WhatsApp servers are down — it's not just you!

WhatsApp, the incredibly popular instant messaging service recently purchased by Facebook for almost $20 bilion, is offline at the moment. So, yeah, it's not just you. It's the WhatsApp servers. There's no word yet on how long the outage will last, so let us know in the comments whether it's working for you yet, and if not, when it starts working again!

Serious security flaw in OAuth, OpenID discovered

Serious security flaw in OAuth, OpenID discovered

Attackers can use the "Covert Redirect" vulnerability in both open-source login systems to steal your data and redirect you to unsafe sites.
Beware of links that ask you to log in through Facebook. The OAuth 2.0 and OpenID modules are vulnerable.iStockphoto

Following in the steps of the OpenSSL vulnerability Heartbleed, another major flaw has been found in popular open-source security software. This time, the holes have been found in the login tools OAuth and OpenID, used by many websites and tech titans including Google, Facebook, Microsoft, and LinkedIn, among others.

Wang Jing, a Ph.D student at the Nanyang Technological University in Singapore, discovered that the serious vulnerability "Covert Redirect" flaw can masquerade as a login popup based on an affected site's domain. Covert Redirect is based on a well-known exploit parameter.

For example, someone clicking on a malicious phishing link will get a popup window in Facebook, asking them to authorize the app. Instead of using a fake domain name that's similar to trick users, the Covert Redirect flaw uses the real site address for authentication.

If a user chooses to authorize the login, personal data (depending on what is being asked for) will be released to the attacker instead of to the legitimate website. This can range from email addresses, birth dates, contact lists and possibly even control of the account.

Regardless of whether the victim chooses to authorize the app, they will then get redirected to a website of the attacker's choice, which could potentially further compromise the victim.

Wang says he has already contacted Facebook and has reported the flaw, but was told that the company "understood the risks associated with OAuth 2.0," and that "short of forcing every single application on the platform to use a whitelist," fixing this bug was "something that can't be accomplished in the short term."

Facebook isn't the only site affected. Wang says he has reported this to Google, LinkedIn and Microsoft, who gave him various responses on how they would handle the matter.

A sample list of websites that are affected by the Covert Redirect vulnerability.Wang Jing

Google (which uses OpenID) told him that the problem was being tracked, while LinkedIn said that the company would publish a blog on the matter soon. Microsoft, on the other hand, said that an investigation had been done and that the vulnerability existed on a the domain of a third-party and not on its own sites.

"Patching this vulnerability is easier said than done. If all the third-party applications strictly adhere to using a whitelist, then there would be no room for attacks," said Wang.

"However, in the real world, a large number of third-party applications do not do this due to various reasons. This makes the systems based on OAuth 2.0 or OpenID highly vulnerable."

Jeremiah Grossman, founder and interim CEO at WhiteHat Security, a website security firm, agreed with Wang's findings after looking at the data.

"While I can't be 100 percent certain, I could have sworn I've seen a report of a very similar if not identical vulnerability in OAuth. It would appear this issue is essentially a known WONTFIX," Grossman said.

"This is to say, it's not easy to fix, and any effective remedies would negatively impact the user experience. Just another example that Web security is fundamentally broken and the powers that be have little incentive to address the inherent flaws."

Further corroborating Wang's findings is Chris Wysopal, CTO at programming code verification firm Veracode.

Wsyopal told CNET that it looks to be a "very real issue" and that OAuth 2.0 looks vulnerable to phishing and redirect attacks.

"Given the trust users put in Facebook and other major OAuth providers I think it will be easy for attackers to trick people into giving some access to their personal information stored on those service," he said.

Users who wish to avoid any potential loss of data should be careful about clicking links that immediately ask you to log in to Facebook or Google. Closing the tab immediately should prevent any redirection attacks.

While this issue isn't as severe as Heartbleed, it's relatively easy to do so unless the flaw gets patched, which according to Wang, is quite difficult to implement due to third-party sites having "little incentive" to fix the problem. Cost is a factor, as well as the view that the host company (such as Facebook) bears the responsibility for making the attacks appear more credible.

