Articles about Security Tools

Apple starts clock on HTTPS app rule

Apple says that iOS app developers will need to adopt HTTPS security before the year is out. Speaking in a session (iOS or Safari required) at Apple's Worldwide Developers Conference, head of security engineering and architecture Ivan Krstić announced that effective at the end of this calendar year, Apple will mandate the use …
Shaun Nichols, 15 Jun 2016
2001: A Space Odyssey

Lie back and think of cybersecurity: IBM lets students loose on Watson

IBM is teaming up with eight North American universities to further tune its cognitive system to tackle cybersecurity problems. Watson for Cyber Security, a platform already in pre-beta, will be further trained in “learning the nuances of security research findings and discovering patterns and evidence of hidden cyber attacks …
John Leyden, 12 May 2016

Commercial software chokkas with ancient brutal open source vulns

Commercial software is riddled with old critical open source flaws that are largely hidden from the eyes of enterprises, according to Black Duck Software. The manual audit report The State of Open Source Security in Commercial Applications [PDF] by the open source security tester studied 200 applications over a six month …
Darren Pauli, 04 May 2016

Halfbreed trojan targets US banks

A new piece of malware has been linked to thefts of $4m from more than 24 American and Canadian banks in just a few days. Researchers at IBM reckon that hackers combined code from two malware types, known as Nymaim and Gozi, to create GozNym, a persistent and powerful trojan. Customers of numerous credit unions and popular e- …
John Leyden, 15 Apr 2016
Man on bicycle talks on mobile on busy Brussels street. Photo by Alredo Cerra via Shutterstock

Europe's new privacy safeguards are finally approved, must invade EU nations by 2018

Analysis The General Data Protection Regulation (GDPR) has been ratified by the European Parliament. The final seal of approval follows successful passage through the EU Parliament's Committee on Civil Liberties, Justice and Home Affairs. Following four years of discussions and amendments, the GDPR is now officially EU law and will …
John Leyden, 14 Apr 2016

Cutting edge security: Expensive kit won't save you

We all want to protect our customer and employee data, but as the threat landscape changes and the publicly disclosed data breaches get increasingly larger, our approach may need to change. What constitutes "state of the art" information security in 2016? It’s tempting to create a listicle of 10 shiny new security tools that …
Danny Bradbury, 13 Apr 2016

Gumtree serves world's worst exploit kit to scores of Aussies

Malware expert Jerome Segura says Australia's most popular classifieds site, Gumtree.com.au, was serving the world's most capable exploit kit to some of its millions of monthly visitors. The site is Australia's twelfth-most-popular website and last month attracted some 47.8 million views. Parent site eBay Australia scored 74.6 …
Darren Pauli, 29 Mar 2016
Moments of perspiration

Cyberthreat: Learning to live with the risk

Cyberthreats are like the common cold or some other infectious virus; eventually you’re going to get sick. It’s a part of life. They’re always there, lurking just around the corner, waiting to make your life that little bit harder. At the same time, you can’t focus entirely on potential risks to your business at the expense of …
Danny Bradbury, 18 Mar 2016
Prince philip Thames barrier old control room photo Environment Agency

WirelessHART industrial control kit is riddled with security holes

Widely used WirelessHART-type industrial control products are wide open to exploitation, a security tools firm has warned. Applied Risk, an industrial control systems (ICS) security specialist, has discovered several weaknesses in various WirelessHART products. The vulnerabilities create the potential for hackers of various …
John Leyden, 01 Feb 2016

Asda slammed for letting vulns fester on its cyber shelves

Supermarket chain Asda has come under fire for sitting on a potentially serious set of web vulnerabilities on its website for almost two years. As first reported by The Register on Monday, UK security consultant Paul Moore warned Asda about a shopping list of online vulnerabilities in March 2014. Asda upped the grade of its …
John Leyden, 21 Jan 2016
Linux password file by https://www.flickr.com/photos/132889348@N07/  CC 2.o attribution sharealike generic https://creativecommons.org/licenses/by-sa/2.0/

