Cryptography

The recent attack on Comodo and several of its associated registration authorities has spurred quite a bit of re-examination of the way that the Web’s certificate authority infrastructure works–or doesn’t. One interesting result of this work is that the folks at the Electronic Frontier Foundation have discovered that there are tens of thousands of legitimate certificates issued by CAs for unqualified names such as “localhost” or “Exchange,” a practice that could simplify some forms of man-in-the-middle attacks.

Evidently the kids are not alright. At least, that is when it comes to the increasingly lucrative identity theft black market.

UPDATE: Call it ‘dancing with the girl that brought ‘ya,’: two weeks after it disclosed a serious security breach at its RSA Security Division, tech firm EMC said it was buying NetWitness, a threat analysis firm that helped it detect the breach in the first place.

RSA confirmed on Friday that the attack that compromised the company’s high-value SecurID product was essentially a small, targeted phishing campaign that included a payload of a malicious Flash object embedded in an Excel file.

Almost a year has passed since the Deepwater Horizon oil rig exploded and spewed three months of oil into the Gulf of Mexico. But less than six months after the beleaguered oil giant managed to cap that well, it is contending with a new spill of a different sort: the loss of personal information on thousands of Gulf Coast residents who had filed claims for compensation stemming from the leak.

Officials at Comodo have acknowledged that an additional two registration authorities affiliated with the company have been compromised in the wake of the high-profile attack on the company that was disclosed last week. However, no forged certificates were issued as a result of the new attacks.

BOSTON–The Tor Project has become a vital mechanism for privacy advocates, human rights activists, journalists and others in sensitive positions to evade online censorship and persecution. And while the governments interested in limiting user access to the Internet and controlling content have had some recent success in preventing the use of the anonymity network, Tor members have been working on new methods for circumventing those restrictions.