Skip to main content

Home/ Information Security/ Group items tagged news

Rss Feed Group items tagged

Devid Thomas

Learn how Eliot from Mr.robot hacked into to his therapist's new boyfriend's email and ... - 0 views

  •  
    SOURCE: Information Security Newspaper http://www.securitynewspaper.com/2015/12/08/learn-eliot-mr-robot-hacked-therapists-new-boyfriends-email-bank-accounts/ TAGS: Bank Account Passwords, Mr.robot text-align: ...
  •  
    SOURCE: Information Security Newspaper http://www.securitynewspaper.com/2015/12/08/learn-eliot-mr-robot-hacked-therapists-new-boyfriends-email-bank-accounts/ TAGS: Bank Account Passwords, Mr.robot text-align: ...
anonymous

Why should Penetration Testing be conducted frequently - 0 views

  •  
    The popularity of cloud computing and BYOD really brought information security to the forefront. The intruders also got smarter and more intelligent in finding new ways and new loopholes to attack. In order to deal with the future attacks, what a business…
netsec

Amazon.com: A New Host-Based Hybrid IDS Architecture - A Mind Of Its Own: The Know-how ... - 0 views

  •  
    Amazon.com: A New Host-Based Hybrid IDS Architecture - A Mind Of Its Own: The Know-how Of Host-Based Hybrid Intrusion Detection System Architecture Using Machine Learning Algorithms With Feature Selection (9783639172881): Murat Topallar: Books
Skeptical Debunker

Does promiscuity prevent extinction? - 0 views

  • Known as 'polyandry' among scientists, the phenomenon of females having multiple mates is shared across most animal species, from insects to mammals. This study suggests that polyandry reduces the risk of populations becoming extinct because of all-female broods being born. This can sometimes occur as a result of a sex-ratio distortion (SR) chromosome, which results in all of the Y chromosome 'male' sperm being killed before fertilisation. The all-female offspring will carry the SR chromosome, which will be passed on to their sons in turn resulting in more all-female broods. Eventually there will be no males and the population will die out. For this study, the scientists worked with the fruitfly Drosophila pseudoobscura. They gave some populations the opportunity to mate naturally, meaning that the females had multiple partners. The others were restricted to having one mate each. They bred several generations of these populations, so they could see how each fared over time. Over fifteen generations, five of the twelve populations that had been monogamous became extinct as a result of males dying out. The SR chromosome was far less prevalent in the populations in which females had the opportunity to have multiple mates and none of these populations became extinct. The study shows how having multiple mates can suppress the spread of the SR chromosome, making all-female broods a rarity. This is because males that carry the SR chromosome produce only half as many sperm as normal males. When a female mates with multiple males, their sperm will compete to fertilise her eggs. The few sperm produced by males carrying the SR chromosome are out-competed by the sperm from normal males, and the SR chromosome cannot spread.
  •  
    Promiscuous females may be the key to a species' survival, according to new research by the Universities of Exeter and Liverpool. Published today (25 February) in Current Biology, the study could solve the mystery of why females of most species have multiple mates, despite this being more risky for the individual.
Kiran Kuppa

"TrustyCon" security counter-convention planned for RSA refusniks - 0 views

  •  
    The RSA concerns started with documents leaked by Edward Snowden and published by the New York Times in December. These indicated that the NSA had worked with the National Institute of Standards and Technology to create a "backdoor" in the Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG), a pseudorandom number generator designated as a standard for encryption. According to the documents, in 2004-even before NIST approved it as a standard-the NSA paid RSA $10 million to use Dual EC DRGB as part of its RSA BSAFE cryptographic library. This meant that much of the encryption software sold by RSA would allow the NSA to break the encryption using the known backdoor
  •  
    The RSA concerns started with documents leaked by Edward Snowden and published by the New York Times in December. These indicated that the NSA had worked with the National Institute of Standards and Technology to create a "backdoor" in the Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG), a pseudorandom number generator designated as a standard for encryption. According to the documents, in 2004-even before NIST approved it as a standard-the NSA paid RSA $10 million to use Dual EC DRGB as part of its RSA BSAFE cryptographic library. This meant that much of the encryption software sold by RSA would allow the NSA to break the encryption using the known backdoor
Skeptical Debunker

Web Posts May Make You Vulnerable To Crime : NPR - 0 views

  •  
    It's fun to brag when you're at a great bar or going off on vacation. Social networking sites and location-based apps have made it easy to broadcast that kind of information to your friends. The problem is that you may not just be making your friends jealous, but supplying criminals with useful information as well. A new Web site called PleaseRobMe.com has drawn attention to the issue by repurposing posts from foursquare, a social networking site that lets people share the latest about their whereabouts. PleaseRobMe demonstrates that it's easy for anyone to find out you're not at home - and therefore, are presenting an "opportunity" for burglary. "There are physical and economic safety risks when you're publicizing to the world where you are," says Kevin Bankston, a senior staff attorney with the Electronic Frontier Foundation. "It's obviously a treasure trove of information for criminals. PleaseRobMe is a good demonstration of how easy it is."
Jonas Patrick

