computer security – Page 2 – WindowsTechs.com

Computer Repair Technicians Are Stealing Your Data

Posted on November 28, 2022 by Bruce Schneier

Laptop technicians routinely violate the privacy of the people whose computers they repair:

Researchers at University of Guelph in Ontario, Canada, recovered logs from laptops after receiving overnight repairs from 12 commercial shops. The logs showed that technicians from six of the locations had accessed personal data and that two of those shops also copied data onto a personal device. Devices belonging to females were more likely to be snooped on, and that snooping tended to seek more sensitive data, including both sexually revealing and non-sexual pictures, documents, and financial information…

Continue reading Computer Repair Technicians Are Stealing Your Data→

Recovering Passwords by Measuring Residual Heat

Posted on October 12, 2022 by Bruce Schneier

Researchers have used thermal cameras and ML guessing techniques to recover passwords from measuring the residual heat left by fingers on keyboards. From the abstract:

We detail the implementation of ThermoSecure and make a dataset of 1,500 thermal images of keyboards with heat traces resulting from input publicly available. Our first study shows that ThermoSecure successfully attacks 6-symbol, 8-symbol, 12-symbol, and 16-symbol passwords with an average accuracy of 92%, 80%, 71%, and 55% respectively, and even higher accuracy when thermal images are taken within 30 seconds. We found that typing behavior significantly impacts vulnerability to thermal attacks, where hunt-and-peck typists are more vulnerable than fast typists (92% vs 83% thermal attack success if performed within 30 seconds). The second study showed that the keycaps material has a statistically significant effect on the effectiveness of thermal attacks: ABS keycaps retain the thermal trace of users presses for a longer period of time, making them more vulnerable to thermal attacks, with a 52% average attack accuracy compared to 14% for keyboards with PBT keycaps…

Continue reading Recovering Passwords by Measuring Residual Heat→

Bypassing Two-Factor Authentication

Posted on April 1, 2022 by Bruce Schneier

These techniques are not new, but they’re increasingly popular:

…some forms of MFA are stronger than others, and recent events show that these weaker forms aren’t much of a hurdle for some hackers to clear. In the past few months, suspected script kiddies like the Lapsus$ data extortion gang and elite Russian-state threat actors (like Cozy Bear, the group behind the SolarWinds hack) have both successfully defeated the protection.

[…]

Methods include:

Sending a bunch of MFA requests and hoping the target finally accepts one to make the noise stop.
…

Continue reading Bypassing Two-Factor Authentication→

To guard against data loss and misuse, the cybersecurity conversation must evolve

Posted on July 1, 2021 by Ram Iyer

People — not applications, networks or endpoints — have become the primary security perimeter in today’s cloud-first, choose-the-handiest-device, collaboration-obsessed world. Continue reading To guard against data loss and misuse, the cybersecurity conversation must evolve→

Paul van Oorschot’s Computer Security and the Internet

Posted on June 17, 2021 by Bruce Schneier

Paul van Oorschot’s webpage contains a complete copy of his book: Computer Security and the Internet: Tools and Jewels. It’s worth reading.
Continue reading Paul van Oorschot’s Computer Security and the Internet→

Enterprise security attackers are one password away from your worst day

Posted on April 16, 2021 by Ram Iyer

IT organizations must shift their enterprise security strategy to detect credential-based attacks before they become a problem. Continue reading Enterprise security attackers are one password away from your worst day→

PlexTrac raises $10M Series A round for its collaboration-centric security platform

Posted on April 14, 2021 by Frederic Lardinois

PlexTrac, a Boise, ID-based security service that aims to provide a unified workflow automation platform for red and blue teams, today announced that it has raised a $10 million Series A funding round led by Noro-Moseley Partners and Madrona Venture Group. StageDot0 ventures also participated in this round, which the company plans to use to […] Continue reading PlexTrac raises $10M Series A round for its collaboration-centric security platform→

Mysterious Macintosh Malware

Posted on March 2, 2021 by Bruce Schneier

This is weird:

Once an hour, infected Macs check a control server to see if there are any new commands the malware should run or binaries to execute. So far, however, researchers have yet to observe delivery of any payload on any of the infected 30,00… Continue reading Mysterious Macintosh Malware→

Base Operations raises $2.2 million to modernize physical enterprise security

Posted on February 11, 2021 by Darrell Etherington

Typically when we talk about tech and security, the mind naturally jumps to cybersecurity. But equally important, especially for global companies with large, multinational organizations, is physical security — a key function at most medium-to-large enterprises, and yet one that to date, hasn’t really done much to take advantage of recent advances in technology. Enter […] Continue reading Base Operations raises $2.2 million to modernize physical enterprise security→

A Look at the Computer Security Act of 1987

Posted on December 2, 2020 by Tripwire Guest Authors

U.S. Federal Cybersecurity Today Computer security regulations have come a long way from their early beginnings. Even before the Federal Information Security Management Act (FISMA), there was the Computer Security Act of 1987 (CSA). The Computer Secur… Continue reading A Look at the Computer Security Act of 1987→