Feeds
13170 items (0 unread) in 75 feeds
-
Watchfire Application Security Insider
-
BlogSecurity
-
sirdarckcat
-
Google Online Security Blog
-
CGISecurity.com: Your Web Site and Application Security Resource
-
Switch/Twitch
-
mybeNi websecurity
-
cat slave diary
-
SecuriTeam Blogs
-
Curiouser and Curiouser
-
Alex's Corner
-
Billy (BK) Rios
-
Chris Shiflett
-
christian's weblog
-
funkatron.com
-
GNUCITIZEN
-
The Spanner
-
hackademix.net
-
Ruby on Rails Security Project
-
It's a shampoo world anyway
-
Web Security Blog
-
ha.ckers.org web application security lab
-
Yet Another Infosec Blog
-
PHP Security Blog
-
Security Thoughts
-
Sunnet Beskerming Security Advisories
-
Disenchant's Blog
-
Sylvan von Stuppe
-
Larholm.com
-
The Turkey Curse
-
Jeremiah Grossman
-
Anurag Agarwal - Application Security Evangelist
-
Ivan Ristic
-
deep inside | security & tools
-
omg.wtf.bbq.
-
BlueHat Security Briefings
-
Tactical Web Application Security
-
.:Computer Defense:.
-
tssci security
-
Plynt Penetration Testing Blog
-
Michael Howard's Web Log
-
Security Retentive
-
BindShell.Net
-
Dominic White's .tHE pRODUCT
-
SecurityFocus News
-
Justice League
-
Schneier on Security
-
Rational Survivability
-
terminal23
-
1 Raindrop
-
hiredhacker.com
-
Matasano Chargen
-
-
Michael on Security - Musings on Information Security
-
Fortify blog
-
The Art of Software Security Assessment
-
GDS Security Blog
-
Vodun.org
-
Robert Penz Blog
-
Mark Curphey - SecurityBuddha.com
-
Liminal states
-
Security Ripcord
-
ModSecurity Blog
-
IBM Internet Security Systems Frequency X Blog
-
Suspekt...
-
extern blog SensePost;
-
Zero in a bit
Schneier on Security
-
Cryptography Spam
Posted: June 30th, 2009, 1:36pm CDT
Tags: [edit]
I think this is a first. Information security, and protection of your e-money. Electronic payments and calculations, on means of a network the Internet or by means of bank credit cards, continue to win the world market. Electronic payments, it quickly, conveniently, but is not safely. Now there is a real war, between users and hackers. Your credit card can... -
Growth of the CSE
Posted: June 30th, 2009, 6:32am CDT
Tags: [edit]
The Communication Security Establishment (CSE, basically Canada's NSA) is growing so fast they're running out of room and building new office buildings.... -
Anti-Stab Knife
Posted: June 29th, 2009, 2:18pm CDT
Tags: [edit]
I've already written about the risks of pointy knives. This no-stabbing knife is the solution, and seems not to be a joke. EDITED TO ADD (7/1): Some people have taken this blog post to imply that I am endorsing these knives. These are obviously not regular readers of mine. (For my part, I'm going to buy a very sharp and... -
Protecting Against the Snatched Laptop Data Theft
Posted: June 29th, 2009, 6:51am CDT
Tags: [edit]
Almost two years ago, I wrote about my strategy for encrypting my laptop. One of the things I said was: There are still two scenarios you aren't secure against, though. You're not secure against someone snatching your laptop out of your hands as you're typing away at the local coffee shop. And you're not secure against the authorities telling you... -
Friday Squid Blogging: 8 Gig USB Squid Flash Drive
Posted: June 26th, 2009, 4:52pm CDT
Tags: [edit]
Cute.... -
Fake Receipts
Posted: June 26th, 2009, 1:16pm CDT
Tags: [edit]
For all of you who want to scam your company's expense reimbursement system. I've heard of sites where you give them a range of dates and a city, and they give you a full set of receipts for a trip to that city: airfare, hotel, meals, everything -- but I can't find a website.... -
The Problem with Password Masking
Posted: June 26th, 2009, 6:17am CDT
Tags: [edit]
I agree with this: It's time to show most passwords in clear text as users type them. Providing feedback and visualizing the system's status have always been among the most basic usability principles. Showing undifferentiated bullets while users enter complex codes definitely fails to comply. Most websites (and many other applications) mask passwords as users type them, and thereby theoretically... -
