Security researcher intercepts embassy passwords
521524
A 21-year-old security researcher in Sweden who collected thousands of e-mails and passwords blamed administrators for not using encryption to shield their Internet traffic.
712724
Program developed by "ethical hacking" group takes advantage of cross-site scripting vulnerability to steal contacts, forward e-mail.
397382
A former security researcher who served time for hacking has been charged with new cybercrimes.
509889
Blog: A recent court case provides a rare glimpse into how federal agents deal with encryption: By breaking into a suspect's home or office, implanting keystroke logging software, and watching what happens from afar.
768812
Password-stealing Trojan horse may--or may not--be targeting popular VoIP feature.
20530
A Canadian inventor has created Internet-based technology that could soon see regular computer users acting as armchair spies. Vincent Tao, an engineer at Toronto&#39;s York University
602412
(InfoWorld) - A security expert has cracked one of the U.K.'s new biometric passports, which the British government hopes will cut down on cross-border crime and illegal immigration. The attack, which uses a common RFID (radio frequency identification) reader and customized code,Â siphoned data off an RFID chipÂ from a passport in a sealed envelope, said Adam Laurie, a security consultant who has worked with RFID and Bluetooth technology. The attack would be invisible to victims, he said. "That's the really scary thing," said Laurie, whose work was detailed in the Sunday edition of the Daily Mail newspaper. "There's no evidence of tampering. They're not going to report something has happened because they don't know." The British government, which began issuing RFID passports about a year ago, eventually wants to incorporate fingerprints and other biometric data on the chips, although privacy activists are concerned over how data will be stored and handled. Currently, the chip contains the printed details on the passports, the person's photograph, and security technology to detect if those files have been altered. The attack was executed while the passport was still in its original envelope used to send it from the passport service, since RFID chips can be read from a few inches away, Laurie said. He used a passport ordered by a woman affiliated with No2ID, a group that opposes the U.K.'s biometric passport and ID card programs. The data on the passport's chip is locked until an RFID reader provides the encryption key, Laurie said. The encryption key is calculated using a combination of the person's personal data, such as date of birth, and is contained in the "machine-readable zone" (MZR) -- the string of characters and digits on the bottom of the passport's first page. At an immigration desk, the optical character reader scans the MZR and gets the key. The RFID chip is unlocked, and the information on the chip is matched with that on the passport. However, Laurie was able to do this process himself. He analyzed ICAO 9303, the standard from the International Civil Aviation Organization that been adopted worldwide for machine-readable passports, to see how the MZR is organized. Laurie also knew some of the woman's personal details -- used to calculate her passport's key -- and found out more through Internet research. He then wrote what's known as a "brute force" program, which repeatedly tries different combinations of data to discover the key. After about 40,000 attempts by the program, he cracked the key. To scan the chip, he used a common RFID reader from ACG ID, now part of Assa Abloy Identification Technology of Germany. The attack could then let Laurie begin the process of making an exact copy of the woman's passport. "[The biometric passport] has been sold to us as something that increases the security of the passport, but so far I don't see anything about it that increases my security," Laurie said. The greatest weakness with the passports is using relatively easy-to-find data to compose the encrypted key, Laurie said. It would be better to include more random elements that would render brute-force style programs nearly useless, he said. Laurie's work spawned from concern over how users can know what's on their passport's chip. "At the moment, if you want to see what's in your own passport, you have to go to passport office," Laurie said. "With my code, you can do it at home." Laurie has published a library of open-source tools written in the Python programming language that will run on RFID readers made by ACG and by Frosch Electronics, based in Austria. Â
744409
Security researchers release code that shows how a pair of widely used technologies could be misused to take control of a victim's Web browsing experience.
450803
Sneaky program takes a different tack to capture people's passwords and potentially steal money.
508741
A grad student who posted a fake boarding pass generator to illuminate a security hole, only to get raided by the FBI, avoids prosecution. But he says his treatment will make the nation less safe. In 27B Stroke 6.
426070
Researcher who demonstrated the "sidejack" attack at Black Hat USA now says even encrypted Gmail can be compromised.
386820
New Internet-based technology could soon turn regular computer users into armchair spies, a Canadian inventor said on Monday. Vincent Tao, an engineer at Toronto&#39;s York University, said he has invented a mapping
590481
In Tunisia, Iran's password is "Tunisia" Underscoring a major susceptibility threating thousands of high-profile computer users across the world, a Swedish security consultant has published login credentials belonging to some 100 embassies.â¦
687532
A security researcher warned today that there are ways the sleek device could potentially be compromised.
441123
A new hacking method is causing concern for the lengths it goes to avoid detection by security software and researchers.
148612
Attackers can trick browsers into releasing password information.
381411
A flaw in the way Firefox handles log-ons could be used by identity thieves to fool users into disclosing passwords, security researcher Aviv Raff said yesterday.