Search

Home > Down the Security Rabbithole > DtSR Episode 177 - NewsCast for January 19th, 2016


	Podcast:		Down the Security Rabbithole
	Episode:		DtSR Episode 177 - NewsCast for January 19th, 2016
	Category:		Technology
	Duration:		00:52:18
	Publish Date:		2016-01-19 00:00:00
	Description:		In this episode FTC imposes a $250,000 fine for "false advertising" of encryption Interesting case, where there really was 'false advertising' Would this even have been a 'security issue'? https://www.ftc.gov/news-events/press-releases/2016/01/dental-practice-software-provider-settles-ftc-charges-it-misled NY wants to ban encrypted smart phone sales Another clear case of legislators being clueless? What about all the existing technology, and kit you can buy across state lines? http://www.zdnet.com/article/apple-iphone-ban-new-york-looks-to-outlaw-sale-of-encrypted-smartphones/ Las Vegas casino is suing cybersecurity firm over "woefully inadequate" work Are there ethical implications here of a competitor defining negligence? Burden of proof is on casino to prove "woefully inadequate" - but against what standard? Does this ultimately raise quality, price or both for IR services? http://thehackernews.com/2016/01/casino-hacker.html The FDA issues draft guidance of security guidelines If everyone is doing it, why not the FDA? As James points out, why does every industry need their own unique (exactly the same issues as everyone else) guidelines? Interesting mention of "full lifecycle" and disclosure of vulnerabilities Of course it's all non-enforceable http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM482022.pdf OpenSSH bug found, fixed OpenSSH bug creates a "malicious server" scenario User has to successfully authenticate first, then server can read/steal memory Can be used to compromise SSH private key from host Great pivot method if you've compromised an SSH server w/this bug, to compromise the users of the server http://arstechnica.com/security/2016/01/bug-that-can-leak-crypto-keys-just-fixed-in-widely-used-openssh/
	Total Play:		0