New attack against multiple encryption functions

Saturday, August 23rd, 2008

Unless you're a dyed in the wool cryptographic geek you probably didn't know that there was a Crypto conference, or even a chain of worldwide crypto conferences that take place each year. Fortunately, for the most of us that aren't crypto geeks there are a handful of very highly skilled ...

Ten ways improve Vista’s security

Wednesday, August 20th, 2008

Although Windows XP was Microsoft's preferred desktop operating system for an unprecedented length of time, it became something of a PR nightmare for the software giant. Windows XP is full of security holes and is very easy to compromise. When Microsoft created Windows Vista, its primary goal was to address ...

New Gpcode (encryption) ransomware speading via botnet

Wednesday, August 13th, 2008

There are confirmed reports on a new version of the Gpcode ransomware being spread via a botnet.According to Vitaly Kamluk of Kaspersky Lab (my employer), the Trojan encrypts files on an infected machine (AES-256) and leaves a text file named crypted.txt with a ransom note demanding $10 to decrypt the ...

Keyczar – Google’s crypto for non-cryptographers

Tuesday, August 12th, 2008

Google has released Keyczar, billed as a "Toolkit for safe and simple cryptography", under an Apache 2.0 open source licence. Keyczar has been developed by members of the Google security team and aims to make cryptography more accessible to application developers.Keyczar's design goals were to manage the complexity of cryptography ...

Surf Jack – HTTPS will not save you

Monday, August 11th, 2008

Say hello to a new security tool called “Surf Jack” which demonstrates a security flaw found in many public sites. The proof of concept tool allows testers to steal session cookies on HTTP and HTTPS sites that do not set the Cookie secure flag. I’ve been working with two banks ...