提高密碼安全性 FBI稱關鍵是長度

星島日報

電郵、社交平台帳號、購物網站、電腦等都需要密碼登入，惟簡單的密碼容易被破解，構成網絡安全問題。美國聯邦調查局（FBI）日前建議，與其用難以記住的複雜密碼，不如使用15個單字或以上的長密碼。

現時很多網站要求設置密碼時大多要求6至8個字，並須有大小楷加數字及標點符號。不過，密碼複雜，容易忘記，造成不便。FBI在官方網站的每周技術建議專欄撰文指，密碼的長度比複雜性更為重要。

文章指，相對於複雜的短密碼，由單字組成、至少15個字的長密碼更容易記，而且亦不容易破解，因為只要密碼長度足夠，黑客就需要花更多時間與運算資源才能破解，安全系數較高，建議機構或網站要求設置長密碼，以及不要提供密碼提示。

文章又指，密碼由沒有關聯的字組成會較為安全，例如「VoicesProtected2020WeAre」雖然已是一個安全密碼，但意思不明的「DirectorMonthLearnTruck」，安全系數更高。

In Desperation Move, IBM Buys Red Hat For $34 Billion In Largest Ever Acquisition

www.zerohedge.com

In what can only be described as a desperation move, IBM announced that it would acquire Linux distributor Red Hat for a whopping $34 billion, its biggest purchase ever, as the company scrambles to catch up to the competition and boost its flagging cloud sales. Still hurting from its Q3 earnings, which sent its stock tumbling to the lowest level since 2010 after Wall Street was disappointed by yet another quarter of declining revenue...

... IBM will pay $190 for the Raleigh, NC-based Red Hat, a 63% premium to the company's stock price, which closed at $116.68 on Friday, and down 3% on the year.

In the statement, IBM CEO Ginni Rometty said that "the acquisition of Red Hat is a game-changer. It changes everything about the cloud market," but what the acquisition really means is that the company has thrown in the towel on organic growth (or lack thereof) and years of accounting gimmicks and attempts to paint lipstick on a pig with the help of ever lower tax rates and pro forma addbacks, and instead will now "kitchen sink" its endless income statement troubles and non-GAAP adjustments in the form of massive purchase accounting tricks for the next several years.

While Rometty has been pushing hard to transition the 107-year-old company into modern business such as the cloud, AI and security software, the company's recent improvements had been largely from IBM’s legacy mainframe business, rather than its so-called strategic imperatives. Meanwhile, revenues have continued the shrink and after a brief rebound, sales dipped once again this quarter, after an unprecedented period of 22 consecutive declines starting in 2012, when Rometty took over as CEO.

While some of the decline has been from divestitures, most is from declining sales in existing hardware, software and services offerings, as the company has struggled to compete with younger technology companies.

The good news for IBM is that the Red Hat purchase, the largest in the company's history, will give IBM an immediate cloud revenue boost growth as well as a suite of proven software products to sell through its global sales force. “We will scale what Red Hat has deeply into many more enterprises than they’re able to get to,” Rometty told Bloomberg.

That growth, however, will come at an extraordinary price, one which shareholders may have a tough time justifying.

Furthermore, while Red Hat is expected to report an all-time high $3 billion in revenue as the company’s Red Hat Enterprise Linux product attracts business from large customers - after booking a record 11 contracts valued at over $5 million each and 73 over $1 million, according to JMP Securities - even here growth may be stalling out after last quarter overall revenue missed analysts’ expectations and the forecast for the current quarter also fell short, "fueling concerns Red Hat may be losing deals to rivals" according to Bloomberg. While Red Hat said at the time it believes the slowdown has "bottomed out", its stock is down 28% over the past six months through Friday.

