Orioles Highlight: David Lough hits walk-off HR off Red Sox closer Koji Uehara in 10th, Jimmy Paredes 4 H, 2 RBI (ESPN)

from ESPN http://ift.tt/1eW1vUH
via IFTTT

Book Release: Peter Pan by Barrie, J.M..

The character of Peter Pan first came to life in the stories J. M. Barrie told to five brothers -- three of whom were named Peter, John, and Michael. Peter Pan is considered one of the greatest children's stories of all time and continues to charm readers one hundred years after its first appearance as a play in 1904.

Source: Baltimore County Public Library - New Books
via IFTTT

City wins as Champions League places look set in England

MANCHESTER, England (AP) Manchester City's disappointing season looks like ending with the consolation prize of Champions League qualification after an unconvincing win Saturday over Aston Villa opened a nine-point gap to the fading chasers for the Premier League's top four.

from FOX Sports Digital http://ift.tt/1DKVXIm
via IFTTT

AC Milan's 4-game unbeaten run ends with 2-1 loss at Udinese

ROME (AP) AC Milan's four-match unbeaten run came to a halt with a 2-1 loss at Udinese on Saturday in Serie A.

from FOX Sports Digital http://ift.tt/1Opnev1
via IFTTT

PSG crushes Lille 6-1 to move 3 points ahead of Lyon

PARIS (AP) Winger Ezequiel Lavezzi grabbed a hat trick and striker Edinson Cavani scored twice as Paris Saint-Germain bounced back from its lackluster performance against Barcelona by thrashing Lille 6-1 to move three points ahead of Lyon at the top of the French league on Saturday.

from FOX Sports Digital http://ift.tt/1z4ZDsO
via IFTTT

Sunderland draws to drop into Premier League relegation zone

STOKE, England (AP) Sunderland failed to take advantage of scoring after 59 seconds by drawing 1-1 at Stoke to drop into the Premier League's relegation zone on Saturday.

from FOX Sports Digital http://ift.tt/1bEBqiN
via IFTTT

Newcastle loses 7th straight Premier League match

NEWCASTLE, England (AP) �? Swansea condemned Newcastle to an unwanted club record of seven straight Premier League defeats, beating the Magpies 3-2 at St James' Park on Saturday.

from FOX Sports Digital http://ift.tt/1b13L1n
via IFTTT

Watford back in Premier League after 8-year absence

WATFORD, England (AP) Watford sealed its return to the Premier League after an eight-year absence after winning on Saturday seeing its promotion rival lose in England's second tier.

from FOX Sports Digital http://ift.tt/1I9hWPe
via IFTTT

Messi scores in Barcelona's 2-0 win at Espanyol

BARCELONA, Spain (AP) Lionel Messi helped set up Neymar's opener before scoring a goal of his own to lead 10-man Barcelona to a 2-0 win at Espanyol on Saturday, provisionally increasing its lead of the Spanish league.

from FOX Sports Digital http://ift.tt/1JEOGhL
via IFTTT

Leicester beats Burnley in Premier League relegation scrap

BURNLEY, England (AP) Leicester scored just a minute after Burnley missed a penalty, securing a 1-0 win in a high-stakes game between teams fighting to avoid relegation from the Premier League.

from FOX Sports Digital http://ift.tt/1HDmA9g
via IFTTT

Hamburg grabs Bundesliga lifeline with 3-2 win over Augsburg

BERLIN (AP) Pierre-Michel Lasogga scored twice as Hamburger SV boosted its chances of avoiding Bundesliga relegation with a 3-2 win over Augsburg on Saturday.

from FOX Sports Digital http://ift.tt/1IW3XdY
via IFTTT

I have a new follower on Twitter

Sean Beeson
Sean Beeson is an award-winning composer, the owner of Sean Beeson Studios LLC located in rural North-Central Ohio.

http://t.co/mHMAHliUQg
Following: 147728 - Followers: 206059

April 25, 2015 at 11:48AM via Twitter http://ift.tt/1iMJxHI

Cameron makes football blunder in UK election speech

LONDON (AP) British Prime Minister David Cameron has made a blunder during his general election campaign when he forgot which football team he supported.

from FOX Sports Digital http://ift.tt/1DvDpN5
via IFTTT

Pelle scores brace as Southampton draws 2-2 with Tottenham

SOUTHAMPTON, England (AP) Tottenham head coach Mauricio Pochettino saw his side draw 2-2 against Southampton on Saturday in the Premier League on his first return to St. Mary's since leaving last summer.

from FOX Sports Digital http://ift.tt/1I8HXON
via IFTTT

Critical SSL Vulnerability Leaves 25,000 iOS Apps Vulnerable to Hackers

A critical vulnerability resides in AFNetworking could allow an attacker to cripple the HTTPS protection of 25,000 iOS apps available in Apple's App Store via man-in-the-middle (MITM) attacks. AFNetworking is a popular open-source code library that lets developers drop networking capabilities into their iOS and OS X products. But, it fails to check the domain name for which the SSL

from The Hacker News http://ift.tt/1QsBG47
via IFTTT

Urawa beats Nagoya 2-1 to widen lead in J-League standings

SAITAMA, Japan (AP) Takahiro Sekine and Yuki Muto scored goals as Urawa Reds defeated Nagoya Grampus 2-1 on Saturday to remain undefeated and widen its lead in the J-League standings.

from FOX Sports Digital http://ift.tt/1brbJBw
via IFTTT

Marseille in crisis after 4th straight league defeat

PARIS (AP) Marseille coach Marcelo Bielsa says he feels ''a lot of shame'' after four straight defeats plunged the club into freefall.

from FOX Sports Digital http://ift.tt/1KfK7LG
via IFTTT

Tor-Based Dark Web Email Service Targeted by Government Spies

The administrator of the popular Darknet email service, SIGAINT, is warning its users that the email service has become a target of a suspected law enforcement agency who tried to compromise it. About a week ago, SIGAINT has been targeted by an attacker who tried to hack the service by using nearly 70 bad Tor exit nodes, one of the service's administrator informed its users via the

from The Hacker News http://ift.tt/1bDhLjc
via IFTTT

Blue Tears and the Milky Way

Lapping at rocks along the shore of the Island of Nangan, Taiwan, planet Earth, waves are infused with a subtle blue light in this sea and night skyscape. Composed of a series of long exposures made on April 16 the image captures the faint glow from Noctiluca scintillans. Also known as sea sparkles or blue tears, the marine plankton's bioluminescence is stimulated by wave motion. City lights along the coast of mainland China shine beneath low clouds in the west but stars and the faint Milky Way still fill the night above. Over the horizon the galaxy's central bulge and dark rifts seem to echo the rocks and luminous waves. via NASA http://ift.tt/1ExrgNs

Orioles Video: P Darren O'Day yields 3-run HR to Brock Holt in 8th of 7-5 setback to Red Sox, team's 5th straight loss (ESPN)

from ESPN http://ift.tt/1eW1vUH
via IFTTT

Confidential submissions (aka Webform Anonymous)

The Webform Anonymous module seeks to allow webform content node authors obscure the submitter's identifying information for a particular ...

from Google Alert - anonymous http://ift.tt/1GhbFMZ
via IFTTT

Book Release: So You've Been Publicly Shamed by Ronson, Jon.

-- 'It's about the terror, isn't it?'   'The terror of what?' I said.   'The terror of being found out.' For the past three years, Jon Ronson has travelled the world meeting recipients of high-profile public shamings. The shamed are people like us - people who, say, made a joke on social media that came out badly, or made a mistake at work. Once their transgression is revealed, collective outrage circles with the force of a hurricane and the next thing they know they're being torn apart by an an

Source: Baltimore County Public Library - New Books
via IFTTT

Brazilian player Jobson banned 4 years in doping case

RIO DE JANEIRO (AP) Brazilian striker Jobson has been banned from football for four years for allegedly refusing to undergo a doping test while he played in Saudi Arabia.

from FOX Sports Digital http://ift.tt/1GqFNYE
via IFTTT

Marseille loses 5-3 at home to Lorient for 4th straight loss

PARIS (AP) Jordan Ayew scored twice against his former club as Lorient won 5-3 away to Marseille in a frantic match to condemn the home side to a fourth straight defeat on Friday.

from FOX Sports Digital http://ift.tt/1KdMezM
via IFTTT

Resurgent Mainz beats Schalke 2-0 at home in Bundesliga

BERLIN (AP) Mainz defender Stefan Bell scored twice to give his side a 2-0 win over Schalke in the Bundesliga on Friday.

from FOX Sports Digital http://ift.tt/1KdMezI
via IFTTT

Book Release: The dead key by Pulley, D. M., author.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Missing You by Coben, Harlan.

From It's a profile, like all the others on the online dating site. But as NYPD Detective Kat Donovan focuses on the accompanying picture, she feels her whole world explode, as emotions she’s ignored for decades come crashing down on her. Staring back at her is her ex-fiancé Jeff, the man who shattered her heart—and who she hasn’t seen in 18 years. Kat feels a spark, wondering if this might be the moment when past tragedies recede and a new world opens up to her.  But when she reaches out to th

Source: Baltimore County Public Library - New Books
via IFTTT

Orioles: Adam Jones batting .571 with 4 HR, 7 RBI at home this season; Fantasy Baseball alerts now available in ESPN app (ESPN)

from ESPN http://ift.tt/1eW1vUH
via IFTTT

Orioles: 2B Ryan Flaherty on 15-day DL with groin strain retroactive to April 23; Rey Navarro recalled from Triple-A (ESPN)

from ESPN http://ift.tt/1eW1vUH
via IFTTT

Hacking and Crashing Trains! Upcoming Cyber Holocaust

After reaching heights in cyber attacks by targeting SCADA systems, hackers are looking forward to crash trains. It isn't only assumptions; it could actually happen in real. A new hi-tech railway signalling system being tested in the United Kingdom could potentially be hacked by cyber criminals to cause oncoming trains to crash into one another at highest speeds, an Internet security

from The Hacker News http://ift.tt/1zVjUvG
via IFTTT

Book Release: Succubus Dreams by Mead, Richelle.

-- Outstanding Praise for Richelle Mead! "This is one of those series I'm going to keep following." --Jim Butcher, New York Times "My kind of book--great characters, dark worlds, and just the right touch of humor. A great read." --Patricia Briggs, New York Times Storm Born

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Fallen Embers by Forte, P.G..

There’s a thin line between blood and madness.Children of Night, Book 5Early Twelfth Century. When the half-civilized Conrad Quintano stumbles upon a stacked battle on an isolated beach, his first instinct is to walk away. What does he care if a bunch of worthless vampires kill each other? But a dying ember of chivalry compels him to rescue the pretty female vampire in distress—radically altering the course of his already cursed life.Present Day. Marc Fischer continues his desperate search for E

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Lovelink by Kimber, Tess Niland.

Satisfaction not guaranteed…To look at Vicky Lewis, no one would believe the willowy, red-haired owner of Lovelink matchmaking services hasn’t had a date in months. The truth is, a broken heart drove Vicky away from home to set up her business in the quaint, low-key village of Brookleigh. If it wasn’t for Janice—her secretary—and her giant yucca tree named “Frank”, she’d have no social interaction at all. But then Marcus Foster storms into her office, furious over a match gone wrong that devasta

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Ashes by Morgan, Sophie H..

