32-bit ISO of Ubuntu 11.04 Desktop

Ubuntu is a community developed, Linux-based operating system that is perfect for laptops, desktops and servers. It contains all the applications you need - a Web browser, presentation, document and spreadsheet software, instant messaging and other applications.


What's new in this version: Version 11.04 (Natty Narwhal) includes new launcher and dash and a clever workspace manager.

This download is an ISO file and requires a CD burner and blank CD to burn the disc image.

Download Now
685.29MB
Tested spyware free

LulzSec Hacking Group Activities Over the Weekend

LulzSec is certainly going to make a name for themselves at the rate they are going. The hacker group claims responsibility for the recent major attacks against Sony and PBS’s websites as we have written about, compromising well over an incredible number of user’s security information and exposing the poor security of both companies.

Despite having successfully orchestrated a major hack on Sony just a few days ago, they announced Friday that they had successfully infiltrated the Atlanta chapter of Infragard. For those not in the know, Infragard is an FBI affiliate. The hackers then uploaded Infragard’s user database to the internet, compromising security for the company and its affiliates. An associated company’s use of botnets was exposed as well, claims the group, and they are claiming that the documents they exposed also reveal an attempt by someone involved to pay LulzSec not to expose the breach.

LulzSec actually took complete control of Infragard’s Atlanta Chapter website, defacing it. One of their main reports was that while there were not many logins (around 180), all of them were affiliated with the FBI in one way or another.

Ironically, Infragard is a private-public partnership between the FBI and US businesses. Their business is “designed to protect IT systems from hacker attacks and other intrusions.” It would appear they are going to have to rethink their security protocols.

LulzSec really seems to be driving home the intense need for appropriate security measures to be taken by companies who are holding extremely valuable personal information for clients. One “weak link” can expose literally thousands of networks to a security breach, as was well demonstrated by their exposure of Karim Hijaz’s indiscretions when it came to his password. It must be understood that reusing passwords in several different places is frowned upon by both the FBI and Infragard handbooks and, indeed, by any person or organization concerned about security.

The attack on Infragard exposed Hijazi’s repeated use of his Infragard password in other places, including accounts of his personal business as well as his personal e-mail. Hacking one system gave them access to all of the major information Hijazi was privy to, compromising not only his own security, but that of the FBI, Infragard, his personal business, all of this clients as well as his personal activities. Particularly interesting to note is the fact that Hijazi’s personal business, “Unveillance” is a whitehat company that specializes in data breaches and botnets. LulzSec reported on their website that Karim was contacted personally by them and told all that they had done and that he purportedly offered them money in exchange for eliminating his competitors by illegal hacking means and for their silence. Supposedly they even discussed plans for him to give them insider information regarding his botnet information.

Hijazi issued a public statement shortly thereafter and is quoted here:

Over the last two weeks, my company, Unveillance, has been the target of a sophisticated group of hackers now identified as “LulzSec.” During this two week period, I was personally contacted by several members of this group who made threats against me and my company to try to obtain money as well as to force me into revealing sensitive data about my botnet intelligence that would have put many other businesses, government agencies and individuals at risk of massive Distributed Denial of Service (DDoS) attacks.

In spite of these threats, I refused to pay off LulzSec or to supply them with access to this sensitive botnet information. Had we agreed to provide this data to them, LulzSec would have been able to grow the size and scope of their DDoS attack and fraud capabilities.

While this author cannot vouch one way or the other for the truth of Hijazi’s or LulzSec’ claims, she can provide the last response LulzSec regarding Hijazi’s claims:

Karim compromised his entire company and the personal lives of his colleagues, then attempted to silence us with promises of financial gain and mutual benefits … [he] used the same password for all of his online accounts and all accounts linked to a company he owns. Then he tried to bargain with hackers so his company wouldn’t crumble.

Regardless of whose claims are the complete truth, one thing is for certain: LulzSec is not playing around. Companies holding vitally sensitive information
would do well to make sure their security protocols are truly secure, for their own sakes as well as the sakes of the clients who trust them.

As a side note, as this article was being written, it has come out that Lulzsec has hacked Nintendo as well, though Nintendo claims that no user information has been compromised. We will update this article as more information becomes available.

Acer Iconia Tab W500 Windows 7 Tablet Review

Despite the popularity of Apple’s iPad and the booming market for Android tablets, there are still plenty of Windows 7 tablets out there.  The latest is Acer’s W500 hybrid tablet, a 10.1 inch tablet based on a 1GHz AMD C-50 processor, 2GB of DDR3 ram and a 32Gb SSD.  It also comes (optionally) with a keyboard dock that allows you to turn it into a netbook.

