Security

Call me Switzerland

Amid the landscape of security vendors issuing daily reports on viruses attacking users' systems and offering products and services to counteract the attacks, the government has stepped into the game with its own advisory system - minus any sales pitch.

The National Institute of Standards and Technology (NIST) has unveiled its mega-database, otherwise known as the National Vulnerability Database. The NVD will issue daily updates of viruses that are wrecking havoc on popular software products and post notices on security trends.

The database was created as a means to warn users about security threats both big and small, according to … Read more

MD5 flaw pops up in Australian traffic court

Suspected flaws in a computer algorithm have invalidated a fine issued by a speed camera in Australia.

It turns out that a Sydney magistrate tossed out a speeding ticket after the Roads and Traffic Authority, a government agency, failed to prove in court that the algorithm was cryptographically sound.

In other words, the argument goes, the photos could have been altered along the way. "The integrity of all speed-camera offences has been thrown into serious doubt and it appears that the RTA is unable to prove any contested speed camera matter because of a lack of admissible evidence," … Read more

Oxford Dictionary talks tech

If you're not too busy deleting phishing e-mails while updating your wiki with links to podcasts debating the politics of offshoring, you might have time to check out the latest additions to the Oxford Dictionary of English, which include a score of frequently-referenced tech terms.

Serving as the latest form of proof that tech-speak is increasingly going mainstream, the forward-looking folks at Oxford University Press have added such computer-oriented verbiage as offshoring, phishing, podcast and wiki to their big book.

Other commonly-used business words also made the cut, such as the statistical mainstay "demographic," along with the … Read more

Glitch in critical IE patch

Shortly after releasing its security patches for August, Microsoft pulled the "critical" fixes for Internet Explorer from its Download Center Web site. An error in the updates for several Windows versions made it impossible for users to install them, a Microsoft representative said.

"Several of the Internet Explorer updates provided only to the Download Center were corrupted, breaking the digital signature and preventing them from installing," the representative said in an instant message conversation Tuesday.

The IE patches will be reposted to the Download Center as soon as they have been fixed. Meanwhile the patches are … Read more

Michael Lynn's lawyer blogs on Cisco, ISS case

Jennifer Granick traveled to Las Vegas two weeks ago to give a practical and theoretical tutorial on legal issues related to computer security practices at the Black Hat security confab. Granick, executive director of the Stanford Law School Center for Internet and Society, even invited her parents and sister along to come and see her speak .

But Black Hat turned out to be much busier for Granick. On Wednesday morning, hours before she arrived, a securtiy researcher named Michael Lynn decided to quit his job at Internet Security Systems and--defying ISS and Cisco Systems--give a presentation on hacking Cisco's … Read more

Alert! President Bush declares national emergency... again

President Bush this week declared a national emergency based on an "extraordinary threat to the national security."

This might sound like a code-red, call-out-the-national-guard, we-lost-a-suitcase-nuke type of alarum, but in reality it's just a bureaucratic way of ensuring that the Feds can continue to control the export of things like computer hardware and encryption products.

And it happens every year or so.

If Bush didn't sign that "national emergency" paperwork, then the Commerce Department's Bureau of Industry and Security would lose some of its regulatory power. That's because Congress never extended the … Read more

Feds look to hire at Defcon

Jim Christy, director of the U.S. Department of Defense's Cyber Crime Center, has been to eight Defcon events. One reason he attends the hacker event every year is to find talent. "I'm hiring 21 people in the next month," Christy said.

The cybercrime center aids in the investigation of cybercrimes by training law enforcement agents, running a forensics lab and developing tools for investigations. Christy is looking for electrical and computer engineers and programmers, among other people. He might fight some of those people at Defcon, he said.

Of course the DOD is not hiring … Read more

EFF probes printer watermarks

Color laser printers print hidden data that lets law enforcement agencies tell which printer was used and when, according to the Electronic Frontier Foundation. The EFF on Thursday sent a freedom of information act request to the U.S. Secret Service in an attempt to get details on the tracing feature, which the group says impacts the privacy of users.

"This undermines people's ability to speak and publsih anonymously," Seth Schoen, a staff technologist at EFF said Friday at the 13th annual Defcon hacker event in Las Vegas.

In the traditional EFF presentation at DefCon, Schoen placed … Read more

Defcon: Poking holes in hacking tools

The Shmoo Group started off Defcon on Friday wanting to make a point. Presenting in a tent packed with hackers on the grounds of the Alexis Park Resort in Las Vegas, group members announced that they had found holes in several popular hacking tools.

"Patch management is not just for users anymore," a group member proclaimed. "The general point is setting an example." And that example would be that those who create the hacking tools, should worry about security like any software maker.

The Shmoo gang warned Defcon attendees not to use Kismet in the wardrive … Read more

Security researcher faces scrutiny, FBI probe

Michael Lynn, the security researcher who defied Cisco Systems and his employer Internet Security Systems to demonstrate that it is possible to hack into Cisco routers, faces scrutiny from his peers and a criminal investigation by the FBI.

The FBI is investigating Lynn for violating trade secrets belonging to ISS, his former employer, according to a Wired News report on Friday. Lynn quit his job at ISS and gave the talk on router software security at the Black Hat security confab in Las Vegas on Wednesday after Cisco and ISS had agreed to cancel the presentation.

A representative for the … Read more