Since every time I posted my previous article people were asking questions, I wrote up the following as a Facebook comment and figured it deserved repeat posting here. Note that there’s an article in our archives which is similar but not as specific as this one. Get ready for your cryptography lesson. A hash is a one-way function. This means that given some input, it creates some seemingly random output. It is one-way in that you can’t do math on the output to get back to the input. So, “abc” -> (hash function) -> A9993E364706816ABA3E25717850C26C9CD0D89D and there’s no way to get “abc” back from that nasty string. UNLESS you have taken the time to generate what’s called a rainbow table. Hackers[…]
You might have heard that LinkedIn had its password database breached, and news of it is trickling out today. There are a number of write-ups about it in most of the usual places, and Martin McKeay has a post with links to some of the better ones. The reason I’m writing about this is not to alert you, or that I’m annoyed I have to change another password. Two things really bother me about this. The first is the eerie similarity between this event and the Gawker password breach I wrote about almost exactly eighteen months ago. Both of these events made news because they were leaks of unsalted password hashes. And, although I didn’t write it in my blog post that day, two[…]
This morning, I heard a commercial on the radio which left me with a bad taste in my mouth. I don’t want to quote the exact commercial, but you’ve heard the type. I’ve created a semi-fictional ad based on the one I heard below: <alarm sound>How do you stop cyber threats <second, more urgent alarm sound in addition> when they’re constantly evolving? <third, even more urgent alarm> Our organization stops threats by <alarms cease, replaced by typing sounds> integrating solutions, building partnerships with business, academia, and government, as well as preparing the cyber professionals of the future. OK, so what have we learned from this 30-second radio clip? Not much. It seems that in order to stay ahead of evolving threats,[…]
During security assessments, I always make sure they’re performing security testing as part of their development process. This is why: “Apple security blunder exposes Lion login passwords in clear text” No need to go into details as to what happened here; it’s well-researched in the linked article. However, this is exactly the scenario that development security testing is meant to avoid. A seemingly innocent patch disables or circumvents an important security feature. The results are predictable. It could be worse, though. Here’s the worst case: the problem isn’t detected. Because the security was included in the original version, and because nobody checked, it is assumed that the security is in place, and successive updates are made, with the security feature[…]
I’ve had some interesting experiences with two companies recently that I’d like to share. We all do business with companies online: we buy from them, we schedule appointments, we put in support requests, and so on. Today, I very seldom use the mail, and don’t shop in person very often. How these businesses treat customer security is interesting. Some places are very technically savvy and have robust, secure online transactions. Being realistic, though, I know that my dentist’s office does not employ a full-time sysadmin. They buy an off-the-shelf customer care solution and hire someone to install it on their website. Sometimes that’s good, sometimes that’s bad… First was with my mechanic. I like my mechanic – they’ve saved me[…]
A service provider shall not be liable for monetary relief, or, except as provided in subsection (j), for injunctive or other equitable relief, for infringement of copyright by reason of the provider’s transmitting, routing, or providing connections for, material through a system or network controlled or operated by or for the service provider, or by reason of the intermediate and transient storage of that material in the course of such transmitting, routing, or providing connections – 17 USC § 512, from the Cornell University Law School No business is an island. There’s no company that does not, to some extent, rely on other businesses. Business models assume that vendors will be able to assure a steady flow of goods, that[…]