Not logged in | Login

Open Source News » Tags » security

Feeds

31256 items (26743 unread) in 5 feeds

OpenSource

SourceForge.net: Front page news (802 unread)
Slashdot: IT (4564 unread)

Security

Digg / Security (9869 unread)

Linux

digg / Linux/Unix (9926 unread)
Slashdot: Linux (1582 unread)

1628 items tagged "security"

Slashdot: IT

Super Bowl Bust: Feds Grab 307 NFL Websites; $4.8M

Posted: February 2nd, 2012, 11:58pm CET by timothy

Tags: security

coondoggie writes "Speaking at a National Football League press conference ahead of this weekend's Super Bowl, the U.S. Immigration and Customs Enforcement agency said special agents this week seized a total of 307 websites and snatched up 42,692 items of phony Super Bowl-related memorabilia along with other counterfeit items for a total take of more than $4.8 million – up from $3.72 million last year."

Read more of this story at Slashdot.
Verisign Admits Company Was Hacked In 2010, Not Sure What Was Stolen

Posted: February 2nd, 2012, 5:39pm CET by timothy

Tags: security

mask.of.sanity writes "Verisign admitted it was hacked repeatedly last year and cannot pin down what data was stolen. It says it doesn't believe the Domain Name System servers were hacked but it cannot rule it out. Symantec, which bought its certificate business in 2010, says also that there was no evidence that system was affected. Verisign further admitted in an SEC filing that its security team failed to tell management about the attacks until 2011, despite moving to address the hacks."

Read more of this story at Slashdot.
The Hi-Tech Security at the Super Bowl

Posted: February 2nd, 2012, 1:30am CET by samzenpus

Tags: security

Hugh Pickens writes "As millions of fans sit glued to their sets next Sunday, one part of the game they will not see is the massive deployment of federal and local law enforcement resources to achieve what is being called the most technologically secure Super Bowl in history, an event that has been officially designated as a National Security Special Event (PDF). At the top of the list are gamma-ray cargo and vehicles scanners that can reportedly see through six inches of steel to reveal the contents of large vehicles. 'We can detect people, handguns and rifles,' says Customs and Border Protection Officer Brian Bell. 'You'd be a fool to bring something into that stadium that you shouldn't. We're going to catch it. Our goal is to look at every vehicle that makes a delivery inside the stadium and inside the secure perimeter.' Next is the 51-foot Featherlite mobile command center for disaster response that will support the newly constructed $18 million Regional Operations Center (ROC) for the Marion County Department of Homeland Security that will serve as a fusion center for coordinating the various federal agencies involved in providing security for the Super Bowl. One interesting security measure are the 'Swiveloc' explosion-proof manhole covers (video) that Indianapolis has spent $150,000 installing that are locked down during the Super Bowl. In case of an underground explosion, the covers lift a couple of inches off the ground — enough to vent gas out without feeding in oxygen to make an explosion bigger — before falling back into place. Finally the Department of Homeland Security and the FBI has installed a network of cameras that will be just a click away for government officials. 'If you had the right (Internet) address, you could set up a laptop anywhere and you could watch the camera from there,' says Brigadier General Stewart Goodwin."

Read more of this story at Slashdot.
DHS Sends Tourists Home Over Twitter Jokes

Posted: January 31st, 2012, 1:58am CET by Unknown Lamer

Tags: security

itwbennett writes "In a classic case of 'we say destroy, you say party hard,' the U.S. Dept. of Homeland Security detained a pair of British twenty-somethings for 12 hours and then sent them packing back to the land of the cheeky retort. At issue is a Tweet sent by Leigh Van Bryan about plans to 'destroy America,' starting with LA, which, really, isn't that bad an idea."

Read more of this story at Slashdot.
How Allan Scherr Hacked Around the First Computer Password

Posted: January 28th, 2012, 3:11am CET by timothy

Tags: security

New submitter MikeatWired writes "If you're like most people, you're annoyed by passwords. So who's to blame? Who invented the computer password? They probably arrived at MIT in the mid-1960s, when researchers built a massive time-sharing computer called CTSS. Technology changes. But, then again, it doesn't, writes Bob McMillan. Twenty-five years after the fact, Allan Scherr, a Ph.D. researcher at MIT in the early '60s, came clean about the earliest documented case of password theft. In the spring of 1962, Scherr was looking for a way to bump up his usage time on CTSS. He had been allotted four hours per week, but it wasn't nearly enough time to run the detailed performance simulations he'd designed for the new computer system. So he simply printed out all of the passwords stored on the system. 'There was a way to request files to be printed offline by submitting a punched card,' he remembered in a pamphlet (PDF) written last year to commemorate the invention of the CTSS. 'Late one Friday night, I submitted a request to print the password files and very early Saturday morning went to the file cabinet where printouts were placed and took the listing.' To spread the guilt around, Scherr then handed the passwords over to other users. One of them — J.C.R. Licklieder — promptly started logging into the account of the computer lab's director Robert Fano, and leaving 'taunting messages' behind."

Read more of this story at Slashdot.
DARPA Funding a $50 Drone-Droppable Spy Computer

Posted: January 27th, 2012, 11:56pm CET by Soulskill

Tags: security

Sparrowvsrevolution writes "At the Shmoocon security conference, researcher Brendan O'Connor plans to present the F-BOMB, or Falling or Ballistically-launched Object that Makes Backdoors. Built from just the disassembled hardware in a commercially-available PogoPlug mini-computer, a few tiny antennae, eight gigabytes of flash memory and some 3D-printed plastic casing, the F-BOMB serves as 3.5"-by-4"-by-1" spy computer. With a contract from DARPA, O'Connor has designed the cheap gadgets to be spy nodes, ready to be dropped from a drone, plugged inconspicuously into a wall socket, (one model impersonates a carbon monoxide detector) thrown over a barrier, or otherwise put into irretrievable positions to quietly collect data and send it back to the owner over any available Wi-Fi network. O'Connor built his prototypes with gear that added up to just $46 each, so sacrificing one for a single use is affordable."

Read more of this story at Slashdot.
When Viruses Infect Worms

Posted: January 27th, 2012, 10:33pm CET by Soulskill

Tags: security

An anonymous reader writes "Bitdefender reports that there exist viruses which, when they encounter other viruses, will merge and combine effects so that they create a new virus. 'A virus infects executable files; and a worm is an executable file. If the virus reaches a PC already compromised by a worm, the virus will infect the exe files on that PC — including the worm. When the worm spreads, it will carry the virus with it. Although this happens unintentionally, the combined features from both pieces of malware will inflict a lot more damage than the creators of either piece of malware intended. While most file infectors have inbuilt spreading mechanisms, just like Trojans and worms (spreading routines for RDP, USB, P2P, chat applications, or social networks), some cannot replicate or spread between computers. And it seems a great idea to “outsource” the transportation mechanism to a different piece of malware (i.e. by piggybacking a worm).'"

Read more of this story at Slashdot.
Symantec Tells Customers To Stop Using pcAnywhere

Posted: January 26th, 2012, 3:24pm CET by timothy

Tags: security

Orome1 writes "In a perhaps not wholly unexpected move, Symantec has advised the customers of its pcAnywhere remote control application to stop using it until patches for a slew of vulnerabilities are issued. If the attackers place a network sniffer on a customer's internal network and have access to the encryption details, the pcAnywhere traffic — including exchanged user login credentials — could be intercepted and decoded. If the attackers get their hands on the cryptographic key they can launch remote control sessions and, thus, access to systems and sensitive data. If the cryptographic key itself is using Active Directory credentials, they can also carry out other malicious activities on the network."

Read more of this story at Slashdot.
Exploits Emerge For Linux Privilege Escalation Flaw

Posted: January 25th, 2012, 11:46pm CET by samzenpus

Tags: security

angry tapir writes "Linux vendors are rushing to patch a privilege escalation vulnerability in the Linux kernel that can be exploited by local attackers to gain root access on the system. The vulnerability, which is identified as CVE-2012-0056, was discovered by Jüri Aedla and is caused by a failure of the Linux kernel to properly restrict access to the '/proc//mem' file."

Read more of this story at Slashdot.

Slashdot: Linux

Exploits Emerge For Linux Privilege Escalation Flaw

Posted: January 25th, 2012, 11:46pm CET by samzenpus

Tags: security

angry tapir writes "Linux vendors are rushing to patch a privilege escalation vulnerability in the Linux kernel that can be exploited by local attackers to gain root access on the system. The vulnerability, which is identified as CVE-2012-0056, was discovered by Jüri Aedla and is caused by a failure of the Linux kernel to properly restrict access to the '/proc//mem' file."

Read more of this story at Slashdot.

Slashdot: IT

Corporate Boardrooms Open To Eavesdropping

Posted: January 25th, 2012, 4:10pm CET by Unknown Lamer

Tags: security

cweditor writes "One afternoon this month, a hacker toured a dozen corporate conference rooms via equipment that most every company has in those rooms: videoconferencing. Rapid7 says they could 'easily read a six-digit password from a sticky note over 20 feet away from the camera' and 'clearly hear conversations down the hallway from the video conferencing system.' With some systems, they could even capture keystrokes being typed in the room. Teleconferencing vendors defended their security, saying the auto-answer feature that left those system vulnerable was an effort to strike the right balance between security and usability."

Read more of this story at Slashdot.
Pwn2Own 2012 Set To Reveal More Browser Vulnerabilities Than In the Past

Posted: January 24th, 2012, 8:24am CET by Soulskill

Tags: security

darthcamaro writes "In any given year, Slashdot always has stories about how a researcher hacked a browser in only a few minutes at the Pwn2own hacking challenge. This year the rules are a bit different, and instead of hackers winning for just one vulnerability, the rules allow for multiple vulnerabilities to be presented. The winner isn't the first one to hack a browser, but is the one that can hack the browser the most. 'In the past, due to the way the competition was architected, we had lots of sensationalist headlines, things like "Mac hacked in three seconds,"' said Aaron Portnoy, Manager of the Security Research Team at HP TippingPoint. 'We don't think that type of sensationalism was representative of all the research that was going on.'"

Read more of this story at Slashdot.
Researchers Find Slew of Flaws In SCADA Hardware, Software

Posted: January 22nd, 2012, 2:15am CET by Soulskill

Tags: security

Trailrunner7 writes "At the S4 security conference this week, 'Project Basecamp,' a volunteer-led security audit of leading programmable logic controllers (PLCs), performed by a team of top researchers found that decrepit hardware, buggy software and pitiful or nonexistent security features make thousands of PLCs vulnerable to trivial attacks by external hackers that could cause PLC devices to crash or run malicious code. 'We were looking for a Firesheep moment in PLC security,' Peterson told the audience of ICS security experts. They got one. 'It's a blood bath mostly,' said Wightman of Digital Bond. 'Many of these devices lack basic security features.' While the results of analysis of the various PLCs varied, the researchers found significant security issues with every system they tested, with some PLCs too brittle and insecure to even tolerate security scans and probing."

Read more of this story at Slashdot.
Dreamhost FTP/Shell Password Database Breached

Posted: January 21st, 2012, 10:59pm CET by Soulskill

Tags: security

New submitter Ccmods writes "Below is a snippet from an email Dreamhost sent to subscribers early Saturday morning, describing an intrusion into the database storing FTP and SSH usernames and passwords: 'We are writing to let you know that there may have been illegal and unauthorized access to some of your passwords at DreamHost today. Our security systems detected the potential breach this morning and we immediately took the defensive precaution of expiring and resetting all FTP/shell access passwords for all DreamHost customers and their users. ... Only the FTP/shell access passwords appear to have been compromised by the illegal access. Web panel passwords, email passwords and billing information for DreamHost customers were not affected or accessed.'"

Read more of this story at Slashdot.
Symantec Admits Its Networks Were Hacked in 2006

Posted: January 19th, 2012, 4:51pm CET by Soulskill

Tags: security

Orome1 writes "After having first claimed that the source code leaked by Indian hacking group Dharmaraja was not stolen through a breach of its networks, but possibly by compromising the networks of a third-party entity, Symantec backpedalled and announced that the code seems to have exfiltrated during a 2006 breach of its systems. Symantec spokesman Cris Paden has confirmed that unknown hackers have managed to get their hands on the source code to the following Symantec solutions: Norton Antivirus Corporate Edition, Norton Internet Security, Norton Utilities, Norton GoBack and pcAnywhere."

Read more of this story at Slashdot.
Will Secure Boot Cripple Linux Compatibility?

Posted: January 19th, 2012, 12:14am CET by Unknown Lamer

Tags: security

MojoMax writes "The advent of Windows 8 is drawing ever nearer and recently we have learned that ARM devices installed with Windows 8 will not be able to disable the UEFI secure boot feature that many of us are deeply concerned about. However, UEFI is still a very real danger to Linux and the freedom to use whichever OS you chose. Regardless of information for OEMs to enable customers to install their own keys, such as that published by the Linux Foundation, there are still very serious and as yet unresolved issues with using secure boot and Linux. These issues are best summarized quoting Matthew Garrett: 'Signing the kernel isn't enough. Signed Linux kernels must refuse to load any unsigned kernel modules. Virtualbox on Linux? Dead. Nvidia binary driver on Linux? Dead. All out of tree kernel modules? Utterly, utterly dead. Building an updated driver locally? Not going to happen. That's going to make some people fairly unhappy.'"

Read more of this story at Slashdot.

Slashdot: Linux

Will Secure Boot Cripple Linux Compatibility?

Posted: January 19th, 2012, 12:14am CET by Unknown Lamer

Tags: security

MojoMax writes "The advent of Windows 8 is drawing ever nearer and recently we have learned that ARM devices installed with Windows 8 will not be able to disable the UEFI secure boot feature that many of us are deeply concerned about. However, UEFI is still a very real danger to Linux and the freedom to use whichever OS you chose. Regardless of information for OEMs to enable customers to install their own keys, such as that published by the Linux Foundation, there are still very serious and as yet unresolved issues with using secure boot and Linux. These issues are best summarized quoting Matthew Garrett: 'Signing the kernel isn't enough. Signed Linux kernels must refuse to load any unsigned kernel modules. Virtualbox on Linux? Dead. Nvidia binary driver on Linux? Dead. All out of tree kernel modules? Utterly, utterly dead. Building an updated driver locally? Not going to happen. That's going to make some people fairly unhappy.'"

Read more of this story at Slashdot.

Slashdot: IT

Israel Faces Escalating Cyberwar

Posted: January 17th, 2012, 8:50pm CET by Soulskill

Tags: security

New submitter 9re9 writes "The NY Times describes what may be the beginning of an actual cyberwar between a pro-Palestinian group and Israeli companies, specifically El Al and the Tel Aviv stock exchange. From the article: 'A hacker identifying himself as oxOmar, already notorious for posting the details of more than 20,000 Israeli credit cards, sent an overnight warning to Israel's Ynet news outlet that a group of pro-Palestinian cyberattackers called Nightmare planned to bring down the sites in the morning.' Though the article is skimpy on technical details, the group appears to have engaged merely in a DDOS attack. Hamas praised the attack as opening 'a new resistance front against Israel.' Is this the first acknowledged cyberwar?"

Read more of this story at Slashdot.
Package Signing Comes To Pacman and Arch Linux

Posted: January 17th, 2012, 4:00pm CET by timothy

Tags: security

fwarren writes "One of the main complaints heard around here on why some Slashdotters don't run Arch Linux is that the packages are not signed. Fear no more: Arch Linux and Pacman now allow for package signing."

Read more of this story at Slashdot.

Slashdot: Linux

Package Signing Comes To Pacman and Arch Linux

Posted: January 17th, 2012, 4:00pm CET by timothy

Tags: security

fwarren writes "One of the main complaints heard around here on why some Slashdotters don't run Arch Linux is that the packages are not signed. Fear no more: Arch Linux and Pacman now allow for package signing."

Read more of this story at Slashdot.

Slashdot: IT

RSA Chief: Last Year's Breach Has Silver Lining

Posted: January 16th, 2012, 11:26pm CET by Soulskill

Tags: security

alphadogg writes "Last year's industry-shaking RSA Security breach has resulted in customers' CEOs and CIOs engaging much more closely with the vendor to improve their organizations' security, according to the head of RSA. Discussing the details of the attack that compromised its SecurID tokens has made RSA sought after by companies that want to prevent something similar from happening to them, Executive Chairman Art Coviello said in an interview with Network World. 'If there's a silver lining to the cloud that was over us from April through over the summer it is the fact that we've been engaged with customers at a strategic level as never before,' Coviello says, 'and they want to know in detail what happened to us, how we responded, what tools we used, what was effective and what was not.'"

Read more of this story at Slashdot.
Zappos Hacked: Internal Systems Breached

Posted: January 16th, 2012, 7:26am CET by samzenpus

Tags: security

wiredmikey writes "Zappos appears to be the latest victim of a cyber attack resulting in a data breach. In an email to Zappos employees on Sunday, CEO Tony Hsieh asked employees to set aside 20 minutes of their time to read about the breach and what communications would be sent to its over 24 million customers. While Hsieh said that credit card data was not compromised, he did say that 'one or more' of the following pieces of personal information has been accessed by the attacker(s): customer names, e-mail addresses, billing and shipping addresses, phone numbers, the last four digits of credit card numbers. User passwords were 'cryptographically scrambled,' he said."

Read more of this story at Slashdot.
New Cable Designed To Deter Copper Thieves

Posted: January 16th, 2012, 4:31am CET by samzenpus

Tags: security

Hugh Pickens writes "Pervasive thefts of copper wire from under the streets of Fresno, California have prompted the city to seal thousands of its manhole covers with concrete. In Picher, Oklahoma, someone felled the town's utility poles with chain saws, allowing thieves to abscond with 3,000 feet of wire while causing a blackout. The theft of copper cables costs U.S. companies $60 million a year and the FBI says it considers theft of copper wire to be a threat to the nation's baseline ability to function. But now PC World reports that a U.S. company has developed a new cable design that removes almost all the copper from cables in a bid to deter metal thieves. Unlike conventional cables made from solid copper, the GroundSmart Copper Clad Steel Cable consists of a steel core bonded to a copper outer casing, forming an equally effective but far less valuable cable by exploiting the corrosion-resistance of copper with the conductive properties of steel. 'Companies trying to protect their copper infrastructure have been going to extreme measures to deter theft, many of which are neither successful nor cost effective,' says CommScope vice president, Doug Wells. 'Despite efforts like these, thieves continue to steal copper because of its rising value. The result is costly damage to networks and growing service disruptions.' The GroundSmart Copper Clad Steel cable is the latest technical solution to the problem of copper theft, which has included alternatives like cable etching to aid tracing of stolen metal and using chemicals that leave stains detectable under ultra-violet light. However the Copper Clad Steel strikes at the root of the problem by making the cable less susceptible to theft by both increasing the resistance to cutting and drastically decreasing the scrap value."

Read more of this story at Slashdot.
DHS X-ray Car Scanners Now At Border Crossings

Posted: January 16th, 2012, 12:12am CET by samzenpus

Tags: security

OverTheGeicoE writes "CNET has a story on DHS' whole car X-ray scanners and their potential cancer risks. The story focuses on the Z Portal scanner, which appears to be a stationary version of the older Z Backscatter Vans. The story provides interesting pictures of the device and the images it produces, but it also raises important questions about the devices' cancer risks. The average energy of the X-ray beam used is three times that used in a CT scan, which could be big trouble for vehicle passengers and drivers should a vehicle stop in mid-scan. Some studies show the risk for cancer from CT scans can be quite high. Worse still, the DHS estimates of the Z Portal's radiation dosage are likely to be several orders of magnitude too low. 'Society will pay a huge price in cancer because of this,' according to one scientist."

Read more of this story at Slashdot.
DHS Monitors Social Media For 'Political Dissent'

Posted: January 15th, 2012, 2:19am CET by Soulskill

Tags: security

OverTheGeicoE writes "Recently, TSA's 'Blogger Bob' Burns posted a rant against a cupcake on the TSA blog. Perhaps it made you wonder if TSA and its parent agency, the Department of Homeland Security, really understand what we're saying about them, especially online. Well, thanks to a Freedom of Information Act lawsuit from the Electronic Privacy Information Center, we now know a lot more about how they monitor online comments aside from 'Blogger Bob.' EPIC has received hundreds of pages of documents regarding DHS's online surveillance program. These documents reveal that DHS has contracts with General Dynamics for '24/7 media and social network monitoring.' Perhaps it will warm your heart to know that DHS is particularly interested in tracking media stories that 'reflect adversely' on the U.S. government generally and DHS specifically. The documents include a report summary that might be representative of General Dynamics' work. The example includes summaries of comments on blogs and social networking sites, including quotes. Then again, you might remember J. Edgar Hoover's monitoring of antiwar activists during the Vietnam War, which certainly wasn't for the protesters' benefit."

Read more of this story at Slashdot.
Viruses Stole City College of S.F. Data For Years

Posted: January 14th, 2012, 7:39pm CET by Soulskill

Tags: security

An anonymous reader sends this quote from an article at the San Francisco Chronicle: "Personal banking information and other data from perhaps tens of thousands of students, faculty and administrators at City College of San Francisco have been stolen in what is being called 'an infestation' of computer viruses with origins in criminal networks in Russia, China and other countries, The Chronicle has learned. At work for more than a decade, the viruses were detected a few days after Thanksgiving, when the college's data security monitoring service detected an unusual pattern of computer traffic, flagging trouble."

Read more of this story at Slashdot.
Sykipot Trojan Variant Stealing DoD Smartcard Credentials

Posted: January 13th, 2012, 11:16pm CET by Soulskill

Tags: security

Trailrunner7 writes "A new research report says variants of the Sykipot Trojan have been found that can steal Dept. of Defense smartcard credentials. The research, published in a blog post Thursday, is the latest by Alien Vault to look at Sykipot, a Trojan horse program known to be used in targeted attacks against the defense industry. The new variants, which Alien Vault believes have been circulating since March, 2011, have been used in 'dozens of attacks' and contain features that would allow remote attackers to steal smart card credentials and access sensitive information."

Read more of this story at Slashdot.
TSA Makes $400K Annually In Loose Change

Posted: January 13th, 2012, 5:37pm CET by Soulskill

Tags: security

Hugh Pickens writes "NBC reports that airport travelers left behind $409,085.56 in loose change at security checkpoints in 2010, providing an additional source of funding for the Transportation Security Administration. 'TSA puts (the leftover money) in a jar at the security checkpoint, at the end of each shift they take it, count it, put it in an envelope and send it to the finance office,' says TSA spokesperson Nico Melendez. 'It is amazing. All that change, it all adds up.' Melendez adds that the money goes into the general operating budget for TSA that is typically used for technology, light bulbs or just overall general expenses. Rep. Jeff Miller (R-Fla.) has introduced legislation that would direct the TSA to transfer unclaimed money recovered at airport security checkpoints to the United Service Organizations (USO), a private nonprofit that operates centers for the military at 41 U.S. airports. The recovered change is not to be confused with the theft that occurs when TSA agents augment their salary by helping themselves to the contents of passengers' luggage as it passes through security checkpoints. For example in 2009, a half dozen TSA agents at Miami International Airport were charged with grand theft after boosting an iPod, bottles of perfume, cameras, a GPS system, a Coach purse, and a Hewlett Packard Mini Notebook from passengers' luggage as travelers at just this one airport reported as many as 1,500 items stolen, the majority of which were never recovered."

Read more of this story at Slashdot.
Researcher's Tool Maps Malware In Elegant 3D Model

Posted: January 13th, 2012, 9:01am CET by samzenpus

Tags: security

Sparrowvsrevolution writes "At the Shmoocon security conference later this month, Danny Quist plans to demo a new three-dimensional version of a tool he's created called Visualization of Executables for Reversing and Analysis, or VERA, that maps viruses' and worms' code into intuitively visible models. Quist, who teaches government and corporate students the art of reverse engineering at Los Alamos National Labs, says he hopes VERA will make the process of taking apart and understanding malware's functionality far easier. VERA observes malware running in a virtual sandbox and identifies the basic blocks of commands it executes. Then those chunks of instructions are color-coded by their function and linked by the order of the malware's operations, like a giant, 3D flow chart. Quist provides a sample video showing a model of a section of the Koobface worm."

Read more of this story at Slashdot.
7000 e-Voting Machines Now Deemed Worthless By Irish Government

Posted: January 13th, 2012, 6:35am CET by samzenpus

Tags: security

First time accepted submitter lampsie writes "Despite spending at least 51 million euro over the last decade buying and storing 7000 e-voting machines from Dutch firm Nedap, the Irish Finance minister has announced that they are now 'worthless'. The machines were originally trialled in 2002 on three regional elections, but a nationwide rollout in 2004 was put on hold after a confidential report expressed serious concern over the security of the voting machines. According to the report, the integrity of the ballot could not be guaranteed with the equipment and controls used. Several years on, and tens of millions later, it looks like the pen and paper ballot will remain for now."

Read more of this story at Slashdot.
Major Financial Groups Share Data To Fight Online Theft

Posted: January 12th, 2012, 3:29pm CET by Soulskill

Tags: security

smitty777 writes "The Wall Street Journal is reporting on some unprecedented steps being taken by major financial institutions to combat online theft. The initiatives include a new type of data center that would be used to analyze bank data for potential security threats. Additionally, a quarterly round-table between the rivals to attack security issues was proposed. The article notes that 'security threats are pushing the big banks to do something that doesn't come naturally for these secrecy-steeped institutions: share information with one another.' A video at MarketWatch digs into it a little bit more, and points out that the banks will spend an estimated $1 billion on protection this year, which represents a 12% increase. Technologically, there has been much discussion of two-factor authentication to improve security. In fact, security officials in Singapore are even hinting at biometric solutions."

Read more of this story at Slashdot.
Symantec Sued For Running Fake "Scareware" Scans

Posted: January 12th, 2012, 2:04pm CET by samzenpus

Tags: security

Sparrowvsrevolution writes "James Gross, a resident of Washington State, filed what he intends to be a class action lawsuit against Symantec in a Northern District California court Tuesday, claiming that Symantec defrauds consumers by running fake scans on their machines, with results designed to bully users into upgrading to a paid version of the company's software. 'The scareware does not conduct any actual diagnostic testing on the computer,' the complaint reads. 'Instead, Symantec intentionally designed its scareware to invariably report, in an extremely ominous manner, that harmful errors, privacy risks, and other computer problems exist on the user's PC, regardless of the real condition of the consumer's computer.' Symantec denies those claims, but it has a history of using fear mongering tactics to bump up its sales. A notice it showed in 2010 to users whose subscriptions were ending in 2010 warned that 'cyber-criminals are about to clean out your bank account...Protect yourself now, or beg for mercy.'"

Read more of this story at Slashdot.
TSA Interested In Purchasing Dosimeters

Posted: January 7th, 2012, 2:25pm CET by timothy

Tags: security

OverTheGeicoE writes "TSA recently announced that it is looking for vendors of 'radiation measurement devices'. According to the agency's Request for Information, these devices 'will assist the TSA in determining if the Transportation Security Officers (TSO) at selected federalized airports are exposed to ionizing radiation above minimum detectable levels, and whether any measured radiation doses approach or exceed the threshold where personnel dosimetry monitoring is required by DHS/TSA policy.' A TSA spokeman claims that their RFI 'did not reflect any heightened concern by the agency about radiation levels that might be excessive or pose a risk to either TSA screeners or members of the traveling public.' Concern outside the agency, however, has always been high. TSA has long been criticized for its apparent lack of understanding of radiological safety, even for its own employees. There has been speculation of a cancer cluster, possibly caused by poor safety practices in baggage screening."

Read more of this story at Slashdot.
Symantec Looks Into Claims of Stolen Source Code

Posted: January 6th, 2012, 6:27am CET by samzenpus

Tags: security

wiredmikey writes "A group of hackers claim to have stolen source code for Symantec's Norton Antivirus software. The group is operating under the name Dharmaraja, and claims it found the data after compromising Indian military intelligence servers. So far it's unclear if the claims are a significant threat, as the information posted thus far by the hackers includes a document dated April 28, 1999, that Symantec describes as defining the application programming interface (API) for the virus Definition Generation Service. However, a second post entitled 'Norton AV source code file list' includes a list of file names reputedly contained within Norton AntiVirus source code package. Symantec said it is still in the process of analyzing the data in the second post." Update: 01/06 07:05 GMT by S : In a post to their Facebook page, Symantec has now said some of their source code was indeed accessed, but it was four or five years old.

Read more of this story at Slashdot.
Linux Foundation Sites Restored

Posted: January 5th, 2012, 2:05am CET by samzenpus

Tags: security

LinuxScribe writes "The Linux Foundation has quietly restored all of the websites it took down following the September 2011 breach that affected Linux.com and all other Foundation websites--an attack that was linked to the August 2011 breach of kernel.org. But one website won't be coming back: the Linux Developer Network, launched in 2008. Content from the site will now be hosted across all of the Linux Foundation's web properties."

Read more of this story at Slashdot.

Slashdot: Linux

Linux Foundation Sites Restored

Posted: January 5th, 2012, 2:05am CET by samzenpus

Tags: security

LinuxScribe writes "The Linux Foundation has quietly restored all of the websites it took down following the September 2011 breach that affected Linux.com and all other Foundation websites--an attack that was linked to the August 2011 breach of kernel.org. But one website won't be coming back: the Linux Developer Network, launched in 2008. Content from the site will now be hosted across all of the Linux Foundation's web properties."

Read more of this story at Slashdot.

Slashdot: IT

Diebold Marries VMs with ATMs to Secure Banking Data

Posted: January 4th, 2012, 11:19pm CET by timothy

Tags: security

gManZboy writes "Automatic teller machine maker Diebold has taken a novel approach to protecting bank customer data: virtualization. Virtualized ATMs store all customer data on central servers, rather than the ATM itself, making it difficult for criminals to steal data from the machines. In places including Brazil, customer data has been at risk when thieves pulled or dynamited ATMs out of their settings and drove off with them. With threats increasing worldwide at many retail points of sale, such as supermarket checkout counters and service station gas pumps, Diebold needed to guarantee the security of customer data entered at the 50,000 ATMs that it manages. Diebold last year partnered with VMware to produce a zero-client ATM. No customer data is captured and stored on the ATM itself." Perhaps Diebold should take the same approach to vote-tabulating machines.

Read more of this story at Slashdot.
One Million Web Pages Attacked By Lilupophilupop

Posted: January 4th, 2012, 5:41pm CET by Unknown Lamer

Tags: security

hankwang writes "The Internet Storm Center reported that one million web pages have been attacked by the Lilupophilupop SQL injection and contain a malicious Javascript link. Affected sites can be found using a Google search query. See also the technical details of the SQL injection. The attack is directed to sites running ASP or ColdFusion with an MSSQL backend. The payload of the Javascript leads, via redirects and obfuscated Javascript, to a fake download page for Adobe Flash and antivirus software."

Read more of this story at Slashdot.
Cleaning Up the Mess After a Major Hack Attack

Posted: January 4th, 2012, 2:13pm CET by Soulskill

Tags: security

Hugh Pickens writes "Kevin Mandia has spent his entire career cleaning up problems much like the recent breach at Stratfor where Anonymous defaced Stratfor's Web site, published over 50,000 of its customers' credit card numbers online and have threatened to release a trove of 3.3 million e-mails, putting Stratfor is in the position of trying to recover from a potentially devastating attack without knowing whether the worst is over. Mandia, who has responded to breaches, extortion attacks and economic espionage campaigns at 22 companies in the Fortune 100 in the last two years and has told Congress that if an advanced attacker targets your company then a breach is inevitable (PDF), calls the first hour he spends with companies 'upchuck hour' as he asks for firewall logs, web logs, and emails to quickly determine the 'fingerprint' of the intrusion and its scope. The first thing a forensics team will do is try to get the hackers off the company's network, which entails simultaneously plugging any security holes, removing any back doors into the company's network that the intruders might have installed, and changing all the company's passwords. 'This is something most people fail at. It's like removing cancer. You have to remove it all at once. If you only remove the cancer in your leg, but you have it in your arm, you might as well have not had the operation on your leg.' In the case of Stratfor, hackers have taken to Twitter to announce that they plan to release more Stratfor data over the next several days, offering a ray of hope — experts say the most dangerous breaches are the quiet ones that leave no trace."

Read more of this story at Slashdot.
Chaos Communication Congress Releases Talks

Posted: January 3rd, 2012, 2:03pm CET by Unknown Lamer

Tags: security

First time accepted submitter jehan60188 writes with this excerpt from an article from Hack a Day: "The 28th Annual Chaos Communication Congress just wrapped things up on December 31st and they've already published recordings of all the talks at the event. These talks were live-streamed, but if you didn't find time in your schedule to see all that you wanted, you'll be happy to find your way to the YouTube collection of the event. The topics span a surprising range. We were surprised to see a panel discussion on depression and suicide among geeks ... which joins another panel called Queer Geeks, to address some social issues rather than just hardcore security tech. But there's plenty of that as well with topics on cryptography, security within web applications, and also a segment on electronic currencies like Bitcoins.'" The CCC wiki has a list of mirrors with downloads in multiple formats (including WebM).

Read more of this story at Slashdot.
Lax Security At Russian Rocket Plant

Posted: January 1st, 2012, 2:32pm CET by timothy

Tags: security

theshowmecanuck writes "Reuters reports that there is little or no security at one of the main factories in Russia responsible for military and Soyuz rocket manufacture. Blogger Lana Sator was able to walk right into the empty (off hours) facility through huge gaps in the fences that no-one bothered to repair, and there was no security to stop them aside from some dogs that didn't bother them either. In fact Lana even has one picture of herself posing next to an apparently non-functional security camera, another of her sitting on what looks like to be possibly a partially assembled rocket motor (someone who knows better can fill us in), and has about 100 photos of the escapade all told on her blog about this (it's in Russian... which I don't speak... any translators out there?). Russian officials are said to be deeply concerned. I wonder if this has any bearing on why Russian rockets haven't been making it into space successfully, or whether it and the launch failures are all part of some general industrial malaise that is taking place."

Read more of this story at Slashdot.
SCADA Vulnerabilities In Prisons Could Open Cell Doors

Posted: January 1st, 2012, 9:00am CET by timothy

Tags: security

Orome1 writes "Many prisons and jails use SCADA systems with PLCs to open and close doors. Using original and publicly available exploits along with evaluating vulnerabilities in electronic and physical security designs, researchers discovered significant vulnerabilities in PLCs used in correctional facilities by being able to remotely flip the switches to 'open' or 'locked closed' on cell doors and gates."

Read more of this story at Slashdot.
Ask Slashdot: Changing Passwords For the New Year?

Posted: December 31st, 2011, 12:50am CET by timothy

Tags: security

New submitter windcask asks "Every New Year's Day, I assemble and memorize a random collection of seven to ten mixed-case alphanumeric characters and proceed to change every password I have on the interwebs to these characters (plus a few extra characters unique to the site). The problem is I only change them on the sites I visit. Once in a while, I'll come across a site I haven't visited for a few years, and I may end up not being able to guess the password before the try-lockout takes effect. What are your password-changing rituals, and how do they deal with situations like mine? I do use Keepass for work, but it is sometimes impractical for times I'm at other computers."

Read more of this story at Slashdot.
Malicious QR Code Use On the Rise

Posted: December 30th, 2011, 7:07pm CET by Soulskill

Tags: security

New submitter EliSowash writes "Malware developers are increasingly using QR Codes as an attack vector. 'The big problem is that the QR code to a human being is nothing more than "that little square with a bunch of strange blocks in it." There's no way to tell what is behind that QR code.' The advice we've always given to the computer user community is 'don't click a link in an email if you don't know who it's from or where it goes' — so how do we protect unsuspecting users from QR codes, where you can't see the destination at all?"

Read more of this story at Slashdot.
Attack Tool Released For WPS Setup Flaw

Posted: December 30th, 2011, 11:05am CET by samzenpus

Tags: security

Trailrunner7 writes "Just a day after security researcher Stefan Viehbock released details of a vulnerability in the WiFi Protected Setup (WPS) standard that enables attackers to recover the router PIN, a security firm has published an open-source tool capable of exploiting the vulnerability. The tool, known as Reaver, has the ability to find the WPS PIN on a given router and then recover the WPA passphrase for the router, as well. Tactical Network Solutions has released the tool as an open-source project on Google Code, but also is selling a more advanced commercial version."

Read more of this story at Slashdot.
Progressive Era Hacker Griefed Marconi Demonstration

Posted: December 28th, 2011, 9:36pm CET by samzenpus

Tags: security

nbauman writes "In June 1903, Gugliemo Marconi and his partner Ambrose Flemming were about to give the first demonstration of long-range wireless communication at the Royal Institution in London, which, Marconi said, could be sent in complete confidentiality with no fear of the messages being hijacked. Suddenly, the silence was broken by a huge mysterious wireless pulse strong enough to take over the carbon-arc projector and make it sputter messages in Morse Code. First, it repeated the word 'Rats' over and over again (abusive at that time). Then it tapped out, 'There was a young fellow of Italy, who diddled the public quite prettily.' Further rude epithets followed. It was Nevil Maskelyne, a stage musician and inventor who was annoyed because Marconi's patents prevented him from using wireless. It was the first hacking, to demonstrate an insecure system."

Read more of this story at Slashdot.
New York Times Hacked?

Posted: December 28th, 2011, 8:50pm CET by samzenpus

Tags: security

First time accepted submitter porsche911 writes "It looks like the NYTimes have been hacked and a large number of subscribers spammed with messages about cancellation of their service. The phone system is overwhelmed as well. The Times is currently saying the email is a fake, but that raises other worries. They were one of the only 3rd parties that had the email in question so it appears either someone really screwed up or they've suffered a data breach." Update: 12/28 21:59 GMT by S : Looks like it was just a mistake by an employee.

Read more of this story at Slashdot.
Will Hackers Try To Disrupt the Iowa Caucuses?

Posted: December 27th, 2011, 2:03pm CET by Unknown Lamer

Tags: security

Hugh Pickens writes "The Iowa Republican Party is boosting the security of the electronic systems it will use to count the first votes of the 2012 presidential campaign after receiving a mysterious threat to its computers in a video urging its supporters to shut down the Iowa caucuses .... 'It's very clear the data consolidation and data gathering from the caucuses, which determines the headlines the next morning, who might withdraw or resign from the process, all of that is fragile,' says Douglas Jones, a computer science professor at the University of Iowa who has consulted for both political parties. The state GOP fears such a delay could disrupt the traditional influence of Iowa's first-in-the-nation vote. 'With the eyes of the media on the state, the last thing we want to do is have a situation where there is trouble with the reporting system,' says Wes Enos, a member of the Iowa GOP's central committee. The GOP is encouraging party activists who run the precinct votes to use paper ballots instead of a show of hands, which has been the practice in some areas so the ballots can provide a backup in the event of any later confusion about the results. 'There is really only one way — and it needn't be a secret — to help assure that results cannot easily be manipulated by either Anonymous or by GOP officials themselves,' writes Brad Friedman. 'The hand-counted paper ballot system, with decentralized results posted at the "precincts," is the only way to try and protect against manipulation of the results from either insiders or outsiders.'"

Read more of this story at Slashdot.
Researchers Build TCP-Based Spam Detection

Posted: December 26th, 2011, 7:04pm CET by samzenpus

Tags: security

itwbennett writes "In a presentation at the Usenix LISA conference in Boston, researchers from the Naval Academy showed that signal analysis of factors such as timing, packet reordering, congestion and flow control can reveal the work of a spam-spewing botnet. The work 'advanced both the science of spam fighting and ... worked through all the engineering challenges of getting these techniques built into the most popular open-source spam filter,' said MIT computer science research affiliate Steve Bauer, who was not involved with the work. 'So this is both a clever bit of research and genuinely practical contribution to the persistent problem of fighting spam.'"

Read more of this story at Slashdot.
New Car Anti-Theft Device Profiles Your Rear End

Posted: December 26th, 2011, 2:06pm CET by samzenpus

Tags: security

Hugh Pickens writes "A car-seat identifier developed at Japan's Advanced Institute of Industrial Technology by Associate Professor Shigeomi Koshimizu can recognize a person by his or her rear end with 98 percent accuracy when the person takes a seat in his car. The bucket seat's lower section is lined with 360 pressure sensors that measure pressure on a scale from 0 to 256, sending information to a laptop, which aggregates the information, generates the key data and produces a precise map of the seated person's rear profile. Researchers say traditional biometric techniques such as iris scanners and fingerprint readers cause stress to people undergoing identity checks, while the simple act of getting seated carries less psychological baggage. Koshimizu wants to see his work available commercially as an anti-theft product in two to three years if automakers agree to collaborate. He sees possibilities of this device being used beyond auto-theft identity protection to a device for security identification in office settings, where users log on to their PCs as they sit down."

Read more of this story at Slashdot.
U.S. Congress Authorizes Offensive Use of Cyberwarfare

Posted: December 23rd, 2011, 9:40pm CET by Soulskill

Tags: security

smitty777 writes "Congress has recently authorized the use of offensive military action in cyberspace. From the December 12th conference on the National Defense Authorization Act, it states, 'Congress affirms that the Department of Defense has the capability, and upon direction by the President may conduct offensive operations in cyberspace to defend our Nation, Allies and interests, subject to: (1) the policy principles and legal regimes that the Department follows for kinetic capabilities, including the law of armed conflict; and (2) the War Powers Resolution.' According to the FAS, 'Debate continues on whether using the War Powers Resolution is effective as a means of assuring congressional participation in decisions that might get the United States involved in a significant military conflict.'"

Read more of this story at Slashdot.
Trion Worlds' Rift Account Database Compromised

Posted: December 23rd, 2011, 7:07pm CET by Soulskill

Tags: security

New submitter Etrahkad writes "Trion Worlds, publisher of MMORPG Rift, has announced that somebody broke into one of their databases and gained access to user information. First Sony and now Rift... my identity has probably been stolen several times over, now. From the e-mail: 'We recently discovered that unauthorized intruders gained access to a Trion Worlds account database. The database in question contained information including user names, encrypted passwords, dates of birth, email addresses, billing addresses, and the first and last four digits and expiration dates of customer credit cards. ... there is no evidence, and we have no reason to believe, that full credit card information was accessed or compromised in any way." Are game companies not concerned with preventing these attacks?"

Read more of this story at Slashdot.
The Problem With Windows 8's Picture Password

Posted: December 22nd, 2011, 11:34pm CET by timothy

Tags: security

alphadogg writes "The Windows 8 feature that logs users in if they touch certain points in a photo in the right order might be fun, but it's not very good security, according to the inventor of RSA's SecurID token. 'It's cute,' says Kenneth Weiss, who now runs a three-factor authentication business called Universal Secure Registry. 'I don't think it's serious security.' The major downside of the picture password is that drawing a finger across a photo on a touch screen is easy to video record from a distance — making it relatively easy to compromise, he says."

Read more of this story at Slashdot.
Researcher Claims Siemens Lied About Security Bugs

Posted: December 21st, 2011, 11:57pm CET by samzenpus

Tags: security

chicksdaddy writes "A month after an unknown gray hat hacker calling himself 'pr0f' used a three character password to hack his way onto Siemens software used to manage water treatment equipment in South Houston, Texas, a security researcher working for Google is accusing the company of trying to cover up the existence of other, more serious vulnerabilities in its products. Billy Rios has disclosed a range of vulnerabilities in Siemens SIMATIC software on his blog. The holes could allow a remote attacker to gain access to the Simatic user interface without a user name and password. Rios claims that he has disclosed the hole to Siemens and that the company has acknowledged the problem, only to deny its existence when a reporter asked for more information about the vulnerability."

Read more of this story at Slashdot.
Book Review: Defense Against the Black Arts

Posted: December 21st, 2011, 11:11pm CET by samzenpus

Tags: security

brothke writes "If there ever was a book that should not be judged by its title, Defense against the Black Arts: How Hackers Do What They Do and How to Protect against It, is that book. Even if one uses the definition in The New Hackers Dictionary of 'a collection of arcane, unpublished, and (by implication) mostly ad-hoc techniques developed for a particular application or systems area', that really does not describe this book. The truth is that hacking is none of the above. If anything, it is a process that is far from mysterious, but rather aether to describe. With that, the book does a good job of providing the reader with the information needed to run a large set of hacking tools." Read below for the rest of Ben's review.

Read more of this story at Slashdot.
Tech Forensics Take Center Stage in Manning Pre-Trial

Posted: December 20th, 2011, 2:04pm CET by Unknown Lamer

Tags: security

smitty777 writes with some updates from Bradley Manning's Article 32 hearing: "Wired has been reporting all [yester]day on the prosecution's technological evidence against Bradley Manning. The first is on the technology and techniques used by Manning. In the second, the examiners admit they didn't find any matching cables on Manning's computer. And finally, evidence that Manning chatted directly with Assange himself." The prosecution was able to access chat logs and other bits of evidence (which had been deleted, but not scrubbed from the disk) thanks to PFC Manning's use of the same password for his OS login and encryption passphrase. Oops.

Read more of this story at Slashdot.
Rare Earth Magnets Pose Threat To Children

Posted: December 17th, 2011, 2:27pm CET by timothy

Tags: security

Hugh Pickens writes writes "Many of today's toys contain rare-earth magnets which are much more powerful than the magnets of yesteryear and the magnets pose a serious threat to children when more than one is ingested because as the magnets attract one another they can cause a range of serious injuries, including holes through internal organs, blood poisoning and death (PDF). Braden Eberle, 4, swallowed two tiny magnets from his older brother's construction kit on two successive days last spring and his mother's first reaction was that the magnet would pass through her son's system without a problem. "People swallow pennies of the same size every day," said Jill Eberle. "They're smaller than an eraser." But next morning, with Braden still in pain, the family's doctor told them to go straight to the emergency room where an X-ray revealed two magnets were stuck together. "They were attracted to each other with the wall of each segment they were in stuck together," said Dr. Sanjeev Dutta, the pediatric surgeon at Good Samaritan Hospital who would operate on Braden later that day. "Because they were so powerful, the wall of the intestine was getting squeezed, squeezed, squeezed, and then it just necrosed, or kind of rotted away, and created a hole between the two." The US Consumer Product Safety Commission (CPSC) says at least 33 children have been injured from ingesting magnets (PDF) with a 20 month-old dying, and at least 19 other children requiring surgery."

Read more of this story at Slashdot.
Was Russia Behind Stuxnet?

Posted: December 11th, 2011, 8:14am CET by Soulskill

Tags: security

An anonymous reader writes "Despite the U.S. and Israel being widely assumed to be responsible for Stuxnet, Russia is the more likely culprit, says U.S. Air Force cyber analyst. The nuclear gangsterism of the past 20 years gives it plenty of motive. Quoting: 'So what better way to maintain Russian interests, and innocence, than to plant a worm with digital U.S.-Israeli fingerprints? After all, Russian scientists and engineers are familiar with the cascading centrifuges whose numbers and configuration – and Siemen’s SCADA PLC controller schematics – they have full access to by virtue of designing the plants. ... the observers of the virus could alert the Iranians before full nuclear catastrophe struck. The Belarusian computer security experts who 'discovered' the code seemingly played that role well. They didn't seem too preoccupied with reverse engineering the malicious code to see what it was designed to do.'"

Read more of this story at Slashdot.
Another Dutch CA Hacked

Posted: December 8th, 2011, 3:13pm CET by timothy

Tags: security

An anonymous reader writes "After the fiasco involving DigiNotar, another Dutch CA (Gemnet, a daughter of KPN-Telecom) has been hacked and databases were accessed, webwereld.nl reports (Dutch original). The hack was possible because the website was managed using PHP-MyAdmin, and this application allowed database access without a password. The site has been shut down and security checks were ordered."

Read more of this story at Slashdot.
Study Shows Many Sites Still Failing Basic Security Measures

Posted: December 7th, 2011, 5:38pm CET by Unknown Lamer

Tags: security

Orome1 writes with a summary of a large survey of web applications by Veracode. From the article: "Considered 'low hanging fruit' because of their prevalence in software applications, XSS and SQL Injection are two of the most frequently exploited vulnerabilities, often providing a gateway to customer data and intellectual property. When applying the new analysis criteria, Veracode reports eight out of 10 applications fail to meet acceptable levels of security, marking a significant decline from past reports. Specifically for web applications, the report showed a high concentration of XSS and SQL Injection vulnerabilities, with XSS present in 68 percent of all web applications and SQL Injection present in 32 percent of all web applications."

Read more of this story at Slashdot.
Adobe Warns of Critical Zero Day Vulnerability

Posted: December 7th, 2011, 2:18am CET by Soulskill

Tags: security

wiredmikey writes "Adobe issued an advisory today on a zero-day vulnerability (CVE-2011-2462) that has come under attack in the wild. According to Adobe, the issue is a U3D memory corruption vulnerability that can be exploited to cause a crash and permit an attacker to hijack a system. So far, there are reports the vulnerability is being exploited in limited, targeted attacks against Adobe Reader 9.x on Windows. However, the bug also affects Adobe Reader and Acrobat 9.4.6 and earlier 9.x versions for UNIX and Macintosh computers, as well as Adobe Reader X (10.1.1) and Acrobat X (10.1.1) and earlier 10.x versions on Windows and Mac. Patches for Windows and Mac users of Adobe Reader X and Acrobat X will come on the next quarterly update, scheduled for Jan. 10, 2012."

Read more of this story at Slashdot.
UK Recruiting Codebreakers Via Social Networks

Posted: December 2nd, 2011, 10:56am CET by samzenpus

Tags: security

Demerara writes in with a story about a unique codebreaking competition sponsored by the UK government. "UK intelligence agency GCHQ has launched a code-cracking competition to help attract new talent. The organization has invited potential applicants to solve a visual code posted at an unbranded standalone website. The challenge has also been 'seeded' to social media sites, blogs and forums. A spokesman said the campaign aimed to raise the profile of GCHQ to an audience that would otherwise be difficult to reach. 'The target audience for this particular campaign is one that may not typically be attracted to traditional advertising methods and may be unaware that GCHQ is recruiting for these kinds of roles,' the spokesman said."

Read more of this story at Slashdot.
Bank Accounts Vulnerable For Victims of ZeuS Trojan Variant 'Gameover'

Posted: December 2nd, 2011, 12:12am CET by timothy

Tags: security

tsu doh nimh writes "Organized crooks have begun launching debilitating cyber attacks against banks and their customers as part of a smoke screen to prevent victims from noticing simultaneous high-dollar cyber heists, the FBI is warning. The thefts, aided by a custom variant of the ZeuS Trojan called 'Gameover,' are followed by distributed denial of service (DDoS) attacks against banks and the victim customers. The feds say the perpetrators also are wiring some of the money from victim organizations directly to high-end jewelry stores, and then sending money mules to pick up the pricey items."

Read more of this story at Slashdot.
Duqu Attackers Managed to Wipe C&C Servers

Posted: November 30th, 2011, 5:46pm CET by Unknown Lamer

Tags: security

Trailrunner7 writes with an update in the saga of Duqu and Stuxnet. From the article: "Shortly after the first public reports about Duqu emerged in early autumn, the crew behind Duqu wiped out all of the command-and-control servers that had been in use up to that point, including some that had been used since 2009. An in-depth analysis of the known C&C servers used in the Duqu attacks has found that some of the servers were compromised as far back as 2009, and that the attackers clearly targeted Linux machines. All of the known Duqu C&C servers discovered up to this point have been running CentOS ... There also is some evidence that the attackers may have used a zero-day in OpenSSH 4.3 to compromise the C&C servers initially."

Read more of this story at Slashdot.
Behind the Government's Rules of Cyber War

Posted: November 30th, 2011, 12:43am CET by Soulskill

Tags: security

wiredmikey writes "Deciding when malware becomes a weapon of war that warrants a response in the physical world – for example, a missile – has become a necessary part of the discussion of military doctrine. The Pentagon recently outlined (PDF) its working definition of what constitutes cyber-war and when subsequent military strikes against physical targets may be justified as result. The main issue is attribution of cyber attacks. The Department of Defense is working to develop new ways to trace the physical source of an attack and the capability to identify an attacker using behavior-based algorithms. 'If a country is going to fire a missile at someone, it better be sure it has the right target,' said one expert. A widely held misconception in the U.S. government is our offensive capabilities provide defensive advantage by identifying attacker toolkits and methods in foreign networks prior to them hitting our networks. So when do malware and cyber attacks become a weapon or act of war that warrant a real-world military response?"

Read more of this story at Slashdot.
AT&T Customer Phone Hacking Tied To Terrorists

Posted: November 27th, 2011, 3:34pm CET by samzenpus

Tags: security

theodp writes "Have you ever hacked into AT&T customer accounts and diverted money to terrorism-financing groups? You will. In 2003, the NY Times reported that AT&T contended U.S. victims of a Philippines-based telephone hacking swindle were responsible for long-distance calls fraudulently made through their voice mail systems. At the time, the city of East Palo Alto was slapped with a $30,000 long-distance phone bill that resulted from voice-mail hacking. Fast forward to 2011, and the NY Times is reporting that a Philippines-based group hacked into the accounts of AT&T business customers in the U.S. and diverted money to an organization that financed terrorist attacks across Asia. But it's not quite deja-vu-all-over-again. While it'd make a better story if AT&T contended customers were responsible for the charges and any ensuing terrorism, AT&T reimbursed the victims of the hacking this time around."

Read more of this story at Slashdot.
Hacker Tries To Land IT Job At Marriott Via Extortion

Posted: November 27th, 2011, 8:11am CET by Soulskill

Tags: security

wiredmikey writes "A tough global economy has certainly created challenges for many people looking for jobs, but one Hungarian man took things to another level in an effort to gain employment at hotel giant Marriott International. On Wednesday, the 26-year-old man pleaded guilty to charges that he hacked into Marriott computer systems and threatened to reveal confidential company information if Marriott didn't offer him a job. Assuming his efforts were working, with the possibility of a new job with Marriott in his sights, the hacker arrived at Washington Dulles Airport on Jan. 17, 2011, using an airline ticket purchased by Marriott for him. He thought he would be attending a job interview with Marriott personnel. Unbeknown to him, he was actually being 'interviewed' by a Secret Service agent posing as a Marriott employee."

Read more of this story at Slashdot.
Airport Security: Thermal Lie-Detectors, Cloned Sniffer Dogs

Posted: November 26th, 2011, 3:30pm CET by Soulskill

Tags: security

PolygamousRanchKid writes with this quote from CNN about the future of airport security: "Earlier this year, the International Air Transport Association demonstrated its vision for the 'checkpoint of the future' — a series of neon-lit tunnels, each equipped with an array of eye-scanners, x-ray machines, and metal and liquid detectors. ... 'Known Travelers,' (those who have completed background checks with government authorities) for instance, will cruise through the light blue security corridor with little more than an ID check, while those guided through the yellow 'Enhanced' corridor will be subjected to an array of iris scans and sensitive contraband detectors. ... Feeling guilty? Got something to hide? A team of UK-based researchers claim to have developed a thermal lie-detection camera that can automatically spot a burning conscience. ... Professor Byeong-chun Lee, who established his reputation in 2005 as the driving force behind the world's first ever dog clone, has bought a new breed of super-sniffers to South Korea's Incheon Airport. They may look like an ordinary pack of golden Labrador Retrievers, but these dogs are all genetically identical to 'Chase,' a dog whose legendary snout kept him top of Incheon's drug-detection rankings right up until his retirement in 2007."

Read more of this story at Slashdot.
Water Pump Destruction Not Due To SCADA Hack

Posted: November 23rd, 2011, 5:44pm CET by Unknown Lamer

Tags: security

knifeyspooney writes "According to the Springfield State Journal-Register, the city's recent public water system failure was not caused by malicious activity. One water district trustee spoke this gem: 'First, they tell us that it's the first instance of cyber hacking in the entire world, and everyone goes nuts. Now, all of a sudden, they tell us it's not.'"

Read more of this story at Slashdot.
CarrierIQ Tries To Silence Security Researcher

Posted: November 23rd, 2011, 1:36am CET by Soulskill

Tags: security

phaedrus5001 sends this quote from a story at Wired: "A data-logging software company is seeking to squash an Android developer's critical research into its software that is secretly installed on millions of phones, but Trevor Eckhart is refusing to publicly apologize for his research and remove the company's training manuals from his website. Though the software is installed on millions of Android, Blackberry and Nokia phones, Carrier IQ was virtually unknown until the 25-year-old Eckhart analyzed its workings, recently revealing that the software secretly chronicles a user's phone experience, from its apps, battery life and texts. Some carriers prevent users who actually find the software from controlling what information is sent." The EFF is hosting PDFs of CarrierIQ's C&D letter, as well as their response on Eckhart's behalf.

Read more of this story at Slashdot.
Users' Data Target Of 'Targeted Attack' on AT&T

Posted: November 22nd, 2011, 5:43pm CET by timothy

Tags: security

New submitter fran6gagne writes "AT&T [Monday] notified customers of an effort by hackers to collect online account information. It is not believed that the perpetrators of this attack obtained access to sensitive information." eWeek's account has a bit more detail.

Read more of this story at Slashdot.
SCADA Hacker: Water District Used 3-Character Password

Posted: November 21st, 2011, 4:12pm CET by samzenpus

Tags: security

Trailrunner7 writes "In an e-mail interview with Threatpost, a hacker who compromised software used to manage water infrastructure for South Houston, Texas, said the district had HMI (human machine interface) software used to manage water and sewage infrastructure accessible to the Internet and used a password that was just three characters long. The hacker, using the handle 'pr0f' took credit for a remote compromise of supervisory control and data acquisition (SCADA) systems. Communicating from an e-mail address tied to a Romanian domain, the hacker told Threatpost that he discovered the vulnerable system using a scanner that looks for the online fingerprints of SCADA systems. 'This was barely a hack. A child who knows how the HMI that comes with Simatic works could have accomplished this,' he wrote in an e-mail."

Read more of this story at Slashdot.
Why Do Companies Backup So Infrequently?

Posted: November 18th, 2011, 9:21am CET by samzenpus

Tags: security

Orome1 writes "Businesses are on average backing up to tape once a month, with one alarming statistic showing 10 percent were only backing up to tape once per year, according to a survey by Vanson Bourne. Although cloud backup solutions are becoming more common, still the majority of companies will do their backups in-house. Sometimes they will have dedicated IT staff to run them, but usually it's done in-house because they have always done it like that, and they have confidence in their own security and safekeeping of data."

Read more of this story at Slashdot.
Identifying Nuclear Scientists Willing To Sell Their Knowledge

Posted: November 17th, 2011, 11:53am CET by samzenpus

Tags: security

Harperdog writes "This is an interesting piece on U.S. programs most people don't know about: programs to identify and win over nuclear scientists who might be willing to sell their know-how to non-nuclear countries. Fascinating discussion, and points to the alleged Russian scientist who is reported to have sold information to Iran. How could he have been stopped?"

Read more of this story at Slashdot.
TSA Puts Off Safety Study of X-ray Body Scanners

Posted: November 16th, 2011, 10:52pm CET by samzenpus

Tags: security

zokuga writes "ProPublica reports that the TSA is backing off a previous promise to conduct a new independent study of X-ray body scanners used at airport security lanes around the country. Earlier this month, an investigation found that TSA had glossed over research about the risks from the X-rays."

Read more of this story at Slashdot.
Experts 'Convinced' Duqu Work of Stuxnet Authors

Posted: November 16th, 2011, 7:48pm CET by samzenpus

Tags: security

Trailrunner7 writes "Researchers are fairly confident now that whoever wrote the Duqu malware was also involved in developing the Stuxnet worm. They're also confident that they have not yet identified all of the individual components of Duqu, meaning that there are potentially some other capabilities that haven't been documented yet. There was a lot of speculation when Duqu first emerged about whether the attack was the work of the same group--still unknown--that had created Stuxnet and unleashed it on Iran's nuclear facilities last year. Some of that was centered on supposed similarities in the code between the two pieces of malware, but that was before many of the individual components of Duqu had been identified and analyzed. Now that the analysis and research into the Duqu malware have advanced a bit, researchers say they've found more evidence that points to the malware being the work of the Stuxnet authors or their close associates. 'I'm convinced it's the same group,' Costin Raiu, director of global research and analysis at Kaspersky Lab, who has done much of the analysis of Duqu, said."

Read more of this story at Slashdot.
Romanian Accused of Breaking Into NASA

Posted: November 16th, 2011, 4:13pm CET by Unknown Lamer

Tags: security

alphadogg writes "Romanian authorities have arrested a 26-year old hacker who is accused of breaking into multiple NASA servers and causing $500,000 in damages to the U.S. space agency's systems. Robert Butyka, 26, was arrested on Tuesday in Western Romania following an investigation by the Romanian Directorate for Investigating Organized Crime and Terrorism. According to local reports, the hacker used the online moniker of 'Iceman.' He does not have a higher education or an occupation, a DIICOT spokeswoman said."

Read more of this story at Slashdot.
New Malware Signed With Stolen Government Certificate

Posted: November 15th, 2011, 10:32pm CET by samzenpus

Tags: security

Trailrunner7 writes "Security researchers claim that malware spreading via malicious PDF files is signed with a valid certificate stolen from the Government of Malaysia, in just the latest evidence that scammers are using gaps in the security of digital certificates to help spread malicious code. The malware, identified by F-Secure as a Trojan horse program dubbed Agent.DTIW, was detected in a signed Adobe PDF file by the company's virus researchers recently. The malicious PDF was signed using a valid digital certificate for mardi.gov.my, the Agricultural Research and Development Institute of the Government of Malaysia. According to F-Secure, the Government of Malaysia confirmed that the certificate was legitimate and had been stolen 'quite some time ago.'"

Read more of this story at Slashdot.
Inside the Duqu Worm's Source Code

Posted: November 14th, 2011, 5:12am CET by samzenpus

Tags: security

angry tapir writes "Wrapped in the code the Duqu worm uses to infect computers is the message: 'Copyright (c) 2003 Showtime Inc. All rights reserved. DexterRegularDexter.' An analysis of the worm has also revealed that Duqu, which is similar to Stuxnet and may even have been written by the same developers, may be four years old and that it generally tries to steal information on Wednesdays."

Read more of this story at Slashdot.
Mac OS X Sandbox Security Hole Uncovered

Posted: November 14th, 2011, 12:30am CET by samzenpus

Tags: security

Gunkerty Jeb writes "Researchers at Core Security Technologies have uncovered a security hole that could allow someone to circumvent the application sandbox restrictions of Mac OS X. The report of the vulnerability, which affects Mac OS X 10.7x, 10.6x and 10.5x, follows Apple's announcement earlier this month that all applications submitted to the Mac App store must implement sandboxing as of March 1, 2012. Sandboxing, Apple has argued, limits the resources applications can access and makes it more difficult for malware to compromise systems. Researchers at Core however revealed Nov. 10 that they had warned Apple in September about a vulnerability in their sandboxing approach. According to Core's advisory, several of the default predefined sandbox profiles fail to 'properly limit all the available mechanisms.' As a result, the sandboxing restrictions can be circumvented through the use of Apple events."

Read more of this story at Slashdot.
So You Want To Be a Zero Day Exploit Millionaire?

Posted: November 11th, 2011, 10:03pm CET by Soulskill

Tags: security

gManZboy writes "There's a thriving trade in zero-day vulnerabilities, predicated on keeping knowledge of these vulnerabilities out of the public domain. For security researchers with knowledge of a bug that's not worth much, or for researchers who question the ethics of selling any bug information, there are alternatives. Vulnerability information service Secunia launched its Secunia Vulnerability Coordination Reward Program, which formalizes what Secunia says it's been doing informally for some time: It acts as a go-between for security researchers that have discovered a vulnerability in a product, and the vendor of that product. Do such practices jeopardize security for the many, while safeguarding just the few? It's still unclear whether Stuxnet's authors discovered the zero-day vulnerabilities themselves, procured them from a legal market, or bought them on the black market. If you're going to cash in, you face some tough ethical questions."

Read more of this story at Slashdot.
DARPA Wants To Get Rid of Password Protection

Posted: November 11th, 2011, 6:47am CET by samzenpus

Tags: security

coondoggie writes "Researchers from the Defense Advanced Research Projects Agency will next week detail a new program it hopes will develop technology to dramatically change computer system security authorization. The program, called Active Authentication, looks to develop technology that goes way beyond today's use of hard to remember password protection and determine identity through 'use of software applications that can determine identity through the activities the user normally performs,' DARPA said."

Read more of this story at Slashdot.
Valve Announces Massive Steam Server Intrusion

Posted: November 11th, 2011, 1:02am CET by samzenpus

Tags: security

SKYMTL writes "Valve has revealed that hackers have gained access to the Steam database and have pulled a variety of information. A statement from Gabe Newell reads in part: 'Dear Steam Users and Steam Forum Users, Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums. We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating. We don’t have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely."

Read more of this story at Slashdot.
Vulnerabilities Discovered In Prison SCADA Systems

Posted: November 8th, 2011, 4:01am CET by Unknown Lamer

Tags: security

phaedrus5001 writes with an excerpt from an Ars Technica article: "Researchers have demonstrated a vulnerability in the computer systems used to control facilities at federal prisons that could allow an outsider to remotely take them over, doing everything from opening and overloading cell door mechanisms to shutting down internal communications systems. ... The researchers began their work after [John] Strauchs was called in by a warden to investigate an incident in which all the cell doors on one prison's death row spontaneously opened."

Read more of this story at Slashdot.
Brazilian ISPs Hit With Massive DNS Attack

Posted: November 7th, 2011, 11:06pm CET by Soulskill

Tags: security

wiredmikey writes "Millions of people in Brazil have potentially been exposed to malware, as a result of a nationwide DNS attack. Additionally, several organizations in Brazil are reporting that network devices are also under attack. After being compromised remotely, scores of routers and modems had their DNS settings altered to redirect traffic. In those cases, when employees of the affected companies tried to open any website, they were asked to execute a malicious Java applet, which would install malware presented as 'Google Defence' software."

Read more of this story at Slashdot.
Help Rename the Department of Homeland Security

Posted: November 7th, 2011, 4:47pm CET by samzenpus

Tags: security

Hugh Pickens writes "James Fallows writes tongue in cheek that U.S. Department of Fear, led by Secretary of Fear Malcolm P. Stag III, is running a poll. To what should we re-name the Department of Homeland Security? 'Possibilities include Department of ScaredyCatLand Security, reflecting the prevailing mentality of an era, and Department of Fatherland Security, to make us sound strong,' writes Fallows. 'There are many more to choose from, plus you can write in your own nominees. But act now, because the polls close Tuesday.'"

Read more of this story at Slashdot.
Hacked MIT Server Used To Stage Attacks

Posted: November 7th, 2011, 12:40am CET by timothy

Tags: security

wiredmikey writes "A compromised server at the Massachusetts Institute of Technology (MIT) has been identified as being used as a vulnerability scanner and attack tool, probing the Web for unprotected domains and injecting code. According to researchers, the ongoing attacks appear to be related to the Blackhole Exploit Pack, a popular crime kit used by criminals online. The attacks started in June, and an estimated 100,000 domains could have been compromised. Judging by initial data, one MIT server (CSH-2.MIT.EDU) hosts a malicious script actively used by cyber-crooks to scan the web for vulnerable websites. These types of attacks are how BlackHat SEO scams are propagated, which target search results in order to spread rogue anti-virus or other malware. In addition, compromised hosts are also leveraged for other schemes, such as spam or botnet control."

Read more of this story at Slashdot.
Open Source Tool Scans For Duqu Drivers

Posted: November 6th, 2011, 9:18am CET by timothy

Tags: security

wiredmikey writes "A new open source scanning tool has been released by engineers at independent security testing firm NSS Labs that can be used to detect Duqu drivers installed on a system. The tool was developed with the goal of discovering any additional drivers, and to enable researchers to learn more about the functionality, capabilities and ultimate purpose of the Duqu malware."

Read more of this story at Slashdot.
MS Traces Duqu Zero-Day To Font Parsing In Win32k

Posted: November 5th, 2011, 12:00pm CET by timothy

Tags: security

yuhong writes "MS has traced the Duqu zero-day to a vulnerability in font parsing in win32k. Many file formats like HTML, Office, and PDF support embedded fonts, and in NT4 and later fonts are parsed in kernel mode! Other possible attack vectors, for example, include web pages visited using web browsers that support embedded fonts without the OTS font sanitizer (which recent versions of Firefox and Chrome have adopted)." Adds reader Trailrunner7: "This is the first time that the exact location and nature of the flaw has been made public. Microsoft said that the permanent fix for the new vulnerability will not be ready in time for next week's November patch Tuesday release."

Read more of this story at Slashdot.
Book Review: Securing the Clicks

Posted: November 4th, 2011, 9:14pm CET by samzenpus

Tags: security

brothke writes:"The book Digital Assassination: Protecting Your Reputation, Brand, or Business Against Online Attacks says businesses that take days to respond to social media issues are way behind the curve. Social media operates in real-time, and responses need to be almost as quick. In a valuable new book on the topic, Securing the Clicks Network Security in the Age of Social Media, Gary Bahadur, Jason Inasi and Alex de Carvalho provide the reader with a comprehensive overview on how not to be a victim of social media based security problems." Read on for the rest of Ben's review.

Read more of this story at Slashdot.
How X-Ray Scanners Became Mandatory In US Airports

Posted: November 2nd, 2011, 1:09pm CET by Soulskill

Tags: security

OverTheGeicoE writes "ProPublica has a story on how x-ray scanners became the controversial yet mandatory security fixtures we in the US must now endure. The story title, 'U.S. Government Glossed Over Cancer Concerns As It Rolled Out Airport X-Ray Scanners,' summarizes a substantial part of the article, but not all of it. The story also describes how government attitudes about the scanners went from overwhelmingly negative in the early 1990s to the naive optimism we see today. How did this change occur? The government weakened its regulatory structure for radiation safety in electronic devices, and left defining safety standards to an ANSI committee dominated by scanner producers and users (prison and customs officials). Even after 9/11 there was still great mistrust of x-ray scanners, but nine years of lobbying from scanner manufacturers, panic over failed terrorist attacks, and pressure from legislators advancing businesses in their own districts eventually forced the devices into the airports. The article estimates that 6 to 100 cancers per year will be caused by the x-ray scanners."

Read more of this story at Slashdot.
Anonymous Cancels Drug-Ring Attack

Posted: November 1st, 2011, 8:52pm CET by Soulskill

Tags: security

snydeq writes "Anonymous supporters have backed off threats to expose Zeta drug gang collaborators, an operation launched in early October as a retaliation for an alleged kidnapping of an Anonymous follower by the Mexico-based drug gang. Members of Anonymous had posted a video claiming the group could identify journalists, police officers, and taxi drivers who collaborate with the Zeta crime syndicate. Zeta has not shied away from targeting its online critics. In September the crime group hung two people from an overpass warning bloggers and 'online snitches' to beware. The decapitated body of another social-media reporter was found later with a similar warning. Worried about the impact on both misidentified people and Anonymous followers, other supporters of the Anonymous movement worked to dismantle the operation over the weekend. In effect, the group canceled the attack, according to online news site Milenio."

Read more of this story at Slashdot.
Spear Phishing Campaign Hits Dozens of Chemical, Defense Firms

Posted: November 1st, 2011, 4:34pm CET by timothy

Tags: security

Orome1 writes "Nearly 50 (and quite possibly more) companies in the chemical, defense, and other sectors have been hit with a spear phishing campaign carrying a backdoor Trojan with the ultimate goal of exfiltrating R&D and manufacturing information, revealed Symantec in a newly released report. The attacks against these companies started in late July 2011 and lasted until the middle of September 2011, but the attackers are thought to be the same ones who targeted human rights related NGOs and companies in the motor industry in May." Here's a link to the report itself (PDF).

Read more of this story at Slashdot.
Authorities Seize Duqu's C&C Servers In Mumbai

Posted: October 31st, 2011, 3:11pm CET by samzenpus

Tags: security

wiredmikey writes "In Mumbai, Indian authorities seized components from servers in a data center after Symantec informed them that they were communicating with the command and control infrastructure used by Duqu, the Trojan that is touted as the precursor to the next Stuxnet. According to a report from Reuters, officials the Department of Information Technology in India seized hard drives and other components from a server hosted in a Mumbai data center. Security vendors and government labs are worried that malware such as Duqu and Stuxnet are the building blocks needed in order for attackers to target critical infrastructure. Based on the initial analysis of Duqu, many researchers warned that it was the second generation development of Stuxnet, but this is still the subject of much debate, with some experts now saying that the connection between the two malicious programs is questionable."

Read more of this story at Slashdot.
TSA's VIPR Bites Rail, Bus, and Ferry Passengers

Posted: October 28th, 2011, 9:23pm CEST by Soulskill

Tags: security

OverTheGeicoE writes "TSA's VIPR program may be expanding. According to the Washington Times, 'TSA has always intended to expand beyond the confines of airport terminals. Its agents have been conducting more and more surprise groping sessions for women, children and the elderly in locations that have nothing to do with aviation.' In Tennessee earlier this month, bus passengers in Nashville and Knoxville were searched in addition to the truck searches discussed here previously. Earlier this year in Savannah, Georgia, TSA forced a group of train travelers, including young children, to be patted down. (They were getting off the train, not on.) Ferry passengers have also been targeted. According to TSA Administrator John Pistole's testimony before the Senate last June, 'TSA conducted more than 8,000 VIPR operations in the [previous] 12 months, including more than 3,700 operations in mass-transit and passenger-railroad venues.' He wants a 50% budget increase for VIPR for 2012. Imagine what TSA would do with the extra funding."

Read more of this story at Slashdot.
FAA Goes To the Web To Fight Laser-Pointing

Posted: October 28th, 2011, 6:49am CEST by samzenpus

Tags: security

coondoggie writes "The Federal Aviation Administration wants you to go online to help it battle the growing safety problem of people pointing lasers at flying aircraft. The FAA today said it created a new website to make it easier for pilots and the public to report laser incidents and obtain information on the problem which continues to grow by leaps and bounds. This year, pilots reported 2,795 laser events through Oct. 20. Pilots have reported the most laser events in 2011 in Phoenix (96), Philadelphia (95) and Chicago (83). Since it began tracking laser events in 2005 reports rose from nearly 300 to 2,836 in 2010, the FAA said."

Read more of this story at Slashdot.
Hackers Briefly Controlled US Government Satellites

Posted: October 27th, 2011, 7:42pm CEST by timothy

Tags: security

Orome1 writes "Two U.S. satellites have been tampered with by hackers — possibly Chinese ones — in 2007 and 2008, claims a soon-to-be released report by the the U.S.-China Economic and Security Review Commission. The two satellites, Landsat-7 and Terra AM-1, had been interfered with on four separate occasions, allowing the attackers to be in command of the satellites for two to over twelve minutes each time. Luckily, both of the satellites are used only for observing the Earth's climate and terrain, and the hackers never actually misused their control over them in any way."

Read more of this story at Slashdot.
Expert: Duqu Is a Custom Attack Framework

Posted: October 26th, 2011, 7:03pm CEST by Unknown Lamer

Tags: security

Trailrunner7 writes "All of the hype about Duqu being the next Stuxnet obscured many of the real facts about the new malware. It turns out that Duqu not only is essentially a customizable attack framework with separate modules for each target, but that it has been found on high-value networks in Iran and the Sudan. A detailed analysis of the Duqu malware files by Alex Gostev of Kaspersky Lab shows that the malware uses different drivers and modules for every target. 'It is obvious that every single Duqu incident is unique with its own unique files using different names and checksums. Duqu is used for targeted attacks with carefully selected victims,' Gostev said."

Read more of this story at Slashdot.
Mitsubishi Hack Stole Nuclear, Defense Data

Posted: October 26th, 2011, 3:55am CEST by Soulskill

Tags: security

judgecorp writes "When Mitsubishi announced in September it had been hacked in August it was criticized for keeping quiet for a month. Now it appears that the attackers got nuclear power plant and military aircraft details according to sources quoted in the Japanese media."

Read more of this story at Slashdot.
The Register Email Address Blunder

Posted: October 25th, 2011, 10:13am CEST by Unknown Lamer

Tags: security

First time accepted submitter Tim99 writes "This morning I got an email from The Register informing me that they have sent 3,521 of their readers the names and e-mail addresses of 46,000 other readers. Considering their frequent rants about security this has got to be a major FAIL." El Reg writes: "Obviously, this was an error. The two-stage send process that is the norm for all of our mailers was over-looked because someone was in a hurry."

Read more of this story at Slashdot.
XML Encryption Broken, Need To Fix W3C Standard

Posted: October 22nd, 2011, 8:50am CEST by timothy

Tags: security

gzipped_tar writes "Researchers from Ruhr University Bochum demonstrated the insecurity of XML encryption standard at ACM Conference on Computer and Communications Security in Chicago this week. 'Everything is insecure,' is the uncomfortable message from Bochum. As pointed out by the Ars Technica article, XML Encryption is used widely as part of server-to-server Web services connections to transmit secure information mixed with non-sensitive data, based on cipher-block chaining. But it is apparently too weak, as demonstrated by Juraj Somorovsky and Tibor Jager. They were able to decrypt data by sending modified ciphertexts to the server by gathering information from the received error messages. The attack was tested against a popular open source implementation of XML Encryption, and against the implementations of companies that responded to the responsible disclosure — in all cases the result was the same: the attack worked. Fixing the vulnerability will require a revision of the W3C XML encryption standard, Somorovsky said. The researchers informed all possibly affected companies through the mailing list of W3C, following a clear responsible disclosure process."

Read more of this story at Slashdot.
New JBOSS Worm Infecting Unpatched Servers

Posted: October 22nd, 2011, 3:58am CEST by timothy

Tags: security

Trailrunner7 writes "There is a new worm circulating right now that is compromising servers running older versions of the JBoss Application Server and then adding them to a botnet. The worm also attempts to install a remote access tool in order to give the attacker control over the newly infected server. The worm has been circulating for a couple of days at least, and it's not clear right now how many servers have been compromised or what the origins of it are. It apparently exploits an old vulnerability in the JBoss Application Server, which was patched in April 2010, in order to compromise new machines. Once that's accomplished, the worm begins a post-infection routine that includes a number of different steps."

Read more of this story at Slashdot.
Nasdaq Intrusion Spreads To Listed Companies

Posted: October 22nd, 2011, 12:06am CEST by Soulskill

Tags: security

New submitter SpzToid writes "Nasdaq's Directors Desk is a program sold to both listed and private companies, whose board members use it to share documents and communicate with executives. Apparently Directors Desk was infected during a breach widely publicized earlier this year. It has now become known that hackers were able to access confidential documents and communications of the corporate directors and board members who received this infected application, said Tom Kellermann, chief technology officer with security technology firm AirPatrol Corp. It is unclear how long the Directors Desk application was infected before the exchange identified the breach, according to Kellermann and another source."

Read more of this story at Slashdot.
How To Stop the Next WikiLeaks

Posted: October 21st, 2011, 2:07pm CEST by samzenpus

Tags: security

Hugh Pickens writes "Eli Lake reports that the U.S.'s 16 intelligence agencies are using a program called SureView that makes it easier to spy on the spies and catch whistleblowers early in the act. SureView is a type of auditing software that specializes in 'behavior-based internal monitoring' that monitors the intelligence officer's computer activity. If the officer acts like a potential leaker, sending an encrypted email or using an unregistered thumb drive, the analyst might push a button and watch a screen video of the officer's last hour of work. Once a case is made that a leak might be imminent, it is checkmate: the agent is thwarted. 'Had SureView been on Bradley Manning's machine, no one would know who Bradley Manning is today,' says Ryan Szedelo, manager for Raytheon's SureView software. The intelligence community has had auditing software for years. SureView came on the market in 2002. But the programs were buggy and often prone to false positives, alerting a network administrator too often to routine behavior. 'The technology has gotten substantially better in the last year,' says Jeffrey Harris, a former head of the National Reconnaissance Office. 'The problem with audit files was it took an army of people to understand them. Now we have rule-driven systems and expert systems that help us reason through the data.'"

Read more of this story at Slashdot.
TSA Doing Random Truck Searches On Tennessee Highway

Posted: October 21st, 2011, 12:49am CEST by samzenpus

Tags: security

OverTheGeicoE writes "TSA is expanding its presence to the American road system. As part of its Visible Intermodal Prevention and Response (VIPR) program, TSA agents are now working at 5 weigh stations and two bus stations in Tennessee. They are randomly checking trucks with 'drug and bomb sniffing dogs', and encouraging truck drivers to join their First Observer Highway Security Program and report anything suspicious that they see to authorities. VIPR is allegedly not a response to any particular threat."

Read more of this story at Slashdot.
Precursor To the Next Stuxnet?

Posted: October 18th, 2011, 10:43pm CEST by Unknown Lamer

Tags: security

An anonymous reader writes "On Oct. 14, 2011 Symantec was alerted to a malware sample from some recovered computers that demonstrated code similar to Stuxnet. This code however appears to serve a different purpose, apparently laying the groundwork for a future Stuxnet type of attack." Quoting Symantec: "The threat was written by the same authors (or those that have access to the Stuxnet source code) and appears to have been created since the last Stuxnet file was recovered. Duqu's purpose is to gather intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party. The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility."

Read more of this story at Slashdot.
Analysis of 250,000 Hacker Conversations

Posted: October 18th, 2011, 12:32am CEST by Soulskill

Tags: security

Orome1 writes "Imperva released a report (PDF) analyzing the content and activities of an online hacker forum with nearly 220,000 registered members, although many are dormant. The forum is used by hackers for training, communications, collaboration, recruitment, commerce and even social interaction. Commercially, this forum serves as a marketplace for selling of stolen data and attack software. The chat rooms are filled with technical subjects ranging from advice on attack planning to solicitations for help with specific campaigns."

Read more of this story at Slashdot.
How To Catch a Laptop Thief?

Posted: October 16th, 2011, 7:03pm CEST by samzenpus

Tags: security

First time accepted submitter otaku244 writes "I spent a day in Vancouver this week while working in Seattle. While I enjoyed the area, some Vancouver citizen decided to enjoy my Macbook Pro. Unfortunately, I didn't discover this until I was already back at my Seattle hotel. Needless to say, I am quite miffed at the whole experience. Fortunately, I have LogMeIn installed on that machine. I provided the IP address to the VPD, but they say that laws don't allow warrants solely on the physical address tied to an IP. It sounds like the silver bullet is to take a picture of the person using the laptop. The question becomes, how do I convince the guy to run a script that will take a picture of him and smtp it to me? I promise to post pics of the guy if this gets pulled off successfully!"

Read more of this story at Slashdot.
Security Researcher Threatened With Vulnerability Repair Bill

Posted: October 15th, 2011, 12:03am CEST by Soulskill

Tags: security

mask.of.sanity writes "A security consultant who quietly tipped off an Australian superannuation fund about a web vulnerability that potentially put millions of customers at risk has been slapped with a legal threat demanding he allow the company access to his computer, and warned he may be forced to pay the cost of fixing the flaw. A legal document (PDF) sent from the company demanded that the researcher provide its technical staff with access to his computer. The company acknowledged the researcher's work was altruistic and thanked him for his efforts, but warned that the disclosure, which was not previously made public, may have breached Australian law. The researcher had run a batch file to access about 500 accounts, which was then handed to the company to demonstrate the direct object reference vulnerability."

Read more of this story at Slashdot.
Air Force Comments On Drone Malware

Posted: October 14th, 2011, 7:01am CEST by samzenpus

Tags: security

wiredmikey writes "Air Force officials have revealed more details about a malware infection that impacted systems used to manage a fleet of drones at the Creech Air Force Base in Nevada as reported last week. The 24th Air Force first detected the malware – which they characterized as a 'credential stealer' as opposed to a keylogger as originally reported — and notified Creech Air Force Base officials Sept. 15 that malware was found on portable hard drives approved for transferring information between systems. The infected computers were part of the ground control system that supports remotely-piloted aircraft (RPA) operations. The malware is not designed to transmit data or video or corrupt any files, programs or data, according to the Air Force. The ground system is separate from the flight control system used by RPA pilots to fly the aircrafts."

Read more of this story at Slashdot.
NATO Exercise Banned From Jamming GPS

Posted: October 13th, 2011, 4:06am CEST by samzenpus

Tags: security

judgecorp writes "A major NATO exercise off the coast of Scotland has been ordered to stop using GPS jamming technology after complaints that to do so would endanger the lives of fishermen and disrupt civilian mobile phones. The exercise — called 'Joint Warrior' -planned to disrupt GPS for 20 miles around each warship"

Read more of this story at Slashdot.
NATO Exercise Banned From Jamming GPS

Posted: October 13th, 2011, 4:06am CEST by samzenpus

Tags: security

judgecorp writes "A major NATO exercise off the coast of Scotland has been ordered to stop using GPS jamming technology after complaints that to do so would endanger the lives of fishermen and disrupt civilian mobile phones. The exercise — called 'Joint Warrior' — planned to disrupt GPS for 20 miles around each warship"

Read more of this story at Slashdot.
SEO Via DNS "Piggybacking"

Posted: October 12th, 2011, 10:03pm CEST by samzenpus

Tags: security

An anonymous reader writes "There is an interesting story over at the SANS Internet Storm Center that shows details on about 50 organizations that have had new machine names added to their DNS zone information. These were then pointed to sites used to boost the search engine cred of pharma, personals, and porn sites. If you outsource your DNS, how would you ever catch something like this?"

Read more of this story at Slashdot.
SEO Via DNS "Piggybacking"

Posted: October 12th, 2011, 10:03pm CEST by samzenpus

Tags: security

An anonymous reader writes "There is an interesting story over at the SANS Internet Storm Center that shows details on about 50 organizations that have had new machine names added to their DNS zone information. These were then pointed to sites used to boost the search engine cred of pharma, personals, and porn sites. If you outsource your DNS, how would you ever catch something like this?"

Read more of this story at Slashdot.
Sony Targeted Yet Again; Thwarts Attackers This Time

Posted: October 12th, 2011, 2:55pm CEST by Unknown Lamer

Tags: security

alphadogg writes with an excerpt from a Network World article: "Sony suspended 93,000 user accounts on several of its gaming and entertainment networks after unauthorized login attempts on those accounts. The attempts occurred on the PlayStation Network, Sony Entertainment Network, and Sony Online Entertainment, and the company says that login information likely acquired from other sources was tested en masse on the networks. Only a 'small number' of the attempts were successful, and no credit card information was leaked. ... Sony Chief Information Security Officer Philip Reitinger said that 'less than one tenth of one percent' of the networks' users may have been affected."

Read more of this story at Slashdot.
Sony Targeted Yet Again; Thwarts Attackers This Time

Posted: October 12th, 2011, 2:55pm CEST by Unknown Lamer

Tags: security

alphadogg writes with an excerpt from a Network World article: "Sony suspended 93,000 user accounts on several of its gaming and entertainment networks after unauthorized login attempts on those accounts. The attempts occurred on the PlayStation Network, Sony Entertainment Network, and Sony Online Entertainment, and the company says that login information likely acquired from other sources was tested en masse on the networks. Only a 'small number' of the attempts were successful, and no credit card information was leaked. ... Sony Chief Information Security Officer Philip Reitinger said that 'less than one tenth of one percent' of the networks' users may have been affected."

Read more of this story at Slashdot.
RSA Blames Nation State For Cyber Attack

Posted: October 12th, 2011, 4:25am CEST by Soulskill

Tags: security

An anonymous reader writes "Security firm RSA has revealed that it believes two groups, working on behalf of a single nation state, hacked into its servers and stole information related to the company's SecurID two-factor authentication products. Speaking at the RSA Security Conference in London, RSA executive chairman Art Coviello described the high profile attack thus: 'There were two individual groups from one nation state, one supporting the other. One was very visible and one less so. We've not attributed it to a particular nation state although we're very confident that with the skill, sophistication and resources involved it could only have been a nation state.' Sophos security researcher Graham Cluley questions how RSA has concluded that a country was responsible for the attack — when RSA is unwilling to name who it suspects. Could it be that the firm is simply applying spin, describing the attack as a 'highly sophisticated Advanced Persistent Threat' to protect its image?"

Read more of this story at Slashdot.
RSA Blames Nation State For Cyber Attack

Posted: October 12th, 2011, 4:25am CEST by Soulskill

Tags: security

An anonymous reader writes "Security firm RSA has revealed that it believes two groups, working on behalf of a single nation state, hacked into its servers and stole information related to the company's SecurID two-factor authentication products. Speaking at the RSA Security Conference in London, RSA executive chairman Art Coviello described the high profile attack thus: 'There were two individual groups from one nation state, one supporting the other. One was very visible and one less so. We've not attributed it to a particular nation state although we're very confident that with the skill, sophistication and resources involved it could only have been a nation state.' Sophos security researcher Graham Cluley questions how RSA has concluded that a country was responsible for the attack — when RSA is unwilling to name who it suspects. Could it be that the firm is simply applying spin, describing the attack as a 'highly sophisticated Advanced Persistent Threat' to protect its image?"

Read more of this story at Slashdot.
Father of SSL Talks Serious Security Turkey

Posted: October 11th, 2011, 9:27pm CEST by Unknown Lamer

Tags: security

coondoggie writes with an excerpt from a Network World article: "SSL/TLS, the protocol that protects security of e-commerce, has taken a beating lately, with news items ranging from the violation of certificate authorities to the discovery of an exploit that beats the protocol itself. But despite the exploit ... and the failures of certificate authorities such as Comodo and DigiNotar that are supposed to authenticate users, the protocol has a lot of life left in it if properly upgraded as it becomes necessary, says Taher Elgamal, CTO of Axway and one of the creators of SSL."

Read more of this story at Slashdot.
Father of SSL Talks Serious Security Turkey

Posted: October 11th, 2011, 9:27pm CEST by Unknown Lamer

Tags: security

coondoggie writes with an excerpt from a Network World article: "SSL/TLS, the protocol that protects security of e-commerce, has taken a beating lately, with news items ranging from the violation of certificate authorities to the discovery of an exploit that beats the protocol itself. But despite the exploit ... and the failures of certificate authorities such as Comodo and DigiNotar that are supposed to authenticate users, the protocol has a lot of life left in it if properly upgraded as it becomes necessary, says Taher Elgamal, CTO of Axway and one of the creators of SSL."

Read more of this story at Slashdot.
German Researchers Crack Mifare RFID Encryption

Posted: October 10th, 2011, 9:16pm CEST by Soulskill

Tags: security

jfruhlinger writes "The long-running security battle has seesawed against RFID cards, as German researchers revealed a way to clone one type of card currently used for a variety of purposes, from transit fares to opening doors in NASA facilities." According to the article, "NXP Semiconductors, which owns Mifare, put out an alert to customers warning that the security had been cracked on its MIFARE DESFire (MF3ICD40) smartcard but saying that model would be discontinued by the end of the year and encouraging customers to upgrade to the EV1 version of the card." This response may sound familiar.

Read more of this story at Slashdot.
Incomplete PDF Redaction Leaks Data From UK MoD

Posted: October 9th, 2011, 11:55pm CEST by timothy

Tags: security

An anonymous reader writes "The UK Ministry of Defence has been left with egg on its face, after a supposedly redacted PDF detailing secrets related to air defence radar systems was published on a parliamentary website. The problem? Whoever did the redacting simply changed the sensitive text to black on a black background, making it possible for anyone to access the information simply by cutting-and-pasting. The incident is particularly embarrassing for the Ministry, as six months ago precisely the same security screw-up occurred — that time related to sensitive information about nuclear submarines."

Read more of this story at Slashdot.
US Drone Fleet Hit By Computer Virus

Posted: October 7th, 2011, 9:08pm CEST by Soulskill

Tags: security

New submitter Golgafrinchan passes along this quote from an article at Wired: "A computer virus has infected the cockpits of America's Predator and Reaper drones, logging pilots' every keystroke as they remotely fly missions over Afghanistan and other warzones. The virus, first detected nearly two weeks ago by the military's Host-Based Security System, has not prevented pilots at Creech Air Force Base in Nevada from flying their missions overseas. Nor have there been any confirmed incidents of classified information being lost or sent to an outside source. But the virus has resisted multiple efforts to remove it from Creech's computers, network security specialists say. And the infection underscores the ongoing security risks in what has become the U.S. military's most important weapons system.'"

Read more of this story at Slashdot.
After Six Days of Outages, BofA Claims It Hasn't Been Hacked

Posted: October 5th, 2011, 10:56pm CEST by samzenpus

Tags: security

Lucas123 writes "After six days of spotty service and outages with its online and mobile sites, Bank of America today said it has not been the victim of a denial of service attack, hacking or malware. Yet, the bank has set up a new homepage that it says will help customers navigate to the proper online service. Internet monitoring service Keynote said the outage is unprecedented in banking. 'I don't think we've seen as significant and as long an outage with any bank. And I've been with Keynote for 16 years now,' said Shawn White, vice president of operations for web monitoring service Keynote Systems. In the meantime, a BofA spokeswoman continued to divulge what might be happening, saying 'We're not going to get into the technical details. We're not going to comment on the technicalities of what we do.' Speculation among experts has been that the site is under attack."

Read more of this story at Slashdot.
Welcome Back Kernel.org

Posted: October 5th, 2011, 9:47pm CEST by samzenpus

Tags: security

Hummdis writes "After more than a month of being offline due to a security breach at Kernel.org, they're back! While they were down, they took the time to 're-architect' the site for developers and users. A statement reads: 'As noted previously, kernel.org suffered a security breach. Because of this, we have taken the time to re-architect the site in order to improve our systems for developers and users of kernel.org. To this end, we would like all developers who previously had access to kernel.org who wish to continue to use it to host their git and static content, to follow the instructions here. Right now, www.kernel.org and git.kernel.org have been brought back online. All developer git trees have been removed from git.kernel.org and will be added back as the relevant developers regain access to the system. Thanks to all for your patience and understanding during our outage and please bear with us as we bring up the different kernel.org systems over the next few weeks. We will be writing up a report on the incident in the future.'"

Read more of this story at Slashdot.

Slashdot: Linux

Welcome Back Kernel.org

Posted: October 5th, 2011, 9:47pm CEST by samzenpus

Tags: security

Hummdis writes "After more than a month of being offline due to a security breach at Kernel.org, they're back! While they were down, they took the time to 're-architect' the site for developers and users. A statement reads: 'As noted previously, kernel.org suffered a security breach. Because of this, we have taken the time to re-architect the site in order to improve our systems for developers and users of kernel.org. To this end, we would like all developers who previously had access to kernel.org who wish to continue to use it to host their git and static content, to follow the instructions here. Right now, www.kernel.org and git.kernel.org have been brought back online. All developer git trees have been removed from git.kernel.org and will be added back as the relevant developers regain access to the system. Thanks to all for your patience and understanding during our outage and please bear with us as we bring up the different kernel.org systems over the next few weeks. We will be writing up a report on the incident in the future.'"