Secrets can burn.The Divided Kingdom, Book 1Reared from birth to rule the Phoenix territory, Ana fled her future and her past when her parents were murdered. Now she secretly leads a rebellion to stop the human ruler, Edward, from experimenting on supernaturals.When she finds herself cornered by an assassin, she knows just what to do: Roast him and toast him. Then recognition sends blue-tipped flames licking through her veins. It’s Cade, the royal bodyguard who once rejected her youthful confess

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: 2015 / 2016 ASVAB For Dummies with Online Practice by Powers, Rod.

Ace the ASVAB with this comprehensive, easy-to-use guide2015/2016 ASVAB For Dummies and take your military test-taking skills to the next level.

Source: Baltimore County Public Library - New Books
via IFTTT

Anonymous Gift Creates Position at Emory Focused on Civil Rights

Emory University School of Law receives an anonymous donation to fund a professorship dedicated to promoting civil rights and social justice.

from Google Alert - anonymous http://ift.tt/1HA7TCr
via IFTTT

France midfielder Fekir pledges immediate future to Lyon

LYON, France (AP) Highly rated midfielder Nabil Fekir has pledged his immediate future to Lyon and wants to experience Champions League football with his club next season.

from FOX Sports Digital http://ift.tt/1d9qkCN
via IFTTT

Book Release: Garden inspirations by Moss, Charlotte.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Kidnapped by nuns: and other stories from a life on the radio by Fuss, Bob.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: DeWalt electrical professional reference: 2014 code by Rosenberg, Paul.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: African Americans from Baltimore County who served in the Civil War : Maryland's six regiments of slaves by Diggs, Louis S., 1932-

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Crochet by Horne, Lucy.

Source: Baltimore County Public Library - New Books
via IFTTT

ISS Daily Summary Report – 04/23/15

Pre-Determined Debris Avoidance Maneuver (PDAM): Last night at 8:00 PM CDT the Flight Control Team was notified of a high concern, late notice conjunction. A PDAM was performed today at 12:35 AM CDT using 58P thrusters. Burn duration was 2 minutes, 20 seconds with a Delta-V of 0.3 meters/second.  Ocular Health: Padalka and Kornienko, with Virts as their Crew Medical Officer (CMO), performed ocular and cardiac echo ultrasound measurements as part of the Ocular Health medical evaluation.  The ultrasound images will be used to identify changes in globe morphology, including flattening of the posterior globe, and document optic nerve sheath diameter, optic nerve sheath tortuosity, globe axial measurements, and choroidal engorgement.  Ocular Health protocol calls for a systematic gathering of physiological data to characterize the risk of microgravity-induced visual impairment/intracranial pressure in ISS crewmembers. Researchers believe that the measurement of visual, vascular and central nervous system changes over the course of this experiment and during the subsequent post-flight recovery will assist in the development of countermeasures, clinical monitoring strategies, and clinical practice guidelines. Rodent Research-2 Center for the Advancement of Science in Space (RR-2 CASIS): Kelly cleaned the Animal Access Unit following Tuesday’s sample collections.  Disposable items were removed and bagged and consumable items were replaced with spares. Cold Stowage Operations: Virts completed a nominal maintenance activity of desiccant swap on the Polar-2 cooler located in EXpedite PRocessing of Experiments to Space Station (EXPRESS) Rack 8.  He then stowed the Ice Bricks brought up by SpX-6 currently in the Double Cold Bags. Robotics Operations: In preparation for next week’s Robotics Refueling Mission (RRM) transfer operations, today Robotics ground controllers translated the Mobile Transporter (MT) from Work Site (WS)-4 to WS7. Dragon Cargo Operations: The USOS crew spent a large portion of their day transferring cargo from the Dragon vehicle. Cargo operations were reported to be approximately 25% complete at the end of yesterday’s crew day. Today’s Planned Activities All activities were completed unless otherwise noted. SLEEP Questionnaire MYCO – Morning Sample Collection MYCO – Sample MELFI Insertion USND2 – Hardware Activation OBSTANOVKA.  (start) Maintenance Activation of Spare Atmosphere Purification System Emergency Vacuum Valves [АВК СОА] JEM Remote Sensor Unit Battery R&R Ultrasound2 – Scanning Prep Ultrasound2 – Scanning Ops VIBROLAB. Hardware Modes Check. DRAGON Transfer Ops SEISMOPROGNOZ.(start). COSMOCARD. Closeout Ops Ultrasound2 – Data Export СТТС Configuration for MRM2 Connecting HDV Sony HRV-Z7E Camcorder on MRM2 EV1 window and Running NASA MPEG-2 Viewer Ultrasound2 – Scanning Ops CARDIOVECTOR. Experiment Ops. Pointing camera to High-Gain Antenna boom (ОНА ) for САУП ОНА Drive Test.  Comm reconfig for nominal ops СОЖ Maintenance Ultrasound2 –  Data Export VIBROLAB. Copy and Downlink Data Ultrasound 2 – Scanning Set up video equipment to record ARED exercise OH-CARDIAC – Preparation Rodent Research (RR) – Cleaning Animal Access Unit OBSTANOVKA. (end) HDV Sony HRF-ZTE camcoder power off Ocular Health – Cardiac Ops OCT Exam OH-CARDIAC – Ocular Health Operator Evaluation of Orthostatic Stability with LBNP (assistance) Orthostatic Stability Evaluation with LBNP.  OH-CARDIAC – Closeout Ops ARED Photo/TV Camcorder Setup Verification OH-CARDIAC – Data Export DRAGON  Transfer Ops ESA Weekly Crew Conference EML – Lens Replacement USND2 – Hardware Deactivation Kazbek Fit Check Completing activities with NASA MPEG-2 Viewer application,  Closeout ops TORU OBT. Removal of ЛКТ (ТА251МБ) No.1417726326 and ROM from ТКГ 424 (DC1) Camcorder Stowage DRAGON Transfer Ops POLAR1 – Desiccant Pack Swap PAO Hardware Setup Double Cold Bag (DCB) Stowage of Ice Bricks Crew Prep for PAO PAO Event DRAGON Transfer Ops IMS Delta File Prep SEISMOPROGNOZ. MATRYOSHKA-R. BUBBLE-dosimeter collection and measurements. DRAGON – Transfers Tagup DRAGON Transfers Conference SPLANH. Preparation for Experiment RELAKSATSIYA. Start Video Camera Battery Charge NMAP – Reading Reminder Completed Task List Items None Ground Activities All activities were completed unless otherwise noted. MT Translate from WS4 to WS7 [In work] Ocular Health operations RR access unit cleaning Three-Day Look Ahead: Friday, 04/24: NeuroMapping Neurocognitive Ops, USOS Crew off duty Saturday, 04/25: Crew off duty, housekeeping Sunday, 04/26: Crew off duty, Fine Motor Skills QUICK ISS Status – Environmental Control Group:                               Component Status Elektron Off Vozdukh Manual [СКВ] 1 – SM Air Conditioner System (“SKV1”) Off [СКВ] 2 – SM Air Conditioner System (“SKV2”) On Carbon Dioxide Removal Assembly (CDRA) Lab Operate Carbon Dioxide Removal Assembly (CDRA) Node 3 Operate Major Constituent Analyzer (MCA) Lab Shutdown Major Constituent Analyzer (MCA) Node 3 Operate Oxygen Generation Assembly (OGA) Standby Urine Processing Assembly (UPA) Standby Trace Contaminant Control System (TCCS) Lab Off Trace Contaminant Control System (TCCS) Node 3 Full Up  

from ISS On-Orbit Status Report http://ift.tt/1Okuvwm
via IFTTT

Book Release: Perfect pets.

Rhyming text introduces different kinds of pets, including dogs, goldfish, rabbits, parrots, and kittens. On board pages.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Shapes at home.

Shows simple shapes and explains where they can be found around the house.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Opposites.

Simple text and colorful photographs of familiar objects and animals introduce young readers to the concept of opposites.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Diary of a madman : the Geto Boys, life, death, and the roots of Southern rap by Scarface.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Adventures in Odyssey, vol. 1: strange journey back

Presents an anthology of four books from the Adventures in Odyssey series, which introduce Mark Prescott, Patti Eldridge, and the Imagination Station.

Source: Baltimore County Public Library - New Books
via IFTTT

I have a new follower on Twitter

Amazing Facts Here
Most amazing and shocking facts about us and our World.


Following: 5021 - Followers: 5989

April 24, 2015 at 07:49AM via Twitter http://ift.tt/WXF2on

I have a new follower on Twitter

Childhood Facts
If you want to remember those days, join our nostalgia trip..


Following: 3412 - Followers: 3502

April 24, 2015 at 07:33AM via Twitter http://ift.tt/1zVO9ST

Barcelona to meet Bayern, Juventus gets Madrid in semifinals

NYON, Switzerland (AP) Barcelona will play Bayern Munich in the Champions League semifinals, pairing coach Pep Guardiola's past and current teams.

from FOX Sports Digital http://ift.tt/1Emy26A
via IFTTT

Champions League Draw List

NYON, Switzerland (AP) Draw Friday for the semifinals of the Champions League:

from FOX Sports Digital http://ift.tt/1Ey8HZB
via IFTTT

Europa League semifinals: Sevilla-Fiorentina, Napoli-Dnipro

NYON, Switzerland (AP) Defending champion Sevilla has been drawn to play Fiorentina in the Europa League semifinals.

from FOX Sports Digital http://ift.tt/1Ey8HZx
via IFTTT

Europa League Draw List

NYON, Switzerland (AP) Draw Friday for the semifinals of the Europa League:

from FOX Sports Digital http://ift.tt/1DGBZhG
via IFTTT

Book Release: Hissing Cousins by Dwyer, Timothy

A lively and provocative double biography of first cousins Eleanor Roosevelt and Alice Roosevelt Longworth, two extraordinary women whose tangled lives provide a sweeping look at the twentieth century. When Theodore Roosevelt became president in 1901, his beautiful and flamboyant daughter was transformed into "Princess Alice," arguably the century's first global celebrity. Thirty-two years later, her first cousin Eleanor moved into the White House as First Lady. Born eight months and twenty bloc

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Vengeance of the Iron Dwarf by Salvatore, R. A.

Bloody war rages across the Forgotten Realms world in the third book of the Companions Codex, the latest series in R.A. Salvatore's New York Times best-selling saga of dark elf Drizzt Do'Urden. In the evolving world of the Forgotten Realms setting, the Sundering has given way to months of cloud-cloaked darkness, and war rages under that oppressive sky. The orcs have broken a hard-fought treaty that's held, however tentatively, for a hundred years, and the time to settle old scores has devolved i

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: None of the Above by Gregorio, I. W.