The Heartbleed Bug

Heartbleed is a software bug in the open-source cryptography library OpenSSL, which allows an attacker to read the memory of the host computer (for example, a Web server), allowing them to retrieve potentially privacy-sensitive data.

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

Check if a website is affected Here:Click 

 What leaks in practice? 

We have tested some of our own services from attacker's perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

How to stop the leak?
As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.

History
In April 2014, Neel Mehta of Google's security team reported a bug in all versions of OpenSSL in the 1.0.1 series released since March 14, 2012. The bug entailed a severe memory handling error in the implementation of the Transport Layer Security (TLS) Heartbeat Extension. This defect could be used to reveal up to 64 kilobytes of the application's memory with every heartbeat.The bug is registered in the Common Vulnerabilities and Exposures system as CVE-2014-0160. The bug is exercised by sending a malformed heartbeat request to the server in order to elicit the server's response, which normally consists of the same data buffer that was received. Due to a lack of bounds checking, the affected versions of OpenSSL did not verify the validity of the heartbeat request size, permitting attackers to read an arbitrary size of server memory.
The vulnerability has existed since December 31, 2011 and the vulnerable code has been in widespread use since the release of OpenSSL version 1.0.1 on March 14, 2012.It was submitted by a German Ph.D. student at the University of Duisburg-Essen
The bug was named by an engineer at the firm Codenomicon, a Finnish cybersecurity company, which also created the bleeding heart logo, and launched the domainHeartbleed.com to explain the bug to the public.^[20] According to Codenomicon, Neel Mehta of Google's security team first reported the bug to OpenSSL, but both Google and Codenomicon discovered it independently. Mehta also congratulated Codenomicon, without going into detail.

What is the CVE-2014-0160?

CVE-2014-0160 is the official reference to this bug. CVE (Common Vulnerabilities and Exposures) is the Standard for Information Security Vulnerability Names maintained by MITRE. Due to co-incident discovery a duplicate CVE, CVE-2014-0346, which was assigned to us, should not be used, since others independently went public with the CVE-2014-0160 identifier.

Why it is called the Heartbleed Bug?

Bug is in the OpenSSL's implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). When it is exploited it leads to the leak of memory contents from the server to the client and from the client to the server.

What makes the Heartbleed Bug unique?

Bugs in single software or library come and go and are fixed by new versions. However this bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation and attacks leaving no trace this exposure should be taken seriously.

Is this a design flaw in SSL/TLS protocol specification?

No. This is implementation problem, i.e. programming mistake in popular OpenSSL library that provides cryptographic services such as SSL/TLS to the applications and services.

What is being leaked?

Encryption is used to protect secrets that may harm your privacy or security if they leak. In order to coordinate recovery from this bug we have classified the compromised secrets to four categories: 1) primary key material, 2) secondary key material and 3) protected content and 4) collateral.

What is leaked primary key material and how to recover?

These are the crown jewels, the encryption keys themselves. Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will. Any protection given by the encryption and the signatures in the X.509 certificates can be bypassed. Recovery from this leak requires patching the vulnerability, revocation of the compromised keys and reissuing and redistributing new keys. Even doing all this will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption. All this has to be done by the owners of the services.

What is leaked secondary key material and how to recover?

These are for example the user credentials (user names and passwords) used in the vulnerable services. Recovery from this leaks requires owners of the service first to restore trust to the service according to steps described above. After this users can start changing their passwords and possible encryption keys according to the instructions from the owners of the services that have been compromised. All session keys and session cookies should be invalided and considered compromised.

What is leaked protected content and how to recover?

This is the actual content handled by the vulnerable services. It may be personal or financial details, private communication such as emails or instant messages, documents or anything seen worth protecting by encryption. Only owners of the services will be able to estimate the likelihood what has been leaked and they should notify their users accordingly. Most important thing is to restore trust to the primary and secondary key material as described above. Only this enables safe use of the compromised services in the future.

What is leaked collateral and how to recover?

