Early Internet services considered harmful

This journalist, while writing a story on the #FBIvApple debate, got his email account hacked while on the airplane. Of course he did. His email account is with Earthlink, an early Internet services provider from the 1990s. Such early providers (AOL, Network Solutions, etc.) haven't kept up with the times. If that's still your email, there's pretty much no way to secure it.

Early Internet stuff wasn't encrypted, because encryption was hard, and it was hard for bad guys to tap into wires to eavesdrop. Now, with open WiFi hotspots at Starbucks or on the airplane, it's easy for hackers to eavesdrop on your network traffic. Simultaneously, encryption has become a lot easier. All new companies, those still fighting to acquire new customers, have thus upgraded their infrastructure to support encryption. Stagnant old companies, who are just milking their customers for profits, haven't upgraded their infrastructure.

You see this in the picture below. Earthlink supports older un-encrypted "POP3" (for fetching email from the server), but not the new encrypted POP3 over SSL. Conversely, GMail doesn't support the older un-encrypted stuff (even if you wanted it to), but only the newer encrypted version.


Thus, if you are a reporter using Continue reading

BlackBerry sets up cybersecurity consulting service

BARCELONA -- BlackBerry on Wednesday announced a new 60-person cybersecurity consulting service, which will include staff from its recent acquisition of UK-based Encription Limited.The purchase of Encription was completed Feb. 19, but terms were not disclosed.BlackBerry officials at Mobile World Congress said cybersecurity consulting is a lucrative field because of a global explosion of cyberattacks on businesses and governments.Data breaches cost the global economy more than $400 billion a year, BlackBerry said, citing 2015 data from the Ponemon Institute. Gartner said cybersecurity consulting is about a $16.5 billion annual global business, and that it is expected to grow to $23 billion by 2019.To read this article in full or to leave a comment, please click here

Hackers can access the Nissan Leaf via insecure APIs

Two security researchers have demonstrated security vulnerabilities in the Nissan Leaf electric car by using mobile management APIs supplied by the car manufacturer.The unsecured APIs allow anyone who knows the VIN number of a car to access non-critical features such as climate control and battery charge management from anywhere across the Internet. Additionally, someone exploiting the unauthenticated APIs can see the car's estimated driving range.+ ALSO: Car hackers urge you to patch your Chrysler, Ram, Durango, or Jeep +To read this article in full or to leave a comment, please click here

Introducing CloudFlare Registrar: Designed for Security, Not the Masses

CloudFlare Registrar Badge

At CloudFlare, we’ve constructed one of the world’s largest networks purpose-built to protect our customers from a wide range of attacks. We’re so good at it that attackers increasingly look for ways to go around us, rather than go through us. One of the biggest risks for high-profile customers has been having their domain stolen at the registrar.

In 2013, we became intimately familiar with this problem when domains for the New York Times were hijacked and the newspaper’s CTO reached out to us to help get it back. We were able to assist, but the newspaper had its web and email traffic rerouted for hours.

Since the New York Times domain hijack, a number of other sites have had their domains stolen. We ourselves have seen multiple attempts to take control of CloudFlare’s registrar account. Thankfully, none have been successful—but some have gotten closer than we were comfortable with. Given the risk, we began looking for a registrar with security protocols that we could trust.

A Brief History of Registries and Registrars

In the early days of the Internet, domain registration was free. As the Internet began to take off, demand for domain registrations exploded. In 1993, unable to Continue reading

The Sony Pictures hackers have been hitting organizations from different countries for years

The group of hackers that crippled the computer infrastructure of Sony Pictures Entertainment in late 2014 has been responsible for a large number of attacks against organizations from South Korea, the U.S. and other countries over the past seven years.The group has been dubbed Lazarus by a coalition of security vendors who have worked together over the past two years to investigate its activities. During this time they've established links between Lazarus and 1,000 malicious file samples organized in over 45 distinct malware families.The researchers found evidence of attacks by this group against organizations from the government, media, military, aerospace, financial, and critical infrastructure sectors stretching as far back as 2009. The attacks included cyberespionage, denial of service, data theft and data destruction.To read this article in full or to leave a comment, please click here

Drowning in the Data of Things

DrowningSign

If you saw the news coming out of Cisco Live Berlin, you probably noticed that Internet of Things (IoT) was in every other announcement. I wrote about the impact of the new Digital Ceiling initiative already, but I think that IoT is a bit deeper than that. The other thing that seems to go hand in hand with discussion of IoT is big data. And for most of us, that big data is going to be a big problem.

Seen And Not Heard

Internet of Things is about dumb devices getting smart. Think Flowers for Algernon. Only now, instead of them just being smarter they are also going to be very talkative too. The amount of data that these devices used to hold captive will be unleashed on something. We assume that the data is going to be sent to a central collection point or polled from the device by an API call or a program that is mining the data for another party. But do you know who isn’t going to be getting that data? Us.