It's 2016 and idiots still use '123456' as their password

Put your head in your hands, sysadmins: the usual weak suspects continue to make up the top most used 25 passwords. The ubiquitous ”123456" remains the most popular password among web users, followed by "password" in a list of user credentials leaked online last year. “Qwerty” appears in fourth place of the list of …
John Leyden, 20 Jan 2016

How long is your password? HTTPS Bicycle attack reveals that and more

A new attack on supposedly secure communication streams raises questions over the resilience of passwords, security researchers warn. The HTTPS Bicycle attack can result in the length of personal and secret data, such as passwords and GPS co-ordinates, being exposed from a packet capture of a user's HTTPS traffic. The attack …
John Leyden, 06 Jan 2016
Hand holding smartphone taking picture in Manaus, Brazil. Picture by Filipe Frazao via Shutterstock

Revealed: Mystery 7-year cyberspy campaign in Latin America

Security researchers have uncovered a seven year-long malware campaign against Latin America. Citizen Lab found that journalists, activists, politicians, and public figures in Argentina, Ecuador, Brazil and Venezuela have been targeted by a large-scale hacking campaign since 2008. The campaign, dubbed Packrat, uses bogus …
John Leyden, 10 Dec 2015
ansip_648

Mandatory data breach reporting rules finally agreed by EUrocrats

After five hours of negotiations on 7 December, members of the European Parliament and Council finally settled on the wording of the EU's Network and Information Security (NIS) Directive. The directive was first proposed in 2013 as a means of forwarding the European Union's cybersecurity strategy. As it is a directive, rather …
Bookshelf in the British Library basement

Whisper this, but Java deserialisation vulnerability affects more libraries

A Java deserialisation vulnerability may affect as many as 40 more software libraries than first feared, research has revealed this week. The deserialisation bug in Apache Commons Collections affects popular distributed software such as WebSphere and JBoss, FoxGlove Security advised last month. But new research by security- …
John Leyden, 07 Dec 2015

Brit hardware hacker turns Raspberry Pi Zeros into selfie slayers

Kiwicon Hipsters and selfie addicts beware: infosec man Steve Lord has crafted a tool designed to sever your line of addiction to Instagram by quietly blocking it over public Wi-Fi. The British security bod built the Raspberry Pi Zero-powered "hipster slayer" out of nothing more than off-the-shelf components and "questionable life …
Darren Pauli, 02 Dec 2015

WoW! Want to beat Microsoft's Windows security defenses? Poke some 32-bit software

Two chaps claim to have discovered how to trivially circumvent Microsoft's Enhanced Mitigation Experience Toolkit (EMET) using Redmond's own compatibility tools. A report [PDF] by the duo at Duo Security describes how the Windows on Windows (WoW64) environment can be abused to bypass builtin security tools. WoW64 allows 32- …
Shaun Nichols, 03 Nov 2015

Malware, restoring data: What keeps data center techies up all night

A majority of organizations polled in a data center and cloud security survey are dissatisfied with their malware containment and recovery times. More than half (55 per cent) of survey respondents were dissatisfied with the length of time it takes them to contain and recover from hacker infiltrations and malware infections, …
John Leyden, 15 Oct 2015
brian_blessed_648

Pawn Storm attack: Flash zero-day exploit hits diplomatic inboxes

Hackers behind a long-running cyber-espionage campaign have begun using a new Adobe Flash zero-day exploit in their latest campaign. The attackers behind Pawn Storm targeted several foreign affairs ministries from around the globe using a Flash-based attack, Trend Micro reports. The targets received spear phishing emails that …
John Leyden, 15 Oct 2015
Xen project hypervisor logo

