From Slashdot: yonk497 writes "A boastful Iranian hacker has claimed sole responsibility for the Comodo security certificate attack, saying it had nothing to do with his government. The 21-year-old claimed via a note on PasteBin, 'I'm not a group of hacker, I'm single hacker with experience of 1,000 hackers.' While some researchers believed his claims, saying the media had accepted Comodo's claims that the attack was from the Iranian government too easily, others said it was impossible to tell if the hacker was real, or a PR move by Iran."

Errata Security becomes an Official Sponsor of the InfoSecMentors Project

Errata Security supports the InfoSecMentors Project in their continued goal of increasing the number and value of mentorships in the Information Security industry through volunteers. The mission of ISMP is to grow the social network by introducing fellow InfoSec professionals that would not otherwise ordinarily get a chance to meet, and encourage those relationships to develop into formal mentorships.

The InfoSecMentors Project - "Helping mentors find aspiring people to help in the Information Security Community"

David Maynor to speak at BayThreat in Mountain View, CA

David Maynor will be presenting a talk at BayThreat on December 10th, 2011 on "Cheat Codes for the Mobile User." This original content focuses on security research concerning games on mobile devices. Errata Security is an official sponsor of BayThreat.

BayThreat - December 10th & 11th - Mountian View, CA - Hacker Dojo

David Maynor and Dr. Paul Judge to speak at DEF CON

Errata CTO David Maynor and Dr. Paul Judge, Chief Research Officer & VP Cloud Services, Barracuda Networks, will speak at DEF CON in Las Vegas July 2010 about malware. In this talk, they will reveal statistical data about the search engines and terms that were most targeted. They will highlight key attacker trends, and examine the ability of traditional security approaches like anti-virus and URL filters to react to the rapid movements by the SEO poisoning attacks.

DEF CON: "Searching for Malware: A Review of Attackers’ Use of Search Engines to Lure Victims"

Errata Security releases the results of the survey on secure coding practices

Errata Security is releasing the results of a survey conducted over the week of Security B-Sides and the RSA Conference in San Francisco. The survey found that Microsoft SDL was the most common security development lifecycle chosen of the companies using formal methodologies, but Ad Hoc solutions are still the most popular. Small companies are more likely to be using Agile development, and the corresponding SDL-Agile. The most common reason for not choosing to use a formal methodology was resource requirements.

Here are the press links covering the story, and a link to the actual paper:

Download the Survey Results (pdf): "Integrating Security Into the Software Development Lifecycle"

Dark Reading: "Survey Says: More Than Half of Software Companies Deploying Secure Coding Methods"

CSO Security and Risk: "Code Writers Finally Get Security? Maybe"

Microsoft SDL Blog: "Survey Results: Microsoft SDL awareness on the rise"

Help Net Security: "Root issues causing software vulnerabilities"

Errata Security announces survey to measure security practices in the SDLC

Errata Security is conducting a survey on the real world usage of software development methodologies such as Microsoft SDL, OWASP's SAMM, and BSIMM. We are interested in learning which organizations are successfully implementing these methods, and also the reasons companies are abstaining from using these methods.

If you would like a copy of the results of this survey, there is a request button at the end of the survey where you can enter your email address. In order to encourage participation in this survey, and to explain the reasons behind it, I will be giving a lightning talk at Security B-Sides in San Francisco on March 3 at 12:00 PST. Please share the survey link with software developers, security experts, product managers, or anyone involved in product development.

The survey will close on Friday March 12, 2010 at 17:00 PST.

Survey: "How do you add security to your software development lifecycle?"

Errata Security Blog: Explanation

UStream: Video footage "Security & the SDLC" SlideShare: PowerPoint "Security & the SDLC"

Marisa Fagan on password authentication panel at Security B-Sides

Marisa Fagan, along with Jennifer Jabbusch and Michael Santarcangelo spoke about the failures of using passwords to authenticate users. "Passwords are the root vulnerability in several identity theft attacks. Users recycle passwords, fall for phishing scams, and choose weak phrases," said Ms. Fagan. Security B-Sides is an alternative to the RSA Conference for participants to share and interact on a more personal level. Links to abstract and video below.

B-Sides San Francisco: "So What's the Alternative? A group discussion of the solutions replacing passwords for user authentication"

UStream: Video footage

Robert Graham quoted on new cloud-based service to steal WiFi passwords

Robert McMillan of IDG News Service interviewed Errata CEO Robert Graham about the new cloud-based WPA password cracker created by security researcher Moxie Marlinspike. The service could save security auditors time. Graham says "When I show this to management and say it would cost $34 to crack your WPA password, it's something they can understand."

Errata Security Blog: "Climategate hack used open proxies"

Robert Graham featured on Dark Reading in response to Brazilian Power Grid Outage

After a power outage at a Brazilian power station was attributed to "hackers" in the tv show 60 Minutes, Errata Security CEO Robert Graham investigated the likelihood of these claims. He cited the lack of evidence, and far more likely scenarios. Later, in a feature on the site Dark Reading, he goes on to explore how an attack such as this could happen.

Errata Security Blog: "Brazil outage NOT caused by hackers"

Dark Reading: "How to Hack a Brazilian Power Grid"

Marisa Fagan and Elizabeth Wharton to speak at Security BSides

The Security BSides Conference in Las Vegas has invited Marisa Fagan, Security Project Manager, and Elizabeth Wharton, VP of Legal Affairs and Business Development, to discuss the aspects of Identity Theft that involve a proximity relationship between the attacker and the target.

Errata CTO David Maynor speaks at Mobile Bar Camp 2009

At Mobile Bar Camp in Atlanta, GA David Maynor gave a presentation over using the iPhone for testing purposes.
"iPhone Security: Bug Hunting on a iPhone"

iPhone research applied to new botnet threat

In the TECH section of New Scientist, Jim Giles referenced last year's research on the iPhone. In combination with SMS viruses, the iPhone introduces a new kind of threat.

"Virus may signal first 'zombie' cellphone network"