Security Leftovers
-
When is it secure enough? Vulnerability research and the future of vulnerability management - Red Hat Research
Security researcher and professor Daniel Gruss is an internationally known authority on security vulnerabilities. Among the exploits he’s discovered with his research team are the Meltdown and Spectre bugs, and their software patch for Meltdown is now integrated into every operating system. Frequent collaborator Martin Schwarzl, a PhD student in Daniel’s CoreSec group at Graz University of Technology (Austria), joined Daniel for an interview with Red Hat Vice President of Product Security Vincent Danen.
-
New Ransom Payment Schemes Target Executives, Telemedicine
Ransomware groups are constantly devising new methods for infecting victims and convincing them to pay up, but a couple of strategies tested recently seem especially devious. The first centers on targeting healthcare organizations that offer consultations over the Internet and sending them booby-trapped medical records for the “patient.” The other involves carefully editing email inboxes of public company executives to make it appear that some were involved in insider trading.
-
Security Researcher: Recent CFAA Changes Won’t Keep Researchers From Being Prosecuted
The people who are here to help are still in harm’s way. The Supreme Court may have mitigated a bit of this damage in its 2021 Van Buren decision, but its limitations on readings of the Computer Fraud and Abuse Act’)’s (CFAA) language means more on paper than it does in real life. All this did was suggest CFAA cases should only target criminal hacking efforts, but left the definition of “criminal” wide open, allowing it to remain a tool of abuse for private companies that refused to fix problems but felt justified in suing security researchers in court for exposing unfixed security flaws.
-
Your Threat Modeling E-book Is Live. | Bogomil Shopov
Why e-book? So, I wrote a small e-book compiling all the knowledge I have from researching and training more than 200 people on efficient threat modeling. I decided to push it as an e-book for a few reasons: How is this threat modeling e-book different from the others on the market?