Señores el Nintendo Wii no se hara hasta el año que viene

Según analistas, las consolas Wii de Nintendo estarán agotadas hasta 2008.

En el marco de la presentación de "Nintendo Summit", analistas de Lazard Capital Market concluyen que la popular consola Wii estará agotada durante mucho tiempo más.

Lazard Capital Market ha analizado las cifras de venta de una serie de grandes compañías, entre ellas GameStop, a la luz de las declaraciones de Nintendo, en el sentido de la compañía pronto alcanzará su objetivo de producir 1,5 millones de unidades mensuales.

Aun así, los índices de demandas superarán a la producción, por lo que no veremos consolas Wii en los escaparates de las tiendas hasta 2008, pronostica el analista Colin Sebastian de Lazard Capital.

Se agradece a diarioTi.

Technical Advances Make Your Passwords Practically Worthless

RESUME

Passwords are supposed to be kept secret, but due to continuing advances in technology, they are becoming weaker every day. The threat has grown to the point where using a password as the sole form of authentication provides you with almost no protection at all. Randy Nash outlines the dangers facing passwords and suggests some additional measures needed to protect even ordinary digital assets.

Your password is a form of authentication, or identification, used to control access to a given resource. Passwords are supposed to be kept secret, thereby controlling access to important information. But due to continuing advances in technology, passwords are becoming weaker every day. The threat has grown to the point where using a password as the sole form of authentication provides you with almost no protection at all. Cracking a password has become a task that can be accomplished in minutes instead of weeks or months. Additional measures need to become commonplace now to protect even ordinary digital assets.

Why Your Password is at Risk

Your password is used to identify you and provide access to your computer resources. It is a form of authentication that is necessary to determine what rights you have within a system. Digital authentication is generally broken down into three classifications:

• Something you know: your password, a pass phrase, or your PIN number.
• Something you have: a security token or a smart card.
• Something you are: biometrics (such as a fingerprint or a retinal scan).

When used as the sole form of authentication, passwords are generally considered the weakest form of authentication. Why? Let's face it; most folks tend to get lazy with their passwords:

• They devise simple passwords, such as the names of their pets or the names of their favorite sports teams.
• They use the same password for multiple systems.
• They write their passwords on sticky notes and stick them next to their computers.

Once your password is no longer secret, it no longer uniquely identifies you – which means it no longer protects access to your valuable information. Unfortunately, even if you do protect your password, there are other ways of obtaining it.

Sniffing Around in Your Data

Bad guys can sniff passwords as they are transmitted over the network by using specialized hardware or software that allows them to access network traffic as it's transmitted over the wire.

Sniffing can provide direct access to passwords if they are transmitted in the clear (without some form of encryption). Even today there are many technologies, applications, and protocols that transmit this sensitive information in clear text without any form of protection. Some examples are:

• Websites (HTTP)
• Email (POP)
• Telnet and FTP

By sending this authentication in clear text, it is immediately available for exploitation without any further level of effort.

Encryption: Speaking in Tongues

One method of protecting passwords is to apply cryptography to encode the password so it cannot be observed in a readable form. There are many different methods of encrypting passwords, each with varying levels of protection and security. Some more commonly used examples are:

• Windows LAN Manager and NT LAN Manager hash (LM and NTLM): NTLM is a Microsoft authentication protocol that uses a challenge-response sequence requiring the transmission of three messages between the client and the server.
• NTLM v2: An updated version of NTLM that addresses weaknesses in the original implementation.
• Kerberos: Kerberos is a network authentication protocol that allows individuals communicating over an insecure network to prove their identity to one another in a secure manner.

Each method works by simply applying a one-way cryptographic algorithm to the password, which creates an encrypted hash. In simpler terms, the algorithm is a form of very complex math that is used to create an encoded version of your password (a password hash). There is generally thought to be no way to mathematically reverse the math to get the original password from the encrypted hash, thus it is considered a one-way process. This encrypted hash can still be sniffed from the network, but it cannot be used in the encrypted form.

