Lucene search
K
SchneierRecent

2961 matches found

Schneier on Security
Schneier on Security
added 2020/12/15 12:44 p.m.28 views

Another Massive Russian Hack of US Government Networks

The press is reporting a massive hack of US government networks by sophisticated Russian hackers. Officials said a hunt was on to determine if other parts of the government had been affected by what looked to be one of the most sophisticated, and perhaps among the largest, attacks on federal...

1.5AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/14 8:3 p.m.69 views

Should There Be Limits on Persuasive Technologies?

Persuasion is as old as our species. Both democracy and the market economy depend on it. Politicians persuade citizens to vote for them, or to support different policy positions. Businesses persuade consumers to buy their products or services. We all persuade our friends to accept our choice of...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/14 7:39 p.m.24 views

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Im speaking online at Western Washington University on January 20, 2021. Details to come. I’ll be speaking at an Informa event on February 28, 2021. Details to come. The list is maintained on this page...

1.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/14 12:31 p.m.26 views

Authentication Failure

This is a weird story of a building owner commissioning an artist to paint a mural on the side of his building -- except that he wasnt actually the buildings owner. The fake landlord met Hawkins in person the day after Thanksgiving, supplying the paint and half the promised fee. They met again a...

0.4AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/11 10:10 p.m.38 views

Friday Squid Blogging: Newly Identified Ichthyosaur Species Probably Ate Squid

This is a deep-diving species that "fed on small prey items such as squid." Academic paper. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

1.5AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/11 12:57 p.m.29 views

A Cybersecurity Policy Agenda

The Aspen Institutes Aspen Cybersecurity Group -- Im a member -- has released its cybersecurity policy agenda for the next four years. The next administration and Congress cannot simultaneously address the wide array of cybersecurity risks confronting modern society. Policymakers in the White...

1.4AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/10 7:48 p.m.31 views

Finnish Data Theft and Extortion

The Finnish psychotherapy clinic Vastaamo was the victim of a data breach and theft. The criminals tried extorting money from the clinic. When that failed, they started extorting money from the patients: Neither the company nor Finnish investigators have released many details about the nature of...

0.5AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/09 12:36 p.m.27 views

FireEye Hacked

FireEye was hacked by -- they believe -- "a nation with top-tier offensive capabilities": During our investigation to date, we have found that the attacker targeted and accessed certain Red Team assessment tools that we use to test our customers’ security. These tools mimic the behavior of many...

7.1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/08 9:2 p.m.31 views

Oblivious DNS-over-HTTPS

This new protocol, called Oblivious DNS-over-HTTPS ODoH, hides the websites you visit from your ISP. Heres how it works: ODoH wraps a layer of encryption around the DNS query and passes it through a proxy server, which acts as a go-between the internet user and the website they want to visit...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/07 12:32 p.m.39 views

Hiding Malware in Social Media Buttons

Clever tactic: This new malware was discovered by researchers at Dutch cyber-security company Sansec that focuses on defending e-commerce websites from digital skimming also known as Magecart attacks. The payment skimmer malware pulls its sleight of hand trick with the help of a double payload...

Exploits0
Schneier on Security
Schneier on Security
added 2020/12/04 10:11 p.m.38 views

Friday Squid Blogging: Bigfin Squid Found in Australian Waters

A bigfin squid has been found -- and filmed -- in Australian waters for the first time. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

2.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/04 8:21 p.m.34 views

The 2020 Workshop on Economics and Information Security (WEIS)

The workshop on Economics and Information Security is always an interesting conference. This year, it will be online. Heres the program. Registration is free...

1.6AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/04 3:18 p.m.38 views

Enigma Machine Recovered from the Baltic Sea

Neat story: German divers searching the Baltic Sea for discarded fishing nets have stumbled upon a rare Enigma cipher machine used by the Nazi military during World War Two which they believe was thrown overboard from a scuttled submarine. Thinking they had discovered a typewriter entangled in a...