The bad news is that in its desperation for growth at what amounts to be any price, IBM is almost certainly overpaying for Red Hat. This was confirmed by Rometty's preemptive defense, telling Bloomberg that IBM "paid a very fair price. This is a premium company. If you look underneath, this is strong revenue growth, strong profit strong free cash flow" she said, adding that IBM will not cut jobs as a result of the deal: "this is an acquisition for revenue growth, this is not for cost synergies."

Perhaps, but the bigger question is what the deal means for IBM's balance sheet. In the press release, IBM said that "the company has ample cash, credit and bridge lines to secure the transaction financing. The company intends to close the transaction through a combination of cash and debt." In other words, no IBM stock, which is already at the lowest level this decade.

So let's do the math: IBM ended Q3 with cash of $14.7 billion, and a record $46.9 billion in debt. Which means that IBM will likely incur at least $20 billion in additional debt, and as a result IBM's already shaky A+/A1 rating could soon be downgraded to BBB.

So what is IBM buying for this $34 billion and $20 billion in debt? According to its LTM financials, Red Hat has $3.2BN in revenue and $603MM in EBITDA. These numbers are expected to grow to $3.9BN by 2020, when EBITDA will hit $1 billion. In other words, on an EV basis, IBM is paying roughly 31x (net of $2.2BN in cash) Red Hat's 2020 forward EBITDA.

Of course, if one assumes continued EBITDA growth for the foreseeable future, this acquisition could make sense. The problem is that between the threat of a recession in the next few years, and aggressive competition from Amazon, Microsoft and others for cloud market share, this is a very aggressive assumption.

Meanwhile, in exchange for this $1 billion in EBITDA, IBM's net debt will grow from $32.5 billion currently to $52 billion, almost doubling IBM's net leverage from 1.7x level to a whopping 3.2x, and well on its way to a BBB rating if not worse. Which is why IBM promise that it will "target a leverage profile consistent with a mid to high single A credit rating" is, with all due respect, laughable.

But the worst news for investors may have nothing to do with the massively overpriced acquisition, and with something that IBM noted deep inside its press release:

The company intends to suspend its share repurchase program in 2020 and 2021.

Considering that the only factor that has kept the IBM stock price elevated in the past decade as IBM's diluted number of shares outstanding declined by 40%, was the company's buybacks...

... most investors may finally have no choice but to bail on "Big Blue" - which after the Red Hat deal may be renamed "Big Purple" and leaving shareholders with at least one blackened eye - as the company bets everything on what may soon prove to be another disastrous gamble.

騰訊為一個網域名擾攘8年 你估叫乜？

on.cc東網專訊

以QQ通訊起家的騰訊(00700)為了1個網域名，擾攘達8年，終於在最近打贏了官司，取得有關網域名的擁有權。

內媒報道，騰訊最新取得的網域名稱並非傳統的qq.net、qq.cn之類的網域名，而是名為「fuckqq.com」的域名，該域名已存在8年之久。

在2010年，騰訊QQ與奇虎360互相指責對方不公平競爭，奇虎針對騰訊QQ先後發布360隱私保護器和360扣扣保鏢，並稱其可以保護QQ用戶的隱私和網路安全。騰訊亦隨後宣布，在裝有360軟件的電腦將不能執行QQ軟件。

兩家公司口水戰之際，網上出現名為fuckqq.com的網域名稱，如果在瀏覽器輸入該域名，會自動跳轉至360官網。市場因而估計事件涉及360。惟遭360CEO周鴻禕否認。中國監管機關不久介入，360與騰訊最終和解收場，但fuckqq.com始終一直存在。據悉，其每日瀏覽量一度達5萬。

及至2017年底，有網友在微博公開承認fuckqq.com是其所為。

騰訊在今年3月中投訴亞洲域名爭議解決中心香港秘書處，要求針對域名fuckqq.com發起仲裁。經亞洲域名爭議解決中心裁決，騰訊申訴獲得爭議域名fuckqq.com所有權。