Leaked collateral are other details that have been exposed to the attacker in the leaked memory content. These may contain technical details such as memory addresses and security measures such as canaries used to protect against overflow attacks. These have only contemporary value and will lose their value to the attacker when OpenSSL has been upgraded to a fixed version.

Recovery sounds laborious, is there a short cut?

After seeing what we saw by "attacking" ourselves, with ease, we decided to take this very seriously. We have gone laboriously through patching our own critical services and are in progress of dealing with possible compromise of our primary and secondary key material. All this just in case we were not first ones to discover this and this could have been exploited in the wild already.

How revocation and reissuing of certificates works in practice?

If you are a service provider you have signed your certificates with a Certificate Authority (CA). You need to check your CA how compromised keys can be revoked and new certificate reissued for the new keys. Some CAs do this for free, some may take a fee.

Am I affected by the bug?

You are likely to be affected either directly or indirectly. OpenSSL is the most popular open source cryptographic library and TLS (transport layer security) implementation used to encrypt traffic on the Internet. Your popular social site, your company's site, commerce site, hobby site, site you install software from or even sites run by your government might be using vulnerable OpenSSL. Many of online services use TLS to both to identify themselves to you and to protect your privacy and transactions. You might have networked appliances with logins secured by this buggy implementation of the TLS. Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

How widespread is this?

Most notable software using OpenSSL are the open source web servers like Apache and nginx. The combined market share of just those two out of the active sites on the Internet was over 66% according to Netcraft's April 2014 Web Server Survey. Furthermore OpenSSL is used to protect for example email servers (SMTP, POP and IMAP protocols), chat servers (XMPP protocol), virtual private networks (SSL VPNs), network appliances and wide variety of client side software. Fortunately many large consumer sites are saved by their conservative choice of SSL/TLS termination equipment and software. Ironically smaller and more progressive services or those who have upgraded to latest and best encryption will be affected most. Furthermore OpenSSL is very popular in client software and somewhat popular in networked appliances which have most inertia in getting updates.

What versions of the OpenSSL are affected?

Status of different versions:

• OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
• OpenSSL 1.0.1g is NOT vulnerable
• OpenSSL 1.0.0 branch is NOT vulnerable
• OpenSSL 0.9.8 branch is NOT vulnerable

Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

How common are the vulnerable OpenSSL versions?

The vulnerable versions have been out there for over two years now and they have been rapidly adopted by modern operating systems. A major contributing factor has been that TLS versions 1.1 and 1.2 came available with the first vulnerable OpenSSL version (1.0.1) and security community has been pushing the TLS 1.2 due to earlier attacks against TLS (such as the BEAST).

How about operating systems?

Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:

• Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
• Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
• CentOS 6.5, OpenSSL 1.0.1e-15
• Fedora 18, OpenSSL 1.0.1e-4
• OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
• FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013
• NetBSD 5.0.2 (OpenSSL 1.0.1e)
• OpenSUSE 12.2 (OpenSSL 1.0.1c)

Operating system distribution with versions that are not vulnerable:

• Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14
• SUSE Linux Enterprise Server
• FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013
• FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013
• FreeBSD 10.0p1 - OpenSSL 1.0.1g (At 8 Apr 18:27:46 2014 UTC)
• FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)

How can OpenSSL be fixed?

Even though the actual code fix may appear trivial, OpenSSL team is the expert in fixing it properly so latest fixed version 1.0.1g or newer should be used. If this is not possible software developers can recompile OpenSSL with the handshake removed from the code by compile time option -DOPENSSL_NO_HEARTBEATS.

Should heartbeat be removed to aid in detection of vulnerable services?

Recovery from this bug could benefit if the new version of the OpenSSL would both fix the bug and disable heartbeat temporarily until some future version. It appears that majority if not almost all TLS implementations that respond to the heartbeat request today are vulnerable versions of OpenSSL. If only vulnerable versions of OpenSSL would continue to respond to the heartbeat for next few months then large scale coordinated response to reach owners of vulnerable services would become more feasible.

Can I detect if someone has exploited this against me?