0.5AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/03 5:21 p.m.28 views

Open Source Does Not Equal Secure

Way back in 1999, I wrote about open-source software: First, simply publishing the code does not automatically mean that people will examine it for security flaws. Security researchers are fickle and busy people. They do not have the time to examine every piece of source code that is published. S...

0.2AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/02 7:55 p.m.37 views

Impressive iPhone Exploit

This is a scarily impressive vulnerability: Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave attackers remote access to the entire device­ -- over Wi-Fi, with no user interaction required at all. Oh, and...

0.6AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/12/01 12:13 p.m.29 views

Manipulating Systems Using Remote Lasers

Many systems are vulnerable: Researchers at the time said that they were able to launch inaudible commands by shining lasers -- from as far as 360 feet -- at the microphones on various popular voice assistants, including Amazon Alexa, Apple Siri, Facebook Portal, and Google Assistant. … They...

1.3AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/30 3:22 p.m.32 views

Check Washing

I cant believe that check washing is still a thing: "Check washing" is a practice where thieves break into mailboxes or otherwise steal mail, find envelopes with checks, then use special solvents to remove the information on that check except for the signature and then change the payee and the...

1.2AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/27 10:33 p.m.60 views

Friday Squid Blogging: Diplomoceras Maximum

Diplomoceras maximum is an ancient squid-like creature. It lived about 68 million years ago, looked kind of like a giant paperclip, and may have had a lifespan of 200 years. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my...

3.1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/27 12:10 p.m.23 views

Undermining Democracy

Last Thursday, Rudy Giuliani, a Trump campaign lawyer, alleged a widespread voting conspiracy involving Venezuela, Cuba, and China. Another lawyer, Sidney Powell, argued that Mr. Trump won in a landslide, the entire election in swing states should be overturned and the legislatures should make su...

1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/25 12:25 p.m.40 views

Cyber Public Health

In a lecture, Adam Shostack makes the case for a discipline of cyber public health. It would relate to cybersecurity in a similar way that public health relates to medicine...

1.3AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/24 12:1 p.m.37 views

On That Dusseldorf Hospital Ransomware Attack and the Resultant Death

Wired has a detailed story about the ransomware attack on a Dusseldorf hospital, the one that resulted in an ambulance being redirected to a more distant hospital and the patient dying. The police wanted to prosecute the ransomware attackers for negligent homicide, but the details were more...

6.7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/23 12:44 p.m.29 views

More on the Security of the 2020 US Election

Last week I signed on to two joint letters about the security of the 2020 election. The first was as one of 59 election security experts, basically saying that while the election seems to have been both secure and accurate voter suppression notwithstanding, we still need to work to secure our...

0.2AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/23 12:4 p.m.34 views

Indistinguishability Obfuscation

Quanta magazine recently published a breathless article on indistinguishability obfuscation -- calling it the "crown jewel of cryptography" -- and saying that it had finally been achieved, based on a recently published paper. I want to add some caveats to the discussion. Basically, obfuscation...

7.3AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/20 10:13 p.m.46 views

Friday Squid Blogging: Ram’s Horn Squid Video

This is the first video footage of a rams horn squid Spirula spirula . As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

2.1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/20 12:5 p.m.58 views

Symantec Reports on Cicada APT Attacks against Japan

Symantec is reporting on an APT group linked to China, named Cicada. They have been attacking organizations in Japan and elsewhere. Cicada has historically been known to target Japan-linked organizations, and has also targeted MSPs in the past. The group is using living-off-the-land tools as well...

1.6AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/19 3:37 p.m.39 views

The US Military Buys Commercial Location Data

Vice has a long article about how the US military buys commercial location data worldwide. The U.S. military is buying the granular movement data of people around the world, harvested from innocuous-seeming apps, Motherboard has learned. The most popular app among a group Motherboard analyzed...