Passwords are usually stored in a local system database. This is necessary to allow the system a method of verifying passwords when a user is trying to gain access. These passwords are usually stored in an encrypted form based on the cryptographic hash previously discussed. Unfortunately, this database represents the proverbial pot of gold for anyone wishing to gain access to your information systems.

Various computer operating systems store their passwords in some well-known standard locations. Many Unix systems store their passwords in the location \etc\passwd, whereas Windows stores them in a local security accounts manager (SAM) database. If attackers gain access to these files, they can easily launch attacks against this cache of information in their efforts to obtain (or crack) the passwords.

Attacking with Dictionaries and Brute-Force

Password attacks have taken many forms, the first of which was probably as simple as trying to guess passwords. The simplest form of guessing passwords was accomplished by manually attempting to log into a computer system and taking your best guesses at the password. Many people choose simple passwords that are easy for them to remember – but that makes them easy for others to figure out as well.

People may also forget or neglect to change default system or account password. A quick Google search for default passwords provides extensive listings of default passwords for various systems. Manual password guessing is very slow and tedious, and is further complicated by the fact that many computer systems lock out an account after a number of failed login attempts. The bad guys have reacted to this challenge by automating their password-cracking attacks.

But how is guessing automated? There are two common methods of automated guessing:

• Dictionary
• Brute-force

A dictionary attack uses a dictionary of common words and names as the source for guessing passwords. Again, many people choose simple passwords that are easy to remember. This means they will choose common words, names, places, and so on. Dictionaries have been created using these common words and they are available for download and immediate use.

A brute-force attack is a little more complex and can take much longer to execute. In simple terms, a brute-force attack attempts all possible character combinations until if finds a match. This total number of combinations is referred to as the keyspace. To know how many possibilities need to be calculated, we need to take the number of allowable characters (y) raised to the power of the password length (x) in the form of y^x. As an example, let’s look at using just uppercase alphabetic characters to create an eight-character password. The following example shows 26 characters raised to the power of 8:

uppercase alphabet	26
password length:	8
keyspace (268)	208,827,064,576

Now, what happens if we expand this to all possible characters on the standard keyboard? That’s 96 characters:

All characters	96
password length	8
keyspace (968)	7,213,895,789,838,340

As the possible character set is increased, the potential number of combinations increases exponentially. This means the computational time to crack these passwords increases in proportion. NIST Special Publication 800-63 provides excellent discussion on password strength and how it is affected by the password attributes (password length and possible character sets).

So, realistically, how long might it take to crack some of these passwords using a brute-force attack? Instead of recreating all the math and scenarios here, I’ll refer you to an article (How Long Does It Take to Crack Passwords?) that provides a detailed explanation of the time breakdown. According to this article, it would take up to 2.1 centuries to evaluate the entire keyspace associated with an eight-character password (based on the entire character set on a standard keyboard). Taking a couple of centuries to crack a password is of no value to anyone. This was an obvious weakness to the brute-force attack, so the bad guys developed new techniques, including distributed computing and Cryptanalytic Time-Memory Trade-Off.

Using Distributed Computing to Become Faster

One of the first attempts at developing faster attack methods was the use the distributed computing model. There are many well-known examples of this technique, such as SETI@Home and Folding@Home. These projects make use of a screen saver that uses dormant computer cycles to perform complex calculations. This concept was also used in the creation of a distributed password cracker known as distributed john or djohn. An excerpt from that site explains the process:

"With Distributed John (djohn) you can crack passwords using several machines to get passwords sooner than using a single machine. The cracking in itself is done by John the Ripper and djohn's server (djohnd) divides the work in work packets and coordinates the effort among the clients (djohn), which are the ones who do the work."

This approach gave hackers almost unlimited cracking power. They were limited by only the number of computers that could be assigned to the task.

