From Slashdot: yonk497 writes "A boastful Iranian hacker has claimed sole responsibility for the Comodo security certificate attack, saying it had nothing to do with his government. The 21-year-old claimed via a note on PasteBin, 'I'm not a group of hacker, I'm single hacker with experience of 1,000 hackers.' While some researchers believed his claims, saying the media had accepted Comodo's claims that the attack was from the Iranian government too easily, others said it was impossible to tell if the hacker was real, or a PR move by Iran."

Robert Graham quoted on "Thunderbolt: A new way to hack macs"

Dan Goodin from The Register interviewed Robert Graham about the new technology to connect to external harddrives/devices. Thunderbolt may give attackers yet another chink to exploit when targeting machines that offer the interconnect. "Imagine that you are at a conference,” Graham, the CEO of security consultancy Errata Security, writes. “You innocently attach your DisplayPort to a projector to show your presentation on the big screen. Unknown to you, while giving your presentation, the projector is downloading the entire contents of your hard disk."

Robert Graham quoted on Security concerns over new Thunderbolt I/O technology

Errata Security CEO Robert Graham was quoted in the article by H-Online.com. "The current Thunderbolt simply sends PCIe signals across the wire. That means, in theory, anything a PCIe card can do, a Thunderbolt device can do", warns Graham.

Coverage on Robert Graham's article "I was just detained by the TSA"

Robert Graham wrote a blog post on being detained by TSA during the early announcements of physical screening by TSA. It received media attention, as well as many comments on the post.

Errata Security releases the results of the survey on secure coding practices

Errata Security is releasing the results of a survey conducted over the week of Security B-Sides and the RSA Conference in San Francisco. The survey found that Microsoft SDL was the most common security development lifecycle chosen of the companies using formal methodologies, but Ad Hoc solutions are still the most popular. Small companies are more likely to be using Agile development, and the corresponding SDL-Agile. The most common reason for not choosing to use a formal methodology was resource requirements.

Here are the press links covering the story, and a link to the actual paper:

Download the Survey Results (pdf): "Integrating Security Into the Software Development Lifecycle"

Dark Reading: "Survey Says: More Than Half of Software Companies Deploying Secure Coding Methods"

CSO Security and Risk: "Code Writers Finally Get Security? Maybe"

Microsoft SDL Blog: "Survey Results: Microsoft SDL awareness on the rise"

Help Net Security: "Root issues causing software vulnerabilities"

Errata Security Blog: "Climategate hack used open proxies"

Robert Graham featured on Dark Reading in response to Brazilian Power Grid Outage

After a power outage at a Brazilian power station was attributed to "hackers" in the tv show 60 Minutes, Errata Security CEO Robert Graham investigated the likelihood of these claims. He cited the lack of evidence, and far more likely scenarios. Later, in a feature on the site Dark Reading, he goes on to explore how an attack such as this could happen.

Errata Security Blog: "Brazil outage NOT caused by hackers"

Dark Reading: "How to Hack a Brazilian Power Grid"