Guru Technology News24: 05 September 2007

Wednesday, September 5, 2007

Mystery of Sun's Superhot Corona May Be Whipped

Rippling magnetic fields finally spotted in the corona

New measurements provide the strongest evidence yet for wriggling magnetic waves that may explain why the solar corona is a good 200 times hotter than the surface of the sun: regular pulsations in the speed of charged, high-energy gas or plasma streaming from the sun combined with matching magnetic fields.

The findings point to magnetic field ripples known as Alfvén waves whipping plasma back and forth, releasing heat, according to a report published online by Science. Although the waves seem to be too tiny to transfer the energy needed to fully heat the corona, researchers say improved measurements may reveal that the waves are larger than they appear.

A central problem in solar physics is why the sun's atmosphere gets hotter as it rises, from about 8,500 degrees Fahrenheit (5,000 kelvins) at the photosphere (solar surface) to more than 1.8 million degrees Fahrenheit (1 million Kelvins) in the corona, which extends for millions of miles. Without an outside force heating the corona, its temperature would plummet, says solar physicist Scott McIntosh of the National Center for Atmospheric Research (NCAR) in Boulder, Colo.

A top candidate for that outside force: Alfv&eacutise;n waves, undulations in the corona's magnetic field liberating heat as the waves "break" and compress plasma.

To spy Alfvén waves, McIntosh, Steven Tomczyk, also of NCAR, and their colleagues used the coronal multichannel polarimeter (CoMP) instrument at New Mexico's National Solar Observatory to measure changes in light emitted by ionized iron in the corona, which told them how the plasma's outward velocity varied.

Pulses of 0.2 mile (0.3 kilometer) a second occurred every five minutes, the same frequency as convective currents in the photosphere that could trigger Alfvén waves, they report. The direction of coronal magnetic field lines also seemed to match the trajectories of the pulses.

The result comes close to solving one of the great mysteries in solar physics, says Viggo Hansteen, professor of astrophysics at the University of Oslo in Norway. Data from Japan's Hinode spacecraft, presented at a meeting in April, showed patterns deeper in the corona that seemed to finger Alfvén waves, but the new finding is much more definitive, he says. "They're not guessing. They're really saying, 'Okay, these things are obeying all the characteristics we expect of Alfvén waves.'"

The only hitch: the waves are less than a thousandth the mangnitude needed to explain coronal heating, but Tomczyk notes that CoMP has relatively low resolution, so much larger waves could still be hidden in the data.

Technorati : Corona, Mystery, Sun's, Superhot, Whipped
Del.icio.us : Corona, Mystery, Sun's, Superhot, Whipped
Ice Rocket : Corona, Mystery, Sun's, Superhot, Whipped
Flickr : Corona, Mystery, Sun's, Superhot, Whipped
Zooomr : Corona, Mystery, Sun's, Superhot, Whipped
Buzznet : Corona, Mystery, Sun's, Superhot, Whipped

More vitamin D could mean fewer cancers: study

Cancer Defeated Vitamin D Pill For ...

Thousands of cases of breast and colon cancers might be averted each year if people in colder climates raised their vitamin D levels, researchers estimate in a new report.

A number of studies have suggested that vitamin D may be important in cancer risk. Much of this research is based on cancer rates at different latitudes of the globe; rates of breast, colon and ovarian cancer, for example, are lower in sunnier regions of the world than in Northern climates where cold winters limit people's sun exposure.

Sunlight triggers the synthesis of vitamin D in the skin, and people who get little sun exposure tend to have lower stores of the vitamin.

Complementing these studies are lab experiments showing that vitamin D helps prevent cancer cells from growing and spreading, as well as some clinical trials in which people given high doses of vitamin D showed lower cancer risks.

For the new study, researchers at the University of California used data on average wintertime blood levels of vitamin D and rates of breast and colon cancers in 15 countries.

They found that rates of the diseases tended to fall as average vitamin D levels climbed, according to their report in the journal Nutrition Reviews. The protective effect against colon cancer seemed to begin when blood levels of vitamin D reached 22 nanograms per milliliter (ng/mL); for breast cancer, that number was 32 ng/mL.

The average late-winter vitamin D level among Americans is 15 to 18 ng/mL, according to the researchers.

