Life Cycle of a Security Bug

Unlike members of the insect family, computer software bugs live forever. Software security bugs (well, flaws) are especially troubling since they demand respect from every software developer now and forever. We want to believe we can "eradicate" software flaws through reviews, testing, and vigilance. Eradication is a myth. A flaw's spores simply go dormant to... Continue Reading →

“Eyes Only” Security Marking

[This post has been UPDATED three times since first published, most recently on Nov 14, 2019] Occasionally in the news (and more often in spy fiction) people pass around super-secret documents marked "Eyes Only." The United Kingdom and Canada use "Eyes Only" to indicate specific countries with whom a document may be shared. "UK Eyes... Continue Reading →

Thanks to my former publisher, Addison-Wesley nee-Pearson Education, I can post several chapters of my favorite writing project: Authentication: From Passwords to Public Keys. I'm including these chapters as material for the Cloud Cybersecurity course I'm doing at the University of Minnesota for Coursera. The book was published in 2001, and it's based on solid,... Continue Reading →

Political campaign security

Maciej Cegłowski has published a long, practical, insightful, and witty article on his experiences with political campaign security. He wisely focuses on a handful of steps to narrow the attack surface with the fewest tools and techniques. This should be a Coursera course, or a series of short videos.

A Forged “From” Address

To the left we see part of a malicious email. The author brags about how the From address is the same as the To address. This is supposed to mean that the author has broken into my email account. I have been waiting patiently for someone to mail one of these to me. Now I... Continue Reading →

This photo should not exist

pin.it/fnnc4j6fjamugy Once we get past the creep factor of Nazi army uniforms, we see a communications team sending a secret message. They are using the legendary Enigma machine to encrypt the message. But why, why did that officer allow a photographer to record this highly sensitive activity? A failure of operational security (OPSEC). Allies in... Continue Reading →

Rule #1 for Detecting a Phish

Golly. This one was really hard to spot. Just kidding. This is obviously a fake email. I don't think that American Express is likely to be sending email from "Steakhousetopia.com" regardless of how challenging Internet operations might get.

A Mac Hack

Here's a clever two-step attack on a Macintosh. First, the victim downloads a file - it may be enough to email it to the victim as an attachment. Second, the victim opens a file or clicks a link. This executes the downloaded file. Yipes!

Create a website or blog at WordPress.com

Up ↑