News
Security and the Net
News and opinions about security, the internet and more
Security and the Net
News and opinions about security, the internet and more
-
.SE domains offline
- Due to a bug in new software, all .se domain names have been unreachable last last night, and can in some cases continue to be unreachable. The problem started when the .SE registry published an updated list of nameservers. It’s an error DNS administrators around the world make on a daily basis, but it’s been [...]
-
Is mobile advertising working for Google?
- A little over a year ago, Google’s CEO Eric Schmidt said that the mobile Internet was “the next major growth wave for Google”. His prediction at the time was that mobile advertising revenue would surpass the revenue seen from “traditional” ads. Several months after Schmidt made these predictions, I first installed the incredible WPtouch theme [...]
-
Printing handcuff keys
- At this year’s Hacking At Random event/conference (HAR2009), a member of SSDeV (the “Sportenthusiasts of Lockpicking”) managed to pull off a very cool stunt: he copied a key for police handcuffs without owning the original key itself. What he did was print a key using a 3D printer; the key was created and checked by [...]
-
Extensions coming to Chrome browser
- Last week, the Chromium development team announced that the extension system has finally been released to the dev-channel. This is an important step, since it means users of the most bleeding edge version will now have the extensions system on by default, without requiring them to boot Chromium with the –enable-plugins flag. The “dev [...]
-
Dutch Ministry accidentally publishes credit card info
- While the list of credit card numbers isn’t that large, this might just be one of the biggest blunders I’ve seen this month. The Dutch Ministry of Internal Affairs managed to publish the credit card numbers and expiration dates for both the Minister of Health and the Minister of Justice. The Telegraaf, one of the [...]
-
Tele2 Netherlands giving the same password to all users
- The Dutch branch of ISP Tele2, an European ISP that is active in 11 countries, has just admitted that they use the same password for all new subscribers. Their procedure goes like this: When a new subscriber signs up, they can choose a login or are assigned one. They are then sent a letter by [...]
-
Palm defends tracking Pre user locations
- Would you like it if you knew the manufacturer of your phone was tracking your location every day to give you a “great user experience”? I personally wouldn’t buy a phone that does this, but this is exactly what Palm’s Pre is designed to do. Faced with complaints about this feature, the best explanation Palm [...]
-
How not to respond to security issues
- Wat is the worst response you can give when someone alerts you about a security issue in your software? I can almost hear you thinking: “waiting two years to fix it“, but there is an even worse response. Some companies just simple don’t respond at all. Simply amazing… After verifying the issue we contacted the [...]
-
Squirrelmail plugins altered by hackers
- Last month, the webserver hosting the popular open source webmail suite SquirrelMail was compromised. At that time, the maintainers thought no source code had been altered: At approximately 1700 GMT, on June 16, it was discovered that the SquirrelMail webserver had been compromised. The project administrators took immediate action to mitigate any futher compromises, locking [...]
-
Dutch court rules that The Pirate Bay should be blocked
- A Dutch court has just ruled that access to The Pirate Bay should be blocked for all visitors coming from the Netherlands. The block should be in place within 10 days. The case was brought before the court by Stichting BREIN, an organization that can be best described as the Dutch version of the RIAA. The [...]
-
iPhone 3GS encryption “useless”?
- Wired has a report about the iPhone 3GS encryption feature. Jonathan Zdziarski is quoted as saying the encryption is basically worthless; while that quote alone wouldn’t normally attract my attention, the article has a lot of details that should make a lot of businesses think twice about relying on the “wipe my phone” feature. As [...]
-
92% of Flash users affected by 0-day hole?
- Secunia released some interesting statistics last week; according to their numbers, at least 92% of the people using their PSI scanner that have Flase Player installed are running a version that is affected by the zero-day attack that was recently discovered. The real number might be even higher; they didn’t release combined numbers for users [...]
-
IPv6: downsides of a larger address space
- With the increasing uptake of the new IPv6 internet protocol, people are starting to notice some of the downsides of the larger amount of IP addresses that will become available. An excellent example are the MTU issues Geoff Huston wrote about earlier this year, and as IPv6 adoption increases more problems are likely to appear. [...]
-
Browser Security Lessons from the Chrome team
- ACM Queue has just added a new paper by Charles Reis, Adam Barth and Carlos Pizano. It expands upon the information published earlier about the effectiveness various browsers’ update mechanisms, adding information about the measures taken to keep users from visiting malicious websites and, more importantly, the ways in which they prevent the inevitable bugs [...]
-
New guess about YouTube losses
- New research by analyst firm RampRate suggests that a previous report by Credit Suisse that claimed YouTube was losing over a million dollars a day was based on wrong assumptions. The number RampRate arrives at is way lower; they estimate a loss of $174.2 million a year. The main difference is in the estimated cost [...]
