Securosis Blog

A New Kind of Commodity Hardware

Adrian Lane · February 1, 2013

I was driving down the road the other day when I passed what I thought was a shipping container on the back of an 18-wheel truck. When I noticed data and power ports on the side, I realized it was a giant data center processing module. Supercomputing on wheels. Four trucks with two modules per truck, rolling down the highway. Inside reside thousands of stripped down motherboards stacked with tons of memory, packed side by side. Some of these are even designed to be filled with dielectric fluid…

Apple blocks vulnerable Java plugin

Rich · February 1, 2013

Apple uses XProtect to block the Java browser plugin due to security concerns.

Draconian, but a good move, I think. Still, they should have notified users better for the ones who need Java in the browser (whoever that may be). You can still manually enable it to run if you need to. This doesn’t block Java itself, just the browser plugin. If complaint levels stay low, it indicates how few people use Java in the browser, and will empower Apple to make similar moves in the future.

Oracle Patches Java. Again.

Rich · February 1, 2013

What’s the over/under on this one working?

Mac users – this means XProtect won’t block it in your web browser, so if you don’t want it active be careful.

Pointing fingers is misleading (and stupid)

Mike Rothman · February 1, 2013

Everyone is all fired up that the APT is now targeting major media companies. Rich covered that in yesterday’s post, and now it seems the Wall Street Journal was also targeted by similar tactics

Twitter Hacked

Adrian Lane · February 1, 2013

Twitter announced this evening that some 250k user accounts were compromised.

This week, we detected unusual access patterns that led to us identifying unauthorized access attempts to Twitter user data. We discovered one live attack and were able to shut it down in process moments later. However, our investigation has thus far indicated that the attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords –…

Friday Summary: February 1, 2013

Rich · January 31, 2013

Plan. Build. Run.

It’s a pretty straightforward process. One of those things that is so simple we rarely need to even call it out. We tend to structure our research this way, even if we use different terms that are more consistent with the context at hand.

It it was easy, everyone would be doing it…

Mike Rothman · January 31, 2013

We talk a lot about Big Data Security, and over the next couple years we will talk about it a lot more. But I think articles like Big Goals for Big Data are a bit misleading.

A must-read reported by the Times itself:

For the last four months, Chinese hackers have persistently attacked The New York Times, infiltrating its computer systems and getting passwords for its reporters and other employees.

Incite 1/30/2013: Email autoFAIL

Mike Rothman · January 30, 2013

It’s the end of January, which means my favorite day of the year is coming up. Yup, Super Bowl Sunday. It’s a huge bummer that the Falcons couldn’t close it out in the NFC Championship, but it was a great season nonetheless. But now on to the important stuff. We will be hosting our 8th Super Bowl party, and we get pretty festive. After this many years we have it down to a system. Pretty much.

See update at the bottom

TechHive’s piece on the new iOS 6.1 jailbreak.

Only works on the pre-A5 processors, which means the iPhone 4S and iPad 2 and later are safe. The device must be connected to a computer for it to work.