Archive for September 13, 2011

Your Desk is Killing You

Your Desk is Killing YouThere is a growing body of that evidence that your desk is killing you. Research suggests that sedentary office workers and other inactive people are at a relatively high risk of dying early. MIT‘s Technology Review reports that sedentary people have higher levels of biomarkers linked to cardiovascular disease, including insulin, glucose, and triglycerides.

Research in animals has shown that levels of an enzyme that is responsible for breaking down fat plunge when they are forced to be inactive. The article says that intensive exercise doesn’t affect the fat-metabolizing enzyme. So even daily workouts won’t necessarily protect people who spend eight hours a day sitting at a desk.

Few firms have tried to figure out ways to make office work less sedentary. “For most people with indoor office jobs or doing lot of driving, work is really the biggest chunk of sedentary time during the day,” Neville Owen, professor of health behavior at the University of Queensland, Australia told Technology Review. The average American spends about 10 hours a day sitting, and the problem is getting worse.

Choose between sitting at your desk and standing during the day

The Professor’s team is beginning a clinical study in which office workers are given adjustable desks. They let the workers choose between sitting and standing throughout the day. These desks are growing in popularity. However, they cost about $1,000 each, employers want to know if they really work.

TR reports that participants in the study will wear meters. The meters will measure their activity levels to find out if the expensive desks reduce sitting time. The researchers will also measure the participants’ markers of cardiovascular disease. They will see if the levels of glucose, insulin, and triglycerides are impacted by the changes in their habits. “We will also look at participants’ perception of their own energy levels,” says Professor Owens.

Change workplace culture

Another approach to the problem being studied is to make it more acceptable to walk around while at work. According to the article, Ken Smith, a researcher at the Stanford Center on Longevity is working on a pilot project at a call center in California. “We want to explore cultural changes in the workplace that make it OK to stand in a highly sedentary environment like a call center, where it might be frowned on to walk around, or not even possible,” he says. “Part of the study will be to look at the impact on productivity.”

Walking at workTargeting inactivity on the job may prove easier to carry out than getting people to exercise according to the article. “A lot of the workplace wellness is around discretionary exercising,” says Professor Owen. “… Workplace sitting is more integral, more structural. It largely has to do with workplace design and giving options for adjusting sitting and standing.”

Meanwhile, the most common advice from physiologists is to get up as much as possible: go get a drink, do a quick stretch, or walk over to see a colleague rather than sending an e-mail.

rb-

I wrote about this issue here. Other research has shown that physical activity and exercise can benefit employers because it

• Improves attention, focus, memory, and reading retention
• Improves brain function making it ready to learn and absorb new information
• Increases executive function at work
• Reduces stress and anxiety

Related articles

What do you think?

Does your organization support physical activity during the work day?

View Results

Loading ... Loading ...

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Remember

09-11-2001

 

Remember 9/11

 

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Adobe Flash Still Full of Holes

Adobe Flash Still Full of Holes

I wrote about Adobe’s (ADBE) problem with writing secure software earlier. The problems still exists according to an article in Help Net Security. The article lays out claims by Google (GOOG) researcher Tavis Ormandy that he notified Adobe of some 400 holes in  Flash Player. According the the article, Adobe fell short on the latest Flash patch. In the article Mr. Ormandy claims that Adobe’s latest release of Flash:

  • Only patched 13 fixed holes in the application, failed to document other holes; and
  • Did not give credit to those that found the bugs using a technique called fuzzing to reveal the bugs.

the Google researchers wrote on their blog, “The initial run of the ongoing effort resulted in about 400 unique crash signatures, which were logged as 106 individual security bugs … each crash was treated as though it were potentially exploitable and addressed by Adobe. In the final analysis, the Flash Player update Adobe shipped earlier this week contained about 80 code changes to fix these bugs.”

Adobe Flash Still Full of Holes

Help Net Security notes that after an initial silence on the matter, Adobe told Computerworld, that Mr. Ormandy had reported some 80 bugs in Flash Player, but defended their decision to not list all the vulnerabilities in the released security bulletins by saying that it usually doesn’t reveal or mention vulnerabilities found internally – by them or their partners. Also, the question is whether all those 80 flaws would lead to an exploitable hole. It seems that Adobe believes that only holes get a CVE number.

Related articles

What do you think?

Is Flash still worth it?

View Results

Loading ... Loading ...

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow him at LinkedInFacebook and Twitter. Email the Bach Seat here.

Malware in Text

A team of security researchers has engineered a way of hiding malware in sentences that read like English language spam. The research led by Dr. Josh Mason of Johns Hopkins University along with Dr. Sam Small of Johns Hopkins, Dr. Fabian Monrose of the University of North Carolina, and Greg MacManus of iSIGHT Partners outlined the threat in a paper English Shellcode (PDF) presented at the 2009 ACM Conference on Computer and Communications Security. According to the UK’s Computing, the paper shows hackers could evade anti-virus protection by hiding malicious code in sentences that read like English language spam

alphanumeric shellcodeThe article says that attackers could develop a tool that would be the next step in the hacking and virus arms race. Hackers could hide alphanumeric shellcode in valid files which would activate the malicious payload of a code-injection attack. This attack vector could give attackers control of system resources, applications, and data on a compromised computer.

The researchers report they can generate English shellcode in less than one hour on standard PC hardware. The text in bold is the instruction set and the plain text is skipped. “There is a major center of economic activity, such as Star Trek, including The Ed Sullivan Show. The former Soviet Union. International organization participation.”

The good news, Dr. Mason said that the widespread use of this attack vector is limited because the alphanumeric character set is much smaller than the set of characters available in Unicode and UTF-8 encodings. This means that the set of instructions available for composing alphanumeric shellcode is relatively small. “There was really not a lot to suggest it could be done because of the restricted instruction set,” said Dr. Mason. Long strings of mostly capital letters, for example, would be very suspicious.

Computing claims the work is a breakthrough. Current network security techniques work on the assumption that the code used in code-injection attacks, where it is delivered and run on victims’ computers, has a different structure to non-executable plain data, such as English prose. If an attacker challenge’s the assumption that executable code structure is different from non-executable data malware would be almost impossible to detect.

Dr. Nicolas T Courtois, an expert in security and cryptology at University College London, said malware deployed in this way would be “hard, if not impossible, to detect reliably.” The research is a proof of concept, but Dr. Mason doubts any hackers are using the technique to disguise their code. “I’d be astounded if anyone is using this method in the real world owing to the amount of engineering it took to pull off,” he said. “A lot of people didn’t think it could be done.

Professor John Walker, managing director of forensics consultancy Secure-Bastion, argued the research highlights the flaws in the anti-virus community’s approach to security exploits. “There is no doubt in my mind that anti-virus software as we know it today has gone well past its sell-by date,” he said.

Related articles

rb-

Carly Fiorina

If this technology gets out in the wild, most experts believe that the current signature-based anti-malware products will miss the attack and leave us all defenseless. Sounds like something the chip makers should be working on. Is this why Intel bought McAfee?

What do you think?

Can the anti-malware industry adapt to new threats from attachers?

View Results

Loading ... Loading ...

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Labor Day 2011

Labor Day in Detroit

 

Labor Day in Detroit

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.