New App ReKey Fixes Android Master Key Vulnerability
A new app called ReKey fixes the Android master key vulnerability, released by Duo Security.
Dennis Fisher
About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
Chris Soghoian on the NSA Surveillance and Government Hacking
Dennis Fisher talks with Chris Soghoian of the ACLU about the NSA surveillance leaks, the PRISM data collection program, the lack of good privacy options for consumers and his upcoming talk at DEF CON on government hacking operations.
HP to Patch Remote Backdoor in StoreVirtual Systems
A few weeks after admitting that it had put an administrative backdoor in its StoreOnce backup servers, HP has said it has a similar mechanism in its StoreVirtual storage systems that allows a remote user to access the operating system. The company said the function is meant for remote support use, but acknowledged that it could also be an attack vector.
Just a few weeks after announcing its first bug bounty programs, Microsoft is already set to pay out a reward to a researcher from Google who discovered a vulnerability in Internet Explorer 11.
Attackers are using an Internet Explorer vulnerability, which Microsoft patched yesterday, in targeted attacks that also employ a malicious Flash file installed through a drive-by download launched by compromised Web pages. The exploit that’s being used is capable of bypassing both ASLR and DEP.
Bug bounty programs can be as much as 100 times more cost-effective for finding security vulnerabilities than hiring full-time security researchers to do the same thing. New research from the University of California at Berkeley, which focused on bug bounty programs run by Google and Mozilla, found that each of these programs has cost the vendor about $400,000 over the course of three years, far less than it would’ve cost to hire employees to find the same number of vulnerabilities.
Google has fixed more than 15 vulnerabilities in Chrome and paid out nearly $35,000 in rewards to security researchers for reporting the bugs. One researcher earned an unusually large reward of $21,500 for a series of vulnerabilities he reported in Chrome.
The details of the Android vulnerability that enables an attacker to create a malicious update to an APK file without breaking its cryptographic signature have become public but it appears as though Google will have a patch ready for the flaw by the time it’s fully disclosed early next month.
The federal government is looking for some help in figuring out how to respond to security incidents. As attacks continue to escalate against both government agencies and private enterprises, NIST is developing a set of standards for best practices in incident response and computer forensics.
Data breaches affected more than 2.5 million California residents last year, and the state’s attorney general said that the information belonging to more than half of those victims would have been unaffected had the data been encrypted by the companies storing it. In an effort to remedy this situation, Attorney General Kamala Harris is planning to take […]