Read more of this story at Slashdot.
Welcome Back Kernel.org

Posted: October 5th, 2011, 9:47pm CEST by samzenpus

Tags: security

Hummdis writes "After more than a month of being offline due to a security breach at Kernel.org, they're back! While they were down, they took the time to 're-architect' the site for developers and users. A statement reads: 'As noted previously, kernel.org suffered a security breach. Because of this, we have taken the time to re-architect the site in order to improve our systems for developers and users of kernel.org. To this end, we would like all developers who previously had access to kernel.org who wish to continue to use it to host their git and static content, to follow the instructions here. Right now, www.kernel.org and git.kernel.org have been brought back online. All developer git trees have been removed from git.kernel.org and will be added back as the relevant developers regain access to the system. Thanks to all for your patience and understanding during our outage and please bear with us as we bring up the different kernel.org systems over the next few weeks. We will be writing up a report on the incident in the future.'"

Read more of this story at Slashdot.

Slashdot: IT

How Windows Gets Infected With Malware

Posted: October 5th, 2011, 5:04pm CEST by timothy

Tags: security

Orome1 writes "Since Up to 85 % of all virus infections occur as a result of drive-by attacks automated via commercial exploit kits, CSIS has actively collected real time data from them for a period of three months. The purpose of their study is to reveal precisely how Microsoft Windows machines are infected with malware and which browsers, versions of Windows and third party software that are at risk. They monitored more than 50 different exploit kits on 44 unique servers / IP addresses. The statistical material covers all in all more than half a million user exposures out of which as many as 31.3 % were infected with the virus/malware due to missing security updates."

Read more of this story at Slashdot.
Is Off-Shoring a National Security Threat?

Posted: October 4th, 2011, 5:05pm CEST by timothy

Tags: security

An anonymous reader writes "Should the U.S. government hold developers more responsible for the quality of their code? One top cyber security analyst says more regulations would be a mistake. 'Any attempt to regulate software quality and security simply drives the software industry off-shore for good,' he says. 'Similarly, requiring trusted on-shore production ensures two things: (1) falling behind world progress as we aren't the only smart people and we are a minority, and (2) costs rise in a way that makes on-shore-mandated software cost-uncompetitive on the world market.'"

Read more of this story at Slashdot.
Prototyping Boards Make It Easier To Find Flaws in Specialized Hardware

Posted: October 2nd, 2011, 3:20pm CEST by timothy

Tags: security

wiredmikey writes "Author Robert Vamosi writes an interesting piece on how security researchers are using open source 'prototyping boards' and other open source tools now available via the Internet for rapid prototyping of tools used in hardware analysis. 'The days of saying it would take the resources of a nation-state to discover or exploit vulnerabilities in a particular piece of hardware in an industrial control system or a healthcare environment are rapidly fading,' he writes. Vendors who do not test their products before selling them into the field are doomed to be targets of future research and, perhaps, attacks."

Read more of this story at Slashdot.
Security By Obscurity — a New Theory

Posted: October 2nd, 2011, 12:12am CEST by Soulskill

Tags: security

mikejuk writes "Kerckhoffs' Principle suggests that there is no security by obscurity — but perhaps there is. A recent paper by Dusko Pavlovic suggests that security is a game of incomplete information and the more you can do to keep your opponent in the dark, the better. In addition to considering the attacker's computing power limits, he also thinks it's worth considering limits on their logic or programming capabilities (PDF). He recommends obscurity plus a little reactive security in response to an attacker probing the system. In this case, instead of having to protect against every possible attack vector, you can just defend against the attack that has been or is about to be launched."

Read more of this story at Slashdot.
Web Hosts — One-Stop-Shops For Mass Hacking?

Posted: October 1st, 2011, 9:00pm CEST by Soulskill

Tags: security

jjp9999 writes "More than 70,000 websites were compromised in a recent breach of InMotion. Thousands of websites were defaced and others had alterations made to give users a hard time accessing their accounts and fixing the damage. A similar attack hit JustHost back in June, and in a breach of Australian Web host DistributeIT just prior to that, hackers completely deleted more than 4,800 websites that the company was unable to recover. The incidents raise concern that hacker groups are bypassing single targets and hitting Web hosts directly, giving them access to tens of thousands of websites, rather than single targets. While the attacks have caused damage, they weren't as malicious as they could have been. Rather than defacing and deleting, hackers could have quietly planted malware in the sites or stolen customer data. Web hosting companies could be one of the largest holes in non-government cybersecurity, since malicious hackers can gain access through openings left by the Web host, regardless of the security of a given site."

Read more of this story at Slashdot.
Security Flaw Bypasses AT&T Samsung Galaxy S II Screen Lock

Posted: September 30th, 2011, 10:22pm CEST by Soulskill

Tags: security

zacharye writes "BGR has uncovered a security flaw on AT&T's version of the Samsung Galaxy S II that renders Android's unlock pattern feature completely useless. Using a simple workaround, the security hole allows anyone to bypass the unlock pattern, which normally denies users access to an Android device unless a preset pattern is drawn on a grid of nine dots spread across the device's lock screen."

Read more of this story at Slashdot.
Man Charged in Model Airplane Plot To Bomb Pentagon

Posted: September 29th, 2011, 2:17am CEST by samzenpus

Tags: security

garymortimer writes "A 26-year-old Massachusetts man with a physics degree was arrested and charged Wednesday with plotting an attack on the Pentagon and the U.S. Capitol with remote-controlled model aircraft, authorities said. Rezwan Ferdaus, a U.S. citizen from Ashland, Massachusetts, planned to use model aircraft filled with C-4 plastic explosives. As a result of an undercover FBI investigation, Ferdaus, who has a physics degree from Northeastern University in Boston, was charged with attempting to provide material support and resources to al Qaeda for attacks on U.S. soldiers overseas. His federal public defender couldn't be reached immediately for comment."

Read more of this story at Slashdot.
Aussie Researcher Cracks OS X Lion Passwords

Posted: September 26th, 2011, 2:47pm CEST by samzenpus

Tags: security

daria42 writes "Thought your Mac was secure running Apple's latest operating system? Think again. Turns out that in some respects Lion is actually less secure than previous version of Mac OS X, due to some permission-tweaking by Apple that has opened up a way for an attacker to crack your password on your Lion box. The flaw was discovered by an Australian researcher who has previously published a guide to cracking Mac OS X passwords. Sounds like Apple had better get a patch out for this."

Read more of this story at Slashdot.
Why the BEAST Doesn't Threaten Tor Users

Posted: September 25th, 2011, 2:22pm CEST by timothy

Tags: security

Earlier in the week, we posted news of a vulnerability discovered in virtually all websites secured with theoretically outdated (but widespread) versions of SSL and TLS encryption. Luckily for all non-nefarious users, this vulnerability (called BEAST, short for Browser Exploit Against SSL/TLS) was discovered and disclosed by researchers Thai Duong and Juliano Rizzo, and browser makers are pushing out changes to nullify it. Many systems, though, will remain unpatched for a long time. Nick Mathewson (nickm) of the Tor project has posted an explanation of why Tor traffic, as he understands the attack, remains safe. As a side benefit for those of us who aren't security experts, his description explains in plain language just what the danger is.

Read more of this story at Slashdot.
FBI Arrests LulzSec and Anonymous Hackers

Posted: September 23rd, 2011, 12:36am CEST by samzenpus

Tags: security

Velcroman1 writes "The FBI arrested two alleged members of the hacking collectives LulzSec and Anonymous on Thursday morning in San Francisco and Phoenix. Search warrants were also being executed in New Jersey, Minnesota and Montana, an FBI official told FoxNews.com. A document purported to come from the FBI leaked online earlier this month called these hacker groups a national security threat. One individual was described as part of the LulzSec group, the other belongs to the group that calls itself Anonymous, the official said. The suspected hacker arrested in California is homeless and alleged to have been involved in the hacking of Santa Cruz County government websites."

Read more of this story at Slashdot.
Microsoft Dumps Partner For Fake Support Call Scam

Posted: September 22nd, 2011, 1:08am CEST by samzenpus

Tags: security

An anonymous reader writes "Microsoft has broken its relationship with one of its Gold Partners, after it discovered that the partner was involved in a scam involving bogus tech support calls. India-based Comantra is said to have cold-called computer users in the UK, Australia, Canada and elsewhere, claiming to offer assistance in cleaning up virus infections. The calls used scare tactics to talk users into opening the Event Viewer on Windows, where a seemingly dangerous list of errors would be seen. This 'evidence' was used to trick innocent users into believing they had a malware infection, and for Comantra to gain the users' confidence. Duped users would then give permission for the support company to have remote access to their PC, and hand over their credit card details for a 'fix.' Security firm Sophos says that internet users have been complaining about Comantra's activities for over 18 months, and it has taken a long time for Microsoft to take action. Comantra's website still retains the Gold Certified Partner logo, although their details have been removed from Microsoft's database of approved partners."

Read more of this story at Slashdot.
Adobe Pushes Emergency Flash Player Security Fix

Posted: September 21st, 2011, 11:33pm CEST by samzenpus

Tags: security

wiredmikey writes "As expected, Adobe today released a security update for its Flash Player. The out of cycle update addresses critical security issues in flash player as well as an important universal cross-site scripting issue. Adobe reported that one of the vulnerabilities (CVE-2011-2444) is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message. To illustrate the importance of keeping systems up to date, including Adobe Flash products, the fact that the RSA cyber attack was executed using a spear phishing attack with an embedded flash file should serve as a friendly reminder. RSA was breached after an employee opened a spreadsheet that contained a zero-day exploit that installed a backdoor through an Adobe Flash vulnerability."

Read more of this story at Slashdot.
Massachusetts Attorney General, Victim of iTunes Fraud

Posted: September 21st, 2011, 11:08pm CEST by samzenpus

Tags: security

chicksdaddy writes "Massachusetts Attorney General Martha Coakley said on Tuesday that her office would be inquiring into long-standing complaints about fraudulent purchases that leverage Apple's popular online music store. Coakley was herself a victim of identity theft in recent months, telling the audience that her stolen credit card information was used to make fraudulent iTunes purchases. When asked (by a Threatpost reporter) about whether such fraud constitutes a reportable event under the Bay State's strict data breach notification law, 201 CMR 17, Coakley said that her office would be looking into that question and demanding answers from Cupertino, which has steadfastly refused to respond to media requests regarding user reports about fraudulent iTunes purchases, and which has not reported the breaches to Massachusetts regulators."

Read more of this story at Slashdot.
EFF System To Warn of Certificate Breaches

Posted: September 21st, 2011, 10:47pm CEST by samzenpus

Tags: security

snydeq writes "With its distributed SSL Observatory, the Electronic Frontier Foundation hopes to detect compromised certificate authorities and warn users about attacks, InfoWorld reports. 'The EEF, along with developers at the Tor Project and consulting firm iSec Partners, has updated its existing HTTPS Everywhere program with the ability to anonymously report every certificate encountered. The group will analyze the data so that it can detect any rogue certificates — and by extension, compromised authorities — its users encounter, says Peter Eckersley, technology projects director for the EFF.'"

Read more of this story at Slashdot.
Hackers Break Browser SSL/TLS Encryption

Posted: September 20th, 2011, 9:17pm CEST by Unknown Lamer

Tags: security

First time accepted submitter CaVp writes with an article in The Register about an exploit that appears to affect all browsers and can decrypt an active TLS session. From the article: "Researchers have discovered a serious weakness in virtually all websites protected by the secure sockets layer protocol that allows attackers to silently decrypt data that's passing between a webserver and an end-user browser." A full disclosure is scheduled for Friday September 23rd at the Ekoparty conference. Note that this only affects SSL 2.0 and TLS 1.0; unfortunately most web servers are misconfigured to still accept SSL 2.0, and TLS 1.1 and 1.2 have seen limited deployment. The practicality of the attack remains to be determined (for one it isn't very fast, but if the intent is just to decrypt the data for later use that isn't an impediment).

Read more of this story at Slashdot.
How Bug Bounties Are Like Rat Farming

Posted: September 20th, 2011, 5:00pm CEST by timothy

Tags: security

Gunkerty Jeb writes "In a keynote speech at the United Security Summit, Stephen Dubner, co-author of Freakonomics, drew parallels between the increasingly popular (and successful) practice of software vendors offering bug bounties and a new industry springing up in Johannesburg, South Africa, where the population has recently found itself beset with a growing rat problem. In order to help mitigate their rodent problem, officials in Johannesburg began offering a small monetary rewards for each dead rat turned in. It was wildly successful, and it didn't take long for fresh batch of entrepreneurs to pop up and exploit the situation. Of course, I'm talking about rat farming. Evidently, business minded individuals have taken to breeding rats, only to kill them and turn them in for rewards. Obviously, rat farming is somewhat unscrupulous, but security researchers are doing the same thing: breeding bugs in the lab, then leading them to the slaughter for a nice payday. And it's a good thing."

Read more of this story at Slashdot.
Japan's Largest Defense Contractor Hacked

Posted: September 19th, 2011, 4:56pm CEST by samzenpus

Tags: security

wiredmikey writes "Mitsubishi Heavy Industries Ltd, Japan's largest defense contractor, has been a victim of a cyber attack, according to a report from the company. The company said attackers had gained access to company computer systems, with some reports saying the attacks targeted its submarine, missile and nuclear power plant component businesses. According to The Yomiuri newspaper, approximately 80 systems had been infected with malware at the company's headquarters in Tokyo, as well as manufacturing and research and development sites, including Kobe Shipyard & Machinery Works, Nagasaki Shipyard & Machinery Works and Nagoya Guidance & Propulsion System Works. 'We can't rule out small possibilities of further information leakage but so far crucial data about our products or technologies have been kept safe,' a Mitsubishi Heavy spokesman told Reuters. 'We've found out that some system information such as IP addresses have been leaked and that's creepy enough,' the spokesman added."

Read more of this story at Slashdot.
Certificate Blunders May Mean the End For DigiNotar

Posted: September 15th, 2011, 10:28pm CEST by timothy

Tags: security

Certificate Authority DigiNotar is having a rough time of it. dinscott writes with these words from Help Net Security: "After having its SSL and EVSSL certificates deemed untrustworthy by the most popular browsers, around 4200 qualified certificates — i.e. certificates used to create digital signatures — issued by the CA are currently in the process of being revoked and their holders notified of the fact by the Dutch independent post and telecommunication authority (OPTA). Starting from yesterday, OPTA has terminated the accreditation of DigiNotar as a certificate provider for 'qualified' certificates. The revocation of this accreditation also makes DigiNotar unqualified to issue certificates under the PKIoverheid CA."

Read more of this story at Slashdot.
US House 'Creator' of TSA Wants To Kill It

Posted: September 15th, 2011, 9:41pm CEST by OverTheGeicoE

Tags: security

U.S. Representative John Mica (R-Florida), the sponsor of the original House bill that helped create the TSA, has become an outspoken opponent of the agency. In a recent interview, "Mica said screeners should be privatized and the agency dismantled." Mica seems to agree with other TSA critics that the agency 'failed to actually detect any threat in 10 years.' Mica is the House Transportation and Infrastructure Committee Chairman and receives classified briefings on TSA. Perhaps we should trust him more than most people on this topic.

Read more of this story at Slashdot.
Italian Hacker Publishes 0day SCADA Hacks

Posted: September 15th, 2011, 4:20pm CEST by timothy

Tags: security

mask.of.sanity writes "An Italian security researcher, Luigi Auriemma, has disclosed a laundry list of unpatched vulnerabilities and detailed proof-of-concept exploits that allow hackers to completely compromise major industrial control systems. The attacks work against six SCADA systems, including one manufactured by U.S. giant Rockwell Automation. The researcher published step-by-step exploits that allowed attackers to execute full remote compromises and denial of service attacks. Auriemma appeared unrepentant for the disclosures in a post on his website."

Read more of this story at Slashdot.
Apache Fixes Range Header Flaw, Again

Posted: September 14th, 2011, 11:09pm CEST by samzenpus

Tags: security

Trailrunner7 writes "Two weeks after releasing a fix for the range-header denial-of-service flaw that was much-discussed on security forums and mailing lists, the Apache Software Foundation has pushed out another version of its popular Web server that includes a further fix for the same flaw. Apache 2.2.21 has a patch for the CVE-2011-3192 vulnerability that the group previously fixed in late August with the release of version 2.2.20. The vulnerability is an old one that recently resurfaced after a researcher published an advisory on a modified version of the bug and also released a tool capable of exploiting the vulnerability."

Read more of this story at Slashdot.
New BIOS Exploiting Rootkit Discovered

Posted: September 14th, 2011, 6:33pm CEST by Unknown Lamer

Tags: security

First time accepted submitter mtemar writes with a Symantec analysis of an interesting new trojan/virus. From the article:"There are more and more known viruses that infect the MBR. Symantec Security Response has published a blog to demonstrate this trend last month. However, we seldom confront with one that infects the BIOS. One of them, the notorious CIH, appeared in 1999, which infected the computer BIOS and thus harmed a huge number of computers at that time. Recently, we met a new threat named Trojan.Mebromi that can add malicious components into Award BIOS which allows the threat to take control of the system even before MBR."

Read more of this story at Slashdot.
The Rise of Software Security

Posted: September 13th, 2011, 10:51pm CEST by Unknown Lamer

Tags: security

Gunkerty Jeb writes with an article in Threatpost. From the article: "Perhaps no segment of the security industry has evolved more in the last decade than the discipline of software security. At the start of the 2000s, software security was a small, arcane field that often was confused with security software. But several things happened in the early part of the decade that set in motion a major shift in the way people built software ... To get some perspective on how far things have come, Threatpost spoke with Gary McGraw of Cigital about the evolution of software security since 2001."

Read more of this story at Slashdot.
Court Denies EPIC's Rehearing Request, Awards Fees

Posted: September 13th, 2011, 9:18pm CEST by Unknown Lamer

Tags: security

OverTheGeicoE writes "The Electronic Privacy Information Center posted a news release about the DC Circuit Court awarding them attorneys fees yesterday. They are to receive $21,482 in attorneys fees for an open government lawsuit against DHS that ultimately released documents about DHS's airport body scanner program. EPIC used these released documents in EPIC v. DHS, another lawsuit that attempts to end the use of airport body scanners. At the end of an e-mailed version of this news release (EPIC Alert 18.18, not yet posted on the Web), EPIC states that 'EPIC requested an en banc review of the court's decision not to suspend, but, on September 12, 2011, the court declined the request.' Is this the end of EPIC v. DHS, or does this simply open the door for an appeal to the Supreme Court?" The complete ruling (PDF) is available.

Read more of this story at Slashdot.
Kevin Mitnick Answers

Posted: September 12th, 2011, 5:08pm CEST by timothy

Tags: security

Last week, you asked Kevin Mitnick questions about his past, his thoughts on ethics and disclosure, and his computer set-up. He's graciously responded; read on for his answers. (No dice on the computer set-up, though.) Thanks, Kevin.

Read more of this story at Slashdot.
GlobalSign Web Server Hacked, But Not CA

Posted: September 10th, 2011, 11:43pm CEST by timothy

Tags: security

Trailrunner7 writes "GlobalSign has found evidence that its main Web server was compromised recently, but has not discovered any indications that its certificate authority infrastructure was hacked, contrary to claims by the attacker responsible for the DigiNotar CA hack."

Read more of this story at Slashdot.
Researchers' Typosquatting Stole 20 GB of E-Mail

Posted: September 9th, 2011, 6:58pm CEST by Soulskill

Tags: security

NeverVotedBush writes "Two researchers who set up doppelganger domains to mimic legitimate domains belonging to Fortune 500 companies say they managed to vacuum up 20 gigabytes of misaddressed e-mail over six months. The intercepted correspondence included employee usernames and passwords, sensitive security information about the configuration of corporate network architecture that would be useful to hackers, affidavits and other documents related to litigation in which the companies were embroiled, and trade secrets, such as contracts for business transactions."

Read more of this story at Slashdot.
Apple Criticized For Not Blocking Stolen Certs

Posted: September 9th, 2011, 8:39am CEST by samzenpus

Tags: security

CWmike writes "A security researcher is criticizing Apple for lagging with its response to the DigiNotar certificate fiasco. He is urging the company to quickly update Mac OS X to protect users. 'We're looking at some very serious issues [about trust on the Web] and it doesn't help matters when Apple is dragging its feet,' said Paul Henry, a security and forensics analyst with Lumension. Unlike Microsoft, which updated Windows on Tuesday to block all SSL certificates issued by DigiNotar, Apple has not updated Mac OS X to do the same. Meanwhile, even Mac OS X users who want to go DIY are stymied, reports Bob McMillan, because the OS can't properly revoke dodgy digital certificates."

Read more of this story at Slashdot.
Moxie Marlinspike's Solution To the SSL CA Problem

Posted: September 8th, 2011, 5:01pm CEST by timothy

Tags: security

Trevelyan writes "In his Blackhat talk on the past and future of SSL (YouTube video) Moxie Marlinspike explains the problems of SSL today, and the history of how it came to be so. He then goes on to not only propose a solution, but he's implemented it as well: Convergence. It will let you turn off all those untrustable CAs in you browser and still safely use HTTPS. It even works with self-signed certificates. You still need to trust someone, but not forever like CAs. The system has 'Notaries,' which you can ask anonymously for their view on a certificate's authenticity. You can pool Notaries for a consensus, and add/remove them at any time."

Read more of this story at Slashdot.
GlobalSign Suspends Issuance of SSL Certificates

Posted: September 7th, 2011, 5:45pm CEST by Unknown Lamer

Tags: security

Joining the ranks of accepted submitters, realxmp writes "The BBC is reporting that GlobalSign has stopped issuing certificates because of yet another suspected CA security breach. This was in response to a post on the ComodoHacker paste bin, claiming that this and several other CA's have also been compromised." No word yet on whether they were actually compromised.

Read more of this story at Slashdot.
Rent Your Own Botnet

Posted: September 6th, 2011, 10:12pm CEST by Unknown Lamer

Tags: security

An anonymous reader writes "New research shows that the TDSS/TDL-4 botnet, widely considered one of the largest and most sophisticated, can be rented via a Web storefront available to all comers. Researchers from Kaspersky found that the latest version of TDSS installs a file that sets the machine up as a proxy for anonymous browsing, and then phones home to awmproxy.net, which rents the proxies for rates from $3 per day to $300 a week. The curators of this service even created a Firefox add-on to help customers. 'Interestingly, AWMproxy says it accepts payment via PayPal, MasterCard, and Visa.'"

Read more of this story at Slashdot.
(Possible) Diginotar Hacker Comes Forward

Posted: September 6th, 2011, 3:46pm CEST by timothy

Tags: security

arglebargle_xiv writes "At the risk of burning people out on the topic of PKI fail, someone claiming to be the Diginotar hacker has come forward to claim responsibility: It's the ComodoGate hacker. He also claims to 0wn four more 'high-profile' CAs, and still has the ability to issue new rogue certificates, presumably from other CAs that he 0wns." Whether this claim turns out to be truthful or not, what led to the breach in the first place? Reader Dr La points to an interim report commissioned by the Dutch government (PDF), according to which "a) No antivirus software was present on Diginotar's servers; b) 'the most critical servers' had malicious software infections; c) The software installed on the public web servers was outdated and not patched; and d) all servers were accessible by one user/password combination, which was 'not very strong and could easily be brute-forced.'"

Read more of this story at Slashdot.
Rogue SSL Certs Issued For CIA, MI6, Mossad

Posted: September 5th, 2011, 7:54pm CEST by timothy

Tags: security

Orome1 writes with this excerpt from Help Net Security: "The number of rogue SSL certificates issued by Dutch CA DigiNotar has ballooned from one to a couple dozen to over 250 to 531 in just a few days. As Jacob Appelbaum of the Tor project shared the full list of the rogue certificates, it became clear that fraudulent certificates for domains of a number of intelligence agencies from around the world were also issued during the CA's compromise — including the CIA, MI6 and Mossad. Additional targeted domains include Facebook, Yahoo!, Microsoft, Skype, Twitter, Tor, Wordpress and many others."

Read more of this story at Slashdot.
The Register Hacked

Posted: September 4th, 2011, 10:20pm CEST by samzenpus

Tags: security

First time accepted submitter rjmx writes "Looks like The Register has been hacked. Its front page has been replaced with a page in tasteful red and black, apparently by a Turkish hacker."

Read more of this story at Slashdot.
Kernel.org Attackers Didn't Know What They Had

Posted: September 3rd, 2011, 9:15pm CEST by Soulskill

Tags: security

Trailrunner7 writes "The attack that compromised some high-value servers belonging to kernel.org — but not the Linux kernel source code — may have been the work of hackers who simply got lucky and didn't realize the value of the servers that they had gotten their hands on. The attackers made a couple of mistakes that enabled the administrators at kernel.org to discover the breach and stop it before any major damage occurred. First, they used a known Linux rootkit called Phalanx that the admins were able to detect. And second, the attackers set up SSH backdoors on the compromised servers, which the admins also discovered. Had the hackers been specifically targeting the kernel.org servers, the attack probably would've looked quite different." A few blog posts in the wake of the attack have agreed with the initial announcement; while it was embarrassing, the integrity of the kernel source is not in question.

Read more of this story at Slashdot.

Slashdot: Linux

Kernel.org Attackers Didn't Know What They Had

Posted: September 3rd, 2011, 9:15pm CEST by Soulskill

Tags: security

Trailrunner7 writes "The attack that compromised some high-value servers belonging to kernel.org — but not the Linux kernel source code — may have been the work of hackers who simply got lucky and didn't realize the value of the servers that they had gotten their hands on. The attackers made a couple of mistakes that enabled the administrators at kernel.org to discover the breach and stop it before any major damage occurred. First, they used a known Linux rootkit called Phalanx that the admins were able to detect. And second, the attackers set up SSH backdoors on the compromised servers, which the admins also discovered. Had the hackers been specifically targeting the kernel.org servers, the attack probably would've looked quite different." A few blog posts in the wake of the attack have agreed with the initial announcement; while it was embarrassing, the integrity of the kernel source is not in question.

Read more of this story at Slashdot.

Slashdot: IT

Anonymous Retaliates, Leaks Texas Police Emails

Posted: September 2nd, 2011, 3:26pm CEST by Soulskill

Tags: security

An anonymous reader sends word that hacking group Anonymous has breached servers and accounts belonging to "dozens" of Texas police departments, leaking emails, documents and personal information. They say the attacks are in retaliation for "the arrests of dozens of alleged Anonymous suspects," and were done in solidarity with "the 'Anonymous 16' PayPal LOIC defendants, accused LulzSec member Jake Davis 'Topiary,' protesters arrested during #OpBart actions, Bradley Manning, Stephen Watt, and other hackers and leakers worldwide." Predictably, some of the leaked emails paint an unflattering picture of internal operations at the police departments.

Read more of this story at Slashdot.
"Apache Killer" Web Server Hole Plugged

Posted: September 2nd, 2011, 4:57am CEST by samzenpus

Tags: security

CWmike writes "The Apache open-source project has patched its Web server software to quash a bug that a denial-of-service (DoS) tool has been exploiting. Apache 2.2.20, released Tuesday, plugs the hole used by an 'Apache Killer' attack tool. On Aug. 24, project developers had promised a fix within 48 hours, then revised the timetable two days later to 24 hours. The security advisory did not explain the delay."

Read more of this story at Slashdot.
Anonymous Claims Responsibility For WikiLeaks Attack

Posted: September 1st, 2011, 3:32pm CEST by Unknown Lamer

Tags: security

mask.of.sanity writes "Anonymous members have taken responsibility for launching a denial of service attack against WikiLeaks this week using a custom-built tool that exploits an SQL server flaw. Field tests of the tool dubbed RefRef were launched against several websites including WikiLeaks, Pastebin and 4Chan. In a Twitter account linked to the Anonymous blog, the users were described as hacktivists with 'a personal vendetta against WikiLeaks,' adding that 'we are sorry we took you down. We are even.'"

Read more of this story at Slashdot.
Kernel.org Compromised

Posted: September 1st, 2011, 2:01am CEST by samzenpus

Tags: security

First time accepted submitter JoeF writes "There is a note posted on the main kernel.org page indicating that kernel.org was compromised earlier this month: 'Earlier this month, a number of servers in the kernel.org infrastructure were compromised. We discovered this August 28th. While we currently believe that the source code repositories were unaffected, we are in the process of verifying this and taking steps to enhance security across the kernel.org infrastructure.' The note goes on to say that it is unlikely to have affected the source code repositories, due to the nature of git."

Read more of this story at Slashdot.

Slashdot: Linux

Kernel.org Compromised

Posted: September 1st, 2011, 2:01am CEST by samzenpus

Tags: security

First time accepted submitter JoeF writes "There is a note posted on the main kernel.org page indicating that kernel.org was compromised earlier this month: 'Earlier this month, a number of servers in the kernel.org infrastructure were compromised. We discovered this August 28th. While we currently believe that the source code repositories were unaffected, we are in the process of verifying this and taking steps to enhance security across the kernel.org infrastructure.' The note goes on to say that it is unlikely to have affected the source code repositories, due to the nature of git."

Read more of this story at Slashdot.

Slashdot: IT

Hackers May Have Nabbed Over 200 SSL Certificates

Posted: September 1st, 2011, 1:11am CEST by samzenpus

Tags: security

CWmike writes "Hackers may have obtained more than 200 digital certificates from a Dutch company after breaking into its network, including ones for Mozilla, Yahoo and the Tor project — a considerably higher number than DigiNotar has acknowledged earlier this week when it said 'several dozen' certificates had been acquired by attackers. Among the certificates acquired by the attackers in a mid-July hack of DigiNotar, Van de Looy's source said, were ones valid for mozilla.com, yahoo.com and torproject.org, a system that lets people connect to the Web anonymously. Mozilla confirmed that a certificate for its add-on site had been obtained by the DigiNotar attackers. 'DigiNotar informed us that they issued fraudulent certs for addons.mozilla.org in July, and revoked them within a few days of issue,' Johnathan Nightingale, director of Firefox development, said Wednesday. Looy's number is similar to the tally of certificates that Google has blacklisted in Chrome."

Read more of this story at Slashdot.
EPIC Files For Rehearing In Body Scanner Case

Posted: August 30th, 2011, 9:11pm CEST by Unknown Lamer

Tags: security

OverTheGeicoE writes "The Electronic Privacy Information Center has filed for a rehearing in their case against DHS regarding airport body scanners. In their latest court filing (PDF), EPIC argues that last month's ruling requiring a public comment period but no other changes was based on incorrect information. From TFA: '"The court overstated the effectiveness of the body scanner devices and understated the degree of the privacy intrusion to the travelling public," stated EPIC President Marc Rotenberg. EPIC's petition challenged the Court's finding that the devices detect "liquid and powders," which was never established and was not claimed by the government. EPIC also argued that the court wrongly concluded that the TSA is not subject to a federal privacy law that prohibits video voyeurism. The panel found that TSA body scanner employees are "engaged in law enforcement activity," contrary to the TSA's own regulations.' Note that this is a request for a rehearing with the same court that rejected their request to stop TSA's use of body scanners. It is not an appeal to a higher court. Is EPIC likely to obtain a more favorable ruling from the same court?"

Read more of this story at Slashdot.
There's Been a Leak At WikiLeaks

Posted: August 29th, 2011, 9:10pm CEST by Soulskill

Tags: security

adeelarshad82 writes "German paper Der Freitag claims it has uncovered a batch of online unredacted diplomatic cables that came from WikiLeaks. Editor Steffen Kraft said he found a 'password protected csv file' that contained a 1.73GB cache of diplomatic cables from WikiLeaks. Its pages contained 'named or otherwise identifiable "informers" and "suspected intelligence agents" from Israel, Jordan, Iran, and Afghanistan.'"

Read more of this story at Slashdot.
Ask Kevin Mitnick

Posted: August 29th, 2011, 8:30pm CEST by timothy

Tags: security

The hacker with perhaps the most famous first name around, Kevin Mitnick, has gone from computer hacking of the sort that gets one on the FBI's Most Wanted list (and into years of solitary confinement) to respected security consultant and author, helping people minimize the sort of security holes he once exploited for fun. His new book is called Ghost in the Wires: My Adventures as the World's Most Wanted Hacker; it's his first since the expiration of an agreement that he could not profit from books written about his criminal activity. Kevin's agreed to answer your questions; we'll pass the best ones on to him, and print his answers when they're ready. Note: Kevin also answered Slashdot questions most of a decade ago; that's a good place to start. Please observe the Slashdot interview guidelines: ask as many questions as you want, but please keep them to one per comment.

Read more of this story at Slashdot.
New Worm Morto Using RDP To Infect Windows PCs

Posted: August 28th, 2011, 7:46pm CEST by timothy

Tags: security

Trailrunner7 writes "A new worm called Morto has begun making the rounds on the Internet, infecting machines via Remote Desktop Protocol. The worm is generating a large amount of outbound RDP traffic on networks that have infected machines, and Morto is capable of compromising both servers and workstations running Windows. Users who have seen Morto infections are reporting in Windows help forums that the worm is infecting machines that are completely patched and are running clean installations of Windows Server 2003."

Read more of this story at Slashdot.
Protecting a Laptop From Sophisticated Attacks

Posted: August 26th, 2011, 11:04pm CEST by Soulskill

Tags: security

mike_cardwell sends in a detailed writeup of how he went about protecting a Ubuntu laptop from attacks of varying levels of sophistication, covering disk encryption, defense against cold boot attacks, and even simple smash-and-grabs. (He also acknowledges that no defense is perfect, and the xkcd password extraction tool would still work.) Quoting: "An attacker with access to the online machine could simply hard reboot the machine from a USB stick or CD containing msramdmp to grab a copy of the RAM. You could password protect the BIOS and disable booting from anything other than the hard drive, but that still doesn't protect you. An attacker could cool the RAM, remove it from the running machine, place it in a second machine and boot from that instead. The first defense I used against this attack is procedure based. I shut down the machine when it's not in use. My old Macbook was hardly ever shut down, and lived in suspend to RAM mode when not in use. The second defense I used is far more interesting. I use something called TRESOR. TRESOR is an implementation of AES as a cipher kernel module which stores the keys in the CPU debug registers, and which handles all of the crypto operations directly on the CPU, in a way which prevents the key from ever entering RAM. The laptop I purchased works perfectly with TRESOR as it contains a Core i5 processor which has the AES-NI instruction set."

Read more of this story at Slashdot.

Slashdot: Linux

Protecting a Laptop From Sophisticated Attacks

Posted: August 26th, 2011, 11:04pm CEST by Soulskill

Tags: security

mike_cardwell sends in a detailed writeup of how he went about protecting a Ubuntu laptop from attacks of varying levels of sophistication, covering disk encryption, defense against cold boot attacks, and even simple smash-and-grabs. (He also acknowledges that no defense is perfect, and the xkcd password extraction tool would still work.) Quoting: "An attacker with access to the online machine could simply hard reboot the machine from a USB stick or CD containing msramdmp to grab a copy of the RAM. You could password protect the BIOS and disable booting from anything other than the hard drive, but that still doesn't protect you. An attacker could cool the RAM, remove it from the running machine, place it in a second machine and boot from that instead. The first defense I used against this attack is procedure based. I shut down the machine when it's not in use. My old Macbook was hardly ever shut down, and lived in suspend to RAM mode when not in use. The second defense I used is far more interesting. I use something called TRESOR. TRESOR is an implementation of AES as a cipher kernel module which stores the keys in the CPU debug registers, and which handles all of the crypto operations directly on the CPU, in a way which prevents the key from ever entering RAM. The laptop I purchased works perfectly with TRESOR as it contains a Core i5 processor which has the AES-NI instruction set."

Read more of this story at Slashdot.

Slashdot: IT

Coordinated, Global ATM Heist Nets $13 Million

Posted: August 26th, 2011, 8:58pm CEST by Soulskill

Tags: security

An anonymous reader writes "An international cybercrime gang stole $13 million from a Florida-based financial institution earlier this year, by executing a highly-coordinated heist in which thieves used ATMs around the globe to cash out stolen prepaid debit cards. 'Prepaid cards usually limit the amounts that cardholders can withdraw from a cash machine within a 24 hour period. Apparently, the crooks were able to drastically increase or eliminate the withdrawal limits for 22 prepaid cards that they had obtained. The fraudsters then cloned the prepaid cards, and distributed them to co-conspirators in several major cities across Europe, Russia and Ukraine.' The attack is eerily similar to the 2008 attack on RBS WorldPay that stole $9.4M. The men who pleaded guilty to the RBS attack were arrested and charged in Russia, but were later given only probation."

Read more of this story at Slashdot.
Book Review: Ghost In the Wires

Posted: August 26th, 2011, 8:19pm CEST by samzenpus

Tags: security

brothke writes "During the 1990's when Kevin Mitnick was on the run, a cadre of people were employed to find him and track him down. Anyone who could have an angle on Mitnick was sought after by the media to provide a sound bite on the world's most dangerous computer hacker. Just one example is John Markoff, who became a star journalist for his work at The New York Times, and a follow-up book and series of articles based on Mitnick. In Ghost in the Wires: My Adventures as the Worlds Most Wanted Hacker, the first personal account of what really happened; Mitnick says most of the stories around him were the result of the myth of Kevin Mitnick, and nothing more. In the book, he attempts to dispel these myths and set the record straight." Read below for the rest of Ben's review.

Read more of this story at Slashdot.
Was This the Phishing E-mail That Took Down RSA?

Posted: August 26th, 2011, 3:35pm CEST by Soulskill

Tags: security

alphadogg tips this IDG News report: "'I forward this file to you for review. Please open and view it.' As a ploy to get a hapless EMC recruiter to open up a booby-trapped Excel spreadsheet, it may not be the most sophisticated piece of work. But researchers at F-Secure believe that it was enough to break into one of the most respected computer security companies on the planet, and a first step in a complex attack that ultimately threatened the security of major U.S. defense contractors including Lockheed Martin, L-3, and Northrop Grumman. The e-mail was sent on March 3 and uploaded to VirusTotal a free service used to scan suspicious messages, on March 19, two days after RSA went public with the news that it had been hacked in one of the worst security breaches ever."

Read more of this story at Slashdot.
MIT Researchers Defend Against Wireless Attacks

Posted: August 26th, 2011, 1:20am CEST by timothy

Tags: security

alphadogg writes "MIT researchers have devised a protocol to flummox man-in-the-middle attacks against wireless networks. The all-software solution lets wireless radios automatically pair without the use of passwords and without relying on out-of-band techniques such as infrared or video channels. Dubbed Tamper-evident pairing, or TEP, the technique is based on understanding how man-in-the-middle attacks tamper with wireless messages, and then detects and in some cases blocks the tampering. The researchers suggest that TEP could have detected the reported but still unconfirmed cellular man-in-the-middle attack that unfolded at the Defcon conference earlier this month in Las Vegas."

Read more of this story at Slashdot.
Apache Warns Web Server Admins of DoS Attack Tool

Posted: August 25th, 2011, 1:37am CEST by samzenpus

Tags: security

CWmike writes "Developers of the Apache open-source project warned users of the Web server software on Wednesday that a denial-of-service (DoS) tool is circulating that exploits a bug in the program. 'Apache Killer' showed up last Friday in a post to the 'Full Disclosure' security mailing list. The Apache project said it would release a fix for Apache 2.0 and 2.2 in the next 48 hours. All versions in the 1.3 and 2.0 lines are said to be vulnerable to attack. The group no longer supports the older Apache 1.3. 'The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server,' Apache said in an advisory. The bug is not new. Michal Zalewski, a security engineer who works for Google, pointed out that he had brought up the DoS exploitability of Apache more than four-and-a-half years ago. In lieu of a fix, Apache offered steps administrators can take to defend their Web servers until a patch is available."

Read more of this story at Slashdot.
Apache Warns Web Server Admins of DoS Attack Tool

Posted: August 25th, 2011, 1:37am CEST by samzenpus

Tags: security

CWmike writes "Developers of the Apache open-source project warned users of the Web server software on Wednesday that a denial-of-service (DoS) tool is circulating that exploits a bug in the program. 'Apache Killer' showed up last Friday in a post to the 'Full Disclosure' security mailing list. The Apache project said it would release a fix for Apache 2.0 and 2.2 in the next 48 hours. All versions in the 1.3 and 2.0 lines are said to be vulnerable to attack. The group no longer supports the older Apache 1.3. 'The attack can be done remotely and with a modest number of requests can cause very significant memory and CPU usage on the server,' Apache said in an advisory. The bug is not new. Michal Zalewski, a security engineer who works for Google, pointed out that he had brought up the DoS exploitability of Apache more than four-and-a-half years ago. In lieu of a fix, Apache offered steps administrators can take to defend their Web servers until a patch is available."

Read more of this story at Slashdot.
Researchers Report Spike In Boot Time Malware

Posted: August 24th, 2011, 5:18pm CEST by CmdrTaco

Tags: security

wiredmikey writes "In their most recent intelligence report, Symantec researchers pointed out a massive increase in the amount of boot time malware striking users, noting there have already been as many new boot time malware threats detected in the first seven months of 2011 as there were in the previous three years. Also known as MBR (master boot record) threats, the malware infect an area of the hard disk that makes them one of the first things to be read and executed when a computer is turned on. This enables the threats to effectively dodge many security defenses."

Read more of this story at Slashdot.
Researchers Report Spike In Boot Time Malware

Posted: August 24th, 2011, 5:18pm CEST by CmdrTaco

Tags: security

wiredmikey writes "In their most recent intelligence report, Symantec researchers pointed out a massive increase in the amount of boot time malware striking users, noting there have already been as many new boot time malware threats detected in the first seven months of 2011 as there were in the previous three years. Also known as MBR (master boot record) threats, the malware infect an area of the hard disk that makes them one of the first things to be read and executed when a computer is turned on. This enables the threats to effectively dodge many security defenses."

Read more of this story at Slashdot.
Anonymous Breaches Another US Defense Contractor

Posted: August 22nd, 2011, 4:07pm CEST by Soulskill

Tags: security

JohnBert sends this excerpt from and IDG report: "The politically oriented hacking group Anonymous has released 1GB of what it says are private e-mails and documents from an executive of a U.S. defense company that sells unmanned aerial vehicles to police and the U.S. military. The documents were publicized in a post on Pastebin, with links leading to the actual material on another website. The material purportedly belongs to Richard Garcia, a senior vice president at Vanguard who was a U.S. Federal Bureau of Investigation special agent for 25 years. Anonymous took special delight in the breach, as Garcia is director of InfraGard, an organization that liaises between private sector companies and the FBI. A group affiliated with Anonymous called LulzSecurity, or LulzSec, breached and defaced one of InfraGard's websites belonging to its Atlanta chapter in June."

Read more of this story at Slashdot.
Anonymous Breaches Another US Defense Contractor

Posted: August 22nd, 2011, 4:07pm CEST by Soulskill

Tags: security

JohnBert sends this excerpt from and IDG report: "The politically oriented hacking group Anonymous has released 1GB of what it says are private e-mails and documents from an executive of a U.S. defense company that sells unmanned aerial vehicles to police and the U.S. military. The documents were publicized in a post on Pastebin, with links leading to the actual material on another website. The material purportedly belongs to Richard Garcia, a senior vice president at Vanguard who was a U.S. Federal Bureau of Investigation special agent for 25 years. Anonymous took special delight in the breach, as Garcia is director of InfraGard, an organization that liaises between private sector companies and the FBI. A group affiliated with Anonymous called LulzSecurity, or LulzSec, breached and defaced one of InfraGard's websites belonging to its Atlanta chapter in June."

Read more of this story at Slashdot.
A Chat With Zavilia, a Tool For Identifying Rioters

Posted: August 19th, 2011, 10:58am CEST by Unknown Lamer

Tags: security

HansonMB writes with an interview in Motherboard.tv. From the article: "Social media isn't just great for starting 'social unrest,' it's proving to be quite helpful for quashing it too. Not long after the bricks began to fly in London's latest kerfuffle, locals angry over raging mobs scrambled to assist the police in their attempt to identify street-fighters and free-for-all hooligans ... Now with more than 1,000 people charged over the chaos, a few citizen groups continue to provide web-based rioter identification platforms, in hopes of being good subjects, maintaining the country's pursuit of order, and keeping their neighborhoods safe."

Read more of this story at Slashdot.
New Research Cracks AES Keys 3-5x Faster

Posted: August 19th, 2011, 2:53am CEST by Unknown Lamer

Tags: security

Landing his first accepted submission, qpgmr writes "AES, generally thought to be the gold standard for encryption, is showing weaknesses. From Computerworld: 'Researchers from Microsoft and the [Belgian] Katholieke Universiteit Leuven have discovered a way to break the widely used Advanced Encryption Standard, the encryption algorithm used to secure most all online transactions and wireless communications.'" The full paper has lots of details. Note that it would still take a few billion years with current computers to actually break anything, but there may be further vunerabilities yet to be discovered.

Read more of this story at Slashdot.
DHS Tries To Hide Mobile Scanner Details

Posted: August 19th, 2011, 12:15am CEST by Unknown Lamer

Tags: security

OverTheGeicoE writes "The Electronic Privacy Information Center filed a Freedom of Information Act request last year (PDF) with the US Department of Homeland Security, whose Transportation Security Administration has been investigating the use of x-ray scanning technology for covert use in more public places, like train stations and even ordinary city streets. TSA has tested interesting devices like the Z Backscatter Vans both privately and on members of the general public. EPIC recently received new documents from DHS. Some of the documents are almost completely black from redactions."

Read more of this story at Slashdot.
Hackers Get Their Own Scoreboard and Rankings

Posted: August 17th, 2011, 5:51pm CEST by samzenpus

Tags: security

wiredmikey writes "Sometimes hacking is about money; other times, it's about competition, and when that happens, it is also about getting a little credit. Enter RankMyHack.com. The site is described as the world's 'first elite hacker ranking system,' and invites people to submit proof of their Website hacks in exchange for points — the higher the points, the higher the place on the leader board. In order to get ranked, hackers need to prove they have indeed hacked a site – by inserting a predetermined text into the hacked site page. Rankmyhack then scans for the text in the page and gives score based on how popular the website is, with lower points awarded for XSS attacks. Assuming the site is real – and early reports indicate that it is – hackers can now see where their hacks stack up against those of their peers. Will this morph into a playground for hacktivists to hone their skills?"

Read more of this story at Slashdot.
How To Steal ATM PINs With a Thermal Camera

Posted: August 17th, 2011, 5:24pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "Researchers from UCSD have demonstrated how thermal imagery cameras can be used to steal customers' PINs (PDF) when you withdraw cash from ATMs. Their paper, entitled 'Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks', (PDF) discovered that plastic PIN pads were the best for retaining heat signatures showing which numbers (and in which order) were used by bank customers. Fortunately the methodology does not appear to have been used by criminals yet, but a third of people surveyed admit that they do not check ATMs for tampering before withdrawing cash."

Read more of this story at Slashdot.
Fired Techie Created Virtual Chaos At Pharma Co.

Posted: August 17th, 2011, 11:19am CEST by Soulskill

Tags: security

itwbennett writes "Using a secret vSphere console, Jason Cornish, formerly an IT staffer at the U.S. subsidiary of drug-maker Shionogi, wiped out most of the company's computer infrastructure earlier this year. Cornish, 37, pleaded guilty Tuesday to computer intrusion charges in connection with the attack."

Read more of this story at Slashdot.
Can We Fix SSL Certification?

Posted: August 16th, 2011, 9:03pm CEST by Unknown Lamer

Tags: security

Em Adespoton writes "At DEFCON this year, Moxie Marlinspike gave an excellent presentation showing how broken the current SSL certification model is and proposing a replacement. Naked Security adds to the issue, asking: does it even matter if you can trust your certificate notaries?"

Read more of this story at Slashdot.
Aaron Barr Talks About DEFCON, Anonymous Attacks

Posted: August 16th, 2011, 2:51pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "Finding Aaron Barr at this year's DEFCON hacker conference in Las Vegas was like a giant game of 'Where's Waldo.' Given the events of the past year, you can hardly blame him for keeping a low profile. First there was the attack on him and his then-employer, HBGary Federal, his decision to part ways with HBGary, his work to rehabilitate his image and turn his personal misfortunes into a 'teaching moment' for the industry, and then the legal wrangling in recent weeks that threw cold water on his plans to take part in a panel discussion about Anonymous at DEFCON. Barr was courted by numerous news outlets at the show, including the mainstream media. But he preferred, for the most part, to keep his own counsel. But he offered his thoughts to Threatpost on the experience of being at the conference, what the attack by Anonymous has done to him and whether it's possible for the group to turn its attentions to more constructive pursuits."

Read more of this story at Slashdot.
SpyEye Trojan Source Code Leaked

Posted: August 16th, 2011, 12:05am CEST by Soulskill

Tags: security

wiredmikey writes "The SpyEye malware kit has long been both the bane of unsuspecting victims and a boon for cyber-criminals. Now, according to security researchers, the situation may have taken a turn for the worse. The SpyEye Builder patch source code for release 1.3.45 was leaked by the Reverse Engineers Dream Crew (RED Crew) recently after a crew member was able to locate a copy of SpyEye Builder 1.3.45 and create a tutorial that enables a reader with SpyEye Builder to crack the hardware identification."

Read more of this story at Slashdot.
Essex Police Arrest Man Over Blackberry Water Fight Plan

Posted: August 15th, 2011, 10:19pm CEST by samzenpus

Tags: security

An anonymous reader writes "Under the banner headline 'Police reassure residents they are working to keep county safe,' Essex police proudly proclaimed that they arrested a 20-year-old man from Colchester who 'allegedly sent messages from a Blackberry encouraging people to join in a water fight.' Having also made a number of arrests of people sitting at home on Facebook, Acting Assistant Chief Constable Mason wrote: 'Police will continue to monitor social networking sites for unlawful activity.'" That's some good police work there, Lou.

Read more of this story at Slashdot.
WPA/WPA2 Cracking With CPUs, GPUs, and the Cloud

Posted: August 15th, 2011, 6:33pm CEST by CmdrTaco

Tags: security

wintertargeter writes "Yeah, it's another article on security, but this time we finally get a complete picture. Tom's Hardware looks at WPA/WPA2 brute-force cracking with CPUs, GPUs, and Amazon's Nvidia Tesla-based EC2 cloud servers. Verdict? WPA/WPA2 is pretty damn secure. Now to wait for a side-channel attack. Sigh...."

Read more of this story at Slashdot.
US and UK Zombies Demand Top Dollar

Posted: August 15th, 2011, 5:01pm CEST by CmdrTaco

Tags: security

coondoggie writes "Denizens of the malware underworld who sell access to compromised computers do so at varying rates depending on where the machines are located, researchers told the Usenix Security Symposium this week. The researchers followed what they called the pay-per-install (PPI) industry, which obtains infected machines from which malware can be launched and sells access to these machines to parties looking for someplace to execute malicious code. Sometimes the PPI sellers hire middlemen to supply the compromised machines, and the PPI dealer retails them."

Read more of this story at Slashdot.
NAND Flash Can Verify a Device's Identity

Posted: August 13th, 2011, 7:30pm CEST by timothy

Tags: security

itwbennett writes "Researchers at UC San Diego and Cornell University have developed software that they say can detect variations in flash behavior that are unique to each chip. The system uses 'physically unclonable functions' (PUFs), or variations in manufacturing that are unique to each element of each flash chip. Swanson described one PUF that his team has worked with, called Program Disturb. It uses a type of manufacturing flaw that doesn't affect normal operation but causes problems under test conditions." Related: from last October, another description of such error-based identity assignment.

Read more of this story at Slashdot.
Macs More Vulnerable Than Windows For Enterprise

Posted: August 9th, 2011, 3:32pm CEST by CmdrTaco

Tags: security

sl4shd0rk writes "At a Black Hat security conference in Las Vegas, researchers presented exploits on Apple's DHX authentication scheme which can compromise all connected Macs on the LAN within minutes. 'If we go into an enterprise with a Mac and run this tool we will have dozens or hundreds of passwords in minutes,' Stamos said. Macs are fine as long as you run them as little islands, but once you hook them up to each other, they become much less secure."

Read more of this story at Slashdot.
India Wants To Monitor Twitter, Facebook

Posted: August 9th, 2011, 7:41am CEST by timothy

Tags: security

swandives writes "India's home ministry has asked its communications ministry to monitor social networking websites such as Twitter and Facebook amid fears that the services are being used by terrorists to plan attacks. The request suggests that the Indian government is trying to broaden the scope of its online surveillance for national security. Under new rules to the country's IT Act that came into force earlier this year, websites and service providers are required to provide government security agencies with information on private accounts, including passwords, on request without a court order."

Read more of this story at Slashdot.
Science Fair Entry Shuts Down Airport Terminal

Posted: August 8th, 2011, 11:47pm CEST by Soulskill

Tags: security

OverTheGeicoE writes "A graduate student was returning home from a science fair in Omaha with his handmade entry in his carry-on luggage. When the TSA discovered it, they shut down the airport terminal for several hours, until they could determine it was harmless. All of this has happened before, and all of this will happen again, so before you fly with your homemade Minty MP3 player, make sure you take a look at TSA Blogger Bob's warning or it could wind up looking like this."

Read more of this story at Slashdot.
Building a Better 'Anonymous?'

Posted: August 8th, 2011, 5:28pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "A hacktivism panel at the DefCon hacker convention was conspicuously missing its star member Aaron Barr, who dropped out under legal pressure from his former company HBGary Federal, debated how Anonymous could channel its efforts for the greater good. Members of Anon attending the discussion chimed in, too."

Read more of this story at Slashdot.
Black Hat Talk Demonstrates New Document Exploits

Posted: August 6th, 2011, 9:38pm CEST by timothy

Tags: security

darthcamaro writes "Remember the days of the viruses embedded in email attachments? They're coming back, according to a pair of researcher talking at Black Hat this week: '"If you have installed all Microsoft Office patches and there are no 0 day vulnerabilities, will it be safe to open a Word or Excel document?" TT asked the audience. "The answer is no."'"

Read more of this story at Slashdot.
Defcon Hacks Defeat Card-And-Code Locks In Seconds

Posted: August 6th, 2011, 2:57am CEST by timothy

Tags: security

Sparrowvsrevolution writes "At the Defcon security conference in Las Vegas, Marc Weber Tobias and Toby Bluzmanis plan to demonstrate simple hardware hacks that expose critical security problems in Swiss lock firm Kaba's E-plex 5800 and its older 5000. Kaba markets the 5800 lock, which Bluzmmanis says can cost as much as $1,300, as the first to integrate code-based access controls with a new Department of Homeland Security standard that goes into effect next year and requires identifying credentials be used in secure facilities to control access. One attack uses a mallet to 'rap' open the lock, another opens the lock by putting a pin through the LED display light to ground a contact on the circuit board, and a third uses a wire inserted in the lock's back panel to hit a switch that resets its software."

Read more of this story at Slashdot.
The History of Invisible Ink

Posted: August 5th, 2011, 9:38pm CEST by samzenpus

Tags: security

As a kid I had a minor obsession with invisible ink after learning about it in a science club. An impressive stack of vinegar and lemon scented papers filled my desk, but the history of invisible ink is much more interesting than a summer enrichment program. Starting with the Roman general Pliny the Elder using milk from the thithymallus plant, to modern inks which are only visible under UV light, the science of invisible ink has grown quite complex. Some of the oldest CIA documents contain recipes for special inks, and MI6 and their very own "adult" mixture during WW1.

Read more of this story at Slashdot.
DOS, Backdoor, and Easter Egg Found In Siemens S7

Posted: August 4th, 2011, 5:47pm CEST by Unknown Lamer

Tags: security

chicksdaddy writes with a post in Threat Post. From the article: "Dillon Beresford used a presentation at the Black Hat Briefings on Wednesday to detail more software vulnerabilities affecting industrial controllers from Siemens, including a serious remotely exploitable denial of service vulnerability, more hard-coded administrative passwords, and even an easter egg program buried in the code that runs industrial machinery around the globe. In an interview Tuesday evening, Beresford said he has reported 18 separate issues to Siemens and to officials at ICS CERT, the Computer Emergency Response Team for the Industrial Control Sector. Siemens said it is readying a patch for some of the holes, including one that would allow a remote attacker to gain administrative control over machinery controlled by certain models of its Step 7 industrial control software."

Read more of this story at Slashdot.
US Wants Cybersecurity Protection Plan For Cars

Posted: August 3rd, 2011, 10:15pm CEST by samzenpus

Tags: security

coondoggie writes "As cars and other forms of transportation increasingly rely on online systems for everything from safety to onboard entertainment, the cybersecurity threat from those who would exploit such electronic control packages has also increased. That's why the US Department of Transportation (DOT) today issued a Request For Information to the security industry to help it build a roadmap to build 'motor vehicle safeguards against cybersecurity threats and assure the reliability and safety of automotive electronic control systems.'"

Read more of this story at Slashdot.
Get Cyber-Mercenaries Suggests Ex NSA, CIA Director

Posted: August 3rd, 2011, 7:22pm CEST by samzenpus

Tags: security

siliconbits writes "One of the architects of US foreign policy under George W. Bush, General Michael Hayden, suggested that the US Government should consider creating a "Digital Blackwater" during a conversation at an event called the Aspen Security Forum. Blackwater was the US private military group founded in 1997 and which has been renamed as Xe Services LLC, a move possibly linked with a number of controversies that arose after the company expanded its security-related operations into Iraq and Afghanistan. Recruiting mercenaries, Hayden suggested 'might be one of those big new ideas in terms of how we have to conduct ourselves in this new cyber domain.'"

Read more of this story at Slashdot.
Living In an Unsecured World

Posted: August 3rd, 2011, 4:08am CEST by Soulskill

Tags: security

GhostX9 writes "Charlie Miller, Accuvant Principal Research Consultant and keynote speaker at NATO's recent International Conference on Cyber Conflict, speaks with Alan Dang of Tom's Hardware about living in an unsecured world. He goes over his recent MacBook battery exploit and the challenges of computing security in the upcoming future. Quoting: '[W]hat we can do (and this is the approach the industry is sort of taking) is make it so hard and expensive to pull off attacks that it becomes economically infeasible for most attackers. ... The way we make it more difficult is to reduce the number of vulnerabilities and ensure users' software is up to date and "secure by default." Also, make the OS resilient to attack with things like stack canaries, ASLR, DEP, and sandbox applications so that multiple exploits are needed. We also need to better control the software loaded on our devices (i.e. Apple's App Store model). So, instead of having to write a single exploit, it takes three or four in order to perform an attack. This means most attackers won't be able to pull it off, and those who can will have to spend much more time working it out.'"

Read more of this story at Slashdot.
UK Police Charge Suspected Anonymous Spokesman

Posted: August 1st, 2011, 4:55am CEST by samzenpus

Tags: security

An anonymous reader writes "Scotland Yard has tonight charged 18-year-old Jake Davis, who was arrested in the Shetland Islands last week, with five offenses including unauthorized computer access and conspiracy to carry out a DDoS (distributed denial-of-service) attack against the SOCA (Serious Organized Crime Agency) website. When announcing his arrest on Wednesday, police said that they believed Davis used the online nickname 'Topiary' and acted as the spokesperson for the Anonymous and LulzSec hacking groups. Topiary's final twitter message said 'You can't arrest an idea' just before his arrest."

Read more of this story at Slashdot.
Windows XP PCs Breed Rootkit Infections

Posted: July 31st, 2011, 5:45pm CEST by samzenpus

Tags: security

CWmike writes "Machines running the decade-old Windows XP make up a huge reservoir of infected PCs that can spread malware to other systems, a Czech antivirus company said. Windows XP computers are infected with rootkits out of proportion to the operating system's market share, according to data released Thursday by Avast Software, which surveyed more than 600,000 Windows PCs. While XP now accounts for about 58% of all Windows systems in use, 74% of the rootkit infections found by Avast were on XP machines. Avast attributed the infection disparity between XP and Windows 7 to a pair of factors: The widespread use of pirated copies of the former and the latter's better security. Vlcek assumed that many of the people running XP SP2, which Microsoft stopped supporting with security patches a year ago, have declined to update to the still-supported SP3 because they are running counterfeits."

Read more of this story at Slashdot.
PayPal Hands Over 1,000 IP Addresses To the FBI

Posted: July 31st, 2011, 3:58pm CEST by samzenpus

Tags: security

tekgoblin writes "PayPal was attacked by Anonymous last year when they had blocked the Wikileaks accounts transactions. Now PayPal has finally come up with enough evidence to strike back at Anonymous with the help of the FBI. PayPal has come up with a list of over 1,000 IP Addresses left behind when they were attacked by Anonymous."

Read more of this story at Slashdot.
Hackers Could Open Convicts' Cells In Prisons

Posted: July 31st, 2011, 2:14pm CEST by Soulskill

Tags: security

Hugh Pickens writes "Some of the same vulnerabilities that the Stuxnet superworm used to sabotage centrifuges at a nuclear plant in Iran exist in the country's top high-security prisons where programmable logic controllers (PLCs) control locks on cells and other facility doors. Researchers have already written three exploits for PLC vulnerabilities they found. 'Most people don't know how a prison or jail is designed; that's why no one has ever paid attention to it,' says John Strauchs, who plans to discuss the issue and demonstrate an exploit against the systems at the DefCon hacker conference next week. 'How many people know they're built with the same kind of PLC used in centrifuges?' A hacker would need to get his malware onto the control computer either by getting a corrupt insider to install it via an infected USB stick or send it via a phishing attack aimed at a prison staffer, since some control systems are also connected to the internet, Strauchs claims. 'Bear in mind, a prison security electronic system has many parts beyond door control such as intercoms, lighting control, video surveillance, water and shower control, and so forth,' adds Strauchs. 'Once we take control of the PLC we can do anything (PDF). Not just open and close doors. We can absolutely destroy the system. We could blow out all the electronics.'"

Read more of this story at Slashdot.
Anonymous Releases 400 MB of FBI Contractor Data

Posted: July 30th, 2011, 3:19pm CEST by Soulskill

Tags: security

An anonymous reader writes "Anonymous, as they have claimed they would, finally released 400 megabytes of files (NSFW language) allegedly stolen from ManTech, a cyber security firm contracted by the FBI. Anonymous stated, 'The FBI is outsourcing cybersecurity to the tune of nearly $100 million to a Washington-area managed services company. The deal shows a willingness in the federal government to place IT services more and more in the hands of third parties as agencies don't have enough staff on hand to do the job.'"

Read more of this story at Slashdot.
HBGary Federal Forces Aaron Barr Out of DEFCON

Posted: July 28th, 2011, 12:06am CEST by samzenpus

Tags: security

Trailrunner7 writes "Former HBGary Federal CEO Aaron Barr says he will withdraw from a planned appearance at the DEFCON conference in the face of threatened legal action over his plans to take part in a panel discussion there. Barr notified DEFCON organizers on Wednesday that he was withdrawing from the Aug. 6 panel discussion after attorneys representing HBGary Federal threatened to file an injunction against him if he did not withdraw from the panel immediately. The incident is just the latest in a series of conflicts between Barr and HBGary Federal following attacks by the anarchic hacking group Anonymous on February 5."

Read more of this story at Slashdot.
Lawsuit Against Sony Highlights Cyber Insurance Shortcomings

Posted: July 27th, 2011, 7:48pm CEST by samzenpus

Tags: security

CWmike writes "A brewing legal dispute between Sony and one of its insurers over data breach liability claims highlights the challenges that companies can sometimes face in getting insurance providers to cover expenses arising from cybersecurity incidents. Zurich American Insurance Co. asked the court last week to absolve it of any responsibility for defending or indemnifying Sony against claims arising from the recent data breaches at the company. The data breaches at Sony's PlayStation Network, Sony Entertainment Online and Sony Pictures resulted in account data on close to 100 million individuals becoming exposed and over 12 million credit and debit cards being compromised. The breaches have so far resulted in at least 55 putative class-action lawsuits being filed against Sony in the U.S and another three lawsuits filed against it in Canada. Sony expects to spend close to $180 million in the next year alone on breach-related costs. But analysts say insurance might not have even been worth it in Sony's case: 'There aren't many success stories where cyber insurance [has played] a significant role in reducing the cost of incidents,' said Gartner analyst John Pescatore. Um, better security as an insurance policy maybe?"

Read more of this story at Slashdot.
LulzSec Calls For PayPal Boycott, Spokesman Arrested

Posted: July 27th, 2011, 6:58pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "British police have arrested a 19-year-old man believed to be 'Topiary', the official spokesperson of the LulzSec hactivist group. The man was arrested at his home in the Shetland Islands earlier today (July 27), and is being transported to a central London police station." Also today, LulzSec has called for a boycott of PayPal saying “We encourage anyone using PayPal to immediately close their accounts and consider an alternative.”

Read more of this story at Slashdot.
Security Expert Slams Google+ Pseudonym Policy

Posted: July 27th, 2011, 2:55pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "A security expert has panned Google's "real name" policy on Google+, claiming that the hard line will damage privacy. Sophos's Chester Wisniewski says that closing accounts where users have adopted false names erodes privacy on the social network. 'What they seemed to have missed is that the very foundation of privacy is identity. Simply knowing my postal code or birth date is meaningless without a name to associate it with. By requiring people to only use their real names, unless they just happen to be a celebrity, they have eliminated the ability for people to be private in any meaningful way.'"

Read more of this story at Slashdot.
The Rise of Polymorphic Malware

Posted: July 26th, 2011, 7:10pm CEST by Unknown Lamer

Tags: security

twoheadedboy writes "The level of aggressive, polymorphic malware intercepted by Symantec doubled in July, when compared to figures from six months ago. This kind of malware has been typically found inside an executable within an attached ZIP file disguised as a PDF file, and is pretty darn good at getting around traditional anti-virus products. 'There are powerful Darwinian forces acting on the development of malware by criminals,' said Martin Lee, senior software engineer at Symantec. 'Those who look to innovate and improve their malware tend to infect more computers and acquire the resources to reinvest in further development and innovation.'"

Read more of this story at Slashdot.
Court Filing On How 2004 Ohio Election Hacked

Posted: July 26th, 2011, 2:47pm CEST by CmdrTaco

Tags: security

chimpo13 writes "A new filing in the King Lincoln Bronzeville v. Blackwell case includes a copy of the Ohio Secretary of State election production system configuration that was in use in Ohio's 2004 presidential election when there was a sudden and unexpected shift in votes for George W. Bush."

Read more of this story at Slashdot.
Could the KGB Infiltrate LulzSec?

Posted: July 25th, 2011, 3:25pm CEST by CmdrTaco

Tags: security

Barence writes "Foreign powers could try to infiltrate hacktivist networks in order to manipulate their actions, according to a security expert who advises governments and businesses on internet issues. Likening the emergence of the hacktivist movement to the arrival of militant groups such as the Red Brigade during the 1970s, government advisor and chair of the International E-crime Congress, Simon Moores, said that hacker groups could eventually be swayed by outside influences. 'If you have a LulzSec or an Anonymous that is perhaps being manipulated by a foreign actor, it takes us back to the days of the Stasi and the KGB, which were manipulating [anti-nuclear campaign group] CND quite easily from Moscow,' he said."

Read more of this story at Slashdot.
675k Stolen Credit Cards = Ten Years In Jail

Posted: July 24th, 2011, 11:52pm CEST by timothy

Tags: security

wiredmikey writes "A hacker who had been found with more than 675,000 stolen credit card numbers that reportedly led to losses totaling more than $36 million, was sentenced on Friday to 120 months in prison. After pleading guilty on April 21, 2011, Rogelio Hackett Jr., 25, of Lithonia, Georgia, was slapped with a maximum prison sentence and ordered to pay a $100,000 fine. According to court documents, U.S. Secret Service special agents executing a search warrant in 2009 at Hackett's home found more than 675,000 stolen credit card numbers and related information in his computers and email accounts. Hackett admitted in a court filing that since at least 2002, he has been trafficking in credit card information he obtained either by hacking into business computer networks and downloading credit card databases, or purchasing the information from others using the Internet through various carding forums."

Read more of this story at Slashdot.
Heathrow To Install Facial Recognition Scanners

Posted: July 24th, 2011, 11:24am CEST by timothy

Tags: security

itwbennett writes "Slashdot readers will recall that back in February, Heathrow airport required full body scanning for select individuals. Now we learn that the airport is installing facial recognitions scanners. The scanners will be used to capture passengers' faces before entering security checks and again before boarding. The stated goal is to prevent illigal immigration."

Read more of this story at Slashdot.
Apple Laptops Vulnerable To Battery Firmware Hack

Posted: July 22nd, 2011, 10:59pm CEST by Soulskill

Tags: security

Trailrunner7 writes "Security researcher Charlie Miller, widely known for his work on Mac OS X and Apple's iOS, has discovered an interesting method that enables him to completely disable the batteries on Apple laptops, making them permanently unusable, and perform a number of other unintended actions. The method, which involves accessing and sending instructions to the chip housed on smart batteries, could also be used for more malicious purposes down the road. Miller discovered the default passwords set on the battery at the factory to change the battery into unsealed mode and developed a method that let him permanently brick the battery as well as read and modify the entire firmware. 'You can read all the firmware, make changes to the code, do whatever you want. And those code changes will survive a reinstall of the OS, so you could imagine writing malware that could hide on the chip on the battery. You'd need a vulnerability in the OS or something that the battery could then attack, though,' Miller said."

Read more of this story at Slashdot.
Anonymous Releases Restricted NATO Document

Posted: July 22nd, 2011, 1:09pm CEST by timothy

Tags: security

angry tapir writes "Anonymous has released a document marked 'restricted' from the North Atlantic Treaty Organization (NATO). The 36-page document, which is dated Aug. 27, 2007, appears to be budget and equipment outlays for what was termed a new 'HQ ISAF JOINT CIS CONTROL CENTRE.' NATO's press office could not be immediately reached. Anonymous claimed on its 'AnonymousIRC' Twitter handle that it has 1GB of material from NATO but said that most would not be published because it would be 'irresponsible.'"

Read more of this story at Slashdot.
A Linux Distro From the US Department of Defense

Posted: July 22nd, 2011, 1:42am CEST by timothy

Tags: security

donadony writes "The Lightweight Portable Security distribution was created by the Software Protection Initiative under the direction of the Air Force Research Laboratory and the U.S. Department Of Defense. The idea behind it is that government workers can use a CD-ROM or USB stick to boot into a tamper proof, pristine desktop when using insecure computers such as those available in hotels or a worker's own home. The environment that it offers should be largely resistant to Internet-borne security threats such as viruses and spyware, particularly when launched from read-only media such as a CDROM. The LPS system does not mount the hard drive of the host machine, so leaves no trace of the user's activities behind."

Read more of this story at Slashdot.

Slashdot: Linux

A Linux Distro From the US Department of Defense

Posted: July 22nd, 2011, 1:42am CEST by timothy

Tags: security

donadony writes "The Lightweight Portable Security distribution was created by the Software Protection Initiative under the direction of the Air Force Research Laboratory and the U.S. Department Of Defense. The idea behind it is that government workers can use a CD-ROM or USB stick to boot into a tamper proof, pristine desktop when using insecure computers such as those available in hotels or a worker's own home. The environment that it offers should be largely resistant to Internet-borne security threats such as viruses and spyware, particularly when launched from read-only media such as a CDROM. The LPS system does not mount the hard drive of the host machine, so leaves no trace of the user's activities behind."

Read more of this story at Slashdot.

Slashdot: IT

Anonymous Hack One Gigabyte of Data From NATO

Posted: July 21st, 2011, 3:23pm CEST by CmdrTaco

Tags: security

GeekTech.in writes "The AnonymousIRC hacking organization have claimed this afternoon that they have hacked into NATO servers. As one of their tweets says: ' Yes, #NATO was breached. And we have lots of restricted material. With some simple injection. In the next days, wait for interesting data :) '"

Read more of this story at Slashdot.
FBI Executes Nationwide Raid of Anonymous Members

Posted: July 19th, 2011, 8:43pm CEST by Unknown Lamer

Tags: security

Nominei and suraj.sun write in with news about a nationwide raid of Anonymous members. CBS reports that raids occurred in California, New Jersey, Florida, and New York. At least 12 arrests were made with 15 warrants executed. Surely this has nothing at all to do with their recent infiltration of a certain company.

Read more of this story at Slashdot.
Anonymous To Release Sun, News of the World Emails

Posted: July 19th, 2011, 5:52pm CEST by samzenpus

Tags: security

siliconbits writes "After having hacked Rupert Murdoch's flagship news website, thesun.co.uk, and redirecting its readers to a spoof front page and pilfering its email servers, Anonymous' unofficial mouthpiece, Sabu, has revealed that the group is 'sitting on [the sun's & NOTW's] emails' with a press release from Anonymous & possibly more coming in a few hours. While that website has already been taken down, the email bounty is likely to be potentially more damaging with Sabu releasing details of two of the Sun's top three employees, Rebekah Wade and Bill Akass, the former editors of the Sun and News of the World respectively as well as Lee Wells & Danny Rogers, Editorial Support Manager at News International and Sun Online Editorial Manager respectively, as a taster of what's coming next."

Read more of this story at Slashdot.
NoScript Awarded $10,000

Posted: July 19th, 2011, 5:10pm CEST by CmdrTaco

Tags: security

An anonymous reader noted an interesting bit of information about a tool a ton of Slashdot users make use of every day: "NoScript has been chosen as the recipient of the DRG Security Innovation Grant. This is a great honor and a spur to keep making the Web a safer place. I feel the urge to thank the committee for recognizing NoScript as a pioneering force in browser security, and the community of contributors, researchers, translators, beta testers, and loyal users who keep this project alive day after day. The grant will fund the effort to merge the current two development lines, i.e. 'traditional' NoScript for desktop environment."

Read more of this story at Slashdot.
The Science of Password Selection

Posted: July 19th, 2011, 1:50am CEST by timothy

Tags: security

troyhunt writes "We all know by now that most people do a pretty poor job of choosing passwords, but what's behind the selection process? What's the inspiration for choosing those short, simple passwords that so often adhere to such predictable patterns? It turns out there's a handful of classic routes that people follow to consistently arrive at the same poor choices – and some of them are pretty shocking."

Read more of this story at Slashdot.
LulzSec Target the Sun After Phone Hacking Scandal

Posted: July 19th, 2011, 1:12am CEST by timothy

Tags: security

nk497 writes "LulzSec have come out of retirement to target Rupert Murdoch's News International, hacking the website of The Sun, redirecting it first to a spoofed page reporting his death and then to Lulz's Twitter feed. 'The Sun's homepage now redirects to the Murdoch death story on the recently-owned New Times website,' the hackers said via Twitter. 'Can you spell success, gentlemen?' The hackers also started to post email addresses and passwords they claimed were from Sun staff, and said to have accessed a mail server at now-defunct News of the World."

Read more of this story at Slashdot.
Security Consultants Warn About PROTECT-IP Act

Posted: July 18th, 2011, 5:33am CEST by samzenpus

Tags: security

epee1221 writes "Several security professionals released a paper raising objections to the DNS filtering(PDF) mandated by the proposed PROTECT-IP Act. The measure allows courts to require Internet service providers to redirect or block queries for a domain deemed to be infringing on IP laws. ISPs will not be able to improve DNS security using DNSSEC, a system for cryptographically signing DNS records to ensure their authenticity, as the sort of manipulation mandated by PROTECT-IP is the type of interference DNSSEC is meant to prevent. The paper notes that a DNS server which has been compromised by a cracker would be indistinguishable from one operating under a court order to alter its DNS responses. The measure also points to a possible fragmenting of the DNS system, effectively making domain names non-universal, and the DNS manipulation may lead to collateral damage (i.e. filtering an infringing domain may block access to non-infringing content). It is also pointed out that DNS filtering does not actually keep determined users from accessing content, as they can still access non-filtered DNS servers or directly enter the blocked site's IP address if it is known. A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server and that the Internet must not be allowed to 'decay into a lawless Wild West.' Paul Vixie, a coauthor of the paper, elaborates in his blog."

Read more of this story at Slashdot.
EU Considers Strict Data Breach Notification Rules

Posted: July 17th, 2011, 11:25am CEST by Soulskill

Tags: security

JohnBert writes "The European Commission is examining whether additional rules are needed on personal data breach notification in the European Union. Telecoms operators and Internet service providers hold a huge amount of data about their customers, including names, addresses and bank account details. The current ePrivacy Directive requires them to keep this data secure and notify individuals if such sensitive information is lost or stolen. Data breaches must also be reported to the relevant national authority. 'The duty to notify data breaches is an important part of the new E.U. telecoms rules,' said Commissioner Neelie Kroes. 'But we need consistency across the E.U. so businesses don't have to deal with a complicated range of different national schemes. I want to provide a level playing field, with certainty for consumers and practical solutions for businesses.'"

Read more of this story at Slashdot.
Vodafone Femtocells Rooted, Secret Keys Exposed

Posted: July 15th, 2011, 11:02am CEST by timothy

Tags: security

AmiMoJo writes "Hackers have discovered the root password for Vodafone femtocells, devices that provide the user with a mobile phone signal piggybacked onto their home broadband. The root password was 'newsys.' Once root access is obtained, phones can be forced to connect to the cell and private keys captured, allowing the user to spoof the victim's phone and potentially make calls or send texts on their account, not to mention eavesdrop."

Read more of this story at Slashdot.
Women Arrested For Refusing TSA Search of Children

Posted: July 14th, 2011, 1:17am CEST by samzenpus

Tags: security

CelticWhisper writes "A Tennessee mother was arrested for refusing to allow TSA screening clerks to subject her child to a body scan or patdown. This comes in the wake of a promise by the TSA Administrator to make repeated attempts at non-physical screening of children, after which another video of a child patdown surfaced. This event may signify a tipping point in the public's willingness to tolerate invasive and inappropriate security procedures at airports."

Read more of this story at Slashdot.
US Wants Drivers To Test Wireless Auto Safety Tech

Posted: July 13th, 2011, 8:39pm CEST by samzenpus

Tags: security

coondoggie writes "Can new wireless auto safety systems work in the real world and how will drivers respond? That's what the U.S. Department of Transportation hopes to find out in the next few months as it lets hundreds of drivers in six communities across the country test some of the latest communication devices in controlled situations."

Read more of this story at Slashdot.
Is the Military Prepared For Cyberwarfare?

Posted: July 13th, 2011, 8:19am CEST by Soulskill

Tags: security

pbahra writes "If you think that combating cyber criminals is hard in your organization, imagine doing it in an enterprise with some 18 or so layers of management between the top man (and it is always a man) and the most junior employee. Now imagine that in such an organization, there is a form for everything, that it can take literally decades to buy new equipment, and that you can be jailed for having dirty footwear. But that same organization is charged with helping to defeat shadowy hacker groups who are faster, have better equipment, almost certainly are better funded and don't have to salute every time someone senior walks past them. The modern military is used to operating in what is known as an asymmetric environment, with a distinct imbalance between the two opponents. The problem for the military is that they like to be the big guy. According to a senior officer speaking at the 2011 Annual Defense Lecture in London, when asked if the military was capable of operating at the same speed as their opponents, he admitted they were not."

Read more of this story at Slashdot.
Anonymous Releases 90,000 Military E-Mail Accounts

Posted: July 12th, 2011, 12:13am CEST by Soulskill

Tags: security

jjp9999 writes "Anonymous Operations posted 90,000 military email addresses and passwords to the Pirate Bay on July 11, in what they're calling 'Military Meltdown Monday.' They obtained the emails while hacking government contracting and consulting firm Booz Allen Hamilton. They hinted at other information obtained during the breach, which they describe as 'maps and keys for various other treasure chests buried on the islands of government agencies, federal contractors and shady whitehat companies.' The breach comes just days after Anonymous hacked government contractor IRC Federal. Both breaches are linked to the new AntiSec movement, which LulzSec joined forces with shortly before disbanding."

Read more of this story at Slashdot.
How Investigators Deciphered Stuxnet

Posted: July 11th, 2011, 11:31pm CEST by Soulskill

Tags: security

suraj.sun tips a story at Wired that takes an in-depth look into how security researchers tracked down and worked to understand the infamous Stuxnet worm. The article begins: "It was January 2010, and investigators with the International Atomic Energy Agency had just completed an inspection at the uranium enrichment plant outside Natanz in central Iran, when they realized that something was off within the cascade rooms where thousands of centrifuges were enriching uranium. But when the IAEA later reviewed footage from surveillance cameras installed outside the cascade rooms to monitor Iran's enrichment program, they were stunned as they counted the numbers. The workers had been replacing the units at an incredible rate — later estimates would indicate between 1,000 and 2,000 centrifuges were swapped out over a few months. The question was, why?"

Read more of this story at Slashdot.
DOJ: We Can Force You To Decrypt That Laptop

Posted: July 11th, 2011, 5:49pm CEST by samzenpus

Tags: security

betterunixthanunix writes "A mortgage-fraud case may have widespread implications for criminals who use cryptography to hide evidence. The US Department of Justice is pushing for the defendant to be forced to decrypt her hard drive, claiming that if they cannot force such decryptions, law enforcement will be unable to gather important evidence. The defendant's lawyer and the Electronic Frontier Foundation have made the claim that forcing such a decryption would be a violation of the defendant's fifth amendment right not to self-incriminate. The prosecutor in the case has insisted that the defendant would not be forced to disclose her passphrase, but only to enter the passphrase into a computer to decrypt the drive."

Read more of this story at Slashdot.
DHS Admits Knowledge of Infected Import Tech

Posted: July 8th, 2011, 10:50pm CEST by Soulskill

Tags: security

smitty777 writes "Deputy Undersecretary Schaffer of the DHS National Protection and Programs Directorate confessed to being aware of foreign technology that had been imported with spyware, malware, and other security risks. According to the article, 'More worryingly, the hearing specifically mentioned hardware components as possibly being compromised — which raises the questions of whether, perhaps, something as innocuous as Flash memory or embedded RFID chips could be used by interested foreign parties.' These hearings were held on July 7th to 'examine the nature and extent of the current threat to America's infrastructure.'"

Read more of this story at Slashdot.
Book Review: Surveillance Or Security?

Posted: July 8th, 2011, 8:48pm CEST by samzenpus

Tags: security

brothke writes "Surveillance or Security?: The Risks Posed by New Wiretapping Technologies is a hard book to categorize. It is not about security, but it deals extensively with it. It is not a law book, but legal topics are pervasive throughout. It is not a telecommunications book, but extensively details telco issues. Ultimately, the book is a most important overview of security and privacy and the nature of surveillance in current times." Read below for the rest of Ben's review.

Read more of this story at Slashdot.
Banks Faulted For Fake Antivirus Scourge

Posted: July 6th, 2011, 10:02pm CEST by samzenpus

Tags: security

krebsonsecurity writes "Merchant banks that process credit card payments for fake antivirus or 'scareware' exhibit a distinctive pattern of card processing that could be used by Visa and MasterCard to weed out the rogue processors, according to a new study by the University of California, Santa Barbara. From the study: 'The UCSB team found that the fake AV operations sought to maximize profits by altering their refunds according to the chargebacks reported against them, and by refunding just enough to remain below a payment processor's chargeback limits. Whenever the rate of chargebacks increased, the miscreants would begin issuing more refunds. When the rate of chargebacks subsided, the miscreants would again withhold refunds.' The study also highlights how few customers ever request a refund, and how affiliates pushing this junk software made more than $133 million."

Read more of this story at Slashdot.
Don't Fly If You Just Had Surgery!

Posted: July 6th, 2011, 6:53pm CEST by Unknown Lamer

Tags: security

mcgrew writes "The Chicago Tribune is reporting that the TSA is now worried about surgically implanted bombs. Are they trying to get everyone to stop flying entirely? I know there's no way they'd get me in an airliner these days. I'll drive, even though it is far, far more dangerous."

Read more of this story at Slashdot.
Ask Slashdot: Which Registrars Support DNSSEC?

Posted: July 4th, 2011, 9:18pm CEST by timothy

Tags: security

baerm writes "With GoDaddy being purchased by private equity firms (i.e. it will be sucked dry with service reduction and price increases until it dies) what other Registrars support DNSSEC? GoDaddy is the only registrar I could find that supports DNSSEC for registrees running their own DNS. It was fairly easy to add the Key Signing Keys' DS records to the parent zone using its DNS config. I did find a couple other registrars that were 'testing' DNSSEC or that would support DNSSEC if they ran your DNS. But I couldn't find any other registrars where you could just register, run your own DNS, and use DNSSEC (i.e. with your DS record in your parent zone). That being said, I was only able to research a small percentage of the registrars out there. Does anyone know of registrars, other than GoDaddy, that allow for DNSSEC? That is, registrars that have a method to pass the DS records to the parent zones for their registeree's domains?"

Read more of this story at Slashdot.
Anonymous Launches a WikiLeaks For Hackers

Posted: July 3rd, 2011, 11:23am CEST by Soulskill

Tags: security

siliconbits writes "Despite countless WikiLeaks copycats popping up since the secret-spilling site first dumped its cache of State Department cables last year, the new generation of leaking sites has produced few WikiLeaks-sized scoops. So instead of waiting for insider whistleblowers, the hacker movement Anonymous hopes that a few outside intruders might start the leaks flowing."

Read more of this story at Slashdot.
Time To Close the Security Theater

Posted: July 1st, 2011, 4:53pm CEST by Soulskill

Tags: security

An anonymous reader writes "An editorial at Forbes calls for the dismantling of the TSA, pointing to recent headlines as the latest examples of 'security theater' at its worst. From the article: 'The problem isn't that the TSA is harassing the wrong people. The problem is that the TSA is harassing anyone. The TSA is encroaching on fundamental liberties and providing no discernable benefit. ... Naturally, the TSA responds to incidents like these by saying that the agents are highly trained and that they have followed proper procedure. This indicates a signal failing for the agency: if "doing it by the book" involves touching people in ways that would be considered sexual assault in virtually any other context or telling a 90-year old breast cancer survivor to remove her bra lest it contain explosives (as happened to a friend's grandmother), then the book needs to be shredded and rewritten. Better yet, it needs to be replaced with a competitive market for air travel in which the airports, the airways, and the airliners are in private hands. Some might object that private firms will have incentives to cut corners on safety. It is a legitimate concern, but competitive mechanisms tend to weed this out.'"

Read more of this story at Slashdot.
Microsoft Says Reinstall Overkill In Removing Rootkit

Posted: June 30th, 2011, 11:31pm CEST by timothy

Tags: security

CWmike writes "Microsoft has clarified the advice it gave users whose Windows PCs are infected with a new, sophisticated rootkit dubbed Popereb that buries itself on the hard drive's boot sector, noting Wednesday that a complete OS reinstall is not necessary. 'If your system is infected with Trojan:Win32/Popureb.E, we advise fixing the MBR using the Windows Recovery Console to return the MBR to a clean state,' MMPC engineer Chun Feng wrote in an updated blog entry. Feng provided links to instructions on how to use the Recovery Console for Windows XP, Vista and Windows 7. Once the MBR has been scrubbed, users can run antivirus software to scan the PC for additional malware for removal, Feng added. Several security researchers agreed with Microsoft's revisions, but a noted botnet expert doubted that the advice guaranteed a clean PC. But an internationally-known botnet expert disagrees. Joe Stewart, director of malware research at Dell SecureWorks, said, 'Once you're infected, the best advice is to [reinstall] Windows and start over ... [MBR rootkits] download any number of other malware. How much of that are you going to catch? This puts the user in a tough position.' MBR rootkit malware is among the most advanced of all threats."

Read more of this story at Slashdot.
Early UNIX Contributor Robert Morris Dead at 78

Posted: June 30th, 2011, 10:07pm CEST by timothy

Tags: security

dtmos writes "Robert Morris, a major contributor to the Unix password and security features while at Bell Labs, has passed at the age of 78. His interesting life was made even more interesting by his son, Robert Tappan Morris, who invented the computer worm."

Read more of this story at Slashdot.
Spamming Becoming Financially Infeasible

Posted: June 30th, 2011, 6:18pm CEST by samzenpus

Tags: security

itwbennett writes "Making money in spam isn't as easy as it used to be. 'It's not something financially feasible for anyone to even consider,' said Robert Soloway, who in his heyday made $20,000/day as a spammer. 'Spam — the Internet's original sin — dropped for the first time ever at the end of 2010,' writes IDG News Service's Robert McMillan. 'In September, Cisco System's IronPort group was tracking 300 billion spam messages per day. By April, the volume had shrunk to 34 billion per day, a remarkable decline.' Soloway says spam filters have become too good."

Read more of this story at Slashdot.
Los Alamos Fire Idles NSA Supercomputer

Posted: June 30th, 2011, 2:52pm CEST by CmdrTaco

Tags: security

ygslash writes "Among the many facilities shut down since Monday at Los Alamos National Laboratory due to the approaching wildfire is Cielo, one of the most powerful supercomputers in the world. The National Nuclear Security Administration's three national laboratories - Los Alamos, Sandia, and Lawrence Livermore - all share computing time on Cielo, according to Associated Press." Update: 06/30 14:48 GMT by S : As readers have pointed out, this article refers to the National Nuclear Security Administration, not the National Security Agency. Summary updated to reflect that.

Read more of this story at Slashdot.
Groupon Deal of the Day: 300,000 Customer Accounts

Posted: June 29th, 2011, 7:11pm CEST by samzenpus

Tags: security

itwbennett writes "The customer database of Groupon's Indian subsidiary was published, unsecured and unencrypted, on the company's site for long enough to indexed by Google. Australian security consultant Daniel Grzelak, Tweeted the news and also notified Groupon, which 'was amazing at providing a swift and full response,' Grzelak said on Twitter. 'They deserve credit for their reaction.'"

Read more of this story at Slashdot.
Yet Another "People Plug In Strange USB Sticks" Story

Posted: June 29th, 2011, 5:27pm CEST by CmdrTaco

Tags: security

Bruce Schneier's blog has a bit about a subject that gets my blood boiling too. He says "I'm really getting tired of stories like this: Computer disks and USB sticks were dropped in parking lots of government buildings and private contractors, and 60% of the people who picked them up plugged the devices into office computers... People get USB sticks all the time. The problem isn't that people are idiots... The problem is that the OS trusts random USB sticks."

Read more of this story at Slashdot.
7 Hackers Who Got Legit Jobs From Their Misdeeds

Posted: June 29th, 2011, 4:05pm CEST by CmdrTaco

Tags: security

adeelarshad82 writes "Just like in Stephen Glass' fabricated feature where a lonely teenage hacker gets hired by a major software company, the 21 year old PlayStation 3 hacker, George "Geohot" Hotz, was offered a job at Facebook. Ironically Hotz wasn't the first school-aged hacker to be rewarded for his cyber-crime rather than a prison sentence. Turns out there are others who have managed (with one exception) to avoid jail time, and instead found themselves gainfully employed by some of Silicon Valley's most exclusive circles."

Read more of this story at Slashdot.
The Lesson of Recent Hacktivism

Posted: June 29th, 2011, 6:18am CEST by Soulskill

Tags: security

itwbennett writes "LulzSec says they're retired, which may or may not be true. But one thing the world has learned from their 'frightening yet funny escapades is that 'the state of online security stinks,' writes blogger Tom Henderson. LulzSec (and Anonymous) have 'demonstrated that an awful lot of people are either asleep at the switch or believed in arcane security methods like security through obscurity.'" A related story at the Guardian suggests that governmental attempts to control the internet are spurring these activities.

Read more of this story at Slashdot.
Cancer Cluster Possibly Found Among TSA Workers

Posted: June 27th, 2011, 10:18pm CEST by Soulskill

Tags: security

OverTheGeicoE writes "TSA employees at Logan International Airport believe they have identified a cancer cluster in their ranks, according to documents obtained under the Freedom of Information Act and released by the Electronic Privacy Information Center. They have requested dosimetry to counter 'TSA's improperly non-monitored radiation threat.' So far, at least, they have not received it. The documents also reveal a paper from Johns Hopkins that essentially questions whether it is even safe to stand near an operating scanner, let alone inside one. Also, the National Institute of Standards and Technology says that the Dept. of Homeland Security 'mischaracterized' their work by telling USA Today that NIST affirmed the safety of the scanners when in fact NIST does not do product safety testing and never tested a scanner for safety."

Read more of this story at Slashdot.
LulzSec Announces That It Is Done

Posted: June 26th, 2011, 2:01am CEST by timothy

Tags: security

MaxBooger writes "LulzSec, the notorious hacker group that's been on a rampage, just announced that it's disbanding. This follows 50 days' chaos during which time it took down several websites (including CIA.gov at one point), exposed passwords, exposed documents of the Arizona penal system, and at one point threatened to hit Too Big To Fail banks. Obviously, it's possible that the group will not abide by its promise to quit. Nobody knows."

Read more of this story at Slashdot.
Trust Is For Suckers: Lessons From the RSA Breach

Posted: June 24th, 2011, 9:01pm CEST by Soulskill

Tags: security

wiredmikey writes "Andrew Jaquith has written a great analysis of lessons learned from the recent RSA Cyber Attack, from a customer's perspective. According to Jaquith, in the security industry, 'trust' is a somewhat slippery concept, defined in terms ranging from the cryptographic to the contractual. Bob Blakley, a Gartner analyst and former chief scientist of Tivoli, once infamously wrote that 'Trust is for Suckers.' What he meant is that trust is an emotional thing, a fragile bond whose value transcends prime number multiplication, tokens, drug tests or signatures — and that it is foolish to rely too much on it. Jaquith observed three things about the RSA incident: (1) even the most trusted technologies fail; (2) the incident illustrates what 'risk management' is all about; and (3) customers should always come first."

Read more of this story at Slashdot.
BioWare's Neverwinter Nights Forum Server Hacked

Posted: June 24th, 2011, 5:17pm CEST by Soulskill

Tags: security

garatheus writes "The folks at EA/BioWare sent out an email this morning (GMT +2) outlining that their older Neverwinter Nights forums had been hacked, with a fair amount of user information stolen from the database — the likes of user names, encrypted passwords, email addresses, mailing addresses, names, phone numbers, CD keys and birth dates. They do go on to say that 'no credit card data was compromised from the servers, nor did we ever have or store sensitive data like social security numbers.' There's no pointing of fingers as to who might have done the compromising, though."

Read more of this story at Slashdot.
StartSSL Suspends Services After Security Breach

Posted: June 23rd, 2011, 8:21pm CEST by timothy

Tags: security

An anonymous reader writes "StartSSL has suspended issuance of digital certificates and related services following a security breach on 15 June. A trademark of Eddy Nigg's StartCom, the StartSSL certificate authority is well known for offering free domain validated SSL certificates, but also sells organisation and extended validation certificates."

Read more of this story at Slashdot.
Fired IT Worker Replaces CEO's Presentation With Porn

Posted: June 22nd, 2011, 11:39pm CEST by samzenpus

Tags: security

An anonymous reader writes "52-year-old Walter Powell wanted revenge when he was fired from his position as an IT manager at Baltimore Substance Abuse System Inc. So, he hacked into their systems — installing keyloggers to steal passwords. Then, when his CEO was giving a presentation to the board of directors he replaced the slides with pornographic images. Powell has now been given a 2 year suspended sentence, and 100 hours community service."

Read more of this story at Slashdot.
WordPress.org Hacked, Plugin Repository Compromised

Posted: June 22nd, 2011, 3:19pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "Back in April hackers gained access to the WordPress.com servers and exposed passwords/API keys for Twitter and Facebook accounts. Now, hackers gained access to Wordpress.org and the plugin repository. Malicious code was found in several commits including popular plugins such as AddThis, WPtouch, or W3 Total Cache. Matt Mullenweg decided to force-reset all passwords on WordPress.org. This is a great reminder for all users not use the same password for two different services."

