Cybersecurity

Do We Need Two Internets?

Jonathan Zittrain's recent book, The Future of the Internet -- And How to Stop It, has spurred a lot of discussion both online and offline, with blog posts lauding his insights or criticising his over-apocalyptic imagination. The book itself makes fascinating reading for those who have watched the network grow from its roots in the research community into today's global channel for communications, commerce and cultural expression... One of the reasons that Zittrain puts forward for the growing popularity of closed or, as he prefers 'tethered', devices, is that they are less vulnerable to hacking, security flaws, malware and all the other perils that face any internet-enabled system. more

Chinese Hackers Have Infiltrated US Navy Contractors to Steal Range of Data Including Missile Plans

Chinese hackers have breached U.S. Navy contractors to steal a wide range of data from ship-maintenance data to missile plans through what is reported as the most debilitating cyber campaigns linked to Beijing. more

DNS-over-HTTPS: Privacy and Security Concerns

The design of DNS included an important architectural decision: the transport protocol used is user datagram protocol (UDP). Unlike transmission control protocol (TCP), UDP is connectionless, stateless, and lightweight. In contrast, TCP needs to establish connections between end systems and guarantees packet ordering and delivery. DNS handles the packet delivery reliability aspect internally and avoids all of the overhead of TCP. There are two problems this introduces. more

Cloud Leak Exposes at least 14 Million Verizon Subscribers, Phone Numbers and Account PINs Included

A Verizon partner is reported to have exposed millions of Verizon customer accounts due to a misconfigured cloud-based file. more

U.S. CERT Issues Alert on DNS Amplification Attacks

Neil Schwartzman writes to report that U.S. Cert issued Alert TA13-088A on Friday March 29, 2013. "It is a solid how-to guide to test for, and remediate DNS configurations that can be used for Distributed Denial of Service attacks." more

The Militarization of the Internet

Someone needs to take a good hard look at those Internet surveillance stories being strategically placed on the front page of the New York Times. There's a trail here, I believe, that's worth following. Here are some data points... there appears to be a deep interest in the ability to declare war online, as evidenced by cybersecurity research and public speeches by Herbert Lin, a key player who has worked on several cybersecurity reports for the National Research Council.
 more

NIST Publishes Guide for DNS-Based Email Security, Draft Open for Public Comments

The National Cybersecurity Center of Excellence (NCCoE) has invited comments on a draft practice guide to help organizations improve email security and defend against phishing, man-in-the-middle, and other types of email-based attacks. more

Client-based WDS: Providing Application Acceleration in Mobile and VPN Environments

Wide-Area Data Services (WDS), aka "WAN Optimization" is becoming the most effective way to improve application performance while reducing network traffic. In scenarios where there is significant network latency that would otherwise render many applications unusable, WDS can deliver almost LAN-like speed. Where bandwidth constraints exist and there is no practical or economical option, WDS can help reduce network traffic, allowing you to postpone or avoid circuit upgrades altogether. The technology provides the ability to centralize applications and servers, furthering the cost savings on hardware, software licensing, maintenance and the operation of a distributed architecture. more

EFF Resigns from World Wide Web Consortium (W3C) over EME Decision

In an open letter to the World Wide Web Consortium (W3C), the Electronic Frontier Foundation (EFF) announced on Tuesday that it is resigning from World Wide Web Consortium (W3C) in response to the organization publishing Encrypted Media Extensions (EME) as a standard. more

The Proxy Fight for Iranian Democracy

If you put 65 million people in a locked room, they’re going to find all the exits pretty quickly, and maybe make a few of their own. In the case of Iran’s crippled-but-still-connected Internet, that means finding a continuous supply of proxy servers that allow continued access to unfiltered international web content like Twitter, Gmail, and the BBC... more

Cryptography is Hard

In the debate about "exceptional access" to encrypted conversations, law enforcement says they need such access to prevent and solve crimes; cryptographers, on the other hand, keep saying it's too complicated to do safely. That claim is sometimes met with skepticism: what's so hard about encryption? After all, you learn someone's key and just start encrypting, right? I wish it were that simple - but it's not. more

P2P as a New Spam Medium, Moving From PoC to Full Operations

Spam on P2P networks used to be mainly with advertising inside downloaded movies and pictures (mainly pornographic in nature), as well as by hiding viruses and other malware in downloaded warez and most any other file type (from zip archives to movie files). Further, P2P networks were in the past used for harvesting by spammers. Today, P2P has become a direct to customer spamvertizing medium. This has been an ongoing change for a while. As we speak, it is moving from a proof of concept trial to a full spread of spam, day in, day out... more

The “Internet of Things,” the Internet and Internet Governance

As the second Internet Governance Forum approaches, it is an appropriate moment to take stock of how the Internet Governance dialogue has evolved since the conclusion of the WSIS Summit in 2005. One year after the first IGF in Athens, it is clear that government, industry and civil society stakeholders are still grappling over the direction and focus of the IGF... There is little doubt that some governments will choose to borrow concepts from the IGF when developing law and policy and will ultimately apply them to the Internet within their respective jurisdictions. Given the global nature of the Internet, this should be a fundamental concern. While this important dialogue about the Internet continues at the IGF in Brazil next month, another no less important debate is emerging with regard to RFID technology and the so-called "Internet of Things." The Internet of Things is a term coined to describe a future ubiquitous sensor network that collects commercial and personal data in public and private settings created, in part, through the rollout of RFID technology... more

Turning the Tide of Online Scams: Interview With Prof. Jorij Abraham, Global Anti-Scam Alliance

Professor Jorij Abraham has been a part of the international eCommerce community since 1997. From 2013 -- 2017, he has been Director of Research & Advise at Thuiswinkel.org (the Dutch Ecommerce Association) and the European Ecommerce Association with 25.000+ members in 20 countries. He is now Managing Director of Global Anti-Scam Alliance, whose mission is to protect consumers from getting scammed. He is also e-commerce professor at the University of Applied Sciences, TIO. more

Phishing: An Interesting Twist on a Common Scam

After Two Security Assessments I Must Be Secure, Right? Imagine you are the CIO of a national financial institution and you've recently deployed a state of the art online transaction service for your customers. To make sure your company's network perimeter is secure, you executed two external security assessments and penetration tests. When the final report came in, your company was given a clean bill of health. At first, you felt relieved, and confident in your security measures. Shortly thereafter, your relief turned to concern. ...Given you're skepticism, you decide to get one more opinion. ...And the results were less than pleasing. more