Exploitation of this bug leaves no traces of anything abnormal happening to the logs.

Can IDS/IPS detect or block this attack?

Although the content of the heartbeat request is encrypted it has its own record type in the protocol. This should allow intrusion detection and prevention systems (IDS/IPS) to be trained to detect use of the heartbeat request. Due to encryption differentiating between legitimate use and attack can not be based on the content of the request, but the attack may be detected by comparing the size of the request against the size of the reply. This seems to imply that IDS/IPS can be programmed to detect the attack but not to block it unless heartbeat requests are blocked altogether.

Has this been abused in the wild?

We don't know. Security community should deploy TLS/DTLS honeypots that entrap attackers and to alert about exploitation attempts.

Can attacker access only 64k of the memory?

There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed.

Is this a MITM bug like Apple's goto fail bug was?

No this doesn't require a man in the middle attack (MITM). Attacker can directly contact the vulnerable service or attack any user connecting to a malicious service. However in addition to direct threat the theft of the key material allows man in the middle attackers to impersonate compromised services.

Does TLS client certificate authentication mitigate this?

No, heartbeat request can be sent and is replied to during the handshake phase of the protocol. This occurs prior to client certificate authentication.

Does OpenSSL's FIPS mode mitigate this?

No, OpenSSL Federal Information Processing Standard (FIPS) mode has no effect on the vulnerable heartbeat functionality.

Does Perfect Forward Secrecy (PFS) mitigate this?

Use of Perfect Forward Secrecy (PFS), which is unfortunately rare but powerful, should protect past communications from retrospective decryption. Please seehttps://twitter.com/ivanristic/status/453280081897467905 how leaked tickets may affect this.

Can heartbeat extension be disabled during the TLS handshake?

No, vulnerable heartbeat extension code is activated regardless of the results of the handshake phase negotiations. Only way to protect yourself is to upgrade to fixed version of OpenSSL or to recompile OpenSSL with the handshake removed from the code.

Who found the Heartbleed Bug?

This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) atCodenomicon and Neel Mehta of Google Security, who first reported it to the OpenSSL team. Codenomicon team found heartbleed bug while improving the SafeGuard feature in Codenomicon's Defensics security testing tools and reported this bug to the NCSC-FI for vulnerability coordination and reporting to OpenSSL team.

What is the Defensics SafeGuard?

The SafeGuard feature of the Codenomicon's Defensics security testtools automatically tests the target system for weaknesses that compromise the integrity, privacy or safety. The SafeGuard is systematic solution to expose failed cryptographic certificate checks, privacy leaks or authentication bypass weaknesses that have exposed the Internet users to man in the middle attacks and eavesdropping. In addition to the Heartbleed bug the new Defensics TLS Safeguard feature can detect for instance the exploitable security flaw in widely used GnuTLS open source software implementing SSL/TLS functionality and the "goto fail;" bug in Apple's TLS/SSL implementation that was patched in February 2014.

Who coordinates response to this vulnerability?

NCSC-FI took up the task of reaching out to the authors of OpenSSL, software, operating system and appliance vendors, which were potentially affected. However, this vulnerability was found and details released independently by others before this work was completed. Vendors should be notifying their users and service providers. Internet service providers should be notifying their end users where and when potential action is required.

Is there a bright side to all this?

For those service providers who are affected this is a good opportunity to upgrade security strength of the secret keys used. A lot of software gets updates which otherwise would have not been urgent. Although this is painful for the security community, we can rest assured that infrastructure of the cyber criminals and their secrets have been exposed as well.

Where to find more information?

This Q&A was published as a follow-up to the OpenSSL advisory, since this vulnerability became public on 7th of April 2014. The OpenSSL project has made a statement athttps://www.openssl.org/news/secadv_20140407.txt. NCSC-FI published an advisory athttps://www.cert.fi/en/reports/2014/vulnerability788210.html. Individual vendors of operating system distributions, affected owners of Internet services, software packages and appliance vendors may issue their own advisories.