Read more of this story at Slashdot.
Authorities Closing On LulzSec

Posted: June 22nd, 2011, 2:45pm CEST by CmdrTaco

Tags: security

mask.of.sanity writes "The noose is tightening on hacker group LulzSec, according to a coordinated group of like-minded users, some from LulzSec-Exposed that claim to have uncovered the identity of LulzSec members and supplied them to the FBI. An arrest Monday of a UK teenager was rumoured to be former hacker scene member Ryan Clearly, and the trackers, which includes a former FBI agent, say this arrest is the first of many. They refused to disclose the identities of LulzSec chief, saying it would cause the members to burn the evidence of attacks and scatter."

Read more of this story at Slashdot.
Paying Hacker Extortion

Posted: June 21st, 2011, 10:38pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "A friend works as CIO at a medium sized publicly traded company. The company was contacted by a hacking group and told to pay $100,000 to prevent their company from being hacked/attacked. They actually paid the extortion (told authorities after). The authorities said the company could be charged with supporting Terrorists. Seeing that most publicly known hacks are costing companies this size nearly a million dollars, Is this supporting terrorists or supporting stockholders?"

Read more of this story at Slashdot.
Paying Hacker Extortion

Posted: June 21st, 2011, 10:38pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "A friend works as CIO at a medium sized publicly traded company. The company was contacted by a hacking group and told to pay $100,000 to prevent their company from being hacked/attacked. They actually paid the extortion (told authorities after). The authorities said the company could be charged with supporting Terrorists. Seeing that most publicly known hacks are costing companies this size nearly a million dollars, Is this supporting terrorists or supporting stockholders?"

Read more of this story at Slashdot.
LulzSec Debunks UK Census Hack

Posted: June 21st, 2011, 6:02pm CEST by CmdrTaco

Tags: security

Earlier this morning we reported that an arrest had been made relating to the hacker group LulzSec. mask.of.sanity notes "Hacking group LulzSec has poured cloud water on claims that it had stolen UK Census data and was preparing to release the records. 'Just saw the pastebin of the UK census hack. That wasn't us — don't believe fake LulzSec releases unless we put out a tweet first,' the group said from its official Twitter account."

Read more of this story at Slashdot.
LulzSec Suspect Arrested By UK Police

Posted: June 21st, 2011, 2:43pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "The UK's Police Computer e-Crime Unit (PCeU) has arrested a 19-year-old man in Wickford, Essex, in connection with the series of LulzSec attacks against organizations including the CIA, PBS and Sony. The man, who has been arrested under the Computer Misuse and Fraud Act, has had his house searched and a significant amount of material taken away by police for forensic examination. The PCeU worked with local Essex police and the FBI on the investigation."

Read more of this story at Slashdot.
13-Year-Old Password Security Bug Fixed

Posted: June 21st, 2011, 1:48am CEST by timothy

Tags: security

arglebargle_xiv writes "In a sign that many eyes don't really make (security) bugs shallow, a thirteen-year-old password-hashing bug that affects (at least) PHP, some Linux distros (Owl, ALT Linux, SUSE), and a variety of other apps has just been patched. This problem had been present in widely-used code since 1998 without anyone noticing it." Better late than never; reader Trailrunner7 points to this article outlining the dangers of old exploits, given old code for them to toy with.

Read more of this story at Slashdot.

Slashdot: Linux

13-Year-Old Password Security Bug Fixed

Posted: June 21st, 2011, 1:48am CEST by timothy

Tags: security

arglebargle_xiv writes "In a sign that many eyes don't really make (security) bugs shallow, a thirteen-year-old password-hashing bug that affects (at least) PHP, some Linux distros (Owl, ALT Linux, SUSE), and a variety of other apps has just been patched. This problem had been present in widely-used code since 1998 without anyone noticing it." Better late than never; reader Trailrunner7 points to this article outlining the dangers of old exploits, given old code for them to toy with.

Read more of this story at Slashdot.

Slashdot: IT

LulzSec Teams With Anonymous, In Operation AntiSec

Posted: June 20th, 2011, 4:15pm CEST by CmdrTaco

Tags: security

c0lo writes "After a brief spat where the notorious Anonymous hacking collective sniped at Lulzsec, the 'upstart' hacking collective, for crowing about low-rent Denial of Service attacks on the CIA and 4chan websites, the two groups have apparently teamed up in operation Anti-Sec. The operation's 'top priority is to steal and leak any classified government information, including email spools and documentation. Prime targets are banks and other high-ranking establishments. If they try to censor our progress, we will obliterate the censor with cannonfire anointed with lizard blood.' We can only predict that the following will be unpredictable: store canned food and flash batteries, change your eBanking password daily."

Read more of this story at Slashdot.
LulzSec Offers to Take Revenge On Sega Hackers

Posted: June 19th, 2011, 11:25pm CEST by samzenpus

Tags: security

An anonymous reader writes "Sega Corp joins the ranks of video game companies to be hacked in recent time with one small twist, it seems LulzSec was not behind this one. They reached to Sega's official twitter account and offered to destroy the hackers that attacked them. From the article: 'In its offer to assist Sega, the Tweet from Lulz hinted that its leaders might count themselves among a small but highly loyal group of gamers who still play on the aging Dreamcast console. "Sega - contact us," Lulz said in its Tweet to the video game developer. "We want to help you destroy the hackers that attacked you. We love the Dreamcast, these people are going down."'"

Read more of this story at Slashdot.
After 7 Years, MyDoom Worm Is Still Spreading

Posted: June 18th, 2011, 1:18pm CEST by timothy

Tags: security

An anonymous reader writes "Researchers at Sophos have revealed that the MyDoom worm, which spread via email and launched denial-of-service attacks against websites belonging to SCO and Microsoft, is still spreading on the internet after more than seven years in existence. The firm suggests, tongue-in-cheek, that it would be nice if computer users updated their anti-virus software at least once every 5 years to combat the malware threat."

Read more of this story at Slashdot.
What LulzSec Logins Reveal About Bookworms, and Passwords

Posted: June 16th, 2011, 10:09pm CEST by timothy

Tags: security

Barence writes "Today the hacking group LulzSec posted 62,000 hacked email usernames and passwords online. PC Pro's Darien Graham-Smith has analysed the passwords stolen — which are believed to have come from a website for writers — and found some interesting patterns. Aside from 'password' and obvious numerical patterns (i.e. '12345') the most common passwords share a literary theme: 'romance,' 'mystery,' 'shadow' and 'bookworm' are all commonly used passwords. 'Clearly, this is a back-of-an-envelope breakdown of a mixed mass of unverified data,' said Graham-Smith. 'But it gives an interesting insight into the way people choose their passwords: in this case, apparently, on a theme that reflects the nature of the site they're visiting.'"

Read more of this story at Slashdot.
ADP Experiences Security Breach

Posted: June 16th, 2011, 2:08pm CEST by samzenpus

Tags: security

wiredmikey writes "HR and Payroll outsourcing giant Automatic Data Processing, Inc. (ADP) experienced a system intrusion, the company announced Wednesday. ADP said it was investigating and taking measures to address the impact of a system intrusion that occurred with a client at Workscape, a benefits administration provider that ADP acquired in August 2010. ADP has also been actively cooperating with law enforcement to determine the cause of this incident and to assist authorities in identifying and apprehending those responsible. ADP added the following in a statement: 'Because this incident is the subject of an ongoing law enforcement investigation, ADP cannot disclose any additional details at this time. ADP will provide further updates once information that can be made public becomes available, and we will continue to communicate with all affected parties as appropriate.'"

Read more of this story at Slashdot.
Adobe Patches Second Flash Zero-Day In 9 Days

Posted: June 16th, 2011, 1:58am CEST by samzenpus

Tags: security

CWmike writes "For the second time in nine days, Adobe has patched a critical vulnerability in Flash Player that hackers were already exploiting, Computerworld's Gregg Keizer reports. Adobe also updated Reader to quash 13 new bugs and several older ones the company had not gotten around to fixing. The memory corruption vulnerability in Flash Player could 'potentially allow an attacker to take control of the affected system,' Adobe said in an accompanying advisory. 'There are reports that this vulnerability is being exploited in the wild in targeted attacks via malicious Web pages.' Adobe last issued an 'out-of-band' emergency update on June 5, when it fixed a critical flaw that attackers were exploiting to steal Gmail login credentials. Those attacks were different from the ones Google disclosed the week before, when it accused Chinese hackers of targeting specific individuals, including senior U.S. and South Korean government officials, anti-Chinese government activists and journalists. Google, which bundles Flash Player with Chrome, also updated its browser Tuesday to include the just-patched version of Flash."

Read more of this story at Slashdot.
LulzSec Phone-Bombs FBI and Blizzard

Posted: June 15th, 2011, 11:42pm CEST by samzenpus

Tags: security

Revotron writes "Anonymous hacker group LulzSec has begun to harness the power of the crowd in their latest griefing attempts. After a day of numerous DDoS attacks on a handful of famous MMOs, LulzSec's phone lines lit up with an estimated 20 calls per second. Using a fairly simple phone redirect, they sent all of their incoming calls to various offices, among them the FBI office in Detroit, Blizzard Customer Support, online retailer Magnets.com, and most recently, the corporate offices of HBGary." Update: It looks like they also brought down the CIA website tonight, but it is up now.

Read more of this story at Slashdot.
Is This the Golden Age of Hacking?

Posted: June 15th, 2011, 4:12pm CEST by samzenpus

Tags: security

Barence writes "With a seemingly continuous wave of attacks hitting the public and commercial sectors, there has never been a more prodigious period for hackers, argues PC Pro. What has led to the sudden hacking boom? Ease of access to tools has also led to an explosion in the numbers of people actively looking for companies with weakened defenses, according to security experts. Meanwhile, the recession has left thousands of highly skilled IT staff out of work and desperate for money, while simultaneously crimping companies' IT security budgets. The pressure to get systems up and running as quickly as possible also means that networks aren't locked down as tightly as they should be, which can leave back doors open for hackers."

Read more of this story at Slashdot.
Phishers Hone Skills, Craft More Impressive Attacks

Posted: June 15th, 2011, 6:11am CEST by Soulskill

Tags: security

CWmike writes "Recent break-ins at high-profile targets like the International Monetary Fund demonstrate just how proficient hackers have become at so-called spear phishing, researchers said on Tuesday. 'Today's spear phishing is not only more prevalent but also much more technically proficient,' said Dave Jevans, chairman of the Anti-Phishing Working Group. 'They're not going for a password, anymore; they're getting people to install crimeware on their computers.' The trend highlights the need for defenses against such targeted threats, requiring companies to look beyond security strategies focused purely on dealing with traditional network threats, analysts said. Increasingly, companies also need to focus on approaches such as continuous monitoring of networks, databases, applications and users, outbound traffic filtering and whitelisting."

Read more of this story at Slashdot.
How Citigroup Hackers Easily Gained Access

Posted: June 14th, 2011, 11:54pm CEST by CmdrTaco

Tags: security

Endoflow2010 writes "Hackers who stole the personal details of more than 200,000 Citigroup customers 'broke in through the front door' using an extremely simple technique. It has been called 'one of the most brazen bank hacking attacks' in recent years. And for the first time it has been revealed how the sophisticated cyber criminals made off with the staggering bounty of names, account numbers, email addresses and transaction histories. They simply logged on to the part of the group's site reserved for credit card customers and substituted their account numbers — which appeared in the browser's address bar — with other numbers. It allowed them to leapfrog into the accounts of other customers, with an automatic computer program letting them repeat the trick tens of thousands of times."

Read more of this story at Slashdot.
Metasploit Launches Exploit Bounty Program

Posted: June 14th, 2011, 7:55pm CEST by Soulskill

Tags: security

Trailrunner7 writes "The team behind the Metasploit Project is launching its own version of a bug bounty program: cash payouts for working exploits. The group is hoping to get exploit code for as many of its top 30 vulnerabilities as possible before the program expires later this summer. The amount of money paid for a working exploit module for Metasploit depends on the value of the vulnerability. A module for one of the vulnerabilities in the top five list — which includes a flaw in Google Chrome and another in the Windows DNS client — is worth $500. Modules for vulnerabilities in the separate top 25 list are worth $100 each under the rules."

Read more of this story at Slashdot.
Hackers Expose 26,000 Sex Website Passwords

Posted: June 13th, 2011, 11:20am CEST by samzenpus

Tags: security

An anonymous reader writes "Passwords and email addresses of almost 26,000 members of adult website Pron.com have been released on the internet by the notorious hacking group LulzSec. To add to the victims' humiliation, LulzSec called on its followers to try the email/password combinations against Facebook, and tell friends and family of the users that they were subscribers to a pornographic website. In addition LulzSec released passwords belonging to the administrators of dozens of other adult websites, and highlighted military and government email addresses that had signed up for the xxx-rated services."

Read more of this story at Slashdot.
Comcast Offering Home Security Bundle

Posted: June 12th, 2011, 11:32pm CEST by samzenpus

Tags: security

vaporland writes "Bloomberg reports that media giant Comcast has begun offering home security bundles with cable or phone service in selected markets. From the article: 'The Philadelphia-based company is starting Xfinity Home Security in seven markets for $39.95 a month. It lets users remotely adjust lights and thermostats, watch cameras, and get e-mail or text alerts when doors and windows are opened and closed. Customers can watch live video of their homes on an Xfinity website or with an Apple Inc. iPad application.'"

Read more of this story at Slashdot.
Codemasters' Website Hacked

Posted: June 11th, 2011, 9:12am CEST by Soulskill

Tags: security

skybon writes "After similar attacks on Sony and Square Enix, Codemasters' website has now been hacked as well. The intrusion took place on 3 June, and is believed to have compromised members' names, usernames, screen names, email addresses, date of birth, encrypted passwords, newsletter preferences, any biographies entered by users, details of last site activity, IP addresses and Xbox Live Gamertags. In a letter sent out to CodeM subscribers, the company recommended changing passwords as soon as possible."

Read more of this story at Slashdot.
Siemens Fixes SCADA Flaws

Posted: June 11th, 2011, 6:06am CEST by Soulskill

Tags: security

itwbennett writes "Siemens has fixed a pair of bugs in its S7-1200 controller, which is used to control machines on factory floors, power stations and chemical plants. The bugs were discovered earlier this year by NSS researcher Dillon Beresford, who planned to disclose the bugs at Black Hat in August. The US Department of Homeland Security said that Siemens' patches fix 'a portion' of the problems Beresford has discovered and that it 'continues to work with Siemens and Mr. Beresford on the other reported problems.'"

Read more of this story at Slashdot.
What Cybercrime Stats Have In Common With Sexual Braggadocio

Posted: June 9th, 2011, 9:41pm CEST by timothy

Tags: security

An anonymous reader writes "Microsoft researchers have rubbished figures from cybercrime surveys, deeming them subject to the types of distortions that have long bedeviled sex surveys. All it takes is a few self-styled Don Juans to hopelessly distort the sex-survey figures. Similarly, cybercrime surveys tend to get dominated by a minority of responses, normally those who have or think they have lost a great deal as a result of hacking or malware attack, and are vocal about it. 'Cybercrime surveys are so compromised and biased that no faith whatever can be placed in their findings,' the researchers write."

Read more of this story at Slashdot.
Citi Bank Reveals Attack... One Month Late

Posted: June 9th, 2011, 4:43pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "Is account security a thing of the past? Quote: 'We're talking a fairly serious hack, too. The personal and account information of some 200,000 Citibank card holders in North America was breached, reports Reuters, including contact specifics like names and email addresses. The solitary bit of good news? Citibank claims far more sensitive info like social security numbers, birth dates, card expiry dates and CVV card security codes was not compromised.'"

Read more of this story at Slashdot.
Court Rules Passwords+Secret Questions=Secure eBanking

Posted: June 9th, 2011, 2:42am CEST by samzenpus

Tags: security

An anonymous reader writes "A closely-watched court battle over how far commercial banks need to go to protect their customers from cyber theft is nearing an end. Experts said the decision recommended by a magistrate last week — if adopted by a US district court in Maine — will make it more difficult for other victim businesses to challenge the effectiveness of security measures employed by their banks. This case would be the first to add legal precedent to banking industry guidelines about what constitutes 'reasonable' security. The tentative decision is that a series of passwords + some device fingerprinting is enough to meet the definition of 'something you know' + 'something you have.' The case has generated enormous discussion over whether the industry's 'recommended' practices are anywhere near relevant to today's attacks, in which crooks usually have complete control over the victim's PC."

Read more of this story at Slashdot.
Most Vulns Exploited By Stuxnet Worm Remain Unpatched

Posted: June 8th, 2011, 6:29pm CEST by timothy

Tags: security

chicksdaddy writes with this excerpt from ThreatPost: "The media storm over the Stuxnet worm may have passed, but many of the software holes that were used by the worm remain unpatched and leave Siemens customers open to a wide range of potentially damaging cyber attacks, according to industrial control system expert Ralph Langner. Writing on his personal blog, Langner said that critical vulnerabilities remain in Windows-based management applications and software used to directly manage industrial controllers by Siemens Inc., whose products were targeted by the Stuxnet worm, Threatpost reports."

Read more of this story at Slashdot.
Security Service Accidentally Makes Websites 60% Faster

Posted: June 8th, 2011, 6:25am CEST by Soulskill

Tags: security

EastDakota writes "CloudFlare was originally conceived by the team behind the open source community. Project Honey Pot as an easy way to protect any website from hackers and spammers. The concern from the beginning was that it would add latency. It was quite a surprise when the free service launched 8 months ago and ended up speeding up websites by 60%."

Read more of this story at Slashdot.
Siemens SCADA Flaws To Be Disclosed At Black Hat

Posted: June 7th, 2011, 2:11pm CEST by timothy

Tags: security

itwbennett writes "In May, NSS Labs Researcher Dillon Beresford pulled out of a Dallas hacking conference at the last minute when Siemens was unable to fix problems he'd found in the firmware of its S7 programmable logic controller. Now NSS Labs CEO Rick Moy says Beresford is rescheduled to deliver his talk at Black Hat, which runs Aug. 2-3. Beresford has discovered six vulnerabilities in the S7 that 'allow an attacker to have complete control of the device,' Moy said. Devices like the S7 do things such as control how fast a turbine spins or open gates on dams."

Read more of this story at Slashdot.
Has iTunes Been Hacked?

Posted: June 7th, 2011, 4:24am CEST by Soulskill

Tags: security

An anonymous reader writes "Betanews has a series of articles talking about an apparent hack in iTunes that has resulted in fraudulent charges for some users involving Sega's Kingdom Conquest game. The reports start with a personal account from reporter Ed Oswald, who was a victim of the hack itself. The next story adds reports from readers, and the most recent story adds additional reports, with Oswald saying the number of reports received are in the 'dozens.' Apple has yet to confirm the existence of a hack, although reports have appeared on Sega's own support forums, Apple discussion boards, and through other news outlets."

Read more of this story at Slashdot.
Daily Sony Hacking Occurs On Schedule

Posted: June 6th, 2011, 10:57pm CEST by Soulskill

Tags: security

jjp9999 writes "LulzSec was compromised and a member of the group, Robert Cavanaugh, was arrested by the FBI on June 6. Meanwhile, LulzSec hacked Sony again, this time leaking the Sony Developer Network source code through file sharing websites."

Read more of this story at Slashdot.
A Brief Sony Password Analysis

Posted: June 6th, 2011, 3:30pm CEST by CmdrTaco

Tags: security

troyhunt writes "With all this [Sony] customer data now unfortunately out there for public viewing, I thought it would be interesting to do some analysis on password practices. There are some rather alarming (although not entirely surprising) findings including: 36% of passwords appear in a common password dictionary. 50% of passwords are 7 characters or less. 67% of accounts on both Sony and Gawker use the same password. 82% of passwords are lowercase alphanumeric of 9 characters or less. 99% of passwords don't contain a single non-alphanumeric character."

Read more of this story at Slashdot.
Cheap GPUs Rendering Strong Passwords Useless

Posted: June 5th, 2011, 10:50pm CEST by timothy

Tags: security

StrongGlad writes with a story at ZDNet describing how it's getting easier to use GPU processing against passwords once considered quite strong. "Take a cheap GPU (like the Radeon HD 5770) and the free GPU-powered password busting tool called 'ighashgpu' and you have yourself a lean, mean password busting machine. How lean and mean? Working against NTLM login passwords, a password of 'fjR8n' can be broken on the CPU in 24 seconds, at a rate of 9.8 million password guesses per second. On the GPU, it takes less than a second at a rate of 3.3 billion passwords per second. Increase the password to 6 characters (pYDbL6), and the CPU takes 1 hour 30 minutes versus only four seconds on the GPU. Go further to 7 characters (fh0GH5h), and the CPU would grind along for 4 days, versus a frankly worrying 17 minutes 30 seconds for the GPU."

Read more of this story at Slashdot.
New MacDefender Defeats Apple Security Update

Posted: June 1st, 2011, 10:41pm CEST by samzenpus

Tags: security

XxtraLarGe writes "Apple released a security update yesterday designed to rid Macs of the menacing MacDefender malware that has plagued users for nearly a month. But mere hours after the update, cyber-criminals released a new variant of the malware that easily defeated Apple's belated security efforts. That didn't take long."

Read more of this story at Slashdot.
NATO Report Threatens To 'Persecute' Anonymous

Posted: June 1st, 2011, 7:17pm CEST by Roblimo

Tags: security

Stoobalou writes "NATO leaders have been warned that Wikileaks-loving 'hacktivist' collective Anonymous could pose a threat to member states' security, following recent attacks on the US Chamber of Commerce and defence contractor HBGary — and promise to 'persecute' its members." From the article: "In a toughly-worded draft report to the NATO Parliamentary Assembly, General Rapporteur Lord Jopling claims that the loose-knit, leaderless group is 'becoming more and more sophisticated,' and 'could potentially hack into sensitive government, military, and corporate files.'"

Read more of this story at Slashdot.
PBS Web Sites and Databases Hacked

Posted: May 31st, 2011, 1:43am CEST by samzenpus

Tags: security

wiredmikey writes "Late Sunday night, hackers gained access to several areas of PBS Web servers and were able publish a fake news story on a PBS news blog. The group also published PBS internal user login information that they were able to siphon out of PBS databases. The fake story was about rapper Tupac Shakur, who died in 1996 after being shot in Las Vegas, being been found alive and well in a small resort in New Zealand. A group going by the name of 'LulzSec' claimed responsibility for the hack, saying the attack was a protest against a PBS Frontline broadcast last week about WikiLeaks."

Read more of this story at Slashdot.
Duplicate RSA Keys Enable Lockheed Martin Network Intrusion

Posted: May 28th, 2011, 10:49pm CEST by timothy

Tags: security

An anonymous reader writes "Unknown hackers have broken into the security networks of Lockheed Martin Corp and several other US military contractors, a source with direct knowledge of the attacks told Reuters. They breached security systems designed to keep out intruders by creating duplicates to 'SecurID' electronic keys from EMC Corp's RSA security division, said the person who was not authorized to publicly discuss the matter." There's also coverage at PC Magazine.

Read more of this story at Slashdot.
8000 Credit Cards' Details Compromised In Australian Bank Breach

Posted: May 28th, 2011, 9:30am CEST by timothy

Tags: security

mask.of.sanity writes "Australia's largest bank, the Commonwealth Bank, has cancelled 8,000 credit cards after it detected a data breach at a merchant. Mastercard and Visa may issue penalties including fines to the acquiring bank under the payment industry's PCI-DSS compliance rules. News of breaches is uncommon in Australia because the nation does not have data breach disclosure laws."

Read more of this story at Slashdot.
Sony Hackings Could Happen To Any Big Business

Posted: May 27th, 2011, 6:26pm CEST by Roblimo

Tags: security

tdog17 writes "People may joke about Sony's porous security, but something as nasty as the Sony attacks could happen to virtually any big corporation. Be smart and learn."

Read more of this story at Slashdot.
Mac Malware Evolves - No Install Password Required

Posted: May 26th, 2011, 5:00pm CEST by samzenpus

Tags: security

An anonymous reader writes "The latest versions of the Mac Defender malware attacks no longer require users to enter their admin credentials (username and password) upon install. A threat called 'Mac Guard' installs itself into areas of the Mac OS X system that only require standard user privilege. On Windows the criminals did this to avoid UAC warnings, and have copied this trick to their Mac OS X releases."

Read more of this story at Slashdot.
Apple's iOS 4 Hardware Encryption Cracked

Posted: May 25th, 2011, 11:21pm CEST by samzenpus

Tags: security

adeelarshad82 writes "Russian company ElcomSoft is claiming to have cracked the 256-bit hardware encryption Apple uses to protect the data on iOS 4 devices, and is offering software that allows anyone to do it. ElcomSoft can now gain full access to what is stored on a gadget such as the iPhone 4. This includes historical information such as geolocation data, browsing history, call history, text messages and emails, usernames, and passwords."

Read more of this story at Slashdot.
Sony Suffers Yet More Security Breaches

Posted: May 25th, 2011, 4:45pm CEST by Unknown Lamer

Tags: security

Oldcynic writes "As Sony struggles to restore the Playstation Network we receive news today of another breach, this time at Sony Ericsson in Canada. 'Sony Corp. spokesman Atsuo Omagari said Wednesday that names, email and encrypted passwords may have been stolen from the Sony Ericsson Canada website, but no credit card information was taken.' Another group managed to penetrate Sony Entertainment Japan yesterday as well. I almost feel bad for them.

Read more of this story at Slashdot.
Apple Acknowledges MacDefender

Posted: May 25th, 2011, 4:03pm CEST by Unknown Lamer

Tags: security

Trailrunner7 writes with an article in threatpost "Apple is planning to release an update specifically designed to protect users against the MacDefender malware that has been circulating for the last couple of weeks. The update for Mac OS X will automatically find and remove the malware on an infected machine and also will warn users if another infection attempt is detected.

Read more of this story at Slashdot.
New Siemens SCADA Vulnerabilities Kept Secret, Says Schneier

Posted: May 24th, 2011, 3:03pm CEST by Roblimo

Tags: security

From the article: SCADA systems -- computer systems that control industrial processes -- are one of the ways a computer hack can directly affect the real world. Here, the fears multiply. It's not bad guys deleting your files, or getting your personal information and taking out credit cards in your name; it's bad guys spewing chemicals into the atmosphere and dumping raw sewage into waterways. It's Stuxnet: centrifuges spinning out of control and destroying themselves. Never mind how realistic the threat is, it's scarier." What worries Bruce Schneier most is that industry leader Siemens is keeping its SCADA vulnerabilities secret, at least in part due to pressure from the Department of Homeland Security .

Read more of this story at Slashdot.
Researcher Hijacks LinkedIn Profiles Using Cookie

Posted: May 23rd, 2011, 10:42pm CEST by Unknown Lamer

Tags: security

mask.of.sanity writes "A security researcher has demonstrated holes in the way cookies are handled on LinkedIn profiles by hijacking profiles. The session cookies are sent over unsecured HTTP and remain active for up to a year."

Read more of this story at Slashdot.
PlayStation Network Hack Will Cost Sony $170M

Posted: May 23rd, 2011, 5:21pm CEST by Roblimo

Tags: security

alphadogg writes "Sony expects the PlayStation Network hack will cost it $170 million this financial year, it said Monday. Unknown hackers hit the network gaming service for PlayStation 3 consoles in April, penetrating the system and stealing personal information from the roughly 77 million accounts on the PlayStation Network and sister Qriocity service. A second attack was directed at the Sony Online Entertainment network used for PC gaming. Sony responded to the attacks by taking the systems offline." Does the $170 million figure include compensation for PSN subscribers who suffered from the outage?

Read more of this story at Slashdot.
Sony Music Greece Falls To Hackers

Posted: May 23rd, 2011, 6:04am CEST by samzenpus

Tags: security

xsee writes "Hackers: 6, Sony: 0. It appears an attacker has performed a SQL injection attack against SonyMusic.gr. The latest attack has exposed usernames, real names, email addresses and more. Is Sony's network being used as the world's largest public penetration test?"

Read more of this story at Slashdot.
The Beginning of the End For Hadopi?

Posted: May 21st, 2011, 8:16pm CEST by Soulskill

Tags: security

zrbyte writes "TorrentFreak reports on the latest developments in the french Hadopi saga. 'The private company entrusted to carry out file-sharing network monitoring for the French government has been hacked. Trident Media Guard, which is responsible for gathering data for so-called 3 strikes warnings was hacked and now has some of its data out in the wild, an event which has the potential to upset the operation of Hadopi.' TMG temporarily suspended the gathering of data on file-sharers while they investigated the breach, later claiming that the attack was on 'an unprotected test server with no confidential data.'"

Read more of this story at Slashdot.
New Malware Simulates Hard Drive Failure

Posted: May 21st, 2011, 2:13am CEST by timothy

Tags: security

An anonymous reader writes "A nasty strain of malware goes beyond mere sensational alerts, it makes it seem the user's hard drive is failing. It moves files from All Users and the current Windows user's profile into a temporary location, making it appear as though problems with the hard drive are causing files to disappear. It also disables a user's ability to change wallpaper images and sets registry keys to hide certain icons — giving the impression that programs are going missing as well. Of course, it's all done in an attempt to get people to buy the software that will fix it."

Read more of this story at Slashdot.
Ask Slashdot: FTP Server Honeypots?

Posted: May 19th, 2011, 11:22pm CEST by timothy

Tags: security

An anonymous reader writes "I run an FTP server for a few dozen people, and it seems like every week I have a random IP address connect to my box and try guessing 'Administrator' passwords once every five seconds or so. This poses no real risk to me, since all my accounts have custom (uncommon) names. But if this is happening to me, I would wager lots of people are at risk of low level, persistent, long term password cracking attempts. Is there a way to report the perpetrators, or any action we can take to address this kind of danger?"

Read more of this story at Slashdot.
Siemens SCADA Hacking Talk Pulled From TakeDownCon

Posted: May 19th, 2011, 9:59pm CEST by timothy

Tags: security

alphadogg writes "A planned presentation on security vulnerabilities in Siemens industrial control systems was pulled Wednesday over worries that the information in the talk was too dangerous to be released. Independent security researcher Brian Meixell and Dillon Beresford, with NSS Labs, had been planning to talk Wednesday at a Dallas security conference about problems in Siemens PLC systems, the industrial computers widely used to open and shut valves on factory floors and power plants, control centrifuges, and even operate systems on warships. But the researchers decided to pull the talk at the last minute after Siemens and the US Department of Homeland Security pointed out the possible scope of the problem."

Read more of this story at Slashdot.
Verifying Passwords By the Way They're Typed

Posted: May 19th, 2011, 4:25pm CEST by CmdrTaco

Tags: security

Zothecula writes "There are good passwords and bad passwords, but none of them are totally secure. Researchers at the American University of Beirut, Lebanon, are working on strengthening an approach to password security that's not just about what you type, but how you type it (abstract)." Note that the actual paper appears to be behind some crappy paywall: hopefully the research exists elsewhere on-line.

Read more of this story at Slashdot.
Apple Support Forums Suggest Malware Explosion

Posted: May 18th, 2011, 10:12pm CEST by Soulskill

Tags: security

dotwhynot writes "According to ZDNet, the volume of in-the-wild malware reports on discussions.apple.com is truly exceptional. With the launch of the first malware DIY kit for OS X earlier this month, and now this, has the malware industry threat finally caught up with the growth of Apple, and what do Mac users need to do?"

Read more of this story at Slashdot.
Kaspersky Calls For 'Internet Interpol'

Posted: May 18th, 2011, 8:51pm CEST by Soulskill

Tags: security

angry tapir writes "With cybercrime now the second largest criminal activity in the world, measures such as the creation of an 'Internet Interpol' and better cooperation between international law enforcement agencies are needed if criminals are to be curtailed in the future, Kaspersky Labs founder and security expert Eugene Kaspersky has argued. He said, 'We were talking about that 10 years ago and almost nothing has happened. Sooner or later we will have one. I am also talking about Internet passports and having an online ID. Some countries are introducing this idea, so maybe in 15 years we will all have it.'"

Read more of this story at Slashdot.
Microsoft: One In 14 Downloads Is Malicious

Posted: May 18th, 2011, 4:49pm CEST by CmdrTaco

Tags: security

alphadogg writes "About one out of every 14 programs downloaded by Windows users turns out to be malicious, Microsoft said Tuesday. And even though Microsoft has a feature in its Internet Explorer browser designed to steer users away from unknown and potentially untrustworthy software, about 5% of users ignore the warnings and download malicious Trojan horse programs anyway. IE also warns users when they're being tricked into visiting malicious websites, another way that social-engineering hackers can infect computer users. In the past two years, IE's SmartScreen has blocked more than 1.5 billion Web and download attacks, according to Jeb Haber, program manager lead for SmartScreen."

Read more of this story at Slashdot.
The Cost of US Security

Posted: May 17th, 2011, 4:25am CEST by Soulskill

Tags: security

Hugh Pickens writes "The Atlantic reports that as we mark Osama bin Laden's death, what's striking is how much he cost our nation and how little we've gained from our fight against him. By conservative estimates, bin Laden cost the US at least $3 trillion over the past 15 years, counting the disruptions he wrought on the domestic economy, the wars and heightened security triggered by the terrorist attacks he engineered, and the direct efforts to hunt him down. 'What do we have to show for that tab,' ask Tim Fernholz and Jim Tankersley. 'Two wars that continue to occupy 150,000 troops and tie up a quarter of our defense budget; a bloated homeland-security apparatus that has at times pushed the bounds of civil liberty; soaring oil prices partially attributable to the global war on bin Laden's terrorist network; and a chunk of our mounting national debt.' In 2004 bin Laden explicitly compared the US fight to the Afghan incursion that helped bankrupt the Soviet Union during the Cold War. 'We are continuing this policy in bleeding America to the point of bankruptcy,' said bin Laden, adding that that every dollar spent by al-Qaida in attacking the US has cost Washington $1m in economic fallout and military spending."

Read more of this story at Slashdot.
New Alureon Rootkit Takes Malware To New Level

Posted: May 16th, 2011, 5:40pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "A new version of the venerable Alureon malware has appeared, and this one includes some odd behavior designed to prevent analysis and detection by antimalware systems. However, this isn't the typical evasion algorithm, as it uses some unusual encryption and decryption routines to make life much more difficult for analysts and users whose machines have been infected. Alureon is a well-known and oft-researched malware family that has some rootkit-like capabilities in some of its variations. The newest version of the malware exhibits some behavior that researchers haven't seen before and which make it more problematic for antimalware software to detect it and for experts to break down its components."

Read more of this story at Slashdot.
WebGL Flaw Leaves GPU Exposed To Hackers

Posted: May 13th, 2011, 6:38pm CEST by Soulskill

Tags: security

recoiledsnake writes "Google spent a lot of time yesterday talking up WebGL, but UK security firm Context seems to think users should disable the feature because it poses a serious security threat, and the US Computer Emergency Readiness Team is encouraging people to heed that advice. According to Context, a malicious site could pass code directly to a computer's GPU and trigger a denial of service attack or simply crash the machine. Ne'er-do-wells could also use WebGL and the Canvas element to pull image data from another domain, which could then be used as part of a more elaborate attack. Khronos, the group that organizes the standard, responded by pointing out that there is an extension available to graphics card manufacturers that can detect and protect against DoS attacks, but it did little to satisfy Context — the firm argues that inherent flaws in the design of WebGL make it very difficult to secure."

Read more of this story at Slashdot.
Baby's First TSA Patdown

Posted: May 13th, 2011, 4:52pm CEST by samzenpus

Tags: security

theodp writes "Is there anything cuter than baby milestones? Baby's first steps. Baby's first word. And now, baby's first TSA patdown. 'Well,' writes Anna North, 'it finally happened. Airport security officers gave a pat-down to a baby.' A post on the TSA blog defended the move: 'The child's stroller alarmed during explosives screening. Our officers followed proper current screening procedures by screening the family after the alarm...The [8-month-old] child in the photo was simply receiving a modified pat-down.' Hey, at least they didn't make a federal case of the 4 oz. of liquid found in the little tyke's Pampers."

Read more of this story at Slashdot.
US-CERT Warns of Serious Hole In ActiveX Control From Iconics

Posted: May 12th, 2011, 10:41pm CEST by timothy

Tags: security

Trailrunner7 writes "The US's Computer Emergency Response Team (CERT) issued a warning (PDF) to critical infrastructure firms on Wednesday about a serious security hole in products from Massachusetts firm Iconics that could leave critical systems vulnerable to remote attacks. US companies in the electricity, oil and gas, manufacturing and water treatment sectors have been warned about a flaw in an ActiveX control used in two products by Iconics. The software, Genesis32 and BizViz, are Human-Machine Interface (HMI) products that provide a graphical user interface to various types of industrial control systems. The software can control industrial systems used for a variety of purposes including manufacturing, building automation, oil and gas, water and waste water treatment, among other applications."

Read more of this story at Slashdot.
Mainstream Media Looks At Anonymous

Posted: May 11th, 2011, 10:20pm CEST by samzenpus

Tags: security

ScuttleMonkey writes "In an uncharacteristically accurate writeup of Anonymous, the Guardian has published a look at the assembled mob behind the mask. A great place to send those unfamiliar with who or what Anonymous really is. From the article: 'This collective identity belongs to no one in particular, but is at the disposal of anyone who knows its rules and knows how to apply them. Anonymous, the collective identity, is older than Anonymous, the hacktivist group – more to the point, I propose that the hacktivist group can be understood as an application of Anonymous, the collective identity.'"

Read more of this story at Slashdot.
Book Review: BackTrack 4: Assuring Security by Penetration Testing

Posted: May 11th, 2011, 9:03pm CEST by samzenpus

Tags: security

RickJWagner writes "Watch out, System Admins. The floodgates to BlackHat Hackerdom are now open. Packt Publishing has just released BackTrack 4: Assuring Security by Penetration Testing, a how-to book based on the freely available BackTrack 4 Linux distribution. The intent of the book is to educate security consultants on the use of this devastatingly complete Hacker's toolkit, and to provide sage words of advice on how to conduct yourself as a penetration testing consultant. On both counts, the authors do well." Keep reading for the rest of Rick's review.

Read more of this story at Slashdot.
Zeus Crimeware Kit Source Code Leaked

Posted: May 11th, 2011, 3:35pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "The source code to the infamous Zeus crimeware kit, which has been sold on underground forums for years, has been leaked and is now available for anyone to see if they know where to look. Security researchers over the weekend noticed that files appearing to contain the source code for the Zeus crimeware kit were starting to pop up on various forums frequented by attackers and cyber-criminals. The Zeus exploit kit is perhaps the most well-known kit of its kind right now, and has been used by a variety of attackers for numerous malware campaigns and targeted attacks."

Read more of this story at Slashdot.
File-hosting Sites Not a Safe Haven For Private Data

Posted: May 9th, 2011, 1:46am CEST by timothy

Tags: security

An anonymous reader tips a story at the Register, according to which "Academic researchers say they've uncovered weaknesses in dozens of the most popular file hosting sites that allow people to gain unauthorized access to data that's supposed to be available only to those selected by the user."

Read more of this story at Slashdot.
Sony Delays PlayStation Network Reactivation

Posted: May 8th, 2011, 11:15pm CEST by timothy

Tags: security

i4u writes "Earlier this week chatter in an IRC network led to speculation of a third attack on Sony's network. For its part, the company steadfastly promised that at least some services would resume by the end of this week. But now it looks like Sony has given up on that goal. The PSN reactivation has been delayed. Sony's explanation? They were 'unaware' of the extent of the attacks on their system."

Read more of this story at Slashdot.
OpenID Warns of Serious Remote Bug, Urges Upgrade

Posted: May 7th, 2011, 2:12pm CEST by timothy

Tags: security

Trailrunner7 writes "The OpenID Foundation is warning users about a weakness in the software that could enable an attacker to change some of the data exchanged between parties that use OpenID. The group is telling sites that implement OpenID to update to a new version in order to fix the problem. The bug in OpenID lies in the system's Attribute Exchange, an extension that gives sites the ability to exchange identity information between endpoints. OpenID, an open source project that enables users to prove their identity to myriad sites without providing their passwords, is used by a slew of popular sites, including Google, Yahoo and Flickr."

Read more of this story at Slashdot.
LastPass: Users Don't Have To Reset Master PWDs

Posted: May 7th, 2011, 4:00am CEST by timothy

Tags: security

CWmike writes "LastPass on Friday rescinded its day-old order that all users of its online password management system reset their master passwords due to a database breach. In a blog post this morning, the company said it won't allow users to change master passwords 'until our databases are completely caught up and we have resolved outstanding issues.' In an e-mail to Computerworld, LastPass CEO Joe Siegrist said the company changed its plan in response to demands from users asking they not be required to reset their passwords. However, comments posted on a LastPass blog suggest that the company's decision may also be related to trouble some users appear to be having with the password reset process. The blog post acknowledged that it had 'identified an issue' with roughly 5% of users that reset their master passwords. The company said it would be contacting those users about a fix for the problem LastPass said earlier that passwords for its Xmarks bookmark sync, which it acquired last December, were not affected."

Read more of this story at Slashdot.
Does Microsoft Need Bug Bounties?

Posted: May 6th, 2011, 8:32pm CEST by Soulskill

Tags: security

Gunkerty Jeb writes "The threats and attacks may have changed in the last decade, but one thing has remained constant: software giant Microsoft doesn't pay for vulnerabilities. Never has. Never will. Even as rivals like Mozilla and Google have introduced bug bounty program, the Redmond giant has stuck doggedly with a position it articulated almost a decade ago, refusing to offer monetary rewards for information on software holes. But security experts say that position may have to change."

Read more of this story at Slashdot.
LastPass Pasword Service Hacked

Posted: May 5th, 2011, 8:55pm CEST by timothy

Tags: security

Trailrunner7 writes "LastPass, a popular Web based password management firm, advised its customers to change the password they use to access the service following what the company said are signs that its network may have been compromised."

Read more of this story at Slashdot.
LastPass Password Service Hacked

Posted: May 5th, 2011, 8:55pm CEST by timothy

Tags: security

Trailrunner7 writes "LastPass, a popular Web based password management firm, advised its customers to change the password they use to access the service following what the company said are signs that its network may have been compromised."

Read more of this story at Slashdot.
Sony Officially Blames Anonymous For PSN Hack

Posted: May 4th, 2011, 8:21pm CEST by samzenpus

Tags: security

H_Fisher writes "In a letter to Congress, Kazuo Hirai, chairman of Sony's board of directors, blames hacker group Anonymous for making possible the theft of gamers' personal information. 'What is becoming more and more evident is that Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack designed to steal personal and credit card information for illegal purposes,' Hirai wrote. He also indicated that Sony waited two days before notifying the FBI of the theft."

Read more of this story at Slashdot.
Sony Online Entertainment Services Follow PSN Down

Posted: May 2nd, 2011, 4:42pm CEST by CmdrTaco

Tags: security

nam37 writes "Sony Online Entertainment's various services seem to be down and a message on the official site does not give much information on the particulars. According to a short post on the site, the services were taken down after an investigation revealed a deeper 'intrusion' than expected at first. This is the first we have heard that Sony's MMORPG arm had some sort of security breach. This could be part of Sony's plans to beef up security for the PlayStation Network, but this message seems to indicate that something more serious going on."

Read more of this story at Slashdot.
NSA Advises Upgrade To Windows 7

Posted: May 2nd, 2011, 2:57am CEST by timothy

Tags: security

An anonymous reader writes "In a document available from the NSA (warning, PDF file), that organisation advises users to upgrade to Windows 7 as part of their Best Practice for Securing a Home Network. No mention of BSD or Linux so I guess the Slashdot crowd will just have to bite the bullet and change operating systems if they want to be really secure."

Read more of this story at Slashdot.
FBI Says Wire Fraud Scam Sending Millions To China

Posted: April 27th, 2011, 5:46pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "The FBI is warning businesses about an ongoing spate of attacks that are stealing millions of dollars from companies through unauthorized bank transfers to Chinese companies. The fraudulent wire transfers are not a new tactic, but the FBI says the current round of attacks is notable in that virtually all of the transfers are going to shell companies based in China and have cost U.S. businesses $11 million. The FBI said that many of the cases it has seen involve well-known pieces of malware, such as Zeus, SpyEye and others. The amount of money the attackers try to transfer varies from $50,000 up to nearly $1 million."

Read more of this story at Slashdot.
Fewer Hacked Records Does Not Mean Better Security

Posted: April 26th, 2011, 11:01pm CEST by CmdrTaco

Tags: security

snydeq writes "The total number of compromised records has dropped substantially over the past couple of years, but not because organizations have come up with a superior recipe for defending their networks, InfoWorld reports. Instead, attackers are continually employing more focused forms of attack, looking for company intellectual property and financial data. Moreover, the low hack rate is also indicative of increasing ambition on the part of criminals. 'Today's APT (advanced persistent threat) attacks are aimed at taking over entire companies. At that level, individual data records just aren't that interesting.'"

Read more of this story at Slashdot.
DHS Chief: What We Learned From Stuxnet

Posted: April 26th, 2011, 10:16pm CEST by CmdrTaco

Tags: security

angry tapir writes "If there's a lesson to be learned from last year's Stuxnet worm, it's that the private sector needs to be able to respond quickly to cyber-emergencies (CT: Warning, site contains obnoxious interstitial ads. Blocker advised), according to the head of the US Department of Homeland Security. When Stuxnet hit, the US Department of Homeland security was sent scrambling to analyze the threat. Systems had to be flown in from Germany to the federal government's Idaho National Laboratory. In short order the worm was decoded, but for some time, many companies that owned Siemens equipment were left wondering what, if any measures, they should take to protect themselves from the new worm."

Read more of this story at Slashdot.
New Tool Hides Data In Plain Sight On HDDs

Posted: April 25th, 2011, 6:27pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "A group of researchers has developed a new application that can hide sensitive data on a hard drive without encrypting it or leaving any obvious signs that the data is present. The new steganography system relies on the old principle of hiding valuables in plain sight. Developed by a group of academic researchers in the US and Pakistan, the system can be used to embed secret data in existing structures on a given HDD by taking advantage of the way file systems are designed and implemented. The software does this by breaking a file to be hidden into a number of fragments and placing the individual pieces in clusters scattered around the hard drive."

Read more of this story at Slashdot.
Sony Rebuilding PlayStation Network Security After Attack

Posted: April 24th, 2011, 11:10pm CEST by samzenpus

Tags: security

alphadogg writes "The outage of Sony's PlayStation Network and Qriocity service, now in its fourth day, looks set to continue after the company said on Sunday that it is 'rebuilding' its system to better guard against attacks. Sony said on Saturday that the outage was caused by an 'external intrusion' into the network, but has yet to detail the problem. The PlayStation Network is used for PlayStation 3 online gaming and sales of software to consoles and the PlayStation Portable. The Qriocity service runs on the same network infrastructure and provides audio and video to Sony consumer electronics products."

Read more of this story at Slashdot.
Iran Says Siemens Helped US, Israel Build Stuxnet

Posted: April 18th, 2011, 10:37pm CEST by Soulskill

Tags: security

CWmike writes "Iran's Brigadier General, Gholam Reza Jalali, accused Siemens on Saturday with helping US and Israeli teams craft the Stuxnet worm that attacked his country's nuclear facilities. 'Siemens should explain why and how it provided the enemies with the information about the codes of the SCADA software and prepared the ground for a cyber attack against us,' Jalali told the Islamic Republic News Service. Siemens did not reply to a request for comment on Jalali's accusations. Stuxnet, which first came to light in June 2010 but hit Iranian targets in several waves starting the year before, has been extensively analyzed by security researchers. Symantec and Langner Communications say Stuxnet was designed to infiltrate Iran's nuclear enrichment program, hide in the Iranian SCADA (supervisory control and data acquisition) control systems that operate its plants, then force gas centrifuge motors to spin at unsafe speeds. Jalali suggested that Iranian officials would pursue Siemens in the courts, and claimed that Iranian researchers traced the attack to Israel and the US. He said information from infected systems was sent to computers in Texas."

Read more of this story at Slashdot.
Wind Power Firm Sees No Evidence of Hack

Posted: April 18th, 2011, 2:57pm CEST by CmdrTaco

Tags: security

alphadogg writes "One day after a hacker posted screen shots and data to a hacking mailing list, saying he had broken into a New Mexico wind turbine facility, the company that runs the turbines says it has seen no evidence of a computer intrusion. The hacker, who calls himself Bigr R, made the claims Saturday, posting screenshots of the facility's management interface, screenshots of an FTP server and project management system, as well as Web server info and configuration data from a Cisco router."

Read more of this story at Slashdot.
Is Your Antivirus Made By the Chinese Government?

Posted: April 18th, 2011, 2:08pm CEST by samzenpus

Tags: security

guanxi writes "Huawei, a large Chinese telecom and IT company with close ties to the Chinese military has faced obstacles doing business in other countries, because governments are concerned about giving them access to critical infrastructure. Huawei Symantec is a joint venture with one of the world's largest IT security companies which sells security products in the US. Would the Chinese or other governments take the opportunity to create back doors into western IT networks? Wouldn't they be crazy not to?"

Read more of this story at Slashdot.
Hacker Claims He Broke Into Wind Turbine Systems

Posted: April 18th, 2011, 12:06pm CEST by samzenpus

Tags: security

itwbennett writes "Claiming revenge for an 'illegitimate firing,' someone has posted screenshots and other data, apparently showing that he was able to break into a 200 megawatt wind turbine system owned by NextEra Energy Resources, a subsidiary of Florida Power & Light. In an e-mail interview, Bgr R said he's a former employee who discovered a vulnerability in the company's Cisco security management software that he then used to hack into the SCADA systems used to control the turbines. His motive was to embarrass the company, he said."

Read more of this story at Slashdot.
Adobe To Patch Flash 0-Day Friday

Posted: April 14th, 2011, 5:55pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "Adobe is planning to patch the recently disclosed Flash Player vulnerability on Friday — just four days after it was disclosed — for users on Windows, Mac OS X and Linux. The vulnerability is being used in targeted attacks right now that use malicious Word documents. Adobe said it plans to push out the Flash Player patch for Google Chrome today, as part of the Chrome release channel, but Reader X users will have to wait till June for a fix."

Read more of this story at Slashdot.
French Hacker Arrested After Bragging On TV

Posted: April 14th, 2011, 7:10am CEST by samzenpus

Tags: security

Orome1 writes "A French hacker has effectually tied a noose around his own neck when he bragged about hacking into the systems of a big government contractor on national TV. He participated in a television program called Further investigation, and he said — and demonstrated — that he has gained access to computers belonging to the French Army and Thales Group, a French company that provides information systems and services for the aerospace, defense, and security markets. He was arrested 6 days after the program was aired. The police discovered on his computer a great number of compromised credit card and bank account data."

Read more of this story at Slashdot.
WordPress Hacked, Attackers Get Root Access

Posted: April 13th, 2011, 10:12pm CEST by samzenpus

Tags: security

An anonymous reader writes "A hacker has gained access to WordPress.com servers and site source code was exposed including passwords/API keys for Twitter and Facebook accounts. From the official blog post: 'Automattic had a low-level (root) break-in to several of our servers, and potentially anything on those servers could have been revealed. We presume our source code was exposed and copied. While much of our code is Open Source, there are sensitive bits of our and our partner's code. Beyond that, however, it appears information disclosed was limited.'"

Read more of this story at Slashdot.
Russia Backs Down On Skype, Gmail Ban

Posted: April 13th, 2011, 9:50am CEST by timothy

Tags: security

An anonymous reader writes "Russia's Federal Security Service (FSB) has backed away from its call for a ban on Skype, Gmail and Hotmail, first voiced on Friday. On 8 April, FSB official Alexander Andreyechkin said foreign-based services that allowed for encrypted communications posed a security problem for Russia. 'The uncontrollable use of such services can lead to a major threat to Russia's security,' Andreyechkin reportedly said at a government meeting."

Read more of this story at Slashdot.
SSL and the Future of Authenticity

Posted: April 11th, 2011, 8:33pm CEST by Soulskill

Tags: security

An anonymous reader writes "There has been a growing tide of support for replacing SSL's Certificate Authorities with an alternative authentication mechanism. Moxie Marlinspike, the security researcher who has repeatedly published attacks against SSL, has written an in-depth piece about the questions we should be asking as we move forward, and urges strong caution about adopting DNSSEC for this task."

Read more of this story at Slashdot.
Five of the Best Free Linux Disk Encryption Tools

Posted: April 10th, 2011, 12:04am CEST by Roblimo

Tags: security

An anonymous reader writes "Disk encryption uses software to encrypt the entire hard disk. The onus is therefore not on the user to determine what data should be encrypted, or to remember to manually encrypt files. By encrypting the entire disk, temporary files, which may reveal important confidential data, are also protected. Security is enhanced further when disk encryption is combined with filesystem-level encryption. To provide an insight into the open source software that is available, we have compiled a list of five notable disk encryption tools. Hopefully, there will be something of interest here for anyone who wants easy-to-use data encryption and security."

Read more of this story at Slashdot.

Slashdot: Linux

Five of the Best Free Linux Disk Encryption Tools

Posted: April 10th, 2011, 12:04am CEST by Roblimo

Tags: security

An anonymous reader writes "Disk encryption uses software to encrypt the entire hard disk. The onus is therefore not on the user to determine what data should be encrypted, or to remember to manually encrypt files. By encrypting the entire disk, temporary files, which may reveal important confidential data, are also protected. Security is enhanced further when disk encryption is combined with filesystem-level encryption. To provide an insight into the open source software that is available, we have compiled a list of five notable disk encryption tools. Hopefully, there will be something of interest here for anyone who wants easy-to-use data encryption and security."

Read more of this story at Slashdot.

Slashdot: IT

Dropbox Authentication: Insecure By Design

Posted: April 8th, 2011, 9:04pm CEST by Soulskill

Tags: security

An anonymous reader writes "Dropbox can be very useful, but you might be a little surprised to learn that by copying one file from a computer running the application, an attacker can access and download all of your files without any obvious signs of compromise. Normal remediation steps after a compromise such as password rotation, system re-image, etc will not prevent continued access to the compromised Dropbox. Derek Newton, a security researcher that published this finding yesterday, discusses the security implications of this by-design security authentication method on his blog."

Read more of this story at Slashdot.
Epsilon Breach Used Four-month-old Attack

Posted: April 7th, 2011, 4:11pm CEST by CmdrTaco

Tags: security

schliz writes "Marketing giant Epsilon knew that it was vulnerable to an attack for 'some months' before suffering a high-profile breach last week. According to Epsilon's technology partner ReturnPath, the breach was part of a series of socially engineered attacks discovered in November."

Read more of this story at Slashdot.
Fired Gucci Employee Accused of Attacking Network

Posted: April 7th, 2011, 3:30pm CEST by CmdrTaco

Tags: security

WrongSizeGlass writes "Computer World, Information Week, The Register are all reporting on the story of a former Gucci IT employee who is accused of a November 2010 assault on Gucci's network deleting files and virtual servers, taking a storage area network offline, and deleting mailboxes from the corporate email server. The lost productivity is estimated at $200,000. Sam Chihlung Yin, 34, of Jersey City, NJ, allegedly created a fake VPN token in the name of a non-existent employee which he tricked Gucci IT staff into activating in June 2010, a month after his employment contract was terminated by Gucci for unrelated reasons."

Read more of this story at Slashdot.
France Outlaws Hashed Passwords

Posted: April 7th, 2011, 9:53am CEST by samzenpus

Tags: security

An anonymous reader writes "Storing passwords as hashes instead of plain text is now illegal in France, according to a draconian new data retention law. According to the BBC, '[t]he law obliges a range of e-commerce sites, video and music services and webmail providers to keep a host of data on customers. This includes users' full names, postal addresses, telephone numbers and passwords. The data must be handed over to the authorities if demanded.' If the law survives a pending legal challenge by Google, Ebay and others, it may well keep some major services out of the country entirely."

Read more of this story at Slashdot.
Thousands of SSL Certs Issued To Unqualified Names

Posted: April 6th, 2011, 3:38pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "The recent attack on Comodo and several of its associated registration authorities has spurred quite a bit of re-examination of the way that the Web's certificate authority infrastructure works--or doesn't. One interesting result of this work is that the folks at the Electronic Frontier Foundation have discovered that there are more than 37,000 legitimate certificates issued by CAs for unqualified names such as 'localhost,' or 'Exchange,' a practice that could simplify some forms of man-in-the-middle attacks. 'Although signing "localhost" is humorous, CAs create real risk when they sign other unqualified names. What if an attacker were able to receive a CA-signed certificate for names like "mail" or "webmail?"' Such an attacker would be able to perfectly forge the identity of your organization's webmail server in a "man-in-the-middle" attack!'"

Read more of this story at Slashdot.
Scientists Develop New Method To Improve Passwords

Posted: April 3rd, 2011, 3:34pm CEST by timothy

Tags: security

An anonymous reader writes "Scientists at Max-Planck-Institute for Physics of Complex Systems in Dresden, Germany have developed a novel method to improve password security. A strong long password is split in two parts. The first part is memorized by a human. The second part is stored as a CAPTCHA-like image of a chaotic lattice system."

Read more of this story at Slashdot.
Scientists Develop New Method To Improve Passwords

Posted: April 3rd, 2011, 3:34pm CEST by timothy

Tags: security

An anonymous reader writes "Scientists at Max-Planck-Institute for Physics of Complex Systems in Dresden, Germany have developed a novel method to improve password security. A strong long password is split in two parts. The first part is memorized by a human. The second part is stored as a CAPTCHA-like image of a chaotic lattice system."

Read more of this story at Slashdot.
Viral Scareware Infects Four Million Websites

Posted: April 2nd, 2011, 10:55pm CEST by timothy

Tags: security

oxide7 writes "A fast-spreading SQL injection attack that illegally peddles a bogus scareware has been breaking anti-virus barriers and compromising millions of websites, besides defrauding unsuspecting victims. The news of this attack was brought out by Websense Security Labs in its blog last week. Websense said its Threatseeker Network identified a new malicious mass-injection campaign which it named LizaMoon."

Read more of this story at Slashdot.
Viral Scareware Infects Four Million Websites

Posted: April 2nd, 2011, 10:55pm CEST by timothy

Tags: security

oxide7 writes "A fast-spreading SQL injection attack that illegally peddles a bogus scareware has been breaking anti-virus barriers and compromising millions of websites, besides defrauding unsuspecting victims. The news of this attack was brought out by Websense Security Labs in its blog last week. Websense said its Threatseeker Network identified a new malicious mass-injection campaign which it named LizaMoon."

Read more of this story at Slashdot.
RSA Says SecurID Hack Based On Phishing With Flash 0-Day

Posted: April 2nd, 2011, 9:16am CEST by timothy

Tags: security

Trailrunner7 writes "RSA confirmed on Friday that the attack that compromised the company's high-value SecurID product was essentially a small, targeted phishing campaign that included a payload of a malicious Flash object embedded in an Excel file."

Read more of this story at Slashdot.
RSA Says SecurID Hack Based On Phishing With Flash 0-Day

Posted: April 2nd, 2011, 9:16am CEST by timothy

Tags: security

Trailrunner7 writes "RSA confirmed on Friday that the attack that compromised the company's high-value SecurID product was essentially a small, targeted phishing campaign that included a payload of a malicious Flash object embedded in an Excel file."

Read more of this story at Slashdot.
Plumber Injection Attack In Bowser's Castle

Posted: April 1st, 2011, 11:27pm CEST by Soulskill

Tags: security

An anonymous reader writes to make sure everybody Yoshi Bullet Bill Reznor is aware of Security Advisory SMB-1985-0001: Plumber Injection Attack in Bowser's Castle. "Ksplice, working in conjunction with Lakitu Cloud Security, has released a high-severity advisory about a Plumber Injection attack in multiple versions of Bowser's Castle. An Italian plumber could exploit jump on headbutt fireball this bug to bypass security measures (walk through walls) in order to rescue Peach, to defeat Bowser, or for unspecified other impact theft of giant gold coins consumption of narcotics vicious attacks on Koopas . This vulnerability is demonstrated by 'happylee-supermariobros,warped.fm2.' Attacks using this exploit have been observed in the wild, and multiple other exploits are publicly available. A bouncing star patch radioactive flower Tanooki suit has been made available."

Read more of this story at Slashdot.
Plumber Injection Attack In Bowser's Castle

Posted: April 1st, 2011, 11:27pm CEST by Soulskill

Tags: security

An anonymous reader writes to make sure everybody Yoshi Bullet Bill Reznor is aware of Security Advisory SMB-1985-0001: Plumber Injection Attack in Bowser's Castle. "Ksplice, working in conjunction with Lakitu Cloud Security, has released a high-severity advisory about a Plumber Injection attack in multiple versions of Bowser's Castle. An Italian plumber could exploit jump on headbutt fireball this bug to bypass security measures (walk through walls) in order to rescue Peach, to defeat Bowser, or for unspecified other impact theft of giant gold coins consumption of narcotics vicious attacks on Koopas . This vulnerability is demonstrated by 'happylee-supermariobros,warped.fm2.' Attacks using this exploit have been observed in the wild, and multiple other exploits are publicly available. A bouncing star patch radioactive flower Tanooki suit has been made available."

Read more of this story at Slashdot.
Massive SQL Injection Attack Compromises 380K URLs

Posted: March 31st, 2011, 5:31pm CEST by CmdrTaco

Tags: security

Orome1 writes "A massive SQL injection attack campaign has been spotted by Websense researchers, and the number of unique URLs affected by it has risen from 28,000 when first detected yesterday, to 380,000 when the researchers last checked. The injected script redirects users that have landed on the various infected pages to the domain in the script, which then redirects them further to a website simulating an anti-malware check and peddling a rogue AV solution."

Read more of this story at Slashdot.
Massive SQL Injection Attack Compromises 380K URLs

Posted: March 31st, 2011, 5:31pm CEST by CmdrTaco

Tags: security

Orome1 writes "A massive SQL injection attack campaign has been spotted by Websense researchers, and the number of unique URLs affected by it has risen from 28,000 when first detected yesterday, to 380,000 when the researchers last checked. The injected script redirects users that have landed on the various infected pages to the domain in the script, which then redirects them further to a website simulating an anti-malware check and peddling a rogue AV solution."

Read more of this story at Slashdot.
Samsung Keylogger Stories a False Alarm

Posted: March 31st, 2011, 3:31pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "The panic that arose yesterday about Samsung allegedly shipping laptops that contained a pre-installed keylogger turns out to have been a complete mistake after further investigation by security researchers and the company itself. In fact, the controversy was the result of a false positive from one commercial antimalware suite and nothing else. Several outlets reported on Wednesday that Samsung laptops had been found to contain a keylogger known as StarLogger right out of the box from the factory. However, upon closer inspection by security companies, the folder on the laptops that supposedly contained the malware was actually a directory that is part of Windows' multi-language support."

Read more of this story at Slashdot.
Samsung Keylogger Stories a False Alarm

Posted: March 31st, 2011, 3:31pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "The panic that arose yesterday about Samsung allegedly shipping laptops that contained a pre-installed keylogger turns out to have been a complete mistake after further investigation by security researchers and the company itself. In fact, the controversy was the result of a false positive from one commercial antimalware suite and nothing else. Several outlets reported on Wednesday that Samsung laptops had been found to contain a keylogger known as StarLogger right out of the box from the factory. However, upon closer inspection by security companies, the folder on the laptops that supposedly contained the malware was actually a directory that is part of Windows' multi-language support."

Read more of this story at Slashdot.
Man Accused of Selling US Military Drones On EBay

Posted: March 29th, 2011, 6:25pm CEST by samzenpus

Tags: security

garymortimer writes "47-year-old Henson Chua is in a bit of trouble for trying to sell a RQ-11B 'Raven' Unmanned Aerial Vehicle on eBay. From the article: 'A federal grand jury in Tampa returned an indictment charging Henson Chua, 47, of Manilla, Philippines, with violations of the Arms Export Control Act and smuggling, following an investigation by US Immigration and Customs Enforcement's Homeland Security Investigations. If convicted on all counts, Chua faces a maximum penalty of 20 years in federal prison.'" I'm kicking myself for missing this auction.

Read more of this story at Slashdot.
Can We Fix Federated Authentication?

Posted: March 29th, 2011, 2:47pm CEST by CmdrTaco

Tags: security

Bruce Schneier writes in his blog of a "New paper by Ross Anderson: 'Can We Fix the Security Economics of Federated Authentication?': There has been much academic discussion of federated authentication, and quite some political maneuvering about 'e-ID.' The grand vision, which has been around for years in various forms but was recently articulated in the US National Strategy for Trustworthy Identities in Cyberspace (NSTIC)."

Read more of this story at Slashdot.
Are the Days of Individual Security Over?

Posted: March 29th, 2011, 2:12pm CEST by Soulskill

Tags: security

angry tapir writes "People solely relying on patching and upgrades are lulling themselves into a false sense of security, and individual protection is no longer sufficient in the age of multi-vector attacks, according to the president of the Australian Internet Industry Association. According to AIIA's Peter Coroneos, vendors need to intervene at the network level and provide security tools at multiple levels to help secure people from the variety of threats that are emerging."

Read more of this story at Slashdot.
Lone Iranian Claims Credit For Comodo Hack

Posted: March 29th, 2011, 12:40am CEST by Soulskill

Tags: security

nk497 writes "A boastful Iranian hacker has claimed sole responsibility for the Comodo security certificate attack, saying it had nothing to do with his government. The 21-year-old claimed via a note on PasteBin, 'I'm not a group of hacker, I'm single hacker with experience of 1,000 hackers.' While some researchers believed his claims, saying the media had accepted Comodo's claims that the attack was from the Iranian government too easily, others said it was impossible to tell if the hacker was real, or a PR move by Iran."

Read more of this story at Slashdot.
McAfee's Website Full of Security Holes

Posted: March 28th, 2011, 10:32pm CEST by Soulskill

Tags: security

Julie188 writes "The McAfee.com website is full of security mistakes that could lead to cross-site scripting and other attacks, researchers said in a post on the Full Disclosure site on Monday. The holes with the site were found by the YGN Ethical Hacker Group, and reported to McAfee on Feb. 10, YGN says, before they were publicly disclosed to the security/hacking mailing list. Embarrassing? Yes, especially given that the company aggressively markets its own McAfee Secure service that is supposed to assure consumers that McAfee has scanned a website and found it to be safe."

Read more of this story at Slashdot.
SSL Cert Weaknesses Exposed By Comodo Breach

Posted: March 25th, 2011, 11:18am CET by timothy

Tags: security

snydeq writes "InfoWorld's Woody Leonhard delves deeper into the Comodo SSL scandal and finds the breach calls into question the integrity of the SSL certification process itself. 'While the press has focused on the sensational fact that Comodo's site was hacked from an Iranian IP address, we really should be asking three questions: How did somebody working with an Iranian IP address get a username and password from Comodo with enough clearance to create SSL certificates? Why did Comodo issue SSL certificates for google.com, live.com, yahoo.com, mozilla.org, and skype.com? Why are browser updates used to revoke SSL certificates?'"

Read more of this story at Slashdot.
Phony Web Certs Issued For Google, Yahoo, Skype

Posted: March 23rd, 2011, 9:23pm CET by samzenpus

Tags: security

Gunkerty Jeb writes "A major issuer of secure socket layer (SSL) certificates acknowledged on Wednesday that it had issued 9 fraudulent SSL certificates to seven Web domains, including those for Google.com, Yahoo.com and Skype.com following a security compromise at an affiliate firm. The attack originated from an IP address in Iran, according to a statement from Comodo Inc."

Read more of this story at Slashdot.
Hacker Posts His Crime On YouTube, Lands In Jail

Posted: March 23rd, 2011, 8:38pm CET by samzenpus

Tags: security

wiredmikey writes "A former contract security guard who admitted hacking into a hospital's computer systems (where he worked), was sentenced to 110 months in Federal prison. Why did he do it? He admits that he intended to use the bots and the compromised computers to launch DDoS attacks on the websites of rival hacker groups. The FBI says he posted video of himself hacking into the hospital computers on YouTube — While the theme of 'Mission Impossible' played, he described his hack, step by step, including the insertion of a CD containing the OphCrack program, which allowed him to bypass all security. The FBI found the CD containing the OphCrack program in McGraw's house and found the source code for the bot on his laptop."

Read more of this story at Slashdot.
Threats vs. Vulnerabilities

Posted: March 23rd, 2011, 2:28pm CET by CmdrTaco

Tags: security

Schneier's blog links to a short paper on the difference between threats and vulnerabilities. It's a little heavy for this early in the morning, but it might be worth your time.

Read more of this story at Slashdot.
UK PC Users Hit By Huge Fake Antivirus Attack

Posted: March 19th, 2011, 10:41am CET by timothy

Tags: security

An anonymous reader writes "UK Internet users were on the receiving end of a large drive-by web attack at the end of February, which attempted to push fake antivirus at least 750,000 times on a single day alone, security company AVG has said. According to a company analysis, on Sunday 27 February, detection levels for the previously obscure Russian 'Blackhole' exploit kit suddenly spiked to 900,000 globally from a few tens of thousands that would be typical for such kits, before dropping back again. Unusually, almost 750,000 of these detections were for UK PCs, which offers a baseline for what must have been a sustained attack several times that size against mainstream web servers frequented by users in the country."

Read more of this story at Slashdot.
New Adobe Flash 0-Day

Posted: March 15th, 2011, 6:48pm CET by CmdrTaco

Tags: security

Trailrunner7 writes "Adobe is warning its users about a critical vulnerability in Flash that affects Adobe Reader and Acrobat, as well, and is being used in some highly targeted attacks right now. The vulnerability in Flash Player affects Reader and Acrobat, both of which include Flash functionality, but it does not affect Reader X. Adobe officials said that Reader X's Protected Mode sandbox would prevent successful exploits. The company plans to have a patch for the affected products ready by next week for all platforms, including Windows, Mac, Linux, Android and Solaris."

Read more of this story at Slashdot.
40th Anniversary of the Computer Virus

Posted: March 14th, 2011, 11:56pm CET by Soulskill

Tags: security

Orome1 writes "This year marks the 40th anniversary of Creeper, the world's first computer virus. From Creeper to Stuxnet, the last four decades saw the number of malware instances boom from 1,300 in 1990, to 50,000 in 2000, to over 200 million in 2010. Besides sheer quantity, viruses, which were originally used as academic proofs of concept, quickly turned into geek pranks, then evolved into cybercriminal tools. By 2005, the virus scene had been monetized, and virtually all viruses were developed with the sole purpose of making money via more or less complex business models."

Read more of this story at Slashdot.
The Emergency Internet Bunkers

Posted: March 12th, 2011, 5:57pm CET by Soulskill

Tags: security

Barence writes "Should the Doomsday Clock ever strike midnight, we may well discover, finally, whether or not the internet really could survive a nuclear conflict. If it could, then a handful of datacenters dotted around the world would likely be all that remains of the multi-billion-dollar hosting industry. These secretive, high-security sites, tunneled out of mountains or housed behind the blast-proof doors of one-time NATO bunkers, are home to the planet's most secure hosting providers. This article profiles the emergency internet bunkers."

Read more of this story at Slashdot.
Hacking a Car With Music

Posted: March 12th, 2011, 4:54am CET by timothy

Tags: security

itwbennett writes "Researchers at the University of California, San Diego, and the University of Washington have identified a handful of ways a hacker could break into a car, including attacks over the car's Bluetooth and cellular network systems, or through malicious software in the diagnostic tools used in automotive repair shops. But their most interesting attack focused on the car stereo. By adding extra code to a digital music file, they were able to turn a song burned to CD into a Trojan horse. When played on the car's stereo, this song could alter the firmware of the car's stereo system, giving attackers an entry point to change other components on the car. This type of attack could be spread on file-sharing networks without arousing suspicion, they believe. 'It's hard to think of something more innocuous than a song,' said Stefan Savage, a professor at the University of California."

Read more of this story at Slashdot.
Verizon Offers Refunds For Fraudulent SMS Messages

Posted: March 10th, 2011, 2:09pm CET by samzenpus

Tags: security

itwbennett writes "Verizon has filed a lawsuit against a group of people and related companies that it alleges duped people into signing up and getting charged for premium short message services. Because some of the short message programs the defendants set up complied with Verizon's rules, Verizon says it is unable to identify which customers didn't know about the charges for the services. As a result it has set up a Web page where customers can file a claim form and get reimbursed if they were wrongly charged for the services."

Read more of this story at Slashdot.
Book Review: Social Engineering: The Art of Human Hacking

Posted: March 9th, 2011, 9:13pm CET by samzenpus

Tags: security

brothke writes "One can sum up all of Social Engineering: The Art of Human Hacking in two sentences from page 297, where author Christopher Hadnagy writes 'tools are an important aspect of social engineering, but they do not make the social engineer. A tool alone is useless; but the knowledge of how to leverage and utilize that tool is invaluable.' Far too many people think that information security and data protection is simply about running tools, without understanding how to use them. In this tremendous book, Hadnagy shows how crucial the human element is within information security." Keep reading for the rest of Ben's review.

Read more of this story at Slashdot.
Researcher Blows $15K By Reporting Bug To Google

Posted: March 9th, 2011, 1:53am CET by timothy

Tags: security

CWmike writes "A security researcher lost a sure $15,000 at this week's Pwn2Own hacking contest because he had earlier reported the bug to Google, which has patched the vulnerability in its Android Market. 'I missed out money wise,' said Jon Oberheide, co-founder and CTO of Duo Security, a developer of two-factor authentication software. 'But it was good that Google is rewarding researchers. And now I have my first Android vulnerability that qualified for a bounty.' Google cut a check to Oberheide for $1,337."

Read more of this story at Slashdot.
Hackers Target French Government Computers For G20

Posted: March 7th, 2011, 5:48pm CET by CmdrTaco

Tags: security

An anonymous reader wrote in to say that "IT staff spent the weekend in a massive cleaning to remove traces of 'spectacular' attack on computer at Bercy, headoffice of the French Ministry of Economy, Finance and Industry Ministry, a government minister said Monday."

Read more of this story at Slashdot.
Hackers Target French Government Computers For G20

Posted: March 7th, 2011, 5:48pm CET by CmdrTaco

Tags: security

An anonymous reader wrote in to say that "IT staff spent the weekend in a massive cleaning effort to remove traces of a 'spectacular' attack on computers at Bercy, the head office of the French Ministry of Economy, Finance and Industry, a government minister said Monday."

Read more of this story at Slashdot.
Russian Payment Processor Runs Massive Scareware Operation

Posted: March 4th, 2011, 7:40pm CET by Unknown Lamer

Tags: security

An anonymous reader writes "Brian Krebs has posted a deep dive through more than a year worth of emails leaked from ChronoPay, Russia's largest online credit card processor. The ... evidence indicates that ChronoPay executives created scareware companies from the ground up, paying for everything from their domain name registration to virtual hosting, to setting up the front companies and associated bank accounts and the 1-800 support lines for entire scareware operations that typically netted the company millions in revenue for each scam."

Read more of this story at Slashdot.
Malware Declines, Trojans Dominate

Posted: March 3rd, 2011, 2:48pm CET by CmdrTaco

Tags: security

Orome1 writes "According to data gathered by Panda Security, only 39 percent of computers scanned in February were infected with malware, compared to 50 percent last month. Trojans were found to be the most prolific malware threat, responsible for 61 percent of all cases, followed by traditional viruses and worms which caused 11.59 percent and 9 percent of cases worldwide, respectively. These figures have hardly changed with respect to the January data."

Read more of this story at Slashdot.
Google Pulls 21 Malware Apps From Android Market

Posted: March 2nd, 2011, 3:28pm CET by CmdrTaco

Tags: security

Hugh Pickens writes writes "CNN reports that Google has pulled 21 free apps from the Android Market that, according to the company, are aimed at gaining root access to the user's device, gathering a wide range of available data, and downloading more code without the user's knowledge. Unfortunately although Google has moved swiftly to remove the apps, they have already been downloaded by at least 50,000 Android users. The apps are all pirated versions of popular games and utilities which once downloaded, root the user's device using a method like rageagainstthecage, then use an Android executable file (APK) to nab user and device data, such as your mobile provider and user ID, and finally act as a wide-open backdoor for your device to quietly download more malicious code. 'If you've downloaded one of these apps, it might be best to take your device to your carrier and exchange it for a new one, since you can't be sure that your device and user information is truly secure,' writes Jolie O'Dell. 'Considering how much we do on our phones — shopping and mobile banking included — it's better to take precautions.'"

Read more of this story at Slashdot.
Contents of Leaked HBGary Emails Reveal Wrongdoing

Posted: March 1st, 2011, 9:14pm CET by CmdrTaco

Tags: security

chargersfan420 writes "Ars Technica has sifted through the contents of the HBGary emails leaked last week in the attack by Anonymous and posted an interesting story about some of the things they were up to (which include rootkit development, selling rootkits to the private sector, and an entire list of 0-day exploits in a variety of OSes and other software, among a variety of other devious plans). Today they are reporting a democratic push for a congressional investigation of HBGary Federal."

Read more of this story at Slashdot.
HBGary Federal CEO Aaron Barr Steps Down

Posted: February 28th, 2011, 10:46pm CET by CmdrTaco

Tags: security

Gunkerty Jeb writes "Embattled CEO Aaron Barr says he is stepping down from his post at HBGary Federal to allow the company to move on after members of the online mischief making group Anonymous hacked into HBGary Federal's computer network and published tens of thousands of company e-mail messages on the Internet. In an interview with Threatpost, Barr said that he is stepping down to allow himself and the company he ran to move on in the wake of the high profile hack."

Read more of this story at Slashdot.
20 Years of Innovative Windows Malware

Posted: February 28th, 2011, 9:15pm CET by CmdrTaco

Tags: security

snydeq writes "InfoWorld's Woody Leonhard takes a look at the past 20 years of innovative Windows malware — an evolution that provides insights into the kinds of attacks to come. From macro viruses, to interstitial infections, to spray attacks, to industrial espionage, 'there's been a clear succession, with the means, methods, and goals changing definitively over time,' Leonhard writes, outlining the rise of Windows malware as a succession of ingenious breakthroughs to nefarious ends."

Read more of this story at Slashdot.
Apple Asks Security Experts To Examine OS X Lion

Posted: February 27th, 2011, 9:35pm CET by samzenpus

Tags: security

An anonymous reader writes "For as much as Mac OS X has a reputation for being safer than Windows, security researchers won't hesitate to point out that the opposite is, in fact, true. But Apple's looking to change that. This past Thursday, Apple doled out a beta of OS X Lion to developers. In conjunction with that, Apple is also reaching out to noted security experts and offering them free previews of OS X 10.7 so that they can take a look at Apple's new security measures and reach back to Apple with any thoughts and concerns they might have. Indeed, Apple is becoming a lot more security conscious these days, not only in terms of reaching out to security researchers but also in its personnel hires."

Read more of this story at Slashdot.
IT Graduates Not "Well-Trained, Ready-To-Go"

Posted: February 27th, 2011, 6:06pm CET by samzenpus

Tags: security

coondoggie writes "There is a disconnect between students getting high-tech degrees and what employers are looking for in those graduates. Employers agree that colleges and universities need to provide their students with the essential skills required to run IT departments, yet only 8% of hiring managers would rate IT graduates hired as 'well-trained, ready-to-go,' according to a survey of 376 organizations that are members of the IBM user group Share and Database Trends and Applications subscribers."

Read more of this story at Slashdot.
New Internal Cavity X-ray Technology for Airports

Posted: February 24th, 2011, 6:53pm CET by samzenpus

Tags: security

Thanks to a new type of X-ray scanner unveiled in Australia, annoyed TSA agents won't have to send you to a hospital for a body cavity scan, they can do it in-house. Officials say that more than 4,600 man-hours were wasted last year in hospitals waiting for scans. From the article: "Home Affairs Minister Brendan O'Connor said the scanners would also help innocent travelers. 'The option of an internal body scan will more quickly exonerate the innocent and ensure a minimum of delay for legitimate travelers,' Mr O'Connor said."

Read more of this story at Slashdot.
Wikileaks Opens Official Online Store

Posted: February 23rd, 2011, 10:28pm CET by samzenpus

Tags: security

siliconbits writes "You can now buy officially branded Julian Assange T-Shirts, cups, netbook sleeves or bags and contribute financially to the Wikileaks fight. From the article: 'Wikileaks is looking to generate more revenue by launching an online shop that is run by Spreadshirt AG. Supporters of Julian Assange and the Wikileaks cause will be able to buy a variety of products like shirts, messenger bags, hats, buttons, scarves etc.'"

Read more of this story at Slashdot.
Mobile Spyware Conferences Into Your Calls

Posted: February 23rd, 2011, 5:39pm CET by CmdrTaco

Tags: security

wiredmikey writes "Reports of Multiple Variants of Android Virus 'Hong Tou Tou' are showing up, which has mainly been working its way onto smartphones via alternative app marketplaces. Today, we saw reports of a new variant of spyware "Spy.Felxispy" targeting Symbian devices, identified by the National Computer Virus Emergency Response Centre of China. More than a dozen variants of the spyware have emerged since the first was spotted, and the latest has affected 150,000+ devices. Once installed, the spyware will turn on the Conference Call feature of the device without users' awareness. When users are making phone calls, the spyware automatically adds itself to the call to monitor the conversation."

Read more of this story at Slashdot.
High Severity BIND Vulnerability Advisory Issued

Posted: February 23rd, 2011, 4:15pm CET by CmdrTaco

Tags: security

wiredmikey writes "The Internet Systems Consortium (ISC) and US-CERT have issued a high severity vulnerability warning, discovered by Neustar, which affects BIND, the most widely used DNS software on the Internet. Successful exploitation could enable attacker to cause Bind servers to stop processing all requests. According to the disclosure, 'When an authoritative server processes a successful IXFR transfer or a dynamic update, there is a small window of time during which the IXFR/update coupled with a query may cause a deadlock to occur. This deadlock will cause the server to stop processing all requests. A high query rate and/or a high update rate will increase the probability of this condition.'"

Read more of this story at Slashdot.
Financial Malware Hijacks Online Banking Sessions

Posted: February 22nd, 2011, 4:26pm CET by CmdrTaco

Tags: security

Orome1 writes "A new type of financial malware has the ability to hijack customers' online banking sessions in real time using their session ID tokens. The OddJob Trojan keeps sessions open after customers think they have 'logged off,' enabling criminals to extract money and commit fraud unnoticed. This is a completely new piece of malware that pushes the hacking envelope through the evolution of existing attack methodologies. It shows how hacker ingenuity can side-step many commercial IT security applications traditionally used to defend users' digital — and online monetary — assets."

Read more of this story at Slashdot.
Testing Free English Anti-Malware On Non-English Threats

Posted: February 22nd, 2011, 6:17am CET by Soulskill

Tags: security

An anonymous reader writes "Brazilian technology news site O Globo posted an interesting comparison on how free anti-malware behaves against non-English threats (Google translation of Portuguese original). By using a database of over 3000 samples from Brazil's Security Incident Contact Center, the numbers are quite different from all US anti-malware reviews. While Avira achieved the best score, 78%, Microsoft Security Essentials stopped less than 14%. This can be a headache for some large multinational corporations, whose IT departments deploy US anti-malware on the entire network, but have network segments outside US with many 'unknown' threats roaming around. I wonder what the results would be in other countries."

Read more of this story at Slashdot.
Industry IT Security Certification Proposed

Posted: February 20th, 2011, 1:33am CET by Soulskill

Tags: security

Roberto123 writes "The US can build defenses against 'cyberwar' by having government and the private sector work together to confront the threat, a panel of experts said at RSA Conference 2011 in San Francisco this week. 'Chertoff called for a regulatory framework where company executives and board members sign on the dotted line, certifying what steps they have taken to secure their network, what backup systems they have in place and what level of resiliency is built into their IT system. “People take that seriously. Is it dramatic? No, but it moves the ball down the field,” Chertoff said. Schneier concurred, noting that holding individuals at a company accountable for certain protections has worked with environmental regulations and Sarbanes-Oxley, the post-Enron law that requires directors and executives to certify their financial results.'"

Read more of this story at Slashdot.
National Security Jobs To Rival Silicon Valley Over the Next 10 Years?

Posted: February 19th, 2011, 12:10am CET by Soulskill

Tags: security

AHuxley writes "The Capital reports on a new cyber curriculum at a Maryland high school to feed the ever growing needs of the NSA and Cyber Command. A quote from Dutch Ruppersberger (D-MD) about job growth in the local national security sector stands out: '... in 10 years, there are going to be more tech jobs than Silicon Valley.' Could the new funding for the expansion of the National Security Agency and the Army's new Cyber Command be the next big growth area for the US?"

Read more of this story at Slashdot.
80% of Browsers Found To Be At Risk of Attack

Posted: February 17th, 2011, 7:00pm CET by CmdrTaco

Tags: security

CWmike writes "About eight out of every 10 Web browsers run by consumers are vulnerable to attack by exploits of already-patched bugs, a security expert said Thursday. The poor state of browser patching stunned Wolfgang Kandek, CTO of Qualys, which presented data from the company's free BrowserCheck service Wednesday at RSA. 'I really thought it would be lower,' Kandek said. BrowserCheck scans Windows, Mac and Linux machines for vulnerable browsers, as well as up to 18 browser plug-ins, from Adobe's Flash to Windows Media Player. When browsers and plug-ins are tabulated together, between 90% and 65% of all consumer systems scanned with BrowserCheck since June 2010 reported at least one out-of-date component. In January 2011, about 80% of the machines were vulnerable. The most likely plug-in to require a patch: same as last year, Oracle's Java."

Read more of this story at Slashdot.
10% of IT Pros Can Access Previous Jobs' Accounts

Posted: February 17th, 2011, 2:49pm CET by CmdrTaco

Tags: security

dinscott writes "According to a survey that examines how IT professionals and employees view the use of policies and technologies to manage and protect users' electronic identities, the sharing of work log-ins and passwords between co-workers is a regular occurrence. It's no wonder then that half of them are concerned about insider threats to network security in their company's current infrastructure! But one of the most surprising results shows that one in 10 IT professionals admit they have accounts from previous jobs, from which they can still access systems even though they've left the organization."

Read more of this story at Slashdot.
Anatomy of the HBGary Hack

Posted: February 17th, 2011, 3:49am CET by samzenpus

Tags: security

PCM2 writes "Recently, Anonymous took down the Web sites of network security firm HBGary. Ars Technica has the scoop on how it happened. Turns out it wasn't any one vulnerability, but a perfect storm of SQL injection, weak passwords, weak encryption, password re-use, unpatched servers, and social engineering. The full story will make you wince — but how many of these mistakes is your company making?"

Read more of this story at Slashdot.
Pentagon To Spend $500 Million On Cyber Defense

Posted: February 16th, 2011, 5:01pm CET by CmdrTaco

Tags: security

hostedftp found a story about the Pentagon's plan to shell out half a billion dollars on cyber defense in the next year. The article says, "The $500 million is part of the Pentagon's 2012 budget request of $2.3 billion to improve the Defense Department's cyber capabilities."

Read more of this story at Slashdot.
Attacked By Anonymous, HBGary Pulls Out of RSA

Posted: February 16th, 2011, 4:18pm CET by CmdrTaco

Tags: security

itwbennett writes "HBGary Federal cancelled a talk the company's CEO Aaron Barr was planning to give at the BSides San Francisco conference on his investigation of WikiLeaks. 'I was receiving death threats,' Barr said in an interview Tuesday. 'There was lots of talk that was being made of in the Anonymous IRC channels of harassing us at our booth and sending people to heckle [HBGary speakers at the conference].' The company has also decided to pull its booth from the RSA Conference floor after it was vandalized on Sunday, said Jim Butterworth, HBGary's vice president of services. 'We... came back the next morning and it was very apparent that the group responsible for the activities in the news had decided to make another statement,' he said."

Read more of this story at Slashdot.
Keys Leaking Through the Air At RSA

Posted: February 15th, 2011, 10:41pm CET by CmdrTaco

Tags: security

NumberField writes "The RSA Conference is underway in San Francisco. A theme among the opening speakers is that the attackers are winning, and even well-funded organizations like NASDAQ can't secure their networks reliably. The show floor is lively, but dominated by the typical firewalls and 'compliance solutions.' One interesting exception is a scary side-channel analysis demo in the Cryptography Research booth using GNU Radio to capture secret keys from various smartphones from about 10 feet away. (The method is related to early computer music using AM radio interference.)"

Read more of this story at Slashdot.
The Seven Types of Hackers

Posted: February 15th, 2011, 9:13pm CET by CmdrTaco

Tags: security

Bruce Schneier's blog links to a nifty article listing the seven types of malicious hackers. The list is: Cyber criminals; Spammers and adware spreaders; Advanced persistent threat (APT) agents; Corporate spies; Hactivists; Cyber warriors; and Rogue hackers.

Read more of this story at Slashdot.
US Secret Service Virtualizes Tiny Town

Posted: February 15th, 2011, 7:46pm CET by CmdrTaco

Tags: security

An anonymous reader writes "For the past 40 years, a miniature model environment called 'Tiny Town' has been one of the methods used to teach Secret Service agents and officers how to prepare a site security plan. The model includes different sites — an airport, outdoor stadium, urban rally site and a hotel interior — and uses scaled models of buildings, cars and security assets. With help from the Department of Homeland Security's Science & Technology Directorate, the Secret Service is giving training scenarios a high-tech edge: moving from static tabletop models to virtual kiosks with gaming technology and 3D modeling."

Read more of this story at Slashdot.
Stuxnet Struck Five Targets In Iran

Posted: February 15th, 2011, 4:51pm CET by CmdrTaco

Tags: security

Batblue writes "Researchers at Symantec said that the notorious Stuxnet worm targeted five separate organizations, and attacks against those objectives — all with a presence in Iran — started in June 2009, more than a year before independent experts raised the alarm."

Read more of this story at Slashdot.
Anonymous Claims Possession of Stuxnet Worm

Posted: February 13th, 2011, 3:29pm CET by timothy

Tags: security

An anonymous reader writes "Last night, a member of hacker group Anonymous announced on Twitter that the group was in possession of the Stuxnet worm. Recently, Anonymous has been in the news for its high profile attacks on software security firm HBGary, after Aaron Barr, the CEO of HBGary's sister firm HBGary Federal, claimed to have acquired the names of senior Anonymous members and threatened to release them to the public. This is where the possibility for Anonymous getting its hands on Stuxnet increases."

Read more of this story at Slashdot.
Chinese Hackers Strike Energy Companies

Posted: February 10th, 2011, 11:48pm CET by timothy

Tags: security

angry tapir writes "Chinese hackers working regular business hours shifts stole sensitive intellectual property from energy companies for as long as four years using relatively unsophisticated intrusion methods in an operation dubbed 'Night Dragon,' according to a new report from security vendor McAfee." Reader IT.luddite links this informative PDF from CERT.

Read more of this story at Slashdot.
DARPA Wants To Know How Stories Influence People

Posted: February 10th, 2011, 4:16pm CET by samzenpus

Tags: security

coondoggie writes "DARPA in a nutshell wants to know how stories or narratives influence human behavior. To this end, they are hosting a workshop called 'Stories, Neuroscience and Experimental Technologies (STORyNET): Analysis and Decomposition of Narratives in Security Contexts,' on Feb. 28th to discuss the topic. 'Stories exert a powerful influence on human thoughts and behavior. They consolidate memory, shape emotions, cue heuristics and biases in judgment, influence in-group/out-group distinctions, and may affect the fundamental contents of personal identity. It comes as no surprise that these influences make stories highly relevant to vexing security challenges such as radicalization, violent social mobilization, insurgency and terrorism, and conflict prevention and resolution. Therefore, understanding the role stories play in a security context is a matter of great import and some urgency," DARPA stated.'"

Read more of this story at Slashdot.
Using War Games To Make Organizations More Secure

Posted: February 10th, 2011, 2:07pm CET by samzenpus

Tags: security

wiredmikey writes "Along with budget constraints and disconnect between IT and executive management surrounding information security, results of a recent survey show that a major problem is outright lack of understanding of threats. We all know the best way to get that budget increased, is to get hacked. Unfortunately, that could also result in you losing your job. Some companies, however, are taking creative approaches to both raise awareness and identify potential vulnerabilities. A manager with a large financial services group, for example, says that his company addresses security vulnerabilities by staging a series of what it calls 'war games,' in which a user or group of users is tasked with trying to compromise a system, while another user or group of users is tasked with preventing the break-in. Management needs to understand the security threat and its impact to business, and these 'war games' are an innovative and creative way for IT departments to convince executive management on security needs."

Read more of this story at Slashdot.
Microsoft Kills AutoRun In Windows

Posted: February 10th, 2011, 2:56am CET by samzenpus

Tags: security

aesoteric writes "Microsoft has finally decided to push out an update to disable AutoRun in its XP operating system, a Windows feature that had been increasingly exploited by virus writers over the years. But because Microsoft still sees AutoRun as a feature and not a security hole, it isn't calling its Windows Update a "security update" but rather an "Important, non-security update" — but it effectively disables the AutoRun feature anyway."

Read more of this story at Slashdot.
Are You Sure SHA-1+Salt Is Enough For Passwords?

Posted: February 9th, 2011, 2:47pm CET by CmdrTaco

Tags: security

Melchett writes "It's all too common that Web (and other) applications use MD5, SHA1, or SHA-256 to hash user passwords, and more enlightened developers even salt the password. And over the years I've seen heated discussions on just how salt values should be generated and on how long they should be. Unfortunately in most cases people overlook the fact that MD and SHA hash families are designed for computational speed, and the quality of your salt values doesn't really matter when an attacker has gained full control, as happened with rootkit.com. When an attacker has root access, they will get your passwords, salt, and the code that you use to verify the passwords."

Read more of this story at Slashdot.
HBGary Federal Hacked By Anonymous

Posted: February 7th, 2011, 3:23pm CET by CmdrTaco

Tags: security

An anonymous reader writes "As the coin was tossed to kick off Superbowl XLV, Anonymous unleashed their anger at a security firm who had been investigating their membership. HBGary Federal had been working on unmasking their identities in cooperation with an FBI investigation into the attacks against companies who were cutting off WikiLeaks access and financing. Unlike the DDoS attacks for which Anonymous has made headlines in recent months, this incident involved true hacking skills."

Read more of this story at Slashdot.
Adobe's Reader X Spoils New PDF Attack

Posted: February 5th, 2011, 1:08am CET by timothy

Tags: security

CWmike writes "Gregg Keizer reports that Adobe's Reader X stymied a recent attack campaign, researchers said Thursday. But they're not sure why. 'I don't want to take anything away from Adobe — after all, a win is a win — but this particular exploit appears to be designed with previous versions of Reader in mind,' said Chris Greamo, who heads the security research lab at Invincea. 'What appears to have happened is that the exploit breaks, but we don't have a good sense if the sandbox was able to contain it.' Reader X, an upgrade issued last year, features a 'sandbox' designed to protect users from PDF exploits. Adobe claimed that a recently-addressed bug in Chrome that lets attackers escape the browser's sandbox was not present in Reader X's sandbox code. Google patched that bug, the first to earn the company's top bug bounty of $3,133, three weeks ago. Adobe said Thursday it will would ship its next regular update for Reader on Tuesday, Feb. 8."

