Schneier on Security

Syndicate content
A blog covering security and security technology.
Updated: 15 hours 33 min ago

The Doghouse: Privacy Inside

October 13, 2009 - 2:55pm
I'm just going to quote without comment: About the file: the text message file encrypted with a symmetric key combine 3 modes 1st changing the original text with random (white noise) and PHR (Pure Human Randomness) shuffle command , move and replace instruction combine with the key from mode 1 (white noise) and 2 (PHR) 2nd mode ­ xor PHR...

David Dittrich on Criminal Malware

October 13, 2009 - 7:15am
Good essay: "Malware to crimeware: How far have they gone, and how do we catch up?" ;login:, August 2009: I have surveyed over a decade of advances in delivery of malware. Over this period, attackers have shifted to using complex, multi-phase attacks based on subtle social engineering tactics, advanced cyptographic techniques to defeat takeover and analysis, and highly targeted attacks...

Wi-fi Blocking Paint

October 12, 2009 - 1:47pm
I wrote about this in 2004. This is an improved product: While paints blocking lower frequencies have been available for some time, Mr Ohkoshi's technology is the first to absorb frequencies transmitting at 100GHz (gigahertz). Signals carrying a larger amount of data -- such as wireless internet -- travel at a higher frequency than, for example, FM radio....

Using Wi-fi to "See" Through Walls

October 12, 2009 - 6:14am
Impressive....

Friday Squid Blogging: Squidsoup

October 9, 2009 - 4:54pm
Gallery of virtual art....

Pigs Defeating RFID-Enabled Feeding Systems

October 9, 2009 - 2:34pm
Pretty clever (for a pig, that is). EDITED TO ADD (10/10): Better link for video....

1,000 Cybersecurity Experts

October 9, 2009 - 11:33am
Yesterday, DHS Secretary Janet Napolitano said that the U.S. needed to hire 1,000 cybersecurity experts over the next three years. Bob Cringley doubts that there even are 1,000 cybersecurity experts out there to hire. I suppose it depends on what she meant by "expert."...

The Futility of Defending the Targets

October 9, 2009 - 6:37am
This is just silly: Beaver Stadium is a terrorist target. It is most likely the No. 1 target in the region. As such, it deserves security measures commensurate with such a designation, but is the stadium getting such security? [..] When the stadium is not in use it does not mean it is not a target. It must be watched...

Detecting Forged Signatures Using Pen Pressure and Angle

October 8, 2009 - 6:43am
Interesting: Songhua Xu presented an interesting idea for measuring pen angle and pressure to present beautiful flower-like visual versions of a handwritten signature. You could argue that signatures are already a visual form, nicely identifiable and universal. However, with the added data about pen pressure and angle, the authors were able to create visual signatures that offer potentially greater security,...

Hotel Safe Scam

October 7, 2009 - 1:07pm
This is interesting: Since then, his scams have tended to take place in luxury hotels around the world. Typically, he would arrive at a hotel, claim to be a guest, and then tell security that he had forgotten the combination code to his safe. When hotel staff helped him to open the safe, he would pocket the contents and make...

Detecting People Who Want to Do Harm

October 7, 2009 - 12:54pm
I'm dubious: At a demonstration of the technology this week, project manager Robert P. Burns said the idea is to track a set of involuntary physiological reactions that might slip by a human observer. These occur when a person harbors malicious intent—but not when someone is late for a flight or annoyed by something else, he said, citing years of...

Computer-Assisted Witness Identification

October 7, 2009 - 7:12am
Witnesses are much more accurate at identifying criminals when computers assist in the identification process, not police officers. A major cause of miscarriages of justice could be avoided if computers, rather than detectives, guided witnesses through the identification of suspects. That's according to Brent Daugherty at the University of North Carolina in Charlotte and colleagues, who say that too often...

Don't Let Hacker Inmates Reprogram Prison Computers

October 6, 2009 - 2:32pm
You'd think this would be obvious: Douglas Havard, 27, serving six years for stealing up to £6.5million using forged credit cards over the internet, was approached after governors wanted to create an internal TV station but needed a special computer program written. He was left unguarded and hacked into the system's hard drive at Ranby Prison, near Retford, Notts. Then...

Malware that Forges Bank Statements

October 6, 2009 - 6:40am
This is brilliant: The sophisticated hack uses a Trojan horse program installed on the victim's machine that alters html coding before it's displayed in the user's browser, to either erase evidence of a money transfer transaction entirely from a bank statement, or alter the amount of money transfers and balances. Another article. If there's a moral here, it's that banks...

UK Defense Security Manual Leaked

October 5, 2009 - 3:10pm
Wow. It's over 2,000 pages, so it'll take time to make any sense of. According to Ross Anderson, who's given it a quick look over, "it seems to be the bureaucratic equivalent of spaghetti code: a hodgepodge of things written by people from different backgrounds, and with different degrees of clue, in different decades." The computer security stuff starts at...

Moving Hippos in the Post-9/11 World

October 5, 2009 - 1:29pm
It's a security risk: The crate was hoisted onto the flatbed with a 120-ton construction crane. For security reasons, there were no signs on the truck indicating that the cargo was a hippopotamus, the zoo said. The last thing you need is a hijacked hippo. Does this make any sense? Has there ever been a zoo animal hijacking anywhere?...

Actual DHS Travel Record

October 5, 2009 - 6:44am
If you were curious what the DHS knows about you....

Friday Squid Blogging: Squid Cartoon

October 2, 2009 - 4:08pm
Lio....

"Security Theater in New York City"

October 2, 2009 - 12:23pm
For the U.N. General Assembly: For those entranced by security theater, New York City is a sight to behold this week. A visit to one of the two centers of the action -- the Waldorf Astoria, where the presidents of China, Russia, the Prime Ministers of Israel and the Palestinian Authority, and the President of the United States -- are...

Proving a Computer Program's Correctness

October 2, 2009 - 7:01am
This is interesting: Professor Gernot Heiser, the John Lions Chair in Computer Science in the School of Computer Science and Engineering and a senior principal researcher with NICTA, said for the first time a team had been able to prove with mathematical rigour that an operating-system kernel—the code at the heart of any computer or microprocessor—was 100 per cent bug-free...

randomness