Skip to main content

Security

FBI calls Sony hack 'organized' but declines to name source or finger North Korea

posted onDecember 11, 2014
by l33tdawg

The FBI declined to name the source of the Sony Pictures hack during a U.S. Senate hearing on Wednesday.

"I won't touch on the attribution piece because we're still working very hard on that," said Joseph Demarest, assistant director of the FBI's cyber division. Demarest's comment was in reply to questions from Sen. Charles Schumer (D-NY) during a hearing of the Senate Banking Committee.

Over 30 vulnerabilities found in Google App Engine

posted onDecember 10, 2014
by l33tdawg

Serious vulnerabilities exist in Google App Engine (GAE), a cloud service for developing and hosting Web applications, a team of security researchers has found.

The vulnerabilities could allow an attacker to escape from the Java Virtual Machine security sandbox and execute code on the underlying system, according to researchers from Security Explorations, a Polish security firm that found many vulnerabilities in Java over the past few years.

Open authentication spec from FIDO Alliance moves beyond passwords

posted onDecember 9, 2014
by l33tdawg

An open industry alliance of 150 members that includes many of the world's biggest vendors -- but notably, not Apple -- released specifications Tuesday that promise to secure online communications without using passwords.

The group, called the FIDO (Fast IDentity Online) Alliance includes Microsoft, Google, PayPal, Bank of America, MasterCard and Visa. Also included are device manufacturers such as Dell, Samsung and BlackBerry, and even enterprises offering various services such as Aetna and Netflix.

Patch Tuesday updates aim for Exchange and Explorer flaws

posted onDecember 9, 2014
by l33tdawg

Internet Explorer and Exchange Server top the list of Microsoft programs needing to be patched by IT administrators this month, now that the company has rolled out its latest round of "Patch Tuesday" security fixes.

Overall, Microsoft has issued seven security bulletins for December, including three that are critical, covering security vulnerabilities found in Windows (both the server and desktop editions), Office, Exchange Server, SharePoint Server and Internet Explorer.

Coming to Blackphone: An app store loaded with privacy tools

posted onDecember 9, 2014
by l33tdawg

Blackphone handsets can download and install a major software update today – ahead of the opening of an online store for privacy-focused apps for the mobes.

The Blackphone runs its own hardened version of Android, dubbed PrivatOS, on custom hardware. It allows owners to make and send encrypted calls and texts, among other security features.

Sony hack snowballs as movie scripts, celebrity phone numbers leaked

posted onDecember 9, 2014
by l33tdawg

Sony Pictures is in full-blown damage-control mode and has called an all-hands meeting following another huge leak of sensitive, confidential info. The new trove of data released by the so-called GOP (Guardians of Peace) includes more private employee info, actor phone numbers and traveling aliases, legal claims against Sony Pictures, film budgets, scripts and more. As pointed out by the WSJ, it also includes private info of some 40,000 Sony Pictures ex-employees like home addresses, previous salaries and social security numbers.

Why You Shouldn’t Use MAC Address Filtering On Your Wi-Fi Router

posted onDecember 9, 2014
by l33tdawg

MAC address filtering allows you to define a list of devices and only allow those devices on your Wi-Fi network. That’s the theory, anyway. In practice, this protection is tedious to set up and easy to breach.

This is one of the Wi-Fi router features that will give you a false sense of security. Just using WPA2 encryption is enough. Some people like using MAC address filtering, but it’s not a security feature.

66-Years-Old Rocker Arrested For Involvement in 2010 Anonymous DDoS Attack

posted onDecember 9, 2014
by l33tdawg

A 66-years-old British rock guitarist received a jail sentence for joining the Anonymous hacker collective in the organized distributed denial-of-service (DDoS) attacks in 2010 against various institutions and organizations in the US.

Dubbed Operation Payback, the attacks aimed at different organizations that opposed the activities of WikiLeaks, as well as financial institutions.