Identity Theft Prevention Services - 0 views

  •  
    This presentation will give you brief look of what actually offer to protect your identity. KeepmyID introduced new identity theft prevention services in reasonable rate.
Kiran Kuppa

Google looks to kill the password using tiny cryptographic card | Ars Technica - 0 views

  •  
    "Google engineers are experimenting with new ways to replace user passwords, including a tiny YubiKey cryptographic card that would automatically log people into Gmail, according to a report published Friday. In the future, engineers at the search giant hope to find even easier ways for people to log in not just to Google properties, but to sites across the Web. They envision a single smartphone or smartcard device that would act like a house or car key, allowing people access to all the services they consume online. They see people authenticating with a single device and then using it everywhere."
quantiq

Database security: Top 10 database vulnerabilities list - Security Bytes - 0 views

  •  
    Database administrators are all too familiar with the issues outlined in Application Security Inc.'s new Top 10 database vulnerabilities list. From the use of default passwords to patching issues, database management systems have been known to be plagued with issues making them vulnerable to attack.
Mark Frisse

SSRN-Waiving Your Privacy Goodbye: Privacy Waivers and the HITECH Act's Regulated Price... - 0 views

  •  
    his article explains why supplying data to researchers is set to become a profitable line of business for entities that hold large stores of health data in electronic form. Health information systems are a form of infrastructure, and Congress's cost-based fee for data preparation and transmission echoes pricing schemes traditionally used in other infrastructure industries such as railroads, electric power transmission, and telecommunications. Cost-based fees for infrastructure services, of constitutional necessity, must allow recovery of operating and capital costs including a return on invested capital-in other words, a profit margin.  This fee structure is being launched in an emerging 21st-century research landscape where biomedical discovery will depend more than it has in the past on studies that harness existing stores of data-such as insurance claims and healthcare data-that were created for purposes other than the research itself. This article explores why, in this environment, the new fee structure has the potential to destabilize already-fragile public trust and invite state-law responses that could override key provisions of federal privacy regulations, with devastating consequences for researchers' future access to data. To avoid this outcome, the cost-based fee must be thoughtfully implemented and accompanied by reform of the HIPAA waiver provision now used to approve nonconsensual use of people's health data in research. This article identifies specific defects of the existing framework for approving nonconsensual uses of data with the aim of eliciting a wider debate about what the reforms ought to be.
netifera platform

netifera - 0 views

  •  
    netifera is a new modular open source platform for creating network security tools.
anonymous

Bruce Schneier: More on the Broad View of Security - CSO Online - Security and Risk - 0 views

  •  
    Bruce Schneier's comments on the first Workshop in Security and Human Behavior. Examples of the New School of Information Security.
Skeptical Debunker

FTC warns firms, organizations of widespread data breach - 0 views

  • The FTC declined to identify the companies or organizations involved, but said they were both "private and public entities, including schools and local governments." The companies and organizations ranged in size from "businesses with as few as eight employees to publicly held corporations employing tens of thousands," the FTC said in a statement. It said sensitive data about customers and employees had been shared from the computer networks of the companies and organizations and made available on Internet peer-to-peer (P2P) file-sharing networks. The information was accessible to "any users of those networks, who could use it to commit identity theft or fraud," the FTC said. "Unfortunately, companies and institutions of all sizes are vulnerable to serious P2P-related breaches, placing consumers' sensitive information at risk," FTC chairman Jon Leibowitz said. "For example, we found health-related information, financial records, and drivers' license and social security numbers -- the kind of information that could lead to identity theft," Leibowitz said.
  •  
    The US Federal Trade Commission (FTC) said Monday it has notified nearly 100 companies and organizations of data breaches involving personal information about customers or employees.
Skeptical Debunker

GPS Jamming Devices Pose Many Threats (w/ Video) - 0 views

  • GPS jammers send out a radio signal that’s the same frequency as the satellite signal. Since GPS satellite signals are weak, a GPS jamming device that puts out approximately 2 watts is sufficient to disrupt a GPS signal in a vehicle that’s approximately within 10 feet of the device. This leaves the in-vehicle system unable to establish its position and report back to a GPS tracking center, where the vehicle is registered. There are also fears that terrorists can use these devices to disrupt air traffic and cause severe safety and economic damage to the US. More powerful jammers could disrupt GPS signals in close proximity of airports, causing safety concerns. Our military overseas use GPS extensively to record their position as well as the position of the enemy. With GPS jamming devices in the hands of our enemy, U.S. and allied forces can be severely impacted when launching ground and air-strikes.
  •  
    The latest GPS jamming devices are now being used by car thieves in the UK to render stolen cars and trucks undetectable by law enforcement. These devices also pose a threat to airlines and US military overseas.
Skeptical Debunker

Microsoft Recruited Top Notch Guns for Waledac Takedown - CIO.com - Business Technology... - 0 views

