Lucene search
K
SchneierRecent

2959 matches found

Schneier on Security
Schneier on Security
•added 2018/08/23 10:54 a.m.•23 views

John Mueller and Mark Stewart on the Risks of Terrorism

Another excellent paper by the Mueller/Stewart team: "Terrorism and Bathtubs: Comparing and Assessing the Risks": Abstract: The likelihood that anyone outside a war zone will be killed by an Islamist extremist terrorist is extremely small. In the United States, for example, some six people have...

7.1AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/22 10:51 a.m.•41 views

Good Primer on Two-Factor Authentication Security

Stuart Schechter published a good primer on the security issues surrounding two-factor authentication. While it's often an important security measure, it's not a panacea. Stuart discusses the usability and security issues that you have to think about before deploying the system...

1.4AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/21 10:58 a.m.•27 views

"Two Stage" BMW Theft Attempt

Modern cars have alarm systems that automatically connect to a remote call center. This makes cars harder to steal, since tripping the alarm causes a quick response. This article describes a theft attempt that tried to neutralize that security system. In the first attack, the thieves just disable...

1.3AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/20 1:7 p.m.•19 views

James Mickens on the Current State of Computer Security

James Mickens gave an excellent keynote at the USENIX Security Conference last week, talking about the social aspects of security -- racism, sexism, etc. -- and the problems with machine learning and the Internet. Worth watching...

2.4AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/17 11:6 p.m.•43 views

Friday Squid Blogging: Firefly Squid Museum

The Hotaruika Museum is a museum devoted to firefly squid in Toyama, Japan. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

0.8AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/17 10:26 a.m.•33 views

New Ways to Track Internet Browsing

Interesting research on web tracking: "Who Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies: Abstract: Nowadays, cookies are the most prominent mechanism to identify and authenticate users on the Internet. Although protected by the Same Origin Policy, popular...

2.5AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/16 4:43 p.m.•53 views

Speculation Attack Against Intel's SGX

Another speculative-execution attack against Intel's SGX. At a high level, SGX is a new feature in modern Intel CPUs which allows computers to protect users' data even if the entire system falls under the attacker's control. While it was previously believed that SGX is resilient to speculative...

2.2AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/15 11:4 a.m.•29 views

Hacking Police Bodycams

Suprising no one, the security of police bodycams is terrible. Mitchell even realized that because he can remotely access device storage on models like the Fire Cam OnCall, an attacker could potentially plant malware on some of the cameras. Then, when the camera connects to a PC for syncing, it...

7AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/14 11:22 a.m.•39 views

Google Tracks its Users Even if They Opt-Out of Tracking

Google is tracking you, even if you turn off tracking: Google says that will prevent the company from remembering where you've been. Google's support page on the subject states: "You can turn off Location History at any time. With Location History off, the places you go are no longer stored." Tha...

0.1AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/13 9:2 p.m.•58 views

Identifying Programmers by their Coding Style

Fascinating research de-anonymizing code -- from either source code or compiled code: Rachel Greenstadt, an associate professor of computer science at Drexel University, and Aylin Caliskan, Greenstadt's former PhD student and now an assistant professor at George Washington University, have found...

1.8AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/10 9:16 p.m.•55 views

Friday Squid Blogging: New Tool for Grabbing Squid and other Fragile Sea Creatures

Interesting video of a robot grabber that's delicate enough to capture squid and even jellyfish in the ocean. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

1AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/10 5:36 p.m.•59 views

xkcd on Voting Computers

Funny and true...

3.6AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/10 11:10 a.m.•25 views

Don't Fear the TSA Cutting Airport Security. Be Glad That They're Talking about It.

Last week, CNN reported that the Transportation Security Administration is considering eliminating security at U.S. airports that fly only smaller planes -- 60 seats or fewer. Passengers connecting to larger planes would clear security at their destinations. To be clear, the TSA has put forth no...

7AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/09 11:17 a.m.•51 views

Detecting Phishing Sites with Machine Learning

Really interesting article: A trained eye or even a not-so-trained one can discern when something phishy is going on with a domain or subdomain name. There are search tools, such as Censys.io, that allow humans to specifically search through the massive pile of certificate log entries for sites...

0.8AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/08 2:37 p.m.•64 views

SpiderOak's Warrant Canary Died

BoingBoing has the story. I have never quite trusted the idea of a warrant canary. But here it seems to have worked. Presumably, if SpiderOak wanted to replace the warrant canary with a transparency report, they would have written something explaining their decision. To have it simply disappear i...

2AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/07 11:40 a.m.•13 views

Measuring the Rationality of Security Decisions

Interesting research: "Dancing Pigs or Externalities? Measuring the Rationality of Security Decisions": Abstract: Accurately modeling human decision-making in security is critical to thinking about when, why, and how to recommend that users adopt certain secure behaviors. In this work, we conduct...

