Security News (125 Posts)

<< Next - First ... 9 10 11 12 13 . Last - Previous >>

Android vs iOS Security

#21 - Posted on 17 January 2011 - Author: SM - Category: Security

A sensitive topic but below is my initial view on the security offered by those two platforms.

My view is that Android, being a more open platform, offers more capabilities (flash, access to the root system, extension slots, etc). However, because of this it offers a less secured experience out of the box.

Apple, by not allowing certain technologies such as flash (flash security issues are endless) and by limiting access to its root system alsolimits its security exposure compare to android devices.

A very important security feature is then offered by the app store screening process. Although not perfect by any means, it still gets rid of obvious bad or flawed apps and protects iOS users further.

None of the devices are bulletproof and both suffered some security issues:
– iOS: Worm on jail broken iPhone and phone lock bypass (fixed in iOS v4.2)
– Android:Core libraries are open and apps can have deeper...
>>[READ MORE]

The scary world of Social Media and geo tagging

#20 - Posted on 10 January 2011 - Author: SM - Category: Security, OSI

As the saying goes, “it is never too late”, and it is only recently that I created a twitter account.
I was convinced to do so after attending a SANS training course (more on that soon) where the instructor told us twitter was the best way to keep up to date and in touch with a great online security community.

I am not new to social media, but after “playing” with twitter for a few days I am both impressed and concerned!

Impressed because it is slick and indeed a great way to follow up some topics and keep in touch.
Concerned because it is a mine gold for wanna be thief!

It has been well publicized that people share far too much information on Facebook, information that can sometimes be used against them (by employers, people who dislike you, ex lovers, etc).
I feel however the micro blogging format of twitter invites more its users at describing and sharing mundane information such as what you eat, what you think, what you ...
>>[READ MORE]

PS3 Hacked and Cryptography

#19 - Posted on 7 January 2011 - Author: SM - Category: Security, Hacking, Cryptography

The recent hack on PS3 where the private key used by Sony to sign their games has been recovered is of course a very bad news for Sony. It finishes to open the door to piracy which started in January 2010. In theory, anyone could now sign (pirated) software to run natively on the PS3.

It is a case of badly implemented cryptography algorithm, in that case, the use a proprietary signing algorithm with a faulty random generator.
Crypto 101 says to NEVER use proprietary/secret algorithms. Now Sony’s will pay the price for not listening :)
The PS3 hack story is a great example of badly implemented cryptography which is as important as the choice of the security controls used to protect an asset.

BBC NEWS ARTICLE

The start of an answer from Sony, which seems to indicate they did not grasp the severity of the issue when first announced about a week ago
...
>>[READ MORE]

Interesting acquisitions

#18 - Posted on 5 January 2011 - Author: SM - Category: Security

2011 seems to cary on with the trend of security companies acquisitions by big IT names. This is now the turn of DELL to buy SecureWorks, planning to offer managed security services in a near future.

Another interesting acquisition is that of Immunet by Sourcefire, which should help the later company to grow its business “in the cloud”.

SaaS and “in the cloud” are two 2010 themes which are likely to grow even more this year.

...
>>[READ MORE]

Stuxnet, a Digital Worm with physical consequences (not to say political!)

#16 - Posted on 4 October 2010 - Author: SM - Category: Security

To follow-up on the theme of my last post, this worm has recently received a lot of media attention:
– It targeted Iran nuclear Plants (among other things)
– It is so sophisticated that it has likely been done with some country/national support
– It had a payload with physical consequences

One thing which did catch my attention was that in order for this worm to be so successful against a Process Network, the group of “hackers” must have had access to a testing environment… not everyone has a refinery in their back garden…

Below is a good explanation of what it actually does and how it does it.
If you are in a hurry:
http://www.symantec.com/connect/blogs/exploring-stuxnet-s-plc-infection-process
If your TV is broken:
...
>>[READ MORE]

Are you taking ZeuS wrath seriously?

#15 - Posted on 29 September 2010 - Author: SM - Category: Security

ZeuS seems to be a popular and quite successful Trojan at the moment, at least in the UK.
It has been around for a while and has been updated several times (at least 3).
There is an excellent white paper written by M86 Security describing its use in what looks like an ongoing and sustain attack against British Banks.
The latest arrests were announced today where hackers had managed to steal about 20m pounds!
If you search the Internet you can see a trend where British bank customers have been successfully defrauded from their money over the last year, all by hackers using the ZeuS Trojan and for what seems an increasing amount of money!

What I find interesting is the fact money is being stolen at large and increasing scale. Actual...
>>[READ MORE]

A funny case for not reusing passwords

#13 - Posted on 17 September 2010 - Author: SM - Category: Security

By the way, you are free to create an account on my website! ;)

As seen on XKCD.COM!

...
>>[READ MORE]

Arcsight, another expensive acquisition… sorry, merger!

#12 - Posted on 14 September 2010 - Author: SM - Category: Security

Following on the $7 billion and a bit acquisition of mcAfee by Intel last month, it is now the turn of Arcsight, a data correlation engine, to get acquired by HP for $1.5 billion, a bargain then! This follows a trend for large non IT Security companies to step into the security field.

What I found interesting though is the difference in vocabulary used by the two companies, actually, by the Arcsight current CEO Tom Reilly. HP speaks about “acquisition”, which really it’s what it is; whereas Tom’s email to Arcsight clients speaks about a “merger”. I guess this is standard practise when the smaller party get “swallowed” by a bigger company.

I’d be interested to see what changes this “merger” will bring to Arcsight and if any of the HP Operation Manager technology (aka OpenView) will find its way in a future Arcsight ESM release… or vice versa!

...
>>[READ MORE]

DoD Windows OS Security guides

#11 - Posted on 10 September 2010 - Author: SM - Category: Guides, Security

I have recently came across that Department of Defence website where they provide free and unclassified Windows Security Guides. From Windows 2000 to windows 7, they provide a set of checklist and “STIG” which stands for Security Technical Implementation Guides.

Having only checked the Windows 7 “STIG”, I found it a useful resource when one can get some ideas on how to secure/validate a windows 7 server configuration.

http://iase.disa.mil/stigs/content_pages/windows_os_security.html

...
>>[READ MORE]

Apple new Patent could mean Big Brother on your phone

#9 - Posted on 24 August 2010 - Author: SM - Category: Security

The following article from Macworld describes a new patent from Apple to detect jail-broken iphone/ipad. It also gives an interesting security twist on that patent, where it is in theory possible to take hidden photos and voice recording of a potential thief, analyse the accelerometer data to define if the thief is walking, driving or even flying, get GPS location, etc.
http://www.macworld.com/article/153612/2010/08/apple_mobiledevice_patent.html

I also came across that app for the iphone, which does not go quite as far but highlight the fact people have already thought about this:
SpyTools for iphone

...
>>[READ MORE]