Subscribe to the RSS feed

It's once again travel time. Full disclosure: I was the first to publish an exploit against travel systems. Co-released with iDefense (since acquired by Symantec) this simple denial of service exploit was capable of halting operations at most airlines and airports in the United States.

Comment on this blog entry

With major cyber-security initiatives by the Department of Homeland Security underway, and the U.S. House of Representatives passing nearly $400 million in IT security research, I wonder if the efforts are being placed where they are most needed, and if more would be achieved by focusing on application security - and unleashing the bug finders.

Comments(1)

In a just released report, IT security firm MANDIANT painfully breaks down the anatomy of the sophisticated threats targeting businesses and western governments. The company says the study is based on seven years of front-lines breach investigation for the public and private sector. It's worth a look.

Comments(1)

Through its acquisition of Phion, Barracuda Networks has launched a line of seven enterprise firewalls meant to consolidate network security devices and reduce management overhead when dealing with numerous distributed firewalls.

Comment on this blog entry

Dentists, physicians, and veterinarians are asking the Federal Trade Commission to exclude healthcare professionals from regulations designed to mitigate the risks of identity theft. I say: Step up and protect your customers from identity theft.

Comments(1)

A report this week shows the number of phishing attacks continue to climb, year over year. Ditto for the number of Web servers dishing out malware. And the country that hosts the most phishing sites? That one just may surprise you.

Comment on this blog entry

The news of a cyber attack from within China on Google and other companies has prompted a range of reactions, including Google's decision to reassess its operations there and a rebuke from U.S. Secretary of State Hillary Clinton. But no one should be surprised by what happened. Two months earlier, a U.S. government report warned that the private sector was susceptible to this very risk.

Comments(1)

Businesses that suffered a data breach in 2009 paid a higher price for the incident than any previous year, according to a study released today. Also, the average cost for a data breach reached an eye-opening $6.75 million.

Comments(2)

The virtual network, Tor, designed to provide private and secure Web browsing to people around the world had a number of servers hacked recently. The Tor anonymous network is helpful to those living in nations that oppress free speech, such as China and Iran, and need unfettered access to information.

Comment on this blog entry

Had the Chinese shot intercontinental ballistic missiles into 33 US-based businesses including those in the finance and defense industries as well as the Mountain View-based headquarters of Google, there would be no question in anyone's mind as to whether war had been declared on the US. Is there any difference now that a Chinese government-backed organization has cyber-attacked 33 US businesses? Let's be honest with ourselves. It was an act of war and it deserves more of a response from the US government than it is getting.

Comments(11)

I've ranted on the subject before, but it's worth sounding off again in light of the recent China hacker breaches of Gmail: Poor software development procedures are the big reason major firms are apparently running around scared witless that their products are vulnerable to cyberattacks. (The corollary, about which we haven't read anything, is that firms with buttoned-down dev rules are likely feeling, if not entirely safe, then at least free of the panic which plagues the cluelessly unprepared.)

Comments(1)

Today Websense released what is touted as the first security application for Facebook, developed via its recently acquired Defensio brand. Facebook users can now monitor their pages for unwanted content, including spam comments, profanity, and links to malware. This could be valuable for companies that want to control their online images and brands.

Comment on this blog entry

A survey of 132 network operators and telecommunication providers reveal that Distributed Denial-of-Service (DDoS) attacks is the top day-to-day security challenge facing service providers.

Comment on this blog entry

From separate coasts, InformationWeek editorial director Fritz Nelson and I have been trying to launch the video version of the Fritz & David Show for what seems like forever. But technology has conspired against us. We're close, and we'll keep trying. But in the meantime, we've decided to offer the audio version of the weekly program that gives you a peek at how we talk about latest technology news and buzz amongst ourselves here at InformationWeek.

