Zack Whittaker

Zack Whittaker is the security editor for ZDNet, covering cyber and national security. He is based in New York newsroom, and is also found on sister-sites CNET and CBS News. You can reach him with his PGP key: EB6CEEA5.

Charlie Osborne

Charlie Osborne is a cybersecurity journalist and photographer who writes for ZDNet and CNET from London. PGP Key: AF40821B | Research/security tips email: cingred@protonmail.com.

Jennifer Leggio

Jennifer Leggio has been in the security industry for 17 years as a marketer, advisor, and writer. Her focus is on security culture, including disclosure, community issues, equality in security, disruptive trends, and even marketing best practices. PGP Key: 3A708289 | She prefers other contact on Twitter via @mediaphyter.

Latest Posts

Purewire raises funding, adds Noonan to board

Purewire raises funding, adds Noonan to board

Purewire, a security start-up competing in the software-as-a-service (Saas) market, has banked $2 million in friends-and-family funding and added industry veteran Tom Noonan to its board of directors.The latest funding round, which was led by Imlay Investments, Inc.

August 4, 2008 by in Cloud

On GIFARs

On GIFARs

Ever since Rob McMillan of IDG published a story giving a preview of our coming Black Hat talk, specifically a preview of the portion of our talk related to GIFARs, media coverage of the research has swirled a bit out of control and there's been some misconceptions.  My co-presenter John Heasman has a write-up on GIFARs that explains this all just a bit more.

August 2, 2008 by in Security

Rise of the 'legit' malware sites

Rise of the 'legit' malware sites

About 75 percent of all Web sites serving up malicious code are legitimate sites that have been hacked/compromised, according to a new report from WebSense.This number validates statistics from ScanSafe showing a dramatic rise in 'good' sites being being used as a conduit for drive-by malware downloads and other social engineering attacks.

August 1, 2008 by in Security

The empty debate over open source security

The empty debate over open source security

Guest editorial by Roger ThorntonLast week, Fortify published a study on adoption of security best-practices within the Open Source community. Given mounting risk posed by extensive use of Open Source technologies within business and government IT, we were gratified to see the passionate discussions that followed.

July 31, 2008 by in Open Source

Black Hat Sneak Preview

Black Hat Sneak Preview

Rob McMillan from IDG interviewed John Heasman and I today about the presentation we will be delivering with Rob Carter at Black Hat Vegas next week. The article has a good teaser about one of the more interesting of the many attacks we will cover, namely what we've coined the GIFAR attack.

July 31, 2008 by in Enterprise Software

Black Hat talk on Apple encryption flaw pulled

Black Hat talk on Apple encryption flaw pulled

Brian Krebs from the Washington Post "Security Fix" Blog reported that one of the talks slated for next week's Black Hat convention on a previously undiscovered flaw in Apple's FileVault encryption system has been canceled, the researcher citing confidentiality agreements as the reason he will not be speaking.The article states:Charles Edge, a researcher from Georgia, had been slated to discuss his research on a weakness that could be used to defeat FileVault encryption on the Mac.

July 31, 2008 by in Security

Web worms squirm through Facebook, MySpace

Web worms squirm through Facebook, MySpace

My colleagues at Kaspersky Lab (see disclosure) have intercepted two new worms squirming through MySpace and Facebook, using social engineering lures to plant malware on Windows systems.The worms propagate via the comments features on the two popular social networks, using video lures and fake Flash Player downloads to trick end users into installing malicious executables.

July 31, 2008 by in Collaboration

CSRF vulnerability allows Twitter 'follow' abuse

CSRF vulnerability allows Twitter 'follow' abuse

Last week, TechCrunch's Jason Kincaid wrote about an obvious Twitter vulnerability that allowed a user called "johng77536" to game the popular micro-blogging service to add thousands of followers (subscribers) in a short period of time.The "johng77536" account has since been disabled but a security researcher tracking Twitter security flaws and weaknesses has discovered a new vulnerability that lets users easily game the "follow" system.

July 31, 2008 by in Security

HD Moore pwned with his own DNS exploit, vulnerable AT&T DNS servers to blame

HD Moore pwned with his own DNS exploit, vulnerable AT&T DNS servers to blame

A week after |)ruid and HD Moore release part 2 of DNS exploit, HD Moore's company BreakingPoint has suffered a traffic redirection to a rogue Google site, thanks to the already poisoned cache at AT&T servers to which his company was forwarding DNS traffic :"It happened on Tuesday morning, when Moore's company, BreakingPoint had some of its Internet traffic redirected to a fake Google page that was being run by a scammer.

July 30, 2008 by in Enterprise Software

OS fingerprinting Apple's iPhone 2.0 software - a "trivial joke"

OS fingerprinting Apple's iPhone 2.0 software - a "trivial joke"

Just like every decent web service out there wanting to identify the iPhone's mobile