They argue that, based on their data, if Americans were able to maintain a vitamin D level of at least 55 ng/mL, 60,000 cases of colon cancer and 85,000 cases of breast cancer could be prevented every year. Worldwide, those figures could be 250,000 and 350,000, respectively.

"This could be best achieved with a combination of diet, supplements and short intervals -- 10 or 15 minutes a day -- in the sun," lead study author Dr. Cedric F. Garland, a cancer prevention specialist at the University of California San Diego, said in a statement.

No one is recommending that people bake in the sun to reach high vitamin D blood levels. According to Garland, spending a matter of minutes in the midday sun, with 40 percent of the skin exposed, is enough. For fair-skinned people, the researchers estimate that just 3 minutes in the sun can be adequate, while darker-skinned people may need about 15 minutes.

A lifeguard in Southern California, Garland said, may have little need for extra vitamin D to reach potentially protective levels, whereas a Northerner who tends to stay indoors much of the year may need much more.

Garland and his colleagues recommend that, in addition to modest sun exposure, adults get 2,000 IU of vitamin D per day -- which is the "tolerable upper intake level" set by U.S. health officials.

That limit exists because of the risk of vitamin D toxicity, which causes elevated calcium levels in the blood and problems such as nausea, weight loss, fatigue and kidney dysfunction..

Northwestern University and NEC Labs America's CRAMES: Power-Packed Memory

Power-Packed Memory

Northwestern University and NEC Labs AmericaCRAMES Memory compression technique doubles storage in embedded systems, such as cell phones

Small mobile devices are inherently limited in the amount of memory they can carry, thereby restricting what applications they can run.

"You will always have limited storage on mobile devices, because you want the device to be small and portable and very power-efficient," says Craig Mathias, principal at Farpoint Group, a wireless and mobile consultancy in Ashland, Mass., and a Computerworld.com columnist. "Memory compression can help in that regard, multiplying the efficiency of the storage you do have."

This summer, Tokyo-based NEC Corp. will release a new software memory compression technique called CRAMES (Compressed RAM for Embedded Systems) on its N904i cell phones. CRAMES more than doubles memory capacity while limiting power drain and performance loss to only 2.7%.

Memory compression technique more than doubles usable storage in embedded systems, such as cell phones.

The company's research arm, NEC Laboratories America Inc., began researching compression technologies eight years ago. In 2004, lab consultant Haris Lekatsas and department head Srimat Chakradhar decided to explore integrating compression into the operating system. CRAMES was developed by Lei Yang, a doctoral student at Northwestern University, along with her academic adviser, assistant professor Robert P. Dick.

"The idea was to transparently compress and decompress selected regions of memory to drastically reduce the memory footprint of embedded applications," says Dick. "By carrying out online compression and decompression entirely in software, hardware platform redesign could be avoided."

Dick says researchers had previously tried compressing software but rejected that approach because it drained power and hurt performance. The Northwestern team aimed to find a way to run applications that required more memory, but without the drain.

To manage compressed memory, the development team decided to use the Linux kernel's swapping mechanism to determine which pages should be compressed. Initially, they were able to reduce the drain to 10% using the established LZO compression algorithm. To further boost performance, the team developed a new compression algorithm called PBPM (Partial Based Partial Match). Other refinements include compressing data only when memory is low, modifying the memory management technology to reduce fragmentation and modifying the Linux kernel so it can eliminate defunct processes when necessary. Together, these steps held power drain and performance loss to 2.7%.

"Embedded system designers and especially designers of cellular phones and [PDAs] need to pack more functionality on the devices every year to remain competitive," says Dick. CRAMES has allowed NEC to pack in more functionality without waiting for the next cycle of hardware design to catch up with the new increasing demands on memory."

Firefox still vulnerable to attacks from protocol-handling bugs

Firefox remains vulnerable to attacks exploiting protocol-handling bugs, even though it was patched twice in July, a pair of security researchers said this weekend.

Billy Rios and Nate McFeters, who spelled out design and functionality vulnerabilities in Windows' Uniform Resource Identifier (URI) protocol handling as recently as mid-August, said Saturday that they have uncovered another way hackers could send malicious code to users via browsers.

"Once again, these URI payloads can be passed by the mailto, nntp, news, and snews URIs, allowing us to pass the payload without any user interaction," claimed Rios in a posting to his blog. "Although the conditions which allowed for remote command execution in Firefox 2.0.0.5 have been addressed with a security patch, the underlying file type handling issues which are truly the heart of the issue have NOT been addressed," he added.