1.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/18 12:21 p.m.21 views

Michael Ellis as NSA General Counsel

Over at Lawfare, Susan Hennessey has an excellent primer on how Trump loyalist Michael Ellis got to be the NSA General Counsel, over the objections of NSA Director Paul Nakasone, and what Biden can and should do about it. While important details remain unclear, media accounts include numerous...

0.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/16 3:55 p.m.27 views

On Blockchain Voting

Blockchain voting is a spectacularly dumb idea for a whole bunch of reasons. I have generally quoted Matt Blaze: Why is blockchain voting a dumb idea? Glad you asked. For starters: It doesnt solve any problems civil elections actually have. Its basically incompatible with "software independence",...

1.4AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/14 6:35 p.m.41 views

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at the ISC² Security Congress 2020, November 16, 2020. I’ll be on a panel at the OECD Global Blockchain Policy Forum 2020 on November 17, 2020. The panel is called "Deep Dive: Digital Security and Distributed Ledger...

0.1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/13 10:9 p.m.33 views

Friday Squid Blogging: Underwater Robot Uses Squid-Like Propulsion

This is neat: By generating powerful streams of water, UCSDs squid-like robot can swim untethered. The "squidbot" carries its own power source, and has the room to hold more, including a sensor or camera for underwater exploration. As usual, you can also use this squid post to talk about the...

1.5AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/13 8:17 p.m.38 views

Inrupt’s Solid Announcement

Earlier this year, I announced that I had joined Inrupt, the company commercializing Tim Berners-Lees Solid specification: The idea behind Solid is both simple and extraordinarily powerful. Your data lives in a pod that is controlled by you. Data generated by your things -- your computer, your...

0.7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/13 12:25 p.m.28 views

New Zealand Election Fraud

It seems that this election season has not gone without fraud. In New Zealand, a vote for "Bird of the Year" has been marred by fraudulent votes: More than 1,500 fraudulent votes were cast in the early hours of Monday in the countrys annual bird election, briefly pushing the Little-Spotted Kiwi t...

1.1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/12 12:22 p.m.34 views

“Privacy Nutrition Labels” in Apple’s App Store

Apple will start requiring standardized privacy labels for apps in its app store, starting in December: Apple allows data disclosure to be optional if all of the following conditions apply: if its not used for tracking, advertising or marketing; if its not shared with a data broker; if collection...

1.5AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/11 4:25 p.m.26 views

The Security Failures of Online Exam Proctoring

Proctoring an online exam is hard. Its hard to be sure that the student isnt cheating, maybe by having reference materials at hand, or maybe by substituting someone else to take the exam for them. There are a variety of companies that provide online proctoring services, but theyre uniformly...

0.6AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/10 12:40 p.m.21 views

2020 Was a Secure Election

Over at Lawfare: "2020 Is An Election Security Success Story So Far." What’s more, the voting itself was remarkably smooth. It was only a few months ago that professionals and analysts who monitor election administration were alarmed at how badly unprepared the country was for voting during a...

1.2AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/06 10:1 p.m.37 views

Friday Squid Blogging: Peru Defends Its Waters against Chinese Squid Fishing Boats

Squid geopolitics. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

1.7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/06 12:28 p.m.26 views

Detecting Phishing Emails

Research paper: Rick Wash, "How Experts Detect Phishing Scam Emails": Abstract: Phishing scam emails are emails that pretend to be something they are not in order to get the recipient of the email to undertake some action they normally would not. While technical protections against phishing reduc...

1.2AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/05 3:28 p.m.17 views

California Proposition 24 Passes

Californias Proposition 24, aimed at improving the California Consumer Privacy Act, passed this week. Analyses are very mixed. I was very mixed on the proposition, but on the whole I supported it. The proposition has some serious flaws, and was watered down by industry, but voting for privacy fee...