Xen 4.6 lands, complete with contributions from the NSA

Update The Xen Project has released version 4.6 of its eponymous hypervisor. The US National Security Agency's again tossed in some code but not, as we reported earlier, to deliver support for version 2.0 of the Virtual Trusted Platform Module (vTPM). That was the Xen team's error - BitDefender, not the NSA, contributed the vTPM 2.0 …
Simon Sharwood, 14 Oct 2015
AWS Snowball appliance

Disk boxes, security tools, etc: What Amazon announced at its AWS shindig on Wednesday

Amazon Web Services (AWS) kicked off its annual re:Invent conference on Wednesday with the introduction of a handful of new additions to its cloud computing service. The rollout includes a tool to test apps for security flaws, plus a business intelligence (BI) service, and a new way to physically toss data into Amazon's cloud …
Shaun Nichols, 08 Oct 2015

How to evade Apple's anti-malware Gatekeeper in OS X and really ruin a fanboy's week

The myth that Macs are inherently more secure than Windows PCs has taken another hit. Patrick Wardle, a former NSA staffer who now heads up research at crowdsourced security intelligence firm Synack, has found a new route around Apple's defensive Gatekeeper technology. Apple's Gatekeeper utility is built into OS X, and is …
John Leyden, 01 Oct 2015

IT security spending to hit $75.4bn in 2015 despite currency issues, says Gartner

Worldwide spending on information security will reach $75.4bn in 2015 – an increase of 4.7 per cent over 2014 – despite a currency-driven price hike causing some customers to delay purchases until next year. Government initiatives, increased legislation and high-profile data breaches are the hot topics shaping the latest …
John Leyden, 23 Sep 2015

Netflix releases reflected XSS audit tool for biz

Netflix has continued its contribution to the open source security community with the release of a tool to better help developers and admins identify cross-site scripting. The Sleeping Puppy tool joins Netflix's released security tools including Fully Integrated Defense Operation automated incidence response platform, the …
Darren Pauli, 03 Sep 2015
VR

Hidden password-stealing malware lurking in your GPU card? Intel Security thinks not

Fears that malware is hiding in people's graphics chipsets may be overclocked, according to Intel Security. Earlier this year, researchers from the self-styled “Team JellyFish” released a proof-of-concept software nasty capable of exploiting GPUs to swipe passwords and other information typed in by a PC's user. The same …
John Leyden, 01 Sep 2015

Mashed together malware threatens Japanese online banking users

Customers of Japanese banks are on the front line of attacks based on a new and sophisticated banking trojan, mashed together from leaked bits of malware code. Shifu (named after the Japanese word for thief) is targeting 14 Japanese banks as well as electronic banking platforms used across Europe, according to security …
John Leyden, 01 Sep 2015

Devs are SHEEP. Which is good when the leader writes secure code

Programmers with security chops are seen as more productive and influential workers whom other coders strive to emulate, according to security researchers from North Carolina State University and Microsoft Research. A sextet of security researchers has produced a trio of studies on the topic, finding that programmers are …
Darren Pauli, 26 Aug 2015

Anti-botnet initiatives USELESS in sea of patch-hating pirates

Three Dutch researchers have crunched data gleaned from efforts to battle the Conficker bot and declared anti-botnet initiatives all but useless for clean up efforts. Conficker was born in 2008 spreading aggressively through a since patched remote code execution Microsoft vulnerability (MS08-067) that affected all operating …
Darren Pauli, 18 Aug 2015
Marc Benioff of Salesforce. Pic: Techcrunch

Salesforce plugs silly website XSS hole, hopes nobody spotted it

A cross-site scripting (XSS) vulnerability on Salesforce's website might have been abused to pimp phishing attacks or hijack user accounts. Fortunately the bug has been resolved, apparently before it caused any harm. Cloud app and security firm Elastica said the issue affected a Salesforce sub-domain – admin.salesforce.com …
John Leyden, 14 Aug 2015