Clear Shuts Down Operation
Posted: June 25th, 2009, 12:36pm CDT
Tags: [edit]
Clear, the company that sped people through airport security, has ceased operations. My first question: what happened to all that personal information it collected on its members? An answer appeared on its website: Applicant and Member data is currently secured in accordance with the Transportation Security Administration's Security, Privacy and Compliance Standards. Verified Identity Pass, Inc. will continue to secure... -
Authenticating Paperwork
Posted: June 25th, 2009, 6:11am CDT
Tags: [edit]
It's a sad, horrific story. Homeowner returns to find his house demolished. The demolition company was hired legitimately but there was a mistake and it demolished the wrong house. The demolition company relied on GPS co-ordinates, but requiring street addresses isn't a solution. A typo in the address is just as likely, and it would have demolished the house just... -
Workshop on Economics of Information Security
Posted: June 24th, 2009, 6:45am CDT
Tags: [edit]
I'm at the 8th Workshop on Economics and Information Security at University College London (field trip to see Jeremy Bentham). Ross Anderson is liveblogging the event. I wrote about WEIS 2006 back in 2006.... -
Fixing Airport Security
Posted: June 24th, 2009, 6:40am CDT
Tags: [edit]
It's been months since the Transportation Security Administration has had a permanent director. If, during the job interview (no, I didn't get one), President Obama asked me how I'd fix airport security in one sentence, I would reply: "Get rid of the photo ID check, and return passenger screening to pre-9/11 levels." Okay, that's a joke. While showing ID, taking... -
Research on the Security of Online Games
Posted: June 24th, 2009, 3:33am CDT
Tags: [edit]
The May/June 2009 issue of IEEE Security and Privacy contains five articles about the security of online games. Unfortunately, the articles are all behind paywalls.... -
John Walker and the Fleet Broadcasting System
Posted: June 23rd, 2009, 1:30pm CDT
Tags: [edit]
Ph.D. thesis from 2001: An Analysis of the Systemic Security Weaknesses of the U.S. Navy Fleet Broadcasting System, 1967-1974, as exploited by CWO John Walker, by MAJ Laura J. Heath Abstract: CWO John Walker led one of the most devastating spy rings ever unmasked in the US. Along with his brother, son, and friend, he compromised US Navy cryptographic systems... -
The Iranian Firewall
Posted: June 23rd, 2009, 9:09am CDT
Tags: [edit]
Technical information on Iran's attempts to censor the Internet... -
Eavesdropping on Dot-Matrix Printers by Listening to Them
Posted: June 23rd, 2009, 6:16am CDT
Tags: [edit]
Interesting research. First, we develop a novel feature design that borrows from commonly used techniques for feature extraction in speech recognition and music processing. These techniques are geared towards the human ear, which is limited to approx. 20 kHz and whose sensitivity is logarithmic in the frequency; for printers, our experiments show that most interesting features occur above 20 kHz,... -
John Mueller on Nuclear Disarmament
Posted: June 22nd, 2009, 1:46pm CDT
Tags: [edit]
The New York Times website has a blog called "Room for Debate," where a bunch of people -- experts in their areas -- write short essays commenting on a news item. (I participated a few weeks ago.) Earlier this month, there was a post on nuclear disarmament, following President Obama's speech in Cairo that mentioned the subject. One of the... -
Engineers More Likely to Become Muslim Terrorists
Posted: June 22nd, 2009, 7:10am CDT
Tags: [edit]
Time to start profiling. EDITED TO ADD: here's the paper.... -
Friday Squid Blogging: Squid Embryos
Posted: June 19th, 2009, 4:36pm CDT
Tags: [edit]
