Vulnerabilities

Five Questions About Aaron Barr’s DEFCON (by Aaron Barr)

Editor’s note: Finding Aaron Barr at this year’s DEFCON hacker conference in Las Vegas was like a giant game of “Where’s Waldo.” Given the events of the past year, you can hardly blame him for keeping a low profile. First there was the attack on him and his then-employer, HBGary Federal, his decision to part ways with HBGary, his work to rehabilitate his image and turn his personal misfortunes into a ‘teaching moment’ for the industry, and then the legal wrangling in recent weeks that threw cold water on his plans to take part in a panel discussion about Anonymous at DEFCON. Barr was courted by numerous news outlets at the show, including the mainstream media. But he preferred, for the most part, to keep his counsel. So when Aaron offered to contribute his thoughts on this year’s DEFCON to Threatpost, we jumped at it. Here’s what he had to say.  

Android Malware Found Stealing Texts, Intercepting Calls

The steady drumbeat of malware and spyware targeting the Android platform is continuing, this time with the emergence of a new variant of an Android Trojan that masquerades as a Google+ app and has the ability to not only record phone calls, but also to answer incoming calls and respond to remote commands that arrive via SMS.

Shady Rat Attackers Hid Code in Digital Images

by Chris Brook

More information about last week’s “Shady Rat” hacks continues to be uncovered, including reports that the attackers behind the hack used digital images to obscure their activities.Researchers at Symantec analyzing the attacks found images were hiding code that enabled communication back and forth with infected machines and a command-and-control (C&C) server, according to a report from DarkReading.

New Workaround Released For iOS SSL Flaw

by Dennis Fisher

A security researcher has released a new workaround for the critical vulnerability in the Apple iOS operating system related to the way that the OS handle SSL certificate validation. The workaround makes some key checks in the certificate chain that the vulnerable versions of iOS and a previous workaround fail to execute.

Video: Researchers Knock Out a $3K First Responder’s Radio With a $30 Children’s Toy

by Paul Roberts
2

During the Reagan Administration, the ‘government waste’ meme was all about $600 toilet seats and $300 hammers. Those looking for a more contemporary example of how government procurement gets it wrong might point, instead, to Project 25 (P25), a decade old effort to provide first responders and federal officials with a reliable and secure emergency radio system.

Researchers Show Method to Decrypt GPRS Traffic

by Dennis Fisher

A security researcher known for his work on cracking cryptographic ciphers on mobile networks has found a method that enables him to capture and decrypt data traffic on virtually any GPRS network. The attack, developed by Karsten Nohl, enables him to eavesdrop on traffic within a radius of about three miles.

DDoS Attack Forces Hong Kong Exchange Site Offline for Second Day

by Chris Brook
3

Trading on Hong Kong’s stock market, Hong Kong Exchanges & Clearing, remains suspended today following a “coordinated and sustained” distributed denial of service attack on one of the exchange’s websites Wednesday. Several companies, including HSBC, China Power International and Cathay Pacific found their shares unavailable late Wednesday following the attack according to a report from BBC.

Dino Dai Zovi: Attacker Math

by Dennis Fisher

In his keynote address at the SOURCE Boston conference this year, independent security researcher Dino Dai Zovi discussed the attacker mentality and they way that defenders can adopt it to better protect their networks.

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.