A groundbreaking story about a teenage girl who discovers she's intersex . . . and what happens when her secret is revealed to the entire school. Incredibly compelling and sensitively told, None of the Above is a thought-provoking novel that explores what it means to be a boy, a girl, or something in between. What if everything you knew about yourself changed in an instant? When Kristin Lattimer is voted homecoming queen, it seems like another piece of her ideal life has fallen into place. She's

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Spinster by Bolick, Kate

A bold, original, moving book that will inspire fanatical devotion and ignite debate. "Whom to marry, and when will it happen--these two questions define every woman's existence." So begins Spinster , a revelatory and slyly erudite look at the pleasures and possibilities of remaining single. Using her own experiences as a starting point, journalist and cultural critic Kate Bolick invites us into her carefully considered, passionately lived life, weaving together the past and present to examine w

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Missoula by Krakauer, Jon

From bestselling author Jon Krakauer, a stark, powerful, meticulously reported narrative about a series of sexual assaults at the University of Montana ­-- stories that illuminate the human drama behind the national plague of campus rape Missoula, Montana, is a typical college town, with a highly regarded state university, bucolic surroundings, a lively social scene, and an excellent football team -- the Grizzlies -- with a rabid fan base. The Department of Justice investigated 350 sexual assaul

Source: Baltimore County Public Library - New Books
via IFTTT

Anonymous Press on Twitter: "#OffTopic http://ift.tt/1z03wzr;

Anonymous Press retweeted AFP Photo Department. #OffTopic http://ift.tt/1Dm7nmt … Anonymous Press ...

from Google Alert - anonymous http://ift.tt/1Ge8uWf
via IFTTT

Newcastle Jets owner cited by FFA for tirade at journalist

SYDNEY (AP) The owner of the Newcastle Jets has been cited by Football Federation Australia for a code of conduct violation following a tirade against a journalist after an A-League match last weekend.

from FOX Sports Digital http://ift.tt/1Gphq0q
via IFTTT

[FD] [ALICLOUDSEC-VUL2015-001]Android wpa_supplicant WLAN Direct remote buffer overflow

1. Advisory Information Advisory URL: http://ift.tt/1GleH5o Date published: 2015-04-23 Date of last update: 2015-04-23 2. Vulnerability Information Class: heap overflow Impact: memory information leak and remote code execution Remote Exploitable: Yes Local Exploitable: No CVE Name: CVE-2015-1863 Vulnerability Information and Patch: http://ift.tt/1DBNVBw 3. Vulnerability Description In Android, wpa_supplicant is designed to be a "daemon" program that runs in the background and acts as the backend component controlling the wireless connection.. When WLAN Direct function of wpa_supplicant is enabled, a malformed p2p invitation type packet with long ssid can trigger a heap overflow vulnerability. An attacker could launch a remote attack in the wireless device signal coverage, access to the victim's android device and execute native code with the corresponding user privileges (in the android is wifi user). The user has permission to read the saved WIFI password, change network configuration, hijacking all Wi-Fi traffic. When combined with a local privilege escalation vulnerability that allows an attacker to remotely control a host of victims, implant Trojans and other underlying implant systems. 4. Vulnerable Packages Android 4/Android 5 wpa_supplicant 2.x 5. Credits Smart hardware research group of Alibaba security team for discovering the vulnerability. 6. Technical Description wpa_supplicant malloc a p2p_device structure, the oper_ssid field size of which is 0x20 bytes. In the p2p invitation packet the size of ssid field is described with an octet, the max of which is 0xff. When copy to oper_ssid field, the length is not checked. When the size of ssid exceeds 0x20 bytes, it can overflow other fields of the p2p_device structure and overflow heap structure when exceeds 0x40 bytes. In the android version 5.1, the source is: ============ p2p_device structure（ wpa_supplicant/p2p/p2p_i.h)============ struct p2p_device { [……….] int oper_freq; u8 oper_ssid[32];

Source: Gmail -> IFTTT-> Blogger

The alleged “flash crash” trader used anonymously owned companies

On Tuesday a former futures trader was arrested in a suburban semi-detached house in London. Navinder Singh Sarao has been accused by the U.S. ...

from Google Alert - anonymous http://ift.tt/1JAnXmi
via IFTTT

I have a new follower on Twitter

Nicole Wenkle
Humanitarian, Doctor, Angel Investor, Musical Enthusiast. Afraid of roller coasters and dry ice.


Following: 494 - Followers: 386

April 24, 2015 at 01:44AM via Twitter http://ift.tt/1aWXJ2y

Meteor in the Milky Way

Earth's April showers include the Lyrid Meteor Shower, observed for more than 2,000 years when the planet makes its annual passage through the dust stream of long-period Comet Thatcher. A grain of that comet's dust, moving 48 kilometers per second at an altitude of 100 kilometers or so, is swept up in this night sky view from the early hours of April 21. Flashing toward the southeastern horizon, the meteor's brilliant streak crosses the central region of the rising Milky Way. Its trail points back toward the shower's radiant in the constellation Lyra, high in the northern springtime sky and off the top of the frame. The yellowish hue of giant star Antares shines to the right of the Milky Way's bulge. Higher still is bright planet Saturn, near the right edge. Seen from Istra, Croatia, the Lyrid meteor's greenish glow reflects in the waters of the Adriatic Sea. via NASA http://ift.tt/1HoENaF

Anonymous donor endows scholarships at Thiel College in honor of two catering specialists

An anonymous donor and their employer, AVI Foodsystems, Inc., have donated the funds to create the $25,000 Patricia Murrin Endowed Scholarship ...

from Google Alert - anonymous http://ift.tt/1I2cm17
via IFTTT

Orioles Video: Manny Machado had 2 HR and 4 RBI in 7-6 loss to Blue Jays; BAL nearly rallied from 7-run deficit (ESPN)

from ESPN http://ift.tt/1eW1vUH
via IFTTT

Ocean City, MD's surf is at least 6.32ft high

Maryland-Delaware, April 29, 2015 at 10:00PM

Ocean City, MD Summary
At 4:00 AM, surf min of 1.31ft. At 10:00 AM, surf min of 2.41ft. At 4:00 PM, surf min of 4.12ft. At 10:00 PM, surf min of 6.32ft.

Surf maximum: 7.33ft (2.23m)
Surf minimum: 6.32ft (1.93m)
Tide height: 0.99ft (0.3m)
Wind direction: ESE
Wind speed: 9.02 KTS


from Surfline http://ift.tt/1kVmigH
via IFTTT

Non-Adaptative Policies for 20 Questions Target Localization. (arXiv:1504.05996v1 [cs.IT])

The problem of the target localization with noise is considered. The target is a sample from a continuous random variable with known distribution and the goal is to locate this target with minimum mean squared error. The localization scheme or policy proceeds by queries, or questions, weather or not the target belongs to some subset as it is addressed in the $20$-question framework. These subsets are not constrained to be intervals and the answers to the queries are noisy. While this situation is well studied for adaptive querying, we concentrate in this paper on non adaptive querying policies. We consider policies based on the dyadic questions. We calculate the asymptotic minimum achievable distortion under such policies. Furthermore, we exhibit a policy that achieve this bound.

from cs.AI updates on arXiv.org http://ift.tt/1EwM0op
via IFTTT

Security Games With Information Leakage: Modeling and Computation. (arXiv:1504.06058v1 [cs.GT])

Most models of Stackelberg security games assume that the attacker only knows the defender's mixed strategy, but is not able to observe (even partially) the instantiated pure strategy. Such partial observation of the deployed pure strategy -- an issue we refer to as {\it information leakage} -- is a significant concern in practical applications. While previous research on patrolling games has addressed the attacker's real-time surveillance, we provide a significant advance. More specifically, after formulating an LP to compute the defender's optimal strategy in the presence of leakage, we start with a hardness result showing that a subproblem (more precisely, the defender oracle) is NP-hard {\it even} for the simplest of security game models. We then approach the problem from three possible directions: efficient algorithms for restricted cases, approximation algorithms, and better sampling algorithms. Our experiments confirm the necessity of handling information leakage and the advantage of our algorithms.

from cs.AI updates on arXiv.org http://ift.tt/1FimMch
via IFTTT

x.ent: R Package for Entities and Relations Extraction based on Unsupervised Learning and Document Structure. (arXiv:1504.06078v1 [cs.CL])

Relation extraction with accurate precision is still a challenge when processing full text databases. We propose an approach based on cooccurrence analysis in each document for which we used document organization to improve accuracy of relation extraction. This approach is implemented in a R package called \emph{x.ent}. Another facet of extraction relies on use of extracted relation into a querying system for expert end-users. Two datasets had been used. One of them gets interest from specialists of epidemiology in plant health. For this dataset usage is dedicated to plant-disease exploration through agricultural information news. An open-data platform exploits exports from \emph{x.ent} and is publicly available.

from cs.AI updates on arXiv.org http://ift.tt/1EwM2g9
via IFTTT

From End-User's Requirements to Web Services Retrieval: A Semantic and Intention-Driven Approach. (arXiv:1504.06158v1 [cs.SE])

In this paper, we present SATIS, a framework to derive Web Service specifications from end-user's requirements in order to opera-tionalise business processes in the context of a specific application domain. The aim of SATIS is to provide to neuroscientists, which are not familiar with computer science, a complete solution to easily find a set of Web Services to implement an image processing pipeline. More precisely, our framework offers the capability to capture high-level end-user's requirements in an iterative and incremental way and to turn them into queries to retrieve Web Services description. The whole framework relies on reusable and combinable elements which can be shared out by a community of users sharing some interest or problems for a given topic. In our approach, we adopt Web semantic languages and models as a unified framework to deal with end-user's requirements and Web Service descriptions in order to take advantage of their reasoning and traceability capabilities.

from cs.AI updates on arXiv.org http://ift.tt/1EwM2g2
via IFTTT

Orioles: IF Ryan Flaherty (sore right groin) out of lineup Thursday vs. Blue Jays; Buck Showalter says DL stint possible (ESPN)

from ESPN http://ift.tt/1eW1vUH
via IFTTT

FIFA rejects lawmakers' call to re-run Qatar World Cup vote

ZURICH (AP) FIFA has rejected a call by European lawmakers to re-run the vote which chose Qatar as 2022 World Cup host.

from FOX Sports Digital http://ift.tt/1GbLAic
via IFTTT

Ravens: K Justin Tucker signs RFA tender worth reported $2.356M; 97-of-108 (89.8%) on field goals in 3-year career (ESPN)

from ESPN http://ift.tt/17lH5T2
via IFTTT

Maradona meets the pope again: 'I'm Francis' top fan'

VATICAN CITY (AP) Diego Maradona says he's Pope Francis' top fan.

from FOX Sports Digital http://ift.tt/1PpOiYl
via IFTTT

Earn up to $15,000 for Hacking Microsoft Spartan Browser

If you’re a bug hunter and love playing with codes than you could grab as much as US$15,000 from Microsoft for finding out vulnerabilities in its latest Project Spartan browser. Yes, $15,000! It seems like Redmond don’t want to take a chance to let hackers and cyber criminals get their hands on the company’s latest Windows 10 operating system. On Wednesday, Microsoft announced that

from The Hacker News http://ift.tt/1Gn63Gc
via IFTTT

Book Release: Gironimo! : riding the very terrible 1914 tour of italy by Moore, Tim, 1964-

