Archive

Category Archives for "Networking"

So, You Want To Be A Manager

And so it was as a young man that I aspired to be a manager. Management looked like control to me. After all, I thought that as I acquired technical expertise in operating systems, security, and networking, I should be the one holding the reins. That’s logical, perhaps. But it’s naive.

Bill filed in Congress would ban encryption backdoors

Four Congressmen are proposing that states be forbidden to ask manufacturers to install encryption backdoors on their products outfitted with the technology. U.S. Rep. Ted Lieu The four filed a short bill this week that would deny states or parts of states from seeking alterations to products for the purpose of enabling surveillance of the user. It would also block them from seeking the ability to decrypt information that is otherwise unintelligible. The representatives filing the bill are Rep. Ted Lieu (D-Calif.), Rep. Blake Farenthold (R-Texas), Suzan DelBene (D-Wash.) and Mike Bishop (R-Mich.).To read this article in full or to leave a comment, please click here

U.S. intelligence chief touts IoT as a spying opportunity

In a brief aside during a Senate testimony on overall national security this week, U.S. director of national intelligence James Clapper justified the privacy and security advocates who have warned of the implications of the Internet of Things (IoT) since before it was a buzzword."In the future, intelligence services might use the [Internet of Things] for identification, surveillance, monitoring, location tracking, and targeting for recruitment, or to gain access to networks or user credentials," Clapper said, according to The Guardian.To read this article in full or to leave a comment, please click here

Don’t touch the malware at this museum

Malware moments you wish to forgetImage by Jelene Morris (modified)Jason Scott, archivist and software curator for the Internet Archive, and Mikko Hypponen, chief research officer of F-Secure, have brought together this group of malware to mark some of the early viruses. Here are only a few, with another batch to be displayed soon.To read this article in full or to leave a comment, please click here

Underhanded C contest winner’s code fools nuke inspectors into destroying fake nukes

What if Alice and Bob represented countries that agreed to a nuclear disarmament treaty, but neither trusted the other enough to scan a warhead and observe the test results because the scans revealed sensitive information about their nuclear program? In the end, the countries agree to build a fissile material detector that would output only a “yes” or “no” as to if each country dismantled real warheads and not fakes.In essence, that was the scenario for the annual Underhanded C Contest which tasked programmers with solving “a simple data processing problem by writing innocent-looking C code, while covertly implementing a malicious function. This type of malicious program, in the real world, could let states take credit for disarmament without actually disarming.”To read this article in full or to leave a comment, please click here

Healthcare CIO: Legal issues are most difficult cloud migration challenge

Boston healthcare organization CIO and longtime technology standards leader John Halamka has been quite open over the years about his organization's technology efforts and challenges. Back in 2002 he shared his hospital's 3-day struggle with network slowdowns. Last Year,  the Beth Israel Deaconess Medical Center CIO sounded the alarm that an FDA warning about a compromised medical device wouldn't be the last.To read this article in full or to leave a comment, please click here

CSO Online’s 2016 data breach blotter

Another day, another data breachImage by ThinkstockThere were 736 million records exposed in 2015 due to a record setting 3,930 data breaches. 2016 has only just started, and as the blotter shows, there are a number of incidents being reported in the public, proving that data protection is still one of the hardest tasks to master in InfoSec.To read this article in full or to leave a comment, please click here

IDG Contributor Network: Drugs, guns, and hitmen more common on dark web than religious extremism

What many of us likely suspected, but possibly hadn't gone to the trouble—or had the inclination—of finding out for ourselves is that the dark web is full of illegal and dubious stuff, researchers have found. The researchers, who have been studying and writing about encryption policy, sniffed around with a Tor browser and found 1,547 out of 5,205 total websites live on the dark web engaging in illegal activity. Those illicit destinations, uncovered in early 2015, covered subjects relating to illegal drugs, money laundering, and "illegitimate" pornography, the Kings College London scientists write in their Cryptopolitik and the Darknet paper abstracted in Survival: Global Policy and Strategy, a journal.To read this article in full or to leave a comment, please click here

