This week’s topics: Air marshal surveillance, Russians hacking control systems, Google 2FA, 23andMe sharing your data, Pentagon’s DoNotBuy list, technology news, human news, discovery, notes, recommendations, and the aphorism of the week… Every week I spend 5-20 hours finding the most interesting stories in security, technology, and humans, which I then curate into a 30 minute podcast &…

A lot of people have questions about the concept of DNS Rebinding attacks, and many of the overviews dive too deep into the details. Here’s a simple explanation that should help those having trouble getting it. DNS Rebinding lets you send commands to systems behind a victim’s firewall, as long as they’ve somehow come to a domain you…

We’re starting to see significant debate around the terms SOC vs. CSIRT, and which one companies should have. As with most such debates in tech—which is moving almost as fast as we can lock down definitions—the issue is largely one of semantics. To start, Wikipedia says a SOC is a centralized unit that deals with security issues on…

For anyone who’s been worried that their online fingerprint was going to be used against them, this paper will provide them their vindication. Here’s how they describe the analysis: As a simple example, every website can effortlessly track whether a customer is using an iOS or an Android device; or track whether a customer comes to the website…

The Information Security community has been debating software reliability for decades. Some say software is too advanced to place guarantees on it. And others say that unless we hold creators/builders responsible, nothing will improve. Nassim Taleb’s Skin in the Game is what got me thinking about this topic. As it turns out, the most ancient law that we…

I’ve been writing more defined and concise posts lately—usually clean ideas that have a beginning and an end. I like it, and I plan to keep doing it. But not today. Today I just need to write. Today this will be an old-school blog, or a journal. There are a lot of things happening in America right now.…

There’s a common belief in InfoSec circles that Security and Privacy are related, but that they’re different enough to constantly mention the distinction. I don’t think the difference should matter much to defenders much at all, and in fact if you look close enough the distinction nearly vanishes. They are simply different aspects of the unified goal of…

Any time you see us using cameras to feed a Machine Learning algorithm, I think we’ll start calling that Machine Learning Vision, and, eventually, Computer Vision. The key point is that computers can parse video (and other sensor data) and figure out things that even humans cannot. The combination of audio, video, heat, other types of EM waves,…

I have a 1,001 friends in InfoSec who I hear things like this from on a regular basis: I’d never put one of those things in MY house! I’m in security! They’re going to find flaws in those things, you wait and see! Then when something happens, like a private conversation being sent to a random person, they…