Monthly Archives: September 2014

Encryption failures fixed in popular PGP email security tool Enigmail

Posted on by

Developers of the popular Enigmail email security extension for Thunderbird have fixed several issues that could have exposed messages users believed to be encrypted.

Enigmail provides a graphical user interface in the Mozilla Thunderbird and SeaMonkey programs that allows users to digitally sign and encrypt email messages using the OpenPGP standard.

The Enigmail Project released version 1.7.2 of the extension on Aug. 29 and briefly noted that the release fixes several important bugs. The changelog did not contain additional details about the impact of the fixed issues, but included a link to the projects external bug tracker.

In addition to several non-security issues, the bug tracker lists a number of addressed bugs that could have serious security implications for users of the older Enigmail 1.7 version. One of them causes emails to be sent in unencrypted form when only BCC (blind carbon copy) recipients are specified.

Another issue causes drafts to be saved in plain text when writing a new email even when the email is marked for encryption automatically. If the IMAP protocol is used, the unencrypted drafts can be synchronized with the email server, exposing potentially sensitive information.

This behavior only happens when the system selects an email for encryption automatically based on an existing per-recipient rule or when the recipients public key exists in the local key store. If the email is manually marked to be encrypted (e.g. by clicking the yellow key symbol on the bottom-right) the drafts are correctly encrypted before being sent to the IMAP server, the bug entry notes.

Another bug can cause an incorrect encryption or signing status message to be displayed when composing a reply. This especially happens if the compose window is not opened for the first time, another entry on the bug tracker notes.

A fourth issue that has been addressed can cause an upgrade from Enigmail 1.6 to 1.7 to break encryption. Email messages wont be encrypted if the per recipient setting is disabled under Key Selection, despite other key selection mechanisms like by email and manual if missing being enabled.

When confirmation dialog is enabled you can even see that Enigmail wants to send an email unsigned/unencrypted despite having selected forced encryption, the corresponding bug entry says. Otherwise it is silently sent unencrypted.

An Enigmail user who reported one of the encryption failures in version 1.7 on the projects support forum described the situation as the biggest imaginable catastrophe.

See original here:
Encryption failures fixed in popular PGP email security tool Enigmail

Out in the Open: A Free Platform for Building Gear on the Internet of Things

Posted on by

The trouble with the Internet of Things is that the things dont really talk to each other.

New devices like the Nest thermostat, the Dropcam camera, and various wearables do a pretty good job of talking to the internet, letting you easily monitor and use them through online dashboards. But such tools would be so much more useful if they also traded information on their own. Its nice if you car tires let you know when theyre low via a web dashboard. But its even nicer if they can tell an air compressor exactly how much air they need and whose bank account to bill for it.

Thats the kind of digital utopia sought by the creators of Zetta, a new open source project that provides common tools for building internet-connected devices that can talk to each other, including everything from home automation contraptions to flying drones. Driven by a company called Apigee, the project made its official debut this morning.

Other projects and services seek much the same utopia. The average consumer can use a service called IFTTT to link devices like the Nest thermostat and the Philips Hue lighting system. More accomplished techies setup more complex interactions through Octoblu, formerly known as SkyNet, an open source system for controlling hardware over the internet. And behind the scenes, companies like Nest, now owned by Google, are now offering APIs, or application programming interfaces, for their devices that let the worlds developers create new ways of interacting with them. With Zetta, Apigee wants to help bring these kinds of APIs to far more devices.

Apigee has long been in the business of web APIs, which are basically ways for software developers to make one application talk with another. APIs are how companies plug their apps into services like Twitter, and increasingly, theyre how data scientists pull information from government websites for analysis. Apigee helps companies create and maintain APIs, and though it typically does this for more traditional online services, and it now wants to expand into the Internet of Things.

Basically, with Zetta, its offering tools that lets anyone build devices that can interact with the larger Internet of Things through APIs. This includes a set of specifications for creating APIsspecifications it is committing to the API Commons, a collection of designs that can be freely reused without license fees. But the company is also offering open source software that can run on devices, helping to handle much of the work that goes into an API.

According Apigee vice president Brian Mulloy, the strength of the platform is that its well suited juggle many different types of communicationsomething that can help link disparate devices. What our platform is really smart about is cross-mediating between different protocols, he says.

The Zetta software will run on cheap, low-end hardware such as the Raspberry Pi and the Beaglebone, passing messages from the hardware either directly to other devices or with servers hosted in the cloud or even your living room. Apigee will try to make money from the project by offering to host online services that plug into this software, but the software and its source code will be available for anyone to use for free.