目前連上fuckqq.com可看到原註冊人徐賢標的聲明，表示他輸fuckqq.com仲裁案，收藏10年的域名所有權由騰訊獲得。

網絡綁架肆虐 港府推抗勒索軟件運動

on.cc東網專訊

生產力促進局及政府電腦保安事故協調中心、與國際知名資訊科技及保安公司合作，包括思科及微軟，推出為期1年的「齊抗勒索軟件運動」，協助香港企業及公眾加強防範網絡攻擊。活動重點項目是在社交媒體Facebook設立勒索軟件情報站，與公眾分享勒索軟件的最新情報和分析、保安警示等。活動亦會向公眾提供，4種適用於不同系統的免費實時防惡意軟件工具，並向學校及中小企提供培訓。

生產力促進局總經理(資訊科技及業務流程)黃家偉表示，社交媒體傳播資訊速度快，希望在勒索軟件攻擊發生的初期，透過及早發放的相關情報和保安建議，減低攻擊造成的影響。

加密勒索軟件攻擊近年成為香港網絡安全新威脅，生產力促進局屬下香港電腦保安事故協調中心，前年接獲50宗勒索軟件攻擊報告，並出現上升趨勢，去年及今年首8個月分別接獲309宗及140宗勒索軟件攻擊報告，當中涉及早幾個月攻擊香港的WannaCry個案佔40宗。黃家偉表示，如果WannaCry的攻擊未有及早制止，情況會更嚴重。

黃家偉提醒，勒索軟件出現新趨勢，稱不單電腦，連外國亦出現手提電話勒索軟件，威脅使用者如不給贖金，就會對外公開手機內的所有資料，雖然香港未有相關個案，但擔憂之後會蔓延至香港。

他又指，有些使用者連防火牆都沒有安裝，希望活動能提高市民人士防範意識，亦呼籲市民除安裝防惡意軟件工具和防火牆，亦要備份數據並離線複製。

Android 8.0命名為Oreo 新增9大功能

on.cc東網專訊

在美國市民正陶醉於觀賞日全食之際，Android 8.0正式版同時向外發布，名為Android Oreo（奧利奧），簡稱Android O。而新版並將很快推送給Pixel和Nexus設備。而Alphabet公司形容Android O新系統的新特性包括安全功能增強，以及作業系統變得更智能和更強大等等。基本而言，共新增了9大功能。

是次Android 8.0正式命名為Android Oreo（奧利奧），市場揣測Alphabet和奧利奧是否將會大規模生產這種特殊版Android Oreo餅乾，幾年前發布Android KitKat系統時也曾生產過Android KitKat朱古力，怎也是一種商機。

據了解，第一批支持Android 8.0的產品自然是Alphabet自家生產的智能手機品牌，包括Pixel、Pixel XL、Pixel C、Nexus 6P、Nexus 5X以及Nexus Player。除了這些嫡系，其他手機品牌相信也會以最快的速度跟進。

Android 8.0比Android 7.0在人工智能等方面有了更大的提升。如果說Android 7.0注重系統上的自身強化，以加強流暢性、穩定性為目的。那麼，Android 8.0在保證原有基礎上，又加強了對系統「大腦」等方面的強化。

綜合而言，Android Oreo能讓你的手機獲得超能力：更快、更強、更智能。同時也會更省電、更安全。而升級Android Oreo後，你的手機會擁有以下九大新增功能:

Android Oreo九大功能

1.畫中畫
使行動裝置能一邊執行應用程式，一邊播放影片。

2.即時取用應用程式
不需下載即可使用的原生應用程式。

3.通知小圓點功能
通知功能有了新提升，當應用軟件有了新的通知推送，圖標上就會出現一個小圓點Notification Dots，看到它以後可長按應用，會出現快速預覽功能，非常快捷方便。

