article thumbnail

Backdoor in XZ Utils That Almost Happened

Schneier on Security

There’s an important moral to the story of the attack and its discovery : The security of the global internet depends on countless obscure pieces of software written and maintained by even more obscure unpaid, distractible, and sometimes vulnerable volunteers. The modularity they provide makes software projects tractable.

Software 359
article thumbnail

Ask Fitis, the Bear: Real Crooks Sign Their Malware

Krebs on Security

Code-signing certificates are supposed to help authenticate the identity of software publishers, and provide cryptographic assurance that a signed piece of software has not been altered or tampered with. “Antivirus software trusts signed programs more. For some types of software, a digital signature is mandatory.”

Malware 304
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Patch issued to tackle critical security issues present in Dell driver software since 2009

Zero Day

Five critical security issues have been discovered.

article thumbnail

Ghost Ransomware a Persistent Global Threat to Critical Infrastructure

SecureWorld News

Tim Mackey, Head of Software Supply Chain Risk Strategy at Black Duck, explains: "Attacks on legacy cyber-physical, IoT, and IIoT devicesparticularly in an OT environmentare to be expected and must be planned for as part of the operational requirements for the device.

article thumbnail

RSA-240 Factored

Schneier on Security

The previous records were RSA-768 (768 bits) in December 2009 [2], and a 768-bit prime discrete logarithm in June 2016 [3]. It is the first time that two records for integer factorization and discrete logarithm are broken together, moreover with the same hardware and software.

Software 175
article thumbnail

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

If you operate a cybercrime business that relies on disseminating malicious software, you probably also spend a good deal of time trying to disguise or “crypt” your malware so that it appears benign to antivirus and security products. In 2010, someone with the username Pepyak on the Russian language affiliate forum GoFuckBiz[.]com

Malware 274
article thumbnail

Adventures in Contacting the Russian FSB

Krebs on Security

federal prison for his role in the theft of $9 million from RBS WorldPay in 2009. ” Antivirus product detections on the FSB’s VPN software. To really figure out what this FSB software was doing, I turned to Lance James , the founder of Unit221B , a New York City based cybersecurity firm. biz, circa 2007. .

Antivirus 333