Tag Archive for: Crypto

Critics: Substandard crypto needlessly puts Evernote accounts at risk

/in

Vicki & Chuck Rogers

Security experts are criticizing online note-syncing service Evernote, saying the service needlessly put sensitive user data at risk because it employed substandard cryptographic protections when storing passwords on servers and Android handsets.

The scrutiny of Evernote’s security comes two days after Evernote officials disclosed a breach that exposed names, e-mail addresses, and password data for the service’s 50 million end users. Evernote blog posts published over the past few years show that the company protects passwords and sensitive user data with encryption algorithms and schemes that contain known weaknesses. That is prompting criticism that the company’s security team isn’t doing enough to protect its customers in the event that hackers are able to successfully compromise the servers or end-user phones.

The chief complaint involves Evernote’s use of the MD5 cryptographic algorithm to convert user passwords into one-way hashes before storing them in a database. Use of MD5 to store passwords has long been frowned on by security experts because the algorithm is an extremely fast and computationally inexpensive way to convert plaintext such as “password” into a unique string of characters such as “5f4dcc3b5aa765d61d8327deb882cf99.” MD5 makes an attacker’s job of cracking the hashes much easier by allowing billions of guesses per second, even on computers of relatively modest means.

Read 13 remaining paragraphs | Comments


Ars Technica » Technology Lab

Adobe to revoke crypto key abused to sign malware apps (corrected)

/in

Adobe is revoking a cryptographic key used to confirm the authenticity of its applications after discovering it was compromised by attackers who abused it to validate malicious software.

The “inappropriate use” of the Adobe code signing certificate was pulled off by attackers who compromised a build server used to compile and package the company’s applications, Adobe officials said in a statement published on Thursday. The server had access to the Adobe code-signing infrastructure, which forensic investigators have determined was used to sign two samples of malicious software.

“We believe the threat actors established a foothold on a different Adobe machine and then leveraged standard advanced persistent threat (APT) tactics to gain access to the build server and request signatures for the malicious utilities from the code signing service via the standard protocol used for valid Adobe software,” officials wrote. The private key associated with the code validation process was stored in hardware security modules and weren’t extracted during the intrusion, Adobe investigators determined. There is no evidence that any source code was stolen.

Read 4 remaining paragraphs | Comments


Ars Technica » Technology Lab

Flame Malware Tapped World Class Crypto – InformationWeek (blog)

/in

Centrum Wiskunde & Informatica (CWI)

Flame Malware Tapped World Class Crypto
InformationWeek (blog)
By Mathew J. Schwartz InformationWeek Whoever built the malware known as Flame, Flamer, and Skywiper imbued it with serious stealth capabilities. Just how serious has been revealed over the past few days, as mathematicians have found a previously …
Price tag for Microsoft piece of Flame malware $ 1M, researcher saysNetwork World
Fake Security Certificates Approve Flame Malware to be Microsoft SoftwareSPAMfighter News
Podcast: How The Flame Malware Stayed Hidden For So LongThreatpost (blog)

all 29 news articles »

flame malware – read more