Source: Baltimore County Public Library - New Books
via IFTTT

ISS Daily Summary Report – 04/22/15

Ocular Health: Padalka performed his Flight Day (FD) 30 fundoscopy, with assistance from Virts as his CMO and ground remote guiders. The fundoscope is utilized to image the fundus (interior surface of the eye including the retina, optic disc, macula, and fovea). Ocular Health protocol calls for a systematic gathering of physiological data to characterize the risk of microgravity-induced visual impairment/intracranial pressure in ISS crewmembers. Researchers believe that the measurement of visual, vascular and central nervous system changes over the course of this experiment and during the subsequent post-flight recovery will assist in the development of countermeasures, clinical monitoring strategies, and clinical practice guidelines. Rodent Research-2 Center for the Advancement of Science in Space (RR-2 CASIS): Kelly completed a fixative swap on the samples collected during yesterday’s RR-2 operations.  Following the swap, the samples in the new fixative were inserted into MELFI. Mycological Evaluation of Crew Exposure to ISS Ambient Air (MYCO) Familiarization: Kelly reviewed the procedure prior to his first MYCO collection scheduled for tomorrow. The MYCO experiment evaluates the risk of microorganisms’ via inhalation and adhesion to the skin to determine which fungi act as allergens on the ISS. Nanoparticles and Osteoporosis and Kubik Closeout: Cristoforetti removed the last 6 of the 8 Nanoparticles and Osteoporosis Experiment Containers (ECs) and stowed them in Minus Eighty Degree Celsius Laboratory Freezer for ISS (MELFI).  She comleted a data download, stowed the Kubik and packed Kubik-3 for return on SpX-6. Nanoparticles based countermeasures for Treatment of microgravity induced osteoporosis (Nanoparticles and Osteoporosis) studies how microgravity changes the metabolic environment of bone leading to site-specific alterations in bone remodeling. This study uses strontium containing hydroxyapatite nanoparticles (nHAP-Sr) as a countermeasure to prevent osteoporosis induced by microgravity during space flight. The in vitro biological effect of nHAP-Sr will be evaluated on differentiated human osteoblasts and osteoclasts and during their differentiation process, varying incubation time and dose-dependence in simulated microgravity and during space flight. Nematode Muscle: Cristoforetti retrieved the nematode samples from the Cell Biology Experiment Facility (CBEF) and performed sample fixation using the Chemical Fixation Apparatus. The samples were then inserted into MELFI.  The Alterations of C. elegans muscle fibers by microgravity (Nematode Muscles), aims to clarify how and why these changes take place in microgravity. Studying worms exposed to both microgravity, and gravity-like conditions in a centrifuge, could help scientists understand the molecular mechanisms responsible for muscle atrophy and other spaceflight-induced changes.   Advanced Resistance Exercise Device (ARED) Maintenance: Virts performed this regularly scheduled quarterly maintenance. He greased the Vibration Isolation System (VIS) rails, rollers and upper stop catch plates and inspected the X-rotation dashpots. The task was completed nominally and no problems were reported.  Robotics Operations:  Today the Robotics Ground Controllers powered up the Mobile Servicing System (MSS) and released the Dragon Flight Releasable Grapple Fixture (FRGF). They then walked SSRMS off Node 2 Power Data Grapple Fixture (PDGF) onto the Mobile Base System (MBS) PDGF 1. After completing the walk off, the Robotics Ground Controllers manoeuvred the SSRMS to the Mobile Transported (MT) translation position for tomorrow (GMT113) translation from Worksite #4 to Worksite #7 in preparation of the Robotic Refueling Mission (RRM) transfer ops next week. MSS performance today was nominal. Today’s Planned Activities All activities were completed unless otherwise noted. SLEEP – Complete Questionnaire Biochemical Urine Test URISYS Hardware Stow PHS Evaluation Setup NANO/CSE – Removal of Containers from KUBIK MRM2 comm config to support the P/L Ops KULONOVSKYI KRISTALL. Experiment Ops COSMOCARD. Preparation. Starting 24-hr ECG Recording. NATO/CYTO – Sample Insertion into MELFI EML – Hardware Activation Replacing РТ-50-1М No.9 (А209) device with the new unit No.П3001009. Periodic Health Status Periodic Health Status (PHS) Data Entry and Stowage of All Hardware Used in PHS URAGAN. Observations and Photography MRM2 Comm Reconfig for Nominal Ops KULONOVSKYI KRISTALL. Copy and Downlink Data via РСПИ Demating РТ-50-1М TLM Connectors from БКС BAR. Experiment Ops. Replacement of РТ-50-1М No.9 (А209). VIZIR. Experiment Ops. [Deferred] ABOUT GAGARIN FROM SPACE. HAM Radio Session RGN-REC TK – Transfer and Replacement KULONOVSKYI KRISTALL. Hardware Teardown BAR. Experiment Ops. Dragon Transfer Ops On MCC GO Mating РТ-50-1М TLM Connectors to БКС РТ-50-1М No.9 (А209) R&R – Closeout Ops. Preventive Maintenance of АСП Hatch Sealing Mechanisms (DC1) and Progress 424 Hatch. PAO Hardware Setup Crew Prep for PAO PAO Event Rodent Research (RR) – Water Box and Light Check BCAT – Camera Focus Setup ISS N2 Repress from Progress 424 (DC1) СрПК Section 2 (start) Rodent Research (RR) – Camcorder Setup CMS – ARED Quarterly Maintenance PPS – Closeout Ops ISS N2 Repress from ТКГ424 (DC1) СрПК Section 2 (terminate) [Aborted] Life On The Station Photo and Video Replacement of СД1-7 Lights in DC1 KUB3 – Hardware Packing BCAT –  D2Xs Battery Charge СОЖ Maintenance NEMATODE – Data Gathering Rodent Research (RR) – Sample Relocation to MELFI IMS Delta File Prep VZAIMODEISTVIYE-2. Experiment Ops [Deferred] JRNL – Journal Entry MSG – Powerdown MYCO – Session Review Health Maintenance System (HMS) – Fundoscope Preparation NEMATODE – Container Retrieval from MELFI Fundoscope – Eye Exam SLEEP – Hardware Setup and Activation NEMATODE – Sample Fixation Dragon Cargo Operations Conference NEMATODE – Sample Insertion into MELFI Health Maintenance System (HMS) – Fundoscope Removal and Stowage Completed Task List Items ARED detent adjust Ground Activities All activities were completed unless otherwise noted. 57P Prop Purge Rodent Research operations Ocular Health operations MSS powerup SSRMS walkoff from N2 to MBS1 MSS power down CATS Fiber Distributed Data Interface operations Three-Day Look Ahead: Thursday, 04/23: Ocular Health, Dragon cargo ops, RR unit cleaning Friday, 04/24: NeuroMapping Neurocognitive Ops, USOS Crew off duty Saturday, 04/25: Crew off duty, housekeeping  QUICK ISS Status – Environmental Control Group:                               Component Status Elektron Off Vozdukh Manual [СКВ] 1 – SM Air Conditioner System (“SKV1”) On [СКВ] 2 – SM Air Conditioner System (“SKV2”) Off Carbon Dioxide Removal Assembly (CDRA) Lab Operate Carbon Dioxide Removal Assembly (CDRA) Node 3 Operate Major Constituent Analyzer (MCA) Lab Shutdown Major Constituent Analyzer (MCA) Node 3 Operate Oxygen Generation Assembly (OGA) Process […]

from ISS On-Orbit Status Report http://ift.tt/1DnIOFL
via IFTTT

Book Release: Nightwalker by James, Allyson.

When someone targets Ansel, the Nightwalker living in Janet's hotel, Janet and Mick find themselves caught in a fight between supernatural powers, one that could prove deadly for them both.

Source: Baltimore County Public Library - New Books
via IFTTT

Former Zenit player accuses club of racial discrimination

MOSCOW (AP) A former Zenit St. Petersburg youth player says the Russian soccer club froze him out because he is black.

from FOX Sports Digital http://ift.tt/1Hrn8Pz
via IFTTT

Book Release: Got milked? : the great dairy deception and why you'll thrive without milk by Hamilton, Alissa, author.

Dispels misconceptions about milk and its crucial role in health, revealing the many ways in which dairy can actually be harmful, and provides dairy-free recipes and full meal plans.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Knooking : knitting with a crochet hook by Hug, Veronica.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: The Larousse book of bread : recipes to make at home by Kayser, Éric.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Ancient trees : portraits of time by Moon, Beth, author.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Fashion artist : drawing techniques to portfolio presentation by Burke, Sandra.

Guiding you through key fashion drawing and design techniques, this title contains self-explanatory drawings, photographs of the fashion model, together with artwork from international designers and illustrators, demonstrating the accepted design standards used in the fashion industry.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Apple computing for seniors in easy steps by Vandome, Nick, author.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Weimaraner : comprehensive owner's guide, a comprehensive guide to owning and caring for ... your dog by Harper, Lavonia.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: The ghost army of World War II : how one top-secret unit deceived the enemy with inflatable tanks, sound effects, and other audacious fakery by Beyer, Rick, 1956-

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: The spy's son : the true story of the highest-ranking CIA officer ever convicted of espionage and the son he trained to spy for Russia by Denson, Bryan.

Source: Baltimore County Public Library - New Books
via IFTTT

Denmark striker Nielsen convicted of violence against police

COPENHAGEN, Denmark (AP) A Danish court has given Denmark international and Evian striker Nicki Bille Nielsen a 60-day suspended jail sentence and 80 hours community service for violence against police officers who arrested him last year in Copenhagen after a night out.

from FOX Sports Digital http://ift.tt/1OKtJDw
via IFTTT

Former Everton chairman Philip Carter has died at age 87

LIVERPOOL, England (AP) Philip Carter, who was chairman of Everton during a trophy-filled period for the English club in the mid-1980s, has died. He was 87.

from FOX Sports Digital http://ift.tt/1HZj87W
via IFTTT

Out of Europe, PSG focuses on beating Lyon to French title

PARIS (AP) With its European aspirations in tatters after two losses to Barcelona in the Champions League quarterfinals, Paris Saint-Germain will now focus on finishing ahead of Lyon in the close-fought French title race.

from FOX Sports Digital http://ift.tt/1ySNkj1
via IFTTT

Book Release: Best frenemies by Simmons, Cari.

"Side by side by side? Alice Kinney shouldn't be nervous about starting middle school. She's got her best friend, Cassidy, by her side, so it can't be that bad, right? Except, Cass isn't at her side. For the first time since kindergarten, Alice and Cassidy aren't in any of the same classes, and Alice is stuck with a brand-new crew in honors class! The girls try to stay in touch from across the hallway with the help of a shared notebook--but when Alice accidentally befriends not-so-nice Nikki fro

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Rocket fuel : the one essential combination that will get you more of what you want from your business by Wickman, Gino.

From the author of the bestselling "Traction," "Rocket Fuel" details the integral roles of the Visionary and Integrator and explains how an effective relationship between the two can thrive, and even offers advice to help Visionary-minded and Integrator-minded individuals find one another. Rocket Fuel also offers assessments so you're able to determine whether you're a Visionary or an Integrator so you can recognize your needs and then find the best partner to suit them.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Gone crazy in Alabama by Williams-Garcia, Rita, author.

