In his 1983 Turing Award acceptance speech, "Reflections on Trusting Trust”, Ken Thompson popularized the concept of a compiler backdoor where the compiler not only inserts a backdoor during compilation of a program but also compiles in the code that inserts the backdoor when compiling itself. The core idea of his speech is that we can only trust a...

  What's happened? An almighty furore has kicked off after it was discovered that for months Lenovo has been shipping PCs and laptops with software pre-installed that could compromise your security and privacy. What software? It's called Superfish, and it inserts adverts into webpages such as Google search results. In January, a Lenovo forum...

We now appreciate the revelation that went public in February 2015 that international hackers circumvented what was supposed to be robust systems and defences, and managed to get away with an estimated $1 billion from a spectrum of around 100 banks located in 30 countries in what has been described as systemic cybercrime. With orchestration, the...

  Last summer, security researchers Karsten Nohl and Jakob Lell developed a malware program, dubbed ‘BadUSB,’ to prove the insecure development of USB devices. The pair of security researchers revealed how they managed to reprogram the firmware on removable USB drives to include malicious code, giving potential attackers the ability to take over PCs,...

Last month, Michal Nemcok blogged about the lack of security in the Progressive Insurance diagnostic monitoring dongle. By hacking the monitoring device, someone may be able to gain access to and change the behavior of the car, itself. Now, this is serious stuff – vulnerabilities that might impact the operation of the thing that carries your body around...

In early February, the White House released its 2015 National Security Strategy (NSS). Each NSS report is symbolic to the extent that it reveals the security issues the acting U.S. president intends to focus on for the coming months and years. While not constituting “hard,” actionable strategies, these documents help to articulate the future security...

A security firm has released a report in which it discusses how an advanced threat actor has been lodging malicious software into foreign target computers’ firmware for more than a decade. According to the report published by Kaspersky Labs, the threat actor, known as “The Equation Group,” uses multiple malware platforms on par with Regin, Stuxnet,...

I’ve been a finance professional for more than 25 years and spent the last 15 years in senior finance roles, mostly as a CFO of both public and private companies. Like many of you, I am often invited by business groups and professional service providers to attend thinly veiled networking events to get the attention of “C” suite officers of both large...

I’ve been an iPhone user for quite a while... starting with the iPhone 4, I upgraded to the 4S, the 5, and, now, the 6. With the iPhone 6, I’ve spent a good deal of time investigating the features of iOS 8, something I didn’t do when I upgraded my iPhone 5 because it was already setup and ready to go. One of the features I discovered allows for custom...

A group of hackers were able to penetrate at least 30 financial institutions around the world and steal upwards of one billion dollars, making this attack one of the most advanced the world has yet seen. According to a report published by security firm Kaspersky Lab and sent to the New York Times, the cyber criminals, which have since been named the ...

Haskell, an advanced purely functional programming language, has confirmed a security breach in its Debian Builds component. According to an advisory recently posted to Haskell’s blog, “`deb.haskell.org` is currently offline due to [its] hosting provider suspecting malicious activity.” The project’s security teams stated on February 14th that they were...

Last week, we investigated the story of Vladmir Drinkman, a Russian hacker who assisted Albert Gonzalez, another notorious hacker, in breaching a number of American retailers and using customers’ stolen payment card credentials to unlawfully withdraw money from ATM machines around the world. With only three hackers remaining, Tripwire now continues its...

  Source: Damballa State of Infections Report, Q4 2014 According to recent research, the average enterprise receives nearly 17,000 malware alerts per week; however, of these alerts, only 19 percent are considered reliable and a mere 4 percent are further investigated by security engineers. As IT teams are...

A new report indicates that the current malware infection rate for mobile devices is 0.68 percent, leading researchers to believe that at least 16 million devices were infected with malware at the end of 2014. Published by the Motive Security Labs division of the French telecommunications equipment company Alcatel-Lucent, the report found that mobile...

Anyone who has ever visited blog posts on the Forbes website has properly been irritated from time-to-time by its practice of displaying a "Thought of the Day" for a few seconds before it passes you onto the article that you actually wish to read. We all understand that Forbes has to make money like any other web publisher, but the "thought" (which is...

  It's not your identity they want, or even your credit card number. Those numbers are hard to exploit for quick cash. Banks and card companies have systems that quickly detect fraud. So, why go after an insurance company? Because it’s easy, and they can get away with really good stuff. What the Anthem hackers are after is your medical provider account...

  The recent Anthem hack that may have compromised 80 million people’s personal health information reveals just how mainstream data breaches have become in recent years. In response to this rapidly evolving threat landscape, Boards of Directors (BoDs) and executives are now more aware of today’s cyber threats and how they might adversely affect their...

Attackers can use gaps in the X-Frame Options (XFO) support on Google’s Play Store web application to remotely install malware onto users’ Android devices. “A malicious user can leverage either a Cross-Site Scripting (XSS) vulnerability in a particular area of the Google Play Store web application, or a Universal XSS (UXSS) targeting affected browsers,...

  I still remember my first time reading AlephOne’s ‘Smashing the Stack for Fun and Profit’ – despite not having the proper knowledge to understand it at the time, it put the security bug in my head. It was truly a consciousness raising experience to get that first glimpse of my computer’s inner workings. One thing I did understand from it, loud and...

In the face of the current wave of cyber threats, the U.S. government announced this week in Washington DC that as part of the Homeland Security initiative the current administration is creating a new agency called the Cyber Threat Intelligence Integration Centre (CTIIP) to monitor cybersecurity threats by acquiring, pooling and analysing any captured...