[ISN] Despite patching efforts, 300K servers are still vulnerable to Heartbleed

http://www.computerworld.com/s/article/9249310/Despite_patching_efforts_300K_servers_are_still_vulnerable_to_Heartbleed By Lucian Constantin IDG News Service June 23, 2014 Despite a great start, the rate of patching OpenSSL servers against the critical Heartbleed vulnerability has slowed down to almost a halt. Around 300,000 servers remain vulnerable and many of them are unlikely to get patched anytime soon. Over the past month only around 9,000 servers were secured, a far cry from the almost 300,000 servers patched during the first month after the vulnerability was revealed. The Heartbleed flaw was publicly disclosed in early April and allows attackers to extract information from the memory of servers that run OpenSSL 1.0.1 through 1.0.1f, if they support an SSL feature called “heartbeat.” The extracted information can include user passwords and long-term server private keys that can be used to decrypt SSL traffic captured from servers. Shortly after the vulnerability was announced, Robert Graham, the CEO of Errata Security, ran an Internet scan and found 615,268 publicly accessible SSL servers that were vulnerable to Heartbleed. He repeated the scan one month later and found that the number of vulnerable systems had decreased by almost half, to 318,239. […]




Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Culture clash: How physical security is impacted by cultural norms

http://www.csoonline.com/article/2365849/physical-security/where-culture-and-security-clash.html By Grant Hatchimonji CSO Online June 23, 2014 Physical perimeter security can differ from facility to facility, with myriad factors playing into what exactly is implemented, including budget and the assets that are being protected. But what about geographical location and, subsequently, culture? It’s not one of the more obvious aspects that people consider when examining security, but it factors in more than one may think. Perimeter security varies from country to country, and their cultures have often proven to be both to the beneficial and detrimental. Generally speaking, there is a stronger culture of security overseas and most businesses are equipped with more stringent measures than what we see stateside, according to Eric Milam, managing principal at Accuvant. “Most organizations in the US, they appear to be somewhat behind the rest of the world,” he says. “Tailgating protection, knee knockers, man traps…we encountered that a lot more in Europe.” […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Card Wash: Card Breaches at Car Washes

http://krebsonsecurity.com/2014/06/card-wash-card-breaches-at-car-washes/ By Brian Krebs Krebs on Security June 23, 2014 An investigation into a string of credit card breaches at dozens of car wash locations across the United States illustrates the challenges facing local law enforcement as they seek to connect the dots between cybercrime and local gang activity that increasingly cross multiple domestic and international borders. Earlier this month, police in Everett, Massachusetts arrested a local man named Jean Pierre for possessing nine stolen credit cards. The cards themselves weren’t stolen: They were gift cards that had been re-encoded with data from cards that were stolen from a variety of data breaches at merchants, including a Splash Car Wash in Connecticut. How authorities in Massachusetts connected Pierre to a cybercrime at a Connecticut car wash is a mix of odd luck and old-fashioned police work. In May, the Everett police department received a complaint from a sheriff’s department in South Carolina about a resident who’d had his credit card account used repeatedly for fraudulent transactions at a Family Dollar store in Everett. Everett PD Detective Michael Lavey obtained security camera footage from the local Dollar Store in question. When Lavey asked the store clerk if he knew the individuals pictured at the date and time of the fraudulent transactions, the clerk said the suspects had been coming in for months — several times each week — always purchasing gift cards. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] People invested $1.2 million in an app that had no security

http://www.zdnet.com/people-invested-1-2-million-in-an-app-that-had-no-security-7000030794/ By Violet Blue Zero Day ZDNet.com June 23, 2014 Proving that no one learned from Snapchat’s security and privacy spectacle, people invested $1.2 million in an app that had essentially no security. Despite the news it was hacked only days after its media fanfare, Yo still isn’t coming clean. Last week free Android and iOS app “Yo” was top in Google Play and iTunes downloads and hot in tech press, with much fanfare focusing on its pointlessness, popularity and sizable cash backing. By Friday night the app had been hacked five ways until Sunday (literally). After Friday night’s report Yo had been hacked and people were sending “Yos” as Elon Musk (among other things), Yo founder Or Arbel told TechCrunch that Yo was “having security issues.” […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail

[ISN] Lockheed Clinches $82.5 Million Sole-Source Cyber Range Deal

http://www.nextgov.com/defense/2014/06/lockheed-clinches-825-million-sole-source-cyber-range-deal/87040/ By Aliya Sternstein Nextgov.com June 23, 2014 A defensewide system that simulates hacks is reliant on Lockheed Martin’s trade secrets and expertise, Pentagon officials said in a redacted justification for awarding an $82.5 million to develop and manage the so-called cyber range. In May, officials said they were awarding Lockheed a $14 million, 5-year contract to operate and sustain the National Cyber Range. ManTech in 2012 lost a bid for the contract, according to Pentagon officials, because only Lockheed had the necessary institutional knowledge and computer programs. “ManTech does not have the expertise” to support the system’s capabilities, “nor do they, or the government, own the source code,” said Army officials, who awarded the contract to Lockheed on May 23. […]


Facebooktwittergoogle_plusredditpinterestlinkedinmail