SAP slaps patch on leaky factory software

SAP's February round of critical software updates includes one for SAP Manufacturing Integration and Intelligence (xMII) that may be of interest to hackers and spies. The software is widely used in manufacturing industry, where it connects factory-floor systems to business applications for performance monitoring -- but a flaw in it meant that restrictions on who could see what were not enforced. The patch for xMII fixes a directory traversal vulnerability, SAP reported Tuesday in security note 2230978. The vulnerability could have allowed attackers to access arbitrary files and directories on an SAP fileserver, including application source code, configuration and system files and other critical technical and business-related information, security researchers at ERPScan said Wednesday.To read this article in full or to leave a comment, please click here

Security ‘net 0x1339ED2: Security begins with you

I’m a couple of days late with this post for Data Privacy Day,, but not too late for Data Privacy Month (February). I wanted to highlight it anyway (and maybe I’ll put it on my calendar so I don’t forget next year). The point, of course (“you don’t need to have a point to have a point”) is that each and every one of us—that’s you and I, in case you’ve not gotten it yet—need to take security seriously. Security begins with you. To this end, the Cloud Security Alliance has a good post up on what you can do to improve data privacy.

Why are end users so mistake-prone? Because, frankly, most don’t care. They think data security is IT’s problem—that if IT does its “job” and filters out the threats, they have nothing to worry about. Moreover, when they do something stupid, they think it’s IT’s job to come to the rescue. They don’t understand the risks they create for the company or the fact that once rung they can’t unring the bell. So, they go on ignoring security policies and finding creative workarounds for security measures that inconvenience them—such as utilizing “shadow IT.”

Continue reading

Microsoft fixes 36 flaws in IE, Edge, Office, Windows, .NET Framework

Microsoft released its second batch of security updates for this year, addressing a total of 36 flaws in Internet Explorer, Edge, Office, Windows and .NET Framework.The patches are covered in 12 security bulletins, five of which are rated critical. There is also a thirteenth bulletin, also critical, for Flash Player. Although it's maintained by Adobe, Flash Player is included with Internet Explorer 11 and Edge, so Microsoft is distributing Adobe's patches through Windows Update.Researchers from security vendor Qualys believe that MS16-022, the Flash Player bulletin, should be at the top of users' priority list this month because it contains fixes for 22 critical vulnerabilities that could give attackers complete control over computers. Flash Player is a frequent target for attackers and can be exploited by simply visiting a malicious or compromised website.To read this article in full or to leave a comment, please click here

IBM’s X-Force team hacks into smart building

As buildings get smarter and increasingly connected to the Internet, they become a potential vector for attackers to target.IBM's X-Force ethical hacking team recently ran a penetration test against a group of office buildings using building automation systems that controlled sensors and thermostats.In this particular case, a building management company operated more than 20 buildings across the United States, as well as a central server.Without any social engineering, or online data gathering about employees, the team targeted one building."We did it old-school, just probing the firewall, finding a couple of flaws in the firmware," said Chris Poulin, research strategist for IBM's X-Force. "Once we had access to that, we had access to the management system of one building."To read this article in full or to leave a comment, please click here

Identity thieves obtain 100,000 electronic filing PINs from IRS system

The Internal Revenue Service was the target of an attack that used stolen social security numbers and other taxpayer data to obtain PINs that can be used to file tax returns electronically.The attack occurred in January and targeted an IRS Web application that taxpayers use to obtain their so-called Electronic Filing (E-file) PINs. The app requires taxpayer information such as name, Social Security number, date of birth and full address.Attackers attempted to obtain E-file PINs corresponding to 464,000 unique SSNs using an automated bot, and did so successfully for 101,000 SSNs before the IRS blocked it.The personal taxpayer data used during the attack was not obtained from the IRS, but was stolen elsewhere, the agency said in a statement. The IRS is notifying affected taxpayers via mail and will monitor their accounts to protect them from tax-related identity theft.To read this article in full or to leave a comment, please click here

Dumping Core: Analytical Findings on Trojan.Corebot

Download the full report here. The Corebot banking trojan was initially discovered and documented last year by researchers at Security Intelligence. Since then, it has evolved rapidly and, in terms of capabilities such as browser-based web injections, it is now similar to the dominant banking malware such as Zeus, Neverquest, and Dyreza although its actual impact to date is […]
1 … 2,789 2,790 2,791 2,792 2,793 … 3,443