Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Pwn2Own is a famous contest held in CansecWest Conference. Every year there is a big reward for researchers who finds exploitable bugs in popular browser and OS and also in mobile devices like iPhone. For the past two years the Pwn2Own contest champion was Charlie Miller (0xcharlie on Twitter), one of the most famous bug hunter and security expert in the world.
As RSA Conference 2010 opens this week in San Francisco, vendors are using this major security show to launch products ranging from hardware to software to virtual appliances in an effort to address specific network security needs. Here are some of those offerings.
The Cloud Security Alliance and Hewlett-Packard will release research today at RSA Conference that identifies the top threats to cloud computing. The document is a companion to the CSA's "Security Guidance for Critical Areas in Cloud Computing," which was updated in December.
The first time I attended the RSA Conference in 2005, I was overwhelmed. The show floor is massive and once you go in it can be hard to find the right door out. Vendor salespeople swamp you. The Tuesday-morning keynotes can be an assault on the eyes, with speakers standing in front of massive uber-resolution screens.
The Internet Research Task Force's (IRTF) Anti-Spam Research Group (ASRG) has produced a summary of how DNS blacklists and whitelists (DNSBLs and DNSWLs, designated in the RFC as DNSxLs) should be used and of the security issues which need to be considered when doing so. The summary is in the form of a 'Request for Comments' (RFC 5782).
A hacking contest next month will award cash prizes of $15,000 to anyone who can break into an iPhone, BlackBerry Bold, Droid or Nokia smartphone. The prizes are 50% more than the top awards given last year at Pwn2Own, which will kick off March 24 at the CanSecWest security conference in Vancouver, British Columbia. Altogether, $100,000 could be handed out by 3Com TippingPoint, the contest sponsor.
Open Source Days is the largest open source conference in the Nordic area. It's your opportunity to meet, share, and learn from professional open source experts.
Many CSOs view ShmooCon as an event of small importance. You don't see the suits and ties that are on display at RSA. In fact, to those who haven't attended, this conference is just a place where twenty-something hackers come to get drunk and throw TVs out hotel windows. Another crazy Black Hat/Defcon-caliber conference, more than one high-level security exec has told me in the past.
A technique used in Web application development platforms that provides a constant look-and-feel across multiple Web pages can potentially expose sensitive user data, such as credit-card numbers, according to researchers, who at next week's Black Hat DC will demonstrate a new class of vulnerabilities in Apache MyFaces, Sun Mojarra, and Microsoft ASP.NET. They will also release a tool that tests for the flaws.
As you may have noticed, posting to this blog was light last week, as in non-existent (OK, so you didn't notice.) This was because I was engaged in some serious geeking-out at the LCA2010 conference. One of the talks that I saw came from Jon Corbet, who gave a run-down on recent changes to the Linux kernel. A statistic that he mentioned along the way has garnered much comment: the fact that "75% of the code comes from people paid to do it.
Very rarely do movies put a real computer application to do a real thing, even rarely do they actually use it correctly. But, Nmap here, seems to be the hot favourite; be it CIA or NSA or a hot good-guy
In terms of cyber security research findings, Sandia has made a significant achievement in successfully demonstrating for the first time the ability to run more than a million Linux kernels as virtual machines. A kernel is the central component of most computer operating systems. The achievement will allow cyber security researchers to more effectively observe behavior found in malicious botnets, or networks of infected machines that can operate on the scale of a million nodes.
In part two of this three-part [video] series, Team Cymru members discuss more of the most successful and innovative malware attacks of 2009.
The organisers of the Hack In The Box security conferences in Malaysia are planning their first European show for Amsterdam next July. Hack In The Box (HITB) held its first security conference, or hacker convention, in Kuala Lumpur in 2003, one of the first major shows of its kind in Asia.
Draft guidance from the National Institute of Standards and Technology issued last week, pushes government agencies to adopt a comprehensive, continuous approach to cybersecurity, tackling criticism that federal cybersecurity regulations have placed too much weight on periodic compliance audits.
The group responsible for coordinating U.S. responses to cyber threats is getting new digs. Department of Homeland Security (DHS) Secretary Janet Napolitano will cut the ribbon Friday at a new "unified operations center" in Arlington, Virginia, that will be home to the U.S. Computer Emergency Readiness Team (US-CERT).
Security is compromised every day, whether the result of a bad password or someone from inside the company or from outside getting into the network to steal data. These words of warning came from Adam Meyers, principal of the information assurance division at SRA International, maker of technology tools and services. Meyers spoke last Tuesday at the SC World Congress in New York.
As a hacker and organizer of Defcon, at event at which computer security vulnerabilities and exploits are routinely unveiled, Jeff Moss seemed an unusual choice when he was named to the Homeland Security Advisory Council in June.
This is a short overview of what happened on Friday August 28 2009 to the apache.org services. A more detailed post will come at a later time after we complete the audit of all machines involved. On August 27th, starting at about 18:00 UTC an account used for automated backups for the ApacheCon website hosted on a 3rd party hosting provider was used to upload files to minotaur.apache.org. The account was accessed using SSH key authentication from this host.
Do you know THE Goal of your organization? Why does it exist? What
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