URI bugs were a hot topic throughout July, when Norwegian researcher Thor Larholm showed how a browser could be tricked into sending malformed data from other applications. Although Larholm initially blamed Internet Explorer for the flaw, others quickly pointed out that Firefox suffered from the same bug. A finger-pointing debate ensued.

Rios and McFeters didn't divulge technical details of how an attacker could exploit the new-found URI flaws, saying that they are giving Mozilla Corp.'s security team time to plug the hole. However, they did post a screenshot that they said showed how they used the mailto URI -- the string used on Web pages that, when clicked, open up the user's default e-mail client with an address already inserted -- to eventually call up any desired malware.

Although Mozilla was not immediately available for comment Tuesday, the vulnerability could not have come as much of a surprise. In the 2007-027 security advisory -- one of two issued in the update to version 2.0.0.6 on July 30 -- Mozilla presciently noted that more bugs might be hidden in protocol handling.

"The Firefox 2.0.0.6 release contains fixes that prevent the original demonstrations of this variant, but it is still possible to launch a filetype handler based on extension rather than the registered protocol handler," stated the advisory. "A way to exploit a common handler with a single unexpected URI as an argument may yet be found."

For its part, Microsoft has repeatedly said that protocol handling problems are up to individual applications to address, not Windows itself. In August, Mark Griesi, a security program manager with Microsoft, told IDGNews that Microsoft was free of blame. "Security is an industry responsibility and this is certainly a case of that [principle]," said Griesi then. "It's not Microsoft's position to be the gatekeeper of all third-party applications." Microsoft modified documents on its MSDN (Microsoft Developer Network) site around the same time to reflect that stance.

Although some security experts said hackers would turn to these unorthodox attack tactics, no evidence of their use in the wild has yet surfaced.

Custom-built botnet steals eBay accounts

Online auction site eBay has been targeted by identity thieves, who are wielding a botnet that uses brute force to uncover valid account log-in information, a Tel Aviv-based security company said Monday.

The attacks against eBay Inc. may have started as long ago as early August, said Ofer Elzam. He said that he and other researchers at Aladdin Knowledge Systems Ltd. have not been successful in notifying eBay of their weekend findings.

According to Elzam, the product manager of Aladdin's eSafe threat-protection line, the brute-force attacks are launched by a large botnet that the identity thieves have built using a sophisticated, multistage campaign that begins with compromised legitimate Web sites.

"My best estimate is that there are at least 300 compromised sites," said Elzam, who noted that they are spread worldwide and in several languages. Two sites are based in Israel, he said, including a price-comparison Web site and another operated by one of the country's largest unions. Other sites identified in a search run with information provided by Elzam included scores of real estate Web sites in Florida and Massachusetts, and a Microsoft security message forum in Italian.

Seeding genuine Web sites with malware is nothing new, but the practice has been gathering steam this year. In June, for example, hackers launched a massive bot-building attack from more than 10,000 hijacked Web sites, most of them hosted in Italy.

"These sites are compromised by SQL injection vulnerabilities, and then IFrame attack code is inserted," said Elzam, describing a common method of hacking legitimate Web sites and infecting their visitors. "The IFrame code redirects visitors to other sites which host a Trojan," he added. The Trojan horse hijacks the PC and turns it into a zombie, or bot.

"This is a very sophisticated, very complex attack," Elzam claimed, ticking off obfuscation techniques, multipart malware downloads and encryption among the tactics used by the thieves.

The resulting botnet is being used to call an eBay application programming interface (API) with pairs of possible usernames and passwords, said Elzam. The API allows the Trojan horse-infected PC -- the bot -- to communicate directly with the eBay database using XML-formatted code. If the database contains the username-password pair, it responds, which the Trojan horse notes, then later transmits to a hacker controlled server.

With enough username-password combinations -- the brute-force part of the attack -- the criminals can uncovering a limited number of real credentials.

"Each bot may be using as few as six pairs of usernames and passwords" in an attempt to come in under the security radar of eBay, said Elzam. "I don't think that eBay is even aware of the attack. The distributed nature of the attack may make it look like a merchant sending confirmations to buyers," he said.