Read more of this story at Slashdot.
Next-Generation Banking Malware Emerges After Zeus

Posted: February 4th, 2011, 6:29pm CET by Soulskill

Tags: security

Batblue writes "The rumored combination of two pieces of advanced online banking malware appears to be fully underway after several months of speculation. What appears to be a beta version of a piece of malware that has bits of both Zeus and SpyEye is now in circulation, albeit among just a few people, said Aviv Raff, CTO and cofounder of Seculert. Seculert has published screen shots of the new malware, which has two versions of a control panel used for managing infected computers. One of those control panels resembles one in Zeus, and the other resembles that in SpyEye. Both of the control panels are connected to the same back-end command-and-control server, he said."

Read more of this story at Slashdot.
Israeli Company Trains Security Mice

Posted: February 3rd, 2011, 4:43pm CET by samzenpus

Tags: security

Israeli scientists have created an explosive detector using specially trained mice. Researchers claim the mice are more accurate than dogs or x-ray machines and best of all, they work for peanuts. From the article: "The device was tested last year on 1,000 shoppers in a Tel Aviv shopping mall when the mice successfully picked out 22 people carrying mock explosives."

Read more of this story at Slashdot.
Attacks Targeting Classified Ad Sites Surge

Posted: February 2nd, 2011, 4:02pm CET by CmdrTaco

Tags: security

wiredmikey writes "Despite spam levels being at their lowest since March 2009, metrics released by the APWG indicate that cybercriminals are cultivating an array of alternative attack schemes, and in particular, increasing attacks on the online classified services sector with phishing attacks. Though the online payment services sector remained the most targeted industry with 38 percent of detected attacks in Q2, the classified ads services sector experienced rapid growth in phishing attacks."

Read more of this story at Slashdot.
Firewalls Make DDoS Attacks Worse

Posted: February 1st, 2011, 7:10pm CET by CmdrTaco

Tags: security

jfruhlinger writes "Firewalls are an important part of any network setup — but if you put them in front of your Web servers, they become a single point of failure in the event of a DDoS attack. "Folks do it because they have been programmed to do it," says one security expert, but he urges you to avoid this setup at all costs."

Read more of this story at Slashdot.
DDoS Attacks Exceed 100 Gbps For First Time

Posted: February 1st, 2011, 5:00pm CET by CmdrTaco

Tags: security

wiredmikey writes "The Sixth Annual Worldwide Infrastructure Security Report, released today by Arbor Networks, revealed that DDoS attack size broke 100 Gbps for first time; up 1000% since 2005. In addition to hitting the 100 Gbps attack barrier for the first time, application layer attacks hit an all-time high. Additionally, it goes on to show that as new equipment, protocols and services are introduced into networks, the vulnerable attack surface for DDoS is expanded. DDoS attacks are likely to continue as a low cost, high-profile form of cyber-protest in 2011 and beyond."

Read more of this story at Slashdot.
Kaspersky Source Code In the Wild

Posted: January 31st, 2011, 11:04pm CET by Soulskill

Tags: security

mvar writes "The source code of an older version of 'Kaspersky Internet Security' has been circulated on the internet. The code was created in late 2007 and was probably stolen in early 2008. Names contained in the source indicate that the stolen code was probably a beta version of the 2008 software package – the current release is Kaspersky Internet Security 2011. According to a Russian language report by CNews (Google translation), the code was copied by a disgruntled ex-employee. The thief has reportedly been trying to sell the code on the black market for some time, and Kaspersky says that the code archive already appeared in various private forums last November."

Read more of this story at Slashdot.
PlentyofFish Hacked, Founder Emails Hacker's Mom

Posted: January 31st, 2011, 8:06pm CET by Soulskill

Tags: security

hellkyng writes "The online dating site PlentyofFish was hacked, and purportedly 30 million customer records were stolen. The site's founder, Markus Frind, is blaming the security researcher who discovered the vulnerability and the journalist who confirmed the issue." The researcher who reported the vulnerability is Chris Russo, one of the guys who hacked The Pirate Bay last year. He explained his side of the story as well. Mr. Frind says he tracked down Russo's Facebook page and emailed his mom.

Read more of this story at Slashdot.
Windows MHTML Vulnerability Warning From Microsoft

Posted: January 31st, 2011, 3:33pm CET by CmdrTaco

Tags: security

jhernik writes "An HTML scripting bug impacting all supported versions of Windows is receiving Microsoft's attention Microsoft issued an advisory on a Windows security vulnerability today after exploit code for the bug went public. The bug, which lies in the MIME Encapsulation of Aggregate HTML (MHTML) protocol handler, can be exploited to cause data leakage. Though proof-of-concept code for the vulnerability has already gone public, the company said it is unaware of any attempts to exploit the bug." This might seem familiar to you, but considering how many times I saw it submitted this morning, it probably doesn't ;)

Read more of this story at Slashdot.
Amazon Flaw Lets Password Variants Through

Posted: January 29th, 2011, 1:17am CET by timothy

Tags: security

Wired reports that it has confirmed a password flaw affecting some Amazon accounts. If your password hasn't been changed in a while ("the past several years"), it may be less secure than you'd like. As Wired explains, for these older accounts, "[...] if your password is “Password,” Amazon.com will also let you log in with 'PASSWORD,' 'password,' 'passwordpassword,' and 'password1234.'" The article suggests that Amazon's use of the Unix crypt() tool may be at fault. (Hat tip to E. Maureen Foley for pointing this out.)

Read more of this story at Slashdot.
FBI Executes 40 Search Warrants For 'Anonymous'

Posted: January 28th, 2011, 10:34pm CET by Soulskill

Tags: security

CWmike writes "Police agencies worldwide are turning up the heat on a loosely organized group of WikiLeaks activists. After yesterday's news that UK police arrested five people, US authorities announced that more than 40 search warrants have been executed in the US in connection with last month's Web-based attacks against companies that had severed ties with WikiLeaks. Investigations are also ongoing in the Netherlands, Germany and France, the FBI said Thursday. Acting on information from German authorities, the FBI raided Dallas ISP Tailor Made Services last month, looking for evidence relating to one of the chat servers used by Anonymous. Another server was traced to Fremont, California's Hurricane Electric. On Thursday, a Web page used by Anonymous to coordinate this latest round of DDoS attacks was offline, and the group's Twitter and Blogspot pages were silent." Reader Ajehals contributes a link to the UK Pirate Party's explanation of how the law applies to DDoS attacks.

Read more of this story at Slashdot.
Bomb Detecting Plants To Root Out Terrorists

Posted: January 28th, 2011, 9:54pm CET by samzenpus

Tags: security

Hugh Pickens writes writes "The Denver Post Reports that a biologist at Colorado State University has re-engineered plants so that they can detect explosives, air pollution and toxic chemicals, signaling the presence of potentially deadly vapors by turning from green to white. 'If you take something into Denver International Airport, like an explosive for a plane, my plants are going to turn white,' says June Medford, who developed the system. 'That's going to get the security guys on you.' Military and Homeland Security research directors say they envision wide applications for the genetically modified plants positioned in buildings, war zones and cities where terrorists could set up covert bomb-making factories and add that strategic placement of the plants could help reach a goal of deploying a decentralized, nationwide system for detecting explosives. 'Our hope is if these plants could be located ubiquitously, we might be able to detect explosives at the point they are being assembled,' says Doug Bauer, the Homeland Security explosives research program manager. 'You would have a much greater opportunity for first-responders to interdict and disrupt that activity.'"

Read more of this story at Slashdot.
Police Arrest Five Over Anonymous Attacks

Posted: January 27th, 2011, 3:32pm CET by CmdrTaco

Tags: security

nk497 writes "Five people have been arrested in the UK, accused of taking part in Anonymous' DDOS attacks in support of WikiLeaks. The five men — aged from 15 to 26 — are still being held by police for questioning. Met Police said the investigation was a collaborative effort between forces in the UK, EU and the US."

Read more of this story at Slashdot.
Hackers Bringing Telnet Back

Posted: January 27th, 2011, 2:52pm CET by CmdrTaco

Tags: security

alphadogg writes "A new report from Akamai Technologies (CT: Requires login) shows that hackers appear to be increasingly using the Telnet remote access protocol to attack corporate servers over mobile networks. The report, which covers the third quarter of 2010, shows that 10 percent of attacks that came from mobile networks are directed at Port 23, which Telnet uses. That marks a somewhat unusual spike for the aging protocol used to log into remote servers but that has been gradually replaced by SSH."

Read more of this story at Slashdot.
Spam Levels Lowest Since 2009

Posted: January 25th, 2011, 8:00pm CET by CmdrTaco

Tags: security

wiredmikey writes "Following a two-week dramatic decline in spam levels, spam now accounts for 78.6 percent of all email traffic, the lowest rate since March 2009, when the global spam rate was 75.7 percent of all email traffic, according to Symantec's January 2011 MessageLabs Intelligence Report, released today. The volume of spam in circulation this month was 65.9% lower than for the same period one year ago, in January 2010, when the spam rate was 83.9% of all email traffic."

Read more of this story at Slashdot.
Ex-NSA Analyst To Be Global Security Head At Apple

Posted: January 25th, 2011, 1:25am CET by Soulskill

Tags: security

AHuxley writes "Cnet.com reports that Apple has tapped security expert and author David Rice to be its director of global security. Rice is a 1994 graduate of the US Naval Academy and has a master's degree in Information Warfare and Systems Engineering from the Naval Postgraduate School. He served as a Global Network Vulnerability analyst (Forbes used cryptographer) for the National Security Agency and as a Special Duty Cryptologic officer for the Navy. He is executive director of the Monterey Group, a cybersecurity consulting firm. He's also on the faculty of IANS, an information security research company and works with the US Cyber Consequences Unit. In a 2008 interview with Forbes, 'A Tax On Buggy Software,' Rice talks of a 'tax on software based on the number and severity of its security bugs. Even if that means passing those costs to consumers. ... Back in the '70s, the US had a huge problem with sulfur dioxide emissions. Now we tax those emissions, and coal power plants have responded by using better filters. Software vulnerabilities, like pollution, are inevitable — producing perfect software is impossible. So instead of saying all software must be secure, we tax insecurity and allow the market to determine the price it's willing to pay for vulnerability in software. Those who are the worst "emitters" of vulnerabilities end up paying the most, and it creates an economic incentive to manufacture more secure software.'"

Read more of this story at Slashdot.
Computer Incident Response and Product Security

Posted: January 24th, 2011, 8:30pm CET by samzenpus

Tags: security

brothke writes "When someone calls 911 in a panic to report an emergency, within seconds the dispatcher knows where the call is coming from, and help is often only moments away. When it comes to computer security incidents, often companies are not as resilient in their ability to quickly respond. Take for instance the TJX Cos. data breach, where insecure wireless networks were compromised for months, revealing millions of personal records, before they were pinpointed and finally secured. Once made aware of the issue, it took TJX an additional few months until the situation was completely in control and secured. In Computer Incident Response and Product Security, author Damir Rajnovic provides the reader with an excellent and practical guide to the fundamentals of building and running a security incident response team. The book is focused on getting the reader up to speed as quick as possible and is packed with valuable real-world and firsthand guidance." Read on for the rest of Ben's review.

Read more of this story at Slashdot.
Terrorists Bomb Moscow Airport

Posted: January 24th, 2011, 7:49pm CET by Soulskill

Tags: security

jayme0227 writes "Terrorists detonated a bomb at Moscow's busiest airport on Monday, killing 35 people and wounding another 152, Russian authorities said. President Dmitry Medvedev, who called the bombing a terrorist attack, ordered additional security at Moscow's other airports and transportation hubs, and Moscow police went on high alert in case of additional bombs." According to the NY Times, "The airport remained open on Monday evening, and passengers continued to flow through the hall where the bomb had exploded."

Read more of this story at Slashdot.
New Mega-Leak Reveals Middle East Peace Process

Posted: January 24th, 2011, 1:14am CET by samzenpus

Tags: security

An anonymous reader writes "There's been yet another mega-leak, this time of 1,600 papers describing the Israeli/Palestinian peace process negotiations. It's independent of Wikileaks and came to light via al-Jazeera, showing perhaps that the mega-leak meme is here to stay whatever happens to Assange. The papers show a weak Palestinian side offering ever greater concessions to Israel, which flatly rejected this as being insufficient: 'We do not like this suggestion because it does not meet our demands,' Israel's then foreign minister, Tzipi Livni, told the Palestinians, 'and probably it was not easy for you to think about it, but I really appreciate it.'"

Read more of this story at Slashdot.
UK Cosmetic Retailer Lush Targeted By Hackers

Posted: January 22nd, 2011, 8:02am CET by timothy

Tags: security

Tasha26 writes "Cosmetic retailer Lush stopped its online activities on Jan 21 due to hacking activities. Their website is still down due to 'continuing attempts to re-enter,' and Lush is thinking of spinning a small PayPal outlet as a temporary solution. The company is urging customers who placed an order between Oct 2010 and Jan 2011 to contact their banks for advice on compromised credit card details. The company even posted a message addressed to the hacker, saying, 'If you are reading this, our web team would like to say that your talents are formidable. We would like to offer you a job — were it not for the fact that your morals are clearly not compatible with ours or our customers.'"

Read more of this story at Slashdot.
Espionage In Icelandic Parliament

Posted: January 21st, 2011, 1:35am CET by timothy

Tags: security

bumburumbi writes "An unauthorised computer, apparently running encrypted software, was found hidden inside an unoccupied office in the Icelandic Parliament, Althingi, connected to the internal network. According to the Reykjavik Grapevine article, serial numbers had been removed and no fingerprints were found. The office had been used by substitute MPs from the Independence Party and The Movement, the Parliamentary group of Birgitta Jonsdottir, whose Twiiter account was recently subpoenaed by US authorities. The Icelandic daily Morgunbladid, under the editorship of Mr David Oddsson, former Prime Minister and Central Bank chief, has suggested that this might be an operation run by Wikileaks. The reporter for the Reykjavik Grapevine, Mr Paul Nikolov is a former substitute MP, having taken seat in Parliament in 2007 and 2008."

Read more of this story at Slashdot.
PC Virus Turns 25

Posted: January 19th, 2011, 4:48pm CET by CmdrTaco

Tags: security

Batblue writes "Happy anniversary Basit and Amjad! Twenty-five years ago this month (CT: Warning, intrusive interstitial ad), the Alvi brothers of Lahore, Pakistan, gave the world the Brain Virus, the first bit of malware capable of infecting a DOS-based PC. Back in those relatively innocent times, the brothers actually embedded their real names and business address in the code and later told Time magazine they had written the virus to protect their medical software from piracy. Who knows what they were really thinking, but by all accounts the Brain Virus was relatively harmless. Twenty-five years later, most malware is anything but benign and cyber criminals pull off exploits the Alvi brothers never envisioned."

Read more of this story at Slashdot.
Criminal Charges Filed Against AT&T iPad Attacker

Posted: January 19th, 2011, 4:05pm CET by CmdrTaco

Tags: security

Batblue writes "The US Department of Justice will file criminal charges against the alleged attackers who copied personal information from the AT&T network of approximately 120,000 iPad users, the US Attorney's Office, District of New Jersey announced Monday. Daniel Spitler will be charged in US District Court in New Jersey with one count of conspiracy to access a computer without authorization and one count of fraud. Andrew Auernheimer will be charged with the same counts at the US Western District Court of Arkansas, which is in Fayetteville. Auernheimer made headlines last June when he discovered that AT&T's website was disclosing the e-mail addresses and the unique ICC-ID numbers of multiple iPad owners. Claiming that he wanted to help AT&T improve its security, he wrote a computer script to extract the data from AT&T and then went public with the information. AT&T said that nobody from Auernheimer's hacking group contacted them about the flaw."

Read more of this story at Slashdot.
Stuxnet Authors Made Key Errors

Posted: January 19th, 2011, 12:45am CET by CmdrTaco

Tags: security

Trailrunner7 writes "There is a growing sentiment among security researchers that the programmers behind the Stuxnet attack may not have been the super-elite cadre of developers that they've been mythologized to be in the media. In fact, some experts say that Stuxnet could well have been far more effective and difficult to detect had the attackers not made a few elementary mistakes."

Read more of this story at Slashdot.
Threat of Cyberwar Is Over-Hyped

Posted: January 17th, 2011, 8:56pm CET by Soulskill

Tags: security

nk497 writes "A new OECD report suggests the cyberwar threat is over-hyped. A pair of British researchers have said states are only likely to use cyberattacks against other states when already involved in military action against them, and that sub-state actors such as terrorists and individual hackers can't really do much damage. Dr. Ian Brown said, 'We think that describing things like online fraud and hacktivism as cyberwar is very misleading.'"

Read more of this story at Slashdot.
Amazon EC2 Enables Cheap Brute-Force Attacks

Posted: January 13th, 2011, 10:50pm CET by timothy

Tags: security

snydeq writes "German white-hat hacker Thomas Roth claims he can crack WPA-PSK-protected networks in six minutes using Amazon EC2 compute power — an attack that would cost him $1.68. The key? Amazon's new cluster GPU instances. 'GPUs are (depending on the algorithm and the implementation) some hundred times faster compared to standard quad-core CPUs when it comes to brute forcing SHA-1 and MD,' Roth explained. GPU-assisted servers were previously available only in supercomputers and not to the public at large, according to Roth; that's changed with EC2. Among the questions Roth's research raises is, what role should Amazon and other public-cloud service providers play in preventing customers from using their services to commit crimes?"

Read more of this story at Slashdot.
Spam Volume Spikes After Holiday Respite

Posted: January 12th, 2011, 12:11am CET by CmdrTaco

Tags: security

Trailrunner7 writes "The amount of spam hitting users' inboxes fell off a cliff in late December, with many security experts attributing the decline to the sudden disappearance of the Rustock botnet and other networks from the spam business. But the level of spam has begun to gain back some of the ground it lost today as other spammers have taken up the slack. Researchers say that after the sudden drop-off in spam volumes, things stayed fairly quiet for a time, but now it seems that other spammers have picked up where Rustock and the other spamming operations left off. The volume of spam took a big jump upward in the last 24 hours, according to researchers at Websense. The volume of spam hasn't made it all the way back to the levels of the last few months of 2010, but it seems to be on the way."

Read more of this story at Slashdot.
Browser Exploit Kits Using Built-In Java Feature

Posted: January 10th, 2011, 5:29pm CET by kdawson

Tags: security

tsu doh nimh writes "Security experts from several different organizations are tracking an increase in Windows malware compromises via Java, although not from a vulnerability in Windows itself: the threat comes from a feature of Java that prompts the user to download and run a Java applet. Kaspersky said it saw a huge uptick in PCs compromised by Java exploits in December, but that the biggest change was the use of this Java feature for social engineering. Brian Krebs writes about this trend, and looks at two new exploit packs that are powered mainly by Java flaws, including one pack that advertises this feature as an exploit that works on all Java versions."

Read more of this story at Slashdot.
Major Security Flaws Discovered In Internet HDTVs

Posted: January 8th, 2011, 4:26pm CET by Soulskill

Tags: security

wiredmikey writes "Security researchers have discovered several security flaws in one of the best-selling brands of Internet-connected HDTVs, and believe it's likely that similar security flaws exist in other Internet TVs. The security researchers were able to demonstrate how an attacker could intercept transmissions from the television to the network using common 'rogue DNS,' 'rogue DHCP server,' or TCP session hijacking techniques. Mocana was able to demonstrate that JavaScript could then be injected into the normal datastream, allowing attackers to obtain total control over the device's Internet functionality."

Read more of this story at Slashdot.
In-Car Technology Becoming More Important Than Horsepower

Posted: January 7th, 2011, 9:55pm CET by Soulskill

Tags: security

Gunkerty Jeb writes "It seems, and I think a lot of people have prophesied this for some time, that in-car features like internet radio and assisted driving technologies are surpassing horsepower, handling and design as automotive selling points. I just hope manufacturers have put in the time to consider all the security dangers that exist in owning internet synthesized cars."

Read more of this story at Slashdot.
Hackers Find New Way To Cheat On Wall Street

Posted: January 6th, 2011, 11:08pm CET by timothy

Tags: security

GMGruman writes "The high-speed trading exchanges that conduct the business of buying and selling stocks and mutual funds are so fast that hackers can introduce delays of a few microseconds completely unnoticed by today's network monitoring technology — and manipulate prices in the process to reap millions of dollars to the detriment of everyone else, InfoWorld's Bill Snyder reports. This kind of activity creates new reason to distrust Wall Street and shows how the computer networks we all rely on for conducting business and moving information are ripe for undetectable hacking."

Read more of this story at Slashdot.
New Cars Vulnerable To Wireless Theft

Posted: January 6th, 2011, 10:20pm CET by timothy

Tags: security

tkrotchko writes "In a story published by Technology Review, researchers have demonstrated multiple times that they can bypass the security of wireless entry and ignition systems to take a car without the owner's permission. As researchers in the article point out, car security systems will begin have a real impact to every day use if a thief can simply walk up to your car and drive it away. Although this article is light on technical details, a companion article shows how the researchers accomplished the security bypass. An interesting read, and certainly something that will no doubt be the subject of a new movie any day now."

Read more of this story at Slashdot.
Kneber Botnet Strikes, Targets Gov't Agencies

Posted: January 6th, 2011, 6:13pm CET by CmdrTaco

Tags: security

Batblue writes "A botnet fingered for stealing a treasure trove of information last year has struck again, harvesting sensitive documents from dozens of government agencies and contractors, according to a pair of security experts. The botnet, dubbed 'Kneber' by Alex Cox, principal research analyst at NetWitness, was behind a campaign of fake Christmas e-mails waged two weeks ago against government workers. NetWitness deals in advanced threat detection technologies, and conducts post mortem network forensics for firms that have been hit with attacks or data breaches."

Read more of this story at Slashdot.
Detailing the Security Risks In PDF Standard

Posted: January 2nd, 2011, 11:16am CET by Soulskill

Tags: security

crabel writes with this quote from the H Online: "At the 27th Chaos Communication Congress in Berlin security researcher Julia Wolf pointed out numerous, previously hardly known security problems in connection with Adobe's PDF standard. For instance, a PDF can reportedly contain a database scanner that becomes active and scans a network when the document is printed on a network printer. Wolf said that the document format is also full of other surprises. For example, it is reportedly possible to write PDFs which display different content in different operating systems, browsers or PDF readers — or even depending on a computer's language settings."

Read more of this story at Slashdot.
Security Researcher Finds Hundreds of Browser Bugs

Posted: January 1st, 2011, 11:50pm CET by Soulskill

Tags: security

An anonymous reader writes "PC Magazine reports on a very understated late night post to the full-disclosure mailing list, in which security researcher Michael Zalewski shared a fuzzing tool reportedly capable of identifying over a hundred browser bugs. Some of these bugs, he says, may be already known to third parties in China. The report also includes an account of how browser vendors fared fixing these flaws so far. Not surprisingly, Microsoft's response timeline appears depressing."

Read more of this story at Slashdot.
Android Trojan Found, Spreading From Chinese App Stores

Posted: December 30th, 2010, 8:51pm CET by timothy

Tags: security

wiredmikey writes that researchers from Lookout Mobile have discovered a sophisticated Trojan targeting Android devices. "The company says the mobile malware is 'The most sophisticated Android malware we've seen to date. Geinimi is also the first Android malware in the wild that displays botnet-like capabilities. Once the malware is installed on a user's phone, it has the potential to receive commands from a remote server that allow the owner of that server to control the phone.' What makes the Trojan different from most 'standard' mobile malware is that Geinimi is being 'grafted' onto repackaged versions of legitimate applications, primarily games, and distributed in third-party Chinese Android app markets."

Read more of this story at Slashdot.
The Significant Decline of Spam

Posted: December 30th, 2010, 3:21pm CET by CmdrTaco

Tags: security

Orome1 writes "In October Commtouch reported an 18% drop in global spam levels (comparing September and October). This was largely attributed to the closure of Spamit around the end of September. Spamit is the organization allegedly behind a fair percentage of the world's pharmacy spam. Analysis of the spam trends to date reveals a further drop in the amounts of spam sent during Q4 2010. December's daily average was around 30% less than September's. The average spam level for the quarter was 83% down from 88% in Q3 2010. The beginning of December saw a low of nearly 74%."

Read more of this story at Slashdot.
4chan Has Been DDOSed

Posted: December 28th, 2010, 3:11pm CET by CmdrTaco

Tags: security

An anonymous reader writes "According to the 4chan status page all of the 4chan boards have been DDOSed and are down."

Read more of this story at Slashdot.
Auditors Question TSA's Tech Spending, Security Solutions

Posted: December 28th, 2010, 1:12am CET by Soulskill

Tags: security

Frosty P writes "Government auditors have faulted the TSA and its parent agency, the Department of Homeland Security, for failing to properly test and evaluate technology before spending money on it. The TSA spent about $36 million on devices that puffed air on travelers to 'sniff' them out for explosives residue. All 207 of those machines ended up in warehouses, abandoned as unable to perform as advertised, deployed in many airports before the TSA had fully tested them. Since it was founded in 2001, the TSA has spent roughly $14 billion in more than 20,900 transactions with dozens of contractors, including $8 billion for the famous new body scanners that have recently come under scrutiny for being unable to perform the task for which they are advertised. 'TSA has an obsession of finding a single box that will solve all its problems. They've spent and wasted money looking for that one box, and there is no such solution,' said John Huey, an airport security expert."

Read more of this story at Slashdot.
Did Stuxnet Take Out 1,000 Centrifuges At Natanz?

Posted: December 27th, 2010, 5:19am CET by timothy

Tags: security

AffidavitDonda writes "In late 2009 or early 2010, Iran decommissioned and replaced about 1,000 IR-1 centrifuges in the Fuel Enrichment Plant (FEP) at Natanz, implying that these centrifuges broke. Iran's IR-1 centrifuges often break, yet this level of breakage exceeded expectations and occurred during an extended period of relatively poor centrifuge performance. Although Iran has not admitted that Stuxnet attacked the Natanz centrifuge plant, it has acknowledged that its nuclear sites were subject to cyber attacks."

Read more of this story at Slashdot.
Will 2011 Be the Year of Mobile Malware?

Posted: December 22nd, 2010, 4:36pm CET by CmdrTaco

Tags: security

alphadogg writes "Perhaps one of the most common predictions of the last six years has been that mobile malicious software will suddenly proliferate, driven by widespread adoption of smartphones with advanced OSes. None of those prognostications has really come to fruition, but it's likely that the coming year will bring a host of new malicious applications. Users — while generally aware of threats aimed at their desktop computers and laptops — have a good chance of being caught flat-footed with their mobile phones. In the third quarter of this year, up to 80 million smartphones were sold around the world, which accounted for about 20 percent of the total number of mobile phones sold, according to statistics published last month by analyst firm Gartner. Experts say the threats against those devices are going to come in several categories, including rogue applications. In September, researchers from security vendor Fortinet discovered a mobile component for Zeus, a notorious piece of banking malware that steals account credentials. The mobile component, which targeted Symbian Series 60 devices or BlackBerrys, intercepted one-time passcodes used to verify transactions."

Read more of this story at Slashdot.
Passwords Are the Weakest Link In Online Security

Posted: December 22nd, 2010, 3:46pm CET by CmdrTaco

Tags: security

Orome1 writes "It's not surprising to find that 79% of consumers use risky password construction practices, such as including personal information and words. The recent Gawker breach and a detailed analysis of breached passwords show undeniably that passwords continue to be the Achilles' heel of the average Internet user. This insecure trend sadly doesn't shift as 26% of users reuse the same password for important accounts such as email, banking or shopping and social networking sites while 29% had their own email or social network account hacked, and over half (52%) know someone who has had a similar problem."

Read more of this story at Slashdot.
Recording the Police

Posted: December 21st, 2010, 10:23pm CET by CmdrTaco

Tags: security

Bruce Schneier says "I've written a lot on the 'War on Photography,' where normal people are harassed as potential terrorists for taking pictures of things in public. This article is different; it's about recording the police: Allison's predicament is an extreme example of a growing and disturbing trend. As citizens increase their scrutiny of law enforcement officials through technologies such as cell phones..."

Read more of this story at Slashdot.
The Smartphone That Spies, and Other Surprises

Posted: December 21st, 2010, 8:00pm CET by CmdrTaco

Tags: security

GMGruman writes "As smartphones become ubiquitous accessories, unexpected consequences can result. In this blog post, InfoWorld's Galen Gruman looks at some of the unintended consequences of mobile technology's ubiquity, in which very useful technology can also raise issues. For example, the US Army has put out a training video to tell troops how to disable the location detection on iPhones and Androids so they can't be tracked when on deployment. That's just one example of the behavior and awareness that most people haven't yet grokked. Others involve cameras, microphones, and USB drives."

Read more of this story at Slashdot.
D0z.me — the Evil URL Shortener

Posted: December 20th, 2010, 11:49pm CET by Soulskill

Tags: security

supernothing writes "DDoS attacks seem to be in vogue today, especially considering the skirmishes over WikiLeaks in the past few weeks. The size of a DDoS attacks, however, has historically been limited by how many computers one has managed to recruit into a botnet. These botnets almost universally require code to be executed on the participants' local systems, whether they are willing or unwilling. A new approach has been emerging recently, however, which uses some simple JavaScript to achieve similar ends. d0z.me is a new service that utilizes these techniques, but provides a unique twist on the idea. Posing as a legitimate URL shortening service, it serves users the requested pages in an iFrame, while simultaneously participating in a DDoS attack in the background. No interaction is required beyond clicking the link and staying on the page. This makes it relatively trivial to quickly mount large-scale DDoS attacks, and affords willing participants plausible deniability in the assault."

Read more of this story at Slashdot.
The DNSSEC Chicken & Egg Challenge

Posted: December 20th, 2010, 6:24pm CET by CmdrTaco

Tags: security

wiredmikey writes "To begin DNSSEC implementation or not: that is the question facing a host of enterprises, notably any that engage in e-commerce or online financial transactions (online retailers, banks, investment firms, hospitality and travel, etc.). These businesses find themselves in a catch 22; there are obvious security benefits to adopting Domain Name System Security Extensions or DNSSEC, but there are some severe downsides to being too early in the adoption curve – downsides that are becoming more and more apparent every day. While DNSSEC is getting rave reviews for successful deployment at the foundation levels of the DNS, problems are lurking just ahead, since very few widely utilized end-user applications are able to actually utilize DNSSEC at all. Simply put, DNSSEC can only work if it is supported throughout the hierarchy from publisher to visitor..."

Read more of this story at Slashdot.
Spamhaus Under DDoS Over Wikileaks.info

Posted: December 18th, 2010, 8:35pm CET by timothy

Tags: security

achowe writes "Steve Linford of Spamhaus sent this to a private anti-spam list and asked that the message get out far and wide: 'For speaking out about the crime gangs located at the wikileaks.info mirror IP, Spamhaus is now under ddos by AnonOps. As our site cannot be reached now [actually sporadic], we can not continue to warn Wikileaks users not to load things from the Heihachi IP. ... AnonOps did not like our article update, here is what we said and what brought the ddos on us.'" At the conclusion of this message: "Spamhaus continues to warn Wikileaks readers to make sure they are viewing and downloading documents only from an official Wikileaks mirror site. We’re not saying 'don’t go to Wikileaks' we’re saying 'Use the wikileaks.ch server instead.'" Here is Spamhaus's full warning.

Read more of this story at Slashdot.
Openwall Linux 3.0 — No SUIDs, Anti-Log-Spoofing

Posted: December 17th, 2010, 9:45pm CET by Soulskill

Tags: security

solardiz writes "Openwall GNU/*/Linux (or Owl for short) version 3.0 is out, marking 10 years of work on the project. Owl is a small, security-enhanced Linux distro for servers, appliances, and virtual appliances. Two curious properties of Owl 3.0: no SUID programs in the default install (yet the system is usable, including password changing); and logging of who sends messages to syslog (thus, a user can't have a log message appear to come, say, from the kernel or sshd). No other distro has these. Other highlights of Owl 3.0: single live+install+source CD, i686 or x86_64, integrated OpenVZ (host and/or guest), 'make iso' & 'make vztemplate' in the included build environment, ext4 by default, xz in tar/rpm/less, 'anti-Debian' key blacklisting in OpenSSH. A full install is under 400 MB, and it can rebuild itself from source."

Read more of this story at Slashdot.

Slashdot: Linux

Openwall Linux 3.0 — No SUIDs, Anti-Log-Spoofing

Posted: December 17th, 2010, 9:45pm CET by Soulskill

Tags: security

solardiz writes "Openwall GNU/*/Linux (or Owl for short) version 3.0 is out, marking 10 years of work on the project. Owl is a small, security-enhanced Linux distro for servers, appliances, and virtual appliances. Two curious properties of Owl 3.0: no SUID programs in the default install (yet the system is usable, including password changing); and logging of who sends messages to syslog (thus, a user can't have a log message appear to come, say, from the kernel or sshd). No other distro has these. Other highlights of Owl 3.0: single live+install+source CD, i686 or x86_64, integrated OpenVZ (host and/or guest), 'make iso' & 'make vztemplate' in the included build environment, ext4 by default, xz in tar/rpm/less, 'anti-Debian' key blacklisting in OpenSSH. A full install is under 400 MB, and it can rebuild itself from source."

Read more of this story at Slashdot.

Slashdot: IT

NSA Considers Its Networks Compromised

Posted: December 17th, 2010, 5:29pm CET by Soulskill

Tags: security

Orome1 writes "Debora Plunkett, head of the NSA's Information Assurance Directorate, has confirmed what many security experts suspected to be true: no computer network can be considered completely and utterly impenetrable — not even that of the NSA. 'There's no such thing as "secure" any more,' she said to the attendees of a cyber security forum sponsored by the Atlantic and Government Executive media organizations, and confirmed that the NSA works under the assumption that various parts of their systems have already been compromised, and is adjusting its actions accordingly."

Read more of this story at Slashdot.
A Finnish-Chinese Connection For Stuxnet?

Posted: December 17th, 2010, 11:05am CET by timothy

Tags: security

Lingenfelter writes "I recently wrote a white paper entitled 'Dragons, Tigers, Pearls, and Yellowcake' in which I proposed four alternative scenarios for the Stuxnet worm other than the commonly held assumption that it was Israel or the US targeting Iran's Bushehr or Natanz facilities."

Read more of this story at Slashdot.
The Case For Lousy Passwords

Posted: December 16th, 2010, 3:39pm CET by CmdrTaco

Tags: security

itwbennett writes "Since the Gawker and McDonald's hack attacks, the web has been overrun with admonishments against using weak passwords. But weak passwords have their place too, says blogger Peter Smith. Like, for example, on Gawker, where he really doesn't care if it gets cracked. 'Life is too short to be worrying about 24 character passwords for trivial sites,' says Smith. And, to put things in perspective, your good passwords are pretty weak too. In a 2007 Coding Horror article, Jeff Atwood points out that the password "Fgpyyih804423" was cracked in 160 seconds by the Ophcrack cracker."

Read more of this story at Slashdot.
Learning From Gawker's Failure

Posted: December 15th, 2010, 6:24pm CET by CmdrTaco

Tags: security

Gunkerty Jeb writes "The Gawker hack has completely disenfranchised their users, not to mention the breach in trust that may well be impossible to regain. Users are demanding that they be allowed to delete their accounts immediately, and beyond implementing such a mechanism, it is likely that Gawker systems will have to be rebuilt from the ground up to avoid future hacks. So, what is to be learned from this perfect storm of bluster and bravado?"

Read more of this story at Slashdot.
The Top 50 Gawker Media Passwords

Posted: December 14th, 2010, 5:00pm CET by CmdrTaco

Tags: security

wiredmikey writes "Readers of Gizmodo, Lifehacker and other Gawker Media sites may be among the savviest on the Web, but the most common password for logging into those sites is embarrassingly easy to guess: "123456." So is the runner-up: "password." On Sunday night, hackers posted online a trove of data from Gawker Media's servers, including the usernames, email addresses and passwords of more than one million registered users. The passwords were originally encrypted, but 188,279 of them were decoded and made public as part of the hack. Using that dataset, we found the 50 most-popular Gawker Media passwords."

Read more of this story at Slashdot.
Gawker Source Code and Databases Compromised

Posted: December 12th, 2010, 11:59pm CET by samzenpus

Tags: security

An anonymous reader writes "Passwords and personal data for 1.3 million Gawker Media readers — this includes readers of sites like Gizmodo, Lifehacker, Kotaku, and io9 — have been released as a BitTorrent by a group of hackers called Gnosis, who also managed to gain access to both the Gawker CMS and Gizmodo's Twitter account. Gawker confirms and urges readers to change their passwords: 'Our user databases do indeed appear to have been compromised. The passwords were encrypted. But simple ones may be vulnerable to a brute-force attack. You should change the password on Gawker (GED/commenting system) and on any other sites on which you've used the same passwords. Out of an abundance of caution, you should also change your company email password and any passwords that may have appeared in your email messages. We're deeply embarrassed by this breach. We should not be in the position of relying on the goodwill of the hackers who identified the weakness in our systems.'"

Read more of this story at Slashdot.
Backscatter X-Ray Machines Easily Fooled

Posted: December 11th, 2010, 8:02pm CET by Soulskill

Tags: security

Pinckney writes "A paper by Leon Kaufman and Joseph W. Carlson in the Journal of Transportation Security asserts that x-ray backscatter machines are not very effective (PDF) even in their intended role. While carelessly placed contraband will be detected, the machines have glaring blind-spots and have difficulty distinguishing explosives from human tissue. As they write, 'It is very likely that a large (15–20 cm in diameter), irregularly-shaped, cm-thick pancake [of PETN explosive] with beveled edges, taped to the abdomen, would be invisible to this technology. ... It is also easy to see that an object such as a wire or a boxcutter blade, taped to the side of the body, or even a small gun in the same location, will be invisible.'"

Read more of this story at Slashdot.
Remote Exim Exploit In the Wild

Posted: December 10th, 2010, 5:11pm CET by kdawson

Tags: security

An anonymous reader sends word of a remote exploit in the wild against the Exim mail agent. The news comes on the exim mailing list, where a user posted that he had his exim install hacked via remote exploit giving the attacker the privilege of the mailnull user, which can lead to other possible attacks. A note up at the Internet Storm Center reminds exim users how to set up to run in unprivileged mode, and a commenter includes recompile instructions for Debian exim for added safety. The security press hasn't picked up on this story so far.

Read more of this story at Slashdot.
Stuxnet Still Out of Control At Iran Nuclear Sites

Posted: December 10th, 2010, 12:47am CET by timothy

Tags: security

Velcroman1 writes "Iran's nuclear program is still in chaos despite its leaders' adamant claim that they have contained the computer worm that attacked their facilities, cybersecurity experts in the US and Europe say. Last week President Mahmoud Ahmadinejad, after months of denials, admitted that the worm had penetrated Iran's nuclear sites, but he said it was detected and controlled. The second part of that claim, experts say, doesn't ring true. Owners of several security sites have discovered huge bumps in traffic from Iran, as the country tries to deal with Stuxnet. 'Our traffic from Iran has really spiked,' said a corporate officer who asked that neither he nor his company be named. 'Iran now represents 14.9 percent of total traffic, surpassing the United States with a total of 12.1 percent.'"

Read more of this story at Slashdot.
WikiLeaks Defenders Threaten Amazon

Posted: December 9th, 2010, 5:38pm CET by CmdrTaco

Tags: security

healeyb writes "CNN is announcing that, starting at 11 AM EST, the hackers (coined Operation Payback) responsible for the DDoS attacks on MasterCard, Visa, PayPal, and PostFinance have promised to commence an attack against Amazon for their revocation of the WikiLeaks EC2 account. They released a do-it-yourself hacking tool online Thursday so other people can help with the attacks they say took down the websites of MasterCard and Visa..."

Read more of this story at Slashdot.
MasterCard Hit By WikiLeaks Payback Attacks

Posted: December 8th, 2010, 4:00pm CET by CmdrTaco

Tags: security

An anonymous reader writes "MasterCard's website has been hit by a distributed denial of service attack. Netcraft describes how the attack uses a voluntary botnet of LOIC (low orbit ion cannon) users to swamp sites with traffic. PostFinance, the PayPal blog and Swedish prosecutors have been targeted previously."

Read more of this story at Slashdot.
Digging Into the WikiLeaks Cables

Posted: December 6th, 2010, 7:33pm CET by Soulskill

Tags: security

A number of readers have sent in new WikiLeaks stories today, many of which focus on the content of the leaked diplomatic cables. The documents showed how the US government bullied and manipulated other countries to gain support for its Copenhagen climate treaty (though behavior from the US wasn't all negative), how copyright negotiations largely meet the expectations of critics like Michael Geist, and how Intel threatened to move jobs out of Russia if the Russian government didn't loosen encryption regulations. Perhaps the biggest new piece of information is a list of facilities the US considers 'vital to security.' Meanwhile, the drama surrounding WikiLeaks continues; Julian Assange's Swiss bank account has been frozen and the UK has received an arrest warrant for the man himself; the effort to mirror the site has gained support from Pirate Parties in Australia, in the UK and elsewhere; and PayPal was hit with a DDoS for their decision not to accept donations for WikiLeaks.

Read more of this story at Slashdot.
With Better Sharing of Intel Comes Danger

Posted: December 5th, 2010, 10:21pm CET by timothy

Tags: security

Hugh Pickens writes "Ellen Nakashima writes in the Washington Post that after the intelligence community came under heavy criticism after 9/11 for having failed to share data, officials sought to make it easier for various agencies to share sensitive information giving intelligence analysts wider access to government secrets but WikiLeaks has proved that there's a downside to better information-sharing. To prevent further breaches, the Pentagon has ordered that a feature that allows material to be copied onto thumb drives or other removable devices be disabled on its classified computer systems and will limit the number of classified systems from which material can be transferred to unclassified systems, as well as require that two people be involved in moving data from classified to unclassified systems. The bottom line is that recent leaks 'have blown a hole' in the framework by which governments guard their secrets. According to British journalist Simon Jenkins 'words on paper can be made secure, electronic archives not.'"

Read more of this story at Slashdot.
Doorways Sneak To Non-Default Ports of Hacked Servers

Posted: December 4th, 2010, 9:49pm CET by timothy

Tags: security

UnmaskParasites writes "To drive traffic to their online stores, software pirates hack reputable legitimate websites injecting hidden spammy links and creating doorway pages. Google's search results are seriously poisoned by such doorways. Negligence of webmasters of compromised sites makes this scheme viable — doorways remain unnoticed for years. Not so long ago, hackers began to re-configure Apache on compromised servers to make them serve doorway pages off of non-default ports, still taking advantage of using established domain names."

Read more of this story at Slashdot.
Canon's Image Verification System Cracked

Posted: December 3rd, 2010, 10:57pm CET by Soulskill

Tags: security

TJNoffy writes "The H Security's H-online reports that 'Hacker Dmitry Sklyarov has succeeded in extracting the secret signing key from numerous digital SLR cameras and has used it to sign modified images which Canon's latest OSK-E3 security kit verifies as legitimate. Canon's Original Data Security System is intended to show whether changes have been made to photographs and to verify date and location information. The system is primarily used for ensuring the integrity of evidence, for reporting accidents and for construction records.'"

Read more of this story at Slashdot.
Antivirus Firms Short-Changing Customers

Posted: December 3rd, 2010, 6:50pm CET by Soulskill

Tags: security

Barence writes "Two leading security firms have been accused of ripping off customers by cutting short their antivirus subscriptions. AVG and Symantec are offering their own customers discounts on subscriptions via email or pop-ups, but the new subscriptions start immediately, 'short-changing' users who had months left on their existing deal. Both Symantec and AVG owned up to the practice, and said they had no plans to change their ways, instead advising their customers to upgrade as close as possible to the end of the subscription. However, the pair actively send out emails and pop-up messages that encourage customers to upgrade immediately."

Read more of this story at Slashdot.
Ransomware Making a Comeback

Posted: December 3rd, 2010, 8:05am CET by timothy

Tags: security

snydeq writes "Ransomware is back. After a hiatus of more than two years, a variant of the GpCode program has again been released, kidnapping victims' data and demanding $120 for its return, InfoWorld reports. 'Like the ransomware programs before it, GpCode encrypts a victim's files and then demands payment for the decryption key. The new version of GpCode — labeled GpCode.AX by security firm Kaspersky — comes with a bit more nastiness than previous attempts. The program overwrites files with the encrypted data, causing total loss of the original data, and uses stronger crypto algorithms — RSA-1024 and AES-256 — to scramble the information.'"

Read more of this story at Slashdot.
Attack of the Trojan Printers

Posted: December 1st, 2010, 8:19pm CET by samzenpus

Tags: security

snydeq writes "Security professionals are tapping Trojan horse access points cloaked in printers and other office equipment to infiltrate clients who want their defenses tested, InfoWorld reports. Attackers dressed in IT supplier uniforms drop off printers to a company for a test-drive. Once the device is connected to the network, the penetration testers have a platform behind any perimeter defenses from which to attack. 'You can put your box inside a printer tray and glue it shut, and who will notice if there are one or two or three power cables coming out?' one security researcher says of the method. A variant of the attack, presented by Errata Security at the Defcon hacking convention, uses an attack-tool-laden iPhone mailed to a target company to get inside the firm's network defenses."

Read more of this story at Slashdot.
Causing Terror On the Cheap

Posted: November 29th, 2010, 7:51pm CET by Soulskill

Tags: security

jhigh writes "Bruce Schneier posts on his blog today about the value of terror with respect to cost-benefit for the terrorists. If you look at terror attacks in terms of what they cost the terrorists to implement, compared with what they cost the economy of the nation that was hit, the reward for terrorists is astronomical. Add in the insane costs of the security measures implemented afterward, particularly in America, and it's easy to see why the terrorists do what they do. Even when they're unsuccessful, they cost us billions in security countermeasures."

Read more of this story at Slashdot.
FedEx Misplaces Radioactive Rods

Posted: November 26th, 2010, 9:17pm CET by Soulskill

Tags: security

Hugh Pickens writes "A shipment of radioactive rods used in medical equipment has vanished while being sent by FedEx from North Dakota to Tennessee. Based on tracking information, FedEx is focusing its search in the Tennessee area, but as a normal precaution the company alerted all of its stations 'in the event that it got waylaid and went to another station by accident.' Dr. Marc Siegel says if someone opens the container it could pose some serious health risks. 'I don't believe it has the degree of radiation that, if it were opened, your skin would suddenly slough off. But the concern would be, if this got opened inadvertently and someone didn't know what it was and then was repeatedly exposed to it over several days, it could cause a problem with radiation poisoning,' says Siegel. 'The people that use this equipment in a hospital use protective shielding with it.' The lesson is that active medical material must always be transported in a way that ensures the general public cannot get access to it. 'Medical devices should not be FedExed. They should be sent under a special service,' adds Siegel."

Read more of this story at Slashdot.
Hacker Sends Out Fake Tsunami Warning On Twitter

Posted: November 26th, 2010, 6:39am CET by samzenpus

Tags: security

An anonymous reader writes "A Twitter account belonging to an official adviser of the Indonesian president has been broken into by a hacker who posted a warning that a tsunami was heading for Jakarta. Andi Arief is Indonesian president Susilo Bambang Yudhoyono's disaster management adviser and a frequent user of Twitter. But when he lost control of his account, a tsunami warning was sent out to Twitter users."

Read more of this story at Slashdot.
A Peek At the National Opt-Out Day Numbers

Posted: November 25th, 2010, 9:11pm CET by timothy

Tags: security

Yesterday was a big travel day for Americans, and the organizers of National Opt-Out Day hoped to use it to highlight widespread, though not universal, dissatisfaction with stepped-up screening measures in US airports, by encouraging people selected for body screening to insist instead on the pat-down alternative. Reader Willtor writes with a story in the New York Times on the effect of the protest: "'39 people had opted out of the body scans in Atlanta by 5 p.m. In Los Angeles, 113 had. One had opted out in Charlotte, N.C. Boston seemed to have something of a mini-spike, with 300.' This is a tiny fraction of passengers, of course. But when I flew out of Boston this afternoon, they had opened a line that led to a traditional metal detector. When I flew out in June all lines went to the nudie scanners. Is it safe to be optimistic that we have been heard and policies have changed? I am not particularly concerned whether we get credit or whether it is reported that the protest fizzled. But it would be nice to know that some of the more invasive theatrics have become optional." According to its organizers, meanwhile, the opt-out protest was a "rousing success." If you traveled yesterday by air, what was your impression?

Read more of this story at Slashdot.
Homeland Security Drops Color-Coded Terror Alerts

Posted: November 25th, 2010, 4:57pm CET by timothy

Tags: security

Hugh Pickens writes "The LA Times reports that the Homeland Security Department is poised to end its five-tiered, color-coded terrorism warning system, a post-Sept. 11 endeavor that has been called too vague to be useful and has been mostly ignored or mocked by the public. The domestic security advisory system was created in 2002 under then-Secretary Tom Ridge and in 2004, the department began assigning color threat levels to general targets such as aviation, financial services and mass transit. However the Department hasn't changed the alert level in four years, even after the attempted bombing of a flight to Detroit on Christmas Day 2009 and the alert level has only been elevated to red once, on Aug. 10, 2006, when British police disrupted a plot to detonate liquid explosives on airliners. Although it is unknown what, if anything, will replace the color-coded alerts, a senior Homeland Security official, who did not want to speak on the record about a decision still under review, says that 'the goal is to replace a system that communicates nothing.'" Can't we just re-use the big DefCon displays from Wargames?

Read more of this story at Slashdot.
Next Step For US Body Scanners Could Be Trains, Metro Systems

Posted: November 24th, 2010, 3:47pm CET by timothy

Tags: security

Hugh Pickens writes "The Hill reports that Homeland Security Secretary Janet Napolitano says terrorists will continue to look for US vulnerabilities, making tighter security standards necessary. '[Terrorists] are going to continue to probe the system and try to find a way through,' Napolitano said in an interview with Charlie Rose. 'I think the tighter we get on aviation, we have to also be thinking now about going on to mass transit or to trains or maritime.' Napolitano added she hoped the US could get to a place in the future where Americans would not have to be as guarded against terrorist attacks as they are and that she was actively promoting research into the psychology of how a terrorist becomes radicalized. 'The long-term [question] is, how do we get out of this having to have an ever-increasing security apparatus because of terrorists and a terrorist attack?' says Napolitano. 'I think having a better understanding of what causes someone to become a terrorist will be helpful.'"

Read more of this story at Slashdot.
Rootkit In a Network Card Demonstrated

Posted: November 23rd, 2010, 9:11pm CET by kdawson

Tags: security

KindMind notes coverage in The Register on a researcher who has developed a firmware-based rootkit that resides in a network card. Here is the developer's blog entry. "Guillaume Delugré, a reverse engineer at French security firm Sogeti ESEC, was able to develop proof-of-concept code after studying the firmware from Broadcom Ethernet NetExtreme PCI Ethernet cards... Using the knowledge gained from this process, Delugré was able to develop custom firmware code and flash the device so that his proof-of-concept code ran on the CPU of the network card."

Read more of this story at Slashdot.
Former Employee Stole Ford Secrets Worth $50 Million

Posted: November 23rd, 2010, 4:20am CET by Soulskill

Tags: security

chicksdaddy writes "A ten year veteran of US automaker Ford pleaded guilty in federal court on November 17 to charges that he stole company secrets, including design documents, valued at between $50 million and $100 million, and shared them with his new employer: the Chinese division of a US rival of Ford's. Xiang Dong ('Mike') Yu admitted to copying some 4,000 Ford Documents to an external hard drive, including design specifications for key components of Ford automobiles, after surreptitiously taking a job with a China-based competitor in 2006. Yu, who took a job for Beijing Automotive Company in 2008, was arrested during a stopover at Chicago in October, 2009. The FBI seized his Beijing Automotive-issued laptop, and an analysis found 41 stolen Ford specification documents on the hard drive. He faces five to six years in prison and a $150,000 fine (PDF)."

Read more of this story at Slashdot.
Making Airport Scanners Less Objectionable

Posted: November 22nd, 2010, 2:45pm CET by kdawson

Tags: security

Hugh Pickens writes "The Washington Post reports that one of the researchers who helped develop the software for the scanners says there is a simple fix that would make scanning less objectionable. The fix would distort the images captured on full-body scanners so they look like reflections in a fun-house mirror, but any potentially dangerous objects would be clearly revealed, says Willard 'Bill' Wattenburg, a former nuclear weapons designer at the Livermore lab. 'Why not just distort the image into something grotesque so that there isn't anything titillating or exciting about it?' asks Wattenburg, adding that the modification is so simple that 'a 6-year-old could do the same thing with Photoshop... It's probably a few weeks' modification of the program.' Wattenburg said he was rebuffed when he offered the concept to Department of Homeland Security officials four years ago. A TSA official said the agency is working on development of scanner technology that would reduce the image to a 'generic icon, a generic stick figure' that would still reveal potentially dangerous items." Reader FleaPlus points out an unintended consequence: some transportation economists believe that the TSA's new invasive techniques may lead to more deaths as more people use road transportation to avoid flying — much more dangerous by the mile than air travel.

Read more of this story at Slashdot.
The US-Soviet Cyber Cold War

Posted: November 21st, 2010, 7:08pm CET by samzenpus

Tags: security

Roberto123 writes "A security expert with the NSA says a cyber cold war is being waged that has significant parallels to the Cold War between the US and Soviet Union. Dickie George says the way to fight the cyber cold war is by building security into technology, making it transparent to the end user, continually monitoring networks and updating their security software."

Read more of this story at Slashdot.
Adobe Launches Sandboxed Reader X

Posted: November 19th, 2010, 4:14pm CET by Soulskill

Tags: security

CWmike writes "Adobe on Wednesday released Reader X, the next version of its popular software that includes a 'sandbox' designed to protect users from PDF attacks. Protected Mode is Adobe's response to experts' demands that the company beef up the security of Reader, which is aggressively targeted by attackers. Calling the sandbox a 'new advancement' in protective measures, Brad Arkin, Adobe's director of security and privacy, admitted it will not stymie every attack. But he argued it will help. 'Even if exploitable security vulnerabilities are found by an attacker, Adobe Reader Protected Mode will help prevent the attacker from writing files or installing malware on potential victims' computers,' Arkin said in a post to a company blog late on Thursday."

Read more of this story at Slashdot.
TSA Pats Down 3-Year-Old

Posted: November 17th, 2010, 7:09pm CET by samzenpus

Tags: security

3-year-old Mandy Simon started crying when her teddy bear had to go through the X-ray machine at airport security in Chattanooga, Tenn. She was so upset that she refused to go calmly through the metal detector, setting it off twice. Agents then informed her parents that she "must be hand-searched." The subsequent TSA employee pat down of the screaming child was captured by her father, who happens to be a reporter, on his cell phone. The video have left some questioning why better procedures for children aren't in place. I, for one, feel much safer knowing the TSA is protecting us from impressionable minds warped by too much Dora the Explorer.

Read more of this story at Slashdot.
New Rootkit Bypasses Windows Code-Signing Security

Posted: November 16th, 2010, 7:45pm CET by CmdrTaco

Tags: security

Trailrunner7 writes "In recent versions of Windows, specifically Vista and Windows 7, Microsoft has introduced a number of new security features designed to prevent malicious code from running. But attackers are continually finding new ways around those protections, and the latest example is a rootkit that can bypass the Windows driver-signing protection."

Read more of this story at Slashdot.
Cracking Passwords With Amazon EC2 GPU Instances

Posted: November 16th, 2010, 5:28pm CET by CmdrTaco

Tags: security

suraj.sun writes "As of Nov. 15, 2010, Amazon EC2 is providing what they call 'Cluster GPU Instances': An instance in the Amazon cloud that provides you with the power of two NVIDIA Tesla 'Fermi' M2050 GPUs... Using the CUDA-Multiforce, I was able to crack all hashes from this file with a password length from 1-6 in only 49 Minutes (1 hour costs $2.10 by the way.). This is just another demonstration of the weakness of SHA1 — you really don't want to use it anymore."

Read more of this story at Slashdot.
Stuxnet Was Designed To Subtly Interfere With Uranium Enrichment

Posted: November 16th, 2010, 11:04am CET by Soulskill

Tags: security

ceswiedler writes "Wired is reporting that the Stuxnet worm was apparently designed to subtly interfere with uranium enrichment by periodically speeding or slowing specific frequency converter drives spinning between 807Hz and 1210Hz. The goal was not to cause a major malfunction (which would be quickly noticed), but rather to degrade the quality of the enriched uranium to the point where much of it wouldn't be useful in atomic weapons. Statistics from 2009 show that the number of enriched centrifuges operational in Iran mysteriously declined from about 4,700 to about 3,900 at around the time the worm was spreading in Iran."

Read more of this story at Slashdot.
Security Strategy: From Requirements To Reality

Posted: November 15th, 2010, 8:41pm CET by samzenpus

Tags: security

brothke writes "Security Engineering: A Guide to Building Dependable Distributed Systems by Ross Anderson is arguably the best information security book ever written. Anderson's premise is that security technology needs to take a structured engineering approach to systems design, with detailed requirements and specification from start-up to development and implementation; just as those designing buildings and bridges do. Without a deeply embedded structured approach to security systems design, Anderson argued that we find ourselves in the situation we are in today, with applications and operating systems full of bugs, vulnerabilities and other serious security flaws. As good as Security Engineering is, it was not written to be a detailed information security design guide. That vacuum has been filled by an incredibly important and valuable new bookSecurity Strategy: From Requirements to Reality." Read on for the rest of Ben's review.

Read more of this story at Slashdot.
Ears Might Be Better Than Fingerprints For ID

Posted: November 14th, 2010, 6:30pm CET by timothy

Tags: security

An anonymous reader writes "A new study says that outer ear could be better unique identification mark in human beings than finger prints. 'When you're born your ear is fully formed. The lobe descends a little, but overall it stays the same. It's a great way to identify people,' said Mark Nixon, a computer scientist at the University of Southampton and leader of the research. Nixon and his team presented a paper at the IEEE Fourth International Conference on Biometrics and using an algorithm identified people with 99.6 per cent accuracy." An anonymous reader adds a link to Wired's story on the same conference presentation, which adds this skeptical note: "'I have seen no scientific proof that the ear doesn’t change significantly over time. People tend to believe notions like these, and they are repeated over time,' said Anil Jain, a computer scientist at Michigan State University who was not involved in the study. 'Fingerprinting has a history of 100 years showing that it works, unless you destroy your fingerprints or work in an industry that gives you calluses.'"

Read more of this story at Slashdot.
Hackers Blamed For MessageLabs Spam Blunder

Posted: November 12th, 2010, 11:58am CET by timothy

Tags: security

littlekorea writes "MessageLabs claims to have discovered that the systems of one of its customers were hacked by spammers after an entire block of MessageLabs IP addresses was blocked by antispam service SORBS. Customers of the managed email service had problems with outbound mail last week after MessageLabs' IP addresses were included in SORBS' block list. The Symantec-owned service provider has assured customers it has systems in place to prevent such incidents from happening again."

Read more of this story at Slashdot.
How Often Should You Change Your Password?

Posted: November 11th, 2010, 4:52pm CET by CmdrTaco

Tags: security

jhigh writes "Bruce Schneier asks the question, how often should you change your password? 'The primary reason to give an authentication credential — not just a password, but any authentication credential — an expiration date is to limit the amount of time a lost, stolen, or forged credential can be used by someone else. If a membership card expires after a year, then if someone steals that card he can at most get a year's worth of benefit out of it. After that, it's useless.' Another reason could be to limit the amount of time an attacker has to crack the password, but Bruce's analysis seems on target."

Read more of this story at Slashdot.
Security App For the New German Personal ID Hacked

Posted: November 11th, 2010, 7:06am CET by samzenpus

Tags: security

prefec2 writes "On Nov. 1st Germany started to issue new personal ID cards which include a security chip. In combination with a reading device and an application on a PC at home, secure transactions can be made. However, the required application can be compromised using DNS spoofing and a wrong SSL certificate (article in German)."

Read more of this story at Slashdot.
UK Terror Chief Blocked From Boarding Aircraft

Posted: November 11th, 2010, 4:38am CET by samzenpus

Tags: security

Jeremiah Cornelius writes "Two days before toner cartridges threatened western civilization, Britain's Home Office minister Baroness Neville-Jones was en route to a Washington summit when she was found to have an over-sized aerosol can in her bag. While being questioned by airport security staff for transporting a container with more than 100ml of liquid, the Baroness seemingly took offense at being lectured on the importance of security procedure: 'Of course I know how important it is,' she said, 'I'm the Security Minister.' The Baroness is also former head of the British Joint Intelligence Committee, and was traveling at the time to discuss the war on terror with US security chiefs. According to a Home Office spokesman, trained in the use of the passive voice, 'Liquids were inadvertently left in a bag. The item was removed and the Minister fully complied with subsequent checks.'"

Read more of this story at Slashdot.
Research Inches Toward Processor-Specific Malware

Posted: November 11th, 2010, 2:01am CET by samzenpus

Tags: security

chicksdaddy writes "The Windows/Office/IE monoculture is disappearing faster than equatorial glaciers — Mac OS X and iOS, Linux and Android ... and whole new application ecosystems to go with each. That's bad news for malware authors and other bad guys, who count on 9.5 out of 10 systems running Windows and Microsoft applications to do their magic. What's the solution? Why, hardware specific hacks, of course! After all, the list of companies making CPUs is far smaller than, say, the list of companies making iPhone applications. Malware targeting one or more of those processors would work regardless of what OS or applications were installed. There's just one problem: its not easy to figure out what kind of CPU a device is running. But researchers at France's Ecole Superiore d'Informatique, Electronique, Automatique (ESIEA) are working on that problem. Threatpost.com reports on a research paper that lays out a strategy for fingerprinting processors by observing subtle differences in the way they perform complex floating point calculations. The method allows them to distinguish broad subsets of processor types by manufacturer, and researchers plan to refine their methods and release a tool that can make specific processor fingerprinting a snap."

Read more of this story at Slashdot.
Royal Navy Website Hacked, Passwords Revealed

Posted: November 8th, 2010, 4:43pm CET by CmdrTaco

Tags: security

An anonymous reader writes "The British Royal Navy's website has been suspended after a Romanian hacker exploited SQL injection vulnerabilities to gain access to the site. The hacker, named 'TinKode,' accessed usernames and passwords used by the site's administrators and published them on the web. TinKode's attack is 'particularly embarrassing for the British Ministry of Defence, as just last month protecting against cyber attacks was declared in the National Security Strategy to be a "highest priority for UK national security."'"

Read more of this story at Slashdot.
Evaluating Or Testing Utility SCADA Security?

Posted: November 6th, 2010, 9:45pm CET by Soulskill

Tags: security

EncryptedBit writes "I am a local elected official involved in bringing new water and waste water treatment plants online in a small town. The new plants will incorporate SCADA, which can be used to change operational aspects at the plants, up to forcing a shutdown or changing operational parameters. Can any Slashdotters recommend ways to make sure it is secure? Any testing recommendations? The operational engineers are oblivious to security and SCADA is a new factor, so this concerns me. Any pointers would be appreciated."

Read more of this story at Slashdot.
Major Security Holes Found In Mobile Bank Apps

Posted: November 5th, 2010, 11:04pm CET by Soulskill

Tags: security

NeverVotedBush writes with this excerpt from CNet: "A security firm disclosed holes today in mobile apps from Bank of America, USAA, Chase, Wells Fargo and TD Ameritrade, prompting a scramble by most of the companies to update the apps. ... Specifically, viaForensics concluded that: the USAA's Android app stored copies of Web pages a user visited on the phone; TD Ameritrade's iPhone and Android apps were storing the user name in plain text on the phone; Wells Fargo's Android app stored user name, password, and account data in plain text on the phone; Bank of America's Android app saves a security question (used if a user was accessing the site from an unrecognized device) in plain text on the phone; and Chase's iPhone app stores the username on a phone if the user chose that option, according to the report. Meanwhile, the iPhone apps from USAA, Bank of America, Wells Fargo, and Vanguard and PayPal's Android app all passed the security tests and were found to be handling data securely."

Read more of this story at Slashdot.
MS Adds Security Suite To Update Service, Antivirus Rival Objects

Posted: November 5th, 2010, 9:35pm CET by Soulskill

Tags: security

CWmike writes "Microsoft has started adding Security Essentials to the optional download list seen by US Windows users when they fire up the operating system's update service, and antivirus rivals are crying foul. 'Commercializing Windows Update to distribute other software applications raises significant questions about unfair competition,' Carol Carpenter, a GM at Trend Micro, said on Thursday. 'Windows Update is a de facto extension of Windows, so to begin delivering software tied to updates has us concerned,' she added. 'Windows Update is not a choice for users, and we believe it should not be used this way.' If Windows doesn't detect working security software on the PC, Microsoft adds Security Essentials to the Optional section of Microsoft Update, a superset of the better-known Windows Update, or to Windows Update if it has been configured to also draw downloads from Microsoft Update. Microsoft made a point to say that it was not offering the software via Windows Update, but only through the Microsoft Update service, which also offers patches for new versions of non-operating system software, notably Office and Windows Media Player. But most users won't understand the distinction."

Read more of this story at Slashdot.
Zeus Attackers Turned the Tables On Researchers

Posted: November 4th, 2010, 2:59pm CET by CmdrTaco

Tags: security

ancientribe writes "The attackers behind a recent Zeus Trojan exploit that targeted quarterly federal taxpayers who file electronically also set up a trap for researchers investigating the attack as well as their competing cybercrime gangs. They fed them a phony administrative panel with fake statistics on the number of Zeus-infected machines, as well as phony 'botnet' software that actually gathers intelligence on the researcher or competitor who downloads it."

Read more of this story at Slashdot.
Nuclear Bunker Houses World's Toughest Server Farm

Posted: November 4th, 2010, 12:12am CET by samzenpus

Tags: security

Lanxon writes "Deep inside the Swiss Alps, a former nuclear bunker is now the ultimate hiding place for the world's most sensitive secrets — the Swiss Fort Knox. In a lengthy feature, Wired gains access to the server farm designed to survive a full-scale military attack. From the article: 'As we punch our codes at the checkpoint, the yellow door opens into what looks like a city of server towers, their green LEDs flickering as a technician in a white jumpsuit runs diagnostic checks. [Later], we are in a dimly lit tunnel next to what looks like a metal oven door carved into the side of the rock. "These are expansion rooms in case you have an atomic explosion outside," Christoph Oschwald, a retired Swiss paratrooper turned contractor, says. The thinking behind the rooms, he explains, is that if there were a nuclear explosion, the rush of high-pressure air would fill them through vents in the opposite side. Then, the vents would snap shut, trapping the air before it had a chance of damaging the fortress. "There is a lot of protection you can't see," he says. We stroll past an intricate network of insulated pipelines that carry water up from the underground glacial lake to the cooling system.'"

Read more of this story at Slashdot.
Adobe To Push Emergency Fix For Flash Bug

Posted: November 3rd, 2010, 6:29pm CET by samzenpus

Tags: security

Trailrunner7 writes "Adobe has moved up the release date for the patch for the critical bug in Adobe Flash Player revealed last week, and now plans to have an emergency fix ready on Thursday. The company still plans to patch Reader two weeks from now. The vulnerability in Flash also exists in Reader and researchers said last week that attackers had already begun exploiting the bug in Reader by the time that Adobe acknowledged the problem and published an advisory. At the time of the initial advisory, Adobe officials said they planned to release a patch for Flash on Nov. 9 and for Reader on Nov. 15."

Read more of this story at Slashdot.
Hiding Backdoors In Hardware

Posted: October 29th, 2010, 6:12pm CEST by Soulskill

Tags: security

quartertime writes "Remember Reflections on Trusting Trust, the classic paper describing how to hide a nearly undetectable backdoor inside the C compiler? Here's an interesting piece about how to hide a nearly undetectable backdoor inside hardware. The post describes how to install a backdoor in the expansion ROM of a PCI card, which during the boot process patches the BIOS to patch grub to patch the kernel to give the controller remote root access. Because the backdoor is actually housed in the hardware, even if the victim reinstalls the operating system from a CD, they won't clear out the backdoor. I wonder whether China, with its dominant position in the computer hardware assembly business, has already used this technique for espionage. This perhaps explains why the NSA has its own chip fabrication plant."

Read more of this story at Slashdot.

Slashdot: Linux

Hiding Backdoors In Hardware

Posted: October 29th, 2010, 6:12pm CEST by Soulskill

Tags: security

quartertime writes "Remember Reflections on Trusting Trust, the classic paper describing how to hide a nearly undetectable backdoor inside the C compiler? Here's an interesting piece about how to hide a nearly undetectable backdoor inside hardware. The post describes how to install a backdoor in the expansion ROM of a PCI card, which during the boot process patches the BIOS to patch grub to patch the kernel to give the controller remote root access. Because the backdoor is actually housed in the hardware, even if the victim reinstalls the operating system from a CD, they won't clear out the backdoor. I wonder whether China, with its dominant position in the computer hardware assembly business, has already used this technique for espionage. This perhaps explains why the NSA has its own chip fabrication plant."

Read more of this story at Slashdot.

Slashdot: IT

Adobe Warns of Critical Flash Bug, Already Being Exploited

Posted: October 29th, 2010, 12:04am CEST by timothy

Tags: security

Trailrunner7 writes "On the same day that it plans to release a patch for a critical flaw in Shockwave, Adobe confirmed on Thursday morning that there is a newly discovered bug in Flash that is being actively exploited already in attacks against Reader. The vulnerability affects Flash on all of the relevant platforms, including Android, as well as Reader on Windows and Mac, and won't be patched for nearly two weeks. The new Flash bug came to light early Thursday when a researcher posted information about the problem, as well as a Trojan that is exploiting it and dropping a pair of malicious files on vulnerable PCs. Researcher Mila Parkour tested the bug and posted a screenshot of the malicious files that a Trojan exploiting the vulnerability drops during its infection routine. Adobe has since confirmed the vulnerability and said that it is aware of the attacks against Reader."

Read more of this story at Slashdot.

Slashdot: Linux

Adobe Warns of Critical Flash Bug, Already Being Exploited

Posted: October 29th, 2010, 12:04am CEST by timothy

Tags: security

Trailrunner7 writes "On the same day that it plans to release a patch for a critical flaw in Shockwave, Adobe confirmed on Thursday morning that there is a newly discovered bug in Flash that is being actively exploited already in attacks against Reader. The vulnerability affects Flash on all of the relevant platforms, including Android, as well as Reader on Windows and Mac, and won't be patched for nearly two weeks. The new Flash bug came to light early Thursday when a researcher posted information about the problem, as well as a Trojan that is exploiting it and dropping a pair of malicious files on vulnerable PCs. Researcher Mila Parkour tested the bug and posted a screenshot of the malicious files that a Trojan exploiting the vulnerability drops during its infection routine. Adobe has since confirmed the vulnerability and said that it is aware of the attacks against Reader."

Read more of this story at Slashdot.

Slashdot: IT

Aussie Kids Foil Finger Scanner With Gummi Bears

Posted: October 28th, 2010, 8:10am CEST by samzenpus

Tags: security

mask.of.sanity writes "An Australian high school has installed 'secure' fingerprint scanners for roll call for senior students, which savvy kids may be able to circumvent with sweets from their lunch box. The system replaces the school's traditional sign-in system with biometric readers that require senior students to have their fingerprints read to verify attendance. The school principal says the system is better than swipe cards because it stops truant kids getting their mates to sign-in for them. But using the Gummi Bear attack, students can make replicas of their own fingerprints from gelatin, the ingredient in Gummi Bears, to forge a replica finger. The attack worked against a bunch of scanners that detect electrical charges within the human body, since gelatin has virtually the same capacitance as a finger's skin."

Read more of this story at Slashdot.
British Airways Chief Slams US Security Requests

Posted: October 28th, 2010, 3:56am CEST by samzenpus

Tags: security

Ponca City writes "Reflecting a growing frustration among airport and airline owners with the steady build-up of rules covering everything from footwear to liquids, Martin Broughton, chairman of British Airways, has launched a scathing attack on the 'completely redundant' airport checks requested by the TSA and urged the UK to stop 'kowtowing' to American demands for ever more security. Speaking at the annual conference of the UK Airport Operators Association, Broughton lambasted the TSA for demanding that foreign airports increase checks on US-bound planes, while not applying those regulations to their own domestic services. 'America does not do internally a lot of the things they demand that we do,' says Broughton. 'We shouldn't stand for that. We should say, "We'll only do things which we consider to be essential and that you Americans also consider essential.''' For example, Broughton noted that cutting-edge technology recently installed at airports can scan laptops inside hand luggage for explosives but despite this breakthrough the British government still demands computers be examined separately. 'It's just completely ridiculous,' says Broughton."

Read more of this story at Slashdot.
Most Americans Support an Internet Kill Switch

Posted: October 27th, 2010, 9:51pm CEST by samzenpus

Tags: security

Orome1 writes "Sixty-one percent of Americans said the President should have the ability to shut down portions of the Internet in the event of a coordinated malicious cyber attack, according to research by Unisys. The survey found that while Americans are taking proactive steps to protect themselves against cybercrime and identity theft, only slightly more than a third of Internet users in the US regularly use and update passwords on their mobile devices – creating a potentially huge security hole for organizations as more consumer devices invade the workplace. The findings illustrate that recent events such as the Stuxnet computer worm attack and the attempted Times Square car bombing may have heightened the American public's awareness of and concern over global and domestic cybersecurity threats."

Read more of this story at Slashdot.
Riskiest Web Domains To Visit

Posted: October 26th, 2010, 5:29pm CEST by CmdrTaco

Tags: security

wiredmikey writes "According to a report released today, .COM is the riskiest top-level domain, the riskiest country domain is Vietnam (.VN). Japan's .JP ranks as the safest country domain for the second year in a row and TRAVEL as the safest overall domain. It's interesting to note that .JP (currently $89.99 at GoDaddy) and .TRAVEL ($89.99 at Moniker) domains are also some of the most expensive domains. Are cybercriminals getting cheap with other people's credit cards? Or do the higher price make it more risky?"

Read more of this story at Slashdot.
Inside a Full-Body-Scanning X-Ray Van

Posted: October 25th, 2010, 8:18pm CEST by Soulskill

Tags: security

Velcroman1 writes "In August, Slashdotters learned that full-body scanners were roaming the streets in vans: 'The same technology used at airport check points, capable of seeing through clothes and walls, has also been rolling out on US streets where law enforcement agencies have deployed the vans to search for vehicle-based bombs. Fox took a ride in one of the $800,000 vans, videotaping the entire event — and continues the debate about security, privacy, and health risks."

Read more of this story at Slashdot.
Firefox Extension Makes Social-Network ID Spoofing Trivial

Posted: October 25th, 2010, 2:06pm CEST by timothy

Tags: security

Orome1 writes "A simple-to-use Firefox plugin presented yesterday at Toorcon in San Diego has hit the security world with the realization that squabbles about Facebook's changing privacy settings and various privacy breaches simply miss the point. 'When it comes to user privacy, SSL is the elephant in the room,' said Eric Butler, the developer of the extension in question, dubbed Firesheep. By installing and running it, anyone can 'sniff out' the unencrypted HTTP sessions currently allowing users on that network segment to access social networks, online services and other website requiring a login, and simply hijack them and impersonate the user."

Read more of this story at Slashdot.
RDS Protocol Bug Creates a Linux Kernel Hole, Now Fixed

Posted: October 21st, 2010, 8:23pm CEST by timothy

Tags: security

Trailrunner7 writes "The open-source Linux operating system contains a serious security flaw that can be exploited to gain superuser rights on a target system. The vulnerability, in the Linux implementation of the Reliable Datagram Sockets (RDS) protocol, affects unpatched versions of the Linux kernel, starting from 2.6.30, where the RDS protocol was first included." The article goes on to say, though, that "Linux installations are only vulnerable if the CONFIG_RDS kernel configuration option is set, and if there are no restrictions on unprivileged users loading packet family modules, as is the case on most stock distributions," and that Linus Torvalds has committed a fix.

Read more of this story at Slashdot.

Slashdot: Linux

RDS Protocol Bug Creates a Linux Kernel Hole, Now Fixed

Posted: October 21st, 2010, 8:23pm CEST by timothy

Tags: security

Trailrunner7 writes "The open-source Linux operating system contains a serious security flaw that can be exploited to gain superuser rights on a target system. The vulnerability, in the Linux implementation of the Reliable Datagram Sockets (RDS) protocol, affects unpatched versions of the Linux kernel, starting from 2.6.30, where the RDS protocol was first included." The article goes on to say, though, that "Linux installations are only vulnerable if the CONFIG_RDS kernel configuration option is set, and if there are no restrictions on unprivileged users loading packet family modules, as is the case on most stock distributions," and that Linus Torvalds has committed a fix.

Read more of this story at Slashdot.

Slashdot: IT

Spammers 'Gearing Up' Botnets For Holiday Rush

Posted: October 19th, 2010, 6:32pm CEST by CmdrTaco

Tags: security

chicksdaddy writes "Spam — there's less of it, but it's much nastier, according to the latest statistics from Google's Postini e-mail security service. According to a post on Google's Enterprise blog, the viral content of spam e-mail (both malicious links and attachments) was up 111% from the same quarter in 2009, even as spam volume overall dropped 24%. The Summertime malware push may be evidence of a push to pump up bot networks in advance of the busy holiday online shopping season, according to Google researchers."

Read more of this story at Slashdot.
Hacker Business Models

Posted: October 19th, 2010, 5:56pm CEST by CmdrTaco

Tags: security

wiredmikey writes "The industrialized hackers are intent on one goal — making money. They also know the basic rules of the business of increasing revenues while cutting costs. As hackers started making money, the field became full of 'professionals' that inspired organized cyber crime. Similar to industrial corporations, hackers have developed their own business models in order to operate as a profitable organization. What do these business models look like? Data has become the hacker's currency. More data, more money. So the attack logic is simple: the more attacks, the more likely victim — so you automate ..."

Read more of this story at Slashdot.
Gene Simmons Threatens Anonymous Again and Gets DDoS'd

Posted: October 19th, 2010, 5:08pm CEST by CmdrTaco

Tags: security

BussyB writes "Rather than shutting him up, the 'Operation Payback' DDoS attack on his websites only made Simmons more angry and outspoken. None of those threats seemed to bother Anonymous, however, and the group promptly launched another DDoS attack on both of Simmons' websites and rendered them inaccessible once again."

Read more of this story at Slashdot.
Adobe Reader X With Sandbox Due In November

Posted: October 18th, 2010, 6:22pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "Adobe will finally release the new version of its Reader software — which will include the much-anticipated Protected Mode security feature — next month. Adobe Reader X will include a number of other new features in addition to the sandbox feature. Adobe officials have been discussing Protected Mode for several months now and said early on that it would be included in the next version of Reader, but had never set a time line for the release of Reader X. Now, the company says the new version will be available in November, although no specific date was announced."

Read more of this story at Slashdot.
Unspoofable Device Identity Using Flash Memory

Posted: October 15th, 2010, 11:00am CEST by timothy

Tags: security

wiredmikey writes with a story from Security Week that describes a security silver lining to the inevitable errors that arise in NAND flash chips. By seeking out (or intentionally causing) defects in a given part of the chip, a unique profile can be created for any device using NAND flash which the author says may be obscured, but not reproduced: "[W]e recognize devices (or rather: their flash memory) by their defects. Very much like humans recognize faces: by their defects (or deviations from the 'norm') a bigger nose, a bit too bushy eyebrows, bigger cheeks. The nice twist is that if an attacker manages to read your device identity, he cannot inscribe it into his own device. Yes, he can create errors — like we did. But he cannot control where in the block they occur as this relies solely on microscopic manufacturing defects in the silicon."

Read more of this story at Slashdot.
Chertoff Advocates Cyber Cold War

Posted: October 15th, 2010, 12:07am CEST by timothy

Tags: security

Jack Spine writes "The US and allied countries should formulate a doctrine to apply the principles of nuclear deterrence to cyber attacks and cyber espionage, according to former US Homeland Security secretary Michael Chertoff. No matter that it's very difficult to attribute the source of cyber attacks — just take punitive action against the platform being used to attack, says Chertoff."

Read more of this story at Slashdot.
Home WiFi Network Security Failings Exposed

Posted: October 14th, 2010, 6:14pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "The shocking state of home wireless (Wi-Fi) network security in the UK has been revealed by a life assistance company study. CPP used an 'ethical hacker,' Jason Hart, to test thousands of Wi-Fi networks across six UK cities, including London. He found that many didn't even have a password and roughly half of home UK Wi-Fi networks could be hacked in less than 5 seconds."

Read more of this story at Slashdot.
IT Security Salaries Expected To Rise In 2011

Posted: October 12th, 2010, 11:36pm CEST by CmdrTaco

Tags: security

wiredmikey writes "IT security professionals in the United States can expect starting salaries to increase in 2011, according to a new salary report released today. The guide suggests larger increases in base compensation expected in high-demand segments including information security related positions. According to the report, companies are hiring security professionals to help foil fraud, prevent network breaches and comply with new regulations, to keep confidential information safe and secure."

Read more of this story at Slashdot.
Cyber-criminals Targeting Online Gaming Websites

Posted: October 12th, 2010, 10:12pm CEST by CmdrTaco

Tags: security

adeelarshad82 writes "According to a June 2010 Nielsen NetView survey on Internet usage, online gaming has overtaken e-mail in terms of the total percentage of time Americans spend online. Only social networking scores higher. On average, online gaming now consumes a staggering 407 million hours of U.S. citizens' time per year. Unfortunately, Nielsen's not the only one that noticed this trend; cybercriminals have taken note as well and are taking advantage of this by infecting games sites—from legitimate forums and tutorial sites to shadier download sites—to attack the unwary. Fortunately though, Avast has published a list of worst gaming sites."

Read more of this story at Slashdot.
Survey Shows How Stupid People Are With Passwords

Posted: October 12th, 2010, 8:06pm CEST by CmdrTaco

Tags: security

wiredmikey writes "Another study was released to today that once again shows how careless people really are online. When it comes to safeguarding personal information online, many people don't seem to care very much, or don't think enough about it. In the survey of more than 2,500 people, some interesting and scary trends were revealed in how users handle their online passwords..."

Read more of this story at Slashdot.
New Tool Blocks Downloads From Malicious Sites

Posted: October 10th, 2010, 9:04pm CEST by timothy

Tags: security

Hugh Pickens writes "Science Daily Headlines reports that a new tool has been developed (funded by the National Science Foundation, US Army Research Office and US Office of Naval Research) to prevent 'drive-by downloads' whereby simply visiting a website, malware can be silently installed on a computer to steal a user's identity and other personal information, launch denial-of-service attacks, or participate in botnet activity. The software called Blade — short for Block All Drive-By Download Exploits — is browser-independent and designed to eliminate all drive-by malware installation threats by tracking how users interact with their browsers to distinguish downloads that received user authorization from those that do not. 'BLADE monitors and analyzes everything that is downloaded to a user's hard drive to cross-check whether the user authorized the computer to open, run or store the file on the hard drive. If the answer is no to these questions, BLADE stops the program from installing or running and removes it from the hard drive,' says Wenke Lee, a professor in the School of Computer Science in Georgia Tech's College of Computing. Blade's testbed automatically harvests malware URLs from multiple whitehat sources on a daily basis and has an interesting display of the infection rate of different browsers, the applications targeted by drive-by exploits, and the anti-virus detect and miss rates of drive-by binaries."

Read more of this story at Slashdot.
Microsoft Eyes PC Isolation Ward To Thwart Botnets

Posted: October 8th, 2010, 2:09am CEST by timothy

Tags: security

CWmike writes "In a paper published Wednesday (PDF), Scott Charney, who heads Microsoft's trustworthy computing group, spelled out a concept of 'collective defense' that he said was modeled after public health measures like vaccinations and quarantines. The aim: To block botnet-infected computers from connecting to the Internet. Under the proposal, PCs would be issued a 'health certificate' that showed whether the system was fully patched, that it was running security software and a firewall, and that it was malware-free. Machines with deficiencies would require patching or an antivirus update, while bot-infected PCs might be barred from the Internet."

Read more of this story at Slashdot.
Spammers Using Soft Hyphen To Hide Malicious URLs

Posted: October 7th, 2010, 11:32pm CEST by timothy

Tags: security

Trailrunner7 writes with this excerpt from ThreatPost illustrating the ongoing Spy-vs.-Spy battle between spammers and the rest of us: "Spammers have jumped on the little-used soft hyphen (or SHY character) to fool URL filtering devices. According to researchers, spammers are larding up URLs for sites they promote with the soft hyphen character, which many browsers ignore. Spammers aren't shy about jumping humans flexible cognitive abilities to slip past the notice of spam filters (H3rb41 V14gr4, anyone?). ... The latest trend involves the use of an obscure character called the soft hyphen or 'SHY' character to obscure malicious URLs in spam messages. Writing on the Symantec Connect blog, researcher Samir Patil said that the company has seen recent spam messages that insert the HTML symbol for the soft hyphen to obfuscate URLs for Web pages promoted by the spammers."

Read more of this story at Slashdot.
Would-Be Akamai Spy Busted By Feds

Posted: October 7th, 2010, 3:59pm CEST by CmdrTaco

Tags: security

itwbennett writes "Elliot Doxer, an Akamai Technologies staffer, was charged on Wednesday with wire fraud. The case began in June 2006 when Doxer sent an e-mail to the consulate of a foreign country (referred to as 'country X') in which he 'expressed his desire to help that country with whatever information he could obtain in his position,' according to an article on ITworld. 'The foreign consulate that Doxer contacted turned his e-mail over to law enforcement authorities, and a little over a year later, he was contacted by an FBI agent posing as a representative of 'country X.' Over the next 18 months, Doxer left confidential business information such as customer lists and contracts at a designated spot called a dead drop, acts captured via video surveillance.'"

Read more of this story at Slashdot.
Politically Motivated Cyber Attacks

Posted: October 6th, 2010, 3:30pm CEST by CmdrTaco

Tags: security

Orome1 writes "According to a new report, 53 percent of critical infrastructure providers report that their networks have experienced what they perceived as politically motivated cyber attacks. Participants of the Symantec survey claimed to have experienced such an attack on an average of 10 times in the past five years, incurring an average cost of $850,000 during a period of five years to their businesses. Participants from the energy industry reported that they were best prepared for such an attack, while participants from the communications industry reported that they were the least prepared."

Read more of this story at Slashdot.
Cryptome Hacked; All Files Deleted

Posted: October 5th, 2010, 11:43pm CEST by CmdrTaco

Tags: security

eldavojohn writes "Over the weekend, the whistle blowing site Cryptome was hacked and vandalized, resulting in all 54,000 files being deleted and two days worth of submissions lost. Cryptome reported that its EarthLink e-mail account was compromised in ways unknown, and once the attacker was inside there, they were able to request a new password from the administration console for Cryptome at their hosting provider, Network Solutions. Once the attacker had that password, they deleted the ~7 GB of data that Cryptome hosted in around 54,000 files. Cryptome was able to eventually restore the site, as they keep backups ready for cases like this and stated that they 'do not trust our ISP, email provider and officials to tell the truth or protect us.'"

Read more of this story at Slashdot.
Analyzing CAPTCHAs

Posted: October 5th, 2010, 3:32pm CEST by CmdrTaco

Tags: security

Bruce Schneier's blog pointed me to a research paper on "Attacks and Design of Image Recognition CAPTCHAs" (PDF). The abstract says, "We systematically study the design of image recognition CAPTCHAs (IRCs) in this paper. We first review and examine all IRCs schemes known to us and evaluate each scheme against the practical requirements in CAPTCHA applications, particularly in large-scale real-life applications such as Gmail and Hotmail."

Read more of this story at Slashdot.
Geolocation XSS Tracker Proof of Concept

Posted: October 4th, 2010, 6:23pm CEST by CmdrTaco

Tags: security

Jamie found a bit of a scary link this morning that demonstrates a router XSS getting your MAC address and using it to map your current location. Which I'm sure is totally no big deal for anyone.

Read more of this story at Slashdot.
Iran Arrests Alleged Spies Over Stuxnet Worm

Posted: October 2nd, 2010, 7:13pm CEST by Soulskill

Tags: security

kaptink writes "Reports surfacing from Iran claim 'nuclear spies' have been arrested over the infection at the Busheher nuclear station, which opened in August. According to Intelligence Minister Heydar Moslehi, because Stuxnet is so sophisticated, cost so much to write and uses two stolen security certificates, he believes only a national intelligence agency or a huge private company could have devised it, calling them 'enemies' spy services."

Read more of this story at Slashdot.
Stuxnet Analysis Backs Iran-Israel Connection

Posted: October 2nd, 2010, 12:32am CEST by Soulskill

Tags: security

Trailrunner7 writes "Liam O'Murchu of Symantec, speaking at the Virus Bulletin Conference, provided the first detailed public analysis of the worm's inner workings to an audience of some of the world's top computer virus experts. O'Murchu described a sophisticated and highly targeted virus and demonstrated a proof of concept exploit that showed how the virus could cause machines using infected PLCs to run out of control. Though most of the conversation about Stuxnet is still based on conjecture, O'Murchu said that Symantec's analysis of Stuxnet's code for manipulating PLCs on industrial control systems by Siemens backs up both the speculation that Iran was the intended target and that Israel was the possible source of the virus. O'Murchu noted that researchers had uncovered the reference to an obscure date in the worm's code, May 9, 1979, which, he noted, was the date on which a prominent Iranian Jew, Habib Elghanian, was executed by the new Islamic government shortly after the revolution. Anti-virus experts said O'Murchu's hypothesis about the origins of Stuxnet were plausible, though some continue to wonder how the authors of such a sophisticated piece of malware allowed it to break into the wild and attract attention." Symantec has also issued a lengthy and detailed dossier on Stuxnet (PDF).

Read more of this story at Slashdot.
Exploits Propagated Via Social Media Increase

Posted: September 30th, 2010, 11:45pm CEST by CmdrTaco

Tags: security

Orome1 writes "Infection via email, traditionally the most popular vector for spreading malware, has declined in favor of greater use of social media. These include clickjacking attacks using the Facebook 'Like' button, fake Web pages positioned on search engines (BlackHat SEO), and zero-day vulnerability exploits. The rise in popularity of smart phones powered by Google's Android operating system for smart phones has been accompanied by an increase in attacks targeting these devices. A number of different threats have appeared, primarily aimed at racking up phone bills or using the geolocalization function to transmit a user's position to a third party."

Read more of this story at Slashdot.
Map Based Passwords

Posted: September 29th, 2010, 8:58pm CEST by samzenpus

Tags: security

smitty777 writes "Discovery is running an article on passwords based on a very specific location on a map. Instead of showing UID and Password fields, the user would simply click on a very specific spot on Google Earth, for example. I wonder how you would make that secure? Also, if you forgot, would you get a message saying 'Your password is the third flamingo on the left on the lawn of Aunt Bessie's house'?"

Read more of this story at Slashdot.
Attack Targets LinkedIn Users With Fake Contact Requests

Posted: September 27th, 2010, 11:09pm CEST by Soulskill

Tags: security

wiredmikey writes "On Monday morning, cybercriminals began sending massive volumes of spam email messages targeting LinkedIn users. Starting at approximately 10am GMT, users of the popular business-focused social networking site began receiving emails with a fake contact request containing a malicious link. According to Cisco Security Intelligence, these messages accounted for as much as 24% of all spam sent within a 15-minute interval today. If users click, they are taken to a web page that says 'PLEASE WAITING.... 4 SECONDS..' and then redirected to Google, appearing as if nothing has happened. During those four seconds, the site attempted to infect the victim's PC with the ZeuS Malware via a 'drive-by download' – something that requires little or no user interaction to infect a system."

Read more of this story at Slashdot.
Malware Running On Graphics Cards

Posted: September 27th, 2010, 6:22pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "Given the great potential of general-purpose computing on graphics processors, it is only natural to expect that malware authors will attempt to tap the powerful features of modern GPUs to their benefit. In this paper, the authors demonstrate the feasibility of implementing a malware that can utilize the GPU (PDF) to evade virus scanning applications. Moreover, the authors discuss the potential of more sophisticated attacks, like accessing the screen pixels periodically to harvest private data displayed on the user screen, or to trick the the user by displaying false, benign-looking information when visiting rogue web sites (e.g., overwriting suspicious URLs with benign-looking ones in the browser's address bar)."

Read more of this story at Slashdot.
Are Desktop Firewalls Overkill?

Posted: September 22nd, 2010, 5:33pm CEST by CmdrTaco

Tags: security

Barence writes "Should you be running firewalls on your desktop and server machines? PC Pro's Jon Honeyball argues the case for switching off Windows firewalls and handing over responsibility for security to server-based solutions. 'I'd rather have security baked right into my network design than scattered willy-nilly around my desktops and servers,' Honeyball argues. 'It seems to me that there's much sense in concentrating your security into a small number of trusty gatekeepers rather than relying on a fog of barely managed faux security devices. Of course, it puts your eggs into fewer baskets, but it does mean these gatekeepers are easier to control and manage: monitoring them in real-time becomes routine.'"

Read more of this story at Slashdot.
Twitter Closes Hole After Attack Hits Up To 500K Users

Posted: September 21st, 2010, 9:55pm CEST by CmdrTaco

Tags: security

chicksdaddy writes "Twitter closed an ugly cross site scripting hole in its Web page Tuesday morning, but not until a fast moving attack, including at least two Twitter worms, compromised hundreds of thousands of user accounts. At its height, the attacks were hitting 100 Twitter users each second, putting estimates of the total number of victims at around 500,000 according to researchers at Kaspersky Lab."

Read more of this story at Slashdot.
Stuxnet Worm May Have Targeted Iranian Reactor

Posted: September 21st, 2010, 7:02pm CEST by CmdrTaco

Tags: security

yuna49 writes "Analysis of the Stuxnet worm suggests its target might have been Iran's nuclear program. "Last week Ralph Langner, a well-respected expert on industrial systems security, published an analysis of the Stuxnet worm, which targets Siemens software systems, and suggested that it may have been used to sabotage Iran's Bushehr nuclear reactor. A Siemens expert, Langner simulated a Siemens industrial network and then analyzed the worm's attack. Experts had first thought that Stuxnet was written to steal industrial secrets, but Langner found something quite different. The worm actually looks for very specific Siemens settings — a kind of fingerprint that tells it that it has been installed on a very specific Programmable Logic Controller (PLC) device — and then it injects its own code into that system."

Read more of this story at Slashdot.
Twitter Suffers Web Interface Exploit

Posted: September 21st, 2010, 3:30pm CEST by CmdrTaco

Tags: security

HaloZero writes "We're seeing lots of re-tweets on Twitter.com right now, all containing a fragment of JavaScript, which re-tweets itself when moused-over on the Twitter web interface. This could easily be muted into a more sinister attack, so it is recommended that you use a third party client application, or refrain from social media altogether until the problem is resolved."

