Larry Loeb

As a security story told around the electronic campfire, this one is a doozy, almost archetypal. First of all, on one side theres a group of crackers that call themselves the EvilScientists. With a name like that, you can almost see them wringing their hands while hunched over their keyboards and saying “Moo-wah-hah-hah!” (Or what […]

Its easy when dealing with IT security to get all caught up in the tech side of things: the crypto, viruses, phishing schemes and what not. Theyre intellectually challenging to identify and satisfying to fix. Theyre the kind of problem that looks good on your quarterly review when they are solved. But theres another kind […]

Last week, the number of independent companies in the security space decreased again as Symantec gobbled up Bindview, and Checkpoint ate Sourcefire, maker of the Snort open-source Intrusion Detection System. Symantec has been on a buying rage since it underwent a $13.5 billion merger with storage leader Veritas in February. That merger changed Symantec from […]

Researchers from the Systems and Internet Infrastructure Security Lab of the Pennsylvania State University made public this week some research they have done about what it may take to shut down mobile cell phone networks using low volumes of text messaging. SIIS Lab students William Enck, Patrick Traynor, SIIS Lab Director Patrick McDaniel and NSRC […]

Can you hack a PSP? It appears so. Secunia has listed a “moderately critical” advisory for Sonys game machine using firmware 2.0. Evidently a “specially crafted” TIFF file can crash the puppy due to a boundary error in the TIFF library and thus cause a denial of service. Evidently, there is a well-known bug in […]

Though its a hot topic now, the need to encrypt data stored on tapes and hard drives, or transmitted across a network, is far from new. DES (data encryption standard), the most widely used encryption algorithm in the world, for example, is more than 28 years old. DES became the bedrock of government cryptology until, […]

Digital signatures—which have been de rigueur for years among both professional and amateur security advocates—have emerged from those relatively small populations to become an important part of mainstream security discussions. The driving force was the Electronic Signatures in Global and National Commerce Act (the so-called “E-Sign” bill) that, beginning in October of 2000, allowed an […]

What is SarbOx anyway? The Sarbanes-Oxley Act of 2002 is a set of rules passed by Congress in order to force American public corporations to document every sale and financial exchange that could have a material effect on the business. SarbOx also requires top executives to review and sign off on financial results so CEOs […]

The Trusted Computing Group announced its plans on Tuesday to “enable trust and security in mobile phones and their applications.” The organization has created a set of use cases for mobile phone security and intends to have a publicly available specification based on these cases ready for dissemination in the first half of 2006. TCGs […]

Check Point Software makes firewalls. But their new “SecurePlatform NGX R60 Build 244” seems to have a problem. (The company says that it also applies to the VPN-1/FireWall-1, VPN-1 VSX, Provider-1 products running the NGX, NG AI, 4.1, NG software.) You see, the firewall contains a set of predefined service groups that are designed to […]

It is Tom Ferris turn to receive the BigDiscovery Award for this week. He was the one that found out that Firefox (and Netscape and Mozilla) have a small problem with the handling of IDN URLs that contain the 0xAD character in the domain name. This can be exploited to cause a heap-based buffer overflow. […]

When the fire alarms are not sounding and calling us to immediate reactive action, security pros need to be kicking back a bit and taking a look at how a serious security problem unfolds. Thats why we should take a look at a Massachusetts teenage who pled guilty of, among other things, hacking—to see what, […]