Oracle pulls CSO's BONKERS anti-bug bounty and infosec rant

Updated While other IT industry heavyweights have embraced bug bounties and working with security researchers more generally, Oracle has set its face in the opposite direction in a blog post likening reverse engineering to cheating on your spouse. Mary Ann Davidson, Oracle's chief security officer (CSO), expressed corporate dislike …
John Leyden, 11 Aug 2015
shutterstock_282226826-Internet-of-things

Cyber poltergeist threat discovered in Internet of Stuff hubs

New security research has revealed a whole new area of concerns for the soon-to-be-everywhere Internet of Things – smart home hubs. Hubs – devices that link into home networks to control lighting, dead-bolt locks and cameras – can be dangerously vulnerable to attack, according to security tools firm TripWire. Craig Young, a …
John Leyden, 23 Jul 2015
Padlocks by Simon Cocks Flickr CC2 license

No more customisation? Cloud Security Alliance calls for Open APIs

The Cloud Security Alliance has teamed up with CipherCloud to try and impose some discipline on the sector by defining protocols and best practice. CipherCloud will co-lead a Cloud Security Open API Working Group to develop vendor neutral protocols and best practices under the the Cloud Access Security Broker Framework. The …
Joe Fay, 30 Jun 2015

Vegan eats BeEf, gets hooked

Botnet slaughterer Brian Wallace has created a module to detect when attackers are using the popular browser-busting BeEF hacking framework. The Chrome extension codenamed Vegan allows victims to detect when attackers have hooked their web browser instances using the enormously powerful Browser Exploit Framework. Vegan could …
Darren Pauli, 26 Jun 2015
management regulation2

As the US realises it's been PWNED, when will OPM heads roll?

Heads are set to roll at the Office of Personnel Management as director Katherine Archuleta continues to receive a grilling from Senate committees, who are beginning to realise that the country's entire intelligence workforce has been utterly pwned, probably by a hostile nation. Archuleta, alongside OPM's Chief Information …

Hacked US OPM boss: We'll fix our IT security – just give us $21 million

The boss of the US government's thoroughly ransacked Office of Personnel Management has – rightly – come in for a rough ride from members of the House Committee on Oversight and Government Reform. Politicians on both sides of the trenches tore strips off the lamentable state of security in the agency, which was raided by …
Iain Thomson, 16 Jun 2015
Glorious future of China

Chinese snoops try tracking VPN users with fiendish JSONP trickery

Snoops are exploiting vulnerabilities in China’s most frequented websites to target individuals accessing web content which state censors have deemed hostile. Even users who run VPN connections to access websites that are blocked by China’s censorship technology, often called the Great Firewall (GFW), are potentially being …
John Leyden, 16 Jun 2015

The weapons pact threatening IT security research

Analysis The US government has rewritten chunks of an obscure weapons trade pact between itself, Europe, Russia, and other nations – a pact that is now casting its shadow over today's computer security tools. Dubbed the Wassenaar Agreement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies, the treaty limits who …
Iain Thomson, 06 Jun 2015

Script tool a Docker shocker blocker

Docker security head Diogo Mónica has crafted a defence tool to help admins protect their machine instances. Mónica says the Docker Bench Security script available on GitHub is designed as a complement and check systems against the Docker benchmarks released last month alongside a whitepaper [pdf]. “Having the documents is …
Darren Pauli, 01 Jun 2015

Facebook flings PGP-encrypted email at world+dog. Don't lose your private key

Hands-on Facebook can now powerfully encrypt notification emails sent to its users with PGP – keeping potentially sensitive messages out of the hands of hackers and other snoopers. The social network has also added a spot for people to share their public PGP keys via the HTTPS-protected website. "We are gradually rolling out an …
Iain Thomson, 01 Jun 2015
Nicole Kidman (Christine Lucas) in Before I Go To Sleep

OK Google, how much of my life do you observe and disturb?

