Security

A Year After SOPA: These Are the Next Five Battles For Internet Freedom

One year ago today, Internet users of all ages, races, and political stripes participated in the largest protest in Internet history, flooding Congress with millions of emails and phone calls to demand they drop the Stop Online Piracy Act (SOPA)-a dangerous bill that would have allowed corporations and the govenrment to censor larger parts of…

Mega Uses Random Data From Your Mouse and Keyboard To Beef Up Its Already Insane Encryption (Updated)

Kim Dotcom’s newly launched Mega is determined not to get screwed over by the Feds the way MegaUpload did, and the trick is encryption, lots of encryption. Mega’s really going that extra mile too; it’s using your random mouse and keyboard data to strengthen your crypto keys. https://gizmodo.com/kim-dotcoms-mega-is-now-open-to-the-public-5977329 Cryptography relies on having complex keys to…

Cyber-Espionage Platform Red October Is Already Pulling Its Tendrils Back Into the Dark

Earlier this week, a sophisticated, capable, and seemingly freelance cyber-spying operation called Red October burst onto the scene. Well, it’s probably been around for years, but we all only just found out about it. Now, it’s already disappearing. After having the light shined on it, it’s darting back into the shadows. https://gizmodo.com/meet-red-october-the-global-cyber-espionage-ring-that-5975793 It looks like…

Mega’s Clever Encryption Will Protect You, But Mostly Kim Dotcom

Almost exactly one year ago, MegaUpload unexpectedly went down in flames. Now, Kim Dotcom’s new venture, plain old “Mega” is rising from the ashes, and we’ve taken you inside for a sneak peek. But things will be different this time. Why? Dotcom’s prepped this baby against all manner of attack, and its encryption is the…

Oracle’s Latest Java Fix Is Still Broken, Better Learn to Live Without

Remember that big zero-day Java vulnerability the Department of Homeland Security was all worried about? Well, Oracle fixed it. Oh wait, no. That latest Java fix still has a big ol’ hole. It’s time to abandon ship, folks. https://gizmodo.com/even-the-department-of-homeland-security-wants-you-to-d-5975415 Turns out that Oracle’s original out-of-band update to Java only fixed one of the two nasty…

Google’s Making Moves to Kill the Password

Passwords are long and complicated and hard to remember. And that’s only if they’re good passwords. No matter how you slice it, passwords are annoying and on top of that, they’re not even all that secure. Google knows that all too well, and it’s pushing for the next big thing. A ring maybe. Like for…

TSA to Remove Naked-Image Scanners From US Airports

The Transportation Security Administration has announced that it will remove the controversial “naked image” body scanners from US airports because developers can’t write software to make the images less revealing. The scanners, made by OSI Systems Inc, have ruffled feathers since they were first rolled out. In a bid to quell controversy, the TSA looked…

Bad Grammar Make Good Password

Along with birthdays, names of pets and ascending number sequences, add one more thing to the list of password no-nos: good grammar. An algorithm developed by Ashwini Rao and colleagues at Carnegie Mellon University in Pittsburgh, Pennsylvania, makes light work of cracking long passwords which make grammatical sense as a whole phrase, even if they…

Two US Power Plants Hit By Malware Attacks

It’s come to light that two US power plants were hit by malware attacks in 2012, after employees used infected USB sticks. The US Industrial Control Systems Cyber Emergency Response Team reports that malware found its way into the plants and affected their operation. From ICS-CERT on one of the attacks: “A third-party technician used…

OkCupid App Bug Exposed Email Addresses and Birth Dates

OKCupid’s new blind date app came out today, to some fanfare and probably a little more mockery. But it’s hit a snag: Apparently, it was coughing up users’ emails and birth dates for anyone who bothered to dig for them. https://gizmodo.com/okcupids-new-blind-date-app-aims-to-find-you-love-or-r-5976070 The information was leaked when you “tweaked” the web traffic info from the app,…

Does Connected Home Security Actually Make Us Safer?

Securing your home against intruders used to be as simple as barring your doors and locking your windows. But home automation services—offering everything from remote monitoring to keyless door locks—have revolutionized how we fortify our houses. Are these new systems any better at protecting us? We saw several new services last week at CES 2013.…

Meet Red October: The Global Cyber-Espionage Ring That Spent 5 Years in the Shadows

There are plenty of cyberweapons floating around out there, like Stuxnet, Flame, and that whole gang. Now, Kaspersky has turned up a cyber-espoinage operation its dubbed “Red October,” and it’s up there in the big leagues. But unlike its cohorts, it doesn’t look state-sponsored. This is a freelance job, and it’s professional grade. https://gizmodo.com/meet-flame-the-massive-spy-malware-infiltrating-iran-5913779 While…

Oracle claims to have patched the Java vulnerability that Homeland Security was worried about. Browse freely! [Oracle]

How To Disable Java in Your Browser

Java isn’t good for your for your computer’s health right now. It can mess it up pretty bad. Bad enough that the Department of Homeland Security is warning us all to turn it off. OK, but how do you do that? Fortunately, it’s not that hard. https://gizmodo.com/even-the-department-of-homeland-security-wants-you-to-d-5975415 All the current Java exploits come from Java…

Oracle says it’ll have a fix for those egregious Java vulnerabilities “shortly.” [Reuters]

Even The Department Of Homeland Security Wants You To Disable Your Java

We’ve been concerned about the security of Java for a while now. There was that vulnerability that affected like a billion computers, and Apple went so far as to remove Java plugins from all OSX browsers. Now even the Department of Homeland Security is in on the act with a special message: “Yo, shut off…

Nokia’s Xpress Browser Decrypts Your HTTPS Data

It’s come to light that Nokia’s Xpress Browser—used on its Asha and Lumia handsets—routes your secure and encrypted HTTPS data through its servers and temporarily decrypts it. GigaOm reports security research which reveals that Nokia’s browser passes data to its servers—nothing odd there, it’s a proxy browser designed to speed things up—but that, at stages,…

Hack Turns Cisco’s Desk Phone Into a Spying Device

Cisco’s internet phones—which sit on thousands of desks around the world—have been shown to be easily hacked and turned into remote spying devices. The official announcement comes two whole weeks after Cisco first found out about the problem. The exploit was discovered by Ang Cui and Salvatore Solfo, a pair of computer scientists from Columbia…

NYT: Iran Is Behind the Recent Spate of Cyberattacks on Banks

A series of recent denial of service attacks on US banks are being blamed on Iran. According to the New York Times, “there is no doubt within the U.S. government that Iran is behind these attacks.” Recent months have seen PNC, Bank of America and HSBC all experience heavy DDoS attacks. The Times cites James…

These Rugged, Encrypted Pocket Drives Keep Your Data Locked Up Safe

There are plenty of external drives floating around at CES, but Rocstor’s offer up a rugged casing and secure encryption in a surprisingly sleek package. Rocstor has actually announced a trio of drives: the Amphibious X5, Hawker HX and Lancer LX. Sadly, the first isn’t waterproof, but it does use AES-256 encryption and both FIPS…