1.8AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/06 10:57 a.m.•28 views

Hacking the McDonald's Monopoly Sweepstakes

Long and interesting story -- now two decades old -- of massive fraud perpetrated against the McDonald's Monopoly sweepstakes. The central fraudster was the person in charge of securing the winning tickets...

2AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/03 9:15 p.m.•45 views

Friday Squid Blogging: Calamari Squid Catching Prey

The calamari squid grabs prey three feet away with its fast tentacles. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

0.9AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/03 7:10 p.m.•59 views

Three of My Books Are Available in DRM-Free E-Book Format

Humble Bundle sells groups of e-books at ridiculously low prices, DRM free. This month, the bundles are all Wiley titles, including three of my books: Applied Cryptography, Secrets and Lies, and Cryptography Engineering. $15 gets you everything, and they're all DRM-free. Even better, a portion of...

0.5AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/03 11:21 a.m.•25 views

How the US Military Can Better Keep Hackers

Interesting commentary: The military is an impossible place for hackers thanks to antiquated career management, forced time away from technical positions, lack of mission, non-technical mid- and senior-level leadership, and staggering pay gaps, among other issues. It is possible the military need...

1.5AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/02 11:14 a.m.•20 views

Using In-Game Purchases to Launder Money

Evidence that stolen credit cards are being used to purchase items in games like Clash of Clans, which are then resold for cash...

1.7AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/01 7:7 p.m.•54 views

GCHQ on Quantum Key Distribution

The UK's GCHQ delivers a brutally blunt assessment of quantum key distribution: QKD protocols address only the problem of agreeing keys for encrypting data. Ubiquitous on-demand modern services such as verifying identities and data integrity, establishing network sessions, providing access contro...

1.9AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/08/01 11:22 a.m.•22 views

Backdoors in Cisco Routers

We don't know if this is error or deliberate action, but five backdoors have been discovered already this year...

4.6AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/31 11:40 a.m.•40 views

Hacking a Robot Vacuum

The Diqee 360 robotic vacuum cleaner can be turned into a surveillance device. The attack requires physical access to the device, so in the scheme of things it's not a big deal. But why in the world is the vacuum equipped with a microphone?...

1.4AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/30 5:8 p.m.•63 views

The Poor Cybersecurity of US Space Assets

Good policy paper summary here on the threats, current state, and potential policy solutions for the poor security of US space systems...

3.8AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/30 11:35 a.m.•36 views

Identifying People by Metadata

Interesting research: "You are your Metadata: Identification and Obfuscation of Social Media Users using Metadata Information," by Beatrice Perez, Mirco Musolesi, and Gianluca Stringhini. Abstract: Metadata are associated to most of the information we produce in our daily interactions and...

2.4AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/27 9:12 p.m.•12 views

Friday Squid Blogging: Squid Deception

This is a fantastic video of a squid attracting prey with a tentacle that looks like a smaller squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

1.7AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/27 5:10 p.m.•7 views

New Report on Police Digital Forensics Techniques

According to a new CSIS report, "going dark" is not the most pressing problem facing law enforcement in the age of digital data: Over the past year, we conducted a series of interviews with federal, state, and local law enforcement officials, attorneys, service providers, and civil society groups...

0.9AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/27 11:12 a.m.•9 views

Third Annual Cybercrime Conference

Ross Anderson liveblogged the Third Annual Cybercrime Conference...

2.5AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/26 5:18 p.m.•13 views

Google Employees Use a Physical Token as Their Second Authentication Factor

Krebs on Security is reporting that all 85,000 Google employees use two-factor authentication with a physical token. A Google spokesperson said Security Keys now form the basis of all account access at Google. "We have had no reported or confirmed account takeovers since implementing security key...

2.3AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/26 11:4 a.m.•11 views

DARPA Wants Research into Resilient Anonymous Communications

DARPA is funding research into resilient anonymous communications systems...

2AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/25 7:8 p.m.•234 views

Major Bluetooth Vulnerability

Bluetooth has a serious security vulnerability: In some implementations, the elliptic curve parameters are not all validated by the cryptographic algorithm implementation, which may allow a remote attacker within wireless range to inject an invalid public key to determine the session key with hig...

0.9AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/25 11:29 a.m.•37 views

On Financial Fraud

There are some good lessons in this article on financial fraud: That's how we got it so wrong. We were looking for incidental breaches of technical regulations, not systematic crime. And the thing is, that's normal. The nature of fraud is that it works outside your field of vision, subverting the...

0.8AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/24 11:29 a.m.•42 views

Nicholas Weaver on Cryptocurrencies

This is well-worth reading non-paywalled version. Here's the opening: Cryptocurrencies, although a seemingly interesting idea, are simply not fit for purpose. They do not work as currencies, they are grossly inefficient, and they are not meaningfully distributed in terms of trust. Risks involving...