Both iOS and Android are polished tablet operating systems, though there is still demand for Windows on tablets.  This might be because people want the power of Windows, they want to use their existing Windows software or perhaps because they’re getting ready to move to the next version of Windows next year.

An Introduction to IPv6

Right now, most of the world is using IPv4
(Internet Protocol version 4). The problem is that it does not allow for enough addresses. The world is just too big of a place. Enter IPv6. It provides vastly more addresses (2^128) and is the future of the web. Most users will not notice a difference, but networking personnel will (you can test your IPv6 connectivity here)

An IPv6 address has a few differences from IPv4. The first is that it is in hexadecimal instead of decimal. The second is that it is split up into larger segments and more of them. The third is that it uses colons (:) rather than periods (.) to divide these segments. In the end, one does not resemble the other. This is good because it prevents confusing the two.

Hexadecimal is better than decimal for a few reasons. For one, it takes up less space. The number “255″ is “FF” in hex; that is %50 smaller. Hexadecimal also relates more closely to binary. The number “1111″ is “15″ in decimal but “F” in hex. So “11111111″ is “FF” in hex, which is a much cleaner conversion than “255″ is. The downside is that humans typically think in decimal, so working with hex takes some getting used to.

IPv6 has a much larger address size. It has eight sections to it. IPv4 had half of that. The sections themselves are larger too: each one has four digits. IPv4 could only have three, and that only went to 255 tops. It should be obvious why this new address can afford all the room we have come to need. Hopeful it will for a long time. Here is a sample address.

FF00:00FF:0000:0000:0000:02f3:0000:0001

At this point, you may begin to see the down side to IPv6: it is long and hard to remember. To make them more human readable, there are a few conventions to short address when you have a lot of zeros present. First of all, you can skip leading zeros, so “0001″ becomes “1″ and “02f3″ becomes “2f3″ (IPv4 did this too). Second, groups of all zeros can be abbreviated to “::” (a double colon) once; you put nothing there. That makes “:0000:0000:0000:” reduce to “::” but “:0000:” cannot as it would be ambiguous. You can apply the first rule, making it “:0:” now. Putting all these rules into place gives us the following address.

FF00:FF::2f3:0:1

This address is about as long as an IPv4 number. Notice how the “00FF” shrank to “FF” and the “FF00″ did not. That was done intentionally to show the difference between leading and trailing zeros.

There is one more thing you really need to know if you are working with IPv6. The loop-back address, which was 127.0.0.1 in IPv4, is ::1 now. It works exactly the same way. You will have to use the ping6 command in Windows or Linux, so ping6 ::1 is what you would type into the command line. This will give many XP users an error as IPv6 may not be enabled on your computer. We have guides on how to enable IPv6 in XP, and how to assign IPv6 addresses in Linux.

Some other factoids about IPv6 are that it has is easier to route, more secure, and works better with mobile technology. There are changes to the way the packets of information are sent that makes it more efficient (e.g. better headers). It is more secure because it requires the use of IPSec, which is only optional in IPv4. IPv6 has an address recovery system, so when you change locations, it tries to keep the same address. These are are some of the that US government is switching over to it.

I should note that IPv6 has been found to have vulnerabilities. Malware tunneling is described in an article (note: a .pdf file) from the us-cert.gov site. It often has to do with how firewalls are configured. Different sources may give different opinions on how secure IPv6 is.

Wondering what happend to IPv5? It did exist. It was developed in the 1970′s to be used in audio and video streaming. It was called the Internet
Stream Protocol. It did not get far past the experimental stage and was never adopted. Ideas from it helped to form IPv6.

Google rolls out +1 Button Internet-wide

As expected, Google has begun the Internet-wide roll-out of its new +1 Button, a social sharing feature that rivals Facebook‘s “Like” button. The +1 Button is now available for all web publishers who wish to put the button on their website. And a number of news organizations, online retailers and other popular websites are already on board.

Like many other share buttons out there, +1 works with “a single click,” Google boasts, allowing people to tip off friends to cool articles, websites or products they like. Unlike other share features, however, +1 is fully integrated into Google search, so a “+1″ shows up next to a link in Google search results when that link has been shared by any of a user’s Google contacts. Not only that, but a particular search result receives a higher page ranking the more contacts share the link using +1.

“With a single click you can recommend that raincoat, news article or favorite sci-fi movie to friends, contacts and the rest of the world,” writes Google software engineer Evan Gilbert, who worked on +1, in a post on the Google blog. “The next time your connections search, they could see your +1′s directly in their search results, helping them find your recommendations when they’re most useful.”

