more readable. "We developed it because nowadays users contribute as well as read information and so you cannot just click on a button to see if Web sites are accessible and easy to use," Draffan says. Wald says it is the first time that there has been a systematic way to evaluate and provide the results of accessibility testing of Web services.

View Full Article

Blog: Code Breakthrough Delivers Safer Computing

Code Breakthrough Delivers Safer Computing
University of New South Wales (09/25/09) Trute, Peter

Computer researchers at the University of New South Wales and NICTA say they have proven that an operating-system kernel was 100 percent free of bugs. The team verified the kernel known as the seL4 microkernel by mathematically proving the correctness of about 7,500 lines of computer code in a project taking an average of six people more than five years. "What we've shown is that it's possible to make the lowest level, the most critical, and in a way the most dangerous part of the system, provably fault free," says NICTA researcher Gernot Heiser. The research could potentially improve the security and reliability of critical systems used by the medical and airline industries as well as the military. "The verification provides conclusive evidence that bug-free software is possible, and in the future, nothing less should be considered acceptable where critical assets are at stake," Heiser says.

View Full Article

Blog: Berners-Lee: Semantic Web Will Have Privacy Built-In

Berners-Lee: Semantic Web Will Have Privacy Built-In
ZDNet UK (03/12/09) Espiner, Tom

World Wide Web Consortium director Sir Tim Berners-Lee says the Semantic Web will improve online privacy protection by allowing Internet users to control who can access their data. Researchers have warned that the combination of personal information and a semantic Web could lead to privacy problems, including increased data mining. However, Berners-Lee says that teams working on the Semantic Web project are working to ensure that privacy principles are built into the Semantic Web's architecture. "The Semantic Web project is developing systems which will answer where data came from and where it's going to--the system will be architectured for a set of appropriate uses," he says. Berners-Lee also says the Semantic Web will be based on the principle that people who make a Web request for information held by third parties, such as a company or a government agency, will be able to see all the data those organizations will keep on them. The Semantic Web project will include accountable data-mining components, which enable people to know who is mining data on them, and it is exploring making the Web adhere to privacy preferences set by the users.

View Full Article

Blog: Web 3.0 Emerging

Web 3.0 Emerging
Computer (01/09) Vol. 42, No. 1, P. 88; Hendler, Jim

Web 3.0 is generally defined as Semantic Web technologies that run or are embedded within large-scale Web applications, writes Jim Hendler, assistant dean for information technology at Rensselaer Polytechnic Institute. He points out that 2008 was a good year for Web 3.0, based on the healthy level of investment in Web 3.0 projects, the focus on Web 3.0 at various conferences and events, and the migration of new technologies from academia to startups. Hendler says the past year has seen a clarification of emerging Web 3.0 applications. "Key enablers are a maturing infrastructure for integrating Web data resources and the increased use of and support for the languages developed in the World Wide Web Consortium (W3C) Semantic Web Activity," he observes. The application of Web 3.0 technologies, in combination with the Web frameworks that run the Web 2.0 applications, are becoming the benchmark of the Web 3.0 generation, Hendler says. The Resource Description Framework (RDF) serves as the foundation of Web 3.0 applications, which links data from multiple Web sites or databases. Following the data's rendering in RDF, the development of multisite mashups is affected by the use of uniform resource identifiers (URIs) for blending and mapping data from different resources. Relationships between data in different applications or in different parts of the same application can be deduced through the RDF Schema and the Web Ontology Language, facilitating the linkage of different datasets via direct assertions. Hendler writes that a key dissimilarity between Web 3.0 technologies and artificial intelligence knowledge representation applications resides in the Web naming scheme supplied by URIs combined with the inferencing in Web 3.0 applications, which supports the generation of large graphs that can prop up large-scale Web applications.

View Full Article - Link to Publication Homepage

Blog: Clickjacking: Scary new cross-browser exploit

Clickjacking: Scary new cross-browser exploit

September 25th, 2008 @ 7:50 am

Ryan Naraine: Researchers are raising an alarm for what looks like a scary new browser threat affecting all the major desktop platforms -- Internet Explorer, Firefox, Safari, Opera and Adobe Flash.

READ FULL STORY

Web: Is Semantic Web Technology Taking the Wrong Turn?

Is Semantic Web Technology Taking the Wrong Turn?
Internet Computing (02/08) Vol. 12, No. 1, P. 75; Bussler, Christoph
Author Christoph Bussler sees a disaster in the making for Semantic Web technology (SWT) unless a change of course is implemented. "SWT doesn't propose a different application architecture," he writes. "Instead, it proposes languages and technologies that are intended to make the application development process and integration efforts a lot simpler, faster, and more reliable, especially in the areas of data and process mediation to achieve uniform semantic interpretation." But Bussler notes that the impact of SWT requires a certain degree of integration with current core computing technologies. He points out that the deployment of SWT as a wrapping technology to facilitate semantic interfaces for layers causes the number of data models requiring additional mediation to sharply increase due to problems with heterogeneity. SWT would like to tackle the heterogeneity challenge, but researchers generally attempt to bypass it by making assumptions or establishing restrictions to produce homogeneous environments, Bussler says. He considers the research community and industry's decision to split up the SWT space along classical lines of distinction between layers and components in software architectures, and along classical academic research fields, to be one possible reason for the derailment of the original SWT vision. "One possible turn would be to start addressing the problem of data and process heterogeneity, not only among systems but also along the layers within them to reduce or eliminate the number of mediations necessary," Bussler writes.
Click Here to View Full Article

Web: ACM Groups Urge Actions to Broaden Web Accessibility

ACM Groups Urge Actions to Broaden Web Accessibility
AScribe Newswire (01/16/08)
Several ACM Special Interest Groups, along with ACM's U.S. Public Policy Committee, have developed a joint statement to encourage equitable and inclusive Internet access for everyone, including people with disabilities. The groups say that while the Internet has become more critical for a variety of commercial and leisure activities, a majority of private and commercial Web sites have access limitations. The ACM groups have committed themselves to being leaders in the quest for improved access to the Internet and the Web, with the goal of increasing Internet access as a means to attract broader participation of talented people in the global economy. The ACM groups' statement urges increasing awareness of the value of accessibility, new federal policies to increase Web accessibility, continued federal R&D funding for more accessible IT systems, and additional low-cost Web development tools from the IT community. USACM and members of ACM's Special Interest Groups on Accessible Computing (SIGACCESS), Computer-Human Interaction (SIGCHI), and Hypertext, Hypermedia and the Web (SIGWEB) signed the statement, along with the Computer Science Teachers Association, launched by ACM in 2005. "The technical community has the resources to make commercial Web sites accessible without undue regulatory and monetary burdens," says Harry Hochheiser, a member of the USACM Executive Committee and an assistant professor of computer and information sciences at Towson University.
Click Here to View Full Article