Comment on this blog entry

Had Novell's director of public relations Ian Bruce not responded to my blog post about Google's choice to change Gmail's default transmission mode from the less secure HTTP (Web) to the more secure and encrypted HTTPS (Secure Web), I would have never seen his own blog post on Novell's Web site entitled On Google, e-mail security, and cloud. But I'm glad I saw it. It's evidence of how some vendors might be too quick to throw fuel on the fire of misinformation in order to draw positive attention to themselves.

Comments(2)

We now know that one of the vectors used in the series of attacks against U.S. businesses was a zero-day vulnerability in Internet Explorer. Apparently, the way most of the world learned of this particular flaw was when it was actually used in these attacks. That's some powerful form of "disclosure," but how common is it?

Comment on this blog entry

Attackers targeting victims through phishing e-mails that lure users to maliciously crafted Web sites is nothing new. But it does highlight the sophistication of the modern attacker.

Comment on this blog entry

Kudos to the folks at Gmail who, in defaulting to a secure browser setting (as opposed to the previous insecure default) for sending and retrieving email, have decided to help users who may not know enough to help themselves. The new default (see screenshot below) tells the browser to access the Gmail service over HTTPS instead of the prior default, HTTP. This significant shift by Google is a reminder that there's probably more you can do to secure your organization's data and communications.

Comments(5)

In his most recent column, Art Wittmann explained that we're not going to see a "year of the cloud" because cloud is an evolutionary process, and evolution takes time. In general, that's true, but there's one area where the pace tends to be quicker—security. Attackers aren't sitting back waiting for new techs to gain maturity. They're throwing everything they have at our networks, hoping something sticks and yields a payoff in stolen data.

Comment on this blog entry

Microsoft is releasing only one security update today. Security teams hoping for a break today: forget it. Adobe is expected to release a patch of its own, and Oracle is releasing two dozen of its own software updates.

Comment on this blog entry

Security managers have to fight for - and justify - every nickel in their budget coffers. Unfortunately, many security managers have a tough time winning the funds they feel are necessary to reduce business risk. And many end up relying on instilling the fear of bad regulatory audit findings and fines to win funds. While often a successful tactic, does wielding the compliance hammer-of-fear pose risks of its own to an IT security program?

Comment on this blog entry

Two separate Internet security firms are warning customers that Microsoft Office users are being specifically targeting in these attacks.

Comment on this blog entry

As I read PandaLab's Annual Malware Report, just published yesterday, the headline number of 25 million new malware samples struck me in this way: So What. And it leaves one wondering why some security vendors choose to focus so heavily on Fear, Uncertainly, and Doubt (FUD). Most of that "new" malware crud doesn't get anywhere.

Comment on this blog entry

Adobe Acrobat and Adobe Reader are vulnerable and under attack from a new, sophisticated zero-day Javascript exploit according to the SANS Internet Storm Center.

Comment on this blog entry

We certainly thought viruses and digital exploits were a nuisance throughout the 1990s. But there was nothing like the Morris worm that played havoc on Internet users on November 2, 1988. That all changed in the spring of 2000, and what a can of worms the oughts turned out to be. And how quaint the malware of the 1990s looks in comparison.

Comment on this blog entry

There has been a recent rash of worms and malware targeting (jailbroken) iPhones. A group of researchers from SRI International published a study of an Apple iPhone bot client, captured just before Thanksgiving.

Comments(1)

The Wall Street Journal reported today that Iraqi militants are able to intercept live feeds from U.S. military predator drones with standard hardware equipment and a $30 software application.

Comment on this blog entry

According to news reports, the American and Russian governments are engaged in talks designed to pave a way for a more secure Internet and a treaty to limit certain types of cyberweapons.

Comment on this blog entry

Want a better idea of how organizations get infiltrated, including detailed synopsis of how many successful data breaches occur? Sit down with a copy of the just released Verizon Data Breach Investigations Supplemental Report and you'll get a great idea.