4.自動填寫
可在個別app中自動填寫表單。

5.使用「尋找我的設備」進行遠端定位、鎖定和移除。

6.Play Store保護
主要用於Play Store中，排查下載的應用和遊戲中是否有害或者攜帶病毒。

7.智能選項
這是一個智能化功能，俾如，如果你想邀請朋友來家晚飯，系統會根據你發送地址，開啟地圖並導航。

8.字體優化
增加了對系統字體的支持，開發者可以自行更改字體樣式，讓用戶有了更多字體的選擇。

9.全面翻新表情符號
為了面對iOS的emoji，Android新版增加超過60種圖案。

以上就是目前Android 8.0新功能盤點，其中很大一部分功能的提升很實用，只是目前只有部分Android系統機款能率先使用吧!

變種Petya侵全球 港發出極度危險警報

on.cc東網專訊

繼勒索軟件WannaCry後，由Petya病毒變種的加密勒索軟件正快速散播。香港生產力促進局屬下的香港電腦保安事故協調中心，今日就「Petwrap(Petrwrap)/NotPetya」加密勒索軟件發出嚴重性為「極度危險」的警報。協調中心表示，名為Petwrap(Petrwrap)，或Petya，或NotPetya，或Nyetya的勒索軟件正於海外廣泛散播，中心指，病毒有多個不同名稱顯示，業界仍在爭論該勒索軟件是否與另一勒索軟件Petya有關。

協調中心表示，新軟件利用與WannaCry相同的攻擊手法，針對SMB v1.0漏洞。有報告指該勒索軟件透過釣魚電郵散播，受感染的系統會先在區域網內散播，然後再加密本機數據。

變種的病毒攻擊途徑，包括WannaCry所利用的漏洞EthernalBlue、視窗管理軟件Psexec，以及視窗元件WMI-Windows Management Instrumentation。

受影響的主要為視窗系統，包括會加密受害者電腦上的masterboot record (MBR)。中毒的電腦會於1小時後重新啟動，由於MBR已被破壞，電腦會顯示勒索訊息，無法正常啟動，而被病毒加密的數據將無法還原，病毒亦會散播至區域網內其他電腦。

協調中心指，解決方案包括安裝最新的保安更新程式，確保已設置防火牆或寬頻路由器沒有開放SMB服務(技術上要關閉TCP 139和445端口)；安裝防毒軟件或互聯網保安應用程式，並更新病毒資料庫；進行離線備份；不要打開任何可疑電郵內的連結或附件；確保電腦已有基本保護包括啟用及執行視窗更新、安裝已有最新病毒資料庫的防毒軟件及啟用視窗防火牆。生產力促進局今日下午召開記者會交代事件。

Hackers Unleash Second NSA-Developed Cyber-Weapon On Dark Web

www.zerohedge.com

While a second variant of the WannaCry(pt) ransomware (based on NSA's EternalBlue exploit) was spreading across the globe yesterday, The FT reports criminal hacking groups have repurposed a second classified cyber weapon stolen from US spies and have made it available on the so-called dark web.

On Monday, the WannaCry attack, which hit 370,000 computers across 150 countries, appeared to slow. Europol, the European police agency, said the spread of the virus had stalled in Europe. But while infection rates have slowed, a Europol spokeswoman warned, "we do not think this is the end of the crisis. 

The hackers have already evolved the malware, and will probably continue to do so."

Notably as Europe woke up (and US opened), the infection rate started to rise once again...

But as The FT reports, intelligence and law-enforcement officials said they fear WannaCry may foreshadow a wave of similarly damaging attacks, as criminals and others race to make use of digital weapons that for years were only available to the most technologically sophisticated nation states.

At least a dozen other NSA tools are currently being discussed and worked on as the basis of potential new cyber weapons on hacking forums on the dark web, parts of the internet not accessible via normal search engines.

The hacking tool, developed by the US National Security Agency and called EsteemAudit, has been adapted and is now available for criminal use, according to security analysts.

