LMH and InfoSec Sellout unmasked?
210010
Month of Apple Bugs kingpin comes clean The equivalent of a virtual nuke has just been set off in the field of vulnerability research and disclosure. The identities behind two of the noms de guerre that have elicited some of the most heated vitriol over the last 12 months appear to have been disclosed.â¦
218085
Security researchers at South Korea's first international hacker conference rip holes in Linux and VOIP. But where are the drinking games? Quinn Norton reports from Seoul.
256222
Looking to extend its RSA division's authentication product line, EMC has purchased identity verification services vendor Verid.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
266699
What happened to the guts in mainstream publications? I recall back in the 80s InfoWorld pressured Lotus into ditching its copy protection scheme by docking Lotus 1-2-3 several points in reviews because of the inconvenience. I believe Lotus was the first to buckle, but other vendors jumped on the bandwagon and abandoned copy protection. Fast forward to today. Not only has copy protection come back from the grave, it has risen like a juggernaut zombie bent on eating everyone's brains. Worse, many consumers and writers alike seem to be unscrewing their scalps and willingly offering up the meal. "I want the latest iThing, it's so cool!" Sure, you'll find appropriate outrage in Linux Journal and a handful of renegade publications like the Register. But what happened to the mainstream journals with the guts of yesteryear?
116243
Is your computer part of a bot army, infiltrating systems and spreading spam?
524352
After having had its $2.1bn takeover of RSA Security Inc formally approved by the security vendor's shareholders, EMC Corp is rumored to be in the market for Network Intelligence Corp, a supplier of so-called security event management appliances.
167577
Red Hat (Nasdaq: RHAT), provider of Linux software and support, has issued a security alert to its customers. E-mails are circulating, says the company, that appear to come from Red Hat but actually are phishing hoaxes.
715732
Shadowserver Foundation white paper suggests notorious malware network disappeared after exposure in mainstream media.
463385
(InfoWorld) - Secure card maker HID Corp. is objecting to a demonstration of a hacking tool at this week's Black Hat Federal security conference in Washington, D.C. that could make it easy to clone a wide range of so-called "proximity" door access cards. HID has sent a letter to IOActive, a security consulting firm, accusing Chris Paget, IOActive's director of research and development, of possible patent infringement over a planned presentation, "RFID for beginners," on Wednesday, a move that could lead to legal action should the talk go forward, according to Jeff Moss, founder and director of Black Hat. IOActive will hold a press conference Tuesday at 9:00AM to discuss the issue, according to Joshua Pennell, IOActive's CEO told InfoWorld. Paget's talk will address widespread security issues with the implementation of RFID in proximity cards that are sold by HID and other companies and that are widely used for building access. His RFID cloner was on display at the recent RSA Security Conference in San Francisco, where he demonstrated for InfoWorld how the device could be used to steal access codes from HID brand proximity cards, store them, then use the stolen codes to fool a HID card reader. Paget's presentation at Black Hat Federal will go deeper, providing schematics and source code that attendees could use to create their own cloning device, and discussing vulnerable implementations of RFID technology in a wide variety of devices, Paget told InfoWorld at RSA earlier this month. "Hopefully I'll be able to give people some information about RFID and get some pressure on vendors to fix these lousy RFID implementations," Paget said. "As it stands, I can walk up to someone on the street or maybe stand next to them in an elevator, grab their card ID and get into the building," he said. So far, Black Hat organizers have not been contacted or asked to cancel Paget's presentation, but lawyers representing Black Hat, which was purchased by CMP, are ready should that happen, Moss said. "We're prepared for the worst," Moss said. The incident between HID and IOActive recalls a 2005 imbroglio between researcher Michael Lynn and Cisco Systems over a presentation of a flaw in Cisco's IOS at a Black Hat event in Las Vegas. In that incident, Cisco attorneys demanded that Lynn's presentation be torn out of the printed conference proceedings and that Lynn be blocked from giving his talk. Lynn ultimately resigned his position at Internet Security Systems Inc. (ISS) and gave the talk anyway, spawning lawsuits and even an FBI investigation of him. Lynn now works as a researcher at Cisco competitor, Juniper Networks. Whereas Lynn's hack of IOS was considered novel, however, the IOActive demonstration of RFID vulnerabilities is largely a rehash of known issues, intended more as an introduction, Moss said. "They've known about this for years and years," Moss said. Kathleen Carroll, a spokeswoman for HID's Government Relations group acknowledged that a letter was sent to IOActive but that it did not mention patent infringement. She said that the company has long been aware that its proximity cards are vulnerable to hacking but does not believe that the cards are as vulnerable as Paget suggests. "For someone to be able to surreptitiously read a card, they'd have to get within two or three inches and get into the same plane as the card," Carroll said. HID is also concerned that Paget's demonstration will popularize the vulnerabilities in its proximity cards and endanger its many customers. "These systems are installed all over the place. It's not just HID, but lots of companies, and there hasn't been a problem. Now we've got a person who's saying let's get publicity for our company and show everyone how to do it, and it puts everyone at risk. Where's the sense of responsibility?" Carroll said. According to Moss, HID has charged Paget with patent infringement over his presentation, but has not laid out any particular remedies or threatened actions, making it difficult to ascertain what the company might do -- if anything -- to block the presentation. Security problems with implementations of RFID are well known and have been publicized before. In 2005, security consultant Jonathan Westhues detailed attacks against implanted VeriChip RFID chips. More recently, in January, Westhues posted detailed code and schematics for an RFID hacking device that can act as a reader, eavesdrop on RFID transactions between reader and a tag, analyze the signal received over the air, or impersonate a tag.