Cybersecurity

Fixing the Internet Might Break It Worse Than It’s Broken Now

Willis Alan Ramsey, who wrote "Muskrat Love," recorded one and only one studio album. The cognoscenti of country think it's a gem, an all time top ten. There's an apocryphal story that when Ramsey was pushed to make another record he allegedly retorted, "What's wrong with the first one?" We who use the Internet every day risk losing sight of what a miracle it is, and the openness that keeps it so miraculous... We also lose sight of the fact that even as the Internet's miracles occur, it's almost always broken or malfunctioning or threatening or worse in many places along the line. more

Should You Whitelist Your Vulnerability Scanning Service Provider?

Unlike consultant-led penetration testing, periodic or continual vulnerability scanning programs have to operate harmoniously with a corporation's perimeter defenses. Firewalls, intrusion prevention systems, web proxies, dynamic malware analysis systems, and even content delivery networks, are deployed to protect against the continuous probes and exploit attempts of remote adversaries -- yet they need to ignore (or at least not escalate) similar probes and tests being launched by the managed security service providers an organization has employed to identify and alert upon any new vulnerabilities within the infrastructure or applications that are to be protected. more

No Virginia, You Have No Duty to Secure Your WiFi Access Point

Every now and again a report flies across the network about the police breaking down someone's door and attempting to arrest the home owner for bad things online - assuming that whatever happened from that person's Internet connection is their fault. Now there are lots of problems with this - lots of problems. But one of the big ones is that anyone can access an open access point... more

Coordinating Attack Response at Internet Scale

How do we help coordinate responses to attacks against Internet infrastructure and users? Internet technology has to scale or it won't survive for long as the network of networks grows ever larger. But it's not just the technology, it's also the people, processes and organisations involved in developing, operating and evolving the Internet that need ways to scale up to the challenges that a growing global network can create. more

Phish or Fair?

It shouldn't be a big surprise to hear that phishing is a big problem for banks. Criminals send email pretending to be a bank, and set up web sites that look a lot like a bank. One reason that phishing is possible is that e-mail has no built in security, so that if a mail message comes in purporting to be from, say, [email protected], there's no easy way to tell whether the message is really from bankofamerica.com, or from a crook. more

PRISM and the Administration State Strikes Back

It is a safe assumption that if you are reading this post, you like technology. If that is the case, then you understand the tremendous economic, cultural, and human rights benefits an open, universal, and free Internet provides. That freedom is under attack. And it is our responsibilities, as stakeholders in a successful Internet, to balance governments and have an open dialog on the topic. more

World Notices That Verisign Said Three Months Ago That They Had a Security Breach Two Years Ago

The trade press is abuzz today with reports about a security breach at Verisign. While a security breach at the company that runs .COM, .NET, and does the mechanical parts of managing the DNS root is interesting, this shouldn't be news, at least, not now. Since Verisign is a public company, they file a financial report called a 10-Q with the SEC every quarter. According to the SEC's web site, Verisign filed their 10-Q for June through September 2011 on October 28th. more

Communications and the London Olympics

Communications will be one of the most critical areas during the London Olympic Games. The industry is working to establish shared access networks -- would it not be nice if they did this everywhere, all the time? They are also working very closely with British Olympic Association, London Transport, the broadcasters and content providers. Mobile coverage will be the biggest shared infrastructure in the world. more

Institutionalizing Consumer Trust and Public Interest at ICANN

For an organization where people argue for hours over arcane minutiae, it's remarkable that virtually everyone agrees that ICANN should serve the "global public interest" and build "consumer trust" in the Internet. Although it's only three pages long, ICANN's Affirmation of Commitments (AoC) cites "public interest" five times and "consumer trust" eight times. So at the ICANN meeting today in Cartagena, Colombia, a group of participants explored ways to "institutionalize" these concepts within the organization. more

Phishing Registrar Accounts: eNom is First Target

Criminals are now looking to use established domain names, via phishing targeted at domain registrars. This is possibly related to ICANN finally moving to stop the black hat registrars of the world. According to the first report on the matter sent yesterday to Registrar Operations (reg-ops) mailing list, the attacks seem to be run by gang of child pornography spammers. more

U.S. Schools Targeted in Ransomware Attacks: White House Responds

In response to increasing ransomware attacks targeting U.S. educational institutions, the White House convened an inaugural cybersecurity summit this Tuesday. The malicious cyber onslaughts have led to the online leakage of confidential student data, ranging from medical files to reports on sexual assaults. more

Project GhostNet: Canada (and Google) Save the World from Cyber-Spying - Again!

While most people I know are at either VoiceCon or CTIA this week, this one is worth staying home for. Also, I'm sure all the Skype followers are focused today on the news about working with the iPhone -- and that IS a big story. However -- for very different reasons -- I'm sure you'll find this one of interest too. This was a front page story in today's Globe and Mail, and no doubt many other Canadian dailies... more

Brands Should Not Ignore the Security Benefits of New gTLDs

If one thing has become clear from recent commentary on ICANN's new top-level domain program, it's that there's a dramatic lack of understanding about some of the benefits of owning your own TLD - especially as it relates to security. Many brand owners - especially those with luxury brands - could realize immediate benefits from reduced counterfeiting and greater brand trust with a "dot Brand." more

A Data Dumb Exposes 773 Million Unique Email Addresses, 22 Million Passwords

Close to 773 million unique email addresses and 22 million unique passwords were found to be hosted on cloud service MEGA. more

Driver’s License for Web Users… Bad Idea

Maybe you saw the stories recently about comments that were made at a recent World Economic Forum debate on cyberwarfare. As one of them notes, Hamadoun Toure, Secretary General of the International Telecommunications Union, proposed a treaty in which countries would pledge not to attack each other without having been attacked. This post isn't about Mr. Toure's proposal. It's about a comment the story attributes to Craig Mundie, Chief Research and Strategy Officer for Microsoft. According to The Raw Story, Mundie "called for a `driver's license' for internet users." more