Read more of this story at Slashdot.
Twitter Suffers Web Interface Exploit

Posted: September 21st, 2010, 3:30pm CEST by CmdrTaco

Tags: security

HaloZero writes "We're seeing lots of re-tweets on Twitter.com right now, all containing a fragment of JavaScript, which re-tweets itself when moused-over on the Twitter web interface. This could easily be muted into a more sinister attack, so it is recommended that you use a third party client application, or refrain from social media altogether until the problem is resolved."

Read more of this story at Slashdot.
ZoneAlarm Employs Scare Tactics Against Its Users

Posted: September 20th, 2010, 10:56pm CEST by Soulskill

Tags: security

snydeq writes "Check Point Software appears to be ripping a page from the 'scum it claims to fight,' running a scare-tactic warning dialog to frighten users into upgrading to a paid version of the company's ZoneAlarm firewall product. Preying on fears of ZeuS.Zbot, the Check Point warning dialog tells users their PCs 'may be in danger' without having found ZeuS.Zbot, nor having checked to see whether you're running an antivirus product. 'The program doesn't care if you're infected with ZeuS.Zbot, or if you have protection in place. It just wants to sell you an upgrade to the firewall that may or may not detect future ZeuS.Zbot variants' activities — some day.' Check Point's customers have inundated the ZoneAlarm forums with complaints."

Read more of this story at Slashdot.
Linux Kernel Exploit Busily Rooting 64-Bit Machines

Posted: September 20th, 2010, 5:11am CEST by timothy

Tags: security

An anonymous reader writes "Running 64-bit Linux? Haven't updated yet? You're probably being rooted as I type this. CVE-2010-3081, this week's second high-profile local root exploit in the Linux kernel, is compromising machines left and right. Almost all 64-bit machines are affected, and 'Ac1db1tch3z' (classy) published code to let any local user get a root shell. Ac1db1tch3z's exploit is more malicious than usual because it leaves a backdoor behind for itself to exploit later even if the hole is patched. Luckily, there's a tool you can run to see if you've already been exploited, courtesy of security company Ksplice, which beat most of the Linux vendors with a 'rebootless' version of the patch."

Read more of this story at Slashdot.

Slashdot: Linux

Linux Kernel Exploit Busily Rooting 64-Bit Machines

Posted: September 20th, 2010, 5:11am CEST by timothy

Tags: security

An anonymous reader writes "Running 64-bit Linux? Haven't updated yet? You're probably being rooted as I type this. CVE-2010-3081, this week's second high-profile local root exploit in the Linux kernel, is compromising machines left and right. Almost all 64-bit machines are affected, and 'Ac1db1tch3z' (classy) published code to let any local user get a root shell. Ac1db1tch3z's exploit is more malicious than usual because it leaves a backdoor behind for itself to exploit later even if the hole is patched. Luckily, there's a tool you can run to see if you've already been exploited, courtesy of security company Ksplice, which beat most of the Linux vendors with a 'rebootless' version of the patch."

Read more of this story at Slashdot.

Slashdot: IT

Hole In Linux Kernel Provides Root Rights

Posted: September 19th, 2010, 2:20am CEST by Soulskill

Tags: security

oztiks writes with this excerpt from The H: "A vulnerability in the 32-bit compatibility mode of the current Linux kernel (and previous versions) for 64-bit systems can be exploited to escalate privileges. For instance, attackers can break into a system and exploit a hole in the web server to get complete root (also known as superuser) rights or permissions for a victim's system. According to a report, the problem occurs because the 32-bit call emulation layer does not check whether the call is truly in the Syscall table. Ben Hawkes, who discovered the problem, says the vulnerability can be exploited to execute arbitrary code with kernel rights. ... Hawkes says the vulnerability was discovered and remedied back in 2007, but at some point in 2008 kernel developers apparently removed the patch, reintroducing the vulnerability. The older exploit apparently only needed slight modifications to work with the new hole."

Read more of this story at Slashdot.

Slashdot: Linux

Hole In Linux Kernel Provides Root Rights

Posted: September 19th, 2010, 2:20am CEST by Soulskill

Tags: security

oztiks writes with this excerpt from The H: "A vulnerability in the 32-bit compatibility mode of the current Linux kernel (and previous versions) for 64-bit systems can be exploited to escalate privileges. For instance, attackers can break into a system and exploit a hole in the web server to get complete root (also known as superuser) rights or permissions for a victim's system. According to a report, the problem occurs because the 32-bit call emulation layer does not check whether the call is truly in the Syscall table. Ben Hawkes, who discovered the problem, says the vulnerability can be exploited to execute arbitrary code with kernel rights. ... Hawkes says the vulnerability was discovered and remedied back in 2007, but at some point in 2008 kernel developers apparently removed the patch, reintroducing the vulnerability. The older exploit apparently only needed slight modifications to work with the new hole."

Read more of this story at Slashdot.

Slashdot: IT

DDoS From 4chan Hits MPAA and Anti-Piracy Website

Posted: September 18th, 2010, 11:56pm CEST by Soulskill

Tags: security

ACKyushu writes "Say what you like about 4chan; when they want something done, it gets done. Following a call to arms yesterday, the masses inhabiting the anonymous 4chan boards have carried out a huge assault on a pair of anti-piracy enemies. The website of Aiplex Software, the anti-piracy outfit which has been DDoSing torrent sites recently, fell victim to a DDoS itself. They were joined in the Internet wasteland by the MPAA's website, which also fell to a huge and sustained attack."

Read more of this story at Slashdot.
Security a Concern As HTML5 Advances

Posted: September 17th, 2010, 7:45pm CEST by Soulskill

Tags: security

Trailrunner7 writes "Every technology innovation has its coming out party, and Google Inc.'s recent 'dancing balls' logo experiment was widely interpreted as a high-impact debut for HTML5. But web security experts are warning that the sprawling new web standard may favor functionality over security, enabling a new generation of powerful web-based attacks. They agree that there are security enhancements in HTML5, but all expressed the same concern: that the new specification will greatly increase the 'attack surface' of HTML — providing more avenues by which malicious code can be delivered through the web. 'HTML5 has an enormous amount of functionality. The (specification) is just huge,' said Jeremiah Grossman of security firm WhiteHat. The breadth of the new specification gives him concern. 'I know that we're still finding vulnerabilities in HTML4,' Grossman said."

Read more of this story at Slashdot.
One Million Sites Infected With Malware In Q2

Posted: September 16th, 2010, 6:22pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "More than one million Web domains were infected with malicious code in the second quarter of 2010 — around one percent of all active Web domains, according to new data. The number of infected domains was extrapolated from data gained through a sample scan of what Dasient describes as 'millions of Web sites,' as well as from customer deployments. It suggests that compromises of Web sites are on the rise, as attackers look to push out malicious programs through so-called drive by download attacks."

Read more of this story at Slashdot.
Facebook the Most Dangerous Social Tool For Businesses

Posted: September 15th, 2010, 11:32pm CEST by samzenpus

Tags: security

wiredmikey writes "According to a recent study Facebook is by far the most popular and most dangerous social media tool among small-to-medium-sized businesses, with 69 percent of respondents reporting that they have active accounts with this site, followed by Twitter, YouTube, and LinkedIn. Facebook is also the top culprit for malware infections and privacy violations, e.g. the leaking of sensitive company information. YouTube took the second spot for malware infection, while Twitter contributed to a significant number of privacy violations. For companies suffering financial losses from employee privacy violations, Facebook was again cited as the most common social media site where these losses occurred, followed by Twitter, YouTube, and LinkedIn."

Read more of this story at Slashdot.
Stuxnet Attacks Used 4 Windows Zero-Day Exploits

Posted: September 14th, 2010, 10:00pm CEST by CmdrTaco

Tags: security

abadnog writes "The attackers behind the recent Stuxnet worm attack used four different zero-day security vulnerabilities to burrow into — and spread around — Microsoft's Windows operating system, according to a startling disclosure from Microsoft. Two of the four vulnerabilities are still unpatched. Microsoft said the attackers initially targeted the old MS08-067 vulnerability (used in the Conficker attack), a new LNK (Windows Shortcut) flaw to launch exploit code on vulnerable Windows systems and a zero-day bug in the Print Spooler Service that makes it possible for malicious code to be passed to, and then executed on, a remote machine. The malware also exploited two different elevation of privilege holes to gain complete control over the affected system."

Read more of this story at Slashdot.
EFF Says 'Stop Using Haystack'

Posted: September 14th, 2010, 3:45pm CEST by CmdrTaco

Tags: security

tenco writes "Based on a blog post by the CRC today, EFF warns against using Haystack for circumventing censorship firewalls in Iran. Jacob Appelbaum states on twitter: 'Haystack is the worst piece of software I have ever had the displeasure of ripping apart.'"

Read more of this story at Slashdot.
Criminals Steal House Thanks To Hacked Email

Posted: September 14th, 2010, 8:20am CEST by Soulskill

Tags: security

mask.of.sanity writes with this quote from ZDNet: "An international cybercrime investigation is underway into a sophisticated scam network that used email and fax to sell an Australian man's AU$500,000 property without his knowledge. The man was overseas when the Nigerian-based scammers stole his credentials and amazingly sold two houses through his real estate agent. He rushed home and prevented the sale of his second home from being finalized. Australian Federal Police and overseas law enforcement agencies will investigate the complex scam, which is considered the first of its kind in Australia. It is alleged scammers had stolen the man's email account and personal property documents to sell the houses and funnel cash into Chinese bank accounts. Investigating agencies admit the scammers hoodwinked both the selling agents and the government, and said they had enough information to satisfy regulatory requirements. The police did not rule out if the scammers had links to the man."

Read more of this story at Slashdot.
Microsoft Helps Adobe Block PDF Zero-Day Exploit

Posted: September 13th, 2010, 9:34pm CEST by Soulskill

Tags: security

CWmike writes "Microsoft has urged Windows users to block ongoing attacks against Adobe's popular PDF viewer by deploying one of Microsoft's enterprise tools. Adobe echoed Microsoft's advice, saying the Enhanced Migration Experience Toolkit (EMET) would stymie attacks targeting Reader and Acrobat. Called 'scary' and 'clever,' the in-the-wild exploit went public last week when security researcher Mila Parkour reported it to Adobe after analyzing a rogue PDF document attached to spam. Adobe first warned users Wednesday of the threat, but at the time gave users no advice on how to protect themselves until a patch was ready. Microsoft stepped in on Friday. 'The good news is that if you have EMET enabled ... it blocks this exploit,' said Fermin Serna and Andrew Roths, two engineers with the Microsoft Security Response Center in an entry on the group's blog." A Symantec blog post suggests the people exploiting this vulnerability may be the 'Aurora' group responsible for the attacks on Google late last year.

Read more of this story at Slashdot.
New Adobe PDF Zero-Day Under Attack

Posted: September 9th, 2010, 6:07pm CEST by CmdrTaco

Tags: security

Rahmmp writes "Adobe has sounded an alarm for a new zero-day flaw in its PDF Reader/Acrobat software, warning that hackers are actively exploiting the vulnerability in-the-wild. An Adobe spokeswoman described the attacks as 'limited' but warned that that could change with the availability of public samples and exploit code."

Read more of this story at Slashdot.
Behind the Scenes and Inside Workings of a CERT

Posted: September 7th, 2010, 3:42pm CEST by timothy

Tags: security

An anonymous reader writes "Ireland's Computer Emergency Response Team differs from what you can find in most other countries, since it's not government-backed and relies mainly on the good will of several security professionals. In this interview, the founder and head of the CERT, Brian Honan, talks about how the CERT was formed, what equipment they use and what challenges they face in their daily work without having a government to back them up."

Read more of this story at Slashdot.
Dubai's Police Chief Calls BlackBerry a Spy Tool

Posted: September 5th, 2010, 8:20am CEST by Soulskill

Tags: security

crimeandpunishment writes "Does the battle over the Blackberry ban in the United Arab Emirates have its roots in a spy story? Dubai's police chief says concern over espionage (specifically, by the US and Israel) led to the decision to limit BlackBerry services. The UAE says it will block BlackBerry email, messaging, and web services on October 11th unless it gets access to encrypted data. Comments by Lt. Gen. Dahi Khalfan Tamim are often seen as reflecting the views of Dubai's leadership, and would appear to indicate a very hard line in talks with Research in Motion."

Read more of this story at Slashdot.
Facebook To Add Remote Logout

Posted: September 3rd, 2010, 8:30am CEST by timothy

Tags: security

angry tapir writes "Facebook users will soon have a new way of knocking spammers out of legitimate accounts. The social-networking company is rolling out a new security feature that lets users see which computers and devices are logged into their Facebook accounts, and then removing the ones that they don't want to have access."

Read more of this story at Slashdot.
Your Smartphone Is Safer Than Your PC -- For Now

Posted: August 31st, 2010, 9:21pm CEST by CmdrTaco

Tags: security

snydeq writes "InfoWorld's Galen Gruman reports on the future of mobile security — one that will see a significant rise in exploits as valuable information increasingly migrates to mobile devices. To date, sandboxing and code-signing have helped make mobile OSes relatively secure, when compared with their desktop brethren. But as devices store more valuable information than email, they will become more enticing to hackers currently breaking into Windows PCs. And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use — too many for Google or the carriers to patch securely. And as the PDF-jailbreak vulnerability showed, sandboxing has its limits when it comes to securing the browser — the most likely point of entry for exploits not due to the rise of extensions, helper objects, and plug-ins on the mobile Web."

Read more of this story at Slashdot.
Your Smartphone Is Safer Than Your PC — For Now

Posted: August 31st, 2010, 9:21pm CEST by CmdrTaco

Tags: security

snydeq writes "InfoWorld's Galen Gruman reports on the future of mobile security — one that will see a significant rise in exploits as valuable information increasingly migrates to mobile devices. To date, sandboxing and code-signing have helped make mobile OSes relatively secure, when compared with their desktop brethren. But as devices store more valuable information than email, they will become more enticing to hackers currently breaking into Windows PCs. And the biggest bulls-eye appears to be on Android, in large part because its architecture is most like that of the desktop PC but also because there are so many variants in use — too many for Google or the carriers to patch securely. And as the PDF-jailbreak vulnerability showed, sandboxing has its limits when it comes to securing the browser — the most likely point of entry for exploits not due to the rise of extensions, helper objects, and plug-ins on the mobile Web."

Read more of this story at Slashdot.
The Nuclear Bunker Where Wikileaks Will Be Located

Posted: August 31st, 2010, 6:16pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "Engadget has photos of 'Pionen White Mountains, the nuclear bunker in which Wikileaks will locate some of its servers. It was excavated 98 feet underground, in a rock hill in the center of Stockholm, Sweden, during the Cold War.' It looks like they hired the same interior designer who decorated Batman's lair."

Read more of this story at Slashdot.
New QuickTime Flaw Bypasses ASLR, DEP

Posted: August 31st, 2010, 6:07am CEST by Soulskill

Tags: security

Trailrunner7 writes "A Spanish security researcher has discovered a new vulnerability in Apple's QuickTime software that can be used to bypass both ASLR and DEP on current versions of Windows and give an attacker control of a remote PC. The flaw apparently results from a parameter from an older version of QuickTime that was left in the code by mistake. It was discovered by Ruben Santamarta of Wintercore, who said the vulnerability can be exploited remotely via a malicious Web site. On a machine running Internet Explorer on Windows 7, Vista or XP with QuickTime 7.x or 6.x installed, the problem can be exploited by using a heap-spraying technique. In his explanation of the details of the vulnerability and the exploit for it, Santamarta said he believes the parameter at the heart of the problem simply was not cleared out of older versions of the QuickTime code. 'The QuickTime plugin is widely installed and exploitable through IE; ASLR and DEP are not effective in this case and we will likely see this in the wild,' said HD Moore, founder of the Metasploit Project."

Read more of this story at Slashdot.
BlackBerry Battle In India Going Down To the Wire

Posted: August 28th, 2010, 12:38am CEST by Soulskill

Tags: security

crimeandpunishment writes "With just days before the deadline, BlackBerry's maker was shot down by India in its latest effort to avoid having its services cut off for about a million Indian users of the device. Research in Motion's effort to broaden the debate over data encryption were rejected. The Indian government wants access to users' emails. The head of a powerful industry group in India accused RIM of taking the wrong approach to negotiations, saying, 'It need not have escalated to this level. Folks like RIM have to understand business is done differently here.'"

Read more of this story at Slashdot.
A Conference For Malware Writers

Posted: August 27th, 2010, 9:32pm CEST by Soulskill

Tags: security

tsu doh nimh writes "There is a security conference being held in Mumbai later this year called MalCon, and the organizers say it's the first ever conference dedicated to the 'malcoder community.' Brian Krebs interviewed one of them and got this gem: 'Just like the concept of "ethical hacking" has helped organizations to see that hackers are not all that bad, it is time to accept that "ethical malcoding" is required to research, identify and mitigate newer malwares in a "proactive" way.' Bruce Schneier is speaking at a sister MalCon event in Pune, India two days later, and he said he doesn't agree with the organizer's premise that more malware is needed to build better security tools."

Read more of this story at Slashdot.
Many Hackers Accidentally Send Their Code To Microsoft

Posted: August 27th, 2010, 3:30pm CEST by Soulskill

Tags: security

joshgnosis writes "When hackers crash Windows in the course of developing malware, they'll often accidentally agree to send the virus code straight to Microsoft, according to senior security architect Rocky Heckman. 'It's amazing how much stuff we get.' Heckman also said Microsoft was a common target for people testing their attacks. 'The first thing [script kiddies] do is fire off all these attacks at Microsoft.com. On average we get attacked between 7000 and 9000 times per second.'"

Read more of this story at Slashdot.
25% of Worms Spread Via USB

Posted: August 26th, 2010, 4:32pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "In 2010, 25 percent of new worms have been specifically designed to spread through USB storage devices connected to computers, according to PandaLabs. This distribution technique is highly effective. With survey responses from more than 10,470 companies across 20 countries, it was revealed that approximately 48 percent of SMBs (with up to 1,000 computers) admit to having been infected by some type of malware over the last year. As further proof, 27 percent confirmed that the source of the infection was a USB device connected to a computer."

Read more of this story at Slashdot.
UVB-76 Broadcasts New Voice Message

Posted: August 25th, 2010, 12:54am CEST by CmdrTaco

Tags: security

Doug52392 writes "Following days of increased activity, the Russian numbers station UVB-76 has sent out a new voice transmission. The transmission, sent out on August 23, 2010 at 9:35AM PST, recited the following in Russian: 'UVB-76, UVB-76 — 93 882 naimina 74 14 35 74 — 9 3 8 8 2 nikolai, anna, ivan, michail, ivan, nikolai, anna, 7, 4, 1, 4, 3, 5, 7, 4' The station, believed to be a part of the former Soviet Union's dead man's switch system, has been continually broadcasting for over twenty years, and its purpose has never been fully explained."

Read more of this story at Slashdot.
Searching For Backdoors From Rogue IT Staff

Posted: August 24th, 2010, 11:43pm CEST by CmdrTaco

Tags: security

WHiTe VaMPiRe writes "When IT staff are terminated under duress, there is often justification for a complete infrastructure audit to reduce future risk to a company. Here is an exploration of the steps necessary to maintain security." Of course the first piece of advice is to basically assume you've been rooted. Ouch.

Read more of this story at Slashdot.
Gaming Foursquare With 9 Lines of Perl

Posted: August 21st, 2010, 5:25pm CEST by Soulskill

Tags: security

caffeinemessiah writes "With the recent launch of Facebook Places, the rise to prominence of Foursquare and GoWalla, and articles in the New York Times about the increasing popularity of 'checking in' to locations using GPS-enabled mobile phones, a number of businesses are wondering how to reward frequent patrons. But exactly how susceptible are these 'location based services' to being abused? A researcher at the University of Illinois at Chicago shows how easily Foursquare can be gamed in 9 Perl statements, and invites readers to submit more succinct versions of the code to game the system." An anonymous reader contributes a link to a similar article about spoofing Facebook Places to create an alibi.

Read more of this story at Slashdot.
Intel Buys McAfee

Posted: August 19th, 2010, 3:14pm CEST by CmdrTaco

Tags: security

Several readers have noted that Intel has agreed to buy McAfee, the computer antivirus software maker, for about $7.7 billion in cash. There is also a press release available if you are into that sort of thing.

Read more of this story at Slashdot.
Owning Virtual Worlds For Fun and Profit

Posted: August 19th, 2010, 1:20am CEST by samzenpus

Tags: security

Trailrunner7 writes "Threatpost has a guest column by security researcher Charlie Miller on the ways in which attackers can easily take advantage of vulnerabilities in virtual worlds and perhaps online games to get control of other players' characters and avatars and even cash out their real-world bank accounts. From the article: 'It turns out that Second Life uses QuickTime Player to process its multimedia. When I started looking into virtual world exploits, with the help of Dino Dai Zovi, there was a stack buffer overflow in QuickTime Player that had been discovered by Krystian Kloskowski but had not yet been patched. In Second Life it is possible to embed images and video onto objects. We embedded a vulnerable file onto a small pink cube and placed it onto a [tract] of land we owned. No matter where the cube was, if a victim walked onto the land and had multimedia enabled (recommended but not required), they would be exploited. The cube could be inside a building, hovering in the air, or even under the ground, and the result was the same.'"

Read more of this story at Slashdot.
1978 Cryptosystem Resists Quantum Attack

Posted: August 18th, 2010, 10:44pm CEST by samzenpus

Tags: security

KentuckyFC writes "In 1978, the CalTech mathematician Robert McEliece developed a cryptosystem based on the (then) new idea of using asymmetric mathematical functions to create different keys for encrypting and decrypting information. The security of these systems relies on mathematical steps that are easy to make in one direction but hard to do in the other. Today, popular encryption systems such as the RSA algorithm use exactly this idea. But in 1994, the mathematician Peter Shor dreamt up a quantum algorithm that could factorise much faster than any classical counterpart and so can break these codes. As soon as the first decent-sized quantum computer is switched on, these codes will become breakable. Since then, cryptographers have been hunting for encryption systems that will be safe in the post quantum world. Now a group of mathematicians have shown that the McEliece encryption system is safe against attack by Shor's algorithm and all other known quantum algorithms. That's because it does not depend on factorisation but gets its security from another asymmetric conundrum known as the hidden subgroup problem which they show is immune to all known quantum attacks."

Read more of this story at Slashdot.
Employees Would Steal Data When Leaving a Job

Posted: August 18th, 2010, 4:30pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "Employees openly admit they would take company data, including customer data and product plans, when leaving a job. In response to a recent survey, 49% of US workers and 52% of British workers admitted they would take some form of company property with them when leaving a position: 29% (US) and 23% (UK) would take customer data, including contact information; 23% (US) and 22% (UK) would take electronic files; 15% (US) and 17% (UK) would take product information, including designs and plans; and 13% (US) and 22% (UK) would take small office supplies."

Read more of this story at Slashdot.
5 Million Domains Serving Malware Via Network Solutions

Posted: August 16th, 2010, 11:53pm CEST by Soulskill

Tags: security

An anonymous reader writes "A compromised widget provided by Network Solutions was serving malware on otherwise legitimate websites. But, as bad as this discovery was, it was overshadowed a couple of days later by another revelation: the widget is automatically included on every 'parked domain' by Network Solutions! Searches on Google and Yahoo! revealed 500,000 and 5,000,000 domains affected and serving malware, respectively. A manual check of some 200 parked domains on the list showed that all of them were provided with the malware-serving widget." The researchers who uncovered this issue alerted Network Solutions, and the widget was taken down a few hours later.

Read more of this story at Slashdot.
"Dislike" Button Scam Hits Facebook Users

Posted: August 16th, 2010, 3:48pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "A message saying 'I just got the Dislike button, so now I can dislike all of your dumb posts lol!!' is spreading rapidly on Facebook, tempting unsuspecting users into believing that they will be able to "dislike" posts as well as "like" them. However, security researchers say that it is just the latest 'survey scam', tricking Facebook users into into giving a rogue Facebook application permission to access their profile, and posting spam messages from their account. The rogue application requires victims to complete an online survey (which makes money for the scammers) before ultimately redirecting to a Firefox browser add-on for a Facebook dislike button developed by FaceMod. "As far as we can tell, FaceMod aren't connected with the scam — their browser add-on is simply being used as bait," says Sophos security blogger Graham Cluley."

Read more of this story at Slashdot.
Facebook Bug Could Give Spammers Names, Photos

Posted: August 12th, 2010, 10:11pm CEST by timothy

Tags: security

angry tapir writes with this excerpt from an IDG report: "Facebook is scrambling to fix a bug in its website that could be misused by spammers to harvest user names and photographs. It turns out that if someone enters the e-mail address of a Facebook user along with the wrong password, Facebook returns a special 'Please re-enter your password' page, which includes the Facebook photo and full name of the person associated with the address. A spammer with an e-mail list could write a script that enters the e-mail addresses into Facebook and then logs the real names. This could help make a phishing attack more realistic."

Read more of this story at Slashdot.
ISP Owner Who Fought FBI Spying Freed From Gag Order

Posted: August 12th, 2010, 7:47pm CEST by timothy

Tags: security

Tootech writes "So you wonder what happens when an ISP recieves a a so-called 'national security letter' from the FBI? Well, read this about an ISP owner's fight to not have to turn over everything and the sink to the FBI: 'The owner of an internet service provider who mounted a high-profile court challenge to a secret FBI records demand has finally been partially released from a 6-year-old gag order that forced him to keep his role in the case a secret from even his closest friends and family. He can now identify himself and discuss the case, although he still can't reveal what information the FBI sought. Nicholas Merrill, 37, was president of New York-based Calyx Internet Access when he received a so-called "national security letter" from the FBI in February 2004 demanding records of one of his customers and filed a lawsuit to challenge it.'"

Read more of this story at Slashdot.
Data Disasters More Likely To Strike In Summer

Posted: August 11th, 2010, 6:51pm CEST by CmdrTaco

Tags: security

Barence writes "The turbulent summer weather leads to a surge in data loss incidents, according to industry experts. Kroll Ontrack claims that it traditionally deals with around 12% more data recovery requests in the summer months than it does in the spring, with the weather largely to blame. 'The stress on electrical devices increases if you elevate the temperature,' Ontrack engineer Robert Winter told PC Pro. 'If you have devices that are going to fail, the failure may be induced by the elevated temperature.' Winter claims failure rates tend to be higher among personal and small business users, rather than large companies, which tend to have air conditioning and humidity control. Laptops and disk drives being left in direct sunlight or in the back of cars is another common cause of failure, the Ontrack engineer added. Power surges caused by electrical storms and failure to cover adequately for holidaying IT staff are other contributory factors, Ontrack claims."

Read more of this story at Slashdot.
SMS Trojan Steals From Android Owners

Posted: August 10th, 2010, 7:16pm CEST by CmdrTaco

Tags: security

siliconbits writes "A Trojan posing as a media player for Android smartphones automatically sends text messages to premium rate numbers, according to Kaspersky Lab. Company officials say the Trojan, dubbed Trojan-SMS.AndroidOS.FakePlayer.a, is the first of its kind for the Android platform, even though SMS Trojans are currently the most widespread type of malware on mobile phones."

Read more of this story at Slashdot.
The Shoddy State of Automotive Wireless Security

Posted: August 10th, 2010, 9:54am CEST by Soulskill

Tags: security

angry tapir writes "Researchers from Rutgers University and University of South Carolina have found that wireless communications between new cars and their tires can be intercepted or even forged. While the potential for misuse may be minimal, this vulnerability points to a troubling lack of rigor with secure software development for new automobiles, said Wenyuan Xu, a computer science assistant professor at the University of South Carolina, who was a co-lead on the study. The researchers will present their findings at the Usenix Security Symposium, being held this week in Washington DC."

Read more of this story at Slashdot.
Ex-SF Admin Terry Childs Gets 4-Year Sentence

Posted: August 7th, 2010, 2:13pm CEST by timothy

Tags: security

Robert McMillan writes "You remember Terry Childs, right? He was finally sentenced Friday. Childs got four years in prison for refusing to hand over passwords to his bosses. This is a denial of service under California law."

Read more of this story at Slashdot.
Cache On Delivery — Memcached Opens an Accidental Security Hole

Posted: August 7th, 2010, 8:00am CEST by timothy

Tags: security

jamie spotted this eye-opening presentation (here's a longer explanation) about how easy it is to access sensitive data on many sites using memcached, writing "If you already know what memcached is, skim to slide #17. The jaw-drop will happen around slide #33. Turns out many websites expose their totally-non-protected memcached interface to the Internet, including gowalla, bit.ly, and PBS."

Read more of this story at Slashdot.
Where To Start With DIY Home Security?

Posted: August 6th, 2010, 12:53am CEST by timothy

Tags: security

secretrobotron writes "I'm a recent university graduate from a co-op system which has kept me on the move every other semester, so I've never really had a permanent place to live, and I've never had the opportunity (or the capital) to buy expensive things. Now that I'm working, those restrictions on my life are gone and I'm living in an apartment with things I don't want stolen. I would love to build a DIY home security system, but I don't even know where to start since Google searches reveal things like diysecurityforum.com, which help only to an extent for a curious newcomer. Has anybody out there successfully built a home security system on a budget? If so, where did you start?" Related query: When similar questions have come up before, many readers have recommended Linux-based Zoneminder (last updated more than a year ago); is that still the state of the art?

Read more of this story at Slashdot.
ReCAPTCHA.net Now Vulnerable to Algorithmic Attack

Posted: August 5th, 2010, 10:59pm CEST by timothy

Tags: security

n3ond4x writes "reCAPTCHA.net algorithms have been developed to solve the current CAPTCHA at an efficacy of 30%. The algorithms were disclosed at DEFCON 18 over the weekend and have since been made available online. Also available is a video demonstration of random reCAPTCHA.net CAPTCHAs being subjected to the algorithms." There's probably an excellent Firefox plugin to render this page's color scheme more bearable. Note: the PowerPoint presentation linked opens fine in OpenOffice, and the video speaks for itself.

Read more of this story at Slashdot.
Two Unpatched Flaws Show Up In Apple iOS

Posted: August 5th, 2010, 1:55am CEST by samzenpus

Tags: security

Trailrunner7 writes "The technique that the Jailbreakme.com Web site is using to bypass the iPhone's security mechanisms and enable users to run unapproved apps on their phones involves exploiting two separate vulnerabilities. One of the vulnerabilities is a memory-corruption flaw that affects the way that Apple's mobile devices, including the iPad and iPod Touch, display PDFs. The second weakness is a problem in the Apple iOS kernel that gives an attacker higher privileges once his code is on a targeted device, enabling him to break out of the iOS sandbox. The combination of the two vulnerabilities — both of which are unpatched at the moment — gives an attacker the ability to run remote code on the device and evade the security protections on the iPhone, iPad or iPod Touch. The technique became public earlier this week when the Jailbreakme.com site began hosting a set of specially crafted PDF files designed to help users jailbreak their Apple devices and load apps other than the ones approved by Apple and offered in its official App Store."

Read more of this story at Slashdot.
Malicious Hardware Hacking May Be the Next Frontier

Posted: August 4th, 2010, 4:14pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "It's a given that hackers will target software, and that's enough for many people to worry about. But now there's the possibility that hackers would hide malicious code in the hardware itself. A hardware hack could be an annoyance, by stopping a mobile phone from functioning. Or it could be more dangerous, if it damages the way a critical system operates. Villasenor says there are several types of attacks. Broadly they would fall into two categories: one is when a block stops a chip from functioning, while the other involves shipping data out."

Read more of this story at Slashdot.
'Project Vigilant' Recruits At Defcon To Track You

Posted: August 3rd, 2010, 3:27pm CEST by CmdrTaco

Tags: security

angry tapir writes "A secretive volunteer group that tries to track terrorists and criminals on the Internet went to the Defcon hacker conference in hopes of recruiting information security experts, but it will first have to overcome some skepticism. That's because most information security professionals have never heard of the group, called Project Vigilant."

Read more of this story at Slashdot.
Attacking Game Consoles On Corporate Networks

Posted: August 3rd, 2010, 12:48pm CEST by Soulskill

Tags: security

A pair of security researchers speaking at DefCon demonstrated how video game consoles, which are becoming increasingly common break room or team-building toys, can open vulnerabilities in corporate networks. "[They] found that many companies install Nintendo Wii devices in their work places, even though they don’t let you walk into the company with smartphones or laptops. (Factories and other sensitive work locations don’t allow any devices with cameras). By poisoning the Wii, they could spread a virus over the corporate network. People have a false sense of security about the safety of these game devices, but they can log into computer networks like most other computer devices now. In the demos, the researchers showed they could take compromised code and inject it into the main game file that runs on either a DS or a game console. They could take over the network and pretty much spread malware across it and thereby compromise an entire corporation. The researchers said they can do this with just about any embedded device, from iPhones to internet TVs."

Read more of this story at Slashdot.
Using XSS & Google To Find Physical Location

Posted: August 3rd, 2010, 8:24am CEST by kdawson

Tags: security

wiredmikey sends along a brief (and quite poorly written) report from Security Week on Samy Kamkar's talk at Black Hat last week. In the video, which is amusing, he demonstrates how to obtain location information (within 30 feet, in the example he shows) of a user who does no more than visit a malicious website. The technique involves sniffing out the local router, breaking into it to obtain its MAC address, and sending that to Google to extract the router's location from Google's Street View database.

Read more of this story at Slashdot.
Silent, Easily Made Android Rootkit Released At DefCon

Posted: July 31st, 2010, 6:26pm CEST by Soulskill

Tags: security

An anonymous reader writes with news that security experts from Spider Labs released a kernel level rootkit for Android devices at DefCon on Friday. "As a proof of concept, it is able to send an attacker a reverse TCP over 3G/WIFI shell upon receiving an incoming call from a 'trigger number.' This ultimately results in full root access on the Android device." The rootkit was developed over a period of two weeks, and has been handed out to DefCon attendees on DVD.

Read more of this story at Slashdot.

Slashdot: Linux

Silent, Easily Made Android Rootkit Released At DefCon

Posted: July 31st, 2010, 6:26pm CEST by Soulskill

Tags: security

An anonymous reader writes with news that security experts from Spider Labs released a kernel level rootkit for Android devices at DefCon on Friday. "As a proof of concept, it is able to send an attacker a reverse TCP over 3G/WIFI shell upon receiving an incoming call from a 'trigger number.' This ultimately results in full root access on the Android device." The rootkit was developed over a period of two weeks, and has been handed out to DefCon attendees on DVD.

Read more of this story at Slashdot.

Slashdot: IT

US Ability To Identify Source of Nuclear Weapons Decays

Posted: July 31st, 2010, 4:19am CEST by Soulskill

Tags: security

Hugh Pickens writes "The NY Times covers a report released by the National Research Council, which says the ability of the US to identify the source of a nuclear weapon used in a terrorist attack is fragile and eroding. The goals of the highly specialized detective work, known as nuclear attribution, is to clarify options for retaliation and to deter terrorists by letting them know that nuclear devices have fingerprints that atomic specialists can find and trace. 'Although US nuclear forensics capabilities are substantial and can be improved, right now they are fragile, under-resourced and, in some respects, deteriorating,' the report warns. 'Without strong leadership, careful planning and additional funds, these capabilities will decline.' The report calls on the federal government to take steps to strengthen its forensic capabilities and argues for the necessity of better planning, more robust budgets, clearer lines of authority and more realistic exercises."

Read more of this story at Slashdot.
DefCon Contest Rattles FBI's Nerves

Posted: July 31st, 2010, 1:34am CEST by Soulskill

Tags: security

snydeq writes "A DefCon contest that invites contestants to trick employees at 30 US corporations into revealing not-so-sensitive data has rattled nerves at the FBI. Chris Hadnagy, who is organizing the contest, also noted concerns from the financial industry, which fears hackers will target personal information. The contest will run for three days, with participants attempting to unearth data from an undisclosed list of about 30 US companies. The contest will take place in a room in the Riviera hotel in Las Vegas furnished with a soundproof booth and a speaker, so an audience can hear the contestants call companies and try to weasel out what data they can get from unwitting employees." The group organizing the contest has established a strict set of rules to ensure participants don't violate any laws. Update: 07/31 04:45 GMT by S : PCWorld has coverage of one of the day's more successful attacks.

Read more of this story at Slashdot.
ATM Hack Gives Cash On Demand

Posted: July 29th, 2010, 1:57pm CEST by samzenpus

Tags: security

angry tapir writes "Windows CE-based ATMs can easily be made to dole out cash, according to security researcher Barnaby Jack. Exploiting bugs in two different ATMs at Black Hat, the researcher from IOActive was able to get them to spit out money on demand and record sensitive data from the cards of people who used them. Jack believes a large number of ATMs have remote management tools that can be accessed over a telephone. After experimenting with two machines he purchased, Jack developed a way of bypassing the remote authentication system and installing a homemade rootkit, named Scrooge."

Read more of this story at Slashdot.
Pizza Lovers Suffer Data Breach From Hell

Posted: July 29th, 2010, 7:12am CEST by samzenpus

Tags: security

netbuzz writes "Some 230,000 New Zealanders have been informed that their personal information has apparently fallen into the hands of hackers who compromised the network of a locally famous food chain, Hell Pizza. The company says it suspects 'a rogue employee,' but one security expert says Hell's ordering portal is 'about 50 steps of fail.' Several New Zealand celebrities are among the victims and at least one is taking the matter in stride, musing: 'My Twitter has been hacked, my Facebook has been hacked and I'm pretty sure half of New Zealand has my phone number already. I have nothing bad to say about Hell.'"

Read more of this story at Slashdot.
AT&T Won't Block Black Hat Eavesdropping Demo

Posted: July 29th, 2010, 4:37am CEST by samzenpus

Tags: security

snydeq writes "AT&T says it won't interfere with a highly anticipated talk on intercepting cell phone calls at the Black Hat conference this week. Hacker Chris Paget last week said that he plans to demonstrate on Saturday how to set up what's essentially a fake cell tower that allows him listen in on nearby mobile calls. But Tuesday, he wrote on his blog that he had 'heard that AT&T may be considering suing me to stop my talk.' AT&T, however, has insisted it has no plans to interfere with the talk."

Read more of this story at Slashdot.
DefCon Ninja Badges Let Hackers Do Battle

Posted: July 28th, 2010, 10:12pm CEST by timothy

Tags: security

eecue writes "The folks at DefCon, the world's largest hacker convention [previously on Slashdot], have been making awesome badges for years. Last year along with the convention badge, a group of hackers known as the Ninjas created an electronic badge for their exclusive party. This year the Ninjas have taken the whole electronic badge thing to the next level with an interactive, wireless, encrypted ninja battle video game badge. I convinced the Ninjas to give Wired.com an exclusive sneak peek, and let me tell you, this thing is awesome."

Read more of this story at Slashdot.
100 Million Facebook Pages Leaked On Torrent Site

Posted: July 28th, 2010, 4:09pm CEST by CmdrTaco

Tags: security

Stoobalou writes "A directory containing personal details about more than 100 million Facebook users has surfaced on an Internet file-sharing site. The 2.8GB torrent was compiled by hacker Ron Bowes of Skull Security, who created a web crawler program that harvested data on users contained in Facebook's open access directory, which lists all users who haven't bothered to change their privacy settings to make their pages unavailable to search engines."

Read more of this story at Slashdot.
Stuxnet May Represent New Trend In Malware

Posted: July 25th, 2010, 3:28pm CEST by Soulskill

Tags: security

Trailrunner7 writes "As more information continues to come out about the Stuxnet worm and the vulnerabilities that it exploits, it's becoming increasingly clear that this kind of attack may be a preview of the attacks that are likely to become commonplace in the months and years ahead. The most interesting aspect of all of this is the fact that the attackers behind Stuxnet clearly knew about the vulnerability in the Siemens WinCC system before the malware was written. That implies the malware authors had some advance intelligence about the configuration of the Siemens software and knew exactly where there was a weakness."

Read more of this story at Slashdot.
Wi-Fi WPA2 Vulnerability Found

Posted: July 25th, 2010, 1:43am CEST by kdawson

Tags: security

BobB-nw sends along news based on yet another press release in advance of the Black Hat conference: a claimed vulnerability in WPA2 Enterprise that leaves traffic open to a malicious insider. "...wireless security researchers say they have uncovered a vulnerability in the WPA2 security protocol, which is the strongest form of Wi-Fi encryption and authentication currently standardized and available. Malicious insiders can exploit the vulnerability, named 'Hole 196' by the researcher who discovered it at wireless security company AirTight Networks. The moniker refers to the page of the IEEE 802.11 Standard (Revision, 2007) on which the vulnerability is buried. Hole 196 lends itself to man-in-the-middle-style exploits, whereby an internal, authorized Wi-Fi user can decrypt, over the air, the private data of others, inject malicious traffic into the network, and compromise other authorized devices using open source software, according to AirTight. 'There's nothing in the standard to upgrade to in order to patch or fix the hole,' says Kaustubh Phanse, AirTight's wireless architect who describes Hole 196 as a 'zero-day vulnerability that creates a window of opportunity' for exploitation." Wi-Fi Net News has some more detail and speculation.

Read more of this story at Slashdot.
Safari Privacy Bug May Be Leaking Your Data

Posted: July 22nd, 2010, 11:18pm CEST by timothy

Tags: security

richi writes "If you use Safari, your browser may be leaking your private information to any website you visit. Jeremiah Grossman, the CTO of WhiteHat Security, has discovered some Very Bad News. I have some analysis and other reactions over at my Computerworld blog. The potential for spam and phishing is huge. A determined attacker might even be able to steal previously-entered customer data." In short, autofill for Web forms is enabled by default in Safari 4 / 5 (and remotely exploitable), and the data that this feature has access to includes the user's local address book — even if the information has never been entered into a Web form.

Read more of this story at Slashdot.
Dell Ships Infected Motherboards

Posted: July 21st, 2010, 4:23pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "Computer maker Dell is warning that some of its server motherboards have been delivered to customers carrying an unwanted extra: computer malware. It could be confirmation that the 'hardware trojans' long posited by some security experts are indeed a real threat."

Read more of this story at Slashdot.
Is Open Source SNORT Dead?

Posted: July 21st, 2010, 2:59pm CEST by CmdrTaco

Tags: security

alphadogg writes "Is Snort, the 12-year-old open-source intrusion detection and prevention system, dead? The Open Information Security Foundation, a nonprofit group funded by the US Dept. of Homeland Security to come up with next-generation open source IDS/IPS, thinks so. But Snort's creator, Martin Roesch, begs to differ, and in fact, calls the OISF's first open source IDS/IPS code, Suricata 1.0 released this week, a cheap knock-off of Snort paid for with taxpayer dollars. The OISF was founded about a year and a half ago with $1 million in funding from a DHS cybersecurity research program, according to Matt Jonkman, president of OISF. He says OISF was founded to form an open source alternative and replacement to Snort, which he says is now considered dead since the research on what is supposed to be the next-generation version of Snort, Snort 3.0, has stalled."

Read more of this story at Slashdot.
Adobe Putting PDF Reader In a Sandbox

Posted: July 20th, 2010, 11:20pm CEST by kdawson

Tags: security

Captain Eloquence writes "The next major version of Adobe's PDF Reader will feature new sandboxing technology aimed at curbing a surge in malicious hacker attacks. The initial sandbox implementation will isolate all 'write' calls on Windows 7, Windows Vista, Windows XP, Windows Server 2008, and Windows Server 2003. Adobe security chief Brad Arkin believes this will mitigate the risk of exploits seeking to install malware on the user's computer or otherwise change the computer's file system or registry. In a future dot-release, the company plans to extend the sandbox to include read-only activities to protect against attackers seeking to read sensitive information from the user's computer."

Read more of this story at Slashdot.
Cyberwarrior Shortage Threatens US Security

Posted: July 20th, 2010, 7:09pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "US security officials say the country's cyberdefenses are not up to the challenge. In part, it's due to a severe shortage of computer security specialists and engineers with the skills and knowledge necessary to do battle against would-be adversaries. The protection of US computer systems essentially requires an army of cyberwarriors, but the recruitment of that force is suffering. 'We don't have sufficiently bright people moving into this field to support those national security objectives as we move forward in time,' says James Gosler, a veteran cybersecurity specialist who has worked at the CIA, the National Security Agency, and the Energy Department."

Read more of this story at Slashdot.
Attackers Using Social Networks For Botnet Control

Posted: July 19th, 2010, 11:27pm CEST by Soulskill

Tags: security

Trailrunner7 writes "Bot herders and the crimeware gangs behind banker Trojans have had a lot of success in the last few years with using bulletproof hosting providers as their main base of operations. But more and more, they're finding that social networks such as Twitter and Facebook are offering even more fertile and convenient grounds for controlling their malicious creations. New research from RSA shows that the gangs behind some of the targeted banker Trojans that are such a huge problem in some countries, especially Brazil and other South American nations, are moving quietly and quickly to using social networks as the command-and-control mechanisms for their malware. The company's anti-fraud researchers recently stumbled upon one such attack in progress and watched as it unfolded."

Read more of this story at Slashdot.
Microsoft Has No Plans To Patch New Flaw

Posted: July 18th, 2010, 9:50pm CEST by timothy

Tags: security

Trailrunner7 writes "Microsoft has acknowledged the vulnerability that the new malware Stuxnet uses to launch itself with .lnk files, but said it has no plans to patch the flaw right now. The company said the flaw affects most current versions of Windows, including Vista, Server 2008 and Windows 7 32- and 64-bit. Meanwhile, the digital certificate that belonging to Realtek Semiconductor that was used to sign a pair of drivers for the new Stuxnet rootkit has been revoked by VeriSign. The certificate was revoked Friday, several days after news broke about the existence of the new malware and the troubling existence of the signed drivers."

Read more of this story at Slashdot.
Damn Vulnerable Linux — Most Vulnerable Linux Ever

Posted: July 18th, 2010, 1:11am CEST by timothy

Tags: security

An anonymous reader writes "Usually, when installing a new operating system, the hope is that it's as up-to-date as possible. After installation there's bound to be a few updates required, but no more than a few megabytes. Damn Vulnerable Linux is different; it's shipped in as vulnerable a state as possible. As the DVL website explains: 'Damn Vulnerable Linux (DVL) is everything a good Linux distribution isn't. Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. DVL isn't built to run on your desktop – it's a learning tool for security students.'"

Read more of this story at Slashdot.

Slashdot: Linux

Damn Vulnerable Linux — Most Vulnerable Linux Ever

Posted: July 18th, 2010, 1:11am CEST by timothy

Tags: security

An anonymous reader writes "Usually, when installing a new operating system, the hope is that it's as up-to-date as possible. After installation there's bound to be a few updates required, but no more than a few megabytes. Damn Vulnerable Linux is different; it's shipped in as vulnerable a state as possible. As the DVL website explains: 'Damn Vulnerable Linux (DVL) is everything a good Linux distribution isn't. Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. DVL isn't built to run on your desktop – it's a learning tool for security students.'"

Read more of this story at Slashdot.

Slashdot: IT

Windows Vulnerable To 'Token Kidnapping' Attacks

Posted: July 18th, 2010, 12:09am CEST by timothy

Tags: security

cuppa+tea writes "More than a year after Microsoft issued a patch to cover privilege escalation issues that could lead to complete system takeover, a security researcher plans to use the Black Hat conference spotlight to expose new design mistakes and security issues that can be exploited to elevate privileges on all Windows versions, including the brand new Windows 2008 R2 and Windows 7."

Read more of this story at Slashdot.
Can Drones Really Get National Airspace Access?

Posted: July 16th, 2010, 11:18pm CEST by Soulskill

Tags: security

coondoggie writes "There is a push by a variety of proponents to give unmanned aircraft more free rein in US airspace, but safety is a major hitch in that effort. The Federal Aviation Administration said this week that data from the Customs and Border Protection (CBP) agency, which flies unmanned systems on border patrols, shows a total of 5,688 flight hours from Fiscal Year 2006 to July 13, 2010. The CBP accident rate is 52.7 accidents per 100,000 flight hours. This accident rate is more than seven times the general aviation accident rate (7.11 accidents/100,000 flight hours) and 353 times the commercial aviation accident rate (0.149 accidents/100,000 flight hours)." An FAA executive noted that an "accident" refers to a situation in which "the aircraft has done something unplanned or unexpected and violates an airspace regulation."

Read more of this story at Slashdot.
OAuth, OpenID Password Crack Could Affect Millions

Posted: July 16th, 2010, 9:06pm CEST by Soulskill

Tags: security

CWmike writes "Researchers Nate Lawson and Taylor Nelson say they've discovered a basic security flaw that affects dozens of open-source software libraries — including those used by software that implements the OAuth and OpenID standards — that are used to check passwords and user names when people log into websites such as Twitter and Digg. By trying to log in again and again, cycling through characters and measuring the time it takes for the computer to respond, hackers can ultimately figure out the correct passwords. This may all sound very theoretical, but timing attacks can actually succeed in the real world. Three years ago, one was used to hack Microsoft's Xbox 360 gaming system, and people who build smart cards have added timing attack protection for years. The researchers plan to discuss their attacks at the Black Hat conference later this month in Las Vegas."

Read more of this story at Slashdot.
Malware Targets Shortcut Flaw In Windows, SCADA

Posted: July 15th, 2010, 11:09pm CEST by timothy

Tags: security

tsu doh nimh writes "Anti-virus researchers have discovered a new strain of malicious software that spreads via USB drives and takes advantage of a previously unknown vulnerability in the way Microsoft Windows handles '.lnk' or shortcut files. Belarus-based VirusBlokAda discovered malware that includes rootkit functionality to hide the malware, and the rootkit drivers appear to be digitally signed by Realtek Semiconductor, a legitimate hi-tech company. In a further wrinkle, independent researcher Frank Boldewin found that the complexity and stealth of this malware may be due to the fact that it is targeting SCADA systems, or those designed for controlling large, complex and distributed control networks, such as those used at power and manufacturing plants. Meanwhile, Microsoft says it's investigating claims that this malware exploits a new vulnerability in Windows."

Read more of this story at Slashdot.
Hack Exposes Pirate Bay User Data

Posted: July 9th, 2010, 11:42pm CEST by Soulskill

Tags: security

tsu doh nimh writes "A group of hackers from Argentina recently broke into the database for thepiratebay.org, the Internet's largest torrent search engine, exposing user names, Internet addresses, and (MD5) hashed password data on more than 4 million users, according to Brian Krebs. He interviewed the leader of the group, Ch Russo, who said they briefly considered what the information would be worth to the RIAA and MPAA before going public with the breach. From the story: 'Probably these groups would be very interested in this information, but we are not [trying] to sell it,' Russo said. 'Instead we wanted to tell people that their information may not be so well protected.'"

Read more of this story at Slashdot.
REMnux, the Malware Analysis Linux OS

Posted: July 9th, 2010, 9:35pm CEST by Soulskill

Tags: security

Trailrunner7 writes "A security expert has released a stripped-down Ubuntu distribution designed specifically for reverse-engineering malware. The OS, called REMnux, includes a slew of popular malware-analysis, network monitoring and memory forensics tools that comprise a very powerful environment for taking apart malicious code. REMnux is the creation of Lenny Zeltser, an expert on malware reverse engineering who teaches a popular course on the topic at SANS conferences. He put the operating system together after years of having students ask him which tools to use and what works best. He originally used Red Hat Linux, but recently decided that Ubuntu was a better fit. REMnux has three separate tools for analyzing Flash-specific malware, including SWFtools, Flasm and Flare, as well as several applications for analyzing malicious PDFs, including Didier Stevens' analysis tools. REMnux also has a number of tools for de-obfuscating JavaScript, including Rhino debugger, a version of Firefox with NoScript, JavaScript Deobfuscator and Firebug installed, and Windows Script Decoder."

Read more of this story at Slashdot.

Slashdot: Linux

REMnux, the Malware Analysis Linux OS

Posted: July 9th, 2010, 9:35pm CEST by Soulskill

Tags: security

Trailrunner7 writes "A security expert has released a stripped-down Ubuntu distribution designed specifically for reverse-engineering malware. The OS, called REMnux, includes a slew of popular malware-analysis, network monitoring and memory forensics tools that comprise a very powerful environment for taking apart malicious code. REMnux is the creation of Lenny Zeltser, an expert on malware reverse engineering who teaches a popular course on the topic at SANS conferences. He put the operating system together after years of having students ask him which tools to use and what works best. He originally used Red Hat Linux, but recently decided that Ubuntu was a better fit. REMnux has three separate tools for analyzing Flash-specific malware, including SWFtools, Flasm and Flare, as well as several applications for analyzing malicious PDFs, including Didier Stevens' analysis tools. REMnux also has a number of tools for de-obfuscating JavaScript, including Rhino debugger, a version of Firefox with NoScript, JavaScript Deobfuscator and Firebug installed, and Windows Script Decoder."

Read more of this story at Slashdot.

Slashdot: IT

Cisco Says Vegas Conference Attendees' Information Was Leaked

Posted: July 8th, 2010, 9:26pm CEST by timothy

Tags: security

Julie188 writes "Thousands of people got a nasty e-mail this morning from Cisco. The company was warning people that its attendee registration database for its Cisco Live 2010 event was hacked. Cisco Live 2010 is the company's annual user conference, held last week in Las Vegas with an estimated 18,000 in attendance. If it's not embarrassing enough for a company that sells security gear to get hacked, the e-mail also went out to people who didn't register and didn't attend the event. That raises questions about exactly what database was pried open and how bad the damage is. Cisco's e-mail said the hole was quickly closed and only business-card type information was exposed."

Read more of this story at Slashdot.
US Plans Cyber Shield For Private Companies and Utilities

Posted: July 8th, 2010, 6:25pm CEST by samzenpus

Tags: security

wiggles writes "The federal government is launching an expansive program dubbed 'Perfect Citizen' to detect cyber assaults on private companies and government agencies running such critical infrastructure as the electricity grid and nuclear-power plants, according to people familiar with the program. The surveillance by the National Security Agency, the government's chief eavesdropping agency, would rely on a set of sensors deployed in computer networks for critical infrastructure that would be triggered by unusual activity suggesting an impending cyber attack, though it wouldn't persistently monitor the whole system, these people said. How do we feel about NSA spyware in all of our infrastructure?"

Read more of this story at Slashdot.
A Flood of Stable Linux Kernels Released

Posted: July 7th, 2010, 10:11pm CEST by timothy

Tags: security

Julie188 writes "Greg Kroah-Hartman has released five new stable Linux kernels, correcting minor errors of their predecessors and including improvements which are unlikely to generate new errors. As so often with kernel versions in the stable series, it remains undisclosed if the new versions contain changes which fix security vulnerabilities, although the number of changes and some of the descriptions of those changes certainly suggest that all the new versions contain security fixes."

Read more of this story at Slashdot.

Slashdot: Linux

A Flood of Stable Linux Kernels Released

Posted: July 7th, 2010, 10:11pm CEST by timothy

Tags: security

Julie188 writes "Greg Kroah-Hartman has released five new stable Linux kernels, correcting minor errors of their predecessors and including improvements which are unlikely to generate new errors. As so often with kernel versions in the stable series, it remains undisclosed if the new versions contain changes which fix security vulnerabilities, although the number of changes and some of the descriptions of those changes certainly suggest that all the new versions contain security fixes."

Read more of this story at Slashdot.

Slashdot: IT

'Robin Sage' Social Hoax Duped Military, Security Pros

Posted: July 7th, 2010, 6:08pm CEST by timothy

Tags: security

ancientribe writes "A social networking experiment of a phony female military security professional known as 'Robin Sage' (named after a US Army Special Forces training exercise) worked way too well, fooling even the most security-savvy professionals on LinkedIn, Facebook, and Twitter. It also led to the leakage of sensitive military information after an Army Ranger accepted 'Robin's' friend request on Facebook and his photos from Afghanistan exposed geolocation information accessible to 'Robin.' The researcher who conducted the experiment will show off his findings at the upcoming Black Hat USA conference in Las Vegas, where the real woman pictured in the profiles is scheduled to introduce him for his presentation."

Read more of this story at Slashdot.
Microsoft Spurned Researchers Release 0-Day

Posted: July 6th, 2010, 8:20pm CEST by kdawson

Tags: security

nk497 notes the news that a group of researchers calling themselves the Microsoft-Spurned Researcher Collective (the name is a play on Microsoft's Security Response Center) have come together to protest Microsoft's perceived heavy-handedness towards researchers who disclose security flaws. Pushed into action by the reception to the flaw disclosed by Tavis Ormandy, the group has released full details and exploit code for a previously unknown Windows local privilege escalation vulnerability. The advisory for the vulnerability, which affects Windows Vista and Windows Server 2008, contains the following manifesto: "Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry (and some not from the industry) have come together to form MSRC: the Microsoft-Spurned Researcher Collective. MSRC will fully disclose vulnerability information discovered in our free time, free from retaliation against us or any inferred employer."

Read more of this story at Slashdot.
The Unstoppable 'Tech Support' Scam

Posted: July 6th, 2010, 6:04pm CEST by timothy

Tags: security

Barence writes "A pernicious new type of scam is targeting British computer owners, reports PC Pro. The con is both fiendishly clever and ridiculously simple. The fraudster cold-calls the customer and tells them that Microsoft has detected a virus on their PC, then invites them to download a piece of remote-assistance software. No doubt reassured by the lines of indecipherable code flitting across their screen, the caller assures the customer they can make the virus vanish – but first, of course, they want payment. £185 to be precise. The spoof site behind the scam is approved by McAfee's Site Advisor and bears Microsoft logos, something which both companies have failed to act upon. Meanwhile, an assortment of British regulators have said there is nothing they can do to stop it."

Read more of this story at Slashdot.
Photo Kiosks Infecting Customers' USB Devices

Posted: July 6th, 2010, 11:29am CEST by kdawson

Tags: security

The Risky Biz blog brings news that Big W, a subsidiary of Woolworths, has Windows-based Fuji photo kiosks in at least some of its stores that don't run antivirus software, and are therefore spreading infections, such as Trojan-Poison-36, via customers' USB storage devices. Here is the account of the original reporter. "It's not just the lack of AV that's the problem... it appears there's been zero thought put into the problem of malware spreading via these kiosks. Why not just treat customers' USB devices as read-only? Why allow the kiosks to write to them at all? It would be interesting to find out which company — Fuji, Big W, or even some other third party — is responsible for the maintenance of the machines. It would also be interesting to find out if there are any liability issues here for Big W in light of its boneheaded lack of security planning."

Read more of this story at Slashdot.
HSBC Bank Sends Activated Debit Cards Through Mail

Posted: July 6th, 2010, 2:04am CEST by kdawson

Tags: security

Knowzy writes "At least two divisions at HSBC Bank apparently failed card issuing 101 and are mailing out debit cards pre-activated. Because they are debit cards, fraudulent transactions come directly out of a victim's checking account. A similar report from 2004 suggests this issue is longstanding and widespread. When confronted with the evidence, HSBC would not commit to fixing this issue, preferring instead to offer vague statements like, 'Through our systems and analytics, we focus on the greatest and most active threats in an effort to avoid negatively impacting customer experience.'"

Read more of this story at Slashdot.
ATM Vendors Threaten, Stop Research Presentation

Posted: July 5th, 2010, 7:41pm CEST by Soulskill

Tags: security

An anonymous reader writes "A presentation about 'The Underground Economy,' by Italian white hat hacker and security expert Raoul Chiesa, was replaced at the last minute during last week's Hack In The Box conference. The reason behind this cancellation was that Chiesa received legal pressure from ATM vendors over the fact that the originally scheduled presentation covers details of various techniques and exploits of vulnerabilities that cyber criminals use to break into ATMs — flaws that have been known for a long time."

Read more of this story at Slashdot.
Behind Cyberwar FUD

Posted: July 4th, 2010, 3:47pm CEST by Soulskill

Tags: security

Nicola Hahn writes "The inevitable occurred this week as The Economist broached the topic of cyberwar with a couple of articles in its July 3rd issue. The first article concludes that 'countries should agree on more modest accords, or even just informal "rules of the road" that would raise the political cost of cyber-attacks.' It also makes vague references to 'greater co-operation between governments and the private sector.' When attribution is a lost cause (and it is), international treaties are meaningless because there's no way to determine if a participant has broken them. The second recommendation is even more alarming because it's using a loaded phrase that, in the past couple of years, has been wielded by those who advocate Orwellian solutions. The other article is a morass of conflicting messages. It presumes to focus on cyberwar, yet the bulk of the material deals with cybercrime and run-of-the-mill espionage. Then there's also the standard ploy of hypothetical scenarios: depicting how we might be attacked and what the potential outcome of these attacks could be. The author concludes with the ominous warning that terrorists 'prefer the gory theatre of suicide-bombings to the anonymity of computer sabotage — for now.' What's truly disturbing is that The Economist never goes beyond a superficial analysis of the topic to examine what's driving all of the fear, uncertainty, and doubt (PDF), a subject dealt with in this Lockdown 2010 white paper."

Read more of this story at Slashdot.
Many Popular Windows Apps Ignore Security Options

Posted: July 3rd, 2010, 7:43pm CEST by Soulskill

Tags: security

eldavojohn writes "The latest versions of Microsoft Windows have some good security options available — now if only they could get their most popular third-party applications to use them. A report from Secunia takes a look at two such options — DEP and ASLR — and Brian Krebs breaks down who is using them and who is not. A security specialist noted, 'If both DEP and ASLR are correctly deployed, the ease of exploit development decreases significantly. While most Microsoft applications take full advantage of DEP and ASLR, third-party applications have yet to fully adapt to the requirements of the two mechanisms (PDF). If we also consider the increasing number of vulnerabilities discovered in third-party applications, an attacker's choice for targeting a popular third-party application rather than a Microsoft product becomes very understandable.' Among those with neither DEP or ASLR: Apple Quicktime, Foxit Reader, Google Picasa, Java, OpenOffice.org, RealPlayer, and AOL's Winamp. While Flash player can't implement DEP, it does have ASLR. Google Chrome is the only popular third-party application listed with stars across the board." It's worth noting that several apps highlighted in the Secunia research paper have added support for those security options in recent patches, or are in the process of doing so. Examples include Firefox, VLC, and Foxit Reader.

Read more of this story at Slashdot.
Security Vulnerability Bingo

Posted: July 2nd, 2010, 8:28pm CEST by samzenpus

Tags: security

An anonymous reader writes "Ben Bitdiddle of MIT fame sends an open letter to system administrators encouraging them to stop patching their systems so they can play 'Security Vulnerability Bingo.'"

Read more of this story at Slashdot.

Slashdot: Linux

Security Vulnerability Bingo

Posted: July 2nd, 2010, 8:28pm CEST by samzenpus

Tags: security

An anonymous reader writes "Ben Bitdiddle of MIT fame sends an open letter to system administrators encouraging them to stop patching their systems so they can play 'Security Vulnerability Bingo.'"

Read more of this story at Slashdot.

Slashdot: IT

With World Watching, Wikileaks Falls Into Disrepair

Posted: July 1st, 2010, 6:06pm CEST by CmdrTaco

Tags: security

JDRucker writes "Supporters are concerned. Very concerned. Would-be whistle-blowers hoping to leak documents to Wikileaks face a potentially frustrating surprise. Wikileaks' submission process, which had been degraded for months, completely collapsed more than two weeks ago and remains offline, in a little-noted breakdown at the world's most prominent secret-spilling website."

Read more of this story at Slashdot.
Russian Spy Ring Needed Some Serious IT Help

Posted: July 1st, 2010, 1:10am CEST by samzenpus

Tags: security

coondoggie writes "The Russian ring charged this week with spying on the United States faced some of the common security problems that plague many companies — misconfigured wireless networks, users writing passwords on slips of paper, and laptop help desk issues that take months to resolve."

Read more of this story at Slashdot.
Regular Domains Have More Malware Than Porn Sites

Posted: June 30th, 2010, 7:06pm CEST by CmdrTaco

Tags: security

SnugglesTheBear writes "New research pours scorn on the comforting but erroneous belief that Windows surfers who avoid smut and wares on the Web are likely to avoid exposure to malware. A study by free anti-virus firm Avast found 99 infected legitimate domains for every infected adult website. In the UK, Avast found that more infected domains contained the word 'London' than the word 'sex.' Among the domains labeled as infected by Avast was the smartphones section of the Vodafone UK website. The mobile phone operator's site contained a malicious JavaScript redirect script that attempted to take advantage of an unpatched Windows Help and Support Centre flaw (CVE-2010-1885) to infect the machines of visiting surfers."

Read more of this story at Slashdot.
Hack AT&T Voicemail With Android

Posted: June 30th, 2010, 3:15am CEST by kdawson

Tags: security

An anonymous reader writes "It is shockingly easy to gain access to an AT&T customer's voicemail using caller ID spoofing techniques. What's worse is that AT&T knows about it. On your Android phone, download one of the two caller ID spoofing programs. Input the number of your target as the destination number and then enter the same number as the spoofed caller ID. Then connect your call. If the target has not added a voicemail password (the default is no password), you will be dropped into a random menu of their voicemail and eventually can drill up or down to get what you want. You can change greetings, erase messages, send voicemails out of the target account, and much more. How many politicians up in arms about Google Wi-Fi sniffing will want to know more about this?"

Read more of this story at Slashdot.
Adobe Finally Fixes Remote Launch 0-Day

Posted: June 29th, 2010, 11:41pm CEST by kdawson

Tags: security

Trailrunner7 sends in this excerpt from Threatpost (Adobe announcement here): "Adobe today shipped a critical Reader/Acrobat patch to cover a total of 17 documented vulnerabilities that expose Windows, Mac, and Unix users to malicious hacker attacks. The update, which affects Adobe Reader/Acrobat 9.3.2 and earlier versions, includes a fix for the outstanding PDF '/Launch' functionality social engineering attack vector that was disclosed by researcher Didier Stevens. As previously reported, Didier created a proof-of-concept PDF file that executes an embedded executable without exploiting any security vulnerabilities. The PDF hack, when combined with clever social engineering techniques, could potentially allow code execution attacks if a user simply opens a rigged PDF file." Relatedly, Brian Krebs blogs about the downsides of Adobe's increasingly Byzantine update process.

Read more of this story at Slashdot.
22 Million SSL Certificates In Use Are Invalid

Posted: June 29th, 2010, 3:43am CEST by kdawson

Tags: security

darthcamaro writes "While SSL certs are widely used on the Internet today, a new study from Qualys, set to be officially released at Black Hat in July, is going to show some shocking statistics. Among the findings in the study is that only 3% of SSL certs in use were actually properly configured. Quoting: '"So we have about 22 million SSL servers with certificates that are completely invalid because they do not match the domain name on which they reside," Ivan Ristic, director of engineering at Qualys, said.'"

Read more of this story at Slashdot.
Security For Open Source Web Projects?

Posted: June 27th, 2010, 7:28pm CEST by Soulskill

Tags: security

PoissonPilote writes "I'm currently developing a multi-player, browser-based game, using the good old HTML, JavaScript, PHP, and MySQL combination. Progress is good so far, and the number of players is slowly but steadily increasing. At the beginning of the project, I decided to put the entirety of my game under the MIT license, so that anyone could study the code or even start their own server for the game. However, with the increasing popularity of my project, I am starting to worry about security issues. Even though I consider myself decent at web development and am pretty sure I'm not making any classic mistakes (SQL injection, cross-site scripting, URL forgery, etc.), I am no web security expert. I didn't find any relevant examples to compare my game to, as most open source games are written in a compiled language, and no web server is at stake in those cases. Some web developer friends told me not to release the source code at all; others told me to release it only when the game will be shut down. Naturally, I'm not satisfied by either of these solutions. What approach would you recommend?"

Read more of this story at Slashdot.
Stand-Alone Antivirus Software?

Posted: June 24th, 2010, 10:33pm CEST by timothy

Tags: security

An anonymous reader writes "I work for a company that repairs specialty devices that have an embedded Mini-ATX motherboard without a CD-ROM drive and run Windows XP Home. And while the USB flash drives we insert into them have a physical write-protect tab, we still encounter a (rather annoying) display dialog from malware/viruses to remove the write-protect so the malware can infect the flash drive. We don't remove the write-protect, obviously, but would like to offer our customers the option of removing the malware/virus without having to install any software. We would rather not install/uninstall antivirus software even for one-time use, due to various licensing issues, nor do we want to connect to the Internet to use web-based online scanners. Is there any stand-alone anti-virus/anti-malware software for Windows that can be run directly from the write-protected flash drive itself?"

Read more of this story at Slashdot.
Dot-Org TLD Signed For DNSSEC

Posted: June 24th, 2010, 12:02am CEST by timothy

Tags: security

graychase writes "A major milestone is reached as the first major top-level domain (.org) is now secured with DNSSEC. The expense to .org for implementing DNSSEC on its infrastructure and operations has not been a small one. While specific figures as to the cost of DNSSEC implementation haven't been released, Afilias, which is the technical operator of the .org registry, told InternetNews.com in 2009 that the DNSSEC implementation would be a multi-million-dollar effort. The cost isn't going to be passed on by .org to domain registrars. The move toward securing the .org registry with DNS security started in September 2008, following the Kaminsky DNS flaw disclosure."

Read more of this story at Slashdot.
iPad Left Vulnerable After Record iPhone Patch Job

Posted: June 22nd, 2010, 9:55pm CEST by kdawson

Tags: security

CWmike writes "With Monday's iOS 4 upgrade, Apple patched a record 65 vulnerabilities in the iPhone, more than half of them critical. However, the first-generation iPhone and iPod Touch, as well as the much newer iPad, may have been left vulnerable to some or all of the 65 bugs. iOS 4 cannot be installed on 2007's iPhone and iPod Touch, and the upgrade is not slated to reach iPad owners until this fall. The bug count is a record for the iPhone, surpassing the previous high mark of 46 vulnerabilities patched last summer with iPhone OS 3.0. Formerly known as iPhone OS 4, iOS 4 included 35 bugs, or 54% of the total, that were tagged with the phrase 'arbitrary code execution.' It's unclear how many, if any, of the vulnerabilities affect Apple's iPad. The media tablet runs an interim version of the operating system, dubbed iPhone 3.2, that followed the February iPhone 3.1.3 security update. It's possible that some of the bugs patched Monday were fixed by Apple before it launched the iPad in early April. But according to the Common Vulnerabilities & Exposures database, it's likely that many of the flaws fixed on Monday still exist in 3.2."

Read more of this story at Slashdot.
Turning Attackers' Tools Against Them

Posted: June 20th, 2010, 2:19am CEST by kdawson

Tags: security

Tasha26 writes "The BBC has an interesting Web security snippet from the SyScan 2010 security conference in Singapore. In a presentation, security researcher Laurent Oudot released details of bugs found in commonly used attack kits such as Neon, Eleonore, and Sniper. These loopholes could be exploited to get more information about the attackers, perhaps identifying them, stealing their tools and methods, or even following the trail back to their own computer."

Read more of this story at Slashdot.
Apple Quietly Goes After Mac Trojan With Update

Posted: June 19th, 2010, 10:46pm CEST by kdawson

Tags: security

Th'Inquisitor was one of several readers to point out coverage of Apple's stealth security fix, included along with the recent Snow Leopard 10.6.4 update. Graham Cluley of Sophos first noticed the update to protect Mac computers from a Trojan, and the fact that Apple didn't mention it in the release notes. The malware opens a back door to a Mac that can allow attackers to gain control of the machine and snoop about on it or turn it into a zombie. "You have to wonder," writes Cluley, "whether their keeping quiet about an anti-malware security update like this was for marketing reasons." While he certainly has a point that Apple benefits by its users' belief that the platform is secure, you also have to wonder whether any such publicity from a security company has a marketing subtext, as well.

Read more of this story at Slashdot.
420,000 Scam E-mails Sent Every Hour In UK Alone

Posted: June 16th, 2010, 2:52pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "More than 420,000 scam e-mails are sent every hour in the UK, according to a report by CPP, which estimates that Brits were targeted by 3.7 billion phishing e-mails in the last 12 months alone. A quarter of us admit to falling victim to e-fraudsters, with the average victim losing over GBP285. Fake banking e-mails are the most common method used by criminals, with 55% of those targeted receiving seemingly legitimate e-correspondence from high street banks."

Read more of this story at Slashdot.
Miscreants Exploit Google-Outed Windows XP Zero-Day

Posted: June 16th, 2010, 3:54am CEST by kdawson

Tags: security

CWmike writes "A compromised website is serving an exploit of the bug in Windows' Help and Support Center, identified by a Google engineer last week, to hijack PCs running Windows XP. Graham Cluley, a senior technology consultant at antivirus vendor Sophos, declined to identify the site, saying only that it was dedicated to open source software. 'It's a classic drive-by attack,' said Cluley. The tactic was one of two that Microsoft said last week were the likely attack avenues. (The other was convincing users to open malicious e-mail messages.) The vulnerability was disclosed last Thursday by Google security engineer Tavis Ormandy, who also posted proof-of-concept attack code. Ormandy defended his decision to reveal the flaw only five days after reporting it to Microsoft. Cluley called Ormandy's action 'utterly irresponsible,' and in a blog post asked, 'Tavis Ormandy — are you pleased with yourself?'"

Read more of this story at Slashdot.
Lenovo Trying Face Recognition For Logins On New Laptops

Posted: June 13th, 2010, 5:50pm CEST by Soulskill

Tags: security

judgecorp writes "Lenovo's new IdeaPads will be using face recognition as a way to replace passwords for users logging onto the laptops. 'Lenovo's VeriFace combines the Windows login and file encryption to password-protect individual files. It identifies users by matching unique features of their faces to photographs taken by the 1.3-megapixel webcam built into the laptop. When Windows users start up their PCs, a camera window pops up in the login frame. The user then just has to adjust their position so their face appears in the window, and VeriFace logs them in automatically.' That could be good, but is the technology really ready for mass market devices? HP ran into trouble when its face recognition software had trouble recognizing people with darker skin."

Read more of this story at Slashdot.
Backdoor Found In UnrealIRCd Source Archive

Posted: June 13th, 2010, 7:28am CEST by timothy

Tags: security

l_bratch writes "A malicious backdoor was added to the UnrealIRCd source archive some time around November 2009. It was not noticed for several months, so many IRC servers are likely to be compromised. A Metasploit exploit already exists."

Read more of this story at Slashdot.
Porn Sites More Infected Than Thought

Posted: June 12th, 2010, 8:34pm CEST by timothy

Tags: security

nk497 writes "Porn sites are five times as likely to host malware as previously thought, with 3.6% offering up a digital infection of some sort, according to a researchers who set up their very own adult sites for a new study. One reason for the high rate of malware is that the online porn industry makes use of affiliate programs, where one site will drive traffic to another in exchange for links, cash, or simply free pornographic material to use. Because such programs don't check who they're doing business with, and sites use disguised links and other clandestine methods to drive people to different pages, it's easy for criminals to abuse the system to spread malware. Researcher Gilbert Wondracek said, 'They inadvertently have created an ecosystem that can easily be abused on a large scale by cyber criminals, and that's worrying.'"

Read more of this story at Slashdot.
Researchers Create Social Engineering IRC Bot

Posted: June 12th, 2010, 7:39pm CEST by Soulskill

Tags: security

An anonymous reader writes "Researchers at the Vienna University of Technology developed an IRC bot that acts as a 'man in the middle' between two unsuspecting users, modifies URLs passed between them, and also is capable of steering the conversation. Not only does this work surprisingly well on IRC — they found a 76.1% click rate for potentially malicious URLs — but four out of 10 people on Facebook Chat also clicked on links after the bot introduced complete strangers to each other. This would have worked even better if the bot were to clone existing friends' profiles and submit friend requests from those, say researchers."

Read more of this story at Slashdot.
Olympus Digital Camera Ships With a Worm

Posted: June 9th, 2010, 3:11am CEST by kdawson

Tags: security

An anonymous reader writes "Olympus Japan has issued a warning to customers who have bought its Stylus Tough 6010 digital compact camera that it comes with an unexpected extra — a virus on its internal memory card. The Autorun worm cannot infect the camera itself, but if it is plugged into a Windows computer's USB port, it can copy itself onto the PC, then subsequently infect any attached USB device. Olympus says it 'humbly apologizes' for the incident, which is believed to have affected some 1,700 units. The company said it will make every effort to improve its quality control procedures in future. Security company Sophos says that more companies need to wake up to the need for better quality control to ensure that they don't ship virus-infected gadgets. At the same time, consumers should learn to always ensure Autorun is disabled, and scan any device for malware before they use it on their computer."

Read more of this story at Slashdot.
Claimed US Military Wikileaks Source Arrested

Posted: June 7th, 2010, 2:54pm CEST by CmdrTaco

Tags: security

svelemor writes "A 22-year-old Army intelligence analyst was ratted out by a fellow hacker, accused of providing the Collateral Murder video and hundreds of thousands of classified State Department records to Wikileaks. He is currently imprisoned in Kuwait."

Read more of this story at Slashdot.
The Men Who Stare At Airline Passengers, Coming To the UK

Posted: June 7th, 2010, 4:57am CEST by timothy

Tags: security

An anonymous reader writes, "The Economist's Gulliver reports on a story in Nature that questions the current airport security regimen," excerpting: "Over the past four years, some 3,000 officers in America's Transportation Security Administration (TSA) have been specially trained to spot potential terrorists at airports. The programme, known as SPOT, for Screening Passengers by Observation Technique, is intended to allow airport security officers to use tiny facial cues to identify people who are acting suspiciously. The British government is currently launching a new screening regime modelled on the Americans' SPOT. There's just one problem with all this: there's no evidence that SPOT is actually effective. The whole thing is mostly based on pseudoscience, Sharon Weinberger reports in Nature." Happily, Nature's original article is available in full, rather than paywalled.

Read more of this story at Slashdot.
Restraining Order On Commercial Spyware Lifted

Posted: June 6th, 2010, 3:37pm CEST by Soulskill

Tags: security

Back in 2008, the US Federal Trade Commission filed a restraining order against CyberSpy Software, makers of a commercial spyware program that logged keystrokes, took screenshots, monitored IM conversations, and sent all the collected data back to the company's servers. Reader suraj.sun tips news that the order has now been lifted, allowing CyberSpy to sell its software, but with a few restrictions. "According to the US District Court settlement, the company must not provide users with the means to disguise the software as an innocent file or email attachment. Users must also be advised that doing so may violate US state or federal law. Additionally, all recorded information sent over the Internet must be encrypted and older legacy versions of the software must be removed from computers on which it was previously installed. ... RemoteSpy is said to employ rootkit techniques to hide from virus scanners."

Read more of this story at Slashdot.
Adobe Warns of Flash, PDF Zero-Day Attacks

Posted: June 5th, 2010, 5:15pm CEST by Soulskill

Tags: security

InfosecWarrior writes "Adobe issued an alert late Friday night to warn about zero-day attacks against an unpatched vulnerability in its Reader and Flash Player software products. The vulnerability, described as critical, affects Adobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux, and Solaris operating systems. It also affects the authplay.dll component that ships with Adobe Reader and Acrobat 9.x for Windows, Macintosh, and Unix operating systems."

Read more of this story at Slashdot.

Slashdot: Linux

Adobe Warns of Flash, PDF Zero-Day Attacks

Posted: June 5th, 2010, 5:15pm CEST by Soulskill

Tags: security

InfosecWarrior writes "Adobe issued an alert late Friday night to warn about zero-day attacks against an unpatched vulnerability in its Reader and Flash Player software products. The vulnerability, described as critical, affects Adobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux, and Solaris operating systems. It also affects the authplay.dll component that ships with Adobe Reader and Acrobat 9.x for Windows, Macintosh, and Unix operating systems."

Read more of this story at Slashdot.

Slashdot: IT

FTC Delays Identity Theft Rule Yet Again

Posted: June 1st, 2010, 9:04pm CEST by kdawson

Tags: security

coondoggie sends news that the FTC, at the request of several members of Congress, has delayed enforcement of anti-ID-theft rules — for the fourth time since the original implementation date, November 2008. "The [Red Flags] rule requires financial institutions and other creditors to develop and carry out identity-theft prevention programs. ... The problem with the rule revolves around which entities must comply and develop identity-theft prevention programs. ... 'It's the act of delaying payment for services that can sweep in entities you wouldn't normally think of as creditors,' Kuehn said. Already, the American Bar Association, the American Medical Association, and the American Institute of Certified Public Accountants have sued, saying that the Red Flags Rule shouldn't apply to their members."

Read more of this story at Slashdot.
Clickjacking Worm Exploits Facebook "Like" Feature

Posted: May 31st, 2010, 5:17pm CEST by StoneLion

Tags: security

An anonymous reader writes "For the last 24 hours, a series of attacks have exploited Facebook's 'Like' feature through a clickjacking vulnerability. Using subjects such as 'This Girl Has An Interesting Way Of Eating A Banana, Check It Out!' hackers have spread an attack that links to web pages that use invisible iFrames to trick users into saying they like the content. Users are presented with a innocent-seeming web page that says 'Click here to continue,' but clicking at any point on the page publishes the same message to their own Facebook page. Security blogger Graham Cluley says that hundreds of thousands of Facebook users have been hit, and offers advice on how to clean up affected Facebook profiles.

Read more of this story at Slashdot.
How Viruses Evolve Into All-Purpose Malware

Posted: May 29th, 2010, 4:55am CEST by timothy

Tags: security

KingofGnG writes "Computer threats are continuously evolving, and some malicious codes are a problem difficult to tackle because of their inherent complexity and an intelligent design capable of constantly putting under pressure security companies. A remarkable 'intelligent' threat is for instance Sality, the 'new generation' file virus that according to Symantec has practically turned into an 'all-in-one' malware incorporating botnet-like functionalities as well."

Read more of this story at Slashdot.
CERT Releases Basic Fuzzing Framework

Posted: May 28th, 2010, 2:53am CEST by timothy

Tags: security

infoLaw passes along this excerpt from Threatpost: "Carnegie Mellon University's Computer Emergency Response Team has released a new fuzzing framework to help identify and eliminate security vulnerabilities from software products. The Basic Fuzzing Framework (BFF) is described as a simplified version of automated dumb fuzzing. It includes a Linux virtual machine that has been optimized for fuzz testing and a set of scripts to implement a software test."

Read more of this story at Slashdot.

Slashdot: Linux

CERT Releases Basic Fuzzing Framework

Posted: May 28th, 2010, 2:53am CEST by timothy

Tags: security

infoLaw passes along this excerpt from Threatpost: "Carnegie Mellon University's Computer Emergency Response Team has released a new fuzzing framework to help identify and eliminate security vulnerabilities from software products. The Basic Fuzzing Framework (BFF) is described as a simplified version of automated dumb fuzzing. It includes a Linux virtual machine that has been optimized for fuzz testing and a set of scripts to implement a software test."

Read more of this story at Slashdot.

Slashdot: IT

Adobe May Change To Monthly Patch Cycle

Posted: May 27th, 2010, 9:40pm CEST by timothy

Tags: security

Trailrunner7 writes "Adobe, which has been under fire for the security of its flagship products, Flash and Reader, for some time now, may be on the verge of changing its patching process to push fixes out on a monthly schedule, which would coincide with Microsoft's monthly Patch Tuesday releases. The change would be the second major adjustment to Adobe's patching process in the last year or so. In 2009 the company moved to a scheduled quarterly patch release process in an effort to give its customers a better chance to plan for testing and deployment. That change was generally well-received. Now Adobe may change the schedule again in order to get patches out more quickly. The company is considering releasing its security fixes for Reader on a monthly schedule, the same day that Microsoft releases its patches."

Read more of this story at Slashdot.
Lifelock Worries After Employee Data Leaked To Web

Posted: May 27th, 2010, 5:00am CEST by samzenpus

Tags: security

itwbennett writes "Last week, Phoenix New Times reporter Ray Stein revealed that LifeLock CEO Todd Davis (who famously published his Social Security number in LifeLock ads) had been the victim of identity theft at least 13 times. This week, LifeLock made it clear that it's not so cavalier with its employees' personal data. The company asked the New Times to remove from its website a police report containing a redacted Social Security number, date of birth, address, and phone number of Lifelock employee Tamika Jones. In an interview, Stein said that the fact that LifeLock had to call and ask for the document to be removed reflected badly on Lifelock's service. 'I think this shows clearly that they know that it's got potential problems.'"

Read more of this story at Slashdot.
Secure Communication Comes To Android

Posted: May 26th, 2010, 12:51am CEST by kdawson

Tags: security

An anonymous reader writes "Forbes is reporting that Moxie Marlinspike and Stuart Anderson's startup, Whisper Systems, has released a public beta of two Android applications that provide encrypted call and SMS capabilities for your Android phone. In the wake of recent GSM attacks, it'll be interesting to see if smartphones end up providing a platform that fundamentally changes the security we can expect from mobile communication."

Read more of this story at Slashdot.
Busting, and Fixing, Frame Busting

Posted: May 25th, 2010, 8:55pm CEST by kdawson

Tags: security

An anonymous reader writes "A study presented last week at the IEEE Web Security and Privacy workshop shows that frame busting code used at popular Web sites is easily circumvented. Frame busting is a widely used technique to prevent clickjacking attacks. The researchers propose better frame busting code and suggest that Web sites migrate to this new code."

Read more of this story at Slashdot.
Tabnapping Scams Around the Corner?

Posted: May 25th, 2010, 2:54pm CEST by CmdrTaco

Tags: security

scamdetect writes "User Interface specialist and creative lead on Mozilla's Firefox browser Aza Raskin has outlined a brand new variant on 'phishing' attacks which he has christened 'tabnapping.' Traditionally, phishing has relied upon convincing users to click on a link in an email to take them to a fake website such as their bank, credit card issuer or email account. Once the user logs into the fake site, their details are transmitted to the fraudster and the account is immediately compromised. Public awareness of phishing emails is now relatively high and most people know not to click on links in emails appearing to come from such organizations. Tabnapping relies on the user believing that it is impossible for the content of a tab to change while you're not looking. You may click on a link in Twitter, Facebook, or a 'sponsored link' in Google which will load a genuine webpage that delivers the content it promises. If you then click away from that site, leaving it open in a tab whilst viewing another website, the content of the original tab will change to a fake log-in page impersonating one of the websites you visit most often ..."

Read more of this story at Slashdot.
Malware on Hijacked Subdomains, a New Trend?

Posted: May 22nd, 2010, 6:20pm CEST by Soulskill

Tags: security

The Unmask Parasites blog discusses a technique attackers are using more and more often recently: modifying a compromised site's DNS settings to redirect various subdomains to different IPs that serve up malware, often leaving site administrators none the wiser. Quoting: "It is clear that hackers have figured out that subdomains of legitimate websites are an almost infinite source of free domain names for their attack sites. With access to DNS settings, they can create arbitrary subdomains that point to their own servers. Such subdomains can hardly be noticed by domain owners who rarely check their DNS records after the initial domain configuration. And they cost nothing to hackers. I wonder if using hijacked subdomains of legitimate websites is a new trend in malware distribution or just a temporarily solution that won't be widely adopted by cybercriminals in the long run (like dynamic DNS domains last September)."

Read more of this story at Slashdot.
How To Go Broke Selling Zero-Day Exploits

Posted: May 22nd, 2010, 12:11am CEST by Soulskill

Tags: security

Trailrunner7 writes "Despite all of the hand-wringing and moral posturing about the public sale of security vulnerabilities, it turns out that not many people are buying or selling vulns, and the ones who are aren't making much money at it. A new survey of security researchers who sell vulnerabilities either publicly or in private, directed sales found that the vast majority of the flaws sell for less than $5,000. Almost none of them sell for much more than $10,000. At those prices, there's little chance that this is going to turn into the chaotic Wild West marketplace that some people predicted. It's a small, mostly controlled market that isn't making anyone rich."

Read more of this story at Slashdot.
Michal Zalewski On Security's Broken Promises

Posted: May 21st, 2010, 9:20pm CEST by Soulskill

Tags: security

Lipton-Arena writes "In a thought-provoking guest editorial on ZDNet, Google security guru Michal Zalewski laments the IT security industry's broken promises and argues that little has been done over the years to improve the situation. From the article: 'We have in essence completely failed to come up with even the most rudimentary, usable frameworks for understanding and assessing the security of modern software; and spare for several brilliant treatises and limited-scale experiments, we do not even have any real-world success stories to share. The focus is almost exclusively on reactive, secondary security measures: vulnerability management, malware and attack detection, sandboxing, and so forth; and perhaps on selectively pointing out flaws in somebody else's code. The frustrating, jealously guarded secret is that when it comes to actually enabling others to develop secure systems, we deliver far less value than could be expected.'"

Read more of this story at Slashdot.
Black Duck Eggs and Other Secrets of Chinese Hacks

Posted: May 19th, 2010, 1:04am CEST by kdawson

Tags: security

Roberto123 writes "Network World offers some insights into the way China infiltrates US organizations, physically and via computer, to steal information. Security expert Ira Winkler says there are far more serious threats out there than the 'laughable' uproar over China's hack of Google."

Read more of this story at Slashdot.
Mobile 'Remote Wipe' Thwarts Secret Service

Posted: May 18th, 2010, 5:00pm CEST by CmdrTaco

Tags: security

bennyboy64 writes "Smartphones that offer the ability to 'remote wipe' are great for when your device goes missing and you want to delete your data so that someone else can't look at it, but not so great for the United States Secret Service, ZDNet reports. The ability to 'remote wipe' some smartphones such as BlackBerry and iPhone was causing havoc for law enforcement agencies, according to USSS special agent Andy Kearns, speaking on mobile phone forensics at a security conference in Australia."

Read more of this story at Slashdot.
Scientists Propose Guaranteed Hypervisor Security

Posted: May 17th, 2010, 2:19pm CEST by kdawson

Tags: security

schliz writes "NCSU researchers are attempting to address today's 'blind trust' of virtualization with new security techniques that 'guarantee' malware does not infect hypervisors. Their HyperSafe software uses the write-protect bit on hypervisor hardware, as well as a technique called restricted pointer indexing, which characterizes the normal behavior of the system and prevents any deviation. A proof-of-concept prototype has been tested on BitVisor and Xen, in research that will be presented (PDF) at an IEEE conference today."

Read more of this story at Slashdot.
Hacking Automotive Systems

Posted: May 14th, 2010, 2:55pm CEST by kdawson

Tags: security

alphadogg writes "University researchers have taken a close look at the computer systems used to run today's cars and discovered new ways to hack into them, sometimes with frightening results. In a paper set to be presented at a security conference in Oakland, California, next week, the researchers say that by connecting to a standard diagnostic computer port included in late-model cars, they were able to do some nasty things, such as turning off the brakes, changing the speedometer reading, blasting hot air or music on the radio, and locking passengers in the car. The point of the research isn't to scare a nation of drivers, already made nervous by stories of software glitches, faulty brakes, and massive automotive recalls. It's to warn the car industry that it needs to keep security in mind as it develops more sophisticated automotive computer systems. Other experts describe the real-world risk of any of the described attacks as low." Here is the researchers' site, and an image that could stand as a summary of the work.

Read more of this story at Slashdot.
German User Fined For Having an Open Wi-Fi

Posted: May 13th, 2010, 4:59pm CEST by CmdrTaco

Tags: security

Kilrah_il writes "A German citizen was sued for copyright infringement because copyrighted material was downloaded through his network while he was on vacation. Although the court did not find him guilty of copyright infringement, he was fined for not having password-protected his network: 'Private users are obligated to check whether their wireless connection is adequately secured to the danger of unauthorized third parties abusing it to commit copyright violation,' the court said."

Read more of this story at Slashdot.
US Needs Secure Coding Office

Posted: May 12th, 2010, 6:46pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "If the United States wants to remain competitive in the global economy and prevent widespread penetrations of its strategic, corporate, and commercial networks, enterprises and government agencies should stop relying on commercial software and go back to writing more of their own custom code. 'If we're going to maintain our place in the world, software is not a strategic problem, it is the strategic problem going forward,' security expert Marcus Ranum said in a speech Tuesday. 'Covert penetration becomes something that you think about on a five, 10, or 20-year scale. Why don't we have a government coding office? We have a government printing office. Why don't we have a strategic software reserve? Our own software is probably a greater threat to us than anything other people can do to us.'"

Read more of this story at Slashdot.
Critical Flaw Found In Virtually All AV Software

Posted: May 9th, 2010, 4:20pm CEST by Soulskill

Tags: security

Securityemo writes "The Register is running an article about a new method to bypass antivirus software, discovered by Matousec. By sending benign code to the antivirus driver hooks, and switching it out for malicious code at the last moment, the antivirus can be completely bypassed. This attack is apparently much more reliable on multi-core systems. Here's the original research paper." El Reg notes that "The technique works even when Windows is running under an account with limited privileges," but "it requires a large amount of code to be loaded onto the targeted machine, making it impractical for shellcode-based attacks or attacks that rely on speed and stealth. It can also be carried out only when an attacker already has the ability to run a binary on the targeted PC."

Read more of this story at Slashdot.
The Desktop Security Battle May Be Lost

Posted: May 7th, 2010, 6:30pm CEST by kdawson

Tags: security

Trailrunner7 writes in with a Threatpost.com article that begins: "For years, security experts, analysts and even users have been lamenting the state of desktop security. Viruses, spam, Trojans and rootkits have added up to create an ugly picture. But, the good news is that the desktop security battle may be over. The less-than-good news, however, is that we may have lost it. Jeremiah Grossman, CTO of WhiteHat Security, said Thursday that many organizations, particularly in the financial services industry, have gotten to the point of assuming that their customers' desktops are compromised. And moving forward from that assumption, things don't get much prettier." It goes on to speculate about home routers being targeted and infected.

Read more of this story at Slashdot.
How Do You Handle Your Keys?

Posted: May 7th, 2010, 12:22am CEST by timothy

Tags: security

arisvega writes "I lost my backpack some time ago, but was lucky enough to have left my laptop at home that night, and my cell and keys in my pocket. The inevitable habit-change that followed was to start strapping my keys on my pants, so at least I would still be able to get home (as long as I kept my pants on). But I realized I had a lot of keys: one for the outer door, two for the inner, three more for my girlfriend's place, one for the office, one for the postbox, one for my bicycle, the car, the motorbike and the roof. ... Plus, I keep a tiny Swiss Army knife on my keychain that I really wouldn't want to part with. Needless to say, this makes a jingly bunch that eats through my pocket. I ask you, Slashdot people, how do you carry/safeguard a hefty, pronouncedly jingly bunch of keys? What are the alternatives? Any suggestions on clothing or technology? Would having 'The One Key' make things better, or worse?"

Read more of this story at Slashdot.
Security Firm Reveals Microsoft's "Silent" Patches

Posted: May 6th, 2010, 9:23pm CEST by timothy

Tags: security

CWmike writes "Microsoft silently patched three vulnerabilities last month, two of them affecting enterprise mission-critical Exchange mail servers, without calling out the bugs in the accompanying advisories, a security expert said on Thursday. Two of the three unannounced vulnerabilities, and the most serious of the trio, were packaged with MS10-024, an update to Exchange and Windows SMTP Service that Microsoft issued April 13 and tagged as 'important,' its second-highest threat ranking. Ivan Arce, CTO of Core Security Technologies, said Microsoft patched the bugs, but failed to disclose that it had done so — which could pose a problem. 'They're more important than the [two vulnerabilities] that Microsoft did disclose,' said Arce. 'That means [system] administrators may end up making the wrong decisions about applying the update. They need that information to assess the risk.'"

