Yahoo's mass account hacking shows 'users' carelessness with passwords'

A security breach at the offices of internet search giant Yahoo, which led to over 450,000 login details being leaked online, highlights how careless Internet users are while choosing their passwords. Last month, a hacking collective posted account information belonging to thousands of Yahoo users on a public website in what they described as 'a wake-up call'.
.....................

The incident showed that the company that holds user details in question has poor user security, which allows the hackers to grab this important data.

But most importantly, it tells how blind Internet users are when it comes to password security.

According to the report, out of 442,837 passwords that were published, the top ten passwords were "123456," "password," "welcome," "ninja," "abc123," "123456789," "princess," "sunshine," "12345678," and "0".

The word "'qwerty"' (the first six letters appearing on the top left letter row of a U.S. keyboard when read left to right, came in at number 11..............

Click here to read more .... 
Solutions : www.xcyss.in

Certificate hacks: PKI didn't fail us, humans did

By Roger A. Grimes | InfoWorld

With the high likelihood that GlobalSign has been hacked, this brings to at least three the number of popular public PKI certification authorities (CAs) attacked in recent months by a single hacker. The other CAs are Comodo and DigiNotar.

The computer security world is aflutter because hundreds of bogus digital certificates have been issued. "It's a massive failure of PKI," they say. "It proves that there's too much trust spread around," say others.

But it's hard for me to get worked up about any public CA or PKI compromise. Here's why: Almost nobody pays serious attention to digital certificate warning messages in the first place.

I've yet to see the person who, when presented with a certificate error, didn't continue on and visit the website they were trying to access. Most users are simply annoyed by digital certificate warning messages. How dare they get in the way of a quick-loading Web page!

It's not just mom and granddad who are ignoring digital certificate warnings. A few years ago, a survey revealed that the more users knew about digital certificates and PKI, the more likely they were to ignore the warnings.

Part of the problem is that for as long as public PKI has been in existence -- nearly two decades -- it has tended to be implemented poorly. Websites with SSL certificates are notorious for having mistakes in their certificates. Mostly they have incorrect host names, where the subject name does not match the host name being contacted -- but certificates are often expired or have other x.509 mistakes. I attended a Black Hat Las Vegas 2010 conference on the subject where Ivan Ristic, directory of engineering at Qualys, revealed that the majority of websites using SSL certificates had errors.

Qualys found 22.65 million SSL-enabled websites and hosts on the Internet (out of hundreds of millions of websites). Only 720,000 had SSL certificates with a valid name match. Only 28 percent of the most popular SSL websites had a proper name, although 70 percent had digital certificates that were linked to a trusted CA. That's good. But 28 percent were untrusted, and 4 percent had trust chains that could not be verified.

Moreover, Qualys said more than 2 percent of the 22.65 million sites were suspicious. More than 137,000 certs were expired, 96,000 were self-signed, and more than 1,000 were revoked (but still being used). Twenty-one thousand had invalid digital signatures, and more than 57,000 had unknown CAs. Ninety-nine digital certificates had known bad keys left over from the Debian random number generator vulnerability, which was found and fixed more than a year before.

I'm sure that these statistics have improved over the last year, but if only 3 percent of SSL-enabled sites (720,000 divided by 22.65 million) had a correct and valid SSL certificate (including only 28 percent of popular websites), can we really ask end-users to rely on public PKI?

Don't get me wrong: I'm sad anytime I hear that a CA is hacked. CAs have heavy, tight security around the digital certificates that can issue other certificates. Most are protected by hardware security modules (HSMs), which usually require smart cards, USB tokens, or some other physical security device. In fact, it usually takes multiple physical tokens (each attached to different people) in order to access the important digital certificates. HSMs should be used by any company with a PKI, but especially by CAs.

The Comodo hacker referenced above talks about being thwarted by an HSM. My guess is that the other compromised CAs were either not using HSMs or were not using them appropriately.

The bottom line is that PKI didn't fail us. Its mathematical beauty and potential assurance is something rare in the computer security world. If run correctly, it would greatly benefit our online world. But as with most ongoing security risks, human nature ruins the promise.

Source: http://www.infoworld.com/t/cyber-crime/certificate-hacks-pki-didnt-fail-us-humans-did-172173

Solutions : http://www.xcyss.in/      

Hackers Are the New Mob: White House Gets Serious on Cybercrime

Potential teenage Matthew Brodericks, beware: In this era of LulzSec, DDoS attacks on BART and hacktivst group Anonymous telling NATO that the world doesn't belong to them anymore, the White House has decided that it's time to take hacking seriously, asking for tougher sentencing for those found guilty of cybercrime.

Speaking before the Senate Judiciary Committee, Associate Deputy Attorney General James Baker and Secret Service Deputy Special Agent in Charge Pablo Martinez explained that sentencing has failed to keep up with the growing seriousness of hacking, and that the administration is calling for the Computer Fraud and Abuse Act to be folded into the Racketeering Influenced and Corrupt Organizations Act.

The key to understanding the proposed changes is the new presumption that modern hackers are not acting alone. Martinez told the Committee that "Secret Service investigations have shown that complex and sophisticated electronic crimes are rarely perpetrated by a lone individual," adding that online criminals "organize in networks, often with defined roles for participants, in order to manage and perpetuate ongoing criminal enterprises dedicated to stealing commercial data and selling it for profit" (or, you know, just to cause chaos and show that they can hack into that place someone said they couldn't, but whatever). It's a narrative picked up by Baker, who went even further, saying that "[a]s computer technology has evolved, it has become a key tool of organized crime. Many of these criminal organizations are similarly tied to traditional Asian and Eastern European organized crime organizations."

In addition to reclassifying hacking as an organized crime activity, the White House's proposal seeks the creation of a national data breach standard, replacing whatever various state laws may be in place.

Source : http://techland.time.com/2011/09/08/hackers-are-the-new-mob-white-house-gets-serious-on-cybercrime/#ixzz1XSH09UWF

Solutions:  http://www.xcyss.in/