"Delphine, Vonetta, and Fern are off to Alabama to visit their grandmother, Big Ma, and her mother, Ma Charles. Across the way lives Ma Charles's half sister, Miss Trotter. The two half sisters haven't spoken in years. As Delphine hears about her family history, she uncovers the surprising truth that's been keeping the sisters apart. But when tragedy strikes, Delphine discovers that the bonds of family run deeper than she ever knew possible" --

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Listening to stone : the art and life of Isamu Noguchi by Herrera, Hayden.

"From the author of Arshile Gorky, a major biography of the great American sculptor that redefines his legacy"--

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Which is different?

Colorful photos of familiar objects make it easy for your toddler to compare and contrast.

Source: Baltimore County Public Library - New Books
via IFTTT

Juventus has a couple of canine options for Suarez if needed

MILAN (AP) Juventus has a couple of canine solutions to keep Luis Suarez and his biting at bay if it draws Barcelona in the Champions League semifinals.

from FOX Sports Digital http://ift.tt/1GawycG
via IFTTT

Henderson signs new deal with Liverpool

LIVERPOOL, England (AP) Jordan Henderson has signed a new long-term contract at Liverpool, keeping the England midfielder at a club where he is expected to take over as captain next season.

from FOX Sports Digital http://ift.tt/1Dm5Gp3
via IFTTT

Juventus aims to extend celebrations with Serie A title

ROME (AP) Juventus is still celebrating reaching the Champions League semifinals and the Bianconeri could be in for some more festivities this weekend in Serie A.

from FOX Sports Digital http://ift.tt/1Qn6nYo
via IFTTT

WhatsApp updates iOS App with Free Voice Calling Feature

After rolling out WhatsApp’s Free Voice Calling feature for Android users late last month, the widely popular messaging service has started to roll out the feature to iOS users. Now iOS users can enjoy making free voice calls through WhatsApp, as the new version of the messenger is now live in the iOS App Store with support to calling. WhatsApp calling feature allows you to call your

from The Hacker News http://ift.tt/1DSiQN5
via IFTTT

Barcelona, Madrid face tough away games in Spanish league

BARCELONA, Spain (AP) Having booked their spots in the Champions League semifinals, Barcelona and Real Madrid now face tough away fixtures in the Spanish league this weekend with just two points separating the title rivals as the season enters its final stretch.

from FOX Sports Digital http://ift.tt/1K7WgCm
via IFTTT

Possible reunions add interest to Champions League draw

NYON, Switzerland (AP) The prospect of old friends and foes meeting again has added even more interest to Friday's blockbuster Champions league semifinals draw.

from FOX Sports Digital http://ift.tt/1Dg62wp
via IFTTT

Bayern can seal Bundesliga title with 4 matches to spare

FRANKFURT, Germany (AP) Bayern Munich can seal its 25th Bundesliga title with four matches to spare with some outside help this weekend.

from FOX Sports Digital http://ift.tt/1HvjBhC
via IFTTT

Arsenal looks to delay Chelsea's title coronation

MANCHESTER, England (AP) With Chelsea holding a 10-point lead in the Premier League with six games left, it's surely no longer a question of whether the team will win the title.

from FOX Sports Digital http://ift.tt/1yVIC4j
via IFTTT

[FD] Socrata Bug Bounty #1 - Persistent Encoding Vulnerability

Document Title: =============== Socrata Bug Bounty #1 - Persistent Encoding Vulnerability References (Source): ==================== http://ift.tt/1JsYsmV Release Date: ============= 2015-04-22 Vulnerability Laboratory ID (VL-ID): ==================================== 1438 Common Vulnerability Scoring System: ==================================== 3.3 Product & Service Introduction: =============================== Private Socrata Bug Bounty Program - BC Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered an application-side input validation vulnerability in the Socrata online service web-application. Vulnerability Disclosure Timeline: ================================== 2015-02-24: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH) 2015-02-24: Vendor Notification (Socrata Security Team - Silent Bug Bounty Program) 2015-02-24: Vendor Response/Feedback (Socrata Security Team - Silent Bug Bounty Program) 2015-02-24: Vendor Fix/Patch (Socrata Developer Team) 2015-02-25: Bug Bounty Reward (Socrata Security Team - Silent Bug Bounty Program) 2015-04-22: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Socrata Inc Product: Socrata Online Service - Web Application 2015 Q1 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ An application-side mail encoding web vulnerability has been discovered in the official Socrata online service web-application. The vulnerability allows remote attackers to bypass the outgoing mail filter validation of the socrata web-server & web-application. The vulnerability is located in the first- and lastname values of the `leadCapture/save` module. Remote attackers without privileged application user account are able to inject persistent malicious script codes. The script code execution occurs in the notification mail to the service but also to the active user copy mail. The persistent injected script code executes in the header section were the database context of the first- and lastname will be displayed. The sender interacts automatically by usage of the discover.socrata.com service. The validation of the db stored outgoing values is wrong encoded and allows persistent injections of malicious script codes via POST method. The attack vector is persistent and the request method to inject is POST. The security risk of the mail encoding web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.3. Exploitation of the web vulnerability requires no privileged web-application user account and low or medium user interaction because of the persistent attack vector. Successful exploitation of the encoding vulnerability results in session hijacking, persistent phishing, persistent external redirects and persistent manipulation of web header or mail body context. Vulnerable Domain(s): [+] discover.socrata.com Vulnerable Module(s): [+] http://ift.tt/1ILzMWS Vulnerable Parameter(s): [+] firstname [+] lastname Affected Sender(s): [+] sales@socrata.com Affected Receiver(s): [+] bkm@evolution-sec.com Affected Context Module(s): [+] Service Notification Mail (Users) Proof of Concept (PoC): ======================= The vulnerability can be exploited by remote attackers without privileged application user account or user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Surf to the vulnerable service page 2. Inject payload to the firstname and lastname values 3. Save the content 4. View your mailbox to review the malicious mail 5 Successful reproduce of the security vulnerability! PoC: Thank You for Downloading "The 2014 Benchmark Report"

2014 Open Data Benchmark Report

Read the Full Report Hello ">[PERSISTENT INJECTED SCRIPT CODE HERE!] Download Now

Source: Gmail -> IFTTT-> Blogger

Google 'Project Fi' Wireless Service: 10 Amazing Facts

Google has just launched its long-rumored wireless cellular service that comes up to give a tough competition for AT&T and Verizon communication. Yes! A wireless Service for Cell Phone users. The web Internet giant, Google is now becoming a Mobile Virtual Network Operator (MVNO) by offering its wireless service. Here's What we Need to Know: 1. Google’s MVNO service is named "

from The Hacker News http://ift.tt/1OJRkEt
via IFTTT

KIRO 7 Eyewitness News

An anonymous donor has paid off the $360000 mortgage of a man who lost his home and his wife in the Oso landslide last year ...

from Google Alert - anonymous http://ift.tt/1Dl5PJD
via IFTTT

Colorful Star Clouds in Cygnus

Stars can form in colorful surroundings. Featured here is a star forming region rich in glowing gas and dark dust toward the constellation of the Swan (Cygnus), near the bright star Sadr. This region, which spans about 50 light years, is part of the Gamma Cygni nebula which lies about 1,800 light years distant. Toward the right of the image is Barnard 344, a dark and twisted dust cloud rich in cool molecular gas. A dramatic wall of dust and red-glowing hydrogen gas forms a line down the picture center. While the glowing red gas is indicative of small emission nebulas, the blue tinted areas are reflection nebulas -- starlight reflecting from usually dark dust grains. The Gamma Cygni nebula will likely not last the next billion years, as most of the bright young stars will explode, most of the dust will be destroyed, and most of the gas will drift away. via NASA http://ift.tt/1GgOTas

Peralta gives America a 1-1 draw with Montreal

MEXICO CITY (AP) Oribe Peralta scored in the 89th minute to give America a 1-1 tie with the Montreal Impact on Wednesday night in the first leg of the CONCACAF Champions League final.

from FOX Sports Digital http://ift.tt/1HoxUWR
via IFTTT

[FD] Magento Unauthenticated RCE

Orioles Video: Delmon Young unable to come through late with tying runners on in 4-2 loss to Blue Jays (ESPN)

from ESPN http://ift.tt/1eW1vUH
via IFTTT

I have a new follower on Twitter

Inverse Phase
Game / Chiptune composer using Nintendo NES Gameboy C64 Atari MSX Sega and more. I live on ramen, hot pockets, pizza, BBQ. Keywords: chiptunes retro games 8-bit
Maryland, US
http://t.co/TjpBSxy9UZ
Following: 17769 - Followers: 22516

April 22, 2015 at 10:04PM via Twitter http://ift.tt/10lpr43

Formalizing Preference Utilitarianism in Physical World Models. (arXiv:1504.05603v1 [cs.CY])

Most ethical work is done at a low level of formality. This makes practical moral questions inaccessible to formal and natural sciences and can lead to misunderstandings in ethical discussion. In this paper, we use Bayesian inference to introduce a formalization of preference utilitarianism in physical world models, specifically cellular automata. Even though our formalization is not immediately applicable, it could provide ethics and ultimately the question of how to "make the world better" with a formal basis.

from cs.AI updates on arXiv.org http://ift.tt/1Hnu0xp
via IFTTT

Distinguishing Cause from Effect Based on Exogeneity. (arXiv:1504.05651v1 [cs.AI])

Recent developments in structural equation modeling have produced several methods that can usually distinguish cause from effect in the two-variable case. For that purpose, however, one has to impose substantial structural constraints or smoothness assumptions on the functional causal models. In this paper, we consider the problem of determining the causal direction from a related but different point of view, and propose a new framework for causal direction determination. We show that it is possible to perform causal inference based on the condition that the cause is "exogenous" for the parameters involved in the generating process from the cause to the effect. In this way, we avoid the structural constraints required by the SEM-based approaches. In particular, we exploit nonparametric methods to estimate marginal and conditional distributions, and propose a bootstrap-based approach to test for the exogeneity condition; the testing results indicate the causal direction between two variables. The proposed method is validated on both synthetic and real data.

from cs.AI updates on arXiv.org http://ift.tt/1JvUES7
via IFTTT

Ascribing Consciousness to Artificial Intelligence. (arXiv:1504.05696v1 [cs.AI])

This paper critically assesses the anti-functionalist stance on consciousness adopted by certain advocates of integrated information theory (IIT), a corollary of which is that human-level artificial intelligence implemented on conventional computing hardware is necessarily not conscious. The critique draws on variations of a well-known gradual neuronal replacement thought experiment, as well as bringing out tensions in IIT's treatment of self-knowledge. The aim, though, is neither to reject IIT outright nor to champion functionalism in particular. Rather, it is suggested that both ideas have something to offer a scientific understanding of consciousness, as long as they are not dressed up as solutions to illusory metaphysical problems. As for human-level AI, we must await its development before we can decide whether or not to ascribe consciousness to it.

from cs.AI updates on arXiv.org http://ift.tt/1OIjwHN
via IFTTT

Learning of Behavior Trees for Autonomous Agents. (arXiv:1504.05811v1 [cs.RO])

Definition of an accurate system model for Automated Planner (AP) is often impractical, especially for real-world problems. Conversely, off-the-shelf planners fail to scale up and are domain dependent. These drawbacks are inherited from conventional transition systems such as Finite State Machines (FSMs) that describes the action-plan execution generated by the AP. On the other hand, Behavior Trees (BTs) represent a valid alternative to FSMs presenting many advantages in terms of modularity, reactiveness, scalability and domain-independence. In this paper, we propose a model-free AP framework using Genetic Programming (GP) to derive an optimal BT for an autonomous agent to achieve a given goal in unknown (but fully observable) environments. We illustrate the proposed framework using experiments conducted with an open source benchmark Mario AI for automated generation of BTs that can play the game character Mario to complete a certain level at various levels of difficulty to include enemies and obstacles.

from cs.AI updates on arXiv.org http://ift.tt/1Hnu0xf
via IFTTT

Generalized Support and Formal Development of Constraint Propagators. (arXiv:1504.05846v1 [cs.AI])

The concept of support is pervasive in constraint programming. Traditionally, when a domain value ceases to have support, it may be removed because it takes part in no solutions. Arc-consistency algorithms such as AC2001 make use of support in the form of a single domain value. GAC algorithms such as GAC-Schema use a tuple of values to support each literal. We generalize these notions of support in two ways. First, we allow a set of tuples to act as support. Second, the supported object is generalized from a set of literals (GAC-Schema) to an entire constraint or any part of it.