Lose Weight Naturally

SapnaVyas Patel Weight Loss and Fitness Expert

I can help you lose weight, just like I did.
I lost 33 kg in 1 year without any pills, surgery or crash dieting and now I am helping others to do the same. I have helped more than 10000 people to lose weight without charging money and I can help you too - for real..
This isn't a fad diet, it's a realistic way to eat better
No need to 'Stay Hungry' or do 'Fruit Days' anymore
Learn what to eat, when to eat and how much to eat

Here's how you can lose weight, just like I did

You just need to do six things... That's it.

• 

  Follow My Exercise Tutorials

  Start doing exercise with the help of step-by-step guide.
• 

  Choose Your Meal Plan

  Select a diet plan which suits your lifestyle and follow it.
• 

  Make Smart Choices

  Learn - What, When and How much to eat at restaurants
• 

  Learn Portion Control

  Learn the portion control technique (using your hand)
• 

  Maintain Good Posture

  Check out the visual guide to good posture
• 

  Cultivate Healthy Habits

  Follow my easy-to-understand, simple-to-follow guidelines.

Weight loss is no rocket science. You can enjoy your life and lose those extra pounds. If I can do it, you can do it too…!!

Facebook Redesigned

Facebook is making strides with the app editions of its service for Android and iOS, but the desktop look has fallen behind recent design trends. Rather than just sit around and complain, designer Fred Nerby took matters into his own hands with this gorgeous new look and concept redesign of the site that he posted to Behance.

Nerby describes the project as “a conceptional and systematic design approach for a new responsive desktop and iPad concept to the largest networking platform in the world, focusing on a more streamlined solution for its online space and created behaviour.”

Readers, how do you feel about this hypothetical version of Facebook? Do you “Like” this more than the social network’s current design?

We were curious to learn more about the designer’s process for reimagining the world’s largest social network, so we sent Nerby a few questions:

Q: What made you want to attempt this new look concept?

FN: I’ve wanted to create a better understanding and relation between user and content and how such data can be displayed. Today, Facebook is not so much the necessary evil that people have to get used to anymore as much as it has become part of people’s behaviour on a daily basis. Such behaviour is systematic and that is creative in itself. That behaviour is a very powerful tool for both end users and companies around the world when “used correctly”, create your platform and tell a story about it. The visual impact is crucial today and how we’re displaying information is essential for any application’s success.

Q: What were your guiding principles during the design process?

FN: To approach the platform from a user perspective and focus on targeted & personalized data while maintaining a visually appealing interface. Facebook has done a good job on this for a long time but we’re still not seeing the full extent of what’s possible within this platform. I believe the future of data, design & dev lies within personalised or targeted information online, because currently, we’re flooded with information online such as banners, ads and other media who have based their campaigns on a more narrative philosophy (which is “interrupting the user” [to get] you to think of a brand or product you hadn’t thought about). This concept draws upon a systematic theory and lets the user control what they want and don’t want to see, creating more of a personal environment online.

Q: Are there any other sources you specifically looked to for inspiration?

FN: New design trends online or within applications is being introduced on a daily basis by solid creatives around the world. I’m not inspired by a specific application as such but more so the overall UX/UI experience of products and websites. I draw upon Apple’s way of executing an interface plus other Metric systems that are currently being introduced by other platforms. I don’t draw too much inspiration from one specific source it’s all about understanding the need for that application or platform that you’re working with and what the expectations are from the end user.

Q: Would you license this to Facebook if they asked for it?

FN: FB and its current creative team has proven its talent. I’m sure we’ll come to an arrangement.

Q: Would you design for Facebook if they offered you a job?

FN: My door is always open for discussion.

Facebook Graph Search

On January 15th at Palo Alto Facebook CEO Mark Zuckerberg held a press conference to announce the unveiling of "Graph Search" - A search engine that will allow people using Facebook to more quickly find answers to questions about friends in their Social Graph. "This is one of the coolest things we've done in a while," Zuckerberg said. 