Comments(1)

Cisco released its Cisco 2009 Annual Security Report this morning, and it contains some interesting insight on many of the vulnerabilities and threat vectors we face today.

Comment on this blog entry

While there hasn't been any attacks on iPhones that haven't been jailbroken, one researcher has shown that once a rogue application makes its way onto the device - there's not much it can't do with your data.

Comments(1)

The Harris County Hospital District of Houston, Texas, fired 16 employees, accusing them of violating patient privacy laws by inappropriately accessing the records of a medical resident who'd been admitted to the hospital after she was shot in a grocery store parking lot.

Comment on this blog entry

Security researchers at CA have found a new so-called "ransomware" attack underway. There are many things you can say about malware writers. Most of it would be NSFW. But you can't say they don't work hard at what they do.

Comment on this blog entry

After a couple of years of rest, L0phtCrack, one of the most famous password auditing and recovery tools is back.

Comment on this blog entry

For about a year now, Microsoft has been trying to gather data on real-world attacks, the types of attacks normal users might encounter in their day to day Internet use - and the software maker just released some interesting data on password attacks.

Comment on this blog entry

There's exploit code circulating that can be used to target certain versions of Internet Explorer, Microsoft says it's working on a fix.

Comments(1)

There is much developers can do to build a secure operating system when limits are set on what devices are supported, and there's no regard for compatibility with all types of software applications. I'm sure it's a luxury some software designers in Redmond and Cupertino certainly envy. But that's the clean shot Google has with its new Chrome OS.

Comments(1)

While OS X is targeted by a far fewer number of viruses than other operating systems, that's not stopping fraudsters from trying to hit Mac users with fraud.

Comments(2)

The Health Information Trust Alliance (HITRUST) has unveiled a new program that helps streamline how healthcare organizations report to their business associates their status of compliance to security regulations such as HIPAA and others.

Comment on this blog entry

With a focus on risks, rather than only ranking software vulnerabilities, the Open Web Application Security Project (OWASP) has made a significant - and welcomed - change in how the organization rates Web application security weaknesses.

Comment on this blog entry

Security firm Palo Alto Networks peeked at the application use of more than 200 organizations around the globe, and found social networking growth on corporate networks is on fire. Will security concerns be the extinguisher? Don't count on it.

Comment on this blog entry

The SANS Institute Internet Storm Center is warning users of jailbroken iPhones that a new worm is targeting their hacked phones. So how dangerous is it, really?

Comment on this blog entry

As part of its monthly ritual, Microsoft in its Security Bulletin Advanced Notification for this month warned of a number of nasty vulnerabilities in its operating systems and productivity software.

Comments(2)

Techies are seeking professional certifications in emerging areas like healthcare and green IT, and especially old standbys like IT security, according to a new survey.

Comments(4)

A Manhattan DA brought an 149-count indictment accusing a computer technician of stealing the identities of more than 150 employees of the Bank of New York Mellon and using those identities to orchestrate more than $1.1 million in thefts against charities and non-profits, among other institutions.

Comment on this blog entry

New open source honeypot sets bait to lure attackers and to gain first hand information on current attack techniques underway.

Comment on this blog entry

Blue Coat has identified a new malware trick just in time for Halloween. Unsuspecting victims are redirected to one of two malware sites after searching for Halloween related sites. These distribution sites are typically used for hosting of warez, pirated digital content, but have been switched to malware distribution in the past 12 hours.

Comment on this blog entry

Mozilla just released 16 patches for vulnerabilities in Firefox. Eleven of the flaws are critical, and affect a number of components in the browser.

Comment on this blog entry

The news site Guardian is warning members of its UK jobs site that the site has been breached, and that personal data may been snagged.

Comments(1)

Hacks targeting U.S. government computers are coming from China. We knew that. The Chinese hackers are relying on zero-day software vulnerabilities to exploit critical systems. So, tell me again: why aren't we doing more to require applications be built secure from the start?

Comment on this blog entry