For webmasters who wish to pop the +1 Button on their website, Google has created an easy-to-use web-tool that allows users to pick from a number of size and style options, so the +1 Button matches the right look for each site. Once a design is chosen, the publisher can then simply copy the automatically-generated JavaScript code and paste it into their site.

By making it easy to install +1 on a website, Google hopes to make the sharing feature as ubiquitous as Facebook’s “Like” button has become. Of course, it remains to be seen whether websites will take to +1. But since the service offers higher page ranking on Google as an incentive, we’re pretty sure many will at least give it a try.

MI6 Hacks Al-Qaeda Website, Attacks With Cupcake Recipes

British intelligence agency MI6 hacked an Al-Qaeda online magazine, replacing bomb-making instructions with a recipe for cupcakes, The Telegraph reports.

The joint action by MI6 and the UK’s Government Communications Headquarters had agents insert into the magazine an encrypted version of “The Best Cupcakes in America,” published by the Ellen DeGeneres talk show.

Originally, the magazine had instructions on how to make lethal pipe bombs, as well as articles by Osama bin Laden and his deputy Ayman al-Zawahiri.

According to The Telegraph, a similar Pentagon operation was blocked by the CIA, who claimed the magazine is more valuable as a source of intelligence. The attack was launched from Britain instead.

Al-Qaeda reissued the magazine (bomb-making instructions included) two weeks later and issued four more editions. According to one of The Telegraph‘s sources, British intelligence “was continuing to target online outlets publishing the magazine because it is viewed as such a powerful propaganda tool.”

As amusing as the story may sound, one has to question whether changing the magazine’s content in such an obvious way was the best course of action. It gave Al-Qaeda a clear warning its website had been hacked, probably making the organization a lot more cautious.

Image courtesy of Flickr, lamantin

Chinese Hackers Targeted U.S. Officials in Gmail Phishing Attack

Google has detected a targeted campaign to collect hundreds of personal Gmail passwords, many of them belonging to senior US government officials, Chinese political activists, military personnel, and journalists.

The accounts may have been compromised using spear phishing techniques in which victims received highly personalized messages that contained links to counterfeit Gmail pages, according to a blog post published in February that Google cited when disclosing the attacks on Wednesday. Google said the campaign “appears to originate from Jinan, China” but didn't share any evidence supporting that claim.

“The goal of this effort seems to have been to monitor the contents of these users' emails, with the perpetrators apparently using stolen passwords to change people's forwarding and delegation settings,” Google's blog post, titled “Ensuring your information is safe online,” stated. “Google detected and has disrupted this campaign to take users' passwords and monitor their emails. Company officials have alerted the victims and “relevant government authorities.”

According to the February blog post, some of the phishing pages were hosted using the free dyndns.org service and contained images and text that were almost indistinguishable from those hosted on the real Google service. The links were “customized and individualized for each target,” independent security researcher Mila Parkour wrote.

Once accounts were compromised attackers created rules to automatically forward all received email to accounts under their control, Parkour said. The attackers then used the purloined email to “gather information about the closets associates and family/friends” and exploited “the harvested information for making future mailings more plausible.”

Parkour's post showed a half-dozen emails exchanged in the campaign, several of which contained Pentagon and US State Department addresses.

“This is the latest version of the State's joint statement,” one fraudulent email read. “My understanding is that State put in placeholder econ language and am happy to have us fill in but in their rush to get a cleared version from the WH, they sent the attached to Mike.”

The email contained what appeared to be a Microsoft Word document as an attachment.

The incident harkens back to a separate attack Google disclosed in January 2010, that targeted the company's source code and the Gmail accounts of human rights activists in China. Unlike the most recent phishing campaign, the “highly sophisticated and targeted attack” from 2010 exploited vulnerabilities on Google's network to gain unauthorized access. Dozens of other companies were also targeted in the earlier attack.

Google's blog post provides a variety of tips for keeping accounts secure. They include use of a two-step verification procedure when logging in to accounts to add an extra layer of security to the login process. Gmail also warns users of suspicious logins to their accounts.

Gmail isn't the only free email service to be targeted recently. Last month, attackers exploited a vulnerability in Microsoft's competing Hotmail that allowed them to steal confidential correspondences and user contacts without warning. The in-the-wild attacks came to light only after they were disclosed by third-party researchers.

Microsoft has yet to say how many users were affected or whether it alerted authorities and compromised users of the attacks.