Category: cybersecurity

Auto Added by WPeMatico

Providing Security Updates to Automobile Software

Posted on By infossl
books, cars, cybersecurity, Security technology, software, Uncategorized

Auto manufacturers are just starting to realize the problems of supporting the software in older models: Today’s phones are able to receive updates six to eight years after their purchase date. Samsung and Google provide Android OS updates and security updates for seven years. Apple halts servicing products seven years after they stop selling them. … Read More “Providing Security Updates to Automobile Software” »

Using LLMs to Exploit Vulnerabilities

Posted on By infossl
academic papers, artificial intelligence, cyberattack, cybersecurity, LLM, Security technology, Uncategorized, vulnerabilities, zero-day

Interesting research: “Teams of LLM Agents can Exploit Zero-Day Vulnerabilities.” Abstract: LLM agents have become increasingly sophisticated, especially in the realm of cybersecurity. Researchers have shown that LLM agents can exploit real-world vulnerabilities when given a description of the vulnerability and toy capture-the-flag problems. However, these agents still perform poorly on real-world vulnerabilities that are … Read More “Using LLMs to Exploit Vulnerabilities” »

Security and Human Behavior (SHB) 2024

Posted on By infossl
conferences, cybersecurity, security conferences, Security technology, Uncategorized

This week, I hosted the seventeenth Workshop on Security and Human Behavior at the Harvard Kennedy School. This is the first workshop since our co-founder, Ross Anderson, died unexpectedly. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of security. The fifty or so attendees include psychologists, economists, … Read More “Security and Human Behavior (SHB) 2024” »

IBM Sells Cybersecurity Group

Posted on By infossl
cybersecurity, ibm, Resilient Systems, Security technology, Uncategorized

IBM is selling its QRadar product suite to Palo Alto Networks, for an undisclosed—but probably surprisingly small—sum. I have a personal connection to this. In 2016, IBM bought Resilient Systems, the startup I was a part of. It became part if IBM’s cybersecurity offerings, mostly and weirdly subservient to QRadar. That was what seemed to … Read More “IBM Sells Cybersecurity Group” »

Microsoft and Security Incentives

Posted on By infossl
cybersecurity, incentives, microsoft, national security policy, Security technology, Uncategorized

Former senior White House cyber policy director A. J. Grotto talks about the economic incentives for companies to improve their security—in particular, Microsoft: Grotto told us Microsoft had to be “dragged kicking and screaming” to provide logging capabilities to the government by default, and given the fact the mega-corp banked around $20 billion in revenue … Read More “Microsoft and Security Incentives” »

Backdoor in XZ Utils That Almost Happened

Posted on By infossl
backdoors, cybersecurity, economics of security, hacking, linux, malware, open source, Security technology, social engineering, ssh, Uncategorized

Last week, the internet dodged a major nation-state attack that would have had catastrophic cybersecurity repercussions worldwide. It’s a catastrophe that didn’t happen, so it won’t get much attention—but it should. There’s an important moral to the story of the attack and its discovery: The security of the global internet depends on countless obscure pieces … Read More “Backdoor in XZ Utils That Almost Happened” »

xz Utils Backdoor

Posted on By infossl
backdoors, cybersecurity, hacking, malware, open source, Security technology, social engineering, Uncategorized

The cybersecurity world got really lucky last week. An intentionally placed backdoor in xz Utils, an open-source compression utility, was pretty much accidentally discovered by a Microsoft engineer—weeks before it would have been incorporated into both Debian and Red Hat Linux. From ArsTehnica: Malicious code added to xz Utils versions 5.6.0 and 5.6.1 modified the … Read More “xz Utils Backdoor” »

Ross Anderson

Posted on By infossl
cryptanalysis, cryptography, cybersecurity, economics of security, security conferences, security engineering, Security technology, Uncategorized

Ross Anderson unexpectedly passed away Thursday night in, I believe, his home in Cambridge. I can’t remember when I first met Ross. Of course it was before 2008, when we created the Security and Human Behavior workshop. It was well before 2001, when we created the Workshop on Economics and Information Security. (Okay, he created … Read More “Ross Anderson” »