Read more of this story at Slashdot.
Hacker Develops ATM Rootkit

Posted: May 6th, 2010, 2:48pm CEST by CmdrTaco

Tags: security

alphadogg writes "One year after his Black Hat talk on automated teller machine security vulnerabilities was yanked by his employer, security researcher Barnaby Jack plans to deliver the talk and disclose a new ATM rootkit at the computer security conference. He plans to give the talk, entitled "Jackpotting Automated Teller Machines," at the Black Hat Las Vegas conference, held July 28 and 29. Jack will demonstrate several ways of attacking ATMs, including remote, network-based attacks."

Read more of this story at Slashdot.
Hot Sales In China For Wi-Fi Key-Cracking Kits

Posted: May 6th, 2010, 12:19am CEST by timothy

Tags: security

alphadogg writes "Dodgy salesmen in China are making money from long-known weaknesses in a Wi-Fi encryption standard, by selling network key-cracking kits for the average user. Wi-Fi USB adapters bundled with a Linux operating system, key-breaking software, and a detailed instruction book are being sold online and at China's bustling electronics bazaars. The kits, pitched as a way for users to surf the Web for free, have drawn enough buyers and attention that one Chinese auction site, Taobao.com, had to ban their sale last year. With one of the 'network-scrounging cards,' or 'ceng wang ka' in Chinese, a user with little technical knowledge can easily steal passwords to get online via Wi-Fi networks owned by other people. The kits are also cheap. A merchant in a Beijing bazaar sold one for 165 yuan ($24), a price that included setup help from a man at the other end of the sprawling, multistory building."

Read more of this story at Slashdot.

Slashdot: Linux

Hot Sales In China For Wi-Fi Key-Cracking Kits

Posted: May 6th, 2010, 12:19am CEST by timothy

Tags: security

alphadogg writes "Dodgy salesmen in China are making money from long-known weaknesses in a Wi-Fi encryption standard, by selling network key-cracking kits for the average user. Wi-Fi USB adapters bundled with a Linux operating system, key-breaking software, and a detailed instruction book are being sold online and at China's bustling electronics bazaars. The kits, pitched as a way for users to surf the Web for free, have drawn enough buyers and attention that one Chinese auction site, Taobao.com, had to ban their sale last year. With one of the 'network-scrounging cards,' or 'ceng wang ka' in Chinese, a user with little technical knowledge can easily steal passwords to get online via Wi-Fi networks owned by other people. The kits are also cheap. A merchant in a Beijing bazaar sold one for 165 yuan ($24), a price that included setup help from a man at the other end of the sprawling, multistory building."

Read more of this story at Slashdot.

Slashdot: IT

Foxit One-Ups Adobe In Blocking PDF Attack Tactics

Posted: May 5th, 2010, 12:38am CEST by kdawson

Tags: security

CWmike writes "Foxit Software, the developer of a rival PDF viewer to Adobe's vulnerability-plagued Reader, released an update on Tuesday that blocks some attacks with a 'safe mode' that's switched on by default. Foxit Reader 3.3 for Windows' 'Trust Manager' blocks all external commands that may be tucked into a PDF document. 'The Foxit Reader 3.3 enables users to allow or deny unauthorized actions and data transmission, including URL connection, attachment PDF actions, and JavaScript functions,' the update's accompanying text explains. Last week, several security companies warned of a major malware campaign that tried to dupe users into opening rigged PDFs that exploited an unpatched design flaw in the PDF format, one attackers could use to infect users of Adobe's and Foxit's software. That flaw in the PDF specification's '/Launch' function was disclosed in late March by Belgium security researcher Didier Stevens, who demonstrated how he could abuse the feature to run malware embedded in a PDF document. He also reported he had figured out how to change Adobe Reader's warning to enhance the scam."

Read more of this story at Slashdot.
OpenDLP Aims To Stem Data Loss

Posted: May 2nd, 2010, 9:05pm CEST by kdawson

Tags: security

rollcall writes "A new free and open source tool, OpenDLP, has been released that will help organizations fight data loss caused by stolen laptops, missing HDDs, or compromised systems. OpenDLP is managed from a centralized Web application and it can simultaneously send and control thousands of non-intrusive agents to Microsoft Windows systems over NetBIOS that look for user-defined regular expressions in data at rest. When sensitive data is found, the agents 'phone home' to the Web app with their results. While organizations have continued to lose sensitive data even though many commercial products are available to help prevent this, perhaps the introduction of a free alternative will finally spur organizations to locate their sensitive data proactively before it is lost."

Read more of this story at Slashdot.
DNSSEC May Cause Problems On May 5

Posted: April 30th, 2010, 3:37pm CEST by kdawson

Tags: security

An anonymous reader notes the coming milestone of May 5, at 17:00 UTC — at this time DNSSEC will be rolled out across all 13 root servers. Some Internet users, especially those inside corporations and behind smaller ISPs, may experience intermittent problems. The reason is that some older networking equipment is preconfigured to block any reply to a DNS request that exceeds 512 bytes in size. DNSSEC replies are typically four times as large. "DNSSEC is in fact already rolled out across most of the world's 13 root servers. ... But to date ... it would only have resulted in a slight lag in the loading of a web page for those with outdated network equipment. The beauty of DNS is that should a request made to one root server not receive a response, the DNS resolver on a user's machine simply makes the same request along the line of the 13 root servers until it gets a satisfactory response. But on May 5, once all 13 root servers are live with the DNSSEC signatures, responses from all 13 root servers won't make it back inside the corporate LAN on some older systems. ... The problem may take several days to surface and be inconsistent from one user's PC to the next. A user at one machine who hasn't switched on his PC for two or three days will have no access to the Internet. A user who left his machine on the night before will have some pages — and responses from DNS servers — cached on his machine, and will still have connectivity." The article links a test site you can use ahead of time to check for any problems.

Read more of this story at Slashdot.
India, China Try Import Regulations As Security Tools

Posted: April 29th, 2010, 9:22pm CEST by timothy

Tags: security

An anonymous reader writes "The Register reports that the Chinese government is forcing vendors to cough up the source code to their encryption alogrithms before they can sell their equipment to the Chinese government. The EU doesn't seem to like it, but if I were in their position I'd want the same thing." China's biggest neighbor goes further; another anonymous reader writes "Telco equipment from China could have spyware that gives access to telcom networks in India. The Indian government has officially told mobile operators not to import any equipment manufactured by Chinese vendors, including Huawei and ZTE. The ban order follows concerns raised by the Home Ministry that telecom equipment from some countries could have spyware or malware that gives intelligence agencies across the border access to telecom networks in India. The biggest gainers from the move could be Ericsson, Nokia, and Siemens, which have been losing market share to aggressive Chinese equipment-makers in India."

Read more of this story at Slashdot.
The US Continues Its Reign As King of Spam

Posted: April 29th, 2010, 4:33am CEST by samzenpus

Tags: security

An anonymous reader writes "The United States continues its reign as the king of spam, relaying more than 13% of global spam, accounting for hundreds of millions of junk messages every day, according to a report by Sophos. However, most dramatically, China – often blamed for cybercrime by other countries – has disappeared from the 'dirty dozen,' coming in at 15th place with responsibility for relaying just 1.9% of the world's spam."

Read more of this story at Slashdot.
Fake Antivirus Peddlers Outpacing Real AV Firms

Posted: April 27th, 2010, 8:56pm CEST by kdawson

Tags: security

An anonymous reader tips a writeup at KrebsOnSecurity.com detailing how purveyors of fake antivirus or 'scareware' programs have aggressively stepped up their game to evade detection. The posting is based on a report from Google's malware detection team (PDF). "Beginning in June 2009, Google charted a massive increase in the number of unique fake antivirus installer programs, a spike that Google security experts posit was a bid to overwhelm the ability of legitimate antivirus programs to detect the programs. Indeed, the company discovered that during that time frame, the number of unique installer programs increased from an average of 300 to 1,462 per day, causing the detection rate to plummet to below 20 percent. ... In addition, Google determined that the average lifetime of sites that redirect users to Web pages that try to install scareware decreased over time, with the median lifetime dropping below 100 hours around April 2009, below 10 hours around September 2009, and below one hour since January 2010."

Read more of this story at Slashdot.
Backdoor Malware Targets Apple iPad

Posted: April 27th, 2010, 3:04pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "Apple iPad users are being warned of an email-borne threat which could give hackers unauthorised access to the device. The threat arrives via an unsolicited email urging the recipient to download the latest version of iTunes as a prelude to updating their iPad software. Apart from opening up a backdoor, it also tries to read the keys and serial numbers of the software installed on the device, and logs the passwords to any webmail, IM or protected storage accounts."

Read more of this story at Slashdot.
New Russian Weapon Hides In Shipping Container

Posted: April 27th, 2010, 11:20am CEST by kdawson

Tags: security

shmG writes "A Russian company is marketing a devastating new cruise missile system that can be hidden inside a shipping container, giving any merchant vessel the capability to wipe out an aircraft carrier. Potential customers for the formidable 'Club-K' system include Kremlin allies Iran and Venezuela, say defense experts. They worry that countries could pass on the satellite-guided missiles, which are very hard to detect, to terrorist groups. This is a scary new development in the global arms race that allows for the proliferation of cruise missiles to anyone who will pay for them — even terrorists. This could be the next big thing in strategic weapons, as they can appear anywhere there is a container ship. The company even made a commercial and posted it onto the Internet." The article notes that a Russian defense expert said that "as far as he understood, the Club-K was still at the concept stage."

Read more of this story at Slashdot.
Massive Number of GoDaddy WordPress Blogs Hacked

Posted: April 26th, 2010, 5:54pm CEST by CmdrTaco

Tags: security

A nasty little exploit has hit a large number of GoDaddy-hosted WordPress blogs this weekend. The best part is that the exploit only executes when the traffic is referred by Google, making it the sort of thing that site maintainers won't easily notice. Clever and devious.

Read more of this story at Slashdot.
Punishing Security Breaches

Posted: April 26th, 2010, 5:10pm CEST by CmdrTaco

Tags: security

Schneier has a story on his blog this morning about punishing security breaches. This one is in response to the tale of Gray Powell, the Apple engineer who left an important bit of technology in a bar recently. You might have heard of it. You also might have been on either the breacher or the corporate side. I'd hate to be in either position myself.

Read more of this story at Slashdot.
McAfee To Pay For PC Repairs After Patch Fiasco

Posted: April 26th, 2010, 4:27pm CEST by CmdrTaco

Tags: security

Barence writes "McAfee has offered to pay for the PC repairs of consumers affected by last week's faulty antivirus update. The problematic patch falsely identified the SVCHOST.EXE Windows file as a virus, causing PCs running Windows XP SP3 to crash or enter endless reboot cycles. In a blog post addressed to 'Home or Home Office Consumers,' the company offered to reimburse PC repair expenses, though there was a notable caveat. 'If you have already incurred costs to repair your PC as a result of this issue, we're committed to reimbursing reasonable expenses,' the company said. 'Reasonable expenses' has yet to be formally defined."

Read more of this story at Slashdot.
Phishing Education Test Blocked For Phishing

Posted: April 24th, 2010, 5:33pm CEST by Soulskill

Tags: security

An anonymous reader writes "It appears a website called ismycreditcardstolen.com, designed to 'educate users about the dangers of phishing,' has itself been flagged by Firefox as a reported web forgery. The site, which asks visitors to enter their credit card details to 'see if they've been stolen,' takes the hapless visitor to a page warning them about the perils of phishing, giving them advice on how to avoid similar scams and also provides a link to the Anti-Phishing Working Group's website. Or at least it did, until various browsers started blocking it. As the Sunbelt blog post notes, the project was likely doomed to failure, both because of the domain name itself and also because it uses anonymous Whois data, which isn't exactly going to make security people look at it in a positive light. Does anyone out there think this was a good idea? Or will malicious individuals start playing copycat on a public now trained to think sites like this are just 'harmless education?'"

Read more of this story at Slashdot.
Fatal System Error

Posted: April 23rd, 2010, 5:09pm CEST by samzenpus

Tags: security

brothke writes "As computing and technology has evolved, so too have the security threats correspondingly evolved. The classic Yankee Doodle virus of 1989 did minimal damage, all while playing a patriotic, albeit monotone song. In 2010, aggressive malware now executes in stealth mode, running in the background with an oblivious end-user, and antivirus software that can’t detect it." Read on for the rest of Ben's review.

Read more of this story at Slashdot.
Digital Photocopiers Loaded With Secrets

Posted: April 20th, 2010, 7:15pm CEST by CmdrTaco

Tags: security

skids writes 'File this under "no, really?" CBS news catches up with the fact that photocopiers, whether networked or not, tend to have a much longer memory these days. When they eventually get tossed, few companies bother to scrub them. Couple this with the tendency of older employees to consider hard-copy to be "secure," and your most protected secrets may be shipped directly to information resellers — no hacking required. "The day we visited the New Jersey warehouse, two shipping containers packed with used copiers were headed overseas — loaded with secrets on their way to unknown buyers in Argentina and Singapore."'

Read more of this story at Slashdot.
Network Solutions Sites Hacked Again

Posted: April 19th, 2010, 10:17pm CEST by Soulskill

Tags: security

CWmike writes "A week after Web hosting company Network Solutions dealt with a large-scale infection of WordPress-driven blogs, the company acknowledged that other sites it hosts have been compromised. 'We have received reports that Network Solutions customers are seeing malicious code added to their websites and we are really sorry for this experience,' said spokesman Shashi Bellamkonda in a blog post. 'At this time, since anything we say in public may help the perpetrators, we are unable to provide details.' Securi Security Labs said on Sunday that at least 50 sites hosted by Networks Solutions had been hacked, and that malicious JavaScript injected into those sites was redirecting unsuspecting users to a Ukrainian attack server. The same server was involved in the earlier attacks against Network Solutions-hosted blogs. According to the StopMalvertising blog, the attacks planted a rogue IFRAME on the hacked sites to shunt users to the attack server. That server then launches multiple exploits, including an attack kit of ActiveX exploits and three more leveraging Adobe Reader vulnerabilities, against visiting PCs. Several browsers, including IE8, Chrome and Firefox, display warnings when users are redirected to the attack site."

Read more of this story at Slashdot.
Life Recorder

Posted: April 19th, 2010, 3:53pm CEST by CmdrTaco

Tags: security

Bruce Schneier writes "In 2006, writing about future threats on privacy, I described a life recorder: A 'life recorder' you can wear on your lapel that constantly records is still a few generations off: 200 gigabytes/year for audio and 700 gigabytes/year for video. It'll be sold as a security device, so that no one can attack you without being recorded."

Read more of this story at Slashdot.
Become an SSLAdmin In a Few Easy Steps

Posted: April 18th, 2010, 3:15pm CEST by Soulskill

Tags: security

Renderer of Evil writes "With news that it is rather simple to mimic authority with many webmail providers in order to coax an SSL certificate authority into creating one for the domain, a Canadian security expert has decided to take it upon himself to see who out there is actually vulnerable and provide information to the public on how prevalent this issue is as we speak. Out of eleven webmail services chosen at random and without prejudice, just under half of them permitted him to register with credentials (ssladmin) that allowed him to create an SSL certificate in their name. In most of these cases, there was a pre-existing, legitimately-acquired certificate." Update: 04/19 01:30 GMT by S : Kurt Seifried's original paper, on which the BetaNews article is based, provides more detailed information on the subject (PDF).

Read more of this story at Slashdot.
SIP Attacks From Amazon EC2 Going Unaddressed

Posted: April 18th, 2010, 3:39am CEST by kdawson

Tags: security

mjgraves writes "Over the past week a number of IP-PBX systems have been suffering SIP attacks from hosts in the Amazon EC2 cloud. At least a dozen known attacks have been reported to Amazon, which has been surprisingly quiet about the matter. The issue has been well documented by one of the attack victims on his blog. The matter was also discussed on the April 16th issue of the VoIP Users Conference (podcast available at the link; EC2 segment begins around 3:30). Amazon appears to have gone silent on the matter even as the attacks are ongoing. This is completely irresponsible behavior from a such a hosting company, which should be acting to take down the attacker in their midst."

Read more of this story at Slashdot.
ClamAV Forced Upgrade Breaks Email Servers

Posted: April 16th, 2010, 7:35pm CEST by kdawson

Tags: security

An anonymous reader writes "A couple of weeks ago Sourcefire announced end-of-life for version 0.94 of its free ClamAV antivirus package (and in fact has been talking about it for six months). The method that Sourcefire chose to retire 0.94 was to shut down the server that provided its service. Those who had failed to upgrade are scrambling now. Many systems have no choice but to disable virus checking in order to continue to process email. I am very glad I saw the announcement last week!"

Read more of this story at Slashdot.
Porn Virus Blackmails Victims Over "Copyright Violation"

Posted: April 16th, 2010, 11:29am CEST by timothy

Tags: security

FishRep writes with this excerpt from the BBC: "A new type of malware infects PCs using file-share sites and publishes the user's net history on a public website before demanding a fee for its removal. The Japanese trojan virus installs itself on computers using a popular file-share service called Winni, used by up to 200m people. It targets those downloading illegal copies of games in the Hentai genre, an explicit form of anime. Website Yomiuri claims that 5,500 people have so far admitted to being infected. The virus, known as Kenzero, is being monitored by web security firm Trend Micro in Japan. Masquerading as a game installation screen, it requests the PC owner's personal details. It then takes screengrabs of the user's web history and publishes it online in their name, before sending an e-mail or pop-up screen demanding a credit card payment of 1,500 yen (£10) to 'settle your violation of copyright law' and remove the webpage."

Read more of this story at Slashdot.
What Can Be Done About Security of Debit Cards?

Posted: April 16th, 2010, 2:31am CEST by timothy

Tags: security

JumpDrive writes "I have been the victim of (Visa) debit card theft. I do not know where they stole or got the number, but it was used one day on the other side of the country and the next day it was used in Europe until they cleaned out my account. I had been monitoring my account online and immediately went to the bank and filed a claim. I was told at that time it would be 3 to 5 weeks for them to investigate the claim before they could return my money. Recently I tried to make a purchase with a debit card and was told that they couldn't use the card since it wasn't a Visa or MasterCard check card; this led to a discussion of why I no longer have a Visa or MasterCard check card. Which then led to the question of 'What can be done about it?' Currently I have a separate account for debit usage for my personal safety. But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards (not in small print and maybe required in advertisement of these cards, similar to what is required with pharmaceutical drugs on television) and/or that if a debit or check card is issued a separate account should be required for its use, and users informed of the issues of placing all of their money in the same account that their debit card has access to. What other precautionary measures should be required or taken?"

Read more of this story at Slashdot.
Sun Pushes Emergency Java Patch

Posted: April 15th, 2010, 9:53pm CEST by timothy

Tags: security

Trailrunner7 writes "In a sudden about-face, Sun has rushed out a Java update to fix a drive-by download vulnerability that exposed Windows users to in-the-wild malware attacks. The patch comes less than a week after Sun told a Google researcher it did not consider the issue serious enough to warrant an out-of-cycle patch and less than a day after researchers spotted live exploits on a booby-trapped Web site. The flaw, which was also discovered independently by Ruben Santamarta, occurs because the Java-Plugin Browser is running 'javaws.exe' without validating command-line parameters. Despite the absence of documentation, a researcher was about to figure out that Sun removed the code to run javaws.exe from the Java plugin. The about-face by Sun is another sign that some big vendors still struggle to understand the importance of working closely with white hat researchers to understand the implications of certain vulnerabilities. In this case, Google's Tavis Ormandy was forced to use the full-disclosure weapon to force the vendor into a proper response."

Read more of this story at Slashdot.
Microsoft Refuses To Patch Rootkit-Compromised XP Machines

Posted: April 15th, 2010, 8:48pm CEST by timothy

Tags: security

Barence writes "Microsoft has revealed that its latest round of patches won't install on XP machines if they're infected with a rootkit. In February, a security patch left some XP users complaining of endless reboots and Blue Screens of Death. An investigation followed and Microsoft discovered the problems occurred on machines infected with the Alureon rootkit, which interacted badly with patch KB977165 for the Windows kernel. Now Microsoft is blocking PCs with the rootkit from receiving its new patches. 'This security update includes package-detection logic that prevents the installation of the security update if certain abnormal conditions exist on 32-bit systems,' Microsoft cautions in the patch notes."

Read more of this story at Slashdot.
NSA Develops USB Storage Device Detector

Posted: April 13th, 2010, 10:20pm CEST by kdawson

Tags: security

Hugh Pickens writes "Bob Brewin writes on NextGov that the National Security Agency has developed a software tool that detects thumb drives or other flash media connected to a network. The NSA says the tool, called the USBDetect 3.0 Computer Network Defense Tool, provides 'network administrators and system security officials with an automated capability to detect the introduction of USB storage devices into their networks. This tool closes potential security vulnerabilities; a definite success story in the pursuit of the [Defense Department] and NSA protect information technology system strategic goals.' The tool gathers data from the registry on Microsoft Windows machines (PDF) and reports whether storage devices, such as portable music or video players, external hard drives, flash drives, jump drives, or thumb drives have been connected to the USB port. 'I have a hunch that a bunch of other agencies use the detection software,' writes Brewin."

Read more of this story at Slashdot.
Please Do Not Change Your Password

Posted: April 13th, 2010, 7:11pm CEST by CmdrTaco

Tags: security

cxbrx writes "Mark Pothier's Boston Globe article, 'Please do not change your password,' covers a paper by Microsoft Researcher Cormac Herley, 'So Long, and No Thanks for the Externalities: the Rational Rejection of Security Advice by Users,' from the 2009 New Security Paradigms Workshop. Herley argues 'that user's rejection of the security advice they receive is entirely rational from an economic perspective.' Herley discusses 'password rules,' 'teaching users to recognize phishing sites by reading URLs,' and 'certificate errors.' Users obviously choose bad passwords, but does password aging actually help? There was some discussion on TechRepublic. I'm especially interested in hearing about studies about password aging."

Read more of this story at Slashdot.
Apache Foundation Attacked, Passwords Stolen

Posted: April 13th, 2010, 6:27pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "Combining a cross-site scripting (XSS) vulnerability with a TinyURL redirect, hackers successfully broke into the infrastructure for the open-source Apache Foundation in what is being described as a 'direct, targeted attack.' The hackers hit the server hosting the software that Apache.org uses to track issues and requests and stole passwords from all users. The software was hosted on brutus.apache.org, a machine running Ubuntu Linux 8.04 LTS, the group said."

Read more of this story at Slashdot.
US Most Vulnerable To Cyberattack?

Posted: April 7th, 2010, 5:46pm CEST by CmdrTaco

Tags: security

alphadogg writes "Several nations, most prominently Russia, the People's Republic of China and North Korea, are already assembling cyber armies and attack weapons that could be used to attack other nations. Given that the United States is heavily dependent on technology for everything from computer-based banking to supply-chain tracking and air-traffic control, it's particularly vulnerable to the denial-of-service attacks, electronic jamming, data destruction and software-based disinformation tricks likely in a cyberattack. Here's what ex-presidential adviser Richard Clarke, who is releasing a new book called Cyber War, and others are saying needs to be done to keep cyberwars from escalating into full-scale combat."

Read more of this story at Slashdot.
No JavaScript Needed For New Adobe Exploits

Posted: April 6th, 2010, 5:52pm CEST by CmdrTaco

Tags: security

bl8n8r writes "More woes for Adobe as a security firm creates a proof-of-concept attack that injects malicious code as part of the update process. The user only needs to click a dialog box to execute the code and no JavaScript is needed to launch the exploit. The exploit affects Foxit as well as Adobe Acrobat software. This exploit is made possible through the host software allowing execution of system binaries. Not clear if it's multi-platform, but seems plausible."

Read more of this story at Slashdot.
Compliance Is Wasted Money, Study Finds

Posted: April 5th, 2010, 10:12pm CEST by Soulskill

Tags: security

Trailrunner7 writes "Enterprises are spending huge amounts of money on compliance programs related to PCI-DSS, HIPAA and other regulations, but those funds may be misdirected in light of the priorities of most information security programs, a new study has found. A paper by Forrester Research, commissioned by Microsoft and RSA, the security division of EMC, found that even though corporate intellectual property comprises 62 percent of a given company's data assets, most of the focus of their security programs is on compliance with various regulations. The study found that enterprise security managers know what their companies' true data assets are, but find that their security programs are driven mainly by compliance, rather than protection (PDF)."

Read more of this story at Slashdot.
New Method Could Hide Malware In PDFs, No Further Exploits Needed

Posted: March 31st, 2010, 8:47pm CEST by timothy

Tags: security

Trailrunner7 writes "A security researcher has managed to create a proof-of-concept PDF file that executes an embedded executable without exploiting any other security vulnerabilities. The PDF hack, when combined with clever social engineering techniques, could potentially allow code execution attacks if a user simply opens a rigged PDF file. With Adobe Reader, the only thing preventing execution is a warning. Disabling JavaScript will not prevent this."

Read more of this story at Slashdot.
Self-Destructing USB Stick

Posted: March 30th, 2010, 1:57pm CEST by samzenpus

Tags: security

Hugh Pickens writes "PC World reports that Victorinox, maker of the legendary Swiss Army Knife, has launched a new super-secure memory stick that sounds like something out of Mission: Impossible. The Secure Pro USB comes in 8GB, 16GB, and 32GB sizes, and provides a variety of security measures including fingerprint identification, a thermal sensor, and even a self-destruct mechanism. Victorinox says the Secure is 'the most secure [device] of its kind available to the public.' The Secure features a fingerprint scanner and a thermal sensor 'so that the finger alone, detached from the body, will still not give access to the memory stick's contents.' While offering no explanation how the self-destruct mechanism works, Victorinox says that if someone tries to forcibly open the memory stick it triggers a self-destruct mechanism that 'irrevocably burns [the Secure's] CPU and memory chip.' At a contest held in London, Victorinox put its money where its mouth was and put the Secure Pro to the test offering a £100,000 cash prize ($149,000) to a team of professional hackers if they could break into the USB drive within two hours. They failed."

Read more of this story at Slashdot.
OpenSSL 1.0.0 Released

Posted: March 29th, 2010, 10:31pm CEST by Soulskill

Tags: security

hardaker writes "After over 11 years of development since the start of the OpenSSL Project (1998-12-23), OpenSSL version 1.0.0 has finally hit the shelves of the free-for-all store."

Read more of this story at Slashdot.
Taking Apart the Energizer Trojan

Posted: March 29th, 2010, 10:10pm CEST by Soulskill

Tags: security

iago-vL writes "Researchers at SkullSecurity have written a tutorial on how they reverse engineered the Energizer Trojan and generated an Nmap probe to remotely detect infections. The Energizer Trojan is a great educational tool because its inner workings are very simplistic, and it makes minimal efforts to hide itself or conceal its purpose; it even lists what appears to be the author's name — 'liuhong' — in the source! The article provides an introduction to malware analysis, from infecting a test machine to debugging and disassembling the Trojan to writing the actual probe."

Read more of this story at Slashdot.
Remote Malware Injection Via Flaw In Network Card

Posted: March 27th, 2010, 10:50pm CET by timothy

Tags: security

kfz-versicherung writes "During the CanSecWest international conference in Vancouver, members of ANSSI described how an attacker could be able to exploit a flaw to run arbitrary code inside some network controllers (full presentation; PDF). The attack uses routable packets delivered to the victim's NIC. Consequently, multiple attacks can be conducted including man-in-the-middle attacks on network connections, access to cryptographic keys on the host platform, or malware injection on the victim's computer host platform."

Read more of this story at Slashdot.
US House Passes P2P Ban On Federal Networks

Posted: March 26th, 2010, 10:23pm CET by Soulskill

Tags: security

An anonymous reader writes "Recently, the US House of Representatives passed a bill in an attempt to ban peer-to-peer file-sharing applications on federal computers and networks. Similar bills have been proposed before, apparently in response to confidential government documents being found on LimeWire. The text of the bill, however, provides a very broad definition of 'peer-to-peer file sharing software,' and may extend to more than they intend (SMB? LDAP?)."

Read more of this story at Slashdot.
New Malware Overwrites Software Updaters

Posted: March 26th, 2010, 7:31pm CET by Soulskill

Tags: security

itwbennett writes "Researchers at Bach Khoa Internetwork Security (BKIS), a Vietnamese security company, have found a new type of malware that 'masks itself as an updater for Adobe Systems' products and other software such as Java,' wrote BKIS analyst Nguyen Cong Cuong in a post on the company's blog. BKIS showed screenshots of a variant of the malware that imitates Adobe Reader version 9 and overwrites the AdobeUpdater.exe, which regularly checks in with Adobe to see if a new version of the software is available."

Read more of this story at Slashdot.
IE8, Safari, iPhone All Fall At Pwn2Own Contest

Posted: March 25th, 2010, 11:27pm CET by timothy

Tags: security

SpuriousLogic writes "The annual Pwn2Own contest at CanSecWest is underway, and on the first day Web browsers fell to attack. Internet Explorer 8 and Firefox 3.6.2 on 64-bit Windows 7 and Safari on OS X all were forced to run exploit code. To add insult to injury, an iPhone was cracked and the SMS database lifted from it." Updated 22:40 GMT by timothy: CWmike adds this interesting bit: "The only researcher to three-peat at the Pwn2Own hacking contest said on Thursday that security is such a 'broken record' that he won't hand over 20 vulnerabilities he's found in Apple's, Adobe's and Microsoft's software. Instead Charlie Miller will show the vendors how to find the bugs themselves."

Read more of this story at Slashdot.
Obama's Twitter Account "Hacked"

Posted: March 25th, 2010, 6:30pm CET by CmdrTaco

Tags: security

Oxford_Comma_Lover writes "A 24-year-old living with his mother in France was arrested for 'hacking' into Obama's twitter accounts. (Warning: WSJ does obnoxious paywall things. Your miles may vary.) Apparently he guesses the answer to a question related to password recovery in order to break into the accounts of famous people; he has no computer science training or financial motive. He posted screenshots to a few boards and twitter found out within a few hours, either from a tip or from noticing when someone from France logs onto twitter as the President of the United States. (He did not actually tweet as POTUS, but just wanted to show he could break into the account.)"

Read more of this story at Slashdot.
Millions Continue To Click On Spam

Posted: March 25th, 2010, 2:58pm CET by CmdrTaco

Tags: security

An anonymous reader writes "Even though over 80% of email users are aware of the existence of bots, tens of millions respond to spam in ways that could leave them vulnerable to a malware infection, according to a Messaging Anti-Abuse Working Group (MAAWG) survey. In the survey, half of users said they had opened spam, clicked on a link in spam, opened a spam attachment, replied or forwarded it – activities that leave consumers susceptible to fraud, phishing, identity theft and infection. While most consumers said they were aware of the existence of bots, only one-third believed they were vulnerable to an infection."

Read more of this story at Slashdot.
Microsoft To Distribute Third-Party Patches

Posted: March 24th, 2010, 8:06pm CET by timothy

Tags: security

dhiren writes "Secunia on Wednesday announced that their authenticated internal vulnerability scanner, the Corporate Software Inspector (CSI) 4.0, has been integrated with Microsoft Windows Server Update Service (WSUS) and System Center Configuration Manager (SCCM). This will hopefully pave the way for other vendors to also make use of Windows' existing patching infrastructure and eliminate the need for the multitude of custom updater applications and services that clutter most systems today."

Read more of this story at Slashdot.
New Legislation Would Crack Down On Online Criminal Havens

Posted: March 24th, 2010, 4:43am CET by timothy

Tags: security

Hugh Pickens writes "The Hill reports that Senators Orrin Hatch (R-Utah) and Kirsten Gillibrand (D-NY) have introduced a bill that would penalize foreign countries that fail to crack down on cyber criminals operating within their borders. Under the bill the White House would have the responsibility of identifying countries that pose cyber threats and the president would have to present to Congress in an annual report. Countries identified as 'hacker havens' would then have to develop plans of action to combat cybercrimes or risk cuts to their US export dollars, foreign-direct investment funds and trade assistance grants. Numerous American employers, including Cisco, HP, Microsoft, Symantec, PayPal, eBay, McAfee, American Express, Mastercard and Visa, as well as Facebook, are supporting the Senators' legislation."

Read more of this story at Slashdot.
How To Evade URL Filters With (Not-So) Fancy Math

Posted: March 24th, 2010, 12:22am CET by timothy

Tags: security

Trailrunner7 writes "In their constant quest to find new and interesting ways to abuse the Internet, attackers recently have begun using an old technique to obfuscate URLs and IP addresses to bypass URL filters and direct users to malicious sites. The technique takes advantage of the fact that modern browsers will allow users to specify IP addresses in formats other than base 10. So a typical IP address that looks something like this — 192.10.10.1 — can also be written in base 8, hexadecimal or a handful of other formats, and the browser will recognize it and take the user to the specified site. What is interesting though is that due to the relative obscurity of using such methods to denote an IP or URL, it is quite feasible that existing security products do not correctly identify the URLs as valid or flag them as malicious when they point to existing known bad websites."

Read more of this story at Slashdot.
The Biggest Cloud Providers Are Botnets

Posted: March 23rd, 2010, 2:35pm CET by CmdrTaco

Tags: security

Julie188 writes "Google is made up of 500,000 systems, 1 million CPUs and 1,500 gigabits per second (Gbps) of bandwidth, according to cloud service provider Neustar. Amazon comes in second with 160,000 systems, 320,000 CPUs and 400 Gbps of bandwidth, while Rackspace offers 65,000 systems, 130,000 CPUs and 300 Gbps. But these clouds are dwarfed by the likes of the really big cloud services, otherwise known as botnets. Conficker controls 6.4 million computer systems in 230 countries, with more than 18 million CPUs and 28 terabits per second of bandwidth."

Read more of this story at Slashdot.
IRS Security Faults Leave Taxpayer Data At Risk

Posted: March 20th, 2010, 4:46pm CET by Soulskill

Tags: security

coondoggie writes "In this tax season, when billions of dollars and tons of personal information is relayed to and from the government, it's more than disconcerting to hear that the Internal Revenue Service is still struggling to keep private information secure. A report out Friday from watchdogs at the Government Accountability Office says about 69% of the tax agency's previously noted security flaws remain unfixed and continue to jeopardize the confidentiality, integrity, and availability of the IRS's systems (PDF). The problems put the IRS at increased risk of unauthorized disclosure, modification, or destruction of financial and taxpayer information, the GAO concluded."

Read more of this story at Slashdot.
US Military Shuts Down CIA's Terrorist Honey Pot

Posted: March 19th, 2010, 4:03pm CET by kdawson

Tags: security

Hugh Pickens sends in a Washington Post story about how US military cyber-warriors attacked and shut down a CIA-backed intelligence gathering site. "US military computer specialists, over the objections of the CIA, mounted a cyberattack that dismantled an online 'honey pot' monitored by US and Saudi intelligence agencies to identify extremists before they could strike, after military commanders said that the site was putting Americans at risk. The CIA argued that dismantling the site would lead to a significant loss of intelligence, while the military (in the form of the NSA) countered that taking it down was a legitimate operation in defense of US troops. 'The CIA didn't endorse the idea of crippling Web sites,' said one US counterterrorism official. The agency 'understood that intelligence would be lost, and it was; that relationships with cooperating intelligence services would be damaged, and they were; and that the terrorists would migrate to other sites, and they did.' Four former senior US officials, speaking on the condition of anonymity, said the creation and shutting down of the site illustrates the need for clearer policies governing cyberwar."

Read more of this story at Slashdot.
What Free Antivirus Do You Install On Windows?

Posted: March 18th, 2010, 7:43pm CET by timothy

Tags: security

Techman83 writes "After years of changing between AVG Free + Avast, it's coming time to find a new free alternative for friends/relatives who run Windows. AVG and Avast have been quite good, but are starting to bloat out in size, and also becoming very misleading. Avast recently auto updated from 4.8 to 5 and now requires you to register (even for the free version) and both are making it harder to actually find the free version. Is this the end of reasonable free antivirus, or is there another product I can entrust to keep the 'my computer's doing weird things' calls to a minimum?"

Read more of this story at Slashdot.
Blazing Fast Password Recovery With New ATI Cards

Posted: March 16th, 2010, 3:55pm CET by CmdrTaco

Tags: security

An anonymous reader writes "ElcomSoft accelerates the recovery of Wi-Fi passwords and password-protected iPhone and iPod backups by using ATI video cards. The support of ATI Radeon 5000 series video accelerators allows ElcomSoft to perform password recovery up to 20 times faster compared to Intel top of the line quad-core CPUs, and up to two times faster compared to enterprise-level NVIDIA Tesla solutions. Benchmarks performed by ElcomSoft demonstrate that ATI Radeon HD5970 accelerated password recovery works up to 20 times faster than Core i7-960, Intel's current top of the line CPU unit."

Read more of this story at Slashdot.
How To Guarantee Malware Detection

Posted: March 15th, 2010, 5:19pm CET by CmdrTaco

Tags: security

itwbennett writes "Dr. Markus Jakobsson, Principal Scientist at PARC, explains how it is possible to guarantee the detection of malware, including zero-day attacks and rootkits and even malware that infected a device before the detection program was installed. The solution comes down to this, says Jakobsson: 'Any program — good or bad — that wants to be active in RAM has no choice but to take up some space in RAM. At least one byte.'"

Read more of this story at Slashdot.
Humans Continue To Be 'Weak Link' In Data Security

Posted: March 15th, 2010, 1:46pm CET by CmdrTaco

Tags: security

ChiefMonkeyGrinder writes "Nearly 90 percent of IT workers in the UK have said a laptop in their organization has been reported lost or stolen, new research has found. Sixty-one percent said that this then resulted in a data breach, according to the '2010 Human Factor in Laptop Encryption Study: United Kingdom,' a report produced by the Ponemon Institute for Absolute Software."

Read more of this story at Slashdot.
Humans Continue To Be "Weak Link" In Data Security

Posted: March 15th, 2010, 1:46pm CET by CmdrTaco

Tags: security

ChiefMonkeyGrinder writes "Nearly 90 percent of IT workers in the UK have said a laptop in their organization has been reported lost or stolen, new research has found. Sixty-one percent said that this then resulted in a data breach, according to the '2010 Human Factor in Laptop Encryption Study: United Kingdom,' a report produced by the Ponemon Institute for Absolute Software."

Read more of this story at Slashdot.
Security Industry Faces Attacks It Can't Stop

Posted: March 12th, 2010, 7:23pm CET by kdawson

Tags: security

itwbennett writes "The takedown of the Mariposa botnet and so-called advanced persistent threat attacks, such as the one that compromised Google systems in early December, were hot topics at the RSA conference last week. What both Mariposa and the Google attacks illustrate, and what went largely unsaid at RSA, was that the security industry has failed to protect paying customers from some of today's most pernicious threats, writes Robert McMillan. Traditional security products are simply not much help, said Alex Stamos, a partner with Isec Partners, one of the companies investigating the APT attacks. 'All of the victims we've worked with had perfectly installed antivirus,' he said. 'They all had intrusion detection systems and several had Web proxies scan content.'"

Read more of this story at Slashdot.
Hollow Spy Coins

Posted: March 12th, 2010, 3:40pm CET by kdawson

Tags: security

Bruce Schneier's blog links to a few sources for hollow spy coins, one being BoingBoing's Bazaar — where a nickel that can hold a microSD card costs $27. Another is Slashdot's sister company ThinkGeek, where you can get hollow quarters and half-dollars in the low 20s. As if corporate and government security geeks didn't have enough to worry about.

Read more of this story at Slashdot.
Energizer USB Battery Charger Software Infects PCs

Posted: March 8th, 2010, 5:49pm CET by Soulskill

Tags: security

swandives writes "Researchers at US-CERT have warned that software accompanying the Energizer DUO USB battery charger contains a Trojan that gives hackers total access to a Windows PC. The product was sold in the US, Latin America, Europe and Asia starting in 2007. Upon installation, the software creates the file 'Arucer.dll,' a Trojan that listens for commands on TCP port 7777. Upon receiving instructions, the Trojan can download and execute files, transmit files stolen from the PC, or tweak the Windows registry. Uninstalling the software disables the automatic execution of the Trojan. Users can also remove Arucer.dll from Windows' system32 directory and reboot the machine to disable the backdoor component."

Read more of this story at Slashdot.
Coping With 1 Million SSH Authentication Failures?

Posted: March 7th, 2010, 1:51am CET by kdawson

Tags: security

An anonymous reader writes "I own a small Web development studio that specializes in open source software, primarily Drupal, WordPress, and Joomla for small businesses. Our production servers, which host about 50 sites and generate ~20K hits/week, are managed by a 3rd party that I'm sure many on Slashdot would recognize. Earlier today I was researching some problems on one of our sites and found that there have been over 1 million SSH authentication failures from ~1200 IP addresses on one of our servers over the last year. I contacted the ISP, who had promised me that server security would be actively managed, and their recommendation was, 'change the SSH port!' Of course this makes sense and may help to an extent, but it still doesn't solve the problem I'm facing: how do you manage server security on a tight budget with literally no system admin (except for me and I know I'm a n00b)? User passwords are randomly generated, we use a non-standard SSH port, and do not use any unencrypted services such as FTP. Is there a server monitoring program you would recommend? Is there an ISP or Web-based service that specializes in this?"

Read more of this story at Slashdot.
White House Declassifies Outline of Cybersecurity Plans

Posted: March 3rd, 2010, 4:20pm CET by Soulskill

Tags: security

An anonymous reader writes "The Obama administration on Tuesday declassified part of the Comprehensive National Cybersecurity Initiative created during the Bush administration, outlining offensive and defensive strategies for protecting information networks. The initiative was originally intended to unify efforts of a number of government agencies into a comprehensive strategy to protect the nation's computer networks. 'One area in which the government did officially disclose new details was Einstein 3, a program to protect civilian government systems from intrusion by deploying sensors on the networks of private telecommunications companies. For the first time, the government disclosed officially that the program would use technology developed by the NSA, the nation's largest intelligence agency. It also said that the Department of Homeland Security, which would run the program, would share malicious code data with the NSA but not the content of communications, such as e-mails.'"

Read more of this story at Slashdot.
Microsoft Says, Don't Press the F1 Key In XP

Posted: March 3rd, 2010, 1:22am CET by kdawson

Tags: security

Ian Lamont writes "Microsoft has issued a security advisory warning users not to press the F1 key in Windows XP, owing to an unpatched bug in VBScript discovered by Polish researcher Maurycy Prodeus. The security advisory says that the vulnerability relates to the way VBScript interacts with Windows Help files when using Internet Explorer, and could be triggered by a user pressing the F1 key after visiting a malicious Web site using a specially crafted dialog box."

Read more of this story at Slashdot.
New "Spear Phishing" Attacks Target IT Admins

Posted: March 2nd, 2010, 10:18pm CET by kdawson

Tags: security

snydeq writes "A new breed of 'spear phishing' aimed at IT admins is making the rounds. The emails, containing no obvious malicious links, are fooling even the savviest of users into opening up holes in their company's network defenses. The authentic-looking emails, which often include the admin's complete name or refer to a real project they are working on, are the product of tactical research or database hacks and appear as if having been sent by the company's hosting provider. 'In each case, the victim remembered getting a similar sort of email message when they first signed on with a service and, thus, thought the bogus message was legitimate — especially because their cloud/hosting providers keep bragging about all the new data centers they're continuing to bring online.' The phishing messages often include instructions for opening up mail servers to enable spam relaying, to disable their host-based firewalls, and to open up unprotected network shares. Certainly fodder for some bone-headed mistakes on the part of admins, the new attack 'makes the old days of hoax messages that caused users to delete legitimate operating system files seem relatively harmless.'"

Read more of this story at Slashdot.
Over Half of Software Fails First Security Tests

Posted: March 2nd, 2010, 5:02pm CET by Soulskill

Tags: security

An anonymous reader writes "Even with all of the emphasis on writing software with security in mind, most software applications remain riddled with security holes, according to a new report released today about the actual security quality of all types of software. Close to 60 percent of the applications tested by application security company Veracode in the past year-and-a-half failed to achieve a successful rating in their first round of testing. And this data is based on software developers who took the time and effort to have their code tested — who knows about the others." Reader sgtrock pointed out another interesting snippet from the article: "'The conventional wisdom is that open source is risky. But open source was no worse than commercial software upon first submission. That's encouraging,' Oberg says. And it was the quickest to remediate any flaws: 'It took about 30 days to remediate open-source software, and much longer for commercial and internal projects,' he says."

Read more of this story at Slashdot.
Aurora Attack — Resistance Is Futile, Pretty Much

Posted: March 2nd, 2010, 3:36am CET by kdawson

Tags: security

eldavojohn writes "Do you have branch offices in China? iSec has published a new report (PDF) outlining the severity of the attacks on Google.cn, allegedly by the Chinese government, dubbed 'Aurora' attacks. Up to 100 companies were victims, and some are speculating that resistance to such attacks is futile. The report lays out the shape of the attacks — which were customized per-company based on installed vulnerable software and antivirus protection: '1. The attacker socially engineers a victim, often in an overseas office, to visit a malicious website. 2. This website uses a browser vulnerability to load custom malware on the initial victim's machine. 3. The malware calls out to a control server, likely identified by a dynamic DNS address. 4. The attacker escalates his privilege on the corporate Windows network, using cached or local administrator credentials. 5. The attacker attempts to access an Active Directory server to obtain the password database, which can be cracked onsite or offsite. 6. The attacker uses cracked credentials to obtain VPN access, or creates a fake user in the VPN access server. 7. At this point, the attack varies based upon the victim. The attacker may steal administrator credentials to access production systems, obtain source code from a source repository, access data hosted at the victim, or explore Intranet sites for valuable intellectual property.' The report also has pages of recommendations as well as lessons learned, which any systems administrator — even those inside the US — should read and take note of."

Read more of this story at Slashdot.
Hackers Target Tsunami Search Results

Posted: February 28th, 2010, 7:28pm CET by Soulskill

Tags: security

xsee writes "Only hours after the earthquake and resulting tsunami from Chile, hackers began manipulating search results to direct people seeking information on the event to infected webpages. Exercise caution as to where you get information on this tragedy. Chester Wisniewski describes what happened after he saw a suspicious site listed second on a Google search: 'It appears to be a normal website with information and videos about different Asian tsunamis over the past few years. It is difficult to tell whether this particular page was SEO-optimized, or was an innocent victim of a malicious script. SophosLabs got back to me that this page contains some obfuscated malicious JavaScript that we detect as MAL/ObfJS-R. This script was appended after the normal code on the page'"

Read more of this story at Slashdot.
A New Wi-Fi Exploit, Limited But Clever

Posted: February 27th, 2010, 8:32pm CET by kdawson

Tags: security

eggboard writes "Martin Beck, who in 2008 co-wrote a paper describing a way to inject packets into a secured Wi-Fi system, is back with a more extensive exploit. His 'Enhanced TKIP Michael Attacks' still don't allow extraction of a key, and are limited to TKIP (not AES-CCMP) WPA-protected networks. Still, he's figured out how to put in large payloads, and to extract data sent from an access point to a client — all without cracking the network key. The attack requires proximity to sniff and inject data, but it's another crack in the older key standard (TKIP) that no one with serious security interests should still be using." Here is Beck's paper (PDF) describing the new attacks.

Read more of this story at Slashdot.
Anatomy of a SQL Injection Attack

Posted: February 26th, 2010, 11:03am CET by timothy

Tags: security

Trailrunner7 writes "SQL injection has become perhaps the most widely used technique for compromising Web applications, thanks to both its relative simplicity and high success rate. It's not often that outsiders get a look at the way these attacks work, but a well-known researcher is providing just that. Rafal Los showed a skeptical group of executives just how quickly he could compromise one of their sites using SQL injection, and in the process found that the site had already been hacked and was serving the Zeus Trojan to visitors." Los's original blog post has more and better illustrations, too.

Read more of this story at Slashdot.
GoDaddy Wants Your Root Password

Posted: February 25th, 2010, 1:20am CET by samzenpus

Tags: security

Johnny Fusion writes "The writer of the Securi Security Blog had an alarming awakening when a honeypot on port 22 on a GoDaddy-hosted VPS recorded login attempts using his GoDaddy username and password and even an attempt to login as root. It turns out the attempt was actually from within GoDaddy's network. Before he could 'alert' GoDaddy about the security breach, he got an email from GoDaddy Demanding his root login credentials. There is an update where GoDaddy explains itself and says they will change policy."

Read more of this story at Slashdot.
Latvian "Robin Hood" Hacker Leaks Bank Details

Posted: February 24th, 2010, 9:11pm CET by ScuttleMonkey

Tags: security

eldavojohn writes "Move over Russell Crowe, an anonymous hacker in Latvia is being hailed as a real life modern Robin Hood. The hacker refers to himself as 'Neo,' claims allegiance with the Fourth Awakening People's Army, and is outing banks that are capitalizing off of the horrible economic status Latvia is currently suffering from. No word on how he is acquiring the information but it is slowly being leaked to TV sources via Twitter and the common people love him. The hacker is thought to be based in Britain but a TV reporter pointed out the fine line Neo is walking, 'On the one hand of course he has stolen confidential data ... and he actually has committed a crime. But at the same time there is value for the public in the sense that now a lot of information gets disclosed and the whole system maybe becomes a little more transparent.' An example of a juicy tidbit he revealed is that managers of a Latvian bank did not take the salary cuts they promised they would after the government bailed them out of economic trouble. You can imagine that taxpayers were upset and thankful they knew this information."

Read more of this story at Slashdot.
US Unable To Win a Cyber War

Posted: February 24th, 2010, 5:30pm CET by CmdrTaco

Tags: security

An anonymous reader writes "The inability to deflect even a simulated cyber attack or mitigate its effects shown in the exercise that took place some six days ago at Washington's Mandarin Oriental Hotel doesn't bode well for the US. Mike McConnell, the former Director of National Intelligence, said to the US Senate Commerce, Science, and Transportation Committee yesterday that if the US got involved in a cyber war at this moment, they would surely lose. 'We're the most vulnerable. We're the most connected. We have the most to lose,' he stated. Three years ago, McConnell referred to cybersecurity as the 'soft underbelly of this country' and it's clear that he thinks things haven't changed much since then."

Read more of this story at Slashdot.
US Unable To Win a Cyber War

Posted: February 24th, 2010, 5:30pm CET by CmdrTaco

Tags: security

An anonymous reader writes "The inability to deflect even a simulated cyber attack or mitigate its effects shown in an exercise that took place some six days ago at Washington's Mandarin Oriental Hotel doesn't bode well for the US. Mike McConnell, the former Director of National Intelligence, said to the US Senate Commerce, Science, and Transportation Committee yesterday that if the US got involved in a cyber war at this moment, they would surely lose. 'We're the most vulnerable. We're the most connected. We have the most to lose,' he stated. Three years ago, McConnell referred to cybersecurity as the 'soft underbelly of this country' and it's clear that he thinks things haven't changed much since then."

Read more of this story at Slashdot.
How Banker Trojans Steal Millions Every Day

Posted: February 23rd, 2010, 3:33am CET by kdawson

Tags: security

redsoxh8r notes a blog post describing in some detail the operation of "man in the browser" Trojans used to empty victims' bank accounts. "Banker trojans have become a serious problem, especially in South America and the US. Trojans like Zeus, URLZone and others are the tip of the iceberg. These toolkits are now standard-issue weapons for criminals and state-sponsored hackers. Like Zeus, URLZone was created using a toolkit (available in underground markets). What this means is that the buyer of this toolkit can then create customized malware or botnets with different command-and-controls and configurations (such as which banks to attack), but having all the flexibility and power of the original toolkit. Having such a toolkit in the hands of multiple criminal groups paints a scary picture. It's simply not enough to eliminate a particular botnet and criminal group to solve this problem."

Read more of this story at Slashdot.
Two Chinese Schools Reportedly Tied To Online Attacks

Posted: February 20th, 2010, 4:16pm CET by Soulskill

Tags: security

squidw* writes "Online attacks on Google and other American corporations have been traced to computers at two educational institutions in China, including one with close ties to the Chinese military, say people involved in the investigation. From the NY Times: '... the attacks, aimed at stealing trade secrets and computer codes and capturing e-mail of Chinese human rights activists, may have begun as early as April, months earlier than previously believed. ... The Chinese schools involved are Shanghai Jiaotong University and the Lanxiang Vocational School, according to several people with knowledge of the investigation who asked for anonymity because they were not authorized to discuss the inquiry. Jiaotong has one of China’s top computer science programs. Just a few weeks ago its students won an international computer programming competition organized by IBM — the “Battle of the Brains” — beating out Stanford and other top-flight universities. Lanxiang, in east China’s Shandong Province, is a huge vocational school that was established with military support and trains some computer scientists for the military.'"

Read more of this story at Slashdot.
Adobe Download Manager Installing Software Without Consent

Posted: February 19th, 2010, 11:31pm CET by timothy

Tags: security

"Not all is worth cheering about as Adobe turns 20," writes reader adeelarshad82, who excerpts from a story at PC Magazine's Security Watch: "Researcher Aviv Raff has found a problem in ADM (Adobe Download Manager) and the method through which it is delivered from adobe.com. The net effect of the problem is that a user can be tricked into downloading and installing software using ADM without actual consent. Tonight Adobe acknowledged the report and said they were working on the issue with Raff and NOS Microsystems, the company that wrote ADM."
Read more of this story at Slashdot.
Time Bomb May Have Destroyed 800 Norfolk City PCs' Data

Posted: February 17th, 2010, 8:20pm CET by timothy

Tags: security

krebsonsecurity writes "The City of Norfolk, Virginia is reeling from a massive computer meltdown in which an unidentified family of malicious code destroyed data on nearly 800 computers citywide. The incident is still under investigation, but city officials say the attack may have been the result of a computer time bomb planted in advance by an insider or employee and designed to trigger at a specific date, according to krebsonsecurity.com. 'We don't believe it came in from the Internet. We don't know how it got into our system,' the city's IT director said. 'We speculate it could have been a time bomb waiting until a date or time to trigger. Whatever it was, it essentially destroyed these machines.'"
Read more of this story at Slashdot.
Rogue PDFs Behind 80% of Exploits In Q4 '09

Posted: February 17th, 2010, 3:30pm CET by CmdrTaco

Tags: security

CWmike writes "Just hours before Adobe is slated to deliver the latest patches for its popular PDF viewer, ScanSafe announced that by its counting, malicious Adobe Reader documents made up 80% of all exploits at the end of 2009. In the first quarter of 2009, malicious PDF files made up 56% of all exploits tracked by ScanSafe. That figure climbed above 60% in the second quarter, over 70% in the third and finished at 80% in the fourth quarter. Mary Landesman, a ScanSafe senior security researcher, said, 'Attackers are choosing PDFs for a reason. It's not random. They're establishing a preference for Reader exploits.' Exactly why hackers choose Adobe as their prime target is tougher to divine, however. 'Perhaps they are more successful,' she said. 'Or maybe it's because criminal attackers are human, too. We respond when we see a lot of people going after a particular product... We all want to go after that product, too. In the attacker arena, they might be thinking, 'Gee, all these reports of Adobe Reader zero-days, maybe I should get in on them too.'"
Read more of this story at Slashdot.
Malicious Spam Jumps To 3B Messages Per Day

Posted: February 16th, 2010, 8:43pm CET by kdawson

Tags: security

Trailrunner7 writes "Last year saw a monstrous increase in the volume of malicious spam, according to a new report (PDF). In the second half of 2009, the number of spam messages sent per day skyrocketed from 600 million to three billion, according to new research. For some time now, spam has been accounting for 90 or more percent of all email messages. But the volume of spam had been relatively steady in the last couple of years. Now, the emergence of several large-scale botnets, including Zeus and Koobface, has led to an enormous spike in the volume of spam."
Read more of this story at Slashdot.
'Iceman' Gets 13 Years For 2nd Hacking Offense

Posted: February 15th, 2010, 9:12pm CET by ScuttleMonkey

Tags: security

Hugh Pickens writes "Computerworld reports that Max Ray Butler, who used the hacker pseudonym Iceman, has been sentenced to 13 years in federal prison for hacking into financial institutions and stealing credit card account numbers, the longest known sentence ever handed down for hacking charges. This isn't Butler's first time facing a federal hacking sentence. After a promising start as a security consultant who did volunteer work for the FBI, Butler was arrested for writing malicious software that installed a back-door program on computers — including some on federal government networks — that were susceptible to a security hole. Butler served an 18-month prison term for the crime and fell on hard times after his 2002 release. In desperation, he turned again to cybercrime and by the time of his arrest in September 2007, he had built the largest marketplace for stolen credit and debit card information in the world."
Read more of this story at Slashdot.
Was This the First Denial of Service Attack?

Posted: February 15th, 2010, 4:36am CET by timothy

Tags: security

An anonymous reader writes "Way back in 1974, Dave Dennis, then aged 13, decided to try out the -ext- TUTOR command on the PLATO system at the University of Illinois, and see if he could cause all the terminals of other users to go offline. It worked. And he never got caught. Of course, the powers that be eventually caught on and fixed the -ext- command so terminals by default didn't automatically receive -ext-'s sent from other locations."
Read more of this story at Slashdot.
Rootkit May Be Behind Windows Blue Screen

Posted: February 12th, 2010, 6:31pm CET by kdawson

Tags: security

L3sPau1 writes "A rootkit infection may be the cause of a Windows Blue Screen of Death issue experienced by Windows XP users who applied the latest round of Microsoft patches. It appears that the affected Windows PCs had the rootkit infection prior to deploying the Microsoft patches. Researcher Patrick W. Barnes, investigating the issue, has isolated the infection to the Windows atapi.sys file, a driver used by Windows to connect hard drives and other components. Barnes identified the infection as the Tdss-rootkit, which surfaced last November and has been spreading quickly, creating zombie machines for botnet activity."
Read more of this story at Slashdot.
European Credit and Debit Card Security Broken

Posted: February 11th, 2010, 10:52pm CET by timothy

Tags: security

Jack Spine writes "With nearly a billion users dependent on smart banking credit and debit cards, banks have refused liability for losses where an idenification number has been provided. But now, the process behind the majority of European credit and debit card transactions is fundamentally broken, according to researchers from Cambridge University. The researchers have demonstrated a man-in-the-middle attack which fooled a card reader into accepting a number of point-of-sale transactions, even though the cards were not properly authenticated. The researchers used off-the-shelf components (PDF), and a laptop running a Python script, to undermine the two-factor authentication process on European credit and debit cards, which is called Chip and PIN."
Read more of this story at Slashdot.
Subversive Groups Must Now Register In South Carolina

Posted: February 11th, 2010, 1:57am CET by samzenpus

Tags: security

Hugh Pickens writes "The Raw Story reports that terrorists who want to overthrow the United States government must now register with South Carolina's Secretary of State and declare their intentions — or face a $25,000 fine and up to 10 years in prison. The 'Subversive Activities Registration Act' passed last year in South Carolina and now officially on the books states that 'every member of a subversive organization, or an organization subject to foreign control, every foreign agent and every person who advocates, teaches, advises or practices the duty, necessity or propriety of controlling, conducting, seizing or overthrowing the government of the United States ... shall register with the Secretary of State.'"
Read more of this story at Slashdot.
A "Never Reboot" Service For Linux

Posted: February 10th, 2010, 1:21am CET by kdawson

Tags: security

An anonymous reader writes "Ksplice, the company based on the MIT Ksplice project, is now offering its 'never reboot' service for Red Hat, Debian, and other Linux distros. You subscribe and get real-time kernel security updates that apply in-memory instead of rebooting. Last summer we discussed the free service for Ubuntu. Cool tech, but will people really pay $4 a month for this?"
Read more of this story at Slashdot.

Slashdot: Linux

A "Never Reboot" Service For Linux

Posted: February 10th, 2010, 1:21am CET by kdawson

Tags: security

An anonymous reader writes "Ksplice, the company based on the MIT Ksplice project, is now offering its 'never reboot' service for Red Hat, Debian, and other Linux distros. You subscribe and get real-time kernel security updates that apply in-memory instead of rebooting. Last summer we discussed the free service for Ubuntu. Cool tech, but will people really pay $4 a month for this?"
Read more of this story at Slashdot.

Slashdot: IT

95% of User-Generated Content Is Bogus

Posted: February 7th, 2010, 11:23am CET by kdawson

Tags: security

coomaria writes "The HoneyGrid scans 40 million Web sites and 10 million emails, so it was bound to find something interesting. Among the things it found was that a staggering 95% of User Generated Content is either malicious in nature or spam." Here is the report's front door; to read the actual report you'll have to give up name, rank, and serial number.
Read more of this story at Slashdot.
Web App Scanners Miss Half of Vulnerabilities

Posted: February 6th, 2010, 9:57pm CET by kdawson

Tags: security

seek3r sends news of a recent test of six web application security scanning products, in which the scanners missed an average of 49% of the vulnerabilities known to be on the test sites. Here is a PDF of the report. The irony is that the test pitted each scanner against the public test files of all the scanners. This reader adds, "Is it any wonder that being PCI compliant is meaningless from a security point of view? You can perform a Web app scan, check the box on your PCI audit, and still have the security posture of Swiss cheese on your Web app!" "NTOSpider found over twice as many vulnerabilities as the average competitor having a 94% accuracy rating, with Hailstorm having the second best rating of 62%, but only after extensive training by an expert. Appscan had the second best 'Point and Shoot' rating of 55% and the rest averaged 39%."
Read more of this story at Slashdot.
Can You Trust Chinese Computer Equipment?

Posted: February 5th, 2010, 5:02pm CET by kdawson

Tags: security

Ian Lamont writes "Suspicions about China slipping eavesdropping technology into computer exports have been around for years. But the recent spying attacks, attributed to China, on Google and other Internet companies have revived the hardware spying concerns. An IT World blogger suggests the gear can't be trusted, noting that it wouldn't be hard to add security holes to the firmware of Chinese-made USB memory sticks, computers, hard drives, and cameras. He also implies that running automatic checks for data of interest in the compromised gear would not be difficult." The blog post mentions Ken Thompson's admission in 1983 that he had put a backdoor into the Unix C compiler; he laid out the details in the 1983 Turing Award lecture, Reflections On Trusting Trust: "The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect."
Read more of this story at Slashdot.
Keep SSH Sessions Active, Or Reconnect?

Posted: February 5th, 2010, 12:23am CET by timothy

Tags: security

borjonx writes "Is it safer to log out of an SSH session, and re-establish it later, or just keep the connection open? Like many of you, I use OpenSSH to connect to my Slackware Linux boxes remotely from Linux and WinXP (putty.exe) clients. At home and at work, I wonder if it would be safer to just leave the connection open (my clients are physically secured, the servers limit connections with hosts.allow). Is it more secure to re-establish the connection over an insecure link (big bad internet) where people can sniff that handshaking, or is it more secure to just remain connected? I connect 1 to 4 times per day, most days."
Read more of this story at Slashdot.
Image Searchers Snared By Malware

Posted: February 4th, 2010, 4:16pm CET by samzenpus

Tags: security

Slashdot frequent contributor Bennett Haselton writes "Sites that have been hacked by malware writers are now serving infected content only when the visitor views the site through a frame on Google Images. This recent twist on a standard trick used by malware writers, makes it harder for webmasters and hosting companies to discover that their sites have been infected. Automated tools that check websites for infections and training procedures for hosting company abuse-department staffers will have to be updated accordingly." Read on for the rest of Bennett's thoughts.
Read more of this story at Slashdot.
A Look Into the Chinese Hacker Underworld

Posted: February 2nd, 2010, 7:55pm CET by kdawson

Tags: security

beachels416 writes "The NY Times gained access to a Chinese hacker-for-profit, referred to as 'Majia,' and observed him during one of his nightly 'sessions.' From the article: 'Oddly, Majia said his parents did not know that he was hacking at night [hacking is illegal in China]. But at one point, he explained the intricacies of computer hacking and stealing data while his mother stood nearby, listening silently, while offering a guest oranges and candy.' At another point Majia spoke about the recent Google attacks, and claimed to have particular knowledge of the exact vector used. Nothing too new, but an interesting read nevertheless."
Read more of this story at Slashdot.
"No Scan, No Fly" At Heathrow and Manchester

Posted: February 2nd, 2010, 11:19am CET by kdawson

Tags: security

An anonymous reader writes "It is now compulsory for people selected for a full body scan to take part, or they will not be allowed to fly from Heathrow or Manchester airports. There is no optional pat down. Also, a rule which meant that people under 18 were not allowed to participate in the body scanner trial has been overturned by the government. There is no mention of blurring out the genitals, however reports a few years back said X-ray backscatter devices aren't effective unless the genitals of people going through them are visible."
Read more of this story at Slashdot.
Botnet Targets Web Sites With Junk SSL Connections

Posted: February 2nd, 2010, 3:51am CET by kdawson

Tags: security

angry tapir writes "More than 300 Web sites are being pestered by infected computers that are part of the Pushdo botnet. The FBI, Twitter, and PayPal are among the sites being hit, although it doesn't appear the attacks are designed to knock the sites offline. Pushdo appears to have been recently updated to cause computers infected with it to make SSL connections to various Web sites — the bots start to create an SSL connection, disconnect, and then repeat." SecureWorks's Joe Stewart theorizes that this behavior is designed to obscure Pushdo's command and control in a flurry of bogus SSL traffic.
Read more of this story at Slashdot.
Gun With Wireless Arming Signal Goes On Sale Soon

Posted: January 30th, 2010, 2:02pm CET by timothy

Tags: security

An anonymous reader writes "Armatix has built a pistol that will disarm itself when it is taken away from a watch that sends it a wireless arming signal. The .22 caliber guns will go on sale in the US within months, and the initial price is 7,000 euro. Higher caliber models will follow. To activate the gun, users must enter a pin code on the wristwatch, and then keep it within roughly 20cm of the gun. If the person is disarmed, the gun can't be used against them. Also coming soon this year, civilians will also be able to buy three-shot Tasers, rubber bullets, as well as Heckler and Koch black rifles." This might not be good news for the citizens of New Jersey.
Read more of this story at Slashdot.
Why "Verified By Visa" System Is Insecure

Posted: January 28th, 2010, 8:31pm CET by timothy

Tags: security

angry tapir writes "A widely deployed system intended to reduce on-line payment card fraud is fraught with security problems, according to University of Cambridge researchers. The system is called 3-D Secure (3DS) but is better known under the names Verified by Visa and MasterCard SecureCode. Steven J. Murdoch, a security researcher at the University of Cambridge, and security engineering professor Ross Anderson contend there are several flaws with 3DS. One of their main points is how 3DS is integrated into Web sites during a transaction — e-Commerce Web sites display 3DS in an iframe."
Read more of this story at Slashdot.
Interview With a Convicted 419 Scammer

Posted: January 28th, 2010, 6:23pm CET by CmdrTaco

Tags: security

An anonymous reader writes "Scam awareness website www.scam-detectives.co.uk has published a two part interview with convicted Nigerian 419 scammer, 'John.' 'John' talks about his experiences of scam victims, how he gains their trust and convinces them to part with their money, and how he would go back for another 'bite' after the original scam, posing as a law enforcement official who has apprehended the scammer and recovered the funds ... for a fee, of course."
Read more of this story at Slashdot.
Intego's "Year In Mac Security" Report

Posted: January 26th, 2010, 8:30am CET by kdawson

Tags: security

david.emery notes the release of Intego's "Year In Mac Security" report (PDF), adding: "Mac OS X and iPhones that haven't been jailbroken fare pretty well (although vulnerabilities exist, there's not been a lot of exploitation). Apple does come in for criticism for 'time to fix' known vulnerabilities. Jailbroken iPhones are a mess. The biggest risk to Macs are Trojan horses, often from pirated software."
Read more of this story at Slashdot.
Insecure Plugins Ding IE, Safari, Chrome, Opera

Posted: January 26th, 2010, 12:46am CET by kdawson

Tags: security

krebsonsecurity writes "The Web browser wars often focus on which browser is more secure, but the dirty secret is that insecure plugins are a serious threat to all browsers, from the perspectives of both stability and security. Krebsonsecurity.com features an informative look at the administration page for a popular browser exploit kit called Eleonora, which suggests that plugins like Adobe Reader and Java are leading to successful compromises for users surfing not just with Internet Explorer, but also with Google Chrome, Firefox, Safari, and Opera."
Read more of this story at Slashdot.
Data Breach Costs Top $200 Per Customer Record

Posted: January 25th, 2010, 7:30pm CET by CmdrTaco

Tags: security

alphadogg writes "The cost of a data breach increased last year to $204 per compromised customer record, according to the Ponemon Institute's annual study. The average total cost of a data breach rose from $6.65 million in 2008 to $6.75 million in 2009. The Ponemon Institute based its estimates on data from 45 companies that publicly acknowledged a breach of sensitive customer data last year and were willing to discuss it. In tallying the cost of a data breach, the Ponemon Institute looks at several factors, including: the cost of lost business because of an incident; legal fees; disclosure expenses related to customer contact and public response; consulting help; and remediation expenses such as technology and training."
Read more of this story at Slashdot.
Chinese Human Rights Orgs Hit By DDoS

Posted: January 25th, 2010, 6:05pm CET by CmdrTaco

Tags: security

Oxford_Comma_Lover writes "IDG News Service is reporting that several human rights organizations focusing on China have been hit by DDoS attacks this weekend, including Chinese Human Rights Defenders and Civil Rights and Livelihood Watch. The latter works on issues of mental persecution (dissidents being thrown into mental hospitals where they were forced onto medication or beaten with electric batons) and eminent-domain type problems (seizure of farmland or urban land without compensation when the government is working on a project)."
Read more of this story at Slashdot.
Australian ISPs To Disconnect Botnet "Zombies"

Posted: January 25th, 2010, 4:36pm CET by CmdrTaco

Tags: security

jibjibjib writes "Some of Australia's largest ISPs are preparing an industry code of conduct to identify and respond to users with botnet-infected computers. The Internet Industry Association, made up of over 200 ISPs and technology companies, is preparing the code in response to an ultimatum from the federal government. ISPs will try to contact the user, slow down their connection, and ultimately terminate the connection if the user refuses to fix the problem. It is hoped that this will reduce the growth of botnets in Australia, which had the world's third-highest rate of new 'zombies' (behind the US and China)."
Read more of this story at Slashdot.
Analysis of 32 Million Breached Passwords

Posted: January 21st, 2010, 2:42pm CET by CmdrTaco

Tags: security

An anonymous reader writes "Imperva released a study analyzing 32 million passwords exposed in the Rockyou.com breach. The data provides a unique glimpse into the way that users select passwords and an opportunity to evaluate the true strength of these as a security mechanism. In the past, password studies have focused mostly on surveys. Never before has there been such a high volume of real-world passwords to examine." Most interesting to me was that in the sample, less than 4% used any non alpha-numerics in their #$#%'ing passwords.
Read more of this story at Slashdot.
AT&T Glitch Connects Users To Wrong Accounts

Posted: January 16th, 2010, 4:01pm CET by Soulskill

Tags: security

CAE guy writes "The Boston Globe is carrying an AP report which begins: 'A Georgia mother and her two daughters logged onto Facebook from mobile phones last weekend and wound up in a startling place: strangers' accounts with full access to troves of private information. The glitch — the result of a routing problem at the family's wireless carrier, AT&T — revealed a little known security flaw with far reaching implications for everyone on the Internet, not just Facebook users.' Who needs to worry about man-in-the-middle attacks when your service provider will hijack your session for you?"
Read more of this story at Slashdot.
Code Used To Attack Google Now Public

Posted: January 16th, 2010, 4:46am CET by timothy

Tags: security

itwbennett writes "The IE attack code used in last month's attack on Google and 33 other companies was submitted for analysis Thursday on the Wepawet malware analysis Web site. One day after being made publicly available, it had been included in at least one hacking tool and could be seen in online attacks, according to Dave Marcus, director of security research and communications at McAfee. Marcus noted that the attack is very reliable on IE 6 running on Windows XP, and could possibly be modified to work on newer versions of IE."
Read more of this story at Slashdot.
US Preps Cyber Outfit To Protect Electric Grid

Posted: January 15th, 2010, 7:52pm CET by ScuttleMonkey

Tags: security

coondoggie writes to mention that the US Department of Energy is planning to set up a new "National Energy Sector Cyber Organization" in order to protect the national bulk power electric grid. For the low, low cost of $8.5 million they will help integrate smart grid technology with the electric grid, speed research, and establish new policy and protocols. "It is paramount that smart grid devices and interoperability standards include protections against cyber intrusions and have systems that are designed from the start (not patches added on) that prevent unauthorized persons from gaining entry through the millions of new access points created by the deployment of smart grid technologies, Hoffman stated."
Read more of this story at Slashdot.
Airport Access IDs Hacked In Germany

Posted: January 15th, 2010, 10:50am CET by timothy

Tags: security

teqo writes "Hackers belonging to the Chaos Computer Club have allegedly cloned digital security ID cards for some German airports successfully which then allowed them access to all airport areas. According to the Spiegel Online article (transgoogleation here), they used a 200 Euro RFID reader to scan a valid security ID card, and since the scanner was able to pretend to be that card, used it to forge that valid ID. Even the airport authorities say that the involved system from 1992 might be outdated, but I guess it might be deployed elsewhere anyway."
Read more of this story at Slashdot.
Gmail Moves To HTTPS By Default

Posted: January 13th, 2010, 11:34pm CET by timothy

Tags: security

clone53421 writes "Although Gmail has long supported HTTPS as an option, Gmail announced their decision yesterday to switch everyone to HTTPS by default: 'We initially left the choice of using it up to you because there's a downside: https can make your mail slower since encrypted data doesn't travel across the web as quickly as unencrypted data. Over the last few months, we've been researching the security/latency tradeoff and decided that turning https on for everyone was the right thing to do.' I wonder if this has anything to do with the reports of Chinese users having their accounts hacked? 'Only two Gmail accounts appear to have been accessed, and that activity was limited to account information (such as the date the account was created) and subject line, rather than the content of emails themselves,' said David Drummond in that blog update. That does sound like it perhaps could be a result of insecure HTTP traffic being intercepted in transit between the users and Gmail's servers."
Read more of this story at Slashdot.
Twitter Hackers Take Down Baidu

Posted: January 12th, 2010, 10:51pm CET by kdawson

Tags: security

snydeq writes "The group that took down Twitter last month has apparently claimed another victim: China's largest search engine Baidu.com. Offline late Monday, Baidu.com at one point displayed an image saying 'This site has been hacked by Iranian Cyber Army,' according to a report in the official newspaper of the Chinese Communist Party and other Web sites. The Iranian Cyber Army first gained notoriety with its Dec. 18 Twitter attack. Baidu's domain name records were the focus of the hack. On Monday, the company was using domain name servers belonging to HostGator, a Florida ISP, instead of the Baidu.com nameservers the company normally uses."
Read more of this story at Slashdot.
Firm To Drop Database, Web Server 0-Days

Posted: January 11th, 2010, 9:00pm CET by CmdrTaco

Tags: security

krebsonsecurity writes "January promises to be a busy month for Web server and database administrators alike: A security research firm in Russia says it plans to release information about a slew of previously undocumented vulnerabilities in several widely-used commercial software products, including Mysql, Tivoli, IBM DB2, Sun Directory, and a host of others, writes krebsonsecurity.com. From the blog: 'After working with the vendors long enough, we've come to conclusion that, to put it simply, it is a waste of time. Now, we do not contact with vendors and do not support so-called "responsible disclosure" policy,' Legerov said."
Read more of this story at Slashdot.
Firm To Release Database, Web Server 0-Days

Posted: January 11th, 2010, 9:00pm CET by CmdrTaco

Tags: security

krebsonsecurity writes "January promises to be a busy month for Web server and database administrators alike: A security research firm in Russia says it plans to release information about a slew of previously undocumented vulnerabilities in several widely-used commercial software products, including MySQL, Tivoli, IBM DB2, Sun Directory, and a host of others, writes krebsonsecurity.com. From the blog: 'After working with the vendors long enough, we've come to conclusion that, to put it simply, it is a waste of time. Now, we do not contact with vendors and do not support so-called "responsible disclosure" policy,' Legerov said."
Read more of this story at Slashdot.
Malware Threat Reports Are "Apples and Oranges"

Posted: January 11th, 2010, 7:31am CET by kdawson

Tags: security

Ant writes "The December malware threat reports are trickling in from vendors — and they all appear to be different. Fortinet, Sunbelt Software, and Kaspersky all published their lists of the most prevalent malware strains for the last month of 2009, but they didn't match up, leading to an admission that users will inevitably be confused by the results. Not only do the various security companies use different names for the threats they identify; they don't even identify the same threats."
Read more of this story at Slashdot.
Blizzard Authenticators May Become Mandatory

Posted: January 9th, 2010, 9:27am CET by Soulskill

Tags: security

An anonymous reader writes "WoW.com is reporting that a trusted source has informed them that Blizzard is giving serious consideration to making authenticators mandatory on all World of Warcraft accounts. The authenticators function the same as ones provided by most banks — in order to log in, you must generate a number on the external device. Blizzard already provides a free iPhone app that functions as an authenticator. The source stated, 'it is a virtually forgone conclusion that it will happen.' This comes after large spates of compromised accounts left Bizzard game masters severely backlogged by restoration requests."
Read more of this story at Slashdot.
FTC Worries About Consumers, Cloud Data, and Privacy

Posted: January 7th, 2010, 2:24am CET by samzenpus

Tags: security

pcause writes "Ars Techina has a nice article about the FTC's concern that consumers don't understand the implications of storing their data in the cloud. From the article: 'Data is now sitting on servers outside of your control, where it can be accessed far more easily by Google itself, hackers, and law enforcement than it ever could if kept within the device. Once data passes over the network, it gets much easier to access in realtime; once it is stored on a remote server, it gets much easier to access at any time. And those are just the phone settings. Google also has access to search history data, anything stored in Google Docs or Spreadsheets, complete schedules stored in Google Calendar, and recent Maps searches. Combine them all, and companies like Google become one-stop shops for authorities looking for personal information.' Do you think the average consumer even has a clue about this issue?"
Read more of this story at Slashdot.
Fake "Bill Gates" Message Dupes Top Tools

Posted: January 6th, 2010, 11:00pm CET by timothy

Tags: security

yahoi writes with this excerpt from Dark Reading that might raise sysadmins' eyebrows about email security, in particular given the big names involved: "A researcher who conducted a successful spear-phishing experiment with a phony LinkedIn invitation from 'Bill Gates' is about to reveal the email products and services that failed to filter the spoofed message — and that list includes Microsoft Outlook 2007, Microsoft Exchange, Outlook Express, and Cisco IronPort. ... The experiment was aimed at measuring the effectiveness of email security controls in several major products and services. And the simplicity and success of the test demonstrated just how powerful social engineering can be and what little technology can actually do about it, security experts say."
Read more of this story at Slashdot.
Enterprise Security For the Executive

Posted: January 6th, 2010, 7:56pm CET by samzenpus

Tags: security

brothke writes "If Shakespeare were to write an information security tragedy, it would not be titled Hamlet, rather Bayuk. The story of Jennifer Bayuk is tragic in that she spent a decade as CISO at Bear, Stearns, building up its security group to be one of the best in the business; only to find it vaporized when the firm collapsed and was acquired by J.P. Morgan Clearing Corp. After all that toil and sweat, Bayuk was out of a job. (Full disclosure: Bayuk and I have given a presentation together in the past, and I did get a copy of this book for free.)" Read below for Ben's review.
Read more of this story at Slashdot.
Alleged Ponzi Mastermind Hacked In Antigua

Posted: January 6th, 2010, 2:11pm CET by kdawson

Tags: security

krebsonsecurity writes "Criminal hackers apparently involved in break-ins at several US financial institutions also appear to have dug up dirt on Robert Allen Stanford, a man slated to go on trial this month for his alleged part in an $8 billion Ponzi scheme. Quoting: 'In early 2008, while federal investigators were busy investigating disgraced financier Robert Allen Stanford for his part in an alleged $8 billion fraudulent investment scheme, Eastern European hackers were quietly hoovering up tens of thousands customer financial records from the Bank of Antigua, an institution formerly owned by the Stanford Group.'"
Read more of this story at Slashdot.
Y2.01K

Posted: January 6th, 2010, 7:54am CET by kdawson

Tags: security

After our recent discussion of decimal/hexadecimal confusion at the turn of 2010, alphadogg writes in with a Network World survey of wider problems caused by the date change. "A decade after the Y2K crisis, date changes still pose technology problems, making some security software upgrades difficult and locking millions of bank ATM users out of their accounts. Chips used in bank cards to identify account numbers could not read the year 2010 properly, making it impossible for ATMs and point of sale machines in Germany to read debit cards of 30 million people since New Year's Day, according to published reports. The workaround is to reprogram the machines so the chips don't have to deal with the number. In Australia, point-of-sales machines skipped ahead to 2016 rather than 2010 at midnight Dec. 31, rendering them unusable by retailers, some of whom reported thousands of dollars in lost sales. Meanwhile Symantec's network-access control software that is supposed to check whether spam and virus definitions have been updated recently enough fails because of this 2010 problem."
Read more of this story at Slashdot.
Slovak Police Planted Explosives On Air Travelers

Posted: January 6th, 2010, 12:40am CET by kdawson

Tags: security

Entropy98 writes "Slovakian Police have planted explosives on 8 unsuspecting air travelers. Seven were stopped by airport security, including one man arrested and held upon arriving at a Dublin airport. Unbelievably, one innocent traveler made it home with 90 grams of explosives, and had his flat surrounded by the police and bomb squad."
Read more of this story at Slashdot.
Fixing Security Issue Isn't Always the Right Answer

Posted: January 5th, 2010, 8:30pm CET by kdawson

Tags: security

Trailrunner7 writes "In a column on Threatpost, Bruce Schneier writes that the recent security breach at Newark Airport shows that fixing a given security problem isn't always the right move. 'An unidentified man breached airport security at Newark Airport on Sunday, walking into the secured area through the exit, prompting an evacuation of a terminal and flight delays that continued into the next day. This problem isn't common, but it happens regularly. The result is always the same, and it's not obvious that fixing the problem is the right solution. American airports can do more to secure against this risk, but I'm reasonably sure it's not worth it. We could double the guards to reduce the risk of inattentiveness, and redesign the airports to make this kind of thing less likely, but that's an expensive solution to an already rare problem. As much as I don't like saying it, the smartest thing is probably to live with this occasional but major inconvenience.'"
Read more of this story at Slashdot.
Encryption Cracked On NIST-Certified Flash Drives

Posted: January 5th, 2010, 7:37pm CET by timothy

Tags: security

An anonymous reader writes "USB Flash drives with hardware based AES 256-bit encryption manufactured by Kingston, SanDisk and Verbatim have reportedly been cracked by security firm SySS. These drives are advertised to meet security standards suitable for use with sensitive US Government data (unclassified, of course) as emphasized by the FIPS 140-2 Level 2 certificate issued by the US National Institute of Standards and Technology (NIST). It looks likes the Windows-based password entry program always sends the same character string to the drive after performing various crypto operations."
Read more of this story at Slashdot.
Adobe Security Chief Defends JavaScript Support

Posted: January 5th, 2010, 6:00pm CET by timothy

Tags: security

Trailrunner7 writes "Despite the fact that the majority of [PDF-related] malware exploits use JavaScript to trigger an attack in Adobe's PDF Reader product, the company says it's impossible to completely remove JavaScript support without causing major compatibility problems. In a Q&A on Threatpost, Adobe security chief Brad Arkin says the removal of JavaScript support is a non-starter because it's an integral part of how users do form submissions. '"Anytime you're working with a PDF where you're entering information, JavaScript is used to do things like verify that the date you entered is the right format. If you're entering a phone number for a certain country it'll verify that you've got the right number of digits. When you click 'submit' on the form it'll go to the right place. All of this stuff has JavaScript behind the scenes making it work and it's difficult to remove without causing problems," Arkin explained.'"
Read more of this story at Slashdot.
Online Services Let Virus Writers Check Their Work

Posted: January 1st, 2010, 7:00pm CET by ScuttleMonkey

Tags: security

An anonymous reader writes "Former Washington Post Security Fix blogger Brian Krebs has launched a new blog at krebsonsecurity.com, and his first story highlights a pair of underground antivirus scanning services that cater to virus writers. Scanning services like virustotal.com scan submitted files against dozens of antivirus products, and share the results with each of the vendors so that all benefit from learning about threats they don't yet detect. But there are number of budding online services that allow customers to pay per scan, and promise that the results will never get reported back to the antivirus companies. One service even tests how well web site 'exploit packs' are detected, while others promise additional layers of protection. 'The service claims that it will soon be rolling out advanced features, such as testing malware against anti-spyware and firewall programs, as well as a test to see whether the malware functions in a virtual machine.'"
Read more of this story at Slashdot.
New Open Source Intrusion Detector Suricata Released

Posted: December 31st, 2009, 10:42pm CET by timothy

Tags: security

richrumble writes "The OISF has released the beta version of the Suricata IDS/IPS engine: The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-Threading, Automatic Protocol Detection (IP, TCP, UDP, ICMP, HTTP, TLS, FTP and SMB! ), Gzip Decompression, Fast IP Matching and coming soon hardware acceleration on CUDA and OpenCL GPU cards."
Read more of this story at Slashdot.

Slashdot: Linux

New Open Source Intrusion Detector Suricata Released

Posted: December 31st, 2009, 10:42pm CET by timothy

Tags: security

richrumble writes "The OISF has released the beta version of the Suricata IDS/IPS engine: The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-Threading, Automatic Protocol Detection (IP, TCP, UDP, ICMP, HTTP, TLS, FTP and SMB! ), Gzip Decompression, Fast IP Matching and coming soon hardware acceleration on CUDA and OpenCL GPU cards."
Read more of this story at Slashdot.

Slashdot: IT

TSA Subpoenas Bloggers Over New Security Directive

Posted: December 31st, 2009, 6:36pm CET by CmdrTaco

Tags: security

Hugh Pickens writes "The NY Times reports that TSA special agents have served subpoenas to travel bloggers Steve Frischling and Chris Elliott demanding that they reveal who leaked a TSA directive outlining new screening measures that went into effect the same day as the Detroit airliner incident. Frischling said he met with two TSA special agents for about three hours and was forced to hand over his laptop computer after the agents threatened to interfere with his contract to write a blog for KLM Royal Dutch Airlines if he didn't cooperate and provide the name of the person who leaked the memo outlining new security measures that would be apparent to the traveling public. 'It literally showed up in my box,' Frischling told The Associated Press. 'I do not know who it came from.' Frischling says he provided the agents a signed statement to that effect. The leaked directive included measures such as screening at boarding gates, patting down the upper legs and torso, physically inspecting all travelers' belongings, looking carefully at syringes with powders and liquids, requiring that passengers remain in their seats one hour before landing, and disabling all onboard communications systems, including what is provided by the airline. In a December 29 posting on his blog, Elliott said he had told the TSA agents at his house that he would call his lawyer and get back to them."
Read more of this story at Slashdot.
Adobe Flash To Be Top Hacker Target In 2010

Posted: December 29th, 2009, 6:20pm CET by CmdrTaco

Tags: security

An anonymous reader writes "Adobe Systems' Flash and Acrobat Reader products will become the preferred targets for criminal hackers (PDF) in 2010, surpassing Microsoft Office applications, a security vendor predicted this week. 'Cybercriminals have long picked on Microsoft products due to their popularity. In 2010, we anticipate Adobe software, especially Acrobat Reader and Flash, will take the top spot,' security vendor McAfee said in its '2010 Threat Predictions' report. 'We have absolutely seen an increase in the number of attacks, around Reader in particular and also Flash Player to some extent,' CTO Kevin Lynch told reporters at the Adobe Max conference in October. 'We're working to decrease the amount of time between when we know about a problem and when we release a fix. That used to be a couple of months; now it's within two weeks for critical issues.'"
Read more of this story at Slashdot.
GSM Decryption Published

Posted: December 29th, 2009, 2:55am CET by ScuttleMonkey

Tags: security

Hugh Pickens writes "The NY Times reports that German encryption expert Karsten Nohl says that he has deciphered and published the 21-year-old GSM algorithm, the secret code used to encrypt most of the world's digital mobile phone calls, in what he called an attempt to expose weaknesses in the security system used by about 3.5 billion of the 4.3 billion wireless connections across the globe. Others have cracked the A5/1 encryption technology used in GSM before, but their results have remained secret. 'This shows that existing GSM security is inadequate,' Nohl told about 600 people attending the Chaos Communication Congress. 'We are trying to push operators to adopt better security measures for mobile phone calls.' The GSM Association, the industry group based in London that devised the algorithm and represents wireless operators, called Mr. Nohl's efforts illegal and said they overstated the security threat to wireless calls. 'This is theoretically possible but practically unlikely,' says Claire Cranton, a GSM spokeswoman, noting that no one else had broken the code since its adoption. 'What he is doing would be illegal in Britain and the United States. To do this while supposedly being concerned about privacy is beyond me.' Simon Bransfield-Garth, the chief executive of Cellcrypt, says Nohl's efforts could put sophisticated mobile interception technology — limited to governments and intelligence agencies — within the reach of any reasonable well-funded criminal organization. 'This will reduce the time to break a GSM call from weeks to hours,' Bransfield-Garth says. 'We expect as this further develops it will be reduced to minutes.'"
Read more of this story at Slashdot.
Man Challenges 250,000 Strong Botnet and Succeeds

Posted: December 28th, 2009, 11:16pm CET by CmdrTaco

Tags: security

nandemoari writes "When security officials decide to 'go after' computer malware, most conduct their actions from a defensive standpoint. For most of us, finding a way to rid a computer of the malware suffices — but for one computer researcher, however, the change from a defensive to an offensive mentality is what ended the two year chase of a sinister botnet once and for all. For two years, Atif Mushtaq had been keeping the notorious Mega-D bot malware from infecting computer networks. As of this past November, he suddenly switched from defense to offense. Mega-D had forced more than 250,000 PCs to do its bidding via botnet control."
Read more of this story at Slashdot.
Security In the Ether

Posted: December 27th, 2009, 6:15pm CET by Soulskill

Tags: security

theodp writes "Technology Review's David Talbot says IT's next grand challenge will be to secure the cloud — and prove we can trust it. 'The focus of IT innovation has shifted from hardware to software applications,' says Harvard economist Dale Jorgenson. 'Many of these applications are going on at a blistering pace, and cloud computing is going to be a great facilitative technology for a lot of these people.' But there's one little catch. 'None of this can happen unless cloud services are kept secure,' notes Talbot. 'And they are not.' Fully ensuring the security of cloud computing, says Talbot, will inevitably fall to emerging encryption technologies."
Read more of this story at Slashdot.
Preventing My Hosting Provider From Rooting My Server?

Posted: December 26th, 2009, 6:25pm CET by Soulskill

Tags: security

hacker writes "I have a heavily-hit public server (web, mail, cvs/svn/git, dns, etc.) that runs a few dozen OSS project websites, as well as my own personal sites (gallery, blog, etc.). From time to time, the server has 'unexpected' outages, which I've determined to be the result of hardware, network and other issues on behalf of the provider. I run a lot of monitoring and logging on the server-side, so I see and graph every single bit and byte in and out of the server and applications, so I know it's not the OS itself. When I file 'WTF?'-style support tickets to the provider through their web-based ticketing system, I often get the response of: 'Please provide us with the root password to your server so we can analyze your logs for the cause of the outage.' Moments ago, there were three simultaneous outages while I was logged into the server working on some projects. Server-side, everything was fine. They asked me for the root password, which I flatly denied (as I always do), and then they rooted the server anyway, bringing it down and poking around through my logs. This is at least the third time they've done this without my approval or consent. Is it possible to create a minimal Linux boot that will allow me to reboot the server remotely, come back up with basic networking and ssh, and then from there, allow me to log in and mount the other application and data partitions under dm-crypt/loop-aes and friends?" Read on for a few more details of hacker's situation.
Read more of this story at Slashdot.
Is Code Auditing of Open Source Apps Necessary?

Posted: December 23rd, 2009, 5:45pm CET by CmdrTaco

Tags: security

An anonymous reader writes "Following Sun Microsystems' decision to release a raft of open source applications to support its secure cloud computing strategy, companies may be wondering if they should conduct security tests of their customized open source software before deployment. While the use of encryption and VPNs to extend a secure bridge between a company IT resource and a private cloud facility is very positive — especially now that Amazon is beta testing its pay-as-you-go private cloud facility — it's important that the underlying application code is also secure. What do you think?"
Read more of this story at Slashdot.
Citibank Denies Reported Breach Linked To Russian Gang

Posted: December 23rd, 2009, 12:01am CET by kdawson

Tags: security

alphadogg writes "US authorities are investigating the theft of an estimated tens of millions of dollars from Citibank by criminals using Russian software tailored for the attack, according to the Wall Street Journal (subscription required to access that link — CNET's coverage here). The security breach at the major US bank was detected mid-year based on traffic from Internet addresses formerly used by the Russian Business Network gang, the WSJ reported today, citing unnamed government sources. The Russian Business Network is a well-known group linked to malicious software, hacking, child pornography, and spam. The FBI is probing the case, the report said. It was not known whether the money had been recovered and a Citibank representative said the company denied any system breach or losses, according to the report."
Read more of this story at Slashdot.
Malware and Botnet Operators Going ISP

Posted: December 21st, 2009, 10:53pm CET by ScuttleMonkey

Tags: security

Trailrunner7 writes to mention that malware and botnet operators appear to be escalating to the next level by setting up their own virtual data centers. This elevates the criminals to the ISP level, making it much harder to stop them. "The criminals will buy servers and place them in a large data center and then submit an application for a large block of IP space. In some cases, the applicants are asked for nothing more than a letter explaining why they need the IP space, security researchers say. No further investigation is done, and once the criminals have the IP space, they've taken a layer of potential problems out of the equation. 'It's gotten completely out of hand. The bad guys are going to some local registries in Europe and getting massive amounts of IP space and then they just go to a hosting provider and set up their own data centers,' said Alex Lanstein, senior security researcher at FireEye, an anti-malware and anti-botnet vendor. 'It takes one more level out of it: You own your own IP space and you're your own ISP at that point.'"
Read more of this story at Slashdot.
Autonomous Intelligent Botnets Bouncing Back

Posted: December 17th, 2009, 3:21pm CET by CmdrTaco

Tags: security

coomaria writes "Thought that 2009 was the year botnets died? Well, think again: compromised computers were responsible for distributing 83.4% of the 107 billion spam messages sent around the world every single day this year, and it's going to get worse if intelligent and autonomous botnets arrive in 2010 as predicted."
Read more of this story at Slashdot.
Doom-Like Video Surveillance For Ports In Development

Posted: December 17th, 2009, 11:48am CET by Soulskill

Tags: security

oranghutan writes "A research and development group down under is working to develop an advanced video surveillance system for ports around the world that uses video superimposed onto a 3D map. With 16-megapixel high-definition cameras on a distributed (cabled) network and a proprietary system written in a variety of languages (C++, Python, SQL, etc.), the group from NICTA is aiming to allow security teams at the Port of Brisbane — which is 110km long — to monitor shipping movements, cargo and people. By scrolling along a 3D map, the security teams can click on a location and then get a real-time video feed superimposed onto the map. Authorities from around the world with the right permissions can then access the same system. The main difference from regular surveillance systems is the ability to switch views without having to know camera numbers/locations and the one screen view."
Read more of this story at Slashdot.
Israeli Border Police Shoot US Student's Laptop

Posted: December 16th, 2009, 11:37am CET by kdawson

Tags: security

zerothink writes "American student Lily Sussman, 21, upon entry into Israel from Taba (Egypt, Sinai) caught Israeli border police in grumpy mood — after two hours of questions and searching through her belongings they decided to put three bullets through her laptop. Explanation? 'I'm sorry but we had to blow up your laptop.' Haaretz also covered the story." All three bullets missed the hard disk.
Read more of this story at Slashdot.
Gravatars Can Leak Users' Email Addresses

Posted: December 16th, 2009, 6:20am CET by kdawson

Tags: security

abell writes "Gravatar offers a global avatar service, using an MD5 hash of the user's email as avatar ID. This piece of information in some cases is enough to retrieve the original email address. Testing a simple attack on stackoverflow.com, I was able to determine the email addresses of more than 10% of the site's users."
Read more of this story at Slashdot.
What Is the State of Linux Security DVR Software?