(e)Using Cryptanalytic Time-Memory Trade-off to Become More Efficient

Eventually the idea arose that these lengthy calculations need not be done repetitively. In other words, why do the same task over and over? Why not do it one time and save the results for re-use? This concept eventually led to the concept of Cryptanalytic Time-Memory Trade-Off. I don’t have the space here to discuss the concept in any depth, but it needs to be mentioned because it later led to the implementation of Rainbow Tables for password cracking. Rainbow tables use generated password hashes stored in a lookup table. Thus, they need to be created only one time and then stored for future use. But again, there are difficulties with this approach:

1. There is still a huge time requirement for creating the tables. This has again been addressed with the application of distributed processing for Rainbow Tables.
2. The storage requirements for this sort of project are immense (on the order of hundreds of gigabytes). Until recently, this would have been very cost prohibitive. Now, however, it’s possible to buy half-terabyte drives for slightly over $100.

What Threats Lie Ahead?

As technology improves and new ideas take hold, risk will increase accordingly. Some of the biggest threats include:

• Moore's Law: Moore’s Law states the number of transistors on a chip doubles about every two years. This leads to faster and more powerful CPUs, which will be used to perform calculations ever faster. We also have dual-core processors which multiply the processing power that can be applied to this task. Intel has even boasted about the development of an experimental 80-core CPU. While this isn’t available today, it is expected to be available within five years.
• High-end graphics cards: Today’s graphics cards are composed of multiple core processors and loaded with their own RAM. ATI and nVidia have each released development kits which allow for the development of programs that can leverage these powerful processors.
• Gaming consoles: Even more powerful than the high-end graphics cards are the PlayStation 3 gaming consoles. These systems are now internet-connected and provide even more powerful processing power. This technology has already been applied to the Folding@Home projects. A comparison of performance can be seen here. A quick glance shows the power of these two platforms in comparison to the various PC platforms. It’s only a matter of time before these techniques are applied to password cracking and other crypto-based tasks.

What’s the Next Line of Defense?

I think it's clear that the next step should be the implementation of some form of two-factor authentication. While there are many ways to accomplish this, the cheapest and most cost effective way is to distribute tokens such as the RSA SecurID. This is one of the better-known solutions and may not be cost effective for small operations. However, Paypal recently implemented a similar solution (Paypal Security Key) that they are providing to customers for a one-time fee of $5 USD.

There are other methods and products as well, but businesses and government alike should begin evaluating their options. The threat is growing every day, and soon a password alone will not provide sufficient protection.

Conoces la herramienta SAGU

Aqui unas cuantas informaciones para que actualices tus conocimientos

SAGU es un acrónimo portugués para "Sistema Aberto de Gestão Unificada", que en español sería "Sistema Abierto de Gestión Unificada". SAGU fue originalmente diseñado para automatizar la relación entre el estudiante y su establecimiento educativo. Esta relación ocurre en distintos niveles: administrativo, académico y financiero, y SAGU posee distintos subsistemas o modulos dedicados a cada uno de estos niveles.

Debido al desarrollo modular y libre de SAGU, éste puede adecuarse a cualquier Institución Educativa.

SAGU está desarrollado en PHP y PostgreSQL y su servidor corre en un sistema operativo GNU/Linux. El cliente, en cambio, desde cualquier browser (Netscape, Internet Explorer, Konqueror, etc) y cualquier sistema operativo. SAGU es autorizado bajo el GNU/GPL..



SAGU comprende los siguientes módulos principales:

* Vestibular
Maneja el proceso de examen de ingreso, donde el estudiante tiene el primer contacto con el Establecimiento Educativo. Brinda clasificación del alumno, distribución de aulas, diferentes opciones de matriculación y un sistema de matriculación por Internet.

* Sistema Académico
Este módulo está orientado a la graduación, escuela secundaria y módulos de extensión. Maneja información relativa a las clases de los alumnos, calificaciones, profesores asignados, distribución de las aulas, horarios, etc.

