Hackers break into two FreeBSD Project servers using stolen SSH keys

Monday, November 19th, 2012

Intrusions on two machines within the FreeBSD.org cluster were detected on Nov. 11, the FreeBSD security team said Saturday. "The affected machines were taken offline for analysis. Additionally, a large portion of the remaining infrastructure machines were also taken offline as a precaution," said a message on the project's public ...

Inappropriate Use of Adobe Code Signing Certificate

Thursday, September 27th, 2012

We recently received two malicious utilities that appeared to be digitally signed using a valid Adobe code signing certificate. The discovery of these utilities was isolated to a single source. As soon as we verified the signatures, we immediately decommissioned the existing Adobe code signing infrastructure and initiated a forensics ...

Defcon Wi-Fi Hack Called No Threat to Enterprise WLANs

Sunday, August 5th, 2012

Enterprise Wi-Fi networks can keep using WPA2 security safely, despite a recent Defcon exploit that has been widely, but wrongly, interpreted as rendering it useless. The exploit successfully compromised a legacy authentication protocol, MS-CHAPv2, which was created by Microsoft years ago. But the vulnerabilities of this protocol (and other similar ones) ...

Hacker can unscramble coded Web traffic for $200

Sunday, July 29th, 2012

A hacking expert has launched a $200 password-cracking tool that makes it easy to decipher Internet traffic sent through a widely used method for securing businesses communications. Moxie Marlinspike, one of the world's top encryption experts, unveiled the tool on Saturday during a presentation at the Def Con hacking conference ...

HTTPS Everywhere is now available for Google Chrome

Wednesday, February 29th, 2012

HTTPS Everywhere is a produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. Many sites on the web offer some limited support for encryption over HTTPS, but make it difficult to use. For instance, they may default to unencrypted HTTP, or fill encrypted pages with links ...