The project is still in the early stages, but Tim Ryan, one of the creators of Internet of Things hardware platform called Tessel believes it can push this market forward. Building your own devices and APIs can be tricky, and theres no standard way of doing it, he says. Zetta could make that easier.

Follow this link:
Out in the Open: A Free Platform for Building Gear on the Internet of Things

A Lossless Tagged Visual Cryptography Scheme | IEEE | IEEE projects 2014 – Video

Posted on by


A Lossless Tagged Visual Cryptography Scheme | IEEE | IEEE projects 2014
As one of the most efficient multi-secret visual cryptography (MVC) schemes, the tagged visual cryptography (TVC) is capable of hiding tag images into random...

By: Renown Technologies

Read the rest here:
A Lossless Tagged Visual Cryptography Scheme | IEEE | IEEE projects 2014 - Video

Property Analysis of XOR-Based Visual Cryptography | IEEE | IEEE projects 2014 – Video

Posted on by


Property Analysis of XOR-Based Visual Cryptography | IEEE | IEEE projects 2014
A (k,n) visual cryptographic scheme (VCS) encodes a secret image into n shadow images (printed on transparencies) distributed among n participants. When any ...

By: Renown Technologies

Visit link:
Property Analysis of XOR-Based Visual Cryptography | IEEE | IEEE projects 2014 - Video

OpenSSL warns vendors against using vulnerability info for marketing

Posted on by

Security advisories for OpenSSL should not be used for competitive advantage, according to the development project behind the widely used cryptography component.

The warning comes from the OpenSSL Project, which has published for the first time guidelines for how it internally handles security problems, part of an ongoing effort to strengthen the project following the Heartbleed security scare in April.

High severity issues such as remote code execution vulnerabilities will be kept private within OpenSSLs development team, ideally for no longer than a month until a new release is ready.

If an update is planned, a notification will be released on the openssl-announce email list, but no further information about the issues will be given, it said.

Some organizations that develop a general purpose OS that includes OpenSSL will be prenotified with more details about the patches in order to have a few days to prepare. But the OpenSSL Project warned that the more people that are notified in advance, the higher the likelihood that a leak will occur.

We may withdraw notifying individual organizations from future prenotifications if they leak issues before they are public or over time do not add value (value can be added by providing feedback, corrections, test results, etc.), it wrote.

If information on a vulnerability leaks, it makes it more likely that attackers may be able to figure out the software flaw and launch attacks before software products are patched.

The OpenSSL Project also advised that it is not acceptable for organizations to use advance notice in marketing as a competitive advantage. It objects, for example, to marketing claims such as if you had bought our product/used our service you would have been protected a week ago.

OpenSSL has been undergoing an intense code review since the Heartbleed vulnerability was discovered in April. The flaw affected tens of thousands of websites across the Internet and many software applications.

OpenSSL is a cryptographic library that enables SSL (Secure Sockets Layer) or TLS (Transport Security Layer) encryption. Most websites use either SSL or TLS, which is indicated in browsers with a padlock symbol.

More here:
OpenSSL warns vendors against using vulnerability info for marketing

Switzerland will host Edward Snowden, if he testifies against the NSA

Posted on by

THE SWISS attorney general has said that whistleblower Edward Snowden can reside there if he responds to state requests for testimony against the US National Security Agency (NSA).

Snowden was the source of leaked documents and information relating to the US Prism programme and the UK Tempora takeaway. The Swiss attorney general said that the US would not be able to force extradition if the local government regards such a request as politically motivated.

A document provided to the Swiss Sunday newspaper Sonntagszeitung is titled, "What are the rules would apply to consider when Edward Snowden would [be] brought to Switzerland and then the United States would make a request for extradition", and it relates that the rules would allow the movement and repel the requests.

Speaking to the newspaper, Snowden's Swiss lawyer Marcel Bosonnet revealed that he is pleased with the results of the study, commenting that, "The legal requirements for safety are met."

Presently Snowden has a residency permit in Russia, and that was recently extended by three years. Snowden has been in Moscow for a year and a month now, after he arrived there from Hong Kong expecting to move to Cuba.

He has already provided testimony in Europe, and told assembled ministers that he knew that what he was doing was the right thing.

"I worked for the United States' Central Intelligence Agency. The National Security Agency. The Defense Intelligence Agency," he said. "I love my country, and I believe that spying serves a vital purpose and must continue. And I have risked my life, my family and my freedom to tell you the truth."