As with the NSA’s EternalBlue, the tool on which WannaCry was based, EsteemAudit exploits a vulnerability in older versions of Microsoft’s Windows software in the way in which networked machines communicate with each other.

Ciaran Martin, director of the UK’s National Cyber Security Centre, said:

“There is a global ecosystem of cyber criminals and sophisticated hackers which are putting a lot of attack methodology into open-source.

“It gets modified and reused and upgraded. The volume of open-source exploits and that ecosystem are getting bigger.”

This is far from over.

黑客勒索肆虐 電腦保安協調中心籲三招防禦

on.cc東網專訊

因應包括中港台在內的全球多個地方電腦用戶，懷疑遭受「WannaCry」加密勒索軟件攻擊，香港電腦保安事故協調中心發出警報，指該勒索軟件極具侵略性，它會透過網絡掃描開啟微軟SMB服務的電腦，然後作出攻擊，呼籲電腦用戶立即採取三招防禦，包括執行Windows Update，安裝Microsoft安全公告MS17-010保安修補程式、使用防火牆保護網絡，不要暴露SMB服務，以及備用數據，並保留離線拷貝。

協調中心已和微軟公司方面聯繫，留意事態發展，得悉微軟亦因應今次大規模攻擊採取行動，包括為所有客戶提供額外安全更新，保護並擴展至Windows XP、Windows 8和Windows Server 2003的Windows平台。而今次攻擊並針對Windows 10，只要有下載3月份安全更新已可有效防禦，微軟呼籲用戶盡快升級至Windows 10，以確保保安措施是最新版本。

微軟公司亦指，這次網絡攻擊已影響數個區域的不同行業，公司的安全團隊已採取行動保護客戶，並已增修最新偵測與防護功能，以避免新的勒索軟件威脅(例如病毒軟件 Win32.WannaCrypt.)。

Android有望超越Windows 成全球最流行作業系統

on.cc東網專訊

外媒報道，流量監測機構StatCounter報告指，據今年2月資料顯示，Google的Android正超越微軟的Windows，有望成為全球最流行的作業系統。

StatCounter統計了桌上型電腦、筆記型電腦、平板電腦及流動裝置的最新資料，與2012年相較，Android市佔率大幅提升，主因是Windows市佔率下降。

在2012年，Windows在作業系統市場的市佔率達82%，當時Android的市佔率只有2.2%。及至目前，Windows的市佔率已急跌至38.6%，而Android的市佔在5年間則升至37.4%，與Windows市佔相差無幾。按現時趨勢，Android取代Windows成為最流行的作業系統指日可待。

Android市佔率勁增主要受惠於智能手機的普及，而搭載Windows系統的傳統PC銷量卻一直下滑。另亞洲市場對Android佔有率的提升又有直接作用。

對微軟而言，透過收購諾基亞(Nokia)的手機業務，以推動流動裝置Windows系統的策略不成功。雖然Windows目前仍在PC市場佔據領先地位，但在流動作業系統市場上則已錯失發展良機。

Messenger推50人群組視像 不再限1對1

on.cc東網專訊

【on.cc東網專訊】 新世代講求最緊要快同方便，近年愈嚟愈多手機應用程式推出視像通話功能，無論用家身在何處都可以與千里外的親朋好友見面！耐何大多數App都只可提供一對一視像通話，要傾大Project就要用返Skype，局限性大，facebook就睇中呢個市場，決定即日起係Messenger推出群組視像通話，搶奪市場佔有率，最多可以50人一齊玩！

新功能可以點用？首先用戶必須把安裝手機上的Messenger更新至最新版本，開啟現有對話群組，或建立全新對話群組，再按畫面加上方的影片圖案，便可進入視像通話，而群組內所有用戶都會接收到通知，用戶便可選擇與全組或部分用戶視像通話。新功能每次最多可以有6名用戶見樣，同時最多50名用戶同時聆聽及透過聲音加入，或輸入文字、貼紙、emoji或GIFs參與對話。