PINDROP BLOG

Category: Authentication

January 22, 2016
On the Wire Podcast: Steven Murdoch
Steven Murdoch is a researcher at University College London and this week published a detailed technical analysis of the MIKEY-SAKKE protocol that is implemented in the U.K.’s Secure Chorus standard for voice encryption. Secure Chorus is set up for key escrow by design, a fact that Murdoch explains in his analysis. In this podcast, Dennis…
Read More →
January 20, 2016
LostPass Allows Easy Phishing to Defeat Password Manager
A security researcher has developed a phishing attack against the LastPass password manager app that is virtually impossible to detect and has the ability to mimic the LastPass login sequence perfectly. The technique takes advantage of several weaknesses in the way that LastPass handles user logout notifications and the resulting authentication sequence. Sean Cassidy, the…
Read More →
January 19, 2016
UK Government Voice Encryption Standard Built for Key Escrow, Surveillance
The U.K. government’s standard for encrypted voice communications, which already is in use in intelligence and other sectors and could be mandated for use in critical infrastructure applications, is set up to enable easy key escrow, according to new research. The standard is known as Secure Chorus, which implements an encryption protocol called MIKEY-SAKKE. The protocol was…
Read More →
January 19, 2016
Serious Yahoo Mail XSS Bug Fixed
Yahoo has fixed a serious cross-site scripting vulnerability in its webmail product that could’ve allowed an attacker to take over a victim’s email account with one malicious email. The bug is a specific kind of cross-site scripting vulnerability known as stored XSS. In order to trigger it, an attacker would only need to send a…
Read More →
January 15, 2016
On the Wire Podcast: Mike Hanley
Mike Hanley is the program manager for research and development in Duo Security‘s Labs division, and is a former senior member of the technical staff at the CERT/CC at Carnegie Mellon University. In today’s podcast, Dennis Fisher talks to Mike about the ways in which two-factor authentication is deployed right now, how 2FA use has changed,…
Read More →
January 15, 2016
Hyatt Data Breach Caused by Payment System Malware
A data breach at hundreds of Hyatt hotels that was revealed in December was caused by point-of-sale device malware that stole victims’ payment card information in transactions in hotel restaurants, spas, golf shops, and other locations. The malware was on PoS systems in more than 300 Hyatt hotels around the world, including dozens in the…
Read More →
January 13, 2016
Bankosy Android Trojan Defeats Voice 2FA
Bad guys are always looking for ways to up their game and find ways around the defenses that security companies and users put in their way. To wit, an Android banking Trojan called Bankosy that has added a new capability that allows attackers to bypass voice-based two-factor authentication. The malware has been around for a…
Read More →
January 12, 2016
Bug in Trend Micro Password Manager Allows Password Theft
A Google security researcher has discovered a serious, easily exploitable vulnerability in a password manager installed by default with some Trend Micro antivirus products. The bug allows an attacker not only to run arbitrary commands but also to download all of the passwords stored by the manager. The vulnerability was discovered by Tavis Ormandy, a…
Read More →
December 29, 2015
Payment Card Protocols Wide Open to Fraud
Researchers have discovered serious security vulnerabilities in a pair of protocols used by software in some point-of-sale terminals, bugs that could lead to easy theft of money from customers or retailers. The vulnerabilities lie in two separate protocols that are used in PoS systems, mainly in Germany, but also in some other European countries. Karsten Nohl, a…
Read More →
December 23, 2015
Google Testing New Account Authentication System
Authentication is one of the tougher problems in security, and a lot of companies have thrown a lot of money at it for a long time. Google is one of those companies, and the company is testing a new scheme that allows users to access their accounts without using a password. The system relies on…
Read More →