  • Microsoft revealed on Wednesday that it gained a court order that compelled VeriSign, the .com registry, to remove 277 ".com" names from its rolls, effectively cutting off communication between the Waledac's controllers and their infected machines. The legal action is unprecedented at the domain name level, said Andre' M. DiMino, co-founder of The Shadowserver Foundation, a group that tracks botnets and helped take down Waledac. In June 2009, a federal court ordered the shutdown of 3FN, a rogue ISP supplying connectivity to botnets such as Pushdo and Mega-D, but this appears to be the first major action at the domain-name level. "It's definitely pretty groundbreaking," DiMino said. "To disable and disrupt a botnet at this level is really pulling the weed out by the root." But behind the scenes, Microsoft's legal action was just one component of a synchronized campaign to bring down Waledac. Last year, researchers with the University of Mannheim in Germany and Technical University Vienna in Austria published a research paper showing how it was possible to infiltrate and control the Waledec botnet. They had studied Waledac's complicated peer-to-peer communication mechanism. Microsoft -- which was annoyed by Waledec due to its spamming of Hotmail accounts -- contacted those researchers about two weeks ago to see if they could perform their attack for real, according one of the University of Mannheim researchers, who did not want to be identified. "They asked me if there was also a way besides taking down those domains of redirecting the command-and-control traffic," said the Mannheim researcher. Waledac distributes instructions through command-and-control servers that work with a peer-to-peer system. Led by a researcher who did his bachelor thesis on Waledac, the action began early this week. "This was more or less an aggressive form of what we did before," the Mannheim researcher said. "We disrupted the peer-to-peer layer to redirect traffic not to botmaster servers but to our servers." At the same time, Microsoft's legal efforts brought down domain names that were used to send new instructions to drones. The result has been dramatic: Up to 90 percent of the infected machines, which amount to at least 60,000 computers, are now controlled by researchers, half of which are in the U.S. and Europe and the rest scattered around the globe.
  •  
    Four days ago, top-notch computer security researchers launched an assault on Waledac, a highly sophisticated botnet responsible for spreading spam and malicious software. As of Thursday, more than 60,000 PCs worldwide that have been infected with malicious code are now under the control of researchers, marking the effort one of the most highly successful coordinated against organized cybercrime.
Skeptical Debunker

Sea World killer whale attack video leads to malware | Graham Cluley's blog - 0 views

  •  
    Dawn Brancheau, a trainer at Sea World in Orlando, was killed yesterday after being attacked by a killer whale. News of the tragedy sped quickly around the world, and now sick cybercriminals are exploiting the story of 40-year-old Brancheau's death for their own commerical gain. Through SEO (search engine optimisation) techniques, hackers have created webpages stuffed with content which appears to be ghoulish video footage of the animal trainer's death - but are really designed to infect visiting computers.
Skeptical Debunker

Hold vendors liable for buggy software, group says - 0 views

  • "The only way programming errors can be eradicated is by making software development organizations legally liable for the errors," he said. SANS and Mitre, a Bedford, Mass.-based government contractor, also released their second annual list of the top 25 security errors made by programmers. The authors said those errors have been at the root of almost every major type of cyberattack, including the recent hacks of Google and numerous utilities and government agencies. According to the list, the most common mistakes continue to involve SQL injection errors, cross-site scripting flaws and buffer overflow vulnerabilities. All three have been well-known problems for
  •  
    A coalition of security experts from more than 30 organizations is urging enterprises to exert more pressure on software vendors to ensure that they use secure code development practices. The group, led by the SANS Institute and Mitre Corp., offered enterprises recent hacks of Google draft contract language that would require vendors to adhere to a strict set of security standards for software development. In essence, the terms would make vendors liable for software defects that lead to security breaches. "Nearly every attack is enabled by [programming] mistakes that provide a handhold for attackers," said Alan Paller, director of research at SANS, a security training and certification group.
  •  
    Of course, a more general way to address this and other "business" generated problems / abuses (like expensive required "arbitration" by companies owned and in bed with the companies requiring the arbitration!), is to FORBID contract elements that effectively strip any party of certain "rights" (like the right to sue for defectives; the right to freedom of speech; the right to warranty protections; the right to hold either party to public or published promises / representations, etc.). Basically, by making LYING and DECEIT and NEGLIGENCE liability and culpability unrestricted. Or will we hear / be told that being honest and producing a quality product is "anti-business"? What!? Is this like, if I can't lie and cheat being in business isn't worth it!? If that is true, then those parties and businesses could just as well "go away"! Just as "conservatives" say other criminals like that should. One may have argued that the software industry would never have "gotten off the ground" (at least, as fast as it did) if such strict liability had been enforced (as say, was eventually and is more often applied to physical building and their defects / collapses). That is, that the EULAs and contracts typically accompanying software ("not represented as fit for any purpose" more or less!) had been restricted. On the other hand, we might have gotten software somewhat slower but BETTER - NOT being associated with or causing the BILLIONS of dollars in losses due to bugs, security holes, etc. Others will rail that this will merely "make lawyers richer". So what if it will? As long as government isn't primarily "on the side" of the majority of the people (you know, like a "democracy" should be), then being able to get a individual "hired gun" is one of the only ways for the "little guy" to effectively defend themselves from corporate criminals and other "special interest" elites.
1 - 20 of 37 Next ›
Showing 20 items per page