-
Belgian government releases source code for election software
- The Belgian government has just released the source code for the software used in the 2008 elections to the public. The news was first reported by the Open Source Observatory & Repository Europe; the files are presented in two zipfiles that contain mostly C and C++ source code. As the OSOR found, there appears to [...]
-
50 ways to inject your SQL
- No, this is not a list of 50 ways to inject SQL; it’s a link to a “50 ways to leave your lover” parody. The singer won’t win any awards for this performance, but the lyrics are great! Evade the regex, Rex Encode it all in hex Unbalance the quotes, Vinod And change the query [...]
-
Should Twitter manage their own hosting?
- As several news articles made clear yesterday, Twitter depends on NTT for hosting its website. They have only been with NTT for about a year now; the move there was announced in february of last year. While the move was part of their efforts to make their service more reliable, yesterday’s maintenance issue shows that [...]
-
Spammers are stupid
- I just found the funniest comment I’ve ever seen in my moderation queue. It appears the spammer didn’t quite understand his automated comment-spam-posting software, so he posted his entire template instead: Hi Fellow Blogger, I’ve never posted before, {but|only} your article was so {good|genuine} I just had to {stop|come} in and say GREAT JOB ! [...]
-
Apple admits Mac OS users can get viruses
- It’s taken them several years to finally get to this point, but Apple has acknowledged that Mac users are not immune from viruses. During WWDC, their Mac OS security page was updated with the following text: There has been a warning about viruses and malware on their website before, but it was buried in their [...]
Dark Reading
DarkReading - All Stories
DarkReading
- Could USB Flash Drives Be Your Enterprise's Weakest Link? - The Pentagon last week conceded that a USB flash drive carried an attack program inside a classified U.S. military network. Could your company be next?
- Delaware Contractor Mistakenly Posts Personal Data Of 22,000 Employees - State of Delaware contractor Aon mistakenly posts personal data of 22,000 retirees without randomization, officials say
- IBM Corrects Unpatched Vulnerability Numbers After Google Challenge - X-Force Team at IBM revises data on vendors with most unpatched bugs in recent IBM X-Force 2010 Mid-Year Trend and Risk Report
- Major Disruption of Pushdo Botnet Wasn't The Original Goal - Botnet's spam traffic cut by 80 percent
- China, Taiwan Nab 450 Suspects In Biggest Fraud Raid Ever - Law enforcement authorities in China, Taiwan seize cash, fraud "manuals" from alleged telecom fraud ring
- Four Best Practices For Tokenization - Going beyond Visa's best practices guide
- Mariposa Botnet Operators Didn't Bite In 'Cookie-Stuffing' Offer - Ecommerce fraud technique siphons commission, referral fees from website affiliates
- Careful With That Third-Party Web Widget - Smaller businesses are more likely to use third-party Web applications on their websites -- and they are less likely to scan such code
- California Legislation Would Require Companies To Specify The Data Exposed In Breaches - New legislation sitting on Governor Arnold Schwarzenegger's desk raises issue of standard breach notifications
- DNSSEC Will Drive Certificate Market - While DNNSEC will improve domain authentication, certificates still needed to verify the brand
- Mobile Devices Threaten Enterprises From Within - Security researchers are focusing increasingly on mobile devices. The result: your next insider attack could come from a smartphone
- United Nations Website Contains SQL Injection Flaws Three Years After Hack, Researcher Says - Bug used in infamous 2007 defacement fixed, but additional SQL injection bugs remain
- Tech Insight: Using Network Segmentation And Access Control To Isolate Attacks - The right network design can protect against hidden threats from embedded systems and rogue access points as well
- Tiger Team Sends DHS Suggestions On How To Better Safeguard Patient Privacy - 19-page letter recommends that the HIT Policy Committee adopt the guidelines set out in the Fair Information Practices
- Intel To Purchase McAfee For $7.68 Billion In Cash - Security experts skeptical of hardware-based security strategy
- Slideshow: Fashion Statements from DEFCON 2010 - Tattoos, mohawks, sheep, and 'pimp' necklaces were just some of the scenes from the hacker conferences in Las Vegas earlier this month.
- Researcher Cracks ReCAPTCHA - Homegrown algorithms for cheating Google's reCAPTCHA released earlier this month
- Ferreting Out Rogue Access Points And Wireless Vulnerabilities - To comply with regulations, companies increasingly must scan their wireless networks -- a third of which have rogue APs or other insecurities
- Mass Drive-By Attack Used Web Widget - Attack used a different spin on mass injection, targeted hosting provider Network Solutions Inc.
- Inside Verizon's Insider Threat Data - Verizon Business' latest Data Breach Investigations Report shows insiders as a growing threat -- but increase comes from a selective data set