Nice photograph.... -
This Week's Movie-Plot Threat: Fungus
Posted: June 19th, 2009, 2:03pm CDT
Tags: [edit]
I had been wondering whether to post this, since it's not really a security threat -- there's no intelligence by the attacker: Crop scientists fear the Ug99 fungus could wipe out more than 80% of worldwide wheat crops as it spreads from eastern Africa. It has already jumped the Red Sea and traveled as far as Iran. Experts say it... -
Fraud on eBay
Posted: June 19th, 2009, 11:55am CDT
Tags: [edit]
I expected selling my computer on eBay to be easy. Attempt 1: I listed it. Within hours, someone bought it -- from a hacked account, as eBay notified me, cancelling the sale. Attempt 2: I listed it again. Within hours, someone bought it, and asked me to send it to her via FedEx overnight. The buyer sent payment via PayPal... -
Imagining Threats
Posted: June 19th, 2009, 6:49am CDT
Tags: [edit]
A couple of years ago, the Department of Homeland Security hired a bunch of science fiction writers to come in for a day and think of ways terrorists could attack America. If our inability to prevent 9/11 marked a failure of imagination, as some said at the time, then who better than science fiction writers to inject a little imagination... -
Lockpicking
Posted: June 18th, 2009, 12:59pm CDT
Tags: [edit]
Great article from Wired about the lockpicker Marc Tobias. Related: "Ten Things Everyone Should Know About Lockpicking & Physical Security."... -
New Computer Snooping Tool
Posted: June 18th, 2009, 7:08am CDT
Tags: [edit]
From the press release: Unlike existing computer forensics solutions, EnCase Portable runs on a USB drive, rather than a laptop, and enables the user to easily and rapidly boot a target computer to the USB drive, and run a pre-configured data search and collection job. The ease-of-use and ultra-portability of EnCase Portable creates exciting new possibilities in data acquisition. Even... -
The Psychology of Being Scammed
Posted: June 17th, 2009, 2:05pm CDT
Tags: [edit]
Fascinating research on the psychology of con games. "The psychology of scams: Provoking and committing errors of judgement" was prepared for the UK Office of Fair Trading by the University of Exeter School of Psychology. From the executive summary, here's some stuff you may know: Appeals to trust and authority: people tend to obey authorities so scammers use, and victims... -
Carrot-Bomb Art Project Bombs in Sweden
Posted: June 17th, 2009, 6:49am CDT
Tags: [edit]
Not the best idea: The carrot bombs had been placed around the city at the request of a local art gallery, as part of an open-air arts festival. They had only been in place for an hour before police received their first call. "We received a call ... from a person who said they saw two real bombs placed outside... -
Ever Better Cryptanalytic Results Against SHA-1
Posted: June 16th, 2009, 12:21pm CDT
Tags: [edit]
The SHA family (which, I suppose, should really be called the MD4 family) of cryptographic hash functions has been under attack for a long time. In 2005, we saw the first cryptanalysis of SHA-1 that was faster than brute force: collisions in 269 hash operations, later improved to 263 operations. A great result, but not devastating. But remember the great... -
DHS Has a Blog
Posted: June 16th, 2009, 9:40am CDT
Tags: [edit]
The U.S. Department of Homeland Security has a blog. I don't know if it will be as interesting or entertaining as the TSA's blog.... -
Prairie Dogs Hack Baltimore Zoo
Posted: June 16th, 2009, 7:24am CDT
Tags: [edit]
Fun story, with a lot of echoes of our own security problems: It took just 10 minutes for a dozen prairie dogs to outwit the creators of the Maryland Zoo's new $500,000 habitat. Aircraft wire, poured concrete and slick plastic walls proved no match for the fast-footed rodents, the stars of a new exhibit that opens today. As officials were... -
Did a Public Twitter Post Lead to a Burglary?
