Crypto researchers abuzz over flaws
554044
Presenters at the Crypto 2004 conference identify faster ways to forge digital signatures with common security algorithms.
140834
An Oracle blog posting that criticizes vulnerability researchers for "irresponsible" practices has highlighted a long-simmering dispute between software vendors and bug hunters.
98178
A series of security holes in three common Linux components has led open-source vendors to rush out several updates. Two of them, rated &quot;highly critical&quot; by security company Secunia, are in libpng, a library
40472
In response to this recent article from the Hiveminds website, Marco Tabini has a few choice words about some of the topics they cover in the article, and cover incorrectly.   Over the last few years, I've made it a point of trying to respond to at least some of the "PHP is dead"-type articles that crop up on the Net from time to time. The latest one comes from Hiveminds and reveals a complete misunderstanding of almost every point it covers.   He notes that though the article seems to be a coherent whole for why PHP is dwindling, it's "based on nothing more than a string of misinformed concepts cobbled together to give the appearance that the author knows what he or she is talking about". Marco comes back against each of the points made in the article, setting things right and eliminating some of the FUD (fear, uncertainly, and doubt) that the Hiveminds article spreads.
101788
MIT researchers develop an authentication system that's not so easily revealed to prying eyes.
687532
A security researcher warned today that there are ways the sleek device could potentially be compromised.
70508
Side-channel code break Security researchers have developed a new approach to breaking the RSA algorithm that creates new problems for the development of effective rights management software.â¦
763575
Ilia Alshanetsky posts today about the proposed "Month of PHP bugs" that Stefan Esser is proposing:   It would be interesting to see what issues he discovers, hopefully most of them have already been reported to the PHP Security Team, in which case the upcoming 5.2.1 release will provide a resolution path for affected users.   Hopefully, as Ilia states, the bugs will not turn out to be zero-day vulnerabilities and will instead be smaller issues. Either way, a bug-fix patch will probably soon follow.   Either way, I have to look at this as a free security audit of PHP by someone with a clue about security and ultimately, in the long run it will only make PHP better, even if March is going to be rather busy.
360612
Just a day after Apple unveils its browser, security researchers report 18 flaws--and counting.
453054
A vulnerability in radio-frequency ID chips could put millions of users of wireless car key tags or speed pass payment devices at risk, according to a recent study by researchers at Johns Hopkins University and RSA Laboratories.
357182
In a new post to his blog, Chris Hartjes, spurred on by an article in the latest edition of php|architect magazine (covering protecting your code), has shared a few opinions starting with a certain paragraph near the end.   To start, I will focus on the paragraph above. What I get out of that is that if only your source was closed and hidden from prying eyes, it would not have bugs in it. Which is, of course, total nonsense. Code has bugs because it's open and they feel safer? There are two kinds of bugs: application bugs (which is the code I would write) and system bugs (in this case, bugs that that appear from PHP itself). I'm sorry, but there is nothing I can do if there is a bug in PHP that causes my application to crash except to point this bug out to the people who have the ability to fix it.   He goes on to talk more about how protection like this (the article talks about using the IonCube Encoder) will not stop someone if they're really determine to get at the code underneath the encryption. His only suggestion is to make an application good enough that people wouldn't want to try to steal it as much and would rather pay for their version.   Encode your stuff if you want, but be aware that the minute you choose to do that you are telling your customers "I don't trust you" and I have a hard time understanding a business model that assumes people are going to want to steal the stuff you sell.
275658
It&#39;s not that there aren&#39;t Unix attacks that work. It&#39;s that pretty much everything the security industry does misrepresents the actual balance between attacks on Microsoft&#39;s products and attacks on Unix and open source.
181070
Sophisticated rootkits can hide from even the most reliable detection method currently available--hardware-based products, security researchers say.
639888
Last month, a group of Princeton University researchers discovered how easy it was to inject malicious software into a Diebold voting machine, enabling it to flip votes between candidates. This isn't a new problem. You'd think the solution might be better cryptography, but just what constitutes "better?"
344908
The federal government is holding a competition for a new cryptographic hash function that will become the national standard. Really, this is exciting stuff. Commentary by Bruce Schneier.
468098
He turned over a new leaf, and turned it back again: A man previously convinced of hacking hundreds of military and government computers has been busted again, this time for massive credit-card theft. In between he became -- what else? -- a well-known security researcher.
603627
Researchers in the field of cryptography have been successfully breaking the hash functions that are used to secure the privacy of electronic communications, threatening the integrity of digital signatures, according to a report on Slashdot.