University of Michigan scientists have found they could foil RSA authentication by varying the
voltage supply to the holder of the “private key,” which would be the
consumer’s device in the case of copy protection and the retailer or
bank in the case of Internet communication. It is highly unlikely that
a hacker could use this approach on a large institution, the
researchers say. Read the full article. [ScienceDaily]
The new class of threat represented by today’s banking malware like ZeuS can
defeat much of the technology out there to combat it, admitted RSA bank-security panelists. Read the full article. [Tech Target]
Security B-Sides: Security penetration testers Mike Bailey and Mike Murray rely plenty on
attacks that exploit weaknesses in websites and servers, but their
approach is better summed up by the famous phrase “There’s a sucker
born every minute.” Read the full article. [The Register]
More details follow the news of the Spanish botnet Mariposa and its owners being caught. The Mariposa Working Group infiltrated the command-and-control
structure of Mariposa to monitor the communication channels that
relayed information from compromised systems back to the hackers who
run the botnet. Read the full article. [The Register]
Forget iris and fingerprint scans — scanning noses could be a quicker and easier way to verify a person’s identity, according to scientists at the University of Bath. With worries about illegal immigration and identity theft, authorities are increasingly looking to using an individual’s physical characteristics, known as biometrics, to confirm their identity. Read the full article. [Homeland Security Newswire]
For years, leaders of the security industry have warned that
passwords have outlived their usefulness. Users pick easy-to-crack
passwords like the name of a dog or a favorite movie. They’re written
on post-it notes and left sticking to the monitor for all to see. Multi-factor
authentication — using more than one form of authentication to verify
the legitimacy of a transaction via smart cards, tokens or biometrics,
for example — is often held up as the alternative; an end to insanity. The reality is far less simple. Read the full article. [CSO]
An estimated 1.42 million adults in this country may have experienced
some type of fraud involving theft of their medical identification
information, a report from the Ponemon Institute claims. “The National Study on Medical Identity Theft” is based on findings
from 156,000 people who agreed to discuss identity theft in general.
Among those surveyed, 5.8% provided specific details about how they had
been hit by medical ID theft. Read the full article. [Computerworld]
The nation’s new cybersecurity czar in a Town
Hall meeting session here today mapped out his top priorities in the
post and provided a glimpse at how the Obama administration may handle
security issues with other countries. National cybersecurity coordinator Howard Schmidt also announced that the White House was
releasing an unclassified version of its plan for securing government
and private industry networks. Read the full article. [Dark Reading]
Authorities have smashed one of the world’s biggest networks of
virus-infected computers (known as the Mariposa botnet), a data vacuum that stole credit cards and
online banking credentials from as many as 12.7 million poisoned PCs. Read the full article. [Associated Press]
Microsoft today said it had restarted distribution of a security update
that had crippled some Windows PCs last month with reboot problems and
Blue Screen of Death error screens. Read the full article. [Computerworld]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
