Securology

I guess maybe I was born to be a security-minded person, if "fate" or "nurture" deemed thus. I just was recollecting th...

I have discussed real-time keyloggers before, as a way to defeat some online banking applications , among other things, and that in general,...

I'm not sure if this de-thrones what I previously referred to as the Stupidest PCI Requirement Ever , but it's close. Sometimes the...

Do you need to comply with some external regulations (think PCI) that require your Microsoft Active Directory (AD) passwords to be changed f...

The uninstallation program for Symantec Anti-Virus requires an administrator password that is utterly trivial to bypass. This probably isn...

Just my two cents, but if you have to dialog about the distinction between an "application" and "network" penetration te...

Here's an interesting, but commonly overlooked, little security nugget. If you are running an e-commerce application and rely on a Con...

Rubber hose cryptanalysis , xkcd -style. It's funny because it's true: Unfortunately, so much of computer security is exactly this ...

This is my blatant attempt to re-direct any aspiring, up-and-coming security professionals into another line of work, for the sake of their ...

Wow. This is a big deal: The forged certificates will say they were issued by a CA called "Equifax Secure Global eBusiness", wh...

The Payment Card Industry (PCI) regulatory compliance goals are good, but not perfect. Some individual requirements in the Data Security St...

The Kaspersky folks have an interesting report on malware that targets the banking and financial markets that supports and echoes many of t...

I'm grateful for physicist Wietse Venema's contributions (satan, the coroner's toolkit, TCP Wrappers, and Postfix) to the comput...

It's official. We now have conclusive evidence. Computer Security is, in fact, more difficult than nuclear physics. I submit to you, ...

Google just released a new set of security features for Gmail. However, you cannot turn on the "always use HTTPS" option if you ...

By now, you may have read about a group of MIT Students who were set to present some insecurity details of the "CharlieCard" sub...

This is a break from the traditional types of posts. It's more of an instructional howto, but I hope that it is valuable nonetheless. ...

I am surprised how often I hear an organization operate under the belief that they can really, truly can control what a remote client does u...