We design a methodology for developing correct propagators using generalized support. A constraint is expressed as a family of support properties, which may be proven correct against the formal semantics of the constraint. Using Curry-Howard isomorphism to interpret constructive proofs as programs, we show how to derive correct propagators from the constructive proofs of the support properties. The framework is carefully designed to allow efficient algorithms to be produced. Derived algorithms may make use of dynamic literal triggers or watched literals for efficiency. Finally, two case studies of deriving efficient algorithms are given.

from cs.AI updates on arXiv.org http://ift.tt/1Hnu0NX
via IFTTT

Semantic Enrichment of Mobile Phone Data Records Using Background Knowledge. (arXiv:1504.05895v1 [cs.AI])

Every day, billions of mobile network events (i.e. CDRs) are generated by cellular phone operator companies. Latent in this data are inspiring insights about human actions and behaviors, the discovery of which is important because context-aware applications and services hold the key to user-driven, intelligent services, which can enhance our everyday lives such as social and economic development, urban planning, and health prevention. The major challenge in this area is that interpreting such a big stream of data requires a deep understanding of mobile network events' context through available background knowledge. This article addresses the issues in context awareness given heterogeneous and uncertain data of mobile network events missing reliable information on the context of this activity. The contribution of this research is a model from a combination of logical and statistical reasoning standpoints for enabling human activity inference in qualitative terms from open geographical data that aimed at improving the quality of human behaviors recognition tasks from CDRs. We use open geographical data, Openstreetmap (OSM), as a proxy for predicting the content of human activity in the area. The user study performed in Trento shows that predicted human activities (top level) match the survey data with around 93% overall accuracy. The extensive validation for predicting a more specific economic type of human activity performed in Barcelona, by employing credit card transaction data. The analysis identifies that appropriately normalized data on points of interest (POI) is a good proxy for predicting human economical activities, with 84% accuracy on average. So the model is proven to be efficient for predicting the context of human activity, when its total level could be efficiently observed from cell phone data records, missing contextual information however.

from cs.AI updates on arXiv.org http://ift.tt/1OIjwrq
via IFTTT

Allocating Indivisible Items in Categorized Domains. (arXiv:1504.05932v1 [cs.GT])

We formulate a general class of allocation problems called categorized domain allocation problems (CDAPs), where indivisible items from multiple categories are allocated to agents without monetary transfer and each agent gets at least one item per category.

We focus on basic CDAPs, where the number of items in each category is equal to the number of agents. We characterize serial dictatorships for basic CDAPs by a minimal set of three axiomatic properties: strategy-proofness, non-bossiness, and category-wise neutrality. Then, we propose a natural extension of serial dictatorships called categorial sequential allocation mechanisms (CSAMs), which allocate the items in multiple rounds: in each round, the active agent chooses an item from a designated category. We fully characterize the worst-case rank efficiency of CSAMs for optimistic and pessimistic agents, and provide a bound for strategic agents. We also conduct experiments to compare expected rank efficiency of various CSAMs w.r.t. random generated data.

from cs.AI updates on arXiv.org http://ift.tt/1Huu1xV
via IFTTT

The Power of Randomization: Distributed Submodular Maximization on Massive Datasets. (arXiv:1502.02606v2 [cs.LG] UPDATED)

A wide variety of problems in machine learning, including exemplar clustering, document summarization, and sensor placement, can be cast as constrained submodular maximization problems. Unfortunately, the resulting submodular optimization problems are often too large to be solved on a single machine. We develop a simple distributed algorithm that is embarrassingly parallel and it achieves provable, constant factor, worst-case approximation guarantees. In our experiments, we demonstrate its efficiency in large problems with different kinds of constraints with objective values always close to what is achievable in the centralized setting.

from cs.AI updates on arXiv.org http://ift.tt/1CNwGlr
via IFTTT

I have a new follower on Twitter

The Davenports
Pop confections for the stoned written by Scott Klass.
Brooklyn,NY
http://t.co/oHVVa2FW2I
Following: 5814 - Followers: 5628

April 22, 2015 at 06:58PM via Twitter http://ift.tt/1FgJf8K

[FD] CVE-2015-0984 SCADA - Gaining remote shell on Honeywell Falcon XLWEB

SCADA - EXPLOITING CVE-2015-0984 FOR SHELL ACCESS This post is a follow up detailing how to achieve control of the actual XLWEB SCADA controller. The vulnerability is assigned with reference CVE-2015-0984. Rather than the application level administrative access as discussed in the email regarding CVE-2014-2717, this focuses on issues with the FTP, default accounts which could not be changed, and high privileges of the web server user resulting in a simple shell on the server. In this case we are looking at CVE-2015-0984, or ICSA-15-076-02, but we expect to be back with a second disclosure soon when the vendor have had a chance to look at the latest finding, still pending a CVE, if one will be assigned. For those interested in a more readable version of this disclosure and additional information, see http://ift.tt/1EdUqyZ Please note that the CVE at NVD uses a different CVSS vector than the one in this disclosure or from ICS-CERT, stating partial confidentiality and no availability or integrity impact. As this gives shell access to the system, I am relatively certain the C:C/A:C/I:C is the correct evaluation. _________________________ *BACKGROUND* Honeywell is a US-based company that maintains offices worldwide. The affected products, XLWeb controllers, are web-based SCADA systems. According to Honeywell, XLWeb controllers are deployed across several sectors including Critical Manufacturing, Energy, Water and Waste water Systems, and others. Honeywell estimates that these products are used primarily in Europe and the Middle East. _________________________ *VULNERABILITY OVERVIEW* The vulnerability is defined as a PATH TRAVERSAL. By using a directory traversal vulnerability in the FTP server, it is possible to gain access to the web root directory. A CVSS v2 base score of 10.0 has been assigned; the CVSS vector string is (AV:N/AC:L/Au:N/C:C/I:C/A:C) That is; Access Vector – Network Access Complexity – Low Authentication – None

Source: Gmail -> IFTTT-> Blogger

Book Release: A girl and her greens : hearty meals from the garden by Bloomfield, April.

Source: Baltimore County Public Library - New Books
via IFTTT

ISS Daily Summary Report – 04/21/15

Osteocytes and mechano-transduction (Osteo-4):  Cristoforetti successfully performed Tray 3 operations, removing the last three bioreactors from Osteo-4, and stowed them in MELFI.  The Osteo-4 locker was then powered off.  The three trays of Osteo-4 are an automated bone cell culture experiment that studies the effects of microgravity on the function of osteocytes, which are the most common cells in bone. These cells reside within the mineralized bone and can sense mechanical forces, or the lack of them, but researchers do not know how. Osteo-4 allows scientists to analyze changes in the physical appearance and genetic expression of mouse bone cells in microgravity. Russian Joint Research (RJR) Microbial Air Sampler (MAS) and Surface Sample Kit (SSK) Analysis: Padalka analyzed the MAS and SSK samples taken on 16 April, performing colony counts and photographing the microbial and fungal slides.  The investigation refines locations and surfaces prone to microbial contamination throughout the ISS, shares monitoring technologies and data between NASA and Roscosmos, and provides a scientific basis for decisions about future microbial monitoring, both on ISS through its extended life, and on other future human exploration spacecraft. Ocular Health:  Kornienko continued Ocular Health activities, performing his Flight Day 30 fundoscopy, with the assistance of Cristoforetti and ground remote guiders.  The fundoscope is utilized to image the fundus (interior surface of the eye including the retina, optic disc, macula, and fovea). Ocular Health protocol calls for a systematic gathering of physiological data to characterize the risk of microgravity-induced visual impairment/intracranial pressure in ISS crewmembers. Researchers believe that the measurement of visual, vascular and central nervous system changes over the course of this experiment and during the subsequent post-flight recovery will assist in the development of countermeasures, clinical monitoring strategies, and clinical practice guidelines. Biological Research in Canisters (BRIC)-21: Cristoforetti inserted the four cartridge samples in the Minus Eighty Degree Celsius Laboratory Freezer for ISS (MELFI), thereby halting the growth period approximately 24 hours after initiation.  The samples will be returned on SpX-6 for ground analysis.  The BRIC-21 investigation tests the hypothesis that microorganisms subjected to a space flight environment experience a spectrum of stress responses, with some leading to alterations in the antibiotic susceptibility. The goals of BRIC-21 are to analyze microbes to identify the suite of stress responses induced by exposure to spaceflight and simulated microgravity, and determine viability, resistance levels to a battery of antibiotics, and rates of spontaneous mutation to antibiotic resistance in microbes. Gene, Immune and Cellular Responses to Single and Combined Space Flight Conditions – A (Triplelux-A): Cristoforetti stowed the six Triplelux Reservoir A canisters in the Biolab Thermal Control Unit (TCU)1 (-20 °C) and the two Triplelux Experiment Container (EC) Handling Mechanism (HM) Interfaces in the Biolab TCU 2 (+4°C) until start of the experiment run scheduled for next week. Triplelux-A uses a rat macrophage cell line to investigate and compare the ability of macrophages to kill pathogens under normal gravity and microgravity conditions. The goal is to gain a better understanding of immune suppression in spaceflight. Rodent Research-2 Center for the Advancement of Science in Space (RR-2 CASIS): Kelly and Virts performed the first set of four sample collections with Kelly as primary operator while Virts assisted, placing samples in containment then in MELFI. The objective of this research is to monitor the effects of the space environment on the musculoskeletal and neurological systems of mice as model organisms of human health and disease. Living in microgravity results in significant and rapid effects on the physiology of mice that mimic the process of aging and some diseases in humans on Earth, including muscle atrophy and the loss of bone mineral density. This project will help scientists discover new molecular targets that can facilitate the development of novel therapeutics for the treatment of muscle and bone-related diseases. Long-duration exposure to microgravity will also induce changes in gene expression, protein synthesis, metabolism, and eye structure/morphology that will be identifiable as a series of assessable biomarkers for tracking the onset and progression of disease. On Board Training (OBT) Dragon Debrief Conference: Virts and Cristoforetti completed a conference with ground teams to debrief lessons learned from the SpX-6 Dragon OBTs performed by the crew prior to berthing.  Today’s Planned Activities All activities were completed unless otherwise noted. SLEEP Questionnaire IMMUNO. Saliva Sample (Session 1) IMMUNO. First stress test, questionnaire data entry. RSS1,2 Reboot IMMUNO. Test-Tube Blood Collection (finger). IMMUNO. Blood Sample Processing. IMMUNO. Equipment Stowage Regeneration of БМП Ф2 Micropurification Cartridge (start) Sample Collection/Incubation using Surface Sample Kit (SSK) and Microbial Air Sampler (MAS) FINEMOTR – Experiment Ops OSTEO4 – Bioreactor Prep for MELFI Stowage PAO hardware setup REMOTE RS LAPTOP Installation in USOS Crew Prep for PAO REMOTE RS LAPTOP Tests from КЦП2. TV Conference with Russia Today TV Channel Correspondent Rodent Research (RR) – Hardware Installation and Connection REMOTE RS LAPTOP Tests from КЦП1. СОЖ Maintenance REMOTE RS LAPTOP Setup Teardown on USOS Rodent Research (RR) – Installation of Refrigerated Centrifuge Removal of ССД305 Light from ТКГ 424 (DC1) and Stowage in Spares Kit DAN. Experiment Execution Support DAN. Experiment Ops. OSTEO4 – Sample Insertion into MELFI OSTEO4 – Glove Bag Stowage Replacement of РТ-50-1М No.9 (А209) – Equipment Prep. Rodent Research (RR) – Refrigerated Centrifuge Configuration Rodent Research (RR) – Hardware Installation and Connection WRS Water Sample Analysis ECON-L. Observations and Photography EML – Cable Removal Rodent Research (RR) – Closeout Ops OSTEO4 – Hardware Deactivation and Removal Verification of ИП-1 Flow Sensor Position BRIC21 – Canister Insertion into MELFI PLR/MELF – Transfer of Samples from Polar to MELFI TPLXA – Biolab TCU1 Hardware Setup MPEG-2 video downlink test via KU-band prior to ТКГ 426 Docking to the ISS ТКГ 424 (DC1) Stowage and IMS Ops TOCA Data Recording Video Footage for Nauka 2.0 TV Channel Rodent Research (RR) – MELFI Sample Insertion Rodent Research (RR) – Refrigerated Centrifuge Configuration ТКГ 424 (DC1) Stowage Completion Report (S-band) Rodent Research (RR) – Experiment Ops IMS Delta File Prep Rodent Research (RR) – Closeout Ops Rodent Research (RR) – […]

