Dennis Fisher

Melissa Hathaway has left her post as the country’s top cybersecurity adviser, casting even more doubt on who will take the open job of cybersecurity coordinator created by President Obama in May. Hathaway said she is resigning for personal reasons and has no interest in the coordinator job, according to the Wall Street Journal.

In this video, researcher Andrew Martin walks through an attack on a Web site involving the Nine-Ball exploit, which has been used to compromise tens of thousands of legitimate Web sites in the last few months.

The cryptographic underpinnings of the Internet are beginning to show some serious wear, and the outlook for better days ahead is not particularly rosy. In just the last week there has been news of major new attacks on perhaps the two most widely used encryption technologies: SSL and AES. We’ve heard talk of cracks in both protocols before, but this time, even the most conservative observers are worried.

LAS VEGAS — The security of social networking sites isn’t as bad as you think. In fact, it’s much worse.

Sites such as Twitter, Facebook and others that rely heavily on user-generated content, shared content and aggregation have been the targets of increasingly sophisticated attacks over the last few months, and if the problems discussed in a presentation at the DEFCON hacker conference here Saturday are any indication, this is only the beginning.

A group of cryptographers has devised a new attack against AES, the de facto standard encryption algorithm, that enables them to recover an encryption key in far less time than had been possible before. The attack can recover an AES-256 key in a small enough amount of time to make the method practical for common attackers, leading some experts to recommend that users stop using AES-256 immediately.

There are several architectural and implementation problems in mobile phone networks that can be used to force users to open malicious files, allow attackers to gain control of users’ phones and change phone settings to redirect mobile Internet traffic to a proxy controlled by the attackers.
In a presentation at the Black Hat conference in Las Vegas on Thursday, Luis Miras, and independent security researcher, and Zane Lackey of iSec Partners, demonstrated a number of techniques for taking advantage of the implementation and design problems. The pair also announced the release of a tool they called TAFT (There’s an Attack for That), which runs on jailbroken iPhones and can be used to execute several different attacks.

LAS VEGAS — There is a serious vulnerability in all versions of the current release of BIND, a widely deployed name server, that can be used to force DNS servers to quit without warning. Experts say there also is an exploit for the vulnerability that is already circulating widely online.