Posted: June 15th, 2009, 2:26pm CDT
Tags: [edit]
No evidence one way or the other: Like a lot of people who use social media, Israel Hyman and his wife Noell went on Twitter to share real-time details of a recent trip. Their posts said they were "preparing to head out of town," that they had "another 10 hours of driving ahead," and that they "made it to Kansas... -
The "Hidden Cost" of Privacy
Posted: June 15th, 2009, 6:45am CDT
Tags: [edit]
Forbes ran an article talking about the "hidden" cost of privacy. Basically, the point was that privacy regulations are expensive to comply with, and a lot of that expense gets eaten up by the mechanisms of compliance and doesn't go toward improving anyone's actual privacy. This is a valid point, and one that I make in talks about privacy all... -
Friday Squid Blogging: Squid Also See Through Non-Eye Organ
Posted: June 12th, 2009, 6:46pm CDT
Tags: [edit]
Weird: The UW-Madison researchers have been intrigued by the light organ's "counterillumination" ability -- this capacity to give off light to make squids as bright as the ocean surface above them, so that predators below can't see them. "Until now, scientists thought that illuminating tissues in the light organ functioned exclusively for the control of the intensity and direction of... -
Second SHB Workshop Liveblogging (9)
Posted: June 12th, 2009, 4:55pm CDT
Tags: [edit]
The eighth, and final, session of the SHB09 was optimistically titled "How Do We Fix the World?" I moderated, which meant that my liveblogging was more spotty, especially in the discussion section. David Mandel, Defense Research and Development Canada (suggested reading: Applied Behavioral Science in Support of Intelligence Analysis, Radicalization: What does it mean?; The Role of Instigators in Radicalization... -
Second SHB Workshop Liveblogging (8)
Posted: June 12th, 2009, 3:01pm CDT
Tags: [edit]
The penultimate session of the conference was "Privacy," moderated by Tyler Moore. Alessandro Acquisti, Carnegie Mellon University (suggested reading: What Can Behavioral Economics Teach Us About Privacy?; Privacy in Electronic Commerce and the Economics of Immediate Gratification), presented research on how people value their privacy. He started by listing a variety of cognitive biases that affect privacy decisions: illusion of... -
Second SHB Workshop Liveblogging (7)
Posted: June 12th, 2009, 12:01pm CDT
Tags: [edit]
Session Six -- "Terror" -- chaired by Stuart Schechter. Bill Burns, Decision Research (suggested reading: The Diffusion of Fear: Modeling Community Response to a Terrorist Strike), studies social reaction to risk. He discussed his theoretical model of how people react to fear events, and data from the 9/11 attacks, the 7/7 bombings in the UK, and the 2008 financial collapse.... -
Second SHB Workshop Liveblogging (6)
Posted: June 12th, 2009, 9:54am CDT
Tags: [edit]
The first session of the morning was "Foundations," which is kind of a catch-all for a variety of things that didn't really fit anywhere else. Rachel Greenstadt moderated. Terence Taylor, International Council for the Live Sciences (suggested video to watch: Darwinian Security; Natural Security), talked about the lessons evolution teaches about living with risk. Successful species didn't survive by eliminating... -
Second SHB Workshop Liveblogging (5)
Posted: June 11th, 2009, 4:50pm CDT
Tags: [edit]
David Livingstone Smith moderated the fourth session, about (more or less) methodology. Angela Sasse, University College London (suggested reading: The Compliance Budget: Managing Security Behaviour in Organisations; Human Vulnerabilities in Security Systems), has been working on usable security for over a dozen years. As part of a project called "Trust Economics," she looked at whether people comply with security policies... -
Second SHB Workshop Liveblogging (4)
Posted: June 11th, 2009, 2:56pm CDT
Tags: [edit]
Session three was titled "Usability." (For the record, the Stata Center is one ugly building.) Andrew Patrick, NRC Canada until he was laid off four days ago (suggested reading: Fingerprint Concerns: Performance, Usability, and Acceptance of Fingerprint Biometric Systems), talked about biometric systems and human behavior. Biometrics are used everywhere: for gym membership, at Disneyworld, at international borders. The government... -