View original post here:
Switzerland will host Edward Snowden, if he testifies against the NSA

Couples Can’t Keep Their Hands Off Each Other’s Phones

Posted on by

By John P. Mello Jr. 09/08/14 3:49 PM PT

Worried about the NSA spying on your smartphone? How about online hackers? Truth be told, the greatest threat to your confidential information is a lot closer to you -- namely, your partner.

That's what a recent survey of more than 13,000 people in the United States revealed.

Avast last week reported its findings. Among them: The majority of women snoop on their men's phones just because they're curious, but a third of married women peek at their hubby's mobile to see if he's faithful.

Paranoia? Maybe not. Seven of 10 women who snooped on their partner's phone found evidence he was deceiving them. More than half the peeping men found such evidence about their women.

Once they had the goods, women were 20 percent more likely to confront their significant other with the incriminating evidence, Avast researchers discovered.

"It surprised us that people you trust would be checking your phone," said Jude McColgan, Avast president of mobile.

Much is made of elaborate schemes to break into someone's phone, but that's typically not a problem for a partner. Almost half the women surveyed (41 percent) and a third of the men (33 percent) said their partner's phone wasn't protected by a pass code.

"It's remarkable that people don't use their pass codes," McColgan told TechNewsWorld. "That's scary if you lose your phone, because you're essentially carrying a PC in your pocket, and all your information is wildly at risk."

In Fourth Amendment circles, advocates often refer to a "reasonable expectation of privacy."

Read more here:
Couples Can't Keep Their Hands Off Each Other's Phones

Snowden shouldn’t be extradited to US if he testifies about NSA spying, says Swiss gov

Posted on by

Secure remote control for conventional and virtual desktops

Master spook blabbermouth Edward Snowden should be granted safe passage to and from Switzerland if he testifies about surveillance, the country's attorney general has reportedly said.

Last year, the one-time NSA sysadmin leaked files revealing some of the secret spying tactics of UK and US spooks.

Snowden currently has temporary residency in Russia, where he has been living for more than a year now.

According to two separate reports in Swiss newspapers Sonntags Zeitung and Le Matin published on Sunday, Snowden would not be extradited to the US if he stands as a "witness in criminal proceedings, or [appears] as part of a parliamentary inquiry" in Switzerland.

That's apparently the opinion of the country's attorney general, who expressed that view in November last year to help work out legalities relating to any potential visit from whistleblower Snowden.

The two newspapers reported the Swiss government law advisor's opinion, after viewing a confidential document.

The top Swiss lawyer added that any US efforts to extradite Snowden if he were to testify in Switzerland would be considered "political" and thereby rejected by authorities in the country.

Only "higher state obligations" could overrule that position, the AG reportedly added.

Snowden, meanwhile, has indicated that he is willing to testify in Switzerland. His Zurich lawyer Marcel Bosonnet was said to be pleased with the AG's comments. He was quoted by Sonntags Zeitung as saying "the legal requirements for [Snowden's] safe conduct are met."

More:
Snowden shouldn't be extradited to US if he testifies about NSA spying, says Swiss gov

Porticor and nScaled Deliver Secure and Compliant Business Continuity and Disaster Recovery …

Posted on by

Porticor Adds Software-Defined Encryption Key Management to nScaled's Leading IT BCDR Platform for Complete Protection of Replicated Data in the Cloud

CAMPBELL, Calif., and SAN FRANCISCO Porticor and nScaled today announced the industry's first joint solution integrating software-defined homomorphic encryption key management to protect customers' cloud information and applications replicated for IT Business Continuity and Disaster Recovery (BCDR).

Porticor is a leading cloud data security company delivering the only cloud-based key management and data encryption solution that infuses trust into the cloud and keeps cloud data confidential. nScaled is a provider of automated, integrated IT Business Continuity and Disaster Recovery (BCDR) solutions.

nScaled's Disaster Recovery as a Service (DRaaS) platform replicates data, servers, operating systems and applications to protect and deliver critical IT services to users in case of a man-made or natural disaster, equipment failure or data loss. nScaled's DRaaS hybrid cloud solution ensures that replicas are up to date at all times, including both the data and the "virtual machine images" of the code that runs the applications. Forrester Research, Inc., named nScaled a Leader in The Forrester Wave: Disaster-Recovery-As-A-Service Providers, Q1 2014.

Porticor adds key management and encryption to nScaled's solution. Integrated into nScaled's physical and virtual appliance, Porticor encrypts the data store of each application backed up by nScaled's solution seamlessly and transparently. Porticor is also implemented on nScaled's cloud, ensuring that any data replicated to the nScaled cloud is also encrypted. The result is multifaceted, data-at-rest and in-transmission encryption solution that protects information at the customer's data center and in the cloud.