Google would like netizens to believe that the vast multinational has bolstered "privacy" controls on its services today. But you'd be wrong to swallow that line. In fact, no changes have been made to the company's data-slurping and scraping policies. Instead – in a move reflecting Facebook's somewhat disingenuous claims to …
Kelly Fiveash, 01 Jun 2015
The Office

SDN to bring new round of internecine office wars to IT shops

Software-defined networking (SDN) will give IT teams a new reason for internecine conflict, as those looking to build automated, software-defined data centres come up against the hard-headed trust nobody pragmatism of security teams. So says Gartner's Eric Ahlm, a research director at the analyst firm, who today delivered a …
Simon Sharwood, 19 May 2015
Venomous snake

VENOM virtual vuln proves less poisonous than first feared

Analysis A newly discovered vulnerability in many popular virtual machine platforms is serious, but nowhere near as bad as last year’s Heartbleed vulnerability, according to security experts. Dubbed VENOM (Virtualized Environment Neglected Operations Manipulation), the zero-day flaw takes advantage of the “virtual floppy disk controller …
John Leyden, 14 May 2015
sap security vulnerabilities

Almost EVERY SAP install hackable, researchers say

A staggering 95 percent of enterprise SAP installations contain high-severity vulnerabilities that could allow systems to be hijacked, researchers say. Researchers from SAP security tools vendor Onapsis say attackers can target the SAP installs to pivot from low to high integrity systems, execute admin privilege commands, and …
Darren Pauli, 08 May 2015
apple mac malware vxer

Ex-NSA security bod fanboi: Apple Macs are wide open to malware

A former NSA staffer turned security researcher is warning that bypassing typical OS X security tools is trivial. Patrick Wardle, a former NSA staffer and NASA intern who now heads up research at crowd-sourced security intelligence firm Synack, found that Apple's defensive Gatekeeper technology can be bypassed allowing unsigned …
John Leyden, 07 May 2015

ID yourself or get NOTHING (except Framework), snarls Metasploit

Metasploit Pro and Community users outside North America now need to prove who they are, thanks to changes introduced this week and a tightening of encryption export rules. The open source Metasploit Framework (a computer security project) is not affected by the new rules. "[This] is yet another reminder that governments have …
John Leyden, 21 Apr 2015
Non-sleeper

Self preservation is AWS security's biggest worry, says gros fromage

State-sponsored cyber armies, lone-wolf attackers, denial-of-service attacks ... which keep Amazon’s Web Services security boffins awake at night? None of the above. It’s customers – those who don’t protect themselves adequately against hackers and malware. That’s according AWS head of global security programs Bill Murray, who …
Gavin Clarke, 13 Apr 2015

Using Office 365 at work? It's dangerous to go alone! Take this...

Microsoft is adding some security tools, dubbed Advanced Threat Protection, to Office 365 for its business and government subscribers. The utilities will try to curb malware writers and phishers seeking to exploit vulnerabilities via emailed attachments and links. "As hackers around the globe launch increasingly sophisticated …
Iain Thomson, 08 Apr 2015

Hackers fear arms control pact makes exporting flaws illegal

Export regulations that threaten to hinder vulnerability research and exploit development have put hackers on edge ahead of the annual Pwn2Own contest. Operators of the hack-fest have reportedly issued an email warning to researchers to obtain legal advice about how the Wassenaar Arrangement, a 42-nation effort aimed at " …
Darren Pauli, 16 Feb 2015

Biter bitten as hacker leaks source code for popular exploit kit

A black hat trouble maker appears to have released recent source code for one of the most popular exploit kits, malware-probers say. The dump was posted online by a user known as (@EkMustDie) before it was removed. The leaker appears to have previously tried to sell access to the exploit kit. Independent malware …
Darren Pauli, 13 Feb 2015

Netflix airs its developers' Dirty Laundry

Netflix has developed a platform, using soon-to-be open source tools, that probes for vulnerabilities and monitor data leakage. One initiative dubbed the "Dirty Laundry Project" monitors for Netflix assets unintentionally exposed by its staff. Engineers Scott Behrens and Andy Hoernecke (pictured above) told the Shmoocon …
Darren Pauli, 09 Feb 2015