Second SHB Workshop Liveblogging (3)
Posted: June 11th, 2009, 11:42am CDT
Tags: [edit]
The second session was about fraud. (These session subjects are only general. We tried to stick related people together, but there was the occasional oddball -- and scheduling constraint -- to deal with.) Julie Downs, Carnegie Mellon University (suggested reading: Behavioral Response to Phishing Risk; Parents' vaccination comprehension and decisions; The Psychology of Food Consumption), is a psychologist who studies... -
Second SHB Workshop Liveblogging (2)
Posted: June 11th, 2009, 9:37am CDT
Tags: [edit]
The first session was about deception, moderated by David Clark. Frank Stajano, Cambridge University (suggested reading: Understanding victims: Six principles for systems security), presented research with Paul Wilson, who films actual scams for "The Real Hustle." His point is that we build security systems based on our "logic," but users don't always follow our logic. It's fraudsters who really understand... -
Second SHB Workshop Liveblogging (1)
Posted: June 11th, 2009, 6:46am CDT
Tags: [edit]
I'm at SHB09, the Second Interdisciplinary Workshop on Security and Human Behavior, at MIT. This is a two-day gathering of computer security researchers, psychologists, behavioral economists, sociologists, philosophers, and others -- all of whom are studying the human side of security -- organized by Ross Anderson, Alessandro Acquisti, and myself. Here's the schedule. Last year's link will give you a... -
Malware Steals ATM Data
Posted: June 10th, 2009, 1:51pm CDT
Tags: [edit]
One of the risks of using a commercial OS for embedded systems like ATM machines: it's easier to write malware against it: The report does not detail how the ATMs are infected, but it seems likely that the malware is encoded on a card that can be inserted in an ATM card reader to mount a buffer overflow attack. The... -
I'm Selling My Laptop
Posted: June 10th, 2009, 11:47am CDT
Tags: [edit]
I'm selling my laptop on eBay. It's basically new, although the box has been opened. I wanted to downgrade the OS, but learned that one of the key drivers -- it controls the camera and the hibernate function -- was only available for Vista. So it's up for sale, at a good price. ETA: It's been sold.... -
Industry Differences in Types of Security Breaches
Posted: June 10th, 2009, 6:18am CDT
Tags: [edit]
Interhack has been working on a taxonomy of security breaches, and has an interesting conclusion: The Health Care and Social Assistance sector reported a larger than average proportion of lost and stolen computing hardware, but reported an unusually low proportion of compromised hosts. Educational Services reported a disproportionally large number of compromised hosts, while insider conduct and lost and stolen... -
Teaching Children to Spot Terrorists
Posted: June 9th, 2009, 2:45pm CDT
Tags: [edit]
You can't make this stuff up: More than 2,000 10 and 11-year-olds [in the UK] will see a short film, which urges them to tell the police, their parents or a teacher if they hear anyone expressing extremist views. [...] A lion explains that terrorists can look like anyone, while a cat tells pupils that [they] should get help if... -
Corrupted Word Files for Sale
Posted: June 9th, 2009, 6:46am CDT
Tags: [edit]
On one hand, this is clever: We offer a wide array of corrupted Word files that are guaranteed not to open on a Mac or PC. A corrupted file is a file that contains scrambled and unrecoverable data due to hardware or software failure. Files may become corrupted when something goes wrong while a file is being saved e.g. the... -
British High Schoolers Write About CCTV in School
Posted: June 8th, 2009, 1:38pm CDT
Tags: [edit]
If you think that under-20-year-olds don't care about privacy, this is an eloquent op-ed by two students about why CCTV cameras have no place in their UK school: Adults are often quick to define the youth of today as stereotypical troublemakers and violent offenders -- generalisations which are prompted by the media -- when in fact the majority of students... -
