• Security software can put computers at risk

    Is the antivirus program running on your computer really making your computers safer to use, say, for online banking? Is the parental control software you bought to keep your 13-year-old off porn sites downgrading the overall safety of your computer? New research from Concordia shows security software might actually make online computing less safe.

  • Cybersecurity’s weakest link: humans

    There is a common thread that connects many of the recent hacks which captured the headlines. They all employed generic – or what is now considered “old school” – phishing attacks which typically took the form of the infamous “Nigerian prince” type e-mails, trying to trick recipients into responding with some personal financial information. “Spearphishing” attacks are similar but far more vicious. They seek to persuade victims to click on a hyperlink or an attachment that usually deploys software (called “malware”) allowing attackers access to the user’s computer or even to an entire corporate network. Yes, people are the weakest links in cybersecurity. But they don’t have to be. With smarter, individualized training, we could convert many of these weak links into strong detectors – and in doing so, significantly strengthen cybersecurity.

  • view counter
  • “Internet of Things” increases threat to infrastructure

    According to former Director of National Intelligence Dennis Blair, a simple Web search can reveal information from thousands of unsecured devices. Even the casual browser can access camera data from Sweden, video game server activity in Eastern Europe, or the output of American wind turbines. He said this information is as easily accessible to terrorists and other criminals. And more will become available as the “Internet of things” — the collection of physical systems and devices connected to the Internet — grows in size.

  • “Smart home” security flaws found in popular system

    Cybersecurity researchers were able to hack into the leading “smart home” automation system and essentially get the PIN code to a home’s front door. Their “lock-pick malware app” was one of four attacks that the cybersecurity researchers leveled at an experimental set-up of Samsung’s SmartThings, a top-selling Internet of Things platform for consumers. The work is believed to be the first platform-wide study of a real-world connected home system. The researchers did not like what they saw.

  • Defending encrypted data from quantum computer threat

    If an exotic quantum computer is invented that could break the codes we depend on to protect confidential electronic information, what will we do to maintain our security and privacy? This is the overarching question posed by a new report from the National Institute of Standards and Technology (NIST), whose cryptography specialists are beginning the long journey toward effective answers.

  • FBI does not know how the $1m iPhone hack works

    The  FBI does not know how the hack which was used to unlock the San Bernardino terrorist’s iPhone 5C works, even though the agency paid about $1 million for the technique. The identity of the hackers who sold the technique to the agency is a closely guarded secret, and the FBI director himself does not know who they are.

  • Argonne hosts Cyber Defense Competition

    More than seventy-five aspiring cyber defenders from across Illinois and Iowa converged last Saturday on the U.S. Department of Energy’s (DOE’s) Argonne National Laboratory to take on the challenge of Argonne’s first Collegiate Cyber Defense Competition. The competition provided a strong challenge for eight teams from seven colleges, forcing them to defend simulated power utility networks from a variety of realistic attacks by a “Red Team” made up of cyber experts from Argonne and industrial partners.

  • Pentagon “dropping cyberbombs” on ISIS

    Deputy Secretary of Defense Robert Work has said that the U.S. military is “dropping cyberbombs” on ISIS. Earlier this month, Defense Secretary Ashton Carter announced that the U.S. Cyber Command had been given its “first wartime assignment” – attacking and disrupting ISIS cyber infrastructure. in the last few months, the Pentagon has allowed more information to be published about the U.S. military’s cyberwar against ISIS. Work, describing the Cyber Command’s operations at a news conference, said: “We are dropping cyberbombs. We have never done that before.”

  • System predicts 85 percent of cyber-attacks using input from human experts

    Today’s security systems usually fall into one of two categories: human or machine. So-called “analyst-driven solutions” rely on rules created by living experts and therefore miss any attacks that do not match the rules. Meanwhile, today’s machine-learning approaches rely on “anomaly detection,” which tends to trigger false positives that both create distrust of the system and end up having to be investigated by humans, anyway. But what if there were a solution that could merge those two worlds? What would it look like? Virtual artificial intelligence analyst developed by the MIT’s Computer Science and Artificial Intelligence Lab and machine-learning startup PatternEx reduces false positives by factor of 5.

  • Patching up Web applications

    By exploiting some peculiarities of the popular Web programming framework Ruby on Rails, MIT researchers have developed a system that can quickly comb through tens of thousands of lines of application code to find security flaws. In tests on fifty popular Web applications written using Ruby on Rails, the system found twenty-three previously undiagnosed security flaws, and it took no more than sixty-four seconds to analyze any given program.

  • S&T licenses physical/cyber risk assessment tool to the commercial market

    DHS S&T announced that a fifth cybersecurity technology has been licensed for commercialization as a part of the Cyber Security Division’s Transition to Practice (TTP) program. The TTP program builds on the S&T process of funding projects through the full research and development lifecycle through to the commercial marketplace. The new technology — Physical and Cyber Risk Analysis Tool (PACRAT) — assesses cyber risks simultaneously with physical risks.

  • The past, present, and future of ransomware

    The rise of ransomware over the past year is an ever growing problem. Business often believe that paying the ransom is the most cost effective way of getting their data back — and this may also be the reality. The problem we face is that every single business that pays to recover their files, is directly funding the development of the next generation of ransomware. As a result of this we are seeing ransomware evolve at an alarming rate.

  • Commonly used strategy for Web site protection is not airtight

    Cloud-based security providers commonly use DNS redirection to protect customers’ Web sites. The success of this strategy depends on shielding the Web site’s original IP address. Computer scientists have now revealed that the IP address can be retrieved in more than 70 percent of the cases, meaning that the DNS redirection security mechanism can easily be bypassed. 

  • Registration opens for U.S. Cyber Challenge’s annual Cyber Quests competition

    U.S. Cyber Challenge (USCC) on Monday opened registration for the 2016 Cyber Quests online competition. The annual Cyber Quests competition determines who qualifies for the USCC Summer Cyber Camps, a leading nationwide program in cybersecurity workforce development.

  • FBI, DHS warn grid operators about cyber threats to power grid

    The FBI and DHS are warning infrastructure operators about the potential cyberattacks on the U.S. power grid. The FBI and DHS have launched a nationwide campaign to alert power companies and security firms, a campaign which includes briefings and online Webinars.