* Sistema Financiero y de Contabilidad
Sistema de gestión de cuentas, que maneja los pagos realizados por los alumnos y proporciona varios reportes contables. También proporciona interfaces a los sistemas de contabilidad externos. Finalmente, este sistema maneja los créditos y seguros del estudiante.

* Recursos Humanos
Interfaces con el sistema de nómina externo y verificación de las relaciones existentes al momento de asignar un maestro a una clase y permite al estudiante o empleado retirar libros de la biblioteca de la Institución.

* Herramienta para la Generación de Reportes
Como los usuarios siempre están pidiendo diferentes tipos de reportes, SAGU tiene su propia herramienta para la generación de reportes, para crear todas las clases de documentos. Esta herramienta utiliza la psLib (también desarrollada por el equipo SAGU), una librería muy hábil para la generación de documentos PostScript.

Aunque SAGU fue desarrollado originalmente para ser un sistema para Instituciones Educativas, su base de datos transaccional permite fácilmente adaptar su estructura para desarrollar nuevos sistemas de dirección. "

Adobe revela beta público de ColdFusion 8

El beta público de ColdFusion 8 es un adelanto con todas las funciones, que permite a los desarrolladores experimentar la simplicidad al construir aplicaciones de Internet.

Adobe Systems Incorporated anunció el beta público del software Adobe ColdFusion 8. La solución diseñada para desarrolladores que construyen sitios Web dinámicos y aplicaciones de Internet, integrándose a ambientes empresariales complejos.

ColdFusion 8 permite a los desarrolladores diseñar y desplegar aplicaciones ricas y atractivas integrando ambientes complejos a interfaces intuitivas. El nuevo ambiente de desarrollo de ColdFusion 8 presenta guías y “debugging" avanzados basados en Eclipse.

“Los desarrolladores estaban ansiosos de ver ColdFusion 8 desde MAX 2006", comentó David Mendels, vicepresidente senior de Soluciones Empresariales y de Desarrollador en Adobe. “Este es el primer lanzamiento de ColdFusion bajo la marca Adobe, y ahora los desarrolladores pueden integrar sus aplicaciones ColdFusion con otras tecnologías de Adobe como Flex, Apollo, LiveCycle y hasta PDF para una mayor evolución de características atractivas en la Web".

El spam con imágenes desborda los buzones de entrada

La compañía de seguridad informática McAfee indica que el spam con imágenes se está convirtiendo en la mayor amenaza contra los usuarios de computadoras personales. Este tipo de correo no solicitado representa la mitad de todo el spam recibido a nivel mundial.

Según las estadísticas más recientes de McAfee, el spam basado en imágenes representa actualmente la mitad de todo el correo electrónico masivo no solicitado. Esto representa un fuerte incremento respecto de 2005, donde el spam con imágenes representaba el 5% del total. El spam con imágenes se asemeja al spam corriente, pero en realidad se trata de archivos JPG o GIF con texto. El truco es que los filtros anti-spam no logran "leer" las imágenes, con lo que el texto incorporado en ellas es invisible para el software de seguridad.

Adicionalmente, independientemente de que el spam no es detectado por los filtros, éste tiene la molesta consecuencia adicional de que los archivos con imágenes ocupan más espacio en el disco duro del destinatario, a la vez que recargan Internet y los recursos de banda ancha.

"El spam con imágenes es usado indistintamente por ciberdelincuentes y por empresas establecidas aunque inescrupulosas. Ofrecen acciones dudosas, préstamos baratos o títulos profesionales falsificados. Es difícil bloquearlas ya que son enviadas a un gran número de usuarios en un corto período de tiempo. En realidad, tienen un negocio bastante lucrativo", declaró Daniel Kollberg, director de McAfee.

Con el paso del tiempo se han desarrollado distintos métodos para contrarrestar la acción del spam con imágenes. Sin embargo, los distribuidores de spam constantemente inventan nuevas formas de proteger sus imágenes, acompañando por ejemplo, las imágenes con textos serios, cambiando el nombre de los archivos, usando distintos renglones de asunto, o aplicando distintos matices de gris.