IoT devices are going to be talking to providers and data collection systems and, in a lot of cases, each other. But they Continue reading

BlackBerry eyes IoT, diversifies with new cybersecurity practice

Struggling smartphone vendor BlackBerry is looking to diversify its business by launching a cybersecurity consulting service, focusing in part on the Internet of Things, and providing related tools to customers.The Ontario smartphone vendor, an early standard bearer for multifunction mobile phones, announced Wednesday it has acquired U.K. cybersecurity consulting firm Encription. The company did not disclose the terms of the deal, which was completed last week.BlackBerry's move into cybersecurity consulting isn't a huge leap, as the company has long positioned itself as a security-minded smartphone vendor. Late last year, the company launched the Priv, a security- and privacy-focused smartphone running a modified version of Android.To read this article in full or to leave a comment, please click here

DevOps Tools for Modern Data Centers

Back in October, 2015, I spoke at All Things Open in Raleigh, North Carolina, an event focused on open technology and open source software. I was very excited by this event because many attendees work in or manage data centers, which means they are very familiar with Linux but have little experience with the networking stack. Cumulus Networks is the first major networking company to contribute a true Linux networking operating system for data center switches, which is highly disruptive to the industry and drives a lot of fun conversations with open-minded individuals.

The talk I did for All Things Open last October titled “Using DevOps Tools for Modern Data Centers” focuses on the new concept of NetDevOps or DevOps for Network devices. Since the network operating system is Cumulus Linux, why not use open source off-the-shelf automation tools that are already being leveraged in the data center to act as a controller.  These tools have an extremely large user base, are vendor neutral — that is, not proprietary — and can scale easily.

Screen Shot 2016-02-23 at 9.31.55 AM

So what are the benefits of using open source tools? One of the most important benefits from a networking point of view is provisioning. Imagine you have 1000 Continue reading

IDG Contributor Network: In the WAN, it’s better to be single than attached

In a traditional WAN infrastructure, the control plane and data plane are tightly coupled, typically congruent, and cannot be separated due to how they are integrated with each network device. This architecture served the networking needs of enterprises well until now, since most data flows were structured around data centers with centralized exits. However, the emergence of cloud computing and new dynamic business requirements that involve communicating with multiple partners and suppliers have forced enterprises to embrace new connectivity models. Today, enterprises need secure access to both partners and cloud provider infrastructures. This new model requires a different policy structure that is very difficult to instantiate and maintain within a legacy MPLS WAN.To read this article in full or to leave a comment, please click here

Review: 8 password managers for Windows, Mac OS X, iOS, and Android

I hate passwords. I hate coming up with them. I hate remembering them. I hate mistyping them four times in a row. And I hate getting locked out of whatever I'm trying to log into in the process.That said, I hate being hacked only slightly more, so I've done my part to use passwords that aren't "password123" or something equally foolish. The hard part is keeping them straight, which I could do by writing them down -- but isn't that a security hole all over again? Heck, I've known that since I was a kid. I saw "WarGames."[ Roger Grimes' free and almost foolproof way to check for malware. | Discover how to secure your systems with InfoWorld's Security newsletter. ] Password vaults, aka password safes or password managers, help solve this problem. They give you a central spot to store all your passwords, encrypted and protected by a passphrase or token you provide. This way, you have to memorize a single password: the one for your password vault. All the other passwords you use can be as long and complex as possible, even randomly generated, and you don't have to worry about remembering them.To read Continue reading

7 heavily-hyped information security products, vendors that hit the scrap heap

Hitting the heapImage by SmoobsInformation security vendors release new products with all the hope of parents sending their child out into the world or a mother bird forcing her babies out of the nest. Unfortunately, as everywhere else in nature, some security technologies fall to the ground and go splat! Here are seven security-related offerings whose trajectories fell off sharply just before the bitter end.To read this article in full or to leave a comment, please click here(Insider Story)

Attackers can turn Microsoft’s exploit defense tool EMET against itself

Hackers can easily disable the Microsoft Enhanced Mitigation Experience Toolkit (EMET), a free tool used by companies to strengthen their Windows computers and applications against publicly known and unknown software exploits.Researchers from security vendor FireEye have found a method through which exploits can unload EMET-enforced protections by leveraging a legitimate function in the tool itself.Microsoft patched the issue in EMET 5.5, which was released on Feb. 2. However, it's likely that many users haven't upgraded yet, because the new version mainly adds compatibility with Windows 10 and doesn't bring any new significant mitigations.To read this article in full or to leave a comment, please click here

1 … 3,035 3,036 3,037 3,038 3,039 … 3,751