Introduction to Graph Search 


With graph search you can look up anything shared with you on Facebook, and others can find stuff you’ve shared with them. Each person sees unique results. One example demonstrated was a very specific search for "Friends of my friends who are single male San Francisco,Calif." That refined query returned a select group of people who fit the criteria. Apart from personal use cases, Graph Search can be used for dating and recruiting purposes, which could make the product a potential challenger to LinkedIn and various dating sites that incorporate social network profiles. 

How Graph search works by Mark Zuckerberg 


The Graph search is being opened to all English (US) speaking users in the coming months. You can get on the waiting list.

The Moving Rocks of Death Valley

Moving rocks  refer to a geological phenomenon where rocks move in long tracks along a smooth valley floor without human or animal intervention. They have been recorded and studied in a number of places around Racetrack Playa, Death Valley.

The force behind their movement is not confirmed and is the subject of research for which several hypotheses exist.For years, people have been puzzled by a peculiar phenomenon in Racetrack Playa, a desolate section of California's Death Valley. Big and small rocks seem to move spontaneously, gliding across the flat landscape and leaving behind trails. Some travel in pairs, tracking each other so precisely that they leave marks that appear to have been made by car tires. Others wander back and forth alone, covering the length of several football fields.

Some photos showing the kind of movement rocks make:

Some move in strainght line ,taking turns at after

 some interval.

Other move in completely random pattern.

Moving Rock

What Makes Death Valley Rocks Move by Themselves?

Are They Moved by People or Animals?

The shape of trails behind the rocks suggest that they move during times when the floor of Racetrack Playa is covered with a very soft mud. A lack of disturbed mud around the rock trails eliminates the possibility of a human or animal pushing or assisting the motion of the rocks.

Are They Moved by Wind?

Another theory is that the rocks are moved by powerful winds that rage through the desert at night. In the 1950s, a researcher tried to simulate this effect with an airplane but was unable to move any rocks very far. In the late 1960s and early 1970s, California Institute of Technology geologist Robert P. Sharp built upon the wind theory by suggesting that the rocks required precise environmental conditions to move. The Playa floor is moistened by meltwater from adjacent mountains. Sharp theorized that it had to be saturated with a quarter to three-eighths of an inch of water, just enough to make the surface slick but not enough to make it soggy.
Sharp attempted to track the movements of rocks, which has never been observed in real time. He and a colleague from UCLA placed stakes near 25 rocks of various sizes and gave them names such as "Mary Ann" and "Irene."
As this 1977 Associated Press article details, Sharp found that from 1968 to 1975, all but one of the 25 rocks moved, including seven that moved more than 300 feet.

Are They Moved by Ice?

A few people have reported seeing Racetrack Playa covered by a thin layer of ice. One idea is that water freezes around the rocks and then wind, blowing across the top of the ice, drags the ice sheet with its embedded rocks across the surface of the playa.

Some researchers have found highly congruent trails on multiple rocks that strongly support this movement theory. However, the transport of a large ice sheet might be expected to mark the playa surface in other ways - these marks have not been found.
Other researchers experimented with stakes that would be disturbed by ice sheets. The rocks moved without disturbing the stakes. The evidence for ice-sheet transport is not consistent. 

Wind is the Favored Mover!

All of the best explanations involve wind as the energy source behind the movement of the rocks. The question remains is do they slide while encased in an ice sheet or do they simply side over the surface of the mud? Perhaps each of these methods is responsible for some rock movement?

Perhaps this story will remain more interesting if the real answer is never discovered!

NASA Studies on Sliding Rocks

NASA sent a team of interns and mentors to Racetrack Playa during Summer 2010. They made observations, performed tests, compiled data and developed some ideas about how the rocks might move.Check out their report and photos.

In 1976 Dr Robert Sharp of the geology department of the California Institute of Technology wrote in the Bulletin of Geological Society of America and stated that:

The secret is to catch the play of wind and water at precisely the right moment.

Not everybody is convinced of this though… Two years after the results were published, there was a severe frost after a week of heavy rain. Surely this would ‘glue’ the rocks in place? In the morning they found that several rocks had moved.

If its not nature, what then can be the secret of these rocks?