article thumbnail

My TED Talks

Schneier on Security

TEDxPSU 2010: “ Reconceptualizing Security ” TEDxCambridge 2013: “ The Battle for Power on the Internet ” TEDMed 2016: “ Who Controls Your Medical Data ?” I have spoken at several TED conferences over the years. ” I’m putting this here because I want all three links in one place.

Internet 291
article thumbnail

Google Pays $10M in Bug Bounties in 2023

Schneier on Security

The highest reward for a vulnerability report in 2023 was $113,337, while the total tally since the program’s launch in 2010 has reached $59 million. It’s $2M less than in 2022, but it’s still a lot. For Android, the world’s most popular and widely used mobile operating system, the program awarded over $3.4

Mobile 310
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

A few thoughts on CVE

Adam Shostack

Tagging both with a name was an important use case in 1997, and one that I got to revisit around 2010 when I was doing work to understand how malware got into PCs. Those included comparing between vulnerability posts. Its a lot of work to decide if two vulns are the same. Most of the attacks in exploit kits were not CVE-labeled.

article thumbnail

The Insecurity of WordPress and Apache Struts

Schneier on Security

Interesting data : A study that analyzed all the vulnerability disclosures between 2010 and 2019 found that around 55% of all the security bugs that have been weaponized and exploited in the wild were for two major application frameworks, namely WordPress and Apache Struts.

Risk 247
article thumbnail

How China Uses Stolen US Personnel Data

Schneier on Security

Interesting analysis of China’s efforts to identify US spies: By about 2010, two former CIA officials recalled, the Chinese security services had instituted a sophisticated travel intelligence program, developing databases that tracked flights and passenger lists for espionage purposes. intelligence agencies.

Hacking 363
article thumbnail

A Basic Timeline of the Exchange Mass-Hack

Krebs on Security

Exchange Server 2010 is no longer supported, but the software giant made a “defense in depth” exception and gave Server 2010 users a freebie patch, too. How long have the vulnerabilities exploited here been around? 2, Microsoft patched four flaws in Exchange Server 2013 through 2019.

Hacking 363
article thumbnail

Nearly a Year Later, Mozilla is Still Promoting OneRep

Krebs on Security

The ink on that partnership agreement had barely dried before KrebsOnSecurity published a story showing that Onereps Belarusian CEO and founder Dimitiri Shelest launched dozens of people-search services since 2010, including a still-active data broker called Nuwber that sells background reports on people.