Posted: December 15th, 2009, 5:51pm CET by timothy

Tags: security

StonyCreekBare writes "I am wondering what slashdotters have to offer on the idea of Linux based security systems, especially DVR software. I am aware of Zoneminder, but wonder what else is out there? Are there applications that will not only monitor video cameras, but motion sensors and contact closure alarms? What is state of the art in this area, and how do the various Linux platforms stack up in comparison to dedicated embedded solutions? Will these 'play nice' with other software, such as Asterisk, and Misterhouse? Can one server host three or four services applications of this nature, assuming CPU/memory/disk resources are sufficient?"
Read more of this story at Slashdot.

Slashdot: Linux

What Is the State of Linux Security DVR Software?

Posted: December 15th, 2009, 5:51pm CET by timothy

Tags: security

StonyCreekBare writes "I am wondering what slashdotters have to offer on the idea of Linux based security systems, especially DVR software. I am aware of Zoneminder, but wonder what else is out there? Are there applications that will not only monitor video cameras, but motion sensors and contact closure alarms? What is state of the art in this area, and how do the various Linux platforms stack up in comparison to dedicated embedded solutions? Will these 'play nice' with other software, such as Asterisk, and Misterhouse? Can one server host three or four services applications of this nature, assuming CPU/memory/disk resources are sufficient?"
Read more of this story at Slashdot.

Slashdot: IT

Adobe Warns of Reader, Acrobat Attack

Posted: December 15th, 2009, 5:03pm CET by timothy

Tags: security

itwbennett writes "Monday afternoon, Adobe 'received reports of a vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions being exploited in the wild,' the company said in a post to the company's Product Security Incident Response Team blog. According to malware tracking group Shadowserver, the vulnerability is due to a bug in the way Reader processes JavaScript code. Several 'tests have confirmed this is a 0-day vulnerability affecting several versions of Adobe Acrobat [Reader] to include the most recent versions of 8.x and 9.x. We have not tested on 7.x, but it may also be vulnerable,' Shadowserver said in a post on its Web site. The group recommends that concerned users disable JavaScript within Adobe's software as a work-around for this problem. (This can be done by un-checking the 'Enable Acrobat JavaScript' in the Edit -> Preferences -> JavaScript window). 'This is legit and is very bad,' Shadowserver added."
Read more of this story at Slashdot.
Cybersecurity Czar Job Is Useless, Says Spafford

Posted: December 14th, 2009, 9:46pm CET by Soulskill

Tags: security

Trailrunner7 writes "It's been about seven months since Obama announced his plan to hire a cybersecurity coordinator, and the job is still vacant. Several prominent security experts have turned the position down, and in an interview on Threatpost, Purdue professor Gene Spafford says that the position is pointless. 'It won't have any statutory authority. It won't have any budgetary authority. That does not give it much authority of any kind. So when I hear that there are supposedly people who have been interviewed for this cyber coordinator job and didn't take it, I'm not surprised. It's not a winning position. I'm not at all surprised by the fact that it's empty. That position is a blame-taking position,' Spafford said."
Read more of this story at Slashdot.
Building a Global Cyber Police Force

Posted: December 14th, 2009, 4:20pm CET by CmdrTaco

Tags: security

dasButcher writes "One of the biggest obstacles to fighting hackers and cyber-criminals is that many operate in the safe harbors of their home countries, insulated from prosecution by authorities in foreign countries where their targets reside. As Larry Walsh writes in his blog, several security vendors and a growing number of countries are now beginning to consider the creation of a global police force that would have trans-border jurisdiction to investigate and arrest suspected hackers."
Read more of this story at Slashdot.
ID Thief Tries To Get Witnesses Whacked

Posted: December 14th, 2009, 11:13am CET by kdawson

Tags: security

adeelarshad82 writes "Pavel Valkovich of Sherman Oaks, CA has pleaded guilty to solicitation of murder, admitting that he attempted to hire hit-men to kill witnesses working with Federal authorities in their investigation of Valkovich's ID theft activities and subsequent crimes. According to the Justice Department: '...Valkovich and others had stolen personal identifying information and used that information to transfer funds from victims' bank accounts to PayPal accounts.'"
Read more of this story at Slashdot.
Hackers Find Home In Amazon EC2 Cloud

Posted: December 10th, 2009, 6:27pm CET by CmdrTaco

Tags: security

snydeq writes "Security researchers have spotted the Zeus botnet running an unauthorized command and control center on Amazon's EC2 cloud computing infrastructure. This marks the first time Amazon Web Services' cloud infrastructure has been used for this type of illegal activity, according to threat researcher Don DeBolt. The hackers got onto Amazon's infrastructure by hacking into a Web site hosted on Amazon's servers and then secretly installing their command and control infrastructure."
Read more of this story at Slashdot.
SQL Injection Attack Claims 132,000+

Posted: December 10th, 2009, 3:23pm CET by CmdrTaco

Tags: security

An anonymous reader writes "A large scale SQL injection attack has injected a malicious iframe on tens of thousands of susceptible websites. ScanSafe reports that the injected iframe loads malicious content from 318x.com, which eventually leads to the installation of a rootkit-enabled variant of the Buzus backdoor trojan. A Google search on the iframe resulted in over 132,000 hits as of December 10, 2009."
Read more of this story at Slashdot.
Malware Found Hidden In Screensaver On Gnome-Look

Posted: December 9th, 2009, 11:39pm CET by timothy

Tags: security

AndGodSed writes "OMG! UBUNTU! Reports the following: 'Malware has been found hidden inside an innocuous 'waterfall' screensaver .deb file made available on popular artwork sharing site Gnome-Look.org. The .deb file installs a script with elevated privileges designed to perform a DDoS attack as well as keep itself updated via downloads. The dodgy screensaver in question has since been removed from gnome-look, and this incident was a very basic, if potentially successful, attempt.'" A similar report at Digitizor.com says that similar malware was also found in a theme called Ninja Black. For those affected, both sites also provide instruction on cleansing your system.
Read more of this story at Slashdot.

Slashdot: Linux

Malware Found Hidden In Screensaver On Gnome-Look

Posted: December 9th, 2009, 11:39pm CET by timothy

Tags: security

AndGodSed writes "OMG! UBUNTU! Reports the following: 'Malware has been found hidden inside an innocuous 'waterfall' screensaver .deb file made available on popular artwork sharing site Gnome-Look.org. The .deb file installs a script with elevated privileges designed to perform a DDoS attack as well as keep itself updated via downloads. The dodgy screensaver in question has since been removed from gnome-look, and this incident was a very basic, if potentially successful, attempt.'" A similar report at Digitizor.com says that similar malware was also found in a theme called Ninja Black. For those affected, both sites also provide instruction on cleansing your system.
Read more of this story at Slashdot.

Slashdot: IT

TSA's Sloppy Redacting Reveals All

Posted: December 8th, 2009, 6:03am CET by kdawson

Tags: security

A travel blog breaks the story of a poor job of redacting by the TSA: they posted a PDF of airport screening policies, with certain sections blacked out — not realizing that simply laying a black rectangle over the text is hardly sufficient. Cryptome has posted a copy with the redaction removed (ZIP).
Read more of this story at Slashdot.
Facebook ID Probe Shows Things Getting Worse

Posted: December 7th, 2009, 3:44pm CET by CmdrTaco

Tags: security

An anonymous reader writes "According to Sophos, Facebook users are getting sloppier with their personal info, not better. Revisiting a 2007 survey in which a plastic frog got 87 hits out of 200 friend requests, this time a rubber duck and a cat got 87 out of 200 friend requests, plus a bonus 8 friends who decided to trust them anyway. The research also suggests that older Facebook users are sloppier than the young, being keener to build their list of friends. (The older users had more than 4x the friends each, on average, than the young.)"
Read more of this story at Slashdot.
Hackers vs. Phishers

Posted: December 7th, 2009, 2:57pm CET by CmdrTaco

Tags: security

An anonymous reader writes "Some hackers out there don't like to do all the hard work of running a successful phishing campaign. Instead, they developed a simple online service to 'steal' account details from the hard-working phishers. Named AutoWhaler, the service allows anyone to scan a phishing server for log files that contain juicy information such as usernames and passwords."
Read more of this story at Slashdot.
A Look At the Safety of Google Public DNS

Posted: December 4th, 2009, 5:35pm CET by kdawson

Tags: security

darthcamaro writes "Yesterday we discussed Google's launch of its new Public DNS service. Now Metasploit founder and CSO at Rapid7, H D Moore, investigates how well-protected Google's service is against the Kaminsky DNS flaw. Moore has put together a mapping of Google's source port distribution on the Public DNS service. In his view, it looks like the source ports are sufficiently random, even though they are limited to a small range of ports. The InternetNews report on Moore's research concludes: 'What Moore's preliminary research clearly demonstrates to me is that Google really does need to live up to its promise here. Unlike a regular ISP, Google will be subject to more scrutiny (and research) than other DNS providers.'"
Read more of this story at Slashdot.
Malware Could Grab Data From Stock iPhones

Posted: December 4th, 2009, 7:20am CET by timothy

Tags: security

Ardisson writes "Swiss iPhone developer Nicolas Seriot presented last night a talk on iPhone Privacy in Geneva. He showed how a malicious application could harvest personal data on a non-jailbroken iPhone (PDF) and without using private APIs. It turns out that the email accounts, the keyboard cache content and the WiFi connection logs are fully accessible. The talk puts up several recommendations. There is also a demo project on github."
Read more of this story at Slashdot.
Cameroon the New Hotbed of Malware

Posted: December 3rd, 2009, 5:18am CET by samzenpus

Tags: security

garg0yle writes "According to McAfee, more than a third of Cameroon domains (TLD of .cm) are infested with viruses or other not-so-fun party treats. Given that it's very easy to mis-type .com as .cm, this puts the computers of a lot of fat-fingered typists in peril. Second place on the most-infested domains list goes to China (.cn), while Hong Kong (last year's 'winner') is now comfortably middle-of-the-pack."
Read more of this story at Slashdot.
Somali Pirates Open Up a "Stock Exchange"

Posted: December 2nd, 2009, 5:29am CET by kdawson

Tags: security

reginaldo writes to clue us that pirates in Somalia have opened up a cooperative in Haradheere, where investors can pay money or guns to help their favorite pirate crew for a share of the piracy profits. "'Four months ago, during the monsoon rains, we decided to set up this stock exchange. We started with 15 "maritime companies" and now we are hosting 72. Ten of them have so far been successful at hijacking,' Mohammed [a wealthy former pirate who took a Reuters reporter to the facility] said. ... Piracy investor Sahra Ibrahim, a 22-year-old divorcee, was lined up with others waiting for her cut of a ransom pay-out after one of the gangs freed a Spanish tuna fishing vessel. 'I am waiting for my share after I contributed a rocket-propelled grenade for the operation,' she said, adding that she got the weapon from her ex-husband in alimony. 'I am really happy and lucky. I have made $75,000 in only 38 days since I joined the "company."'"
Read more of this story at Slashdot.
SarBox Lawsuit Could Rewrite IT Compliance Rules

Posted: December 1st, 2009, 9:45pm CET by kdawson

Tags: security

dasButcher notes that the Supreme Court will hear arguments next week brought by a Nevada accounting firm that asserts the oversight board for the Sarbanes-Oxley Act is unconstitutional. If the plaintiffs are successful, it could force Congress to rewrite or abandon the law used by many companies to validate tech investments for security and compliance. "Many auditing firms have used [Sarbanes-Oxley Section] 404 as a lever for imposing stringent security technology requirements on publicly traded companies regulated by SOX and their business partners. SOX security compliance has proven effective for vendors and solution providers, as it forces regulated enterprises to spend billions of dollars on technology that, many times, doesn’t prevent security incidents but does make them compliant with the law."
Read more of this story at Slashdot.
Serious Remote FreeBSD Exploit Posted, Patched

Posted: December 1st, 2009, 3:23pm CET by timothy

Tags: security

Trailrunner7 writes "A researcher has published an explanation of a new flaw in FreeBSD that allows a remote attacker to take control of a vulnerable machine. The vulnerability could give an attacker root access to the FreeBSD machine, and the FreeBSD developers have published a patch for the flaw early Tuesday. The vulnerability lies in run-time link-editor and, if exploited, gives an attacker the ability to run arbitrary code. The researcher, Kingcope, has posted an explanation of the flaw on the Full Disclosure mailing list. In a message to FreeBSD users, Colin Percival, the project's security officer, said that because of the severity of the flaw and the fact that exploit code already is available, he felt it was necessary to post the patch as soon as possible, without even publishing a security advisory."
Read more of this story at Slashdot.
Ethics of Releasing Non-Malicious Linux Malware?

Posted: December 1st, 2009, 3:39am CET by kdawson

Tags: security

buchner.johannes writes "I was fed up with the general consensus that Linux is oh-so-secure and has no malware. After a week of work, I finished a package of malware for Unix/Linux. Its whole purpose is to help white-hat hackers point out that a Linux system can be turned into a botnet client by simply downloading BOINC and attaching it to a user account to help scientific projects. The malware does not exploit any security holes, only loose security configurations and mindless execution of unverified downloads. I tested it to be injected by a PHP script (even circumventing safe mode), so that the Web server runs it; I even got a proxy server that injects it into shell scripts and makefiles in tarballs on the fly, and adds onto Windows executables for execution in Wine. If executed by the user, the malware can persist itself in cron, bashrc and other files. The aim of the exercise was to provide a payload so security people can 'pwn' systems to show security holes, without doing harm (such as deleting files or disrupting normal operation). But now I am unsure of whether it is ethically OK to release this toolkit, which, by ripping out the BOINC payload and putting in something really evil, could be turned into proper Linux malware. On the one hand, the way it persists itself in autostart is really nasty, and that is not really a security hole that can be fixed. On the other hand, such a script can be written by anyone else too, and it would be useful to show people why you need SELinux on a server, and why verifying the source of downloads (checksums through trusted channels) is necessary. Technically, it is a nice piece, but should I release it? I don't want to turn the Linux desktop into Windows, hence I'm slightly leaning towards not releasing it. What does your ethics say about releasing such grayware?"
Read more of this story at Slashdot.

Slashdot: Linux

Ethics of Releasing Non-Malicious Linux Malware?

Posted: December 1st, 2009, 3:39am CET by kdawson

Tags: security

buchner.johannes writes "I was fed up with the general consensus that Linux is oh-so-secure and has no malware. After a week of work, I finished a package of malware for Unix/Linux. Its whole purpose is to help white-hat hackers point out that a Linux system can be turned into a botnet client by simply downloading BOINC and attaching it to a user account to help scientific projects. The malware does not exploit any security holes, only loose security configurations and mindless execution of unverified downloads. I tested it to be injected by a PHP script (even circumventing safe mode), so that the Web server runs it; I even got a proxy server that injects it into shell scripts and makefiles in tarballs on the fly, and adds onto Windows executables for execution in Wine. If executed by the user, the malware can persist itself in cron, bashrc and other files. The aim of the exercise was to provide a payload so security people can 'pwn' systems to show security holes, without doing harm (such as deleting files or disrupting normal operation). But now I am unsure of whether it is ethically OK to release this toolkit, which, by ripping out the BOINC payload and putting in something really evil, could be turned into proper Linux malware. On the one hand, the way it persists itself in autostart is really nasty, and that is not really a security hole that can be fixed. On the other hand, such a script can be written by anyone else too, and it would be useful to show people why you need SELinux on a server, and why verifying the source of downloads (checksums through trusted channels) is necessary. Technically, it is a nice piece, but should I release it? I don't want to turn the Linux desktop into Windows, hence I'm slightly leaning towards not releasing it. What does your ethics say about releasing such grayware?"
Read more of this story at Slashdot.

Slashdot: IT

Man Arrested For RuneScape MMORPG Online Robbery

Posted: November 30th, 2009, 2:41pm CET by CmdrTaco

Tags: security

Unexpof writes "A man has been arrested by the British Police Central e-Crime Unit (PCeU) accused of stealing the usernames and passwords from players of the RuneScape MMORPG. Security experts report that this is one of the first occasions when a Brit has been apprehended for "virtual robbery", although incidents have happened in the past. For instance, the CEO of the sci-fi trading game Eve Online stole 200 billion "kredits", which he then used as a deposit on a real-world house, and in October last year a Japanese woman was arrested by police after allegedly hacking her virtual husband "to death".
Read more of this story at Slashdot.
Man Arrested For RuneScape MMORPG Online Robbery

Posted: November 30th, 2009, 2:41pm CET by CmdrTaco

Tags: security

Unexpof writes "A man has been arrested by the British Police Central e-Crime Unit (PCeU), accused of stealing the usernames and passwords from players of the RuneScape MMORPG. Security experts report that this is one of the first occasions when a Brit has been apprehended for 'virtual robbery,' although incidents have happened in the past. For instance, the CEO of the sci-fi trading game EVE Online stole 200 billion 'kredits,' which he then used as a deposit on a real-world house, and in October last year a Japanese woman was arrested by police after allegedly hacking her virtual husband 'to death.'"
Read more of this story at Slashdot.
Network Security While Traveling?

Posted: November 29th, 2009, 10:08pm CET by kdawson

Tags: security

truesaer writes "I'll be spending all of next year backpacking through South America. In the past I've used Internet cafes while away, but this time I plan to bring a netbook and rely primarily on Wi-Fi hotspots. I'll be facing the same issues and risks that business travelers in hotels and airports face, as well as those encountered by millions of other backpackers, gap-year travelers, and students. Since my trip is so long I'll have no choice but to access my banking, credit card, and investment accounts on public networks. I will not have a system at home to connect through. Other than an effective firewall, a patched system, and the use of SSL, what else should I do to protect my information? Keep in mind that many places have very poor bandwidth and latency."
Read more of this story at Slashdot.
Massive Badware Campaign Targets Google's "Long Tail"

Posted: November 27th, 2009, 4:50pm CET by kdawson

Tags: security

A post by Cyberveillance a couple of weeks back revealed a complex black-hat operation involving Google searches leading to hundreds of thousands of bogus blogs, exploiting the "long tail" of search results and isolated from Google's auto-detection of malware sites by a shifting network of redirectors. The fake blog posts are innocuous when visited directly, but make aggressive attempts to install a fake Windows anti-virus tool (which is actually a Trojan horse) if clicked through from Google. Other search engines do not index the bogus sites. The Unmask Parasites site has a detailed two-part analysis of the badware operation, which puts some numbers on its scope: almost 688,000 bogus scareware blogs can be located in Google; some of them have upwards of 1000 posts. This analysis also reveals that a large majority of the sites hacked to host fake blogs are on the network of Servage.net. From the second Unmask Parasites link: "What we have here is millions of rogue web pages targeting the long tail of web search (millions of keywords) where each page tries to install fake (and malicious) "anti-virus" software on visitors' computers. While this black-hat campaign is active for at least 6 months, webmasters of the compromised sites and their hosting providers don't simply notice this illicit activity. The good news is Google seems to have noticed this problem. Probably thanks to the Cyveillance blog post. During the week after that post I see a steady decrease in search results returned by the queries that you can find in this post."
Read more of this story at Slashdot.
English Shell Code Could Make Security Harder

Posted: November 24th, 2009, 2:33am CET by ScuttleMonkey

Tags: security

An anonymous reader writes to tell us that finding malicious code might have just become a little harder. Last week at the ACM Conference on Computer and Communications Security, security researchers Joshua Mason, Sam Small, Fabian Monrose, and Greg MacManus presented a method they developed to generate English shell code [PDF]. Using content from Wikipedia and other public works to train their engine, they convert arbitrary x86 shell code into sentences that read like spam, but are natively executable. "In this paper we revisit the assumption that shell code need be fundamentally different in structure than non-executable data. Specifically, we elucidate how one can use natural language generation techniques to produce shell code that is superficially similar to English prose. We argue that this new development poses significant challenges for in-line payload-based inspection (and emulation) as a defensive measure, and also highlights the need for designing more efficient techniques for preventing shell code injection attacks altogether."
Read more of this story at Slashdot.
Program To Detect Smuggled Nuclear Bombs Stalls

Posted: November 24th, 2009, 12:11am CET by ScuttleMonkey

Tags: security

Pickens writes "The NY Times reports that a program to detect plutonium or uranium in shipping containers has stalled because the United States has run out of helium 3, a crucial raw material needed to build the 1,300 to 1,400 machines to be deployed in ports around the world to thwart terrorists who might try to deliver a nuclear bomb to a big city by stashing it in one of the millions of containers that enter the United States every year. Helium 3 is an unusual form of the element that is formed when tritium, an ingredient of hydrogen bombs, decays — but the government mostly stopped making tritium in 1989 after accumulating a substantial stockpile of Helium 3 as a byproduct of maintaining nuclear weapons. 'I have not heard any explanation of why this was not entirely foreseeable,' says Representative Brad Miller, chairman of a House subcommittee that is investigating the problem. Helium 3 is not hazardous or even chemically reactive, and it is not the only material that can be used for neutron detection. The Homeland Security Department has older equipment that can look for radioactivity, but it does not differentiate well between bomb fuel and innocuous materials that naturally emit radiation like cat litter, ceramic tiles and bananas — and sounds false alarms more often. In a letter to President Obama, Miller called the shortage 'a national crisis' and said the price had jumped to $2,000 a liter from $100 in the last few years. With continuing concern that Al Qaida or other terrorists will try to smuggle a nuclear weapon into the United States, Congress has mandated that, by 2012, all containers bound for the US be inspected overseas."
Read more of this story at Slashdot.
Recession Pushes More Workers To Steal Data

Posted: November 23rd, 2009, 11:26pm CET by ScuttleMonkey

Tags: security

An anonymous reader writes to share the findings of a recent transatlantic survey which suggests that the recession is pushing workers to be a little bit more accommodating when it comes to sharing, viewing, or stealing sensitive information from the company they work(ed) for. "Pilfering data has become endemic in our culture as 85% of people admit they know it's illegal to download corporate information from their employer but almost half couldn't stop themselves taking it with them with the majority admitting it could be useful in the future! [...] The survey entitled 'the global recession and its effect on work ethics,' carried out for a second year by Cyber-Ark – found that almost half of the respondents 48% admit that if they were fired tomorrow they would take company information with them and 39% of people would download company/competitive information if they got wind that their job was at risk. Additionally a quarter of workers said that the recession has meant that they feel less loyal towards their employer."
Read more of this story at Slashdot.
Hacked Climate Emails Stoke Debate

Posted: November 23rd, 2009, 7:48pm CET by ScuttleMonkey

Tags: security

The Wall Street Journal is reporting that a series of hacked emails and documents that were recently posted on Wikileaks are causing quite a stir in the scientific community. All told, more than 1,000 emails and 2,000 documents were stolen from the Climate Research Unit in East Anglia University in the U.K. "The emails include discussions of apparent efforts to make sure that reports from the Intergovernmental Panel on Climate Change, a United Nations group that monitors climate science, include their own views and exclude others. In addition, emails show that climate scientists declined to make their data available to scientists whose views they disagreed with. [] Phil Jones, the director of the East Anglia climate center, suggested to climate scientist Michael Mann of Penn State University that skeptics' research was unwelcome: We 'will keep them out somehow -- even if we have to redefine what the peer-review literature is!' Neither man could be reached for comment Sunday."
Read more of this story at Slashdot.
First Malicious iPhone Worm In the Wild

Posted: November 21st, 2009, 9:37pm CET by timothy

Tags: security

An anonymous reader writes "After the ikee worm that displayed a picture of Rick Astley on jailbroken iPhones, the first malicious iPhone worm (Google translation; original, in Dutch) has now been discovered in the wild. Internet provider XS4ALL in the Netherlands encountered several of such devices (link in Dutch) on the wireless networks of their customers and put out a warning. After obtaining a copy of the malware it was discovered that the jailbroken phones, which are exploited through openSSH with a default password, scan IP ranges of mobile internet providers for other vulnerable iPhones, phone home to a C&C botnet server, are able to update themselves with additional malware and have the ability to dump the SMS database as well. Owners of a jailbroken iPhone with a default root password are advised to flash to the latest Apple firmware in order to ensure no malware is present."
Read more of this story at Slashdot.
Cyber Attacks On US Military Jump Sharply In 2009

Posted: November 21st, 2009, 8:02am CET by Soulskill

Tags: security

angry tapir writes "Cyber attacks on the US Department of Defense — many of them coming from China — have jumped sharply in 2009, a US congressional committee has reported. Citing data provided by the US Strategic Command, the US-China Economic and Security Review Commission said that there were 43,785 malicious cyber incidents targeting Defense systems in the first half of the year. That's a big jump. In all of 2008, there were 54,640 such incidents. If cyber attacks maintain this pace, the yearly increase will be around 60 percent. The full report (PDF) is available online."
Read more of this story at Slashdot.
Zero-Day Vulnerabilities In Firefox Extensions

Posted: November 20th, 2009, 4:14pm CET by kdawson

Tags: security

An anonymous reader writes "Researchers have found several security holes in popular Firefox extensions that have an estimated total of 30 million downloads from AMO (the Addons Mozilla community site). Three 0-days were also released. Mozilla doesn't have a security model for extensions and Firefox fully trusts the code of the extensions. There are no security boundaries between extensions and, to make things even worse, an extension can silently modify another extension." The affected extensions are Sage version 1.4.3, InfoRSS 1.1.4.2, and Yoono 6.1.1 (and earlier versions). Clearly the problem is larger than just these three extensions.
Read more of this story at Slashdot.
Microsoft Denies It Built Backdoor Into Windows 7

Posted: November 19th, 2009, 11:16pm CET by timothy

Tags: security

CWmike writes "Microsoft has denied that it has built a backdoor into Windows 7, a concern that surfaced yesterday after a senior National Security Agency (NSA) official testified before Congress that the agency had worked on the operating system. 'Microsoft has not and will not put "backdoors" into Windows,' a company spokeswoman said, reacting to a Computerworld story Wednesday. On Monday, Richard Schaeffer, the NSA's information assurance director, told the Senate's Subcommittee on Terrorism and Homeland Security that the agency had partnered with the developer during the creation of Windows 7 'to enhance Microsoft's operating system security guide.' Thursday's categorical denial by Microsoft was accompanied by further explanation of exactly how the NSA participated in the making of Windows 7. 'The work being discussed here is purely in conjunction with our Security Compliance Management Toolkit,' said the spokeswoman. The company rolled out the Windows 7 version of the toolkit late last month, shortly after it officially launched the operating system."
Read more of this story at Slashdot.
Two Arrested For Zbot Trojan

Posted: November 19th, 2009, 4:23am CET by samzenpus

Tags: security

An anonymous reader writes "Officers from the Metropolitan Police's Central e-Crime Unit have made Europe's first arrests in the battle against the ZeuS or Zbot Trojan which threatened to compromise thousands of computers. Officers arrested a man and woman, both aged 20 years, in Manchester for offenses under the 1990 Computer Misuse Act and the 2006 Fraud Act. Both suspects were interviewed by PCeU detectives and have been bailed for further in-depth inquiries to be completed. The arrests in connection with the malware represent some of the first in the world, and the first in Europe to combat the distribution and control of ZeuS."
Read more of this story at Slashdot.
Hackers Broke Into Brazil Power Grid Operator's Website Last Thursday

Posted: November 18th, 2009, 12:41am CET by kdawson

Tags: security

An anonymous reader writes "A week ago, 60 Minutes had a story (we picked it up too) claiming that hackers had caused power outages in Brazil. While this assertion is now believed to be in error, hackers were inspired by the story actually to do what was claimed. Last Thursday, they broke into ONS, the operator of the grid (Google translation; Portuguese original). DarkReading has specific details on the SQL injection vulnerabilities the hackers probably used."
Read more of this story at Slashdot.
SSL Renegotiation Attack Becomes Real

Posted: November 17th, 2009, 12:30am CET by kdawson

Tags: security

rastos1 and several other readers noted that the SSL vulnerability we discussed a couple of weeks back, which some researchers had claimed was too theoretical to worry about, has now been demonstrated by exploit. The attack description is available on securegoose.org. "A Turkish grad student has devised a serious, real-world attack on Twitter that targeted a recently discovered vulnerability in the SSL protocol. The exploit by Anil Kurmus is significant because it successfully targeted the so-called SSL renegotiation bug to steal Twitter login credentials that passed through encrypted data streams. All in all, a man in the middle is able to steal the credentials of a user authenticating himself through HTTPS to a trusted website."
Read more of this story at Slashdot.
Most Security Products Fail To Perform

Posted: November 16th, 2009, 2:45pm CET by CmdrTaco

Tags: security

An anonymous reader writes "Nearly 80 percent of security products fail to perform as intended when first tested and generally require two or more cycles of testing before achieving certification, according to a new ICSA Labs report that details lessons gleaned from testing thousands of security products over 20 years. Across seven product categories core product functionality accounted for 78 percent of initial test failures. For example, an anti-virus product failing to prevent infection and for firewalls or an IPS product not filtering malicious traffic. Rounding out the top three is the startling finding that 44 percent of security products had inherent security problems. Security testing issues range from vulnerabilities that compromise the confidentiality or integrity of the system to random behavior that affects product availability."
Read more of this story at Slashdot.
The First Windows 7 Zero-Day Exploit

Posted: November 16th, 2009, 10:54am CET by kdawson

Tags: security

xploraiswakco writes with the first Microsoft-confirmed Windows 7 zero-day vulnerability, with a demonstration exploit publicly available. The problem is in SMBv2 and SMBv1 and affects Windows 7 and Windows Server 2008 R2, but not Vista, XP, or Windows Server 2003. A maliciously crafted URI could hard-crash affected machines beyond any remedy besides pushing the white button. "Microsoft said it may patch the problem, but didn't spell out a timetable or commit to an out-of-cycle update before the next regularly-scheduled Patch Tuesday of December 8. Instead, the company suggested users block TCP ports 139 and 445 at the firewall." Reader xploraiswakco adds, "As important as this the mentioned article is, it should also be pointed out that any IT staff worth their pay packet should already have port 139 blocked at the firewall, and probably port 445, too."
Read more of this story at Slashdot.
The "Hail Mary Cloud" Is Growing

Posted: November 15th, 2009, 6:23pm CET by Soulskill

Tags: security

badger.foo writes "The Australian rickrolling of jailbroken iPhones only goes to prove that bad passwords are bad for you, Peter Hansteen points out, as he reports on the further exploits of the password-guessing Hail Mary Cloud (which we've discussed in the past). The article contains log data that could indicate that the cloud of distributed, password-guessing hosts is growing. 'With 1767 hosts in the current sample it is likely that we have a cloud of at least several thousand, and most likely no single guessing host in the cloud ever gets around to contacting every host in the target list. The busier your SSH deamon is with normal traffic, the harder it will be to detect the footprint of Hail Mary activity, and likely a lot of this goes undetected.'"
Read more of this story at Slashdot.

Slashdot: Linux

The "Hail Mary Cloud" Is Growing

Posted: November 15th, 2009, 6:23pm CET by Soulskill

Tags: security

badger.foo writes "The Australian rickrolling of jailbroken iPhones only goes to prove that bad passwords are bad for you, Peter Hansteen points out, as he reports on the further exploits of the password-guessing Hail Mary Cloud (which we've discussed in the past). The article contains log data that could indicate that the cloud of distributed, password-guessing hosts is growing. 'With 1767 hosts in the current sample it is likely that we have a cloud of at least several thousand, and most likely no single guessing host in the cloud ever gets around to contacting every host in the target list. The busier your SSH deamon is with normal traffic, the harder it will be to detect the footprint of Hail Mary activity, and likely a lot of this goes undetected.'"
Read more of this story at Slashdot.

Slashdot: IT

DNS Problem Linked To DDoS Attacks Gets Worse

Posted: November 15th, 2009, 3:13pm CET by Soulskill

Tags: security

itwbennett writes "The percentage of devices on the Internet that are configured to accept DNS queries from anywhere — what networking experts call an 'open recursive' or 'open resolver' system — has jumped from around 50 percent in 2007 to nearly 80 percent this year, according to research sponsored by DNS appliance company Infoblox. As more consumers demand broadband Internet, service providers are rolling out modems configured this way to their customers, said Cricket Liu, vice president of architecture with Infoblox. Georgia Tech researcher David Dagon agreed that open recursive systems are on the rise, in part because of 'the increase in home network appliances that allow multiple computers on the Internet. ... Almost all ISPs distribute a home DSL/cable device. Many of the devices have built-in DNS servers. These can sometimes ship in "open by default" states.' What's worse, says Dagon, is that many of these devices do not include patches for a widely publicized DNS flaw discovered by researcher Dan Kaminsky last year."
Read more of this story at Slashdot.
US Cybersecurity Plan Includes Offense

Posted: November 14th, 2009, 4:16pm CET by Soulskill

Tags: security

z4ns4stu writes "Shane Harris of the National Journal describes how the US government plans to use, and has successfully used, cyber-warfare to disrupt the communications of insurgents in Iraq. 'In a 2008 article in Armed Forces Journal, Col. Charles Williamson III, a legal adviser for the Air Force Intelligence, Surveillance, and Reconnaissance Agency, proposed building a military "botnet," an army of centrally controlled computers to launch coordinated attacks on other machines. Williamson echoed a widely held concern among military officials that other nations are building up their cyber-forces more quickly. "America has no credible deterrent, and our adversaries prove it every day by attacking everywhere," he wrote. ... Responding to critics who say that by building up its own offensive power, the United States risks starting a new arms race, Williamson said, "We are in one, and we are losing."'"
Read more of this story at Slashdot.
Easing the Job of Family Tech Support?

Posted: November 12th, 2009, 6:10pm CET by Soulskill

Tags: security

DarkDevil writes "Ever since I was introduced to computers at a very young age, I've been the resident tech support for a household of 7 users. I've been in a cycle for the last ~8 years where something happens to my parents' computer, I spend a week or two trying to non-destructively fix the problem (and try to explain to the users what caused it and how to avoid it), and then if it's not easily fixed I'll reformat and start from scratch. Most often, the level of infection warrants a reformat, which usually ends up taking even more time to get the computer back to how my parents know how to use it. 4-8 months later, it happens again. Recently, I found ~380 instances of malware and 6 viruses. I only realized something was wrong with their computer after it slowed down the entire network whenever anyone used it. My question for Slashdot is: are there any resources out there that explain computer viruses, malware, adware, and general safe computer practices to non-technical people in an easy-to-digest format? The security flaws in my house are 9, 26, and ~50 years old, with no technical background aside from surfing the internet. Something in video format would be ideal as they are perfectly happy with our current arrangement and so it'll be hard to get them reading pages and pages of technical papers."
Read more of this story at Slashdot.
Scientists Unveil Lightweight Rootkit Protection

Posted: November 11th, 2009, 4:26pm CET by CmdrTaco

Tags: security

DangerFace writes "Scientists are set to unveil a lightweight system they say makes an operating system significantly more resistant to rootkits without degrading its performance. The hypervisor-based system is dubbed HookSafe, and it works by relocating kernel hooks in a guest OS to a dedicated page-aligned memory space that's tightly locked down. The team installed HookSafe on a machine running Ubuntu 8.04, and found the system successfully prevented nine real-world rootkits targeting that platform from installing or hiding themselves. The program was able to achieve that protection with only a 6 percent reduction in performance benchmarks."
Read more of this story at Slashdot.

Slashdot: Linux

Scientists Unveil Lightweight Rootkit Protection

Posted: November 11th, 2009, 4:26pm CET by CmdrTaco

Tags: security

DangerFace writes "Scientists are set to unveil a lightweight system they say makes an operating system significantly more resistant to rootkits without degrading its performance. The hypervisor-based system is dubbed HookSafe, and it works by relocating kernel hooks in a guest OS to a dedicated page-aligned memory space that's tightly locked down. The team installed HookSafe on a machine running Ubuntu 8.04, and found the system successfully prevented nine real-world rootkits targeting that platform from installing or hiding themselves. The program was able to achieve that protection with only a 6 percent reduction in performance benchmarks."
Read more of this story at Slashdot.

Slashdot: IT

Microsoft Plugs "Drive-By" and 14 Other Holes

Posted: November 11th, 2009, 2:07pm CET by kdawson

Tags: security

CWmike writes "Microsoft today patched 15 vulnerabilities in Windows, Windows Server, Excel, and Word, including one that will probably be exploited quickly by hackers. None affects Windows 7. Of today's 15 bugs, Microsoft tagged three 'critical' and the remaining 12 'important.' Experts agreed that users should focus on MS09-065 first and foremost. That update, which was ranked critical, affects all still-supported editions of Windows except Windows 7 and its server sibling, Windows Server 2008 R2. 'The Windows kernel vulnerability is going to take the cake,' said Andrew Storms, director of security operations at nCircle Network Security. 'The attack vector can be driven through Internet Explorer, and this is one of those instances where the user won't be notified or prompted. This is absolutely a drive-by attack scenario.' Richie Lai, the director of vulnerability research at security company Qualys, agreed. 'Anyone running IE [Internet Explorer] is at risk here, even though the flaw is not in the browser, but in the Win32k kernel mode driver.'"
Read more of this story at Slashdot.
$9 Million ATM Hacking Ring Indicted

Posted: November 11th, 2009, 4:27am CET by kdawson

Tags: security

Trailrunner7 writes "US and international prosecutors have indicted a criminal ring that they allege was responsible for an ATM scam last November that stole about $9 million from RBS WorldPay. The criminals cracked payroll debit cards and withdrew money from ATMs in hundreds of cities around the world. A federal grand jury in Atlanta has indicted eight men in connection with the scheme, including five Estonians, one Russian, one Moldovan, and one unidentified man. Prosecutors allege that the men 'used sophisticated hacking techniques' to defeat the company's encryption system. The scam involved an elaborate plan in which the attackers first bypassed the encryption on the debit cards, which RBS WorldPay issues to customers for employee payroll purposes. They then raised the limits on the accounts attached to the cards, then provided a network of 'cashers' with 44 counterfeit payroll debit cards, which were used to withdraw more than $9 million from more than 2,100 ATMs in at least 280 cities worldwide, including cities in the United States, Russia, Ukraine, Estonia, Italy, Japan and Canada. The $9 million loss occurred within a span of less than 12 hours; 130 different ATMs in 49 cities were hit within one 30-minute period."
Read more of this story at Slashdot.
Best Tool For Remembering Passwords?

Posted: November 11th, 2009, 2:30am CET by kdawson

Tags: security

StonyCreekBare writes "Lately I've been rethinking my personal security practices. Should my laptop be stolen, having Firefox 'fill in' passwords automatically for me when I go to my bank's site seems sub-optimal. Keeping passwords for all the varied sites on the computer in a plain-text file seems unwise as well. Keeping them in my brain is a prescription for disaster, as my brain is increasingly leaky. A paper notepad likewise has its disadvantages. I have looked at a number of password managers, password 'vaults' and so on. The number of tools out there is a bit overwhelming. Magic Password Generator add-in for Firefox seems competent, but it's tied to Firefox, and I have other places and applications where I want passwords. And I might be accessing my sites from other computers that don't have it installed. The ideal tool in my mind should be something that is independent of any application, browser, or computer; something that is easily carried, but which if lost poses no risk of compromise. What does the Slashdot crowd like in password tools?"
Read more of this story at Slashdot.
Massive Power Outages In Brazil Caused By Hackers

Posted: November 9th, 2009, 1:17am CET by timothy

Tags: security

Hugh Pickens writes "CBS reports on 60 minutes that a massive two-day power outage in Brazil's Espirito Santo State affecting more than three million people in 2007, and another, smaller event in three cities north of Rio de Janeiro in January 2005, were perpetrated by hackers manipulating control systems. Former Chief of US National Intelligence Retired Adm. Mike McConnell says that the 'United States is not prepared for such an attack' and believes it could happen in America. 'If I were an attacker and wanted to do strategic damage to the United States, I would either take the cold of winter or the heat of summer,' says McConnell, 'I would probably sack electric power on the US East Coast, maybe the West Coast and attempt to cause a cascading effect.' Congressman Jim Langevin says that US power companies need to be forced to deal with the issue after they told Congress they would take steps to defend their operations but did not follow up. 'They admit that they misled Congress. The private sector has different priorities than we do in providing security. Their bottom line is about profits,' says Langevin. 'We need to change their motivation so that when see vulnerability like this, we can require them to fix it.' McConnell adds that a similar attack to the one in Brazil is poised to take place on US soil and that it may take some horrific event to get the country focused on shoring up cyber security. 'If the power grid was taken off line in the middle of winter and it caused people to suffer and die, that would galvanize the nation. I hope we don't get there.'"
Read more of this story at Slashdot.
Malware Can Download Child Porn To Your Computer

Posted: November 8th, 2009, 10:47pm CET by timothy

Tags: security

2muchcoffeeman writes "The Associated Press tells the story of Michael Fiola, a former Massachusetts government employee who was arrested in 2007 after child porn was found on his state-issued laptop computer. He was eventually cleared of all charges after some digging by the defense found that the laptop was infected with malware that was 'programmed to visit as many as 40 child porn sites per minute — an inhuman feat. While Fiola and his wife were out to dinner one night, someone logged on to the computer and porn flowed in for an hour and a half. Prosecutors performed another test and confirmed the defense findings. The charge was dropped — 11 months after it was filed.' The article also discusses the technical aspects of how it could happen and about similar cases in the United Kingdom in 2003."
Read more of this story at Slashdot.
Test of 16 Anti-Virus Products Says None Rates "Very Good"

Posted: November 8th, 2009, 4:20am CET by timothy

Tags: security

An anonymous reader writes "AV-Comparative recently released the results of a malware removal test in which they evaluated 16 anti-virus software solutions. The test focused only on the malware removal/cleaning capabilities, therefore all the samples used were ones that the tested anti-virus products were able to detect. The main question was if the products were able to successfully remove malware from an already infected/compromised system. None of the products performed at a level of 'very good' in malware removal or removal of leftovers, based on those 10 samples."
Read more of this story at Slashdot.
Shockwave Vulnerabilities Affect More Than 450 Million Systems

Posted: November 5th, 2009, 8:14pm CET by timothy

Tags: security

Trinity writes "Researchers from VUPEN have discovered critical vulnerabilities in Adobe Shockwave, a technology installed on over 450 million Internet-enabled desktops. The vulnerabilities could allow remote code execution by tricking a user into visiting a web page using Internet Explorer or even Mozilla Firefox. Version 11.5.1.601 as well as earlier ones are affected. The vendor recommends upgrading to version 11.5.1.602." Especially sobering when you consider Adobe's current push to be essentially required as an intermediary player for anyone who wants to see certain government data.
Read more of this story at Slashdot.
Facebook and MySpace Backdoors Found, Fixed

Posted: November 5th, 2009, 5:29pm CET by Soulskill

Tags: security

jamie writes with news of a Facebook app developer who found a significant security hole while he was trying to get around function limitations for his application. Quoting: "Luckily — just with browser AJAX requests — a flash application hosted on domain X is unable to open a file on domain Y. If this would be possible, domain X [would be] able to access content on domain Y, and when the user is logged in on domain Y retrieve and post back any personal data. In certain cases this could limit a Flash application's capabilities. ... To resolve such issues, Adobe (Flash's developers) introduced a 'crossdomain.xml' file which could allow certain domains to access another domain, leading to cross-domain access by certain or all domains. While indeed Facebook locked the front door from any non-Facebook domain access via Flash, a simple subdomain change allowed any flash application (domain="*") to access its domain data." He found a similar problem in MySpace's crossdomain.xml. Both sites were notified, and they have implemented fixes.
Read more of this story at Slashdot.
Man-In-the-Middle Vulnerability For SSL and TLS

Posted: November 5th, 2009, 3:23pm CET by Soulskill

Tags: security

imbaczek writes "The SSL 3.0+ and TLS 1.0+ protocols are vulnerable to a set of related attacks which allow a man-in-the-middle (MITM) operating at or below the TCP layer to inject a chosen plaintext prefix into the encrypted data stream, often without detection by either end of the connection. This is possible because an 'authentication gap' exists during the renegotiation process, at which the MitM may splice together disparate TLS connections in a completely standards-compliant way. This represents a serious security defect for many or all protocols which run on top of TLS, including HTTPS."
Read more of this story at Slashdot.
Maryland Town Tests New Cryptographic Voting System

Posted: November 5th, 2009, 12:58am CET by samzenpus

Tags: security

ceswiedler writes "In Tuesday's election voters in Takoma Park, MD used a new cryptographic voting system designed by David Chaum with researchers from several universities including MIT and the University of Maryland. Voters use a special ink to mark their ballots, which reveals three-digit codes which they can later check against a website to verify their vote was tallied. Additionally, anyone can download election data from a Subversion repository and verify the overall accuracy of the results without seeing the actual choices of any individual voter."
Read more of this story at Slashdot.
Bug In Most Linuxes Can Give Untrusted Users Root

Posted: November 4th, 2009, 2:51pm CET by kdawson

Tags: security

Red Midnight and other readers brought to our attention a bug in most deployed versions of Linux that could result in untrusted users getting root access. The bug was found by Brad Spengler last month. "The null pointer dereference flaw was only fixed in the upcoming 2.6.32 release candidate of the Linux kernel, making virtually all production versions in use at the moment vulnerable. While attacks can be prevented by implementing a common feature known as mmap_min_addr, the RHEL distribution... doesn't properly implement that protection... The... bug is mitigated by default on most Linux distributions, thanks to their correct implementation of the mmap_min_addr feature. ... [Spengler] said many other Linux users are also vulnerable because they run older versions or are forced to turn off [mmap_min_addr] to run certain types of applications." The register reprints a dialog from the OpenBSD-misc mailing list in which Theo De Raadt says, "For the record, this particular problem was resolved in OpenBSD a while back, in 2008. We are not super proud of the solution, but it is what seems best faced with a stupid Intel architectural choice. However, it seems that everyone else is slowly coming around to the same solution."
Read more of this story at Slashdot.

Slashdot: Linux

Bug In Most Linuxes Can Give Untrusted Users Root

Posted: November 4th, 2009, 2:51pm CET by kdawson

Tags: security

Red Midnight and other readers brought to our attention a bug in most deployed versions of Linux that could result in untrusted users getting root access. The bug was found by Brad Spengler last month. "The null pointer dereference flaw was only fixed in the upcoming 2.6.32 release candidate of the Linux kernel, making virtually all production versions in use at the moment vulnerable. While attacks can be prevented by implementing a common feature known as mmap_min_addr, the RHEL distribution... doesn't properly implement that protection... The... bug is mitigated by default on most Linux distributions, thanks to their correct implementation of the mmap_min_addr feature. ... [Spengler] said many other Linux users are also vulnerable because they run older versions or are forced to turn off [mmap_min_addr] to run certain types of applications." The register reprints a dialog from the OpenBSD-misc mailing list in which Theo De Raadt says, "For the record, this particular problem was resolved in OpenBSD a while back, in 2008. We are not super proud of the solution, but it is what seems best faced with a stupid Intel architectural choice. However, it seems that everyone else is slowly coming around to the same solution."
Read more of this story at Slashdot.

Slashdot: IT

In Test, Windows 7 Vulnerable To 8 Out of 10 Viruses

Posted: November 3rd, 2009, 10:33pm CET by kdawson

Tags: security

As Windows 7's market share passes 3.6%, up from 1.9% the day before launch, llManDrakell notes an experiment they did over at Sophos. They installed Windows 7 on a clean machine — with no anti-virus protection — with User Access Control in its default configuration. They threw at it the next 10 virus/worm samples that came in the door. Seven of them ran; UAC stopped only one baddie that had run in the absense of UAC. "Lesson learned? You still need to run anti-virus on Windows 7."
Read more of this story at Slashdot.
Microsoft Links Malware Rates To Pirated Windows

Posted: November 3rd, 2009, 12:07am CET by kdawson

Tags: security

CWmike writes "Microsoft said today that computers in countries with high rates of software piracy are more likely to be infected because users are leery of applying security patches. 'There is a direct correlation between piracy and the malware infection rate,' said Jeff Williams, head manager of the Microsoft Malware Protection Center. Highlighting research that showed worms to be the most prevalent computer security problem today, Williams said the link between PC infection rates and piracy is due to the hesitancy of users of pirated software to use Windows Update. China's piracy rate is more than four times that of the US, but the use of Windows Update in China is significantly below that in this country. Same for Brazil and France. But Microsoft's own data doesn't always support William's contention that piracy, and the hesitancy to use Windows Update, leads to more infected PCs. China, for example, boasted a malware infection rate — as defined by the number of computers cleaned for each 1,000 executions of the MSRT — of just 6.7 per thousand, significantly below the global average of 8.7 or the US's rate of 8.2. France's infection rate of 7.9 in the first half of 2009 was also below the worldwide average."
Read more of this story at Slashdot.
After 1 Year, Conficker Infects 7M Computers

Posted: October 31st, 2009, 1:04am CET by Soulskill

Tags: security

alphadogg writes "The Conficker worm has passed a dubious milestone. It has now infected more than 7 million computers, security experts estimate. On Thursday, researchers at the volunteer-run Shadowserver Foundation logged computers from more than 7 million unique IP addresses, all infected by the known variants of Conficker. They have been able to keep track of Conficker infections by cracking the algorithm the worm uses to look for instructions on the Internet and placing their own 'sinkhole' servers on the Internet domains it is programmed to visit. Conficker has several ways of receiving instructions, so the bad guys have still been able to control PCs, but the sinkhole servers give researchers a good idea how many machines are infected."
Read more of this story at Slashdot.
Arbitrary Code Execution With "ldd"

Posted: October 26th, 2009, 4:13pm CET by kdawson

Tags: security

pkrumins writes "The ldd utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! It turns out that running ldd on an executable can result in executing arbitrary code. This article details how such executable can be constructed and comes up with a social engineering scenario that may lead to system compromise. I researched this subject thoroughly and found that it's almost completely undocumented."
Read more of this story at Slashdot.
Cyberterror Not Yet a Credible Threat, Says Policy Thinktank

Posted: October 25th, 2009, 10:42pm CET by timothy

Tags: security

Trailrunner7 writes "A new report by a Washington policy think tank dismisses out of hand the idea that terrorist groups are currently launching cyber attacks and says that the recent attacks against US and South Korean networks were not damaging enough to be considered serious incidents. The report, written by James Lewis of the Center for Strategic and International Studies, looks at cyberwar through the prism of the Korean attacks, and calls the idea that terrorists have attack capabilities and just aren't using them 'nonsensical.' 'A very rough estimate would say that there is a lag of three and eight years between the capabilities developed by advanced intelligence agencies and the capabilities available for purchase or rental in the cybercrime black market. The evidence for this is partial and anecdotal, but the trend has been consistent for more two decades,' Lewis writes."
Read more of this story at Slashdot.
Now Linux Can Get Viruses, Via Wine

Posted: October 24th, 2009, 8:31pm CEST by timothy

Tags: security

fsufitch writes "Wine has advanced enough to make Linux not immune to Windows viruses. However, just like many Wine applications, it takes a bit of effort to get the program off the ground. Also, just like some Windows programs running via Wine, not all features may work — in this case, the crippling of the system, immunity to the task manager, identity theft, etc."
Read more of this story at Slashdot.

Slashdot: Linux

Now Linux Can Get Viruses, Via Wine

Posted: October 24th, 2009, 8:31pm CEST by timothy

Tags: security

fsufitch writes "Wine has advanced enough to make Linux not immune to Windows viruses. However, just like many Wine applications, it takes a bit of effort to get the program off the ground. Also, just like some Windows programs running via Wine, not all features may work — in this case, the crippling of the system, immunity to the task manager, identity theft, etc."
Read more of this story at Slashdot.

Slashdot: IT

Impressing Security Upon End-users Visually?

Posted: October 24th, 2009, 5:22pm CEST by Soulskill

Tags: security

get quad writes "I continually have to remind our end-users to be vigilant about the usual web security safeguards, such as not clicking links in the occasional spam email which passes through filters, avoiding suspicious websites, why some websites aren't entirely safe or appropriate for the work environment (Facebook apps, MySpace, remote access apps, proxies, etc), and the myriad other things an end-user can do to get into trouble. What I'm hoping to find are video or flash examples (mind you, in layman's terms) of what web-based exploits/zero-day threats are capable of, how they can happen and the harm they can ultimately cause, rather than posting links to technical docs the users will never bother to read. Getting the point across in a purely visual and less technical manner seems much more effective. Does anyone have any suggestions or experience with this type of training?"
Read more of this story at Slashdot.
Impressing Security Upon End-Users Visually?

Posted: October 24th, 2009, 5:22pm CEST by Soulskill

Tags: security

get quad writes "I continually have to remind our end-users to be vigilant about the usual web security hazards, such as not clicking links in the occasional spam email that passes through our filters, avoiding suspicious websites, why some websites aren't entirely safe or appropriate for the work environment (Facebook apps, MySpace, remote access apps, proxies, etc), and the myriad other things an end-user can do to get into trouble. What I'm hoping to find are video or flash examples (mind you, in layman's terms) of what Web-based exploits/zero-day threats are capable of, how they can happen, and the harm they can ultimately cause — rather than posting links to technical docs the users will never bother to read. Getting the point across in a purely visual and less technical manner seems much more effective. Does anyone have any suggestions or experience with this type of training?"
Read more of this story at Slashdot.
How To Stretch Your Security Dollar

Posted: October 24th, 2009, 12:11am CEST by ScuttleMonkey

Tags: security

itwbennett writes "Taking an aspirin a day will keep you headache-free but it can also reduce your risk of heart attack. You're definitely getting your money's worth out of that bitter little pill. But experts say you can also get additional ROI from security, business continuity, disaster recovery and compliance investments, writes Daniel Dern in a recent article. In fact, you can get 'double or triple the value from "side effects,"' observes Jim Cuff, VP of strategy, Iron Mountain Digital. For example, tools purchased for compliance management can also help identify redundancies and other inefficiencies. Security appliances don't just provide security; they can also be used for performance and bandwidth management, and enforcing acceptable use policies. Or take the next step and use disaster recovery resources 'for part of your active environment, like load balancing, test and develop and QA, and backup, not something you have just in case,' urges Greg Schulz, founder and senior analyst of the StorageIO Group. And for the ultimate bang for your buck, take your facilities and knowledge and turn them into an external business offering."
Read more of this story at Slashdot.
China Expands Cyberspying In US, Report Says

Posted: October 22nd, 2009, 5:38pm CEST by samzenpus

Tags: security

An anonymous reader writes "A new report published by The US-China Economic and Security Review Commission wags a finger at the People's Republic of China for conducting Internet-borne espionage operations against United States high-tech companies. The paper, written by defense giant Northrop Grumman, provides a detailed case study of one such intrusion that moved large volumes of sensitive tech data out of a US firm in 2007. From a Wall Street Journal article, '"The case study is absolutely clearly controlled and directed with a specific purpose to get at defense technology in a related group of companies," said Larry Wortzel, vice chairman of the commission and a former U.S. Army attaché in China. "There's no doubt that that's state-controlled."' Wang Baodong, a spokesman for the Chinese Embassy in Washington, criticized the commission as "a product of Cold War mentality" that was "put in place to pick China to pieces." He added: "Accusations of China conducting, or 'likely conducting' as the commission's report indicates, cyberspace attacks or espionage against the US are unfounded and unwarranted.'"
Read more of this story at Slashdot.
Time Warner Cable Modems Expose Users

Posted: October 22nd, 2009, 2:45pm CEST by samzenpus

Tags: security

eldavojohn writes "Wired is reporting on a simple hack putting some 65,000 customers at risk. The hack to gain administrative access to the cable modem/router combo is remarkably simple: '[David] Chen, founder of a software startup called Pip.io, said he was trying to help a friend change the settings on his cable modem and discovered that Time Warner had hidden administrative functions from its customers with Javascript code. By simply disabling Javascript in his browser, he was able to see those functions, which included a tool to dump the router's configuration file. That file, it turned out, included the administrative login and password in cleartext. Chen investigated and found the same login and password could access the admin panels for every router in the SMC8014 series on Time Warner's network — a grave vulnerability, given that the routers also expose their web interfaces to the public-facing internet.' If you use Time Warner's SMC8014 series cable modem/Wi-Fi router combo, watch for firmware to be released soon that they are reportedly in the process of testing."
Read more of this story at Slashdot.
Metasploit Project Sold To Rapid7

Posted: October 21st, 2009, 5:07pm CEST by Soulskill

Tags: security

ancientribe writes "The wildly popular, open-source Metasploit penetration testing tool project has been sold to Rapid7, a vulnerability management vendor, paving the way for a commercial version of Metasploit to eventually hit the market. HD Moore, creator of Metasploit, was hired by Rapid7 and will continue heading up the project. This is big news for the indie Metasploit Project, which now gets full-time resources. Moore says this will translate into faster turnaround for new features. Just what a commercial Metasploit product will look like is still in the works, but Rapid7 expects to keep the Metasploit penetration testing tool as a separate product with 'high integration' into Rapid7's vulnerability management products."
Read more of this story at Slashdot.
Sneaky Microsoft Add-On Put Firefox Users At Risk

Posted: October 16th, 2009, 10:14pm CEST by ScuttleMonkey

Tags: security

CWmike writes to mention that the "Windows Presentation Foundation" plugin that Microsoft slipped into Firefox last February apparently left the popular browser open to attack. This was among the many things recently addressed in the massive Tuesday patch. "What was particularly galling to users was that once installed, the .NET add-on was virtually impossible to remove from Firefox. The usual 'Disable' and 'Uninstall' buttons in Firefox's add-on list were grayed out on all versions of Windows except Windows 7, leaving most users no alternative other than to root through the Windows registry, a potentially dangerous chore, since a misstep could cripple the PC. Several sites posted complicated directions on how to scrub the .NET add-on from Firefox, including Annoyances.org."
Read more of this story at Slashdot.
Delta Air Lines Sued Over Alleged E-mail Hacking

Posted: October 15th, 2009, 12:52am CEST by samzenpus

Tags: security

alphadogg writes "Delta Air Lines is being sued for allegedly hacking the e-mail account of a passenger rights advocate supporting legislation that would allow access to food, water and toilets during long delays on the tarmac. Kathleen Hanni, executive director of Flyersrights.org, alleges Delta obtained sensitive e-mails and files and used the material in an attempt to derail the 'Airline Passenger's Bill of Rights of 2009,' of which four versions are pending before Congress. The suit was filed on Tuesday in US District Court for the Southern District of Texas and seeks a minimum of $11 million in damages. Flyersrights.org, a nonprofit organization founded in 2007, had been investigating surface delays in air travel."
Read more of this story at Slashdot.
Washington Post Says Use Linux To Avoid Bank Fraud

Posted: October 14th, 2009, 4:27am CEST by kdawson

Tags: security

christian.einfeldt writes "Washington Post Security Fix columnist Brian Krebs recommends that banking customers consider using a Linux LiveCD, rather than Microsoft Windows, to access their on-line banking. He tells a story of two businesses that lost $100K and $447K, respectively, when thieves — armed with malware on the company controller's PC — were able to intercept one of the controller's log-in codes, and then delay the controller from logging in. Krebs notes that he is not alone in recommending the use of non-Windows machines for banking; The Financial Services Information Sharing and Analysis Center, an industry group supported by some of the world's largest banks, recently issued guidelines urging businesses to carry out all online banking activities from 'a stand-alone, hardened, and completely locked down computer system from where regular e-mail and Web browsing [are] not possible.' Krebs concludes his article with a link to an earlier column in which he steps readers through the process of booting a Linux LiveCD to do their on-line banking." Police in Australia offer similar advice, according to an item sent in by reader The Mad Hatterz: "Detective Inspector Bruce van der Graaf from the Computer Crime Investigation Unit told the hearing that he uses two rules to protect himself from cybercriminals when banking online. The first rule, he said, was to never click on hyperlinks to the banking site and the second was to avoid Microsoft Windows."
Read more of this story at Slashdot.

Slashdot: Linux

Washington Post Says Use Linux To Avoid Bank Fraud

Posted: October 14th, 2009, 4:27am CEST by kdawson

Tags: security

christian.einfeldt writes "Washington Post Security Fix columnist Brian Krebs recommends that banking customers consider using a Linux LiveCD, rather than Microsoft Windows, to access their on-line banking. He tells a story of two businesses that lost $100K and $447K, respectively, when thieves — armed with malware on the company controller's PC — were able to intercept one of the controller's log-in codes, and then delay the controller from logging in. Krebs notes that he is not alone in recommending the use of non-Windows machines for banking; The Financial Services Information Sharing and Analysis Center, an industry group supported by some of the world's largest banks, recently issued guidelines urging businesses to carry out all online banking activities from 'a stand-alone, hardened, and completely locked down computer system from where regular e-mail and Web browsing [are] not possible.' Krebs concludes his article with a link to an earlier column in which he steps readers through the process of booting a Linux LiveCD to do their on-line banking." Police in Australia offer similar advice, according to an item sent in by reader The Mad Hatterz: "Detective Inspector Bruce van der Graaf from the Computer Crime Investigation Unit told the hearing that he uses two rules to protect himself from cybercriminals when banking online. The first rule, he said, was to never click on hyperlinks to the banking site and the second was to avoid Microsoft Windows."
Read more of this story at Slashdot.

Slashdot: IT

Details Emerge of 2006 Wal-Mart Hack

Posted: October 14th, 2009, 1:29am CEST by kdawson

Tags: security

plover writes "Kim Zetter of Wired documents an extensive hack of Wal-Mart that took place in 2005-2006. She goes into great detail about the investigation and what the investigators found, including that the hackers made copies of their point-of-sale source code, and that they ran l0phtCrack on a Wal-Mart server. 'Wal-Mart uncovered the breach in November 2006, after a fortuitous server crash led administrators to a password-cracking tool that had been surreptitiously installed on one of its servers. Wal-Mart's initial probe traced the intrusion to a compromised VPN account, and from there to a computer in Minsk, Belarus.' Wal-mart has long since fixed the flaws that allowed the compromise, and confirmed that no customer data was lost in the hack — which is why they did not need to report the breach publicly earlier." This intrusion happened around the same time that Albert Gonzalez's gang was breaking into Marshall's and its parent company, TJX. The MO was quite similar: researching and closely targeting the point-of-sale systems in use. But the article notes that "There's no evidence Wired.com has seen linking Gonzalez to the Wal-Mart breach."
Read more of this story at Slashdot.
SSL Still Mostly Misunderstood, Even By the Pros

Posted: October 12th, 2009, 2:14pm CEST by timothy

Tags: security

An anonymous reader writes "People still don't understand SSL. This isn't much of a surprise... no one expects that grandma and grandpa know what SSL is and what it does. What is surprising and downright scary is that most IT professionals don't understand SSL, and many consider it to be the be-all, end-all of security in their organization. With all the tools out there to manipulate SSL connections, and the browser vendors unable to settle on a single method of showing if a site is secured by SSL or not, is it any wonder that no one gets it?"
Read more of this story at Slashdot.
Comcast's War On Infected PCs (Or All Customers)

Posted: October 8th, 2009, 10:21pm CEST by timothy

Tags: security

thadmiller writes "Comcast is launching a trial on Thursday of a new automated service that will warn broadband customers of possible virus infections if the computers are behaving as if they have been compromised by malware. For instance, a significant overnight spike in traffic being sent from a particular Internet Protocol address could signal that a computer is infected with a virus, taking control of the system and using it to send spam as part of a botnet." Update: Jason Livingood of Comcast's Internet Systems Engineering group sent to Dave Farber's "Interesting People" mailing list a more detailed explanation of what this trial will involve.
Read more of this story at Slashdot.
How Dangerous Could a Hacked Robot Possibly Be?

Posted: October 8th, 2009, 3:36pm CEST by CmdrTaco

Tags: security

alphadogg writes "Researchers at the University of Washington think it's finally time to start paying some serious attention to the question of robot security. Not because they think robots are about to go all Terminator on us, but because the robots can already be used to spy on us and vandalize our homes. In a paper published Thursday the researchers took a close look at three test robots: the Erector Spykee, and WowWee's RoboSapien and Rovio. They found that security is pretty much an afterthought in the current crop of robotic devices. 'We were shocked at how easy it was to actually compromise some of these robots,' said Tadayoshi Kohno, a University of Washington assistant professor, who co-authored the paper."
Read more of this story at Slashdot.
FBI Cracks "Largest Phishing Case Ever"

Posted: October 8th, 2009, 2:43pm CEST by CmdrTaco

Tags: security

nk497 writes "The FBI and Egyptian authorities have arrested 100 people in what they're calling 'the largest international phishing case ever conducted' as part of a wide-scale investigation called Operation Phish Phry. The criminals used phishing to get access to hundreds of bank accounts, stealing $1.5 million. 'This international phishing ring had a significant impact on two banks and caused huge headaches for hundreds, perhaps thousands of bank customers,' said Acting US Attorney George S. Cardona."
Read more of this story at Slashdot.
Why the FBI Director Doesn't Bank Online

Posted: October 8th, 2009, 1:57pm CEST by samzenpus

Tags: security

angry tapir writes "The head of the US Federal Bureau of Investigation has stopped banking online after nearly falling for a phishing attempt. FBI Director Robert Mueller said he recently came 'just a few clicks away from falling into a classic Internet phishing scam' after receiving an e-mail that appeared to be from his bank."
Read more of this story at Slashdot.
Cyber-criminal Left In Charge of Prison Computer Network

Posted: October 7th, 2009, 8:22pm CEST by samzenpus

Tags: security

samzenpus writes "A 27-year-old man serving six years for stealing £6.5million using forged credit cards over the internet was recruited to help write code needed for the installation of an internal prison TV station. He was left unguarded with unfettered access to the system and produced results that anyone but prison officials could have guessed. He installed a series of passwords on all the machines, shutting down the entire prison computer system. A prison source said, 'It's unbelievable that a criminal convicted of cyber-crime was allowed uncontrolled access to the hard drive. He set up such an elaborate array of passwords it took a specialist company to get it working.'"
Read more of this story at Slashdot.
Massive Phishing Campaign Hits Multiple Email Services

Posted: October 7th, 2009, 7:01pm CEST by Soulskill

Tags: security

nandemoari writes "It seems as if the massive phishing campaign reported yesterday was not specific to Hotmail, as was initially believed. According to a report by the BBC, many Gmail and Yahoo Mail accounts have also been compromised. Earthlink, Comcast, and AOL were also affected. While the source of the latest attacks has not been determined, many are pointing to the same bug that claimed at least 10,000 passwords from Microsoft Windows Live Hotmail. Microsoft has done their part in blocking all known hijacked Hotmail accounts and created tools to help users who had lost control of their email. An analysis of the data from Hotmail showed the most common password among the compromised accounts to be '12345.' On their end, Google responded to the attacks by forcing password resets on the affected accounts."
Read more of this story at Slashdot.
Null-Prefix SSL Certificate For PayPal Released

Posted: October 7th, 2009, 12:45am CEST by kdawson

Tags: security

An anonymous reader writes "Nine weeks after Moxie Marlinspike presented at Defcon 17, null-prefix certificates that exploit the SSL certificate vulnerability are beginning to appear. Yesterday, someone posted a null-prefix certificate for www.paypal.com on the full-disclosure mailing list. In conjunction with sslsniff, this certificate can be used to intercept communication to PayPal from all clients using the Windows Crypto API, for which a patch is still not available. This includes IE, Chrome, and Safari on Windows. What's worse, because of the OCSP attack that Moxie also presented at Defcon, this certificate cannot be revoked." Update: 10/06 23:19 GMT by KD: Now it seems that PayPal has suspended Marlinspike's account.
Read more of this story at Slashdot.
72% of Banks Say Their Employees Committed Fraud

Posted: October 6th, 2009, 5:54am CEST by kdawson

Tags: security

yahoi writes "The financial crisis appears to be exacerbating fraud by bank employees: a new survey found that 72 percent of financial institutions say that in the last 12 months they have experienced a case of data theft by one of their workers. Meanwhile, most banks don't want to talk about the insider threat problem and remain in denial, says a former Wachovia Bank executive who handled insider fraud incidents at the bank and has co-authored a new book called Insidious — How Trusted Employees Steal Millions and Why It's So Hard for Banks to Stop Them that investigates several real-world insider fraud cases at banks." The article dispels one assumption that might commonly be made about such insider fraud: "Interestingly, it's not the stereotypical offshore or outsourced employee who's most risky to their organizations. Nearly 70 percent of financial institutions say their full-time employees are most likely to pose an insider fraud threat..." Technology workers placed third in the roster of the job categories most abused.
Read more of this story at Slashdot.
Researchers Hijack Mebroot Botnet, Study Drive-By Downloads

Posted: October 5th, 2009, 9:30pm CEST by ScuttleMonkey

Tags: security

TechReviewAl writes "Researchers at the University of California at Santa Barbara hijacked the Mebroot botnet for about a month and used it to study drive-by downloading. The researchers managed to intercept Mebroot communications by reverse-engineering the algorithm used to select domains to connect to. Mebroot infects legitimate websites and uses them to redirect users to malicious sites that attempt to install malware on a victim's machine. The team, who previously infiltrated the Torpig botnet, found that at least 13.3 percent of systems that were redirected by Mebroot were already infected and 70 percent were vulnerable to about 40 common attacks."
Read more of this story at Slashdot.
Sloppy Linux Admins Enable Slow Bruteforce Attacks

Posted: October 5th, 2009, 4:27am CEST by kdawson

Tags: security

badger.foo passes on the report of Peter N. M. Hansteen that a third round of low-intensity, distributed bruteforce attacks is now in progress — we earlier discussed the first and second rounds — and that sloppy admin practice on Linux systems is the main enabler. As before, the article links to log data (this time 770 apparently already compromised Linux hosts are involved), and further references. "The fact that your rig runs Linux does not mean you're home free. You need to keep paying attention. When your spam washer has been hijacked and tries to break into other people's systems, you urgently need to get your act together, right now."
Read more of this story at Slashdot.
Sloppy Linux Admins Enable Slow Brute-Force Attacks

Posted: October 5th, 2009, 4:27am CEST by kdawson

Tags: security

badger.foo passes on the report of Peter N. M. Hansteen that a third round of low-intensity, distributed brute-force attacks is now in progress — we earlier discussed the first and second rounds — and that sloppy admin practice on Linux systems is the main enabler. As before, the article links to log data (this time 770 apparently already compromised Linux hosts are involved), and further references. "The fact that your rig runs Linux does not mean you're home free. You need to keep paying attention. When your spam washer has been hijacked and tries to break into other people's systems, you urgently need to get your act together, right now."
Read more of this story at Slashdot.

Slashdot: Linux

Sloppy Linux Admins Enable Slow Bruteforce Attacks

Posted: October 5th, 2009, 4:27am CEST by kdawson

Tags: security

badger.foo passes on the report of Peter N. M. Hansteen that a third round of low-intensity, distributed bruteforce attacks is now in progress — we earlier discussed the first and second rounds — and that sloppy admin practice on Linux systems is the main enabler. As before, the article links to log data (this time 770 apparently already compromised Linux hosts are involved), and further references. "The fact that your rig runs Linux does not mean you're home free. You need to keep paying attention. When your spam washer has been hijacked and tries to break into other people's systems, you urgently need to get your act together, right now."
Read more of this story at Slashdot.
Sloppy Linux Admins Enable Slow Brute-Force Attacks

Posted: October 5th, 2009, 4:27am CEST by kdawson

Tags: security

badger.foo passes on the report of Peter N. M. Hansteen that a third round of low-intensity, distributed brute-force attacks is now in progress — we earlier discussed the first and second rounds — and that sloppy admin practice on Linux systems is the main enabler. As before, the article links to log data (this time 770 apparently already compromised Linux hosts are involved), and further references. "The fact that your rig runs Linux does not mean you're home free. You need to keep paying attention. When your spam washer has been hijacked and tries to break into other people's systems, you urgently need to get your act together, right now."
Read more of this story at Slashdot.

Slashdot: IT

Fake Antivirus Overwhelming Scanners

Posted: October 1st, 2009, 6:20pm CEST by CmdrTaco

Tags: security

ChiefMonkeyGrinder writes "Rogue or bogus programs passing themselves off as real antivirus software have been one of the malware themes of 2009, but the APWG's numbers for the first half of the year show that the organisation's members detected 485,000 samples, more than five times the total for the whole of 2008."
Read more of this story at Slashdot.
Microsoft Blocks Pirates From Security Essentials Software

Posted: October 1st, 2009, 12:47am CEST by samzenpus

Tags: security

CWmike writes "Microsoft will block users running counterfeit copies of Windows from installing the free Security Essentials antivirus software, said Alex Kochis, director of Microsoft's Genuine Windows team, in a post to a company blog. On-again, off-again debates about the wisdom of blocking security-oriented downloads like patches or defensive software have centered around the argument that Microsoft should protect all users, including pirates, since hijacked PCs threaten the entire Windows ecosystem. In this case, though, one analyst isn't buying that line. 'I can't see any justification for making Microsoft give away Security Essentials [to counterfeit Windows users],' said John Pescatore, Gartner's primary security analyst. 'Those people have many other choices, including free. There are plenty of alternatives to Security Essentials,' he said, adding that that makes a difference. Windows patches, on the other hand, aren't available from anyone but Microsoft."
Read more of this story at Slashdot.
Auto-Detecting Malware? It's Possible

Posted: September 30th, 2009, 9:18pm CEST by timothy

Tags: security

itwbennett writes "If antivirus protectors could collect data from machines and users, including geographic location, social networking information, type of operating system, installed programs and configurations, 'it would enable them to quickly identify new malware strains without even looking at the code,' says Dr. Markus Jakobsson. In a recent article, he outlines some examples of how this could work. The bottom line is this: 'Let's ignore what the malware does on a machine, and instead look at how it moves between machines. That is much easier to assess. And the moment malware gives up what allows us to detect it, it also stops being a threat.'"
Read more of this story at Slashdot.
Using Aluminum Oxide Paint To Secure Wi-Fi

Posted: September 30th, 2009, 6:22pm CEST by Soulskill

Tags: security

eldavojohn writes "The BBC reports on people using aluminum oxide in their paint to block Wi-Fi signals from leaving their home or business. Aluminum oxide resonates at the same frequency as Wi-Fi signals and other radio waves, blocking data from going outside a building. It's not a flawless solution, as it may also block AM/FM signals. You or your neighbors may be unwittingly using this already, as most pre-finished wood flooring uses aluminum oxide as a protective coating."
Read more of this story at Slashdot.
IT Security Breaches Soar In 2009

Posted: September 30th, 2009, 1:24am CEST by kdawson

Tags: security

slak11 quotes from a Globe and Mail article on the jump in corporate and government security breaches year-over-year. (The reporting is from Canada but the picture is probably much the same in the US.) "This does not seem to be all that newsworthy these days, since stories like this are appearing on a regular basis. The one detail I did like — that seems to break from the traditional 'hackers cause all the bad stuff' reporting — is the mention that everyday employees are a major cause of breaches. The recent Rocky Mountain Bank/Google story is a perfect example. As stated in the article: 'But lower security budgets aren't the only reason breaches tend to soar during tough economic times — employees themselves can often be the cause of such problems.' I figure this will be an ongoing problem until company management and employees accept their role in keeping company information safe. And IT people need to understand that regular employees are not propeller-heads like Slashdot readers, and to begin to implement technology and processes that average people can understand and use."
Read more of this story at Slashdot.
Apple Pushes Unwanted Software To PCs, Again

Posted: September 29th, 2009, 2:10am CEST by kdawson

Tags: security

itwbennett writes "Blogger Steven J. Vaughan-Nichols wags his finger at Apple for indiscriminately pushing the iPhone Configuration Utility 2.1 update out to Windows users, since it is a tool for business system administrators to set up and administer corporate iPhones — the blogger himself (and practically every other iPhone user) not being of the corporate iPhone user persuasion. But more than just unnecessary, the update actually puts him and millions of other iPhone owners/Windows PC users at increased risk by installing 'not just a configuration program, but the Apache Web server as well,' says Vaughan-Nichols. 'A Web server like the one Apple [is] adding to your PC... [is] a gateway just asking to be hammered on by an attacker. Managed properly Apache is as safe a Web server as you'll ever find, but ordinary PC users shouldn't try to manage it, and even an expert can't do anything with it if they don't know it's there.'" Reader CWMike notes that Apple pulled the iPhone Configuration Utility from the update list after a few hours.
Read more of this story at Slashdot.
Schneier On Un-Authentication

Posted: September 28th, 2009, 5:51pm CEST by CmdrTaco

Tags: security

Trailrunner7 writes "Bruce Schenier writes on Threatpost.com: 'In computer security, a lot of effort is spent on the authentication problem. Whether it is passwords, secure tokens, secret questions, image mnemonics, or something else, engineers are continually coming up with more complicated — and hopefully more secure — ways for you to prove you are who you say you are over the Internet. This is important stuff, as anyone with an online bank account or remote corporate network knows. But a lot less thought and work have gone into the other end of the problem: how do you tell the system on the other end of the line that you are no longer there? How do you un-authenticate yourself? My home computer requires me to log out or turn my computer off when I want to un-authenticate. This works for me because I know enough to do it, but lots of people just leave their computer on and running when they walk away. As a result, many office computers are left logged in when people go to lunch, or when they go home for the night. This, obviously, is a security vulnerability.'"
Read more of this story at Slashdot.
Reddit Javascript Exploit Spreading Virally

Posted: September 28th, 2009, 3:39pm CEST by CmdrTaco

Tags: security

Nithendil writes "guyhersh from reddit.com describes the situation (warning: title NSFW): Based on what I've seen today, here's what went down. Reddit user Empirical wrote javascript code where if you copied and pasted it into the address bar, you would instantly spam that comment by replying to all the comments on the page and submitting it. Later xssfinder posted a proof of concept where if you hovered over a link, it would automatically run a Javascript. He then got the brilliant idea to combine the two scripts together, tested it and it spread from there."
Read more of this story at Slashdot.
Cyber Gangs Raise Profile of Commercial Online Bank Security

Posted: September 27th, 2009, 7:26pm CEST by Soulskill

Tags: security

tsu doh nimh writes "The Washington Post's Security Fix blog has published a rapid-fire succession of investigative stories on the theft of hundreds of thousands of dollars from companies, schools, and public institutions at the hands of organized cyber thieves and 'money mules,' willing or unwitting people recruited via online job scams. Some businesses are starting to challenge the financial industry's position that they are not responsible for online banking losses from things like keystroke logging malware that attacks customer PCs. Last week, a Maine firm sued its bank, saying the institution's lax approach to so-called multi-factor authentication failed after thieves stole $588,000 from the company, sending the money to dozens of money mules. The same group is thought to have taken $447,000 from a California wrecking company, whose bank also is playing hardball. Most recently, the Post's series outlined a sophisticated online system used by criminals to recruit, track and manage money mules."
Read more of this story at Slashdot.
Ants Vs. Worms — Computer Security Mimics Nature

Posted: September 26th, 2009, 11:14am CEST by Soulskill

Tags: security

An anonymous reader writes with this excerpt from Help Net Security: "In the never-ending battle to protect computer networks from intruders, security experts are deploying a new defense modeled after one of nature's hardiest creatures — the ant. Unlike traditional security devices, which are static, these 'digital ants' wander through computer networks looking for threats ... When a digital ant detects a threat, it doesn't take long for an army of ants to converge at that location, drawing the attention of human operators who step in to investigate. 'Our idea is to deploy 3,000 different types of digital ants, each looking for evidence of a threat,' [says Wake Forest Professor of Computer Science Errin Fulp.] 'As they move about the network, they leave digital trails modeled after the scent trails ants in nature use to guide other ants. Each time a digital ant identifies some evidence, it is programmed to leave behind a stronger scent. Stronger scent trails attract more ants, producing the swarm that marks a potential computer infection.'"
Read more of this story at Slashdot.
Idaho Tops America's Most-Spammed States

Posted: September 24th, 2009, 11:12pm CEST by timothy

Tags: security

An anonymous reader writes "MessageLabs unveiled a list of the top US spammed states, with surprising results — the spam capital of the US is Idaho, with 93.8 percent of spam, far exceeding the global spam rate for September 2009 of 86.4 percent. Idaho has jumped 43 spots since 2008 when it was ranked the 44th most spammed state. The difference can be attributed to the resilient and aggressive botnet market as well as a higher volume of global spam that has ensued since the beginning of the credit crisis toward the end of 2008."
Read more of this story at Slashdot.
Video Surveillance System That Reasons Like a Human

Posted: September 22nd, 2009, 12:08am CEST by ScuttleMonkey

Tags: security

An anonymous reader writes "BRS Labs has created a technology it calls Behavioral Analytics which uses cognitive reasoning, much like the human brain, to process visual data and to identify criminal and terroristic activities. Built on a framework of cognitive learning engines and computer vision, AISight, provides an automated and scalable surveillance solution that analyzes behavioral patterns, activities and scene content without the need for human training, setup, or programming."
Read more of this story at Slashdot.
Spyware Prank Exposes Hospital Medical Records

Posted: September 18th, 2009, 8:23am CEST by kdawson

Tags: security

cheerytt writes "Let this be a lesson to all the broken-hearted geeks out there. A 38-year-old Ohio man is set to plead guilty to federal charges after spyware he meant to install on the computer of a woman he'd had a relationship with ended up infecting computers at a children's hospital. Spyware was sent to the woman's Yahoo e-mail address in the hope it would be used to monitor what his former girlfriend was doing on her PC. But instead, she opened the spyware on a computer in the hospital's pediatric cardiac surgery department. The spyware sent more than 1,000 screen captures via e-mail, including details of medical procedures, diagnostic notes and other confidential information relating to 62 patients. The man will pay $33,000 to the hospital for damages and faces a maximum sentence of five years in prison."
Read more of this story at Slashdot.
Snow Leopard Missed a Security Opportunity

Posted: September 16th, 2009, 2:21pm CEST by kdawson

Tags: security

CWmike writes "Apple missed a golden opportunity to lock down Snow Leopard when it again failed to implement fully a security technology that Microsoft perfected nearly three years ago in Windows Vista, noted Mac researcher Charlie Miller said today. Dubbed ASLR, for address space layout randomization, the technology randomly assigns data to memory to make it tougher for attackers to determine the location of critical operating system functions, and thus makes it harder for them to craft reliable exploits. 'Apple didn't change anything,' said Miller, of Independent Security Evaluators, the co-author of The Mac Hacker's Handbook, and winner of two consecutive 'Pwn2own' hacker contests. 'It's the exact same ASLR as in Leopard, which means it's not very good.'"
Read more of this story at Slashdot.
DHS To Review Report On US Power Grid Vulnerability

Posted: September 15th, 2009, 8:47pm CEST by kdawson

Tags: security

CWmike writes "The US Department of Homeland Security is looking at a report by a research scientist in China that shows how a well-placed attack against a small power subnetwork could trigger a cascading failure of the entire West Coast power grid. Jian-Wei Wang, a network analyst at China's Dalian University of Technology, used publicly available information to model how the West Coast grid and its component subnetworks are connected. Wang and another colleague then investigated how a major outage in one subnetwork would affect adjacent subnetworks. New Scientist magazine reported on this a week or so ago, and the paper has been available since the spring."
Read more of this story at Slashdot.
SANS Report Says Organizations Focusing On the Wrong Security Threats

Posted: September 15th, 2009, 7:09pm CEST by timothy

Tags: security

yahoi writes "Companies around the world are leaving themselves wide open to Web- and client-side attacks, according to a new report released today by the SANS Institute that includes real attack data gathered from multiple sources. SANS found that most organizations are focusing their patching efforts and vulnerability scanning on the operating system, but they're missing the boat: 60 percent of the total number of attacks occur on Web applications, and many attacks are aimed at third-party applications such as Microsoft Office, and Adobe Flash and other tools. Exacerbating the problem, they're taking twice as long to patch Microsoft Office and other applications than to patch their operating systems."
Read more of this story at Slashdot.
Australian ISPs Asked To Cut Off Malware-Infected PCs

Posted: September 15th, 2009, 8:08am CEST by timothy

Tags: security

bennyboy64 writes "Australia's Internet Industry Association has put forward a new code of conduct that suggests ISPs contact, and in some cases disconnect, customers that have malware-infected computers. 'Once an ISP has detected a compromised computer or malicious activity on its network, it should take action to address the problem. ISPs should therefore attempt to identify the end user whose computer has been compromised, and contact them to educate them about the problem,' the new code states. The code won't be mandatory, but it's expected the ISP industry will take it up if they are to work with the Australian Government in preventing the many botnets operating in Australia."
Read more of this story at Slashdot.
New Standard For EU-Compliant Electronic Signatures

Posted: September 14th, 2009, 7:08am CEST by timothy

Tags: security

An anonymous reader writes "ETSI has published a multi-part standard that will facilitate secure paperless business transactions throughout Europe, in conformance with European legislation. The standard defines a series of profiles for PAdES — Advanced Electronic Signatures for PDF documents — that meet the requirements of the European Directive on a Community framework for electronic signatures (Directive 1999/93/EC)."
Read more of this story at Slashdot.
New York Times Site Pop-up Says Your Computer Is Infected

Posted: September 14th, 2009, 1:59am CEST by timothy

Tags: security

Zott writes "Apparently, 'some readers' of the New York Times site are getting a bit more with their news: an apparently syndicated adware popup with a faux virus scan of the user's computer indicating they are infected, and a link to go download a fix now. It's entertaining when a Mac user gets it, but clearly downloading an .exe file isn't a good way to keep your computer clean ..."
Read more of this story at Slashdot.
New York Times Site Pop-Up Says Your Computer Is Infected

Posted: September 14th, 2009, 1:59am CEST by timothy

Tags: security

Zott writes "Apparently, 'some readers' of the New York Times site are getting a bit more with their news: an apparently syndicated adware popup with a faux virus scan of the user's computer indicating they are infected, and a link to go download a fix now. It's entertaining when a Mac user gets it, but clearly downloading an .exe file isn't a good way to keep your computer clean ..." Update: 09/14 03:20 GMT by T : Troy encountered this malware, "and did basic forensics. Summary: iframe ad then series of HTML/JS redirects, ending at a fake virus scanner page with a "Scan" link (made to look like a dialog box button) that downloaded malware." Nice explanation!
Read more of this story at Slashdot.
Google Groups Used To Control Botnets

Posted: September 13th, 2009, 4:41pm CEST by Soulskill

Tags: security

oDDmON oUT writes "'Maintaining a reliable command and control (C&C) structure is a priority for back door Trojan writers. ... Symantec has observed an interesting variation on this concept in the wild. A back door Trojan that we are calling Trojan.Grups has been using the Google Groups newsgroups to distribute commands,' writes Symantec employee Gavin O Gorman. He goes on to state that 'the Trojan itself is quite simple. It is distributed as a DLL,' and while the decrypted commands indicate it is used 'for reconnaissance and targeted attacks,' he does go on record as saying, 'It's worth noting that Google Groups is not at fault here; rather, it is a neutral party. The authors of this threat have chosen Google Groups simply for its bevy of features and versatility.'"
Read more of this story at Slashdot.
First Botnet of Linux Web Servers Discovered

Posted: September 12th, 2009, 8:16pm CEST by kdawson

Tags: security

The Register writes up a Russian security researcher who has uncovered a Linux webserver botnet that is coordinating with a more conventional home-based botnet of Windows machines to distribute malware. "Each of the infected machines examined so far is a dedicated or virtual dedicated server running a legitimate website, Denis Sinegubko, an independent researcher based in Magnitogorsk, Russia, told The Register. But in addition to running an Apache webserver to dish up benign content, they've also been hacked to run a second webserver known as nginx, which serves malware [on port 8080]. 'What we see here is a long awaited botnet of zombie web servers! A group of interconnected infected web servers with [a] common control center involved in malware distribution,' Sinegubko wrote. 'To make things more complex, this botnet of web servers is connected with the botnet of infected home computer(s).'"
Read more of this story at Slashdot.

Slashdot: Linux

First Botnet of Linux Web Servers Discovered

Posted: September 12th, 2009, 8:16pm CEST by kdawson

Tags: security

The Register writes up a Russian security researcher who has uncovered a Linux webserver botnet that is coordinating with a more conventional home-based botnet of Windows machines to distribute malware. "Each of the infected machines examined so far is a dedicated or virtual dedicated server running a legitimate website, Denis Sinegubko, an independent researcher based in Magnitogorsk, Russia, told The Register. But in addition to running an Apache webserver to dish up benign content, they've also been hacked to run a second webserver known as nginx, which serves malware [on port 8080]. 'What we see here is a long awaited botnet of zombie web servers! A group of interconnected infected web servers with [a] common control center involved in malware distribution,' Sinegubko wrote. 'To make things more complex, this botnet of web servers is connected with the botnet of infected home computer(s).'"
Read more of this story at Slashdot.