Although Aladdin pieced together the evidence only today, Elzam said that clues indicate it might have started in early August.

It's unknown what the identity thieves have done with stolen eBay log-ons. One eBay user, however, may have offered up a possibility today in a blog post.

"I woke up this morning to a nightmare," wrote a Texas-based book collector identified on his blog only as Sam Houston. "Someone in England hacked into my personal eBay data and changed it to reflect a completely fraudulent identity with an English mailing address. That person than proceeded to send out at least 25 e-mails to individuals in the U.K. who are trying to sell Sony laptop computers on the site. He offered them more than they are asking for the laptops and wanted them mailed to him as soon as possible."

According to the blogger, the attacker has also compromised his PayPal account and tried to pay for the 25 notebooks using funds from the checking account linked to PayPal.

Technorati : -built, Custom, accounts, botnet, eBay, steals
Del.icio.us : -built, Custom, accounts, botnet, eBay, steals
Ice Rocket : -built, Custom, accounts, botnet, eBay, steals
Flickr : -built, Custom, accounts, botnet, eBay, steals
Zooomr : -built, Custom, accounts, botnet, eBay, steals
Buzznet : -built, Custom, accounts, botnet, eBay, steals
Riya : -built, Custom, accounts, botnet, eBay, steals
43 Things : -built, Custom, accounts, botnet, eBay, steals

Money at your fingertips as digital payments hit German stores

For those who frequently arrive at the supermarket check-out only to find they have left their wallets at home, help is at hand.

A new system that scans customers' fingerprints and deducts the grocery bill from their bank accounts has taken supermarkets in southwestern Germany by storm and is being picked up by hardware stores, school canteens and even the country's ubiquitous beer gardens.

"Almost a quarter of our customers pay with their fingers," staff at the headquarters of the Edeka supermaket chain, which became the first retail business in Germany to use the new system, told AFP.

Edeka has installed the fingerprint payment system at 70 of its outlets and say some 200 others will soon follow because it has proven a hit with clients.

"At first we thought that only the young who really keep up with the latest technology would be interested, but we were wrong," said Stefan Sewoester from IT Werke, one of the pioneers of fingerprint payment software in Germany.

"Almost two-thirds of the people who use the fingerprint system are 40 and older."

IT Werke has furbished around 150 shops, canteens and pubs with fingerprint scanning machines at a cost of 2,000 euros (2,730 dollars) each.

To sign up for the service, customers must have their fingerprints taken and leave their addresses and banking details with the shop, who can then charge purchases directly to the client's bank account.

"It is a godsend for elderly clients because they do not have to remember their pin-code to pay with their bank cards, or to scratch around for their glasses or cash," Sewoester said.

Georg Meisberger from Globus Warehouse, a hypermarket in St. Wendel near the French border, said he had "customers well over 70 using the system."

The stores believe that it saves more than time in the check-out line because it also cuts out the hidden costs of accepting electronic cash card payments.

If an electronic payment "bounces" because there is not enough money in the customer's account, the bank can charge the shop up to 15 euros for supplying them with the customer's address.

Legal issues tied to fingerprint paying have nonetheless generated a few clouds on the horizon.

Retailers have mulled using the information they get from registered customers for advertising purposes, setting off alarm bells in a nation obsessed with privacy rights.

But a spokeswoman for the data protection authorities in the western state of North Rhine-Westphalia, Bettina Gayk, told AFP that the system posed no legal problems as long as it operated on a voluntary basis.

"As long as customers are free to take it or leave it, there is no legal impediment," she said.

"We naturally advise clients not to give out personal data unconditionally."

There are safety concerns too, however, as experts have pointed out that fingerprints can be forged with the help of silicon.

But Ulrich Binneboessel from the Confederation of German Retailers noted that the shops do not use a full set of fingerprints, making the information useless elsewhere.

And it is unlikely, he said, that thieves would painstakingly forge somebody's fingerprints just to buy bread and milk on his account.

"It is probably easier and more lucrative to empty out an ATM machine in broad daylight."

Fingerprint data profiling has long been used for to control access and for other security purposes in Germany's airports, laboratories and nuclear power plants.

IT Werke plans to keep refining the retail use of the system.

It wants to introduce fingerprint payment in school canteens with an additional feature that might appeal to parents -- they could disable their children's access to junk food