Chinese researchers compromise SHA-1 hashing algorithm

Posted on by admini

The paper described how two separate documents could be manipulated to deliver the same SHA-1 hash with a computation of lower complexity level than previously believed possible.

It is a key technical underpinning of Secure Sockets Layer, a private-key technology used broadly to send secure information such as credit card numbers over the Internet. In addition, a handful of chipmakers—including Atmel, Infineon, National Semiconductor and STMicroelectronics– use SHA-1 as the basis for so-called Trusted Platform Modules (TPMs) at the heart of an industry effort to provide a hardware root of trust in PCs and other devices.

Shamir and others said they believe the work of the Chinese trio will probably be proven to be correct based on their academic reputations, although details of the paper are still under review.

It’s extremely important to develop new kinds of hashing algorithms,” said Shamir in the panel session at RSA. “This break of SHA-1 is stunning,” said Ronald Rivest, a professor at MIT who co-developed the RSA algorithm with Shamir.

“This is another reminder that conservatism is needed in the choice of an algorithm,” added Rivest at the panel session.

“They are going to go nuts,” said a technical advisor to the American Bar Association, trying to assess the legal implications of the news.

http://www.eetimes.com/article/printableArticle.jhtml;jsessionid=KXLBKKQ2JSDYIQSNDBCSKHSCJUMEKJVN?articleID=60401254&url_prefix=&sub_taxonomyID=4217

Read more

Warning on hard drives’ security

Posted on by admini

A University of Glamorgan (UK) study found more than half the hard drives they saw still contained sensitive information. It is feared some of the information could be used by criminals. The Information Commissioner’s Office, which monitors data disposal, has said it will be tough on any organisations breaching the Data Protection Act.

The study examined 105 hard drives which had been purchased on internet auction sites and was able to access 92 of them. The data recovered by the university team included staff passwords and national insurance numbers, a template to print a university degree and even detailed information about school children.

Dr Andrew Blyth, principal lecturer at the university’s School of Computing, said companies needed to have a “cradle-to-grave” approach to computer security. He said organised crime now saw e-crime – including identify theft – as a source of revenue.

“We’re not just talking about organised crime, about hackers, we’re also talking about extortionists, blackmailers, even conceivably, paedophiles. Companies need to wake up to the fact that under the Data Protection Act, they have a duty of care towards personal data. They can’t just take hard disks and throw them in the bin and say we have disposed of them, they have a duty to make sure that data is disposed off a sound manner. The advice we always give is take a six inch nail and stick it through your hard drive – physical destruction of the hard drive is the only way to be sure that you have got rid of that data.”

Dr Blyth added there were software programmes, some of which were freely available, which offered users the chance to clear their hard drives for re-use by others. “The only way to be sure if you are really paranoid about your data is to physically destroy your device,” he told BBC Wales’ news website.

http://news.bbc.co.uk/1/hi/wales/4272395.stm

Read more

Clarke rips Microsoft over security

Posted on by admini

“Given their record in the security area, I don’t know why anybody would buy from them,” the former White House cybersecurity and counterterrorism adviser said yesterday, when asked for his thoughts on Microsoft’s forthcoming line of security software.

The observation came during an impromptu interview on the sidelines of the RSA computer security conference in San Francisco, where Clarke took part in panel discussions with other experts in technological and national security.

The company plans to release an anti-virus product this year and introduce a new version of Internet Explorer this summer — about a year sooner than expected — to boost security.

He said he asked Microsoft last year to disclose the specific quality-assurance practices it was following in the pursuit of more-secure software code. The idea, he said, would be for the software industry to collectively come up with a set of best practices for secure software development.

“There’s no fine involved, there’s no liability involved, but the marketplace is better informed, and the marketplace works better when it knows what’s going on,” Clarke said, drawing a round of applause from the crowd at San Francisco’s Moscone Center.

“The market is demanding security now, and that hard work is going forward already,” said Amy Roberts, director of product management in Microsoft’s Security Business and Technology Unit, in the statement.

During a panel discussion on technology regulation, Rick White, a former Republican congressman from Washington state, agreed with Clarke that it would be good to establish visible standards by which companies could be judged in the marketplace. “It’s just a question of how far you get the government involved.” But on the subject of government involvement, White and Clarke disagreed, as illustrated by a related discussion of Internet service providers.

http://seattlepi.nwsource.com/business/212437_rsaclarke17.html

Read more

IE 7.0 Leaves Windows 2000 Users Out in the Cold

Posted on by admini

“When you run a business and you worry only about what your competitors are doing, that’s not a long-term business proposition. You really need to be listening to your customers and that’s what we’re doing,” said Gytis Barzdukas, director of product management in Microsoft’s security business technology unit.