from ISS On-Orbit Status Report http://ift.tt/1Pjhhgc
via IFTTT

UEFA, FIFA warn Greece over government's planned new laws

NYON, Switzerland (AP) UEFA and FIFA say they have sent a final warning to Greece that it faces suspension from international football for government interference.

from FOX Sports Digital http://ift.tt/1GjfRkq
via IFTTT

Knee injury ends Leverkusen midfielder Castro's season

LEVERKUSEN, Germany (AP) Bayer Leverkusen midfielder Gonzalo Castro will miss the final five matches of the Bundesliga season because of a knee injury.

from FOX Sports Digital http://ift.tt/1Gj2wbQ
via IFTTT

CSI: Cyber Video

When a teenage girl goes missing, the team discovers a shocking social media page that has been created to bully her online.

from Google Alert - anonymous http://ift.tt/1GiKGWs
via IFTTT

iOS 8 Vulnerability Lets Hackers Crash Any iPhone and iPad Within Wi-Fi Range

Security researchers have uncovered a zero-day vulnerability in iOS 8 that could repeatedly crash users' Apple iPhones, iPads and iPods when the devices connect to a malicious wireless hotspot. It’s like Denial of Service (DoS) attack on Apple's iOS devices that results in crashing either individual iOS apps or users' entire iPhones. NO iOS ZONE Adi Sharabani and Yair Amit of Mobile

from The Hacker News http://ift.tt/1aSk1lh
via IFTTT

Book Release: The dinosaur mystery by Warner, Gertrude Chandler, 1890-1979.

When the Aldens go to the Pickering Natural History Museum to assist with the opening of a dinosaur exhibit, their work is hampered by a series of mysterious happenings.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: The mystery of the hidden beach by Warner, Gertrude Chandler, 1890-1979.

While visiting the Florida Keys, the Aldens encounter suspicious characters, strange incidents at night, and a plot to steal valuable coral.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Finger knitting fun : 28 cute, clever, and creative projects for kids by Howell, Vickie.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: A voyage in the sunbeam : our home on the ocean for eleven months by Brassey, Annie.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: Childhood by Wyness, Michael G.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: What's great about Pennsylvania? by Marciniak, Kristin

What's so great about Pennsylvania? Find out about the top ten sites to see or things to do in the Keystone State! Explore Pennsylvania's big cities, mountains, rivers, and rich history. The Pennsylvania by Map feature shows where you'll find all the places covered in the book. A special section provides fast state facts such as the state motto, capital, population, animals, foods, and more.

Source: Baltimore County Public Library - New Books
via IFTTT

Book Release: The Bone Tree A Novel by Iles, Greg.

#1 New York TimesThe Bone Tree is a masterpiece of modern suspense and the next novel in the monumental trilogy that Greg Iles was born to write.

Source: Baltimore County Public Library - New Books
via IFTTT

[FD] HomeAdvisor Bug Bounty #1 - Filter Bypass & Client Side Exception Handling Vulnerability

Document Title: =============== HomeAdvisor (Bug Bounty #1) - Filter Bypass & Client Side Exception Handling Vulnerability References (Source): ==================== http://ift.tt/1J5UaoK Release Date: ============= 2015-04-21 Vulnerability Laboratory ID (VL-ID): ==================================== 1452 Common Vulnerability Scoring System: ==================================== 3.6 Product & Service Introduction: =============================== HomeAdvisor is a website that lists pre-screened and customer-rated service professionals. The website also has tools, products, and resources for home improvement, maintenance, and repair. HomeAdvisor is a subsidiary of IAC. Professionals in the HomeAdvisor network are pre-screened for criminal records, bankruptcy issues, bad reviews, sex offenses, and cases of malpractice. Homeowners choose a category that matches their home improvement needs, enter their full address or adjacent cross-streets and contact information and answer three pages of questions about their project. (Copy of the Homepage: http://ift.tt/1sZnjqI ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Core Research Team discovered a filter bypass and issue and client-side cross site scripting web vulnerability in the official homeadvisor web-application. Vulnerability Disclosure Timeline: ================================== 2015-03-10: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH) 2015-03-11: Vendor Notification (HomeAdvisor Inc - Security Research Team) 2015-03-26: Vendor Response/Feedback (HomeAdvisor Inc - Security Research Team) 2015-04-20: Vendor Fix/Patch (HomeAdvisor Inc - Developer Team) 2015-04-21: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== HomeAdvisor Inc Product: HomeAdvisor - Web Application (Online Service) 2015 Q2 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A non-persistent cross site scripting web vulnerability (client-side) and filter bypass issue has been discovered in the official HomeAdvisor web-application. The security vulnerability allows remote attackers to execute client-side script code that compromises the homeadvisor web-application. The client-side cross site scripting web vulnerability is located in the exception-handling comments context. Remote attackers are able to inject client-side script code that executes in the web-application exception-handling. The request method to execute is GET and the attack vector is client-side. Remote attackers are able to prepare special crafted urls with own script codes to compromise homeadvisor user session data in connection with client-side attacks. The security risk of the client-side cross site scripting web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.6. Exploitation of the non-persistent web vulnerability requires a low privileged web-application user account and low or medium user interaction. Successful exploitation of the vulnerabilities result in persistent phishing, session hijacking, persistent external redirect to malicious sources and application-side manipulation of affected or connected module context. Request Method(s): [+] GET Vulnerable Module(s): [+] rated.VipElectric.11975047.html#profile Affected Parameter(s): [+] sm/security/login/isLoggedInOrRecognized Proof of Concept (PoC): ======================= The client-side cross site scripting vulnerability and filter bypass issue can be exploited by remote attackers without privileged application user account and with low or medium user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Login to the service 2. Surf to for example (http://ift.tt/1Oe5m6c) 3. Inject splitted char payload to the input of the comments 4. Send the comment 5. An exception occurs with an error (An error has occurred, please try again later (400124) 6. Under the exception is the injected code 7. Now click to embed the stuff or use the share function 8. Successful reproduce of the vulnerability! PoC: Payload(s) </> %20%20%20">

UEFA confirms new Champions League seeding system

NYON, Switzerland (AP) UEFA has published Champions League regulations for next season confirming a seeding change to reward national league winners.

from FOX Sports Digital http://ift.tt/1OdWWMc
via IFTTT

Book Release: Hearts In Atlantis by King, Stephen.

Stephen King, whose first novel, -- heart, Stephen King's new book will take some readers to a place they have never been...and others to a place they have never been able to completely leave.