"We are in the insurance business so clients share personal and account information about their employees with us," said Aatash Patel, IT Director at Covala Group, a leading enroller and administrator of voluntary, supplemental individual disability benefits for large employers. "With nScaled in place serving our disaster recovery needs, we needed a private cloud data encryption solution that was high performing and compatible with our VMware environment. Porticor has been our answer to protect clients' confidential information, and help us meet their compliance requirements. We spun up Porticor with nScaled in our cloud without any technical training, and support has been very helpful at both companies. I am very happy with what both vendors are doing together so far."

For a white paper on the partnership and joint solution now available, see http://www.porticor.com/porticor-nscaled-secure-dr/.

"Business continuity and disaster recovery have been one of the most successful services offered through the cloud model, and nScaled delivers the industry's leading automated and integrated solution," said Mark Jameson, VP of Worldwide Sales and Product Strategy at nScaled. "Together with Porticor we are providing the most secure and reliable Disaster Recovery as a Service (DRaaS) to protect customer's data and applications."

"Cloud providers, including providers delivering DRaaS, offer a shared responsibility' model for the security and protection of customer applications and data," said Gilad Parann-Nissany, Porticor founder and CEO. "Now that we have teamed with nScaled, customers can be assured that their applications and information will be available and safe from loss due to disasters and cloud data security threats."

Cloud data encryption provides an effective layer of protection against new cloud security challenges, including internal cloud data center threats, information protection in a shared environment, and compliance requirements which mandate information to be secured both on premises and in the cloud. The challenge created is not in encrypting the data, but with managing the encryption keys. To provide secure cloud management of encryption keys for outsourced data center services to the nScaled cloud, Porticor uses a highly sophisticated and patented approach split key encryption and homomorphic key management.

Continue reading here:
Porticor and nScaled Deliver Secure and Compliant Business Continuity and Disaster Recovery ...

@CloudExpo | PCI-DSS Encryption Requirements

Posted on by

Significant money is at stake and in need of protection in the Payment Card Industry (PCI). The global payment card industry covers several sectors: banks and financial institutions (acquirers), issuers, processors, service providers, merchants carrying out transactions online and via point of sale terminals in bricks and mortar stores, large and small.

PCI SecurityThe PCI Security Organizations Data Security Standard (DSS) applies to your business if you store, process or transmit cardholder data (CHD). The PCI supply chain is not an isolated entity. It needs to protect itself well beyond its own

perimeter fences. This is because business entities also need to protect the billions of people every day that key in their Personal Identity Numbers (PINs) and other personal data as they trade or carry out transactions in store or over the Internet, from fixed and mobile devices using payment cards. Increasingly, commerce takes place via mobile devices over wireless networks, with the card itself rarely being physically present at the store.

As credit and debit cards are used more and more, checks are disappearing in many economies. In a mobile, electronic, global world, the payment card industry continues to grow. In May 2014, for example, 47.1 billion was spent in the United Kingdom on cards of all types (credit and debit), a 7.5% annual growth in spending rates over May 2013, at a time where the countrys economy is a long way from recovery.

Its not surprising therefore that the payment card industry attracts people of malicious intent.

PCI-DSS Encryption RequirementsIn this reality, if your business occupies any of the nodes in the payment card supply chain, you must comply with the 12 core requirements of PCI-DSS to keep perpetrators of payment card fraud at bay. You will need to ensure you have the same levels of protection, and thus of PCI-DSS compliance, in the cloud and in your data centers. In addition, you must make sure that all third-party service providers you use are fully PCI-compliant.

Several of the 12 PCI-DSS requirements are relevant for cloud security. However, on this occasion, well single out those sections of requirement number 3, which relate specifically to the protection of stored cardholder data. As youll see below, you can comply with these requirements by using Porticors data encryption and cloud key management system.

PCI-DSS Encryption: Requirement 3Requirement 3.4, for example, states that you must make sure that Primary Account Numbers (PANs) are unreadable, wherever they are stored. Our solution ensures your compliance here thanks to strong hashing (SHA-2) and AES-256 encryption, augmented by robust encryption key management.

You must not tie decryption keys to user accounts, regardless of whether you encrypt at the disk, file- or column-level of the database, nor must you allow access to the cryptographic key by native operating systems. Your compliance is assured on both points with Porticors key management algorithm, which by default splits the key. This keeps it independent of the OS, as well as administrators and service providers in your supply chain. In other words, access is limited to very few custodians and, always acting together, rather than any one on their own, ensures your compliance with requirements 3.5.1 and 3.5.2.

Continued here:
@CloudExpo | PCI-DSS Encryption Requirements