"When you are dealing with so many different sources of information and so many different offices that need to be involved in the response to a problem, there has to be a reporting structure that brings it all together," Mr. McRobbie says. The changes mean that the university now has uniform response procedures—a tool kit, Mr. Bruhn calls it—that can be applied to cybersecurity and physical-security incidents alike. "It is that structure that provides us with a huge amount of comfort because we know even if it is a one-off sort of incident, we have a structure that is amoeba-like enough that it can cover just about anything that can happen," he says.

Indiana U. Puts IT and Safety Under One Umbrella - Technology - The Chronicle of Higher Education

The results are a strong indication that merely updating servers to a version of OpenSSL that’s not vulnerable to Heartbleed isn’t enough. Because Heartbleed exploits don’t by default show up in server logs, there’s no way for sites that were vulnerable to rule out the possibility the private certificate key was plucked out of memory by hackers. Anyone possessing the private key can use it to host an impostor site that is virtually impossible for most end users to detect. Anyone visiting the bogus site would see the same https prefix and padlock icon accompanying the site’s authentic server. The demonstration that it’s possible to extract private SSL certificates means that out of an abundance of caution, administrators of sites that used vulnerable versions of OpenSSL should revoke and replace old certificates with new ones as soon as possible. Given the huge number of sites affected, the revelation could create problems.

Private crypto keys are accessible to Heartbleed hackers, new data shows | Ars Technica

In short: The NSA is said to have decided that the exploit was better something for it to use as an offensive tool than to affect a defensive posture for the rest [of] tech; its decision meant that in its view, its own intelligence efforts were essentially more important than the security of your information.

NSA Exploited Heartbleed For Years,” TechCrunch (via shortformblog)

They came in through the Chinese takeout menu. Unable to breach the computer network at a big oil company, hackers infected with malware the online menu of a Chinese restaurant that was popular with employees. When the workers browsed the menu, they inadvertently downloaded code that gave the attackers a foothold in the business’s vast computer network.

Hackers Lurking in Vents and Soda Machines - NYTimes.com

Bugs in single software or library come and go and are fixed by new versions," the researchers who discovered the vulnerability wrote in a blog post published Monday. "However this bug has left a large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitations and attacks leaving no trace this exposure should be taken seriously.

Critical crypto bug in OpenSSL opens two-thirds of the Web to eavesdropping | Ars Technica

The odds are 50/50 that the Internet will be effectively destroyed by cyberattacks by 2025. If the Net goes down, there will be terrible costs as we reboot the economy.

Robert E. McGrath, a retired software engineer who participated in critical developments of the World Wide Web, on the future of the internet. Survey participants in our future of the internet canvassing acknowledged the fact that global dependence on one particular system makes it a prime target for a devastating attack.

Agree? Disagree? Your thoughts?

(via pewinternet)

"If you’re a journalist or a journalistic organization we will see state-sponsored targeting and we see it happening regardless of region, we see it from all over the world both from where the targets are and where the targets are from," Huntley told Reuters.

Journalists, media under attack from hackers: Google researchers | Reuters

The technique made it possible for an attacker with modest resources to greatly amplify the bandwidth at its disposal. By sending spoofed Web requests in a way that made them appear to come from the target site, the attacker was able to trick the WordPress servers into bombarding the target with more traffic than it could handle. Besides causing such a large number of unsuspecting sites to attack another one, the attack is notable for targeting XML-RPC, a protocol the sites running WordPress and other Web applications use to provide services such as pingbacks, trackbacks, and remote access to some users. Researchers from security firm Sucuri recently counted more than 162,000 legitimate WordPress sites hitting a single customer website. They suspect they would have seen more if they hadn’t ended the attack by blocking the requests.

Attackers trick 162,000 WordPress sites into launching DDoS attack | Ars Technica

The bug in the GnuTLS library makes it trivial for attackers to bypass secure sockets layer (SSL) and Transport Layer Security (TLS) protections available on websites that depend on the open source package. Initial estimates included in Internet discussions such as this one indicate that more than 200 different operating systems or applications rely on GnuTLS to implement crucial SSL and TLS operations, but it wouldn’t be surprising if the actual number is much higher. Web applications, e-mail programs, and other code that use the library are vulnerable to exploits that allow attackers monitoring connections to silently decode encrypted traffic passing between end users and servers.

Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping | Ars Technica

Chameleon can spread through densely populated areas like the common cold, the University of Liverpool researchers claim, by hopping from network to network via access points, spreading rapidly among homes and businesses. If as that wasn’t bad enough, the virus can avoid detection and identify weak wireless access points — those that are least protected by encryption and passwords. “Wi-Fi connections are increasingly a target for computer hackers because of well-documented security vulnerabilities, which make it difficult to detect and defend against a virus,” said Alan Marshall, a professor of network security at the school. “It was assumed, however, that it wasn’t possible to develop a virus that could attack Wi-Fi networks; but we demonstrated that this is possible and that it can spread quickly. We are now able to use the data generated from this study to develop a new technique to identify when an attack is likely.”

Uh-oh, this computer virus can spread via Wi-Fi | Crave - CNET