Â  In 2005, Avi Rubin and other researchers at Johns Hopkins also sounded the alarm about weak security in RFID implementations by hacking technology from Texas Instruments that is used in late model car ignition systems and electronic payment systems, as well. All that attention hasn't sparked much change at companies like HID, which makes fifteen different types of proximity cards in their Prox Products and Indala Prox Products lines, all of which are believed to be vulnerable to cloning, according to Paget. "Some of these cards have been around for 15 years and were developed when there was no awareness of the problem," Carroll said. Asked why HID hasn't addressed the issue in more recent proximity card systems, after knowledge of RFID threats became common, Carroll said that doing so would cause "major upheaval" among customers.Â  Inertia is a more likely cause, said Dan Kaminsky, director of penetration testing at IOActive. "They didn't want to change to a more secure implementation because of backwards compatibility issues, and they had a lot of sites that use these cards, and HID has stuff to sell them," Kaminsky said. Paget's hack was no feat of engineering wizardry, Kaminsky said. "It took a month -- and he wasn't even working on it full time." The problem is that RFID technology, although good for inventory tracking as a replacement for barcodes, is not well suited for security, Kaminsky said. "The technology is very convenient, but don't interpret the convenience as security," Kaminsky said. "At the end of the day, many companies are essentially using barcode technology to control access to their facilities. I'd posit that perhaps there are more secure technologies out there." HID recommends that customers who are concerned about cloning upgrade to one of HID's smart card products, which do encrypt transmissions between card and reader and are more difficult to hack, Carroll said. HID also recommends that companies that use the cards train their employees to look for suspicious activity that might indicate that someone is trying to clone or spoof access cards. As for Paget's presentation, Moss expressed frustration over HID's actions, especially given the widespread attention to RFID security holes. "It's just so frustrating from a security standpoint. Now anytime someone wants to talk about anything, they need a team of lawyers. Even when it's about commonly understood problems," Moss said. For now, Moss said Black Hat is supporting Paget and his presentation -- even if last minute changes are needed to satisfy HID, Moss said.
40472
In response to this recent article from the Hiveminds website, Marco Tabini has a few choice words about some of the topics they cover in the article, and cover incorrectly.   Over the last few years, I've made it a point of trying to respond to at least some of the "PHP is dead"-type articles that crop up on the Net from time to time. The latest one comes from Hiveminds and reveals a complete misunderstanding of almost every point it covers.   He notes that though the article seems to be a coherent whole for why PHP is dwindling, it's "based on nothing more than a string of misinformed concepts cobbled together to give the appearance that the author knows what he or she is talking about". Marco comes back against each of the points made in the article, setting things right and eliminating some of the FUD (fear, uncertainly, and doubt) that the Hiveminds article spreads.
357199
Back in February, Ralph Green asked me to speak at the North Texas Linux Users' Group. I discussed Linux administration and then took questions. Some one in the audience asked me about Mono. I gave a cavalier answer having a bias against it. Then someone else in the audience said that I needed to get my facts straight.
339599
A data dump by an individual eBay describes as a "malicious fraudster" exposed names and contact information for 1,200 users of the auction site online. The information led to the closure of the discussion group in which the information was released -- a discussion group devoted to, ironically, security issues.
531535
Phisher 'Vladuz' dodges eBay's defenses &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
661786
SAN FRANCISCO, Feb. 9  /PRNewswire/ -- RSA CONFERENCE BOOTH #650 -- One of the now infamous magnetic Aqua Teen Hunger Force neon signs was raffled off by security software developer CyberDefender Corporation (http://www.cyberdefender.com/) at the RSA Conference in San Francisco yesterday.
705539
One of Russia's fastest growing markets, and quite possibly a contributor to stabilizing that country's fickle economy, is cut-rate, self-deploying Trojan horse packages.  This morning, security engineers are sounding the alarm about one such package that customers appear to be purchasing in order to conduct possible identity theft attacks, by leveraging Italian media sites as unsuspecting middlemen...with the equally unsuspecting help of Google.
609138
Inky upside to murky mess The US Securities and Exchange Commission (SEC) doesn't want to be left out of the Big Dig into HP's spy operations. The agency has broadened its probe of the company, asking for records tied to the resignation of board member Tom Perkins and documents related to HP's already infamous mole hunt.â¦
419358
Piling it on HP today released a message from CEO Mark Hurd that vaguely addresses the company's ongoing spy scandal. The missive serves more as an advertisement than a real confrontation with the issues affecting HP.â¦