Larry Seltzer

Some software companies have learned a lesson from this decade that you don’t protect your customers by pretending that vulnerabilities don’t exist in your software. And then there’s Adobe. The story of the latest zero-day exploit of a vulnerability in their products tells a sadly familiar tale of how low a priority vulnerabilities are to […]

The one presentation from the recent Shmoocon that I want to focus on is Chris Paget’s on hacking the US Passport Card. This presentation takes an hour, but I urge you all to take some time for it. It’s not just the great hacking perspective, it’s that he gives further proof of how an initiative […]

When Microsoft went to the regular monthly patch cycle many years ago it seemed counter-intuitive to many. Turns out it’s very popular among enterprises. But it still rubs some people the wrong way, including Wolfgang Kandek, chief technology officer at security company Qualys. Kandek has been quoted in more than one publication recently arguing that […]

If you were in charge of the nation’s cyber-security what would you focus on? One really scary problem that doesn’t get enough attention is the insecurities in BGP, the router protocol of the Internet. BGP has been getting some attention as of late from Homeland Security, but it’s still way down the list of sexy […]

Whenever I go to clean up a friend/relative’s computer that they complain is too slow there’s one thing I almost always find: Numerous browser toolbars, particularly in Internet Explorer. Not all browser toolbars are bad, but the bad ones do seem to get around. There is a long and disturbing history of malicious toolbars for […]

Even with all the mistakes that users make and all the effort put up by criminals, you might wonder how the networks of illicit software stay up. There are lots of people trying to take them down, and often they are capable people, often with authority. The answer is that botnets have defense mechanisms built […]

A controversy erupted last week with the revelation by a researcher that it is possible for a user-mode program in Windows 7 to disable User Access Control in the default configuration. My first reaction to this was that it was bad, but it’s a beta and it will be fixed. Now I’m getting the vibe […]

I was talking to a head research guy at an anti-virus company recently, and he said that the big anti-virus firms are all getting about 50,000 new malware submissions every day. 50K! How do they, the malware authors, do it? And how is it that the AV companies actually get the malware? Welcome to the […]

Have you ever signed up for an Internet service only to find that your desired user ID was already taken? Happens all the time. In the world of domain names we have the concept of reverse domain name hijacking, in which a company bullies a domain name registrant out of their domain without clear intellectual […]

A Washington Post story this morning caught my attention: “Staff Finds White House in the Technological Dark Ages.” It’s not a good sign, but not for the reasons the story implies. Some, perhaps most of the article, details problems that probably happen in every White House transition. Suddenly there are large numbers of new employees […]

[Editor’s note: On Jan. 26, ICANN and Enom finally followed through and resolved the issues described in this column. For details, see this entry in my blog Cheap Hack.] How would you react if you found out that someone was trying to impersonate you in order to defraud and the authorities ignored your complaints about […]

It’s an old rule and a common-sense one: Passwords should not be simple, easy-to-guess words. It goes beyond the old TV trick of guessing the person’s birthday. “Dictionary attacks,” in which a list of hundreds or even more words are tested, are common. And yet people still get burned by having weak passwords. Two recent […]