Cryptography

The Internet was not designed to be a secure network, not by any stretch of the imagination. It was meant to enable giant PDPs and IMPs at one college to talk to their brethren at another college across the country. SSL was an attempt to impose some level of security and trustability on this system after the fact, but the last few years have shown that it has a lot of limitations, and to some degree has given users a misplaced faith in the fragile certificate authority infrastructure. Now, security researcher Moxie Marlinspike is hoping to change some of that.

Digital civil liberties organization, the Electric Frontier Foundation (EFF), appealed to the U.S. District Court of Colorado arguing that encrypted personal data is covered by the Fifth Amendment’s protection against self incrimination.

Most Internet users at this point understand that Web sites routinely and extensively track the behavior and movements of their visitors. It’s an unsettling reality. But few people have a handle on just how widespread and pervasive the practice is. Now, a developer has released an add-on for Firefox called Collusion that enables users to see exactly which sites and third parties are tracking them, in real time.

It wasn’t long ago – just a month in fact – that Apple’s iOS mobile operating system was being called the ‘Most secure’ OS. Period.’ A few weeks later, and the security of that OS has fallen (again) to the talents of Comex, an as-yet-unnamed mobile device hacker whose work is attracting kudos from some of the world’s top hackers, vulnerability researchers and exploit writers. 

Researchers from Kaspersky Labs claim to have discovered the most sophisticated piece of malware available on the Web. Detected by their antivirus product as TDSS, the Trojan employs a number of methods to avoid detection, including the use of encryption between the botnet command and control server and its zombies and a powerful rootkit component that conceals the presence other types of malware in a given system.

Customers of EMC’s RSA Security division that are worried about being the victim of an attack following the theft of sensitive data relating to that company’s SECURID tokens may not need to rush out and replace those tokens, according to security consulting firm Verizon Business. 

The following is an exclusive Threatpost interview with Samuel Weber, Program Director for the National Science Foundation’s Trustworthy Computing Program. The interview took place on Monday, June 27, 2011 at the RFIDSec 11 Conference on the campus of the University of Massachusetts, Amherst.