Source: Baltimore County Public Library - New Books
via IFTTT

[FD] iPassword Manager v2.6 iOS - Persistent Vulnerabilities

[FD] Apple iOS 8.0 - 8.0.2 - Controls Re Auth Bypass Vulnerability

Document Title: =============== Apple iOS 8.0 - 8.0.2 - Controls Re Auth Bypass Vulnerability References (Source): ==================== http://ift.tt/1vRIzEN Video: http://ift.tt/1F0gBGT Release Date: ============= 2015-03-02 Vulnerability Laboratory ID (VL-ID): ==================================== 1322 Common Vulnerability Scoring System: ==================================== 5.2 Product & Service Introduction: =============================== iOS (previously iPhone OS) is a mobile operating system developed and distributed by Apple Inc. Originally released in 2007 for the iPhone and iPod Touch, it has been extended to support other Apple devices such as the iPad and Apple TV. Unlike Microsoft`s Windows Phone (Windows CE) and Google`s Android, Apple does not license iOS for installation on non-Apple hardware. As of September 12, 2012, Apple`s App Store contained more than 700,000 iOS applications, which have collectively been downloaded more than 30 billion times. It had a 14.9% share of the smartphone mobile operating system units shipped in the third quarter of 2012, behind only Google`s Android. In June 2012, it accounted for 65% of mobile web data consumption (including use on both the iPod Touch and the iPad). At the half of 2012, there were 410 million devices activated. According to the special media event held by Apple on September 12, 2012, 400 million devices have been sold through June 2012. The user interface of iOS is based on the concept of direct manipulation, using multi-touch gestures. Interface control elements consist of sliders, switches, and buttons. Interaction with the OS includes gestures such as swipe, tap, pinch, and reverse pinch, all of which have specific definitions within the context of the iOS operating system and its multi-touch interface. Internal accelerometers are used by some applications to respond to shaking the device (one common result is the undo command) or rotating it in three dimensions (one common result is switching from portrait to landscape mode). iOS is derived from OS X, with which it shares the Darwin foundation. iOS is Apple`s mobile version of the OS X operating system used on Apple computers. In iOS, there are four abstraction layers: the Core OS layer, the Core Services layer, the Media layer, and the Cocoa Touch layer. The current version of the operating system (iOS 6.1) dedicates 1-1.5 GB of the device`s flash memory for the system partition, using roughly 800 MB of that partition (varying by model) for iOS itself. iOS currently runs on iPhone, Apple TV, iPod Touch, and iPad. ( Copy of the Homepage: http://ift.tt/15d7WzJ ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered bypass vulnerability in the official Apple (iPhone) iOS v8.0 (12A365) - v8.0.2 mobile device system. Vulnerability Disclosure Timeline: ================================== 2014-09-18: Researcher Notification & Coordination (Benjamin Kunz Mejri - VL Core Research Team) 2014-09-28: Vendor Notification (Apple Security Team - Acknowledgement Program) 2015-03-02: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Apple Product: iOS 8.0 Exploitation Technique: ======================= Local Severity Level: =============== Medium Technical Details & Description: ================================ A local pass code (code lock) bypass and glitch has been discovered in the Apple iOS v8.0 (12A365) mobile device system. The vulnerability allows to bypass or evade via glitch the regular pass code restriction of the embed iOS device system. The local bypass vulnerability is located in the favorite contact preview function that can be used for imessages or phone calls. Local attackers with physical access can glitch the display by usage of siri to bypass since the end of a call the device system access restriction. To exploit the attacker visit the favorite call function via the home button in the ios task favorite preview slideshow. He clicks a contact and uses siri to merge via glitch with the authorized call app. In the next step he locks the mobile device. The he hold the volume + button multiple times to keep the service since the call end ahead to the pass code logon screen. The issue is very tricky to exploit but affects at the end obviously secure pass code restriction. The attacker is able to multiple times push in the last moment the power button to deactivate the display and start the pass code lock. However the local attacker is able to bypass exactly this mechanism in the mentioned location. During the tests the security researcher revealed a video that demonstrates the security issue and the glitch that affects the local device security. Like in the Samsung in 2010 the device allows to access the information as long as a call runs in the phone app. The local issue has been tested to verify with the default configured iphone 6 and 5s device. The security risk of the local pass code bypass vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 5.2. Exploitation of the local glitch bypass vulnerability requires a privileged web-application user account, multi user account or restricted physical device access without user interaction. Successful exploitation of the local pass code bypass vulnerability results in device compromise or information leaking. Affected Device(s): [+] Apple > iPhone 5 & 6 Affected OS Version(s): [+] iOS v8.0 (12A365) Tested Device(s): [+] Apple iPhone 5s & 6 > iOS v8.0 (12A365) Proof of Concept (PoC): ======================= The auth bypass vulnerability can be exploited by local attackers with physical device access without user interaction. For security demonstration or to reproduce the issue follow the provided information and steps below to continue. Requirement(s): [+] iOS v8.0 (default install) [+] Apple Device (iPad 2, iPhone 5s or iPhone 6) [+] Two healthy hands ;) Manual Steps to reproduce the local vulnerability ... 1. Start your iOS device and install the new iOS v8.0 to your ipad2, iphone 5s or iphone 6 device 2. Start the mobile and login to the pass code 3. Now press the home button twice to see the app preview slide show and the new favorite contract slideshow above 4. move you finger over the favorite contact and two symboles become visible (Phone app and Message app) 5. Press now the home button two seconds to activate siri and push in the last second the private call button to the contact Note: Be fast! After it the siri which is in default mode available glitches ahead to the phone call 6. Now you push the power button on top of the mobile and shortly after it you use the hardware volumen to reactivate Note: The mobile now goes in the locked mode after the power button push but the siri is ahead glitched to the call that runs 7. In the call mask you can click the contacts button by pressing around the button because of the siri glitch 8. The contact list becomes available as long as the call runs with the glitch through siri 9. Successul bypass of the secure pass code restriction! Reference(s): ../poc-video.wmv Picture(s): ../1.png ../2.png ../3.png ../4.png ../5.png ../6.png ../7.png ../8.png Security Risk: ============== The security risk of the local auth bypass issue and glitch in the iOS v8.0 is estimated as medium. (CVS 5.2) Credits & Authors: ================== Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [http://ift.tt/1jnqRwA] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: http://ift.tt/1jnqRwA - www.vuln-lab.com - http://ift.tt/1kouTut Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com Section: magazine.vulnerability-db.com - http://ift.tt/1zNuo47 - http://ift.tt/1wo6y8x Social: http://ift.tt/1kouSq9 - http://ift.tt/1kouSqa - http://ift.tt/1kouTKL Feeds: http://ift.tt/1iS1DH0 - http://ift.tt/1kouSqh - http://ift.tt/1kouTKS Programs: http://ift.tt/1iS1GCs - http://ift.tt/1iS1FyF - http://ift.tt/1kouSqp Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™

Source: Gmail -> IFTTT-> Blogger

I have a new follower on Twitter

Inspari
Vores passion er at flytte vores kunder fra data til viden - og fra viden til værdi med data-driven decision management og Business Intelligence //
Hørsholm, Denmark
http://t.co/kxlGFZNY1y
Following: 928 - Followers: 959

April 22, 2015 at 04:26AM via Twitter http://ift.tt/1utoT3O

I have a new follower on Twitter

Jens-Jacob T. Aarup
Director and Partner at Inspari A/S - Business Intelligence and Performance Management consulting services in Europe.
Skødstrup, Denmark
http://t.co/aGBCrPZI39
Following: 3955 - Followers: 4149

April 22, 2015 at 04:26AM via Twitter http://ift.tt/1Bitlab

Deepak Babu P R (@prdeepakbabu) favorited one of your Tweets!

      Patrick McGuire, Your Tweet got favorited!         Patrick McGuire @mistermcguire [FD] Google Analytics by Yoast stored XSS #2 ift.tt/1Ja1RdG 05:09 AM - 22 Apr 15 Favorited by

Source: Gmail -> IFTTT-> Blogger

Spartak Moscow punished over racist banner

MOSCOW (AP) Spartak Moscow has been fined and its fans barred from two away games after the club lost its appeal against sanctions for a racist banner.

from FOX Sports Digital http://ift.tt/1OdglNn
via IFTTT

Re: [FD] Photo Manager Pro 4.4.0 iOS - Code Execution Vulnerability

This looks like a reflected XSS, not a code execution vulnerability as the term is commonly understood. On Tue, Apr 21, 2015 at 11:34 AM, Vulnerability Lab < research@vulnerability-lab.com> wrote: > Document Title: > =============== > Photo Manager Pro 4.4.0 iOS - Code Execution Vulnerability > > > References (Source): > ==================== > http://ift.tt/1AZOByY > > > Release Date: > ============= > 2015-03-10 > > > Vulnerability Laboratory ID (VL-ID): > ==================================== > 1444 > > > Common Vulnerability Scoring System: > ==================================== > 8.6 > > > Product & Service Introduction: > =============================== > Do you have troubles for managing thousands of photos and videos? Do you > have any private photos or videos? Are you looking for a photo portfolio > app? > Photo Manager Pro is exactly you are looking for. Photo Manager Pro is > extremely easy to use. TP Transfer: Transfer folders and files between > computer > and device over wifi network. HTTP Transfer: Transfer files between > computer and device over wifi network. View photos in the browser. Peer to > Peer > Transfer: Directly transfer files between iPad, iPhone and iPod Touch over > wifi network. USB Transfer: Import/Export photos from/to iTunes file > sharing. > Basic Transfer: Import/Export photos from/to the Photos app. > > (Copy of the Vendor Homepage: > http://ift.tt/1DHFhEB & > http://ift.tt/1J5AUHW ) > > > Abstract Advisory Information: > ============================== > The Vulnerability Laboratory Research Team discovered a code execution > vulnerability in the official Linkus Photo Manager Pro v4.4.0 iOS mobile > web-application. > > > Vulnerability Disclosure Timeline: > ================================== > 2015-03-10: Public Disclosure (Vulnerability Laboratory) > > > Discovery Status: > ================= > Published > > > Affected Product(s): > ==================== > Linkus > Product: Photo Manager Pro - iOS Mobile Web Application (Wifi) 4.4.0 > > > Exploitation Technique: > ======================= > Remote > > > Severity Level: > =============== > Critical > > > Technical Details & Description: > ================================ > An arbitrary code execution vulnerability has been discovered in the > official Linkus Photo Manager Pro v4.4.0 iOS mobile web-application. > The vulnerability allows remote attackers to execute malicious codes on > the application-side of the vulnerable app to compromise the > target mobile device. > > The vulnerability is located in the `folderName` value of the > `newfolder.action` module. Remote attackers are able to manipulate the > `folderName` value in the `index.html#?w=300` file POST method request to > compromise the application, user session information or connected > device components. The attacker tampers the new Folder POST method request > to exchange the regular folderName value with special crafted code. > The input context is becomes visible at the main index service or > subfolder (path). The vector of the vulnerability is located on the > application-side. > > The security risk of the arbitrary code execution vulnerability is > estimated as high with a cvss (common vulnerability scoring system) count > of 8.6. > Exploitation of the arbitrary code execution vulnerability requires no > user interaction or privileged web-application user account with password. > Successful exploitation of the vulnerability results in session hijacking, > persistent phishing, persistent external redirects and persistent > manipulation function or connected module context. > > Request Method(s): > [+] [POST] > > Vulnerable Module(s): > [+] newfolder.action > > Vulnerable Parameter(s): > [+] folderName > > Affected Module(s): > [+] Index (http://localhost:8080) > [+] Sub Category Path > > > Proof of Concept (PoC): > ======================= > The code execution vulnerability can be exploited by remote attackers > without privileged application user account or user interaction. > For security demonstration or to reproduce the vulnerability follow the > provided information and steps below to continue. > > PoC: Create Folder > >

Home

>

• src="images/blank.gif" class="blank"> href="browse_folder.html?folderID=1"> height="86" width="80">
  href="browse_folder.html?folderID=1">Family
• class="folder_item_bg"> href="browse_folder.html?folderID=2"> height="86" width="80">
  href="browse_folder.html?folderID=2">Friends
• class="folder_item_bg"> href="browse_folder.html?folderID=3"> height="86" width="80">
  href="browse_folder.html?folderID=3">Travel
• class="folder_item_bg"> href="browse_folder.html?folderID=4"> height="86" width="80">
  href="browse_folder.html?folderID=4">Shopping
• class="folder_item_bg"> href="browse_folder.html?folderID=5"> height="86" width="80">
  href="browse_folder.html?folderID=5">Funny;[CODE EXECUTION VULNERABILITY > VIA FOLDERNAME!]>

> > > ... after surfing to the created folder > >

>

>

>

Photo Manager Pro

>

>

>

>

href="index.html">Home > href="browse_folder.html?folderID=5">Funny;[CODE EXECUTION VULNERABILITY > VIA FOLDERNAME!]>

>

method="post"> >

>

>

> > > PoC: Vulnerable Source > } > > function createFolder() { > $.ajax({ > type: 'POST', > url: 'newfolder.action', > cache: false, > dataType: 'json', > data: {folderName:$('#foldername').attr('value'), > isSubfolder:$('#is_subfolder_hidden').attr('value'), > parentFolderID:$('#parent_folder_hidden').attr('value')}, > async: false, > success: function(result) { > window.location.reload(false); > } > }); > } > > > >

Source: Gmail -> IFTTT-> Blogger