Asked to explain the rationale for limiting IE 7.0 to XP SP2 users when the majority of businesses are still running Windows 2000, Barzdukas left the door open slightly. “We haven’t closed the door on potentially providing it to other platforms,” he said.

However, Barzdukas argued that it was much easier for a company to consider migration to a new operating system than testing and deploying significant product upgrades. “When we do all this engineering work, the architecture is changed significantly.”

Last year, when Microsoft rolled out XP SP2 and declined to offer the security enhancements to Windows 2000 users, analysts grumbled that the Redmond, Wash.-based software giant was using security as a carrot to get businesses to upgrade.

http://www.eweek.com/article2/0,1759,1765331,00.asp

Read more

Cisco set on security spending spree

Posted on by admini

CEO John Chambers laid out the company’s seven-year network security plan on Wednesday during a keynote speech at RSA Conference 2005 here.

His comments built on Cisco’s Tuesday launch of its Adaptive Threat Defense effort, in which “intelligent” networks defend themselves against security attacks. “We will be acquiring aggressively, partnering aggressively and spending aggressively to build about two-thirds of our (security portfolio),” Chambers said.

A key part of Cisco’s security strategy has been to acquire start-ups for their technology and expertise, and many of its latest security updates have come from these buys. The company’s new Secure Sockets Layer (SSL) virtual private network (VPN) product uses technology picked up in its Twingo deal, for example. It’s also put a tool from Riverhead Networks into its Catalyst switches to help prevent denial-of-service attacks.

For more than a year, Cisco has touted its “self-defending” network initiative, which puts intelligence into devices so they can communicate with each other. That means security can be coordinated across the entire network, from the worker at a desk to the guts of the system.

In its related release of upgrades and new products at the RSA show, Cisco introduced intrusion-prevention software, a revamp of its PIX firewall and the overhauled SSL VPN product, which enables employees to remotely connect to the corporate network using a standard Web browser.

Chambers said that Cisco’s move to extend control over security defenses across the whole network came out of discussions with customers between 1999 and 2001. Clients wanted the ability to track network traffic, end points, applications and users, he said. Chambers warned that companies that build their security architecture based on the worms and malicious software of today will find a whole different set of terms and threats five years from now. As a result, he said, companies should instead be focusing on how to get their security architecture “right” and how the components all work together. “You have to think about where the industry will be in three, five and seven years out,” Chambers said. “And you have to think about security as an architecture…you can’t approach it as a pinpoint of products. We believe that security will evolve and be integrated throughout the network,” he added. “We believe they will tie together and move from a reactive mode to one where we can see an intrusion, know how to contain it and have a whole bunch of different products working together.”

Cisco has already partnered with several antivirus and security companies. In late 2003, it teamed up with three companies in an initiative, named Network Admission Control, that aimed to improve the security of networks accessed via mobile devices.

When all the pieces are in place, the NAC architecture will allow companies to set their network devices to refuse connections from mobile PCs or devices that fail to meet corporate security policies, such as not having the latest software patches and antivirus updates. Currently, Cisco supports the NAC framework on its IP routers, and it plans to introduce support on its Ethernet switches some time this year.

http://news.com.com/Cisco+set+on+security+spending+spree/2100-7347_3-5579566.html?part=rss&tag=5575731&subj=news.7347.5

Read more

Security firms show united front

Posted on by admini

The ratings will consist of three numbers, Gerhard Eschelbeck, the chief technology officer at security information provider Qualys said on Tuesday.

The first will be a baseline estimate of the severity of the flaw. The second will rate the bug depending on how long it has been around, and therefore how likely it is that companies have patched against it. The third will measure the threat a vulnerability poses to a specific corporate network. Each will take five or six factors into account for the measurement.

The companies plan to announce the first version of the system on Thursday, Eschelbeck said. They are proposing that vulnerability trackers such as BugTraq use the approach to label the severity of new software bugs.

Businesses can take the ratings to calculate the level of risk on their own network, to generate a single grade, depending on factors such as how reliant they are on the affected software.

“There are three numbers, but customers will deal with a specific final number,” Eschelbeck said. “You can see right out of the get-go how vulnerable you are.”

The launch, which will be made at the RSA Conference in San Francisco this week, is the fruit of a partnership of Redwood Shores, California-based Qualys, networking giant Cisco — which has recently announced a revamp of its security product line — and security company Symantec.

It is designed to provide the first systematic grading of flaws that can be used by companies to assess the potential damage to their vulnerable systems and to prioritise patching. The ratings could also offer insight into the severity of flaws on the different computing platforms, such as Microsoft Windows, Linux and Apple’s Mac OS X.

http://news.zdnet.co.uk/0,39020330,39188056,00.htm

Read more