Fear of Aerial Images
Posted: June 8th, 2009, 6:15am CDT
Tags: [edit]
Time for some more fear about terrorists using maps and images on the Internet. But the more striking images come when Portzline clicks on the "bird's-eye" option offered by the map service. The overhead views, which come chiefly from satellites, are replaced with strikingly clear oblique-angle photos, chiefly shot from aircraft. By clicking another button, he can see the same... -
Friday Squid Blogging: Flying Squid
Posted: June 5th, 2009, 4:18pm CDT
Tags: [edit]
Ommastrephid squids "glide over the ocean surface."... -
Bullet Pen
Posted: June 5th, 2009, 12:19pm CDT
Tags: [edit]
Earlier this year, I blogged about a self-defense pen that is likely to easily pass through airport security. On the other hand, this normal pen in the shape of a bullet will probably get you in trouble.... -
Clever Combination Door Lock Design
Posted: June 5th, 2009, 6:53am CDT
Tags: [edit]
This combination door lock is very pretty. Of course, four digits is too short an entry code, but I like the overall design and the automatic rescrambling feature.... -
I'm Being Interviewed in Second Life Today
Posted: June 4th, 2009, 2:42pm CDT
Tags: [edit]
I'll be interviewed in Second Life on "Virtually Speaking" tonight at 9:00 PM ET.... -
Secret Goverment Communications Cables Buried Around Washington, DC
Posted: June 4th, 2009, 1:07pm CDT
Tags: [edit]
Interesting: This part happens all the time: A construction crew putting up an office building in the heart of Tysons Corner a few years ago hit a fiber optic cable no one knew was there. This part doesn't: Within moments, three black sport-utility vehicles drove up, a half-dozen men in suits jumped out and one said, "You just hit our... -
Cloud Computing
Posted: June 4th, 2009, 6:14am CDT
Tags: [edit]
This year's overhyped IT concept is cloud computing. Also called software as a service (Saas), cloud computing is when you run software over the internet and access it via a browser. The Salesforce.com customer management software is an example of this. So is Google Docs. If you believe the hype, cloud computing is the future. But, hype aside, cloud computing... -
Why Is Terrorism so Hard?
Posted: June 3rd, 2009, 1:35pm CDT
Tags: [edit]
I don't know how I missed this great series from Slate in February. It's eight essays exploring why there have been no follow-on terrorist attacks in the U.S. since 9/11 (not counting the anthrax mailings, I guess). Some excerpts: Al-Qaida's successful elimination of the Twin Towers, part of the Pentagon, four jetliners, and nearly 3,000 innocent lives makes the terror... -
Arming the Boston Police with Assault Rifles
Posted: June 3rd, 2009, 5:57am CDT
Tags: [edit]
Whose idea is this? The Boston Police Department is preparing a plan to arm as many as 200 patrol officers with semiautomatic assault rifles, a significant boost in firepower that department leaders believe is necessary to counter terrorist threats, according to law enforcement officials briefed on the plan. The initiative calls for equipping specialized units, such as the bomb squad... -
Update on Computer Science Student's Computer Seizure
Posted: June 2nd, 2009, 12:01pm CDT
Tags: [edit]
In April, I blogged about the Boston police seizing a student's computer for, among other things, running Linux. (Anyone who runs Linux instead of Windows is obviously a scary bad hacker.) Last week, the Massachusetts Supreme Court threw out the search warrant: Massachusetts Supreme Judicial Court Associate Justice Margot Botsford on Thursday said that Boston College and Massachusetts State Police... -
Research on Movie-Plot Threats
Posted: June 1st, 2009, 3:29pm CDT
Tags: [edit]
This could be interesting: Emerging Threats and Security Planning: How Should We Decide What Hypothetical Threats to Worry About? Brian A. Jackson, David R. Frelinger Concerns about how terrorists might attack in the future are central to the design of security efforts to protect both individual targets and the nation overall. In thinking about emerging threats, security planners are confronted...