2.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/04 4:28 p.m.23 views

Determining What Video Conference Participants Are Typing from Watching Shoulder Movements

Accuracy isnt great, but that it can be done at all is impressive. Murtuza Jadiwala, a computer science professor heading the research project, said his team was able to identify the contents of texts by examining body movement of the participants. Specifically, they focused on the movement of...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/11/02 8:1 p.m.12 views

New Windows Zero-Day

Googles Project Zero has discovered and published a buffer overflow vulnerability in the Windows Kernel Cryptography Driver. The exploit doesnt affect the cryptography, but allows attackers to escalate system privileges: Attackers were combining an exploit for it with a separate one targeting a...

3.1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/10/30 9:7 p.m.31 views

Friday Squid Blogging: Interview with a Squid Researcher

Interview with Mike Vecchione, Curator of Cephalopoda -- now thats a job title -- at the Smithsonian Museum of National History. One reason theyre so interesting is they are intelligent invertebrates. Almost everything that we think of as being intelligent -- parrots, dolphins, etc. -- are...

0.7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/10/30 2:14 p.m.21 views

The Legal Risks of Security Research

Sunoo Park and Kendra Albert have published "A Researcher’s Guide to Some Legal Risks of Security Research." From a summary: Such risk extends beyond anti-hacking laws, implicating copyright law and anti-circumvention provisions DMCA §1201, electronic privacy law ECPA, and cryptography export...

1.3AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/10/29 2:52 p.m.18 views

Tracking Users on Waze

A security researcher discovered a wulnerability in Waze that breaks the anonymity of users: I found out that I can visit Waze from any web browser at waze.com/livemap so I decided to check how are those driver icons implemented. What I found is that I can ask Waze API for data on a location by...

1.5AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/10/28 2:40 p.m.20 views

The NSA is Refusing to Disclose its Policy on Backdooring Commercial Products

Senator Ron Wyden asked, and the NSA didnt answer: The NSA has long sought agreements with technology companies under which they would build special access for the spy agency into their products, according to disclosures by former NSA contractor Edward Snowden and reporting by Reuters and others...

0.4AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/10/27 11:34 a.m.22 views

Reverse-Engineering the Redactions in the Ghislaine Maxwell Deposition

Slate magazine was able to cleverly read the Ghislaine Maxwell deposition and reverse-engineer many of the redacted names. Weve long known that redacting is hard in the modern age, but most of the failures to date have been a result of not realizing that covering digital text with a black bar...

0.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/10/26 11:53 a.m.42 views

IMSI-Catchers from Canada

Gizmodo is reporting that Harris Corp. is no longer selling Stingray IMSI-catchers and, presumably, its follow-on models Hailstorm and Crossbow to local governments: L3Harris Technologies, formerly known as the Harris Corporation, notified police agencies last year that it planned to discontinue...

0.3AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/10/23 9:5 p.m.26 views

Friday Squid Blogging: Squid-like Nebula

Pretty astronomical photo. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

1.5AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/10/23 1:47 p.m.35 views

New Report on Police Decryption Capabilities

There is a new report on police decryption capabilities: specifically, mobile device forensic tools MDFTs. Short summary: its not just the FBI that can do it. This report documents the widespread adoption of MDFTs by law enforcement in the United States. Based on 110 public records requests to...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/10/21 2:21 p.m.22 views

NSA Advisory on Chinese Government Hacking

The NSA released an advisory listing the top twenty-five known vulnerabilities currently being exploited by Chinese nation-state attackers. This advisory provides Common Vulnerabilities and Exposures CVEs known to be recently leveraged, or scanned-for, by Chinese state-sponsored cyber actors to...

4.7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2020/10/20 11:29 a.m.25 views

Cybersecurity Visuals

The Hewlett Foundation just announced its top five ideas in its Cybersecurity Visuals Challenge. The problem Hewlett is trying to solve is the dearth of good visuals for cybersecurity. A Google Images Search demonstrates the problem: locks, fingerprints, hands on laptops, scary looking hackers in...

1.2AI score
Exploits0
Total number of security vulnerabilities2961