0.9AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/23 11:17 a.m.•23 views

1Password's Travel Mode

The 1Password password manager has just introduced "travel mode," which allows you to delete your stored passwords when you're in other countries or crossing borders: Your vaults aren't just hidden; they're completely removed from your devices as long as Travel Mode is on. That includes every ite...

0.5AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/20 9:34 p.m.•39 views

Friday Squid Blogging: Dead Squid on Prince Edward Island

A beach on Prince Edward Island is littered with dead squid. No one knows why. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

1.9AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/20 11:38 a.m.•18 views

New Report on Chinese Intelligence Cyber-Operations

The company ProtectWise just published a long report linking a bunch of Chinese cyber-operations over the past few years. The always interesting gruqq has some interesting commentary on the group and its tactics. Lots of detailed information in the report, but I admit that I have never heard of...

1AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/19 11:17 a.m.•46 views

Suing South Carolina Because Its Election Machines Are Insecure

A group called Protect Democracy is suing South Carolina because its insecure voting machines are effectively denying people the right to vote. Note: I am an advisor to Protect Democracy on its work related to election cybersecurity, and submitted a declaration in litigation it filed, challenging...

2.9AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/18 11:25 a.m.•120 views

Defeating the iPhone Restricted Mode

Recently, Apple introduced restricted mode to protect iPhones from attacks by companies like Cellebrite and Greyshift, which allow attackers to recover information from a phone without the password or fingerprint. Elcomsoft just announced that it can easily bypass it. There is an important lesson...

0.7AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/17 11:20 a.m.•20 views

Installing a Credit Card Skimmer on a POS Terminal

Watch how someone installs a credit card skimmer in just a couple of seconds. I don't know if the skimmer just records the data and is collected later, or if it transmits the data back to some base station...

2.1AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/16 11:30 a.m.•35 views

Reasonably Clever Extortion E-mail Based on Password Theft

Imagine you've gotten your hands on a file of e-mail addresses and passwords. You want to monetize it, but the site it's for isn't very valuable. How do you use it? You convince the owners of the password to send you money. I recently saw a spam e-mail that ties the password to a porn site. The...

0.3AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/13 11:18 a.m.•29 views

Gas Pump Hack

This is weird: Police in Detroit are looking for two suspects who allegedly managed to hack a gas pump and steal over 600 gallons of gasoline, valued at about $1,800. The theft took place in the middle of the day and went on for about 90 minutes, with the gas station attendant unable to thwart th...

0.6AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/12 9:3 p.m.•50 views

Friday Squid Blogging: Antifungal Squid-Egg Coating

The Hawaiian bobtail squid coats its eggs with antifungal bacteria. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

1.6AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/12 11:11 a.m.•25 views

WPA3

Everyone is writing about the new WPA3 Wi-Fi security standard, and how it improves security over the current WPA2 standard. This summary is as good as any other: The first big new feature in WPA3 is protection against offline, password-guessing attacks. This is where an attacker captures data fr...

0.4AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/11 11:8 a.m.•22 views

Department of Commerce Report on the Botnet Threat

Last month, the US Department of Commerce released a report on the threat of botnets and what to do about it. I note that it explicitly said that the IoT makes the threat worse, and that the solutions are largely economic. The Departments determined that the opportunities and challenges in workin...

1.2AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/10 11:18 a.m.•30 views

Recovering Keyboard Inputs through Thermal Imaging

Researchers at the University of California, Irvine, are able to recover user passwords by way of thermal imaging. The tech is pretty straightforward, but it's interesting to think about the types of scenarios in which it might be pulled off. Abstract: As a warm-blooded mammalian species, we huma...

0.3AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/09 11:13 a.m.•34 views

PROPagate Code Injection Seen in the Wild

Last year, researchers wrote about a new Windows code injection technique called PROPagate. Last week, it was first seen in malware: This technique abuses the SetWindowsSubclass function -- a process used to install or update subclass windows running on the system -- and can be used to modify the...

2.3AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/06 9:27 p.m.•52 views

Friday Squid Blogging: Squid Unexpectedly Playing a Part in US/China Trade War

Chinese buyers are canceling orders to buy US squid in advance of an expected 25% tariff. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

1.8AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/06 2:16 p.m.•49 views

The NSA's Domestic Surveillance Centers

The Intercept has a long story about the NSA's domestic interception points. Includes some new Snowden documents...

3.4AI score
Exploits0
Schneier on Security
Schneier on Security
•added 2018/07/05 12:14 p.m.•25 views

Beating Facial Recognition Software with Face Makeup

At least right now, facial recognition algorithms don't work with Juggalo makeup...

2.3AI score
Exploits0
Total number of security vulnerabilities2959