Slashdot: IT

Vast Malware Repository Dedicated To R&D

Posted: September 10th, 2009, 5:15am CEST by samzenpus

Tags: security

An anonymous reader writes "Dutch company Frame4 group is offering subscriptions for the Malware Distribution Project, a large security archive with a massive collection of downloadable malware and computer underground related information for the purposes of analysis, testing, research and development. Help Net Security has talked with the founder of the project and several other security researchers to get more details on this unique service."
Read more of this story at Slashdot.
Password Hackers Do Big Business With Ex-Lovers

Posted: September 7th, 2009, 6:46pm CEST by ScuttleMonkey

Tags: security

Hugh Pickens writes "The Washington Post reports that disgruntled lovers and spouses considering divorce are flocking to services like YourHackerz.com that boast they have little trouble hacking into Web-based e-mail systems like AOL, Yahoo, Gmail, Facebook and Hotmail. The services advertise openly, and there doesn't appear to be much anyone can do about it because while federal law prohibits hacking into e-mail, without further illegal activity, it's only a misdemeanor, says Orin Kerr, a law professor at George Washington University. 'The feds usually don't have the resources to investigate and prosecute misdemeanors,' says Kerr. 'And part of the reason is that normally it's hard to know when an account has been compromised, because e-mail snooping doesn't leave a trace.' It's not clear where YourHackerz.com is located, but experts suspect that most password hacking businesses are based overseas."
Read more of this story at Slashdot.
Wordpress.org Warns of Active Worm Hacking Blogs

Posted: September 6th, 2009, 12:53am CEST by timothy

Tags: security

Erik writes "Wordpress, the popular open-source Content Management System (CMS) for many thousands of bloggers worldwide, is under attack from a 'clever' worm that automatically compromises unpatched versions of the Wordpress system. The particularly nasty bug crawls the web for vulnerable Wordpress installations, installing malware, deleting content, and generally wreaking havoc wherever it can. Today, Wordpress founder Matt Mullenweg eloquently implored Wordpress bloggers to update more frequently. Originally, updating the Wordpress system was a rather laborious process; however, newer versions offer fast and simple one-click upgrades. The two most recent versions of Wordpress (2.8.3 and 2.8.4) cannot be attacked by the worm discovered this week, and blogs hosted at Wordpress.com are also apparently immune."
Read more of this story at Slashdot.
Code-Breaking Quantum Algorithm On a Silicon Chip

Posted: September 5th, 2009, 2:06am CEST by Soulskill

Tags: security

Urchin writes "Shor's quantum algorithm, which offers a way to crack the commonly-used RSA encryption algorithm, has been demonstrated on a silicon chip for the first time. The algorithm was first demonstrated on large tabletop arrays 3 years ago, but the photonic quantum circuit can now be printed relatively easily onto a silicon chip just 26 mm long. You can see the abstract from the team's academic paper in the journal Science; the full text requires a subscription."
Read more of this story at Slashdot.
Symantec Wants To Use Victims To Hunt Computer Criminals

Posted: September 4th, 2009, 9:48pm CEST by ScuttleMonkey

Tags: security

Hugh Pickens writes "Business Week reports that security experts plan to recruit victims and other computer users to help them go on the offensive and hunt down hackers. '"It's time to stop building burglar alarms to keep people out and go after the bad guys," says Rowan Trollope, senior vice-president for consumer products at Symantec, the largest maker of antivirus software. Symantec will ask customers to opt in to a program that will collect data about attempted computer intrusions and then forward the information to authorities. Symantec will also begin posting the FBI's top 10 hackers and their schemes on its Web site, where customers go for software updates and next year the company will begin offering cash bounties for information leading to an arrest. The strategy has its risks as hackers who find novices on their trail may trash their computers or steal their identities as punishment. Citizen hunters could also become cybervigilantes and harm bystanders as they pursue criminals but Symantec is betting customers won't mind being disrupted if they can help snare the bad guys. "I'm convinced we can clean up the Internet in 10 years if we can peel away the dirt and show people the threats they're facing," says Trollope.'"
Read more of this story at Slashdot.
How To Hire a Hacker

Posted: September 3rd, 2009, 4:16am CEST by samzenpus

Tags: security

itwbennett writes "If you want to hire a hacker, you need to take a more psychology-based approach to the entire interview process to determine whether he or she has changed their ways enough to be a trustworthy employee, says Mich Kabay in a recent Network World blog post. But this approach is also 'germane for highly skilled staffers, even those that don't come with arrest records or who have done something questionable in their pasts,' says David Strom. For example, in your next interview, ask a question that will suss out how much of a sense of entitlement a candidate has — or how much you or your company has. 'One time when I interviewed with Microsoft in Redmond I couldn't get over this sense of corporate entitlement — it was one of the biggest turn-offs that I had during my interviewing day there,' says Strom. 'I got the feeling that I wasn't going to fit in, no matter how smart I thought (or they thought) I was.'"
Read more of this story at Slashdot.
The Myths of Security

Posted: August 31st, 2009, 9:19pm CEST by samzenpus

Tags: security

brothke writes "The Myths of Security: What the Computer Security Industry Doesn't Want You to Know is an interesting and thought-provoking book. Ultimately, the state of information security can be summed up in the book's final three sentences, in which John Viega writes that 'real, timely improvement is possible, but it requires people to care a lot more [about security] than they do. I'm not sure that's going to happen anytime soon. But I hope it does.'" Read on for the rest of Ben's review.
Read more of this story at Slashdot.
Security Test Prompts Federal Fraud Alert

Posted: August 29th, 2009, 5:21pm CEST by Soulskill

Tags: security

itwbennett writes "Johannes Ullrich, chief research officer at the SANS Institute, took great interest in a National Credit Union Administration (NCUA) warning issued earlier this week, thinking, 'Finally this is in the wild, because I've only seen it in pen tests before.' Unfortunately for Mr. Ullrich, the letter and 2 CDs that caused the kerfuffle were part of a sanctioned security test of a bank's computer systems conducted by Ohio-based security company MicroSolved. 'It was a part of some social engineering we were doing in a fully sanctioned penetration test,' said MicroSolved CEO Brent Huston. For his part, NCUA spokesman John McKechnie did not have much to say about his organization's alert, except that 'at this point, it appears that this is an isolated event.'"
Read more of this story at Slashdot.
Crime Expert Backs Call For "License To Compute"

Posted: August 29th, 2009, 12:08am CEST by ScuttleMonkey

Tags: security

The Cable Guy writes to mention that Russel Smith, one of Australia's principal criminologists, is pushing for first-time computer users to be required to earn a license to browse the web. "The Australian Computer Society launched computer driver's licenses in 1999. It aimed to give users a basic level of competency before they started using PCs. But the growth in cybercrime has led to IT security experts such as Eugene Kaspersky to call for more formalized recognition of a user's identity so they can travel the net safely. Last week Dr. Smith sat in front of a Federal Government Inquiry into cybercrime and advised Australia's senior politicians on initiatives in train to fight cybercrime. He said that education was secondary to better technology solutions."
Read more of this story at Slashdot.
Hackers (Or Pen-Testers) Hit Credit Unions With Malware On CD

Posted: August 28th, 2009, 1:40am CEST by timothy

Tags: security

redsoxh8r writes "Online criminals have taken to a decidedly low-tech method for distributing the latest batch of targeted malware: mailing infected CDs to credit unions. The discs have been showing up at credit unions around the country recently, a throwback to the days when viruses and Trojans were distributed via floppy disk. The scam is elegant in its simplicity. The potential thieves are mailing letters that purport to come from the National Credit Union Administration, the federal agency that charters and insures credit unions, and including two CDs in the package. The letter is a fake fraud alert from the NCUA, instructing recipients to review the training materials contained on the discs. However, the CDs are loaded with malware rather than training programs." According to the linked article, the infected CDs were (or at least may have been) part of a penetration test, rather than an actual attack.
Read more of this story at Slashdot.
Coder of Swiss Wiretapping Trojan Speaks Out

Posted: August 26th, 2009, 4:41pm CEST by Soulskill

Tags: security

Lars Sobiraj writes "Ruben Unteregger has worked for a long time as a software-engineer for the Swiss company ERA IT Solutions. His job there was to code malware that would invade PCs of private users, and allow the wiretapping of VoIP calls — in particular, calls made through Skype. In the German-speaking areas of the country, the Trojans were called 'Bundestrojaner' because the Swiss government was involved with their development and use. Unfortunately, Unteregger has to remain silent about the customers of the company. Last night, he published the source code of his Skype-Trojan under the GPL."
Read more of this story at Slashdot.
Offshore Drilling Rigs Vulnerable To Hackers

Posted: August 26th, 2009, 3:08pm CEST by Soulskill

Tags: security

Hugh Pickens writes "Foreign Policy magazine reports that a research team from the SINTEF Group, an independent Norwegian think tank, has warned oil companies worldwide that offshore oil rigs are highly vulnerable to hacking as they shift to unmanned robot platforms where vital operations — everything from data transmission to drilling to sophisticated navigation systems that maintain the platform's position over the wellhead — are controlled via wireless links to onshore facilities. 'The worst-case scenario, of course, is that a hacker will break in and take over control of the whole platform,' says Martin Gilje Jaatun, adding that it hasn't happened yet, but computer viruses have caused personnel injuries and production losses on North Sea platforms. The list of potential cyberattackers includes ecowarriors aiming to jack up an oil firms' production costs, extortionists drawn to oil firms' deep pockets, and foreign governments engaging in a strategic contest for ever-more-scarce global oil reserves, says Jeff Vail, a former counterterrorism and intelligence analyst with the US Interior Department. 'It's underappreciated how vulnerable some of these systems are,' says Vail. 'It is possible, if you really understood them, to cause catastrophic damage by causing safety systems to fail.'"
Read more of this story at Slashdot.
Banks Urge Businesses To Lock Down Online Banking

Posted: August 26th, 2009, 2:14am CEST by kdawson

Tags: security

tsu doh nimh writes "Organized cyber-gangs in Eastern Europe are increasingly preying on small and mid-size companies in the US, setting off a multimillion-dollar online crime wave that has begun to worry the nation's largest financial institutions, The Washington Post's Security Fix blog reports: '"In the past six months, financial institutions, security companies, the media and law enforcement agencies are all reporting a significant increase in funds transfer fraud involving the exploitation of valid banking credentials belonging to small and medium sized businesses," reads a confidential alert issued by the Financial Services Information Sharing and Analysis Center, an industry group created to share data about critical threats to the financial sector.' The banking group is urging that commercial bank customers 'carry out all online banking activity from a standalone, hardened, and locked-down computer from which e-mail and Web browsing is not possible.' The story includes interviews with several victim businesses, and explains that in each case, the fraudsters — thought to reside in Eastern Europe — are using "'money mules,' unwitting or willing accomplices in the US hired via Internet job boards. The blog has more stories and details about these crimes."
Read more of this story at Slashdot.
Report That OS X Snow Leopard May Include Antivirus

Posted: August 25th, 2009, 10:02pm CEST by kdawson

Tags: security

File this firmly in the "rumor" category for now. the JoshMeister writes (in the third person) "Mac antivirus company Intego broke the story this morning that Apple is apparently including antivirus functionality in its upcoming operating system, Snow Leopard. But which antivirus engine is Apple using? Security researcher Joshua Long discusses the likely candidates."
Read more of this story at Slashdot.
IE Should Use Google's Malware List

Posted: August 25th, 2009, 4:30pm CEST by timothy

Tags: security

Frequent contributor Bennett Haselton writes with an idea that he thinks could help keep browsing on Microsoft's browser more secure for users — and benefit Microsoft as a result. "Tests show that IE's malware filter performs well against other browsers that use the Safe Browsing blacklist from Google. But wouldn't IE's filter be even more effective if it used both filter lists at the same time? And are the political obstacles to that really so insurmountable?" Read on for the rest of a plan that seems a lot more than half-baked.
Read more of this story at Slashdot.
What Is the Best Way To Track Stolen Gadgets?

Posted: August 25th, 2009, 3:22pm CEST by timothy

Tags: security

An anonymous reader writes "Now that gadgets can determine their location and phone home, many companies are creating tools for finding lost and stolen gadgets. It sounds like a simple process, but this NY Times article describes a number of wildly different approaches. Some report all of the information back to the owner while others deliberately keep the owner in the dark to avoid dangerous confrontations. Some start grabbing pictures from the web cameras and logging keystrokes. Others just record IP addresses. Some don't do anything but record serial numbers to make it easier for the police to do their job. Are sophisticated systems dangerous because the tracking mechanisms could be misused to violate the privacy of the owner? Are the stakes different when a company purchases the software and gives the IT manager the ability to track everyone in the company? What are the best practices that are emerging? What should I recommend if my boss reads this article and wants to track our laptops and Blackberries?"
Read more of this story at Slashdot.
Vulnerability, Potential Exploit In Cisco WLAN APs

Posted: August 25th, 2009, 2:37pm CEST by timothy

Tags: security

An anonymous reader writes "The AirMagnet Intrusion Research Team has uncovered a new wireless vulnerability and potential exploit associated with Cisco wireless LAN infrastructure. The vulnerability involves Cisco's Over-the-Air-Provisioning (OTAP) feature found in its wireless access points. The potential exploit, dubbed SkyJack by AirMagnet, creates a situation whereby control of a Cisco AP can be obtained, whether intentionally or unintentionally, to gain access to a customer's wireless LAN."
Read more of this story at Slashdot.
Real-Time Keyloggers

Posted: August 23rd, 2009, 11:18pm CEST by kdawson

Tags: security

The NY Times has a story and a blog backgrounder focusing on a weapon now being wielded by bad guys (most likely in Eastern Europe, according to the Times): Trojan horse keyloggers that report back in real-time. The capability came to light in a court filing (PDF) by Project Honey Pot against "John Doe" thieves. The case was filed in order to compel the banks — which are almost as secretive as the cyber-crooks — to reveal information such as IP addresses that could lead back to the miscreants. Or at least allow victims to be notified. Real-time keyloggers were first discovered in the wild last year, but the court filing and the Times article should bring new attention to the threat. The technique menaces the 2-factor authentication that some banks have instituted: "By going real time, hackers now can get around some of the roadblocks that companies have put in their way. Most significantly, they are now undeterred by systems that create temporary passwords, such as RSA's SecurID system, which involves a small gadget that displays a six-digit number that changes every minute based on a complex formula. If [your] computer is infected, the Trojan zaps your temporary password back to the waiting hacker who immediately uses it to log onto your account. Sometimes, the hacker logs on from his own computer, probably using tricks to hide its location. Other times, the Trojan allows the hacker to control your computer, opening a browser session that you can't see."
Read more of this story at Slashdot.
EVE Bans Exploiters; Dropping 2% of Users Cuts Average CPU Usage 30%

Posted: August 22nd, 2009, 5:14pm CEST by Soulskill

Tags: security

Earthquake Retrofit writes "Ars has a story about EVE Online banning thousands of accounts for real-world trading of in-game money for profit. From the article: 'Those who buy and sell ISK, the game's currency, are not only exploiting the game, but unbalancing play. That's why the company decided to go drastic: a program they called "Unholy Rage." For weeks they studied the behavior and effects these real-money traders had on the game, and then they struck. During scheduled maintenance, over 6,000 accounts were banned. [Einar Hreiðarsson, EVE's lead GM,] assures us that the methods were sound, and the bannings went off with surgical precision. ... While the number of accounts banned in the opening phase of the operation constituted around 2 percent of the total active registered accounts, the CPU per user usage was cut by a good 30 percent.' Looks like they got the right 6,000.' Further information and more graphs are available from the EVE dev blog."
Read more of this story at Slashdot.
Criminals Prefer Firefox, Opera Web Browsers

Posted: August 22nd, 2009, 12:37am CEST by CmdrTaco

Tags: security

An anonymous reader writes "Security researchers at Purewire have leveraged vulnerabilities in malware infrastructure to track the criminals behind it. In a three-month long project, they used security flaws in exploit kits to get operators to expose themselves (Obnoxious interstitial ad between link and content) when they access the kits' admin control panels. Data collected shows that 50% of those tracked use Firefox, while 25% use Opera."
Read more of this story at Slashdot.
Scientists Find Way To Combat Forged DNA

Posted: August 21st, 2009, 11:11pm CEST by ScuttleMonkey

Tags: security

An anonymous reader writes to tell us that while scientists may have learned how to forge DNA, it appears that a group of Israeli scientists has created a DNA authentication method that is able to distinguish between real and faked DNA samples. "The new process was tested on natural and artificial samples of blood, saliva and touched surfaces, with complete success, Nucleix said. It also identifies 'contaminated' DNA that has been mixed with two or more samples."
Read more of this story at Slashdot.
Ten Ways To Destroy a Hard Disk

Posted: August 21st, 2009, 8:18pm CEST by samzenpus

Tags: security

Barence writes "Following his blog last week about the home-made hard disk destroyer, Bustadrive, Mike Jennings was deluged with comments from readers, both on the blog and here on Slashdot. Most seemed to like the product, but also offered up far more innovative and madcap methods of hard disk destruction, with a wide range of implements used — household and otherwise. In this follow-up post, he rounds up the best of an imaginative bunch of hard disk destruction methods."
Read more of this story at Slashdot.
Australian Police Database Lacked Root Password

Posted: August 19th, 2009, 4:02am CEST by kdawson

Tags: security

Concerned Citizen writes "The Australian Federal Police database has been hacked, although 'hacked' might be too strong a word for what happens when someone gains access to a MySQL database with no root password. Can you be charged with breaking and entering a house that has the door left wide open? Maybe digital trespassing is a better term for this situation. 'These dipshits are using an automatic digital forensics and incident response tool,' the hacker wrote. 'All of this [hacking] had been done within 30-40 minutes. Could of [sic] been faster if I didn't stop to laugh so much.'"
Read more of this story at Slashdot.
Predicting Malicious Web Attacks

Posted: August 18th, 2009, 10:13pm CEST by kdawson

Tags: security

KentuckyFC writes "Recommendation systems attempt to guess what books, movies, or news people are likely to be interested in. Companies such as Amazon, Google, and Netflix have developed algorithms to mine vast databases looking for correlations that they then use to recommend new items. Now a team of computer scientists has used some of the same filtering techniques to predict the origin of malicious Web attacks so that they can be blacklisted in advance. The team mined a database of hundreds of millions of security logs looking for correlations between victims. The correlations were then used to produce a predictive blacklist of potential attackers. The team says its algorithm is up to 70 per cent more successful at predicting the origin of attacks than current state-of-the-art predictive blacklisting."
Read more of this story at Slashdot.
Three Indicted In Huge Identity/Data Breach

Posted: August 18th, 2009, 12:53am CEST by kdawson

Tags: security

ScentCone and other readers let us know about an indictment just unsealed in federal court for stealing 130 million credit cards and other data useful in identity theft, or just plain money theft. The breaches were at payment processor Heartland (accounting for the bulk of the 130M), Hannaford, 7-11, and two unnamed "national retailers." Interestingly, the focus of the indictment, Albert "Segvec" Gonzalez, is currently awaiting trial for masterminding the TJX break-in, which until Heartland counted as the largest credit-card theft ever. The indictment cites SQL injection attacks as the entry vector. Two unnamed Russia-based conspirators were also indicted. Securosis has analysis of the security implications of the breach ("These appear to be preventable attacks using common security controls. It's possible some advanced techniques were used, but I doubt it") and the attackers' methodology.
Read more of this story at Slashdot.
The Homemade Hard Disk Destroyer

Posted: August 17th, 2009, 2:51pm CEST by CmdrTaco

Tags: security

Barence writes "All businesses have sensitive data they need to destroy when they replace PCs, but disposing of hard disks properly can be an expensive business. This has led one IT manager in the UK to come up with his own, homemade solution — Bustadrive. It uses a powerful 'hydraulic punch' to physically deform a hard disk, rendering it virtually unreadable, and requires nothing more than a pull of the lever on the front — similar to a drinks-can crusher. PC Pro tested the Bustadrive, and also sought the opinions of data destruction companies as to whether the device was really as effective as hoped, or just a fun way to mangle a hard disk or two."
Read more of this story at Slashdot.
Amazon Confirms EC2/S3 Not PCI Level 1 Compliant

Posted: August 17th, 2009, 8:31am CEST by timothy

Tags: security

Jason writes "After months of digging though speculation and polar opposite opinions from PCI experts, I finally sent a direct request to Amazon's AWS sales team asking if they are in fact PCI compliant and will provide documentation attesting that they are as is required by PCI guidlines. I fully expecting them to dodge the question and refer me to a QSA, but to my relief, they replied with a refreshingly honest and absolute confirmation that it is currently impossible to meet PCI level 1 compliance using AWS services for card data storage. They also very strong suggest that cardnumbers never be stored on EC2 or S3 as those services are inherently noncompliant. For now at least, the official verdict is if you need to process credit cards, the Amazon cloud platform is off the table."
Read more of this story at Slashdot.
Twitter Used To Control Botnet Machines

Posted: August 14th, 2009, 10:35pm CEST by ScuttleMonkey

Tags: security

DikSeaCup writes "Arbor Network's Jose Nazario, an expert on botnets, discovered what looks to be the first reported case of hackers using Twitter to control botnets. 'Hackers have long used IRC chat rooms to control botnets, and have continually used clever technologies, such as peer-to-peer strategies, to counter efforts to track, disrupt and sometimes decapitate the bots. Perhaps what's surprising then is that it's taken so long for hackers to take Twitter to the dark side.' The next step, of course, is to code the tweets in such a way that they aren't so suspicious."
Read more of this story at Slashdot.
Local Privilege Escalation On All Linux Kernels

Posted: August 13th, 2009, 10:54pm CEST by timothy

Tags: security

QuesarVII writes "Tavis Ormandy and Julien Tinnes have discovered a severe security flaw in all 2.4 and 2.6 kernels since 2001 on all architectures. 'Since it leads to the kernel executing code at NULL, the vulnerability is as trivial as it can get to exploit: an attacker can just put code in the first page that will get executed with kernel privileges.'"
Read more of this story at Slashdot.

Slashdot: Linux

Local Privilege Escalation On All Linux Kernels

Posted: August 13th, 2009, 10:54pm CEST by timothy

Tags: security

QuesarVII writes "Tavis Ormandy and Julien Tinnes have discovered a severe security flaw in all 2.4 and 2.6 kernels since 2001 on all architectures. 'Since it leads to the kernel executing code at NULL, the vulnerability is as trivial as it can get to exploit: an attacker can just put code in the first page that will get executed with kernel privileges.'"
Read more of this story at Slashdot.

Slashdot: IT

How Much Does a Reputation For Security Matter Anymore?

Posted: August 12th, 2009, 5:49pm CEST by Soulskill

Tags: security

dasButcher writes "We often hear that businesses risk their corporate reputations if they don't have adequate security. It's been a common refrain among those selling security technologies: protect your data or suffer the reputational consequences. But, as Larry Walsh points out, the evidence is against this notion. Even companies that have suffered major security breaches — TJX, Hannaford, etc. — have suffered little lasting damage to their reputation. So, does this mean that reputational concerns are simply bunk?"
Read more of this story at Slashdot.
WordPress Exploit Allows Admin Password Reset

Posted: August 12th, 2009, 5:04pm CEST by Soulskill

Tags: security

Multiple readers have sent word of a vulnerability in WordPress 2.8.3 which allows anyone to lock an admin out of his or her account by resetting the password. "The bug ... is trivial to exploit remotely using nothing more than a web browser and a specially manipulated link. Typically, requests to reset a password are handled using a registered email address. Using the special URL, the old password is removed and a new one generated in its place with no confirmation required." An alert on the Full Disclosure mailing list detailed the vulnerability, and WordPress quickly rolled out version 2.8.4 to address the issue.
Read more of this story at Slashdot.
Voting Machine Attacks Proven To Be Practical

Posted: August 11th, 2009, 7:51pm CEST by kdawson

Tags: security

An anonymous reader writes "Every time a bunch of academics show vulnerabilities in electronic voting machines, critics complain that the attacks aren't realistic, that attackers won't have access to source code, or design documents, or be able to manipulate the hardware, etc. So this time a bunch of computer scientists from UCSD, Michigan, and Princeton offered a rebuttal. They completely own the AVC Advantage using no access to source code or design documents (PDF), and deliver a complete working attack in a plug-in cartridge that could be used by anyone with a few private minutes with the machine. Moreover, they came up with some cool tricks to do this on a machine protected against traditional code injection attacks (the AVC processor will only execute instructions from ROM). The research was presented at this week's USENIX EVT."
Read more of this story at Slashdot.
Schneier On Self-Enforcing Protocols

Posted: August 11th, 2009, 4:36pm CEST by timothy

Tags: security

Hollow Being writes "In an essay posted to Threatpost, Bruce Schneier makes the argument that self-enforcing protocols are better suited to security and problem-solving. From the article: 'Self-enforcing protocols are safer than other types because participants don't gain an advantage from cheating. Modern voting systems are rife with the potential for cheating, but an open show of hands in a room — one that everyone in the room can count for himself — is self-enforcing. On the other hand, there's no secret ballot, late voters are potentially subjected to coercion, and it doesn't scale well to large elections. But there are mathematical election protocols that have self-enforcing properties, and some cryptographers have suggested their use in elections.'"
Read more of this story at Slashdot.
The iPhone SMS Hack Explained

Posted: August 10th, 2009, 2:12pm CEST by timothy

Tags: security

GhostX9 writes "Tom's Hardware just interviewed Charlie Miller, the man behind the iPhone remote exploit hack and winner of Pwn2Own 2009. He explains the (now patched) bug in the iPhone which allowed him to remotely exploit the iPhone in detail, explaining how the string concatenation code was flawed. The most surprising thing was that the bug could be traced back to several previous generations of the iPhone OS (he stopped testing at version 2.2). He also talks about the failures of other devices, such as crashing HTC's Touch by sending a SMS with '%n' in the text."
Read more of this story at Slashdot.
Poor Passwords A Worse Problem Than Poor Antivirus

Posted: August 8th, 2009, 9:40pm CEST by timothy

Tags: security

dasButcher writes "Viruses and worms get all the headlines, but poor password management is a worse problem according to a new study by Channel Insider and CompTIA. As Larry Walsh writes in his Security Channel blog, VARs and security service providers say they find more problems with password management than antivirus applications when they do security assessments. While password problems are nothing new, Walsh and those posting on his blog correctly assert that users remain cavalier about passwords and businesses are doing too little to address this serious vulnerability."
Read more of this story at Slashdot.
Twitter, Facebook DDoS Attack Targeted One User

Posted: August 7th, 2009, 3:54pm CEST by kdawson

Tags: security

An anonymous reader writes "A Georgian blogger with accounts on Twitter, Facebook, LiveJournal, and Google's Blogger and YouTube was targeted in a denial of service attack that led to yesterday's site-wide outage at Twitter and problems at the other sites on, according to a Facebook executive. The blogger, who uses the account name 'Cyxymu' (the name of a town in the Republic of Georgia), had accounts on all of the different sites that were attacked at the same time, Max Kelly, chief security officer at Facebook, told CNet News." Here are user Cyxymu's LiveJournal Google cache and LiveJournal account (unreachable at this writing). Larry Magid writes on CNet that this individual blogs about independence of a breakaway region of Georgia. Macworld has some speculation in other directions on the motivations behind the DDoS attack. Update: 08/07 19:52 GMT by KD : Cyber attacks on Cyxymu are not new. For over a year Evgeny Morozov has been calling attention to him as the first digital refugee.
Read more of this story at Slashdot.
UK National ID Card Cloned In 12 Minutes

Posted: August 7th, 2009, 10:50am CEST by timothy

Tags: security

Death Metal writes with this excerpt from Computer Weekly, which casts some doubt on the security of the UK's proposed personal identification credential: "The prospective national ID card was broken and cloned in 12 minutes, the Daily Mail revealed this morning. The newspaper hired computer expert Adam Laurie to test the security that protects the information embedded in the chip on the card. Using a Nokia mobile phone and a laptop computer, Laurie was able to copy the data on a card that is being issued to foreign nationals in minutes."
Read more of this story at Slashdot.
How Can I Tell If My Computer Is Part of a Botnet?

Posted: August 6th, 2009, 10:59pm CEST by timothy

Tags: security

ashraya writes "My father (not too computer literate) has a desktop and a laptop both running Windows in his network back in Hyderabad, India. I set up a Linksys router for him to use with his broadband service. For some reason, he reset the config on the Linksys, and connected it up without wireless security, and also with the default admin password for some time. As you would expect, both of the Windows computers got 'slow,' and the desktop stopped connecting to the internet completely for some reason. As I logged in remotely to 'fix' things, I noticed on the Linksys' log that the laptop was making seemingly random connections to high-numbered ports on various IPs. I did an nslookup on the IPs to see that they were all either in Canada or US, with Comcast and other ISP addresses. Is that a sign that the computers were in a botnet? Are the other hosts part of the botnet too? (I have since rebuilt the Windows hosts, and these connections are not happening now. I have also secured the Linksys.)"
Read more of this story at Slashdot.
Feds At DefCon Alarmed After RFIDs Scanned

Posted: August 6th, 2009, 3:40pm CEST by CmdrTaco

Tags: security

FourthAge writes "Federal agents at the Defcon 17 conference were shocked to discover that they had been caught in the sights of an RFID reader connected to a web camera. The reader sniffed data from RFID-enabled ID cards and other documents carried by attendees in pockets and backpacks. The 'security enhancing' RFID chips are now found in passports, official documents and ID cards. 'For $30 to $50, the common, average person can put [a portable RFID-reading kit] together,' said security expert Brian Marcus, one of the people behind the RFID webcam project. 'This is why we're so adamant about making people aware this is very dangerous.'"
Read more of this story at Slashdot.
XML Library Flaw — Sun, Apache, GNOME Affected

Posted: August 5th, 2009, 6:27pm CEST by Soulskill

Tags: security

bednarz writes with this excerpt from Network World: "Vulnerabilities discovered in XML libraries from Sun, the Apache Software Foundation, the Python Software Foundation and the GNOME Project could result in successful denial-of-service attacks on applications built with them, according to Codenomicon. The security vendor found flaws in XML parsers that made it fairly easy to cause a DoS attack, corruption of data, and delivery of a malicious payload using XML-based content. Codenomicon has shared its findings with industry and the open source groups, and a number of recommendations and patches for the XML-related vulnerabilities are expected to be made available Wednesday. In addition, a general security advisory is expected to be published by the Computer Emergency Response Team in Finland (CERT-FI)."
Read more of this story at Slashdot.
Null-Prefix SSL Attacks Enabled In New sslsniff

Posted: August 4th, 2009, 3:53pm CEST by timothy

Tags: security

An anonymous reader writes "Moxie Marlinspike, who recently published new attacks on SSL at Defcon 17, seems to have released the new version of sslsniff which supports these attacks. While the release appears to coincide with a patch from Mozilla, every product that uses the Microsoft CryptoAPI is still vulnerable, including Internet Explorer and Outlook. The new version of sslsniff also supports built-in modes for hijacking software auto-updates that depend on SSL, and apparently includes techniques for defeating OCSP as well — making the elimination of existing null-prefix certificates difficult."
Read more of this story at Slashdot.
Entropy Problems For Linux In the Cloud

Posted: August 4th, 2009, 2:29am CEST by kdawson

Tags: security

CalTrumpet writes "Our research group recently spoke at Black Hat USA on the topic of cloud computing security. One of the interesting outcomes of our research was the discovery that the combination of virtualization technologies and public system images results in a problem for random number generation on guest operating systems. This is especially true for Linux, since its PRNG uses only a small set of entropy-gathering events, and virtual Linux images often generate SSH host keys within seconds of their initial boot. The slides are available; the PRNG vulnerability material begins at slide 63."
Read more of this story at Slashdot.

Slashdot: Linux

Entropy Problems For Linux In the Cloud

Posted: August 4th, 2009, 2:29am CEST by kdawson

Tags: security

CalTrumpet writes "Our research group recently spoke at Black Hat USA on the topic of cloud computing security. One of the interesting outcomes of our research was the discovery that the combination of virtualization technologies and public system images results in a problem for random number generation on guest operating systems. This is especially true for Linux, since its PRNG uses only a small set of entropy-gathering events, and virtual Linux images often generate SSH host keys within seconds of their initial boot. The slides are available; the PRNG vulnerability material begins at slide 63."
Read more of this story at Slashdot.

Slashdot: IT

First Ever Criminal Arrest For Domain Name Theft

Posted: August 3rd, 2009, 9:11pm CEST by ScuttleMonkey

Tags: security

Domain Name News writes "Until recently, there hasn't been a case of a domain theft where the thief was caught and arrested. However, on July 30th, Daniel Goncalves was arrested at his home in Union, New Jersey and charged in a landmark case, the first criminal arrest for domain name theft in the United States. 'Cases of domain name theft have not typically involved a criminal prosecution because of the complexities, financial restraints and sheer time and energy involved. If a domain name is stolen, the victim of the crime in most cases would need experience with the technical and legal intricacies associated with the domain name system. To move the case forward, they would also need a law enforcement professional who understands the case or is willing to take the time to learn. For example, the Angels told us that in their case they called their local law enforcement in Florida who sent a uniformed officer in a squad car to their home. The first thing you can imagine the officer asked was, "What's a domain?"'"
Read more of this story at Slashdot.
Has Conficker Been Abandoned By Its Authors?

Posted: August 3rd, 2009, 6:19pm CEST by CmdrTaco

Tags: security

darthcamaro writes "Remember Conficker? April first doom and gloom and all? Well apparently after infecting over five million IP addresses, it's now an autonomous botnet working on its own without any master command and control. Speaking at the Black Hat/Defcon Hat security conference in Las Vegas, Mikko Hypponen, chief research officer at security firm F-Secure, was told not to talk in detail about the Conficker gang — the problem is that not all researchers were under the same gag order. Just ask Roel Schouwenberg, senior anti-virus researcher at security firm Kaspersky, who says 'The Conficker botnet is autonomous; that is very strange in itself that they made Conficker replicate by itself. Now it seems like the authors have abandoned the project, but because it is autonomous, it can do whatever it wants and it keeps on trying to find new hosts to infect.'"
Read more of this story at Slashdot.
Scammer Plants a Fake ATM At Defcon 17

Posted: August 3rd, 2009, 12:22am CEST by kdawson

Tags: security

Groo Wanderer writes "Normally, a well-crafted fake ATM would skim a lot of card information before it was noticed, if it was ever noticed at all. Because it is safer for the criminals and harder to prosecute, financial crimes like this are spreading fast. If you are smart, you don't try to pull one off in the middle of a computer security convention where the attendees are very good at spotting such scams. That said, some not-so-bright criminal tried to plant a fake ATM at Defcon. He now has one less fake ATM and a whole lot of investigators on his tail."
Read more of this story at Slashdot.
Bootkit Bypasses TrueCrypt Encryption

Posted: August 2nd, 2009, 1:43am CEST by timothy

Tags: security

mattOzan writes with this excerpt from H-online: "At Black Hat USA 2009, Austrian IT security specialist Peter Kleissner presented a bootkit called Stoned which is capable of bypassing the TrueCrypt partition and system encryption. The bootkit uses a 'double forward' to redirect I/O interrupt 13h, which allows it to insert itself between the Windows calls and TrueCrypt."
Read more of this story at Slashdot.
Apple Keyboard Firmware Hack Demonstrated

Posted: August 1st, 2009, 7:24pm CEST by Soulskill

Tags: security

Anonymouse writes with this excerpt from SemiAccurate: "Apple keyboards are vulnerable to a hack that puts keyloggers and malware directly into the device's firmware. This could be a serious problem, and now that the presentation and code (PDF) is out there, the bad guys will surely be exploiting it. The vulnerability was discovered by K. Chen, and he gave a talk on it at Black Hat this year (PDF). The concept is simple: a modern Apple keyboard has about 8K of flash memory, and 256 bytes of working RAM. For the intelligent, this is more than enough space to have a field day. ... The new firmware can do anything you want it to. Chen demonstrated code which, when you put in a password and hit return, starts playing back the last five characters typed in, LIFO. It is a rudimentary keylogger; a proof of concept more than anything else. Since there is about 1K of flash free in the keyboard itself, you can log quite a few keystrokes totally transparently."
Read more of this story at Slashdot.
Linux, Twitter, and Red Hat "Win" Big At Pwnie Awards

Posted: August 1st, 2009, 2:03am CEST by Soulskill

Tags: security

hugmeplz writes "The third annual Pwnie Awards took place last night at Black Hat in Las Vegas, and a full list of the winners has been posted. 'Most Epic Fail' honors went to the notorious Twitter/Google Apps hack from earlier this month that raised all sorts of questions about cloud computing security. Red Hat got skewered with the 'Mass 0wnage' award, also known as the 'Pwnie for Breaking the Internet,' for issuing a version of OpenSSH that left a backdoor open to hackers. The Linux development team earned 'Lamest Vendor Response' recognition for 'continually assuming that all kernel memory corruption bugs are only Denial-of-Service.' Naturally, Microsoft didn't slip past judges' eyes. Its vulnerability that enabled the Conficker worm to do its thing earned honors as the 'Most Overhyped Bug.' On the more positive side, the Pwnie Awards recognized security pros Wei Yongjun, sgrakkyu, Sebastian Kramer and Bernhard Mueller for accomplishments such as discovering bugs and demonstrating exploits. The Pwnie for Best Song went to Doctor Braid for his song Nice Report. Solar Designer snagged the Lifetime Achievement Award, for among other things, being the first to demonstrate heap buffer overflow exploitation, according to the Pwnie Awards Web site."
Read more of this story at Slashdot.

Slashdot: Linux

Linux, Twitter, and Red Hat "Win" Big At Pwnie Awards

Posted: August 1st, 2009, 2:03am CEST by Soulskill

Tags: security

hugmeplz writes "The third annual Pwnie Awards took place last night at Black Hat in Las Vegas, and a full list of the winners has been posted. 'Most Epic Fail' honors went to the notorious Twitter/Google Apps hack from earlier this month that raised all sorts of questions about cloud computing security. Red Hat got skewered with the 'Mass 0wnage' award, also known as the 'Pwnie for Breaking the Internet,' for issuing a version of OpenSSH that left a backdoor open to hackers. The Linux development team earned 'Lamest Vendor Response' recognition for 'continually assuming that all kernel memory corruption bugs are only Denial-of-Service.' Naturally, Microsoft didn't slip past judges' eyes. Its vulnerability that enabled the Conficker worm to do its thing earned honors as the 'Most Overhyped Bug.' On the more positive side, the Pwnie Awards recognized security pros Wei Yongjun, sgrakkyu, Sebastian Kramer and Bernhard Mueller for accomplishments such as discovering bugs and demonstrating exploits. The Pwnie for Best Song went to Doctor Braid for his song Nice Report. Solar Designer snagged the Lifetime Achievement Award, for among other things, being the first to demonstrate heap buffer overflow exploitation, according to the Pwnie Awards Web site."
Read more of this story at Slashdot.

Slashdot: IT

BIOS "Rootkit" Preloaded In 60% of New Laptops

Posted: July 31st, 2009, 5:45pm CEST by kdawson

Tags: security

Keldrin_1 writes "Researchers Alfredo Ortega and Anibal Sacco, from Core Security Technologies, have discovered a vulnerability in the 'Computrace LoJack for Laptops' software. This is a BIOS-level application that calls home for instructions in case the laptop is ever lost or stolen. However, what the application considers 'home' is subject to change. This allows the creation of malware capable of 'infecting the BIOS with persistent code that survive reboots and reflashing attempts.' Computers from Dell, Lenovo, HP, Toshiba, Asus, and others may be affected."
Read more of this story at Slashdot.
Hackers Get Free Parking In San Francisco

Posted: July 31st, 2009, 1:58pm CEST by timothy

Tags: security

Hugh Pickens writes "PC World reports that at the Black Hat security conference this week, security researchers say that it is pretty easy for a technically savvy hacker to make a fake payment card that gives them unlimited free parking on San Francisco's smart parking meter system. 'It wasn't technically complicated and the fact that I can do it in three days means that other people are probably already doing it and probably taking advantage of it,' says Joe Grand. 'It seems like the system wasn't analyzed at all.' To figure out how the payment system worked, Grand hooked up an oscilloscope to a parking meter and monitored what happened when he used a genuine payment card. Grand discovered the cards aren't digitally signed, and the only authentication between the meter and card is a password sent from the former to the latter. Examining the meters themselves could yield additional vulnerabilities that might allow someone to conduct other kinds of attacks, such as propagating a virus from meter to meter via the smart cards or a meter minder's PDA."
Read more of this story at Slashdot.
Adobe Security Updates For Flash and Shockwave

Posted: July 31st, 2009, 3:43am CEST by timothy

Tags: security

nlewis writes "Adobe has finally released updates for their Flash and Shockwave Players. These updates should, in theory, address the security issues outlined in this security bulletin. This issue has been mentioned here previously. Don't expect an update to the equally flawed Acrobat Reader until sometime tomorrow, though."
Read more of this story at Slashdot.
Null Character Hack Allows SSL Spoofing

Posted: July 30th, 2009, 8:43pm CEST by timothy

Tags: security

eldavojohn writes "Two researchers, Dan Kaminsky and Moxie Marlinspike, came up with exact same way to fake being a popular website with authentication from a certificate authority. Wired has the details: 'When an attacker who owns his own domain — badguy.com — requests a certificate from the CA, the CA, using contact information from Whois records, sends him an email asking to confirm his ownership of the site. But an attacker can also request a certificate for a subdomain of his site, such as Paypal.com.badguy.com, using the null character in the URL. The CA will issue the certificate for a domain like PayPal.com.badguy.com because the hacker legitimately owns the root domain badguy.com. Then, due to a flaw found in the way SSL is implemented in many browsers, Firefox and others theoretically can be fooled into reading his certificate as if it were one that came from the authentic PayPal site. Basically when these vulnerable browsers check the domain name contained in the attacker's certificate, they stop reading any characters that follow the " in the name.'"
Read more of this story at Slashdot.
MI5 Website Breached By Hacker

Posted: July 30th, 2009, 2:49pm CEST by CmdrTaco

Tags: security

Jack Spine writes "UK intelligence agency MI5 has admitted that its website security was breached by hacker group Team Elite. A member of the hacker forum posted details of the hack last week, which took advantage of a cross-site scripting vulnerability in the site's Google embedded search. MI5 admitted the breach on Wednesday, but said that the flaw had not been exploited maliciously."
Read more of this story at Slashdot.
McAfee Leaks Conference Attendees' Personal Info

Posted: July 30th, 2009, 1:57pm CEST by samzenpus

Tags: security

Timmy writes "In the cruelest of ironies, e-mail security vendor McAfee has accidentally coughed up the personal details of some 1400 attendees of its recent security conference in Sydney, Australia. Those who were sent the list — attached as a spreadsheet to a thank you e-mail — are far from pleased that such an extraordinary thing could happen. McAfee, which sells products to 'stop sensitive and protected data from leaving the enterprise through email and web traffic' has blamed 'human error' for the blunder and is 'taking steps to ensure it doesn't happen again.' Doh!"
Read more of this story at Slashdot.
P2P Network Exposes Obama's Safehouse Location

Posted: July 29th, 2009, 10:20pm CEST by timothy

Tags: security

Lucas123 writes "The location of the safe house used in times of emergency for the First Family was leaked on a LimeWire file-sharing network recently, a fact revealed today to members of the House Oversight and Government Reform Committee. Along with the safe house location, the LimeWire networks also disclosed presidential motorcade routes, as well as sensitive but unclassified document that listed details on every nuclear facility in the country. Now lawmakers are considering a bill to ban P2P use on government, contractor networks."
Read more of this story at Slashdot.
Tetraktys

Posted: July 29th, 2009, 8:09pm CEST by samzenpus

Tags: security

brothke writes "Imagine for a moment what his novels would read like if Dan Brown got his facts correct. The challenge Brown and similar authors face is to write a novel that is both compelling and faithful to the facts. In Tetraktys, author Ari Juels is able to weave an interesting and readable story, and stay faithful to the facts. While Brown seemingly lacks the scientific and academic background needed to write such fiction, Juels has a Ph.D. in computer science from Berkeley and is currently the Chief Scientist and director at RSA Laboratories, the research division of RSA Security." Read below for the rest of Ben's review.
Read more of this story at Slashdot.
New DoS Vulnerability In All Versions of BIND 9

Posted: July 29th, 2009, 4:02am CEST by kdawson

Tags: security

Icemaann writes "ISC is reporting that a new, remotely exploitable vulnerability has been found in all versions of BIND 9. A specially crafted dynamic update packet will make BIND die with an assertion error. There is an exploit in the wild and there are no access control workarounds. RedHat claims that the exploit does not affect BIND servers that do not allow dynamic updates, but the ISC post refutes that. This is a high-priority vulnerability and DNS operators will want to upgrade BIND to the latest patch level."
Read more of this story at Slashdot.
Sandia Studies Botnets In 1M OS Digital Petri Dish

Posted: July 28th, 2009, 11:44pm CEST by kdawson

Tags: security

Ponca City, We love you writes "The NY Times has the story of researchers at Sandia National Laboratories creating what is in effect a vast digital petri dish able to hold one million operating systems at once in an effort to study the behavior of botnets. Sandia scientist Ron Minnich, the inventor of LinuxBIOS, and his colleague Don Rudish have converted a Dell supercomputer to simulate a mini-Internet of one million computers. The researchers say they hope to be able to infect their digital petri dish with a botnet and then gather data on how the system behaves. 'When a forest is on fire you can fly over it, but with a cyber-attack you have no clear idea of what it looks like,' says Minnich. 'It's an extremely difficult task to get a global picture.' The Dell Thunderbird supercomputer, named MegaTux, has 4,480 Intel microprocessors running Linux virtual machines with Wine, making it possible to run 1 million copies of a Windows environment without paying licensing fees to Microsoft. MegaTux is an example of a new kind of computational science, in which computers are used to simulate scientific instruments that were once used in physical world laboratories. In the past, the researchers said, no one has tried to program a computer to simulate more than tens of thousands of operating systems."
Read more of this story at Slashdot.
92% of Windows PCs Vulnerable To Zero-Day Attacks On Flash

Posted: July 28th, 2009, 4:42pm CEST by timothy

Tags: security

CWmike writes "More than 9 out of every 10 Windows users are vulnerable to the Flash zero-day vulnerability that Adobe won't patch until Thursday, Danish security company Secunia says. According to Secunia, 92% of the 900,000 users who have recently run the company's Personal Software Inspector (PSI) utility have Flash Player 10 on their PCs, while 31% have Flash Player 9. (The total exceeds 100% because some users have installed both.) The most-current versions of Flash Player — 9.0.159.0 and 10.0.22.87) — are vulnerable to hackers conducting drive-by attacks hosted on malicious and legitimate-but-compromised sites. Antivirus vendors have reported hundreds, in some cases thousands, of sites launching drive-bys against Flash."
Read more of this story at Slashdot.
Could Cyber-Terrorists Provoke Nuclear Attacks?

Posted: July 28th, 2009, 12:08am CEST by ScuttleMonkey

Tags: security

Hugh Pickens writes "The Guardian reports that according to a study commissioned by the International Commission on Nuclear Non-proliferation and Disarmament (ICNND), a joint initiative of the Australian and Japanese Governments, terrorists could use information warfare techniques to make a nuclear attack more likely — triggering a catastrophic chain of events that may be an easier alternative 'than building or acquiring a nuclear weapon or dirty bomb themselves.' While the possibility of a radical group gaining access to actual launch systems is remote, the study suggests that terrorists could focus on feeding in false information further down the chain — or spreading fake information to officials in a carefully orchestrated strike. According to the study 'Hacking Nuclear Command and Control' [PDF], cyber-terrorists could 'provoke a nuclear launch by spoofing early warning and identification systems or by degrading communications networks.' Since command and control systems are placed at a higher degree of exploitation due to the need for rapid decisions under high pressure with limited intelligence, cyber-terrorists 'would not need deception that could stand up over time; they would only need to be believable in the first 15 minutes or so.'"
Read more of this story at Slashdot.
Shrinking Budgets Tie Hands of Security Pros

Posted: July 27th, 2009, 3:31pm CEST by CmdrTaco

Tags: security

An anonymous reader writes "RSA Conference released the results of a recent survey of security professionals regarding the critical security threats and infrastructure issues they currently face, including those exacerbated by the current economic climate. The study indicates that even though practitioners are most concerned about email phishing and securing mobile devices, technologies addressing these needs are at risk of being cut from IT budgets. The survey also asked what technology investments will likely be bypassed or curtailed due to spending freezes and budget cuts."
Read more of this story at Slashdot.
Security Certificate Warnings Don't Work

Posted: July 27th, 2009, 5:03am CEST by timothy

Tags: security

angry tapir writes "In a laboratory experiment, researchers found that between 55 percent and 100 percent of participants ignored certificate security warnings, depending on which browser they were using (different browsers use different language to warn their users). The researchers first conducted an online survey of more than 400 Web surfers, to learn what they thought about certificate warnings. They then brought 100 people into a lab and studied how they surf the Web. They found that people often had a mixed-up understanding of certificate warnings. For example, many thought they could ignore the messages when visiting a site they trust, but that they should be more wary at less-trustworthy sites."
Read more of this story at Slashdot.
Hacker Group L0pht Making a Comeback

Posted: July 26th, 2009, 7:24pm CEST by Soulskill

Tags: security

angry tapir writes "The news report begins with shots of a tense space shuttle launch. Engineers hunch over computer banks and techno music pounds in the background. There is a countdown, a lift-off, and then you see a young man in a black T-shirt and sunglasses, apparently reporting from 'space.' This is the Hacker News Network, and after a decade offline it is lifting off again, this time with a quirky brand of video reports about security. Hacker News Network is one of the side projects of the Boston-based hacker collective known as L0pht Heavy Industries. They're the guys who famously told the US Congress that they could take down the Internet in about 30 minutes, and who helped invent the way that security bugs are reported to computer companies."
Read more of this story at Slashdot.
AVG Update Breaks iTunes

Posted: July 26th, 2009, 2:20am CEST by kdawson

Tags: security

nate_in_ME writes "After getting a positive from the AVG virus detector while playing music on iTunes just a few minutes ago, I did a bit of research. It appears that AVG has recently pushed an update to the virus definitions that flags every iPod/iTunes related file as being infected with the 'Small.BOG' trojan. Interestingly enough, AVG does not have any information on this particular virus in their virus encyclopedia. Discussion on the Apple forum is up to 4 pages and climbing. One user there had an interesting thought: 'Maybe Palm has some shares in AVG...MUAHAAAA!!' (on page 3)."
Read more of this story at Slashdot.
Network Solutions Suffers Massive Data Breach

Posted: July 25th, 2009, 2:19pm CEST by Soulskill

Tags: security

dasButcher writes "Network Solutions, the domain registration and hosting service company, suffered a massive security breach that lasted three months and exposed tens of thousands of credit card numbers of its customers and of the businesses that use its hosting and online payment processing service. The company is just beginning the victim notification process. 'There is no information on how the code was planted on the sites. While examination of the code shows that it had the ability to ship data off to a third party, and Network Solutions believes that it did just that, the exact code is not available for public review. There is also no public information as to where the data believed to be stolen was sent.'"
Read more of this story at Slashdot.
iPhone 3Gs Encryption Cracked In Two Minutes

Posted: July 25th, 2009, 1:07am CEST by Soulskill

Tags: security

An anonymous reader writes "In a Wired news article, iPhone Forensics expert Jonathan Zdziarski explains how the much-touted hardware encryption of the iPhone 3Gs is but a farce, and demonstrates how both the passcode and backup encryption can be bypassed in about two minutes. Zdziarski also goes on to say that all data on the iPhone — including deleted data — is automatically decrypted by the iPhone when it's copied, allowing hackers and law enforcement agencies alike access the device's raw disk as if no encryption were present. A second demonstration features the recovery of the iPhone's entire disk while the device is still passcode-locked. According to a similar article in Ars Technica, Zdziarski describes the iPhone's hardware encryption by saying it's 'like putting privacy glass on half your shower door.' With the iPhone being sold into 20% of Fortune-100s and into the military, just how worried should we be with such shoddy security?"
Read more of this story at Slashdot.
Critical Flaw Discovered In DD-WRT

Posted: July 24th, 2009, 3:58pm CEST by kdawson

Tags: security

MagicM writes "A critical flaw has been discovered in DD-WRT, a Linux based alternative open source firmware for WLAN routers such as the fan-favorite Linksys WRT54GL. The flaw can give an attacker instant root access to the router merely by embedding an image with a specially crafted URL in a Web page (CSRF attack)." The linked page notes that a fix is being rolled out (build 12533) and gives firewall rules to thwart the attack if the fix is not available yet for a particular device.
Read more of this story at Slashdot.
Researchers Outline Targeted Content Poisoning For P2P Data

Posted: July 24th, 2009, 4:42am CEST by timothy

Tags: security

Diomidis Spinellis writes "Two USC researchers published a paper in the prestigious IEEE Transactions on Computers that describes a technique for p2p content poisoning targeted exclusively at detected copyright violators. Using identity-based signatures and time-stamped tokens they report a 99.9 percent prevention rate in Gnutella, KaZaA, and Freenet and a 85-98 percent prevention rate on eMule, eDonkey, and Morpheus. Poison-resilient networks based on the BitTorrent protocol are not affected. Also the system can't protect small files, like a single-song MP3. Although the authors don't say so explicitly, my understanding is that the scheme is only useful on commercial p2p distribution systems that adopt the proposed protocol."
Read more of this story at Slashdot.
America's 10 Most-Wanted Botnets

Posted: July 22nd, 2009, 9:17pm CEST by timothy

Tags: security

bednarz writes "Network World ranks America's 10 most wanted botnets, based on an estimate by security firm Damballa of botnet size and activity in the United States. The leader is Zeus, with 3.6 million compromised PCs so far. The Zeus Trojan uses key-logging techniques to steal user names, passwords, account numbers and credit card numbers, and it injects fake HTML forms into online banking login pages to steal user data. At the bottom of the list is Conficker, which despite its celebrity status has compromised just 210,000 US computers so far."
Read more of this story at Slashdot.
Adobe Chided For Insecure Acrobat Reader

Posted: July 22nd, 2009, 11:06am CEST by kdawson

Tags: security

The Register covers security firm Secunia calling out Adobe for its insecure distribution practices with regard to Adobe Reader. (Here is Secunia's note.) The accusation is that the way Adobe provides Reader extends the software's window of vulnerability once an exploit has begun to circulate. Version 9.1 of Reader, which is what you get when you visit the official download site, contains 10 vulnerabilities that were patched by later releases. "Adobe Systems has been taken to task for offering outdated software on its downloads page that contains dozens of security vulnerabilities, several of which are already being exploited in the wild... Visitors who obtain Adobe Reader from the company's official downloads page will find that it installs version 9.1 of the program on their computers, even though the most recent version was 9.1.2 at time of writing. That could put users at considerable peril given the number of vulnerabilities fixed in the two iterations that have come since 9.1, complains Secunia..."
Read more of this story at Slashdot.
40 Million Identities Up For Sale On the Web

Posted: July 22nd, 2009, 12:34am CEST by kdawson

Tags: security

An anonymous reader writes "Highly sensitive financial information, including credit card details, bank account numbers, telephone numbers, and even PINs are available to the highest bidder. The information being traded on the Web has been intercepted by a British company and collated into a single database for the first time. The Lucid Intelligence database contains the records of 40 million people worldwide, mostly Americans; four million are Britons. Security experts described the database as the largest of its kind in the world. The database is in the hands of Colin Holder, a retired senior Metropolitan police officer who served on the fraud squad. He has collected the information over the past four years. His sources include law enforcement from around the world, such as British police and the FBI, anti-phishing and hacking campaigners, and members of the public. Mr. Holder said he has invested £160,000 in the venture so far. He plans to offset the cost by charging members of the public for access to his database to check whether their data security has been breached."
Read more of this story at Slashdot.
'Vanish' Makes Sensitive Data Self-Destruct

Posted: July 21st, 2009, 6:14pm CEST by Soulskill

Tags: security

Hugh Pickens writes "The NY Times reports on new software called 'Vanish,' developed by computer scientists at the University of Washington, which makes sensitive electronic messages 'self destruct' after a certain period of time. The researchers say they have struck upon a unique approach that relies on 'shattering' an encryption key that is held by neither party in an e-mail exchange, but is widely scattered across a peer-to-peer file sharing system. 'Our goal was really to come up with a system where, through a property of nature, the message, or the data, disappears,' says Amit Levy, who helped create Vanish. It has been released as a free, open-source tool that works with Firefox. To use Vanish, both the sender and the recipient must have installed the tool. The sender then highlights any sensitive text entered into the browser and presses the 'Vanish' button. The tool encrypts the information with a key unknown even to the sender. That text can be read, for a limited time only, when the recipient highlights the text and presses the 'Vanish' button to unscramble it. After eight hours, the message will be impossible to unscramble and will remain gibberish forever. Tadayoshi Kohno says Vanish makes it possible to control the 'lifetime' of any type of data stored in the cloud, including information on Facebook, Google documents or blogs."
Read more of this story at Slashdot.
Is Battery-Free 2-Factor ID Secure?

Posted: July 20th, 2009, 3:50pm CEST by timothy

Tags: security

An anonymous reader writes "There was a television program in Australia last week about Matthew Walker's visual battery-less two-factor authentication system called PassWindow. Essentially, you hold the clear plastic window up to the apparently random pattern on the screen of your computer, revealing a one-time PIN to type in for authentication. The plastic window has many advantages: difficult to copy or view over the shoulder, etc. Because there is no electronics, chip or battery, the PassWindow is extremely cheap to manufacture, giving it a big advantage over other two-factor authentication systems. However, I don't know about the security of the system. The apparently random pattern of lines in the PassWindow is analogous to a one-time pad, using a different subset of the one-time pad every time a PIN is needed. Is this a useful level of security for logging in to a bank account?"
Read more of this story at Slashdot.
Security Threats 3 Levels Beyond Kernel Rootkits

Posted: July 19th, 2009, 12:19am CEST by kdawson

Tags: security

GhostX9 writes "Tom's Hardware has a long interview with security expert Joanna Rutkowska (which is unfortunately split over 9 pages). Many think that kernel rootkits are the most dangerous attacks, but Joanna and her team have been studying exploits beyond Ring 0 for some years. Joanna is most well known for the BluePill virtualization attack (Ring -1) and in this interview she chats a little bit about Ring -2 and Ring -3 attacks that go beyond kernel rootkits. What's surprising is how robust the classic BluePill proof-of-concept is: 'Many people tried to prove that BluePill is "detectable" by writing various virtualization detectors (but not BluePill detectors). They simply assumed that if we detect a virtualization being used, this means that we are "under" BluePill. This assumption was made because there were no products using hardware virtualization a few years ago. Needless to say, if we followed this way of reasoning, we might similarly say that if an executable makes network connections, then it must surely be a botnet.'" Rutkowska says that for her own security, "I don't use any A/V product on any of my machines (including all the virtual machines). I don't see how an A/V program could offer any increased security over the quite-reasonable-setup I already deployed with the help of virtualization." She runs three separate virtual machines, designated Red, Yellow, and Green, each running a separate browser and used for increasingly sensitive tasks.
Read more of this story at Slashdot.
New Linux Kernel Flaw Allows Null Pointer Exploits

Posted: July 18th, 2009, 2:17pm CEST by Soulskill

Tags: security

Trailrunner7 writes "A new flaw in the latest release of the Linux kernel gives attackers the ability to exploit NULL pointer dereferences and bypass the protections of SELinux, AppArmor and the Linux Security Module. Brad Spengler discovered the vulnerability and found a reliable way to exploit it, giving him complete control of the remote machine. This is somewhat similar to the magic that Mark Dowd performed last year to exploit Adobe Flash. Threatpost.com reports: 'The vulnerability is in the 2.6.30 release of the Linux kernel, and in a message to the Daily Dave mailing list Spengler said that he was able to exploit the flaw, which at first glance seemed unexploitable. He said that he was able to defeat the protection against exploiting NULL pointer dereferences on systems running SELinux and those running typical Linux implementations.'"
Read more of this story at Slashdot.

Slashdot: Linux

New Linux Kernel Flaw Allows Null Pointer Exploits

Posted: July 18th, 2009, 2:17pm CEST by Soulskill

Tags: security

Trailrunner7 writes "A new flaw in the latest release of the Linux kernel gives attackers the ability to exploit NULL pointer dereferences and bypass the protections of SELinux, AppArmor and the Linux Security Module. Brad Spengler discovered the vulnerability and found a reliable way to exploit it, giving him complete control of the remote machine. This is somewhat similar to the magic that Mark Dowd performed last year to exploit Adobe Flash. Threatpost.com reports: 'The vulnerability is in the 2.6.30 release of the Linux kernel, and in a message to the Daily Dave mailing list Spengler said that he was able to exploit the flaw, which at first glance seemed unexploitable. He said that he was able to defeat the protection against exploiting NULL pointer dereferences on systems running SELinux and those running typical Linux implementations.'"
Read more of this story at Slashdot.

Slashdot: IT

Free Rainbow Tables Looking For New Admin

Posted: July 17th, 2009, 7:24pm CEST by kdawson

Tags: security

lee writes "After almost three years online, the admin of Free Rainbow Tables has decided to call it a day, citing a lack of time to keep it running. (I'm sure that you all know a rainbow table is essentially a giant list of precomputed hashes.) This is a shame, as the site is a useful resource for those occasions when you really need an existing password exposed, rather than simply changing it. I'm a Windows admin, and this site has come in very handy in the past. The currently computed tables weigh in at well over half a terabyte, are available as torrents from the site, or from a couple of mirrors (and alternatives are available). When the site was active, it featured a downloadable BOINC client to put your idle cycles to work computing ever-greater tables, and a space-saving format for storing the tables. The admin is willing to hand over source code if you wish to take over, though I suspect hosting is not included!"
Read more of this story at Slashdot.
Nmap 5.00 Released, With Many Improvements

Posted: July 16th, 2009, 9:50pm CEST by timothy

Tags: security

iago-vL writes "The long-awaited Nmap Security Scanner version 5.00 was just released (download)! This marks the most important release since 1997, and is a huge step in Nmap's evolution from a simple port scanner to an all-around security and networking tool suite. Significant performance improvements were made, and dozens of scripts were added. For example, Nmap can now log into Windows and perform local checks (PDF), including Conficker detection. New tools included in 5.00 are Ncat, a modern reimplementation of Netcat (with IPv6, SSL, NAT traversal, port redirection, and more!), and Ndiff, for quickly comparing scan results. Other tools are in the works for future releases, but we're still waiting for them to add email and ftp clients so we can finally get off Emacs!"
Read more of this story at Slashdot.
Attacks Against Unpatched Microsoft Bug Multiply

Posted: July 15th, 2009, 12:59am CEST by kdawson

Tags: security

CWmike writes "Attacks exploiting the latest Microsoft vulnerability are quickly ramping up in quantity and intensity, several security companies warned today as they rang alarms about the developing threat. Symantec, Sunbelt Software, and SANS' Internet Storm Center bumped up their warnings yesterday after Microsoft announced that attackers were exploiting a bug in an ActiveX control used by IE to display Excel spreadsheets. There is no patch for the vulnerability; Microsoft didn't release one in today's Patch Tuesday. A temporary fix that sets the 'kill bits' of the ActiveX control is available, but experts believe it's likely most users won't take advantage of the protection. Symantec raised its ThreatCon ranking to the second of four steps. "We're seeing it exploited, but currently on a limited scale," said Symantec's Ben Greenbaum. Sunbelt also bumped up its ranking, to high." Firefox users can't be too complacent; Secunia is warning of a 0-day in version 3.5.
Read more of this story at Slashdot.
UK, Not North Korea, Is Source of DDoS Attacks

Posted: July 14th, 2009, 8:16pm CEST by kdawson

Tags: security

angry tapir writes "The UK was the likely source of a series of attacks last week that took down popular Web sites in the US and South Korea, according to an analysis performed by a Vietnamese computer security researcher. The results contradict assertions made by some in the US and South Korean governments that North Korea was behind the attack. Security analysts had been skeptical of the claims, which were reportedly made in off-the-record briefings and for which proof was never delivered." The Vietnamese security site's blog is linked from the article, but it is very slow even before Slashdotting. The researchers observed 166,908 zombies participating in the attacks — a number far larger than most earlier estimates. Update: 07/14 21:24 GMT by KD : Wired is reporting that the UK owner of the IP address in question is pointing a finger at a server in Florida, which it says opened a VPN to the UK machine for the attacks. Once again, the attacker could be anywhere.
Read more of this story at Slashdot.
German Health Insurance Card CA Loses Secret Key

Posted: July 14th, 2009, 5:20pm CEST by timothy

Tags: security

Christiane writes "The SSL Root CA responsible for issuing the German digital health insurance card lost its secret private key during a test enrollment. After their Hardware Security Module (HSM) dutifully deleted its crypto keys during a power outage, it was all 'Oops, why is there no backup?' All issued cards must be replaced: 'Gematik spokesman Daniel Poeschkens poured scorn on the statement that Gematik had insisted on the service provider carrying out a test without backing up the root CA private keys. "We did not decide against a back-up service. The fact of the matter is that the service provider took over the running of the test system, so it also has to warrant its continuous operation. How it fulfills this obligation is its own responsibility."'"
Read more of this story at Slashdot.
IronKey Unveils Self-Destructing USB Flash Drive

Posted: July 13th, 2009, 11:11pm CEST by ScuttleMonkey

Tags: security

fysdt writes to share that IronKey has released a USB flash drive with self-destruct capability. Specializing in "secure flash drives," IronKey has launched the S200 aimed at government and enterprise customers, "featuring hardened physical security, the latest Cryptochip technology, active anti-malware and enhanced management capabilities. It's the 'first and only USB storage device to achieve FIPS 140-2, Level 3 validation' and delivers advanced Cryptochip featuring AES-256, tamper-resistance and self-destruction circuitry."
Read more of this story at Slashdot.
Hackers' Next Target — Your Brain?

Posted: July 13th, 2009, 10:27pm CEST by ScuttleMonkey

Tags: security

Hugh Pickens writes "Wired reports that as neural devices become more complicated — and go wireless — some scientists say the risks of 'brain hacking' should be taken seriously. '"Neural devices are innovating at an extremely rapid rate and hold tremendous promise for the future," said computer security expert Tadayoshi Kohno of the University of Washington. "But if we don't start paying attention to security, we're worried that we might find ourselves in five or 10 years saying we've made a big mistake."' For example, the next generation of implantable devices to control prosthetic limbs will likely include wireless controls that allow physicians to remotely adjust settings on the machine. If neural engineers don't build in security features such as encryption and access control, an attacker could hijack the device and take over the robotic limb." Relatedly, several users have written to tell us that science may be closer to the science fiction "mind wipe" than previously thought. Put this all together and I welcome the next step in social networking; letting the cloud drive my limbs around town via a live webcam and then wiping the memory from my brain. Who has MyLimb.com parked and is willing to deal?
Read more of this story at Slashdot.
R.I.P. FTP

Posted: July 13th, 2009, 5:19pm CEST by CmdrTaco

Tags: security

Slashdot contributor Bennett Haselton says "Using FTP to administer a website is insecure -- but not for the reasons that you probably think. You yourself can stop using FTP any time you want, but how do we change the landscape Net-wide, to reduce the number of breakins using stolen FTP credentials?" You know what to click on if you want to read the rest.
Read more of this story at Slashdot.
Strong Passwords Not As Good As You Think

Posted: July 13th, 2009, 4:42pm CEST by CmdrTaco

Tags: security

Jamie noticed that Bruce Schneier wrote a piece on a paper on strong passwords that tells us that the old 'strong password' advice that many of us (myself included) regard as gospel might not be as true as we had hoped. They make things hard on users, but are useless against phishing and keyloggers. Everyone can change their password back to 'trustno1' now.
Read more of this story at Slashdot.
Stealing Data Via Electrical Outlet

Posted: July 12th, 2009, 10:57am CEST by timothy

Tags: security

Ponca City, We love you writes "NetworkWorld reports that security consultants Andrea Barisani and Daniele Bianco are preparing to unveil their methodology at the Black Hat USA conference for stealing information typed on a computer keyboard using nothing more than the power outlet to which the computer is connected. When you type on a standard computer keyboard, electrical signals run through the cable to the PC. Those cables aren't shielded, so the signal leaks via the ground wire in the cable and into the ground wire on the computer's power supply. The attacker connects a probe to a nearby power socket, detects the ground leakage, and converts the signal back into alphanumeric characters. So far, the attack has proven successful using outlets up to about 15 meters away. The cost of the equipment to carry out the power-line attack could be as little as $500 and while the researchers admit their hacking tools are rudimentary, they believe they could be improved upon with a little time, effort and backing. 'If our small research was able to accomplish acceptable results in a brief development time (approximately a week of work) and with cheap hardware,' they say, 'Consider what a dedicated team or government agency can accomplish with more expensive equipment and effort.'"
Read more of this story at Slashdot.
ImageShack Hacked, Security Groups Threatened

Posted: July 11th, 2009, 5:23pm CEST by Soulskill

Tags: security

revjtanton writes "Last night a group calling themselves 'Anti-Sec' hacked ImageShack, one of the largest image hosting sites on the web, and replaced many of the site's hosted pictures with one of their own, which detailed their manifesto. The group's grievance is against full-disclosure of exploits, an issue that was debated recently after a presentation on an ATM exploit was canceled. Anti-Sec simply wants the practice within security circles to end, and they've promised to cause 'mayhem and destruction' if it doesn't. These people are taking direct aim against a sector of the IT industry that is already armed to fight the ... but they also already know that. It should be interesting to see how this plays out."
Read more of this story at Slashdot.
Researcher Discovers ATM Hack, Gets Silenced

Posted: July 10th, 2009, 5:00pm CEST by kdawson

Tags: security

Al writes "A researcher working for networking company Juniper has been forced to cancel a Black Hat presentation that would have revealed a way to hack into ATMs. The presentation focused on exploiting vulnerabilities in devices running the Windows CE operating system, including some ATMs. The decision to cancel was made to give the vendor concerned time to patch the problem, although the company was notified 8 months ago. The article mentions a growing trend in ATM hacking: In November 2008 thieves stole nearly $9 million from more than 130 cash machines in 49 cities worldwide. And earlier this year, the second biggest maker of ATMs, Diebold, warned customers in an advisory that certain cash machines in Eastern Europe had been loaded with malicious software capable of stealing financial information and the secret PINs from customers performing ATM transactions."
Read more of this story at Slashdot.
Korean DDoS Bots To Self-Destruct

Posted: July 10th, 2009, 7:41am CEST by timothy

Tags: security

tsu doh nimh writes "Several news sources are reporting that the tens of thousands of Microsoft Windows systems infected with the Mydoom worm and being used in an ongoing denial of service attack against US and S. Korean government Web sites will likely have their hard drives wiped of data come Friday. From The Washington Post's Security Fix blog, the malware is 'designed to download a payload from a set of Web servers. Included in that payload is a Trojan horse program that overwrites the data on the hard drive with a message that reads "memory of the independence day," followed by as many "u" characters as it takes to write over every sector of every physical drive attached to the compromised system.' ChannelNews Asia carries similar information."
Read more of this story at Slashdot.
Online Attack Hits US Government Web Sites

Posted: July 8th, 2009, 3:43pm CEST by Soulskill

Tags: security

angry tapir writes "A botnet composed of about 50,000 infected computers has been waging a war against US government Web sites and causing headaches for businesses in the US and South Korea. The attack started Saturday, and security experts have credited it with knocking the Federal Trade Commission's (FTC's) web site offline for parts of Monday and Tuesday. Several other government Web sites have also been targeted, including the Department of Transportation."
Read more of this story at Slashdot.
PC Invader Costs a Kentucky County $415,000

Posted: July 8th, 2009, 1:26am CEST by kdawson

Tags: security

plover recommends a detailed account by Brian Krebs in the Washington Post's Security Fix column of a complex hack and con job resulting in the theft of $415,000 from Bullitt County, Kentucky. "The crooks were aided by more than two dozen co-conspirators in the United States, as well as a strain of malicious software capable of defeating online security measures put in place by many banks. ...the trouble began on June 22, when someone started making unauthorized wire transfers of $10,000 or less from the county's payroll to accounts belonging to at least 25 individuals around the country... [T]he criminals stole the money using a custom variant of a keystroke logging Trojan known as 'Zeus' (a.k.a. 'Zbot') that included two new features. The first is that stolen credentials are sent immediately via instant message to the attackers. But the second, more interesting feature of this malware... is that it creates a direct connection between the infected Microsoft Windows system and the attackers, allowing the bad guys to log in to the victim's bank account using the victim's own Internet connection."
Read more of this story at Slashdot.
Gaze-Tracking Software Protects Computer Privacy

Posted: July 7th, 2009, 11:50pm CEST by kdawson

Tags: security

Ponca City, We Love You writes "Two years ago computer security expert Bill Anderson read about scientific research on how the human eye moves as it reads and processes text and images. 'This obscure characteristic... suddenly struck me as (a solution to) a security problem,' says Anderson. With the help of a couple of software developers, Anderson developed a software program called Chameleon that tracks a viewer's gaze patterns and only allows an authorized user to read text on the screen, while everyone else sees gibberish. Chameleon uses gaze-tracking software and camera equipment to track an authorized reader's eyes to show only that one person the correct text. After a 15-second calibration period in which the software learns the viewer's gaze patterns, anyone looking over that user's shoulder sees dummy text that randomly and constantly changes. To tap the broader consumer market, Anderson built a more consumer-friendly version called PrivateEye, which can work with a simple Webcam to blur a user's monitor when he or she turns away. It also detects other faces in the background, and a small video screen pops up to alert the user that someone is looking at the screen. 'There have been inventions in the space of gaze-tracking. There have been inventions in the space of security,' says Anderson. 'But nobody has put the two ideas together, as far as we know.'"
Read more of this story at Slashdot.
Microsoft Warns of New Video ActiveX Vulnerability

Posted: July 7th, 2009, 3:34pm CEST by Soulskill

Tags: security

ucanlookitup writes "Microsoft has warned of a 'privately reported' vulnerability affecting IE users on XP or Windows Server 2003. The vulnerability allows remote users to execute arbitrary code with the same privileges as the users. The vulnerability is triggered when users visit a web site with malicious code. 'Security experts say criminals have been attacking the vulnerability for nearly a week. Thousands of sites have been hacked to serve up malicious software that exploits the vulnerability.' The advisory can be found at TechNet. Until Microsoft develops a patch, a workaround is available."
Read more of this story at Slashdot.
Beautiful Security

Posted: July 6th, 2009, 8:56pm CEST by samzenpus

Tags: security

brothke writes "Books that collect chapters from numerous expert authors often fail to do more than be a collection of disjointed ideas. Simply combining expert essays does not always make for an interesting, cohesive read. Beautiful Security: Leading Security Experts Explain How They Think is an exception to that and is definitely worth a read. The book's 16 chapters provide an interesting overview to the current and future states of security, risk and privacy. Each chapter is written by an established expert in the field and each author brings their own unique insights and approach to information security." Keep reading for the rest of Ben's review.
Read more of this story at Slashdot.
Symantec Exec Warns Against Relying On Free Antivirus

Posted: July 4th, 2009, 3:29pm CEST by Soulskill

Tags: security

thefickler writes "Clearly, the rise of free antivirus is starting to worry Symantec, with one of their top executives warning consumers not to rely on free antivirus software (including Microsoft's Security Essentials). 'If you are only relying on free antivirus to offer you protection in this modern age, you are not getting the protection you need to be able to stay clean and have a reasonable chance of avoiding identity theft,' said David Hall, a Product Manager for Symantec. According to Hall, there is a widening gap between people's understanding of what protection they need and the threats they're actually facing."
Read more of this story at Slashdot.
iPhone Vulnerability Yields Root Access Via SMS

Posted: July 3rd, 2009, 3:01pm CEST by timothy

Tags: security

snydeq writes "Pwn2Own winner Charlie Miller has revealed an SMS vulnerability that could provide hackers with root access to the iPhone. Malicious code sent by SMS to run on the phone could include commands to monitor location using GPS, turn on the phone's microphone to eavesdrop on conversations, or make the phone join a DDoS attack or botnet, Miller said. Miller did not provide detailed description of the SMS vulnerability, citing an agreement with Apple, which is working to fix the vulnerability in advance of Black Hat, where Miller plans to discuss the attack in greater detail. 'SMS is a great vector to attack the iPhone,' Miller said, as SMS can send binary code that the iPhone processes without user interaction. Sequences can be sent to the phone as multiple messages that are automatically reassembled, thereby surpassing individual SMS message limits of 140 bytes."
Read more of this story at Slashdot.
NSA To Build 20-Acre Data Center In Utah

Posted: July 2nd, 2009, 1:57pm CEST by samzenpus

Tags: security

Hugh Pickens writes "The Salt Lake City Tribune reports that the National Security Agency will be building a one million square foot data center at Utah's Camp Williams. The NSA's heavily automated computerized operations have for years been based at Fort Meade, Maryland, but the agency began looking to decentralize its efforts following the terrorist attacks of Sept. 11, 2001 and accelerated their search after the Baltimore Sun reported that the NSA — Baltimore Gas & Electric's biggest customer — had maxed out the local grid and could not bring online several supercomputers it needed to expand its operations. The agency got a taste of the potential for trouble January 24, 2000, when an information overload, rather than a power shortage, caused the NSA's first-ever network crash, taking the agency 3 1/2 days to resume operations. The new data center in Utah will require at least 65 megawatts of power — about the same amount used by every home in Salt Lake City — so a separate power substation will have to be built at Camp Williams to sustain that demand. 'They were looking at secure sites, where there could be a natural nexus between organizations and where space was available,' says Col. Scott Olson, the Utah National Guard's legislative liaison. NSA officials, who have a long-standing relationship with Utah based on the state Guard's unique linguist units, approached state officials about finding land in the state on which to build an additional data center. 'The stars just kind of came into alignment. We could provide them everything they need.'"
Read more of this story at Slashdot.
The Hysteria of the Cyber-Warriors

Posted: July 1st, 2009, 6:21pm CEST by Soulskill

Tags: security

Willfro sends in a piece by Evgeny Morozov at the Boston Review about the hyperbole and the reality of "cyber war." Quoting: "At the end of May, President Obama called cyber-security 'one of the most serious economic and national security challenges we face as a nation.' His words echo a flurry of gloomy think-tank reports. Unfortunately, these reports are usually richer in vivid metaphor — with fears of 'digital Pearl Harbors' and 'cyber-Katrinas' — than in factual foundation. So why is there so much concern about 'cyber-terrorism?' Answering a question with a question: who frames the debate? Much of the data are gathered by ultra-secretive government agencies — which need to justify their own existence — and cyber-security companies — which derive commercial benefits from popular anxiety. Journalists do not help. Gloomy scenarios and speculations about cyber-Armaggedon draw attention, even if they are relatively short on facts."
Read more of this story at Slashdot.
Scammers Target Neopets Users

Posted: July 1st, 2009, 6:00pm CEST by Soulskill

Tags: security

An anonymous reader writes "If you have children that play on the popular virtual world game Neopets, you might want to warn them of a social engineering scam gleefully targeting 12-year-old kids. Neopets users looking for rare items are sent private messages from the scammers, who direct them to sites hosting keyloggers & trojans. They then use the infected PC as a means to get to data the parents might have stored there, be it credit card details, Paypal accounts or online banking. Seeing the screenshots of some of these people talking about putting these children into botnets is just unbelievable — if ever you wanted proof that people up to no good online will go to any lengths to get their hands on some money (or even just feel good about outsmarting a 12-year-old), here it is."
Read more of this story at Slashdot.
New Click-Fraud Attack Is Stealthiest Yet

Posted: July 1st, 2009, 3:35am CEST by kdawson

Tags: security

An anonymous reader sends news from The Washington Post's Security Fix blog of a new Trojan horse program that takes click fraud to the next level. The Trojan, dubbed FFsearcher by SecureWorks, was among the pieces of malware installed by sites hacked with the Nine-Ball mass compromise, which attacked some 40,000 Web sites this month. The Trojan takes advantage of Google's "AdSense for Search" API, which allows Web sites to embed Google search results alongside the usual Google AdSense ads. (SecureWorks' writeup indicates that Yahoo search is targeted too, but the researchers saw no evidence if the malware redirecting Yahoo searches.) While most search hijackers give themselves away on the victim's machine by redirecting the browser through some no-name search engine, FFsearcher "...converts every search a victim makes through Google.com, so that each query is invisibly redirected through the attackers' own Web sites, via Google's Custom Search API. Meanwhile, the Trojan manipulates the victim's PC and browser so that the victim never actually sees the attacker-controlled Web site that is hijacking the search, but instead sees the search results as though they were returned directly from Google.com (and with Google.com in the victim browser's address bar, not the address of the attacker controlled site). Adding to the stealth is the fact that search results themselves aren't altered by the attackers, who are merely going after the referral payments should victims click on any of the displayed ads. What's more, the attackers aren't diverting clicks or ad revenue away from advertisers or publishers, as in traditional click fraud: They are simply forcing Google to pay commissions that it wouldn't otherwise have to pay." If FFSearcher were the only piece of malware on the machine, it would have a better chance of staying under the radar.
Read more of this story at Slashdot.
New Firefox Standard Aims to Combat Cross-Site Scripting

Posted: June 30th, 2009, 12:06am CEST by ScuttleMonkey

Tags: security

Al writes "The Mozilla foundation is to adopt a new standard to help web sites prevent cross site scripting attacks (XSS). The standard, called Content Security Policy, will let a website specify what Internet domains are allowed to host the scripts that run on its pages. This breaks with Web browsers' tradition of treating all scripts the same way by requiring that websites put their scripts in separate files and explicitly state which domains are allowed to run the scripts. The Mozilla Foundation selected the implementation because it allows sites to choose whether to adopt the restrictions. 'The severity of the XSS problem in the wild and the cost of implementing CSP as a mitigation are open to interpretation by individual sites,' Brandon Sterne, security program manager for Mozilla, wrote on the Mozilla Security Blog. 'If the cost versus benefit doesn't make sense for some site, they're free to keep doing business as usual.'"
Read more of this story at Slashdot.
Ksplice Offers Rebootless Updates For Ubuntu Systems

Posted: June 28th, 2009, 7:50am CEST by timothy

Tags: security

sdasher writes "Ksplice has started offering Ksplice Uptrack for Ubuntu Jaunty, a free service that delivers rebootless versions of all the latest Ubuntu kernel security updates. It's currently available for both the 32 and 64-bit generic kernel, and they plan to add support for the virtual and server kernels by the end of the month, according to their FAQ. This makes Ubuntu the first OS that doesn't need to be rebooted for security updates. (We covered Ksplice's underlying technology when it was first announced a year ago.)"
Read more of this story at Slashdot.

Slashdot: Linux

Ksplice Offers Rebootless Updates For Ubuntu Systems

Posted: June 28th, 2009, 7:50am CEST by timothy

Tags: security

sdasher writes "Ksplice has started offering Ksplice Uptrack for Ubuntu Jaunty, a free service that delivers rebootless versions of all the latest Ubuntu kernel security updates. It's currently available for both the 32 and 64-bit generic kernel, and they plan to add support for the virtual and server kernels by the end of the month, according to their FAQ. This makes Ubuntu the first OS that doesn't need to be rebooted for security updates. (We covered Ksplice's underlying technology when it was first announced a year ago.)"
Read more of this story at Slashdot.

Slashdot: IT

The Path From Hacker To Security Consultant

Posted: June 27th, 2009, 6:10pm CEST by Soulskill

Tags: security

CNet has a series of interviews with former hackers who ran afoul of the law in their youth, but later turned their skills toward a profession in security consulting. Adrian Lamo discusses taking "normal every day information resources and [arranging] them in improbable ways," describing a time when he broke into Excite@Home's system and ended up answering help desk questions from their users. Kevin Mitnick, famous for gaining access to many high-profile systems, warns today's young hackers not to follow in his footsteps, saying, "A lot of pen testers today have done unethical things in their past during their learning process, especially the older ones because there was no opportunity to learn about security. Back in the '70s and '80s, it was all self-taught. So a lot of the old-school hackers really learned on other people's systems. And at the time, I couldn't even afford my own computer." Mark Abene explains how he got interested in phone phreaking, and how it led to a prison term and a career in computer security. Like Mitnick, he says that easy access to powerful modern computers removes part of the motivation for breaking into other systems.
Read more of this story at Slashdot.
Kaminsky On DNS Bugs a Year Later and DNSSEC

Posted: June 25th, 2009, 4:52pm CEST by CmdrTaco

Tags: security

L3sPau1 writes "Network security researcher Dan Kaminsky has had a year to reflect on the impact of the cache poisoning vulnerability he discovered in the Domain Name System. In the time since, Kaminsky has become an advocate for improving security in DNS, and ultimately, trust on the Internet. One way to do this is with the widespread use of DNSSEC (DNS Security Extensions), which essentially brings PKI to website requests. In this interview, Kaminsky talks about how the implementation of DNSSEC would enable greater security and trust on the Net and provide a platform for the development of new security products and services."
Read more of this story at Slashdot.
UK Launches Dedicated Cyber Security Agency

Posted: June 25th, 2009, 4:08pm CEST by CmdrTaco

Tags: security

Jack Spine writes "The UK government is launching an office dedicated to cyber attack and defence. The Office of Cyber Security will focus on protecting Britain's IT infrastructure, and will be similar to the US Cyber Command model. While the Pentagon Cyber Command will be lead by the NSA, the UK Cyber Security Operations Centre, which will coordinate UK cyber efforts, will be based at GCHQ in Cheltenham."
Read more of this story at Slashdot.
Reporters Find US Gov't Data In Ghana Market

Posted: June 25th, 2009, 1:57pm CEST by samzenpus

Tags: security

narramissic writes "'Hundreds and hundreds of documents about government contracts,' were found on a hard drive purchased at a market in Ghana for the bargain basement price of $40, said Peter Klein, an associate professor with the University of British Columbia, who led an investigation into the global electronic waste business for the PBS show Frontline. The hard drive had belonged to US government contractor Northrop Grumman and in a made-for-TV ironic twist, 'some of the documents talked about how to recruit airport screeners and several of them even covered data security practices,' Klein said. 'Here were these contracts being awarded based on their ability to keep the data safe.'"
Read more of this story at Slashdot.
AV-Test Deems Windows Security Essentials "Very Good"

Posted: June 24th, 2009, 11:57pm CEST by timothy

Tags: security

CWmike writes "Microsoft's new free security software, Windows Security Essentials, passed a preliminary antivirus exam with flying colors, said independent and trusted firm AV-Test, which tested Essentials, launched yesterday in beta, on Windows XP, Vista and Windows 7. It put it up against nearly 3,200 common viruses, bot Trojans and worms, said Andreas Marx, one of the firm's managers. The malware was culled from the most recent WildList, a list of threats actually actively attacking computers. 'All files were properly detected and treated by the product,' Marx said in an e-mail. 'That's good, as several other [antivirus] scanners are still not able to detect and kill all of these critters yet.' It also tested well on false positives."
Read more of this story at Slashdot.
Pentagon Confirms Cyber Command, Under NSA Control

Posted: June 24th, 2009, 9:39pm CEST by timothy

Tags: security

eldavojohn writes "The Pentagon's been planning a cyber command for a while now but it's just been confirmed. The Pentagon will set up a Cyber Command outfit most likely around — surprise surprise — Fort George G. Meade in Maryland. From the article, 'The head of the Cyber Command would also be the director of the U.S. National Security Agency, which conducts electronic surveillance and communications interception and is also based at Fort Meade.' The Air Force has been no stranger to digital warfare."
Read more of this story at Slashdot.
Google Chrome Developers On Browser Security

Posted: June 19th, 2009, 11:02pm CEST by ScuttleMonkey

Tags: security

CowboyRobot writes "Developers of Google's Chrome browser have spoken up in an article describing their approach to keeping the browser secure, focusing on minimizing the frequency, duration, and severity of exposure. One tool Chrome uses is a recently open-sourced update distribution application called 'Omaha.' 'Omaha automatically checks for software updates every five hours. When a new update is available, a fraction of clients are told about it, based on a probability set by the team. This probability lets the team verify the quality of the release before informing all clients.'"
Read more of this story at Slashdot.
New PHP Interpreter Finds XSS, Injection Holes

Posted: June 19th, 2009, 5:22pm CEST by kdawson

Tags: security

rkrishardy writes "A group of researchers from MIT, Stanford, and Syracuse has developed a new program, named 'Ardilla,' which can analyze PHP code for cross-site scripting (XSS) and SQL injection attack vulnerabilities. (Here is the paper, in PDF, and a table of results from scanning six PHP applications.) Ardilla uses a modified Zend interpreter to analyze the code, trace the data, and determine whether the threat is real or not, significantly decreasing false positives." Unfortunately, license issues prevent the tool in its current form from being released as open source.
Read more of this story at Slashdot.
Attack On a Significant Flaw In Apache Released

Posted: June 19th, 2009, 4:17pm CEST by kdawson

Tags: security

Zerimar points out a significant flaw in Apache that can lead to a fairly trivial DoS attack is in the wild. Apache 1.x, 2.x, dhttpd, GoAhead WebServer, and Squid are confirmed vulnerable, while IIS6.0, IIS7.0, and lighttpd are confirmed not vulnerable. As of this writing, Apache Foundation does not have a patch available. From Rsnake's introduction to the attack tool: "In considering the ramifications of a slow denial of service attack against particular services, rather than flooding networks, a concept emerged that would allow a single machine to take down another machine's web server with minimal bandwidth and side effects on unrelated services and ports. The ideal situation for many denial of service attacks is where all other services remain intact but the webserver itself is completely inaccessible. Slowloris was born from this concept, and is therefore relatively very stealthy compared to most flooding tools."
Read more of this story at Slashdot.
Central Anti-Virus For Small Business?

Posted: June 17th, 2009, 7:52am CEST by kdawson

Tags: security

rduke15 writes "I'm trying to find a centrally managed anti-virus solution for a small business network, which has around 20 Windows XP machines with a Linux server. It is too big to manage each client manually. However, there is no no full-time IT person on site, and no Windows Active Directory server — just Linux with Samba. And the current solution with Symantec Endpoint Protection seems too expensive, and too complex for such a simple need. On the Linux server side, email is handled by amavisd and ClamAV. But the WinXP clients still need a real-time anti-virus for the USB disks they may bring to work, or stuff they download from their personal webmail or other sites. I'm wondering what others may be using in similar situations, and how satisfied they are with it."
Read more of this story at Slashdot.
Researchers Build a Browser-Based Darknet

Posted: June 16th, 2009, 11:48pm CEST by kdawson

Tags: security

ancientribe writes "At Black Hat USA next month, researchers will demonstrate a way to use modern browsers to more easily build darknets — underground private Internet communities where users can share content and ideas securely and anonymously. HP's Billy Hoffman and Matt Wood have created Veiled, a proof-of-concept darknet that only requires participants have an HTML 5-based browser to join. No special software or configuration is necessary, unlike with darknets such as Tor. Veiled is basically a 'zero footprint' network, in which groups can rapidly form and disappear without a trace. The researchers admit darknets are attractive to bad guys, too, but they say they think these more easily set-up and dismantled nets will be more popular for mainstream (and legit) users." In somewhat related news, reader cheesethegreat informs us that version 0.7.5 of FreeNet has hit the tubes.
Read more of this story at Slashdot.
Hackers Find Remote iPhone Crack

Posted: June 16th, 2009, 2:13pm CEST by kdawson

Tags: security

Al writes "Two researchers have found a way to run unauthorized code on an iPhone remotely. This is different than 'jailbreaking,' which requires physical access to the device. Normally applications have to be signed cryptographically by Apple in order to run. But Charles Miller of Independent Security Evaluators and Vincenzo Iozzo from the University of Milan found more than one instance in which Apple failed to prevent unauthorized data from executing. This means that a program can be loaded into memory as a non-executable block of data, after which the attacker can essentially flip a programmatic switch and make the data executable. The trick is significant, say Miller and Iozzo, because it provides a way to do something on a device after making use of a remote exploit. Details will be presented next month at the Black Hat Conference in Las Vegas." The attack was developed on version 2.0 of the iPhone software, and the researchers don't know if it will work when 3.0 is released.
Read more of this story at Slashdot.
Apple Finally Patches Java Vulnerability

Posted: June 16th, 2009, 2:23am CEST by kdawson

Tags: security

macs4all writes "Apple has finally addressed the Java vulnerability that nearly everyone else patched months ago. Available now for OS X 10.4 and 10.5, and through Apple's Software Update service, this update patches a flaw in the Java Virtual Machine that could potentially allow a malicious Java applet to execute arbitrary code on the machine. Apple had previously advised users to turn off Java temporarily in their Web browsers."
Read more of this story at Slashdot.
The Next Ad You Click May Be a Virus

Posted: June 16th, 2009, 1:33am CEST by kdawson

Tags: security

Jay notes a Wall Street Journal report about ad networks unintentionally selling empty space to malware loaders (the link is to a syndicating site that doesn't require a subscription to view). The submitter comments: "The labeling of the fake ad sellers as hackers is pretty bogus; there's no hacking involved. Simply sign up for one of these networks, create your fake site, put up another company's creative, and you're good to go." The incidents being reported go back a few months, but the pattern of this criminal activity seems to be coming clear only recently."EWeek.com, a technology news site owned by Ziff Davis Enterprise, in February displayed an ad on its homepage masquerading as a promotion for LaCoste, the shirt maker. The retailer hadn't placed the ad — a hacker had, to direct users to a Web site where harmful programs would be downloaded to their computers, says Stephen Wellman, director of community and content for Ziff Davis."
Read more of this story at Slashdot.
Sniffing Browser History Without Javascript

Posted: June 14th, 2009, 2:32am CEST by kdawson

Tags: security

Ergasiophobia alerts us to a somewhat alarming technology demonstration, in which a Web site you visit generates a pretty good list of sites you have visited — without requiring JavaScript. NoScript will not protect you here. The only obvious drawbacks to this method are that it puts a load on your browser, and that it requires a list of Web sites to check against. "It actually works pretty simply — it is simpler than the JavaScript implementation. All it does is load a page (in a hidden iframe) which contains lots of links. If a link is visited, a background (which isn't really a background) is loaded as defined in the CSS. The 'background' image will log the information, and then store it (and, in this case, it is displayed to you)."
Read more of this story at Slashdot.
Default Passwords Blamed In $55M PBX Hacks

Posted: June 13th, 2009, 9:27am CEST by ScuttleMonkey

Tags: security

An anonymous reader writes "The Washington Post is reporting that the US Justice Department has indicted three residents of the Philippines for breaking into more than 2,500 corporate PBX systems in the United States and abroad. The government says the hackers sold access to those systems to operators of call centers in Italy, which allegedly made 12 million minutes of unauthorized phone calls through the system, valued at more than $55 million. The DOJ's action coincides with an announcement from Italian authorities today of the arrest of five men there who are suspected of funneling the profits from those call centers to terrorist groups in Southeast Asia."
Read more of this story at Slashdot.
The Birth and Battle of Conficker

Posted: June 13th, 2009, 3:12am CEST by ScuttleMonkey

Tags: security

NewScientist has an interesting look back at the birth of the Conficker worm and how this sophisticated monster quickly grew to such power and infamy. "Since that flurry of activity in early April, all has been uneasily quiet on the Conficker front. In some senses, that marks a victory for the criminals. The zombie network is now established and being used for its intended purpose: to make money. Through its peer-to-peer capabilities, the worm can be updated on the infected network at any time. It is not an unprecedented situation. There are several other large networks of machines infected with malicious software. Conficker has simply joined the list. The security community will continue to fight them, but as long as the worm remains embedded in any computer there can be no quick fixes."
Read more of this story at Slashdot.
Microsoft's Free AV App May Be a Non-Starter

Posted: June 12th, 2009, 3:33pm CEST by kdawson

Tags: security

CWmike writes "Microsoft is preparing to launch a public beta of Morro, the free anti-malware it announced last November, according to reports. Morro will use the same scanning engine as Windows Live OneCare, the software that the free software will replace and Microsoft's first consumer-grade antivirus package. OneCare is to get the boot as of June 30 (along with finance app Microsoft Money). John Pescatore, an analyst at Gartner, has questioned whether users would step up to Morro even if it was free. 'Consumers are hesitant to pay for a Microsoft security product that will remove problems in other Microsoft products,' he said. 'Think of it this way. What if you smelled a rotten egg odor in your water and the water company said, "Sure, we can remove that, but it will cost you $50." Would you buy it?' Not surprisingly, competitors have dismissed Morro's threat to their business. 'We like our chances,' Todd Gebhart, vice president in charge of McAfee's consumer line, said when it was announced OneCare was a goner. 'Consumers have already rejected OneCare,' added Rowan Trollope, senior vice president of consumer software at Symantec. 'Making that same substandard security technology free won't change that equation.'"
Read more of this story at Slashdot.
New Exploit Uses JavaScript To Compromise Intranets, VPNs

Posted: June 12th, 2009, 12:40am CEST by timothy

Tags: security

redsoxh8r writes "Security researcher Robert Hansen, known as Rsnake

Open Source News » Tags » security

Feeds

1628 items tagged "security"

Posted: February 2nd, 2012, 11:58pm CET by timothy

Tags: security

Posted: February 2nd, 2012, 5:39pm CET by timothy

Tags: security

Posted: February 2nd, 2012, 1:30am CET by samzenpus

Tags: security

Posted: January 31st, 2012, 1:58am CET by Unknown Lamer

Tags: security

Posted: January 28th, 2012, 3:11am CET by timothy

Tags: security

Posted: January 27th, 2012, 11:56pm CET by Soulskill

Tags: security

Posted: January 27th, 2012, 10:33pm CET by Soulskill

Tags: security

Posted: January 26th, 2012, 3:24pm CET by timothy

Tags: security

Posted: January 25th, 2012, 11:46pm CET by samzenpus

Tags: security

Posted: January 25th, 2012, 11:46pm CET by samzenpus

Tags: security

Posted: January 25th, 2012, 4:10pm CET by Unknown Lamer

Tags: security

Posted: January 24th, 2012, 8:24am CET by Soulskill

Tags: security

Posted: January 22nd, 2012, 2:15am CET by Soulskill

Tags: security

Posted: January 21st, 2012, 10:59pm CET by Soulskill

Tags: security

Posted: January 19th, 2012, 4:51pm CET by Soulskill

Tags: security

Posted: January 19th, 2012, 12:14am CET by Unknown Lamer

Tags: security

Posted: January 19th, 2012, 12:14am CET by Unknown Lamer

Tags: security

Posted: January 17th, 2012, 8:50pm CET by Soulskill

Tags: security

Posted: January 17th, 2012, 4:00pm CET by timothy

Tags: security

Posted: January 17th, 2012, 4:00pm CET by timothy

Tags: security

Posted: January 16th, 2012, 11:26pm CET by Soulskill

Tags: security

Posted: January 16th, 2012, 7:26am CET by samzenpus

Tags: security

Posted: January 16th, 2012, 4:31am CET by samzenpus

Tags: security

Posted: January 16th, 2012, 12:12am CET by samzenpus

Tags: security

Posted: January 15th, 2012, 2:19am CET by Soulskill

Tags: security

Posted: January 14th, 2012, 7:39pm CET by Soulskill

Tags: security

Posted: January 13th, 2012, 11:16pm CET by Soulskill

Tags: security

Posted: January 13th, 2012, 5:37pm CET by Soulskill

Tags: security

Posted: January 13th, 2012, 9:01am CET by samzenpus

Tags: security

Posted: January 13th, 2012, 6:35am CET by samzenpus

Tags: security

Posted: January 12th, 2012, 3:29pm CET by Soulskill

Tags: security

Posted: January 12th, 2012, 2:04pm CET by samzenpus

Tags: security

Posted: January 7th, 2012, 2:25pm CET by timothy

Tags: security

Posted: January 6th, 2012, 6:27am CET by samzenpus

Tags: security

Posted: January 5th, 2012, 2:05am CET by samzenpus

Tags: security

Posted: January 5th, 2012, 2:05am CET by samzenpus

Tags: security

Posted: January 4th, 2012, 11:19pm CET by timothy

Tags: security

Posted: January 4th, 2012, 5:41pm CET by Unknown Lamer

Tags: security

Posted: January 4th, 2012, 2:13pm CET by Soulskill