Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
We have thousands of posts on a wide variety of open source and security topics, conveniently organized for searching or just browsing.
FireEye and Fox-IT have launched a free tool to assist victims of the CryptoLocker ransomware. Announced on Wednesday, the new service, dubbed DecryptCryptoLocker, is available for free to assist those impacted by the CryptoLocker ransomware.
A status report filed by the Justice Department on Friday indicates that the Cryptolocker threat has been neutralized. Cryptolocker, ransomware that extorted more than $27 million from its victims in nine months of existence, can no longer communicate with the infrastructure used to control the malware, according to a Friday release.
Nobody questions that OpenSSL is a vital part of the Internet's infrastructure. So many fundamentals are built on top of it and in so many places. Too much is at stake for it to be vulnerable to yet another Heartbleed, the dangers of which may linger for some time in embedded and client devices.
The OpenSSL Project is planning a number of changes to ensure its security component, used across millions of computers across the Internet, is in tip-top shape.
Analyzing encrypted Web traffic can potentially reveal highly sensitive information such as medical conditions and sexual orientation, according to a research paper that forecasts how privacy on the Internet may erode.
If there is any good news from the discovery of the Heartbleed bug that affects OpenSSL, it
Although the developers behind the TrueCrypt encryption software have given up the ghost and decided to no longer maintain the application, interest in the project has never been higher. But, one of the developers says that a nascent effort to fork TrueCrypt is unlikely to succeed.
Banker Trojans have proven to be reliable and effective tools for attackers interested in quietly stealing large amounts of money from unwitting victims. Zeus, Carberp and many others have made piles of money for their creators and the attackers who use them, and researchers have been looking at a newer banker Trojan that has the ability to bypass SSL protection for banking sessions by redirecting traffic through the attackers
Google has released the alpha version of a new Chrome browser extension called End-To-End that allows users to encrypt, decrypt, digitally sign, and verify signed emails all within the browser.
Six months before the entire world knew his name, Edward Snowden threw a CryptoParty in Hawaii with privacy researcher Runa Sandvik in an effort to teach locals how to protect their online privacy from threats as big as the National Security Agency or Google. Twenty Hawaiians attended the workshop taught by Sandvik and Snowden, who later called the event a
Encryption is like a relationship -- both parties need to be on the same page for it to work. And Microsoft and Comcast are apparently not on Google's page.
In a move that appears designed to provoke widespread questions, the anonymous managers of the TrueCrypt open-source encryption project abruptly pulled the plug on the effort without explanation.
The maintainers of GnuTLS, a secure communications library used in Red Hat, Ubuntu other Linux distributions, have released fixes for a critical bug affecting the client-side of the software.
SanDisk today released its first self-encrypting SSDs, a line of drives aimed at enterprises. SanDisk's new X300s SSD uses both the Trusted Computing Group's Opal 2.0 specification and Microsoft Encrypted Hard Drive hardware-based encryption to protect data on the drive.
Visiting a website certified with an SSL certificate doesn't mean that the website is not bogus. Secure Sockets Layer (SSL) protect the web users in two ways, it uses public key encryption to encrypt sensitive information between a user's computer and a website, such as usernames, passwords, or credit card numbers and also verify the identity of websites.
In addition to turning the Internet into a worldwide surveillance platform, the NSA has surreptitiously weakened the products, protocols, and standards we all use to protect ourselves. By doing so, it has destroyed the trust that underlies the Internet. We need that trust back.
The IETF working group responsible for the TLS 1.3 standard is closing in on a decision to remove RSA key transport cipher suites from the protocol.
It's been a month since the Heartbleed Bug set off a stampede to patch software in everything from network gear to security software as it quickly became evident that vulnerable versions of the OpenSSL encryption code had been very widely deployed.
Everyone who has studied mathematics at the movie theater knows that encryption is pretty boss. Practically every spy in every spy movie looks at an encrypted file with fear and dread. Armies of ninjas can be fought. Bombs can be defused. Missiles can be diverted.
Weeks after the OpenSSL debacle, the question still stands: Why did so few people show up to work on such widely-used and important code? Since the problem arose, funds have flowed in to fix it at the behest of corporate giants, but before the crises, few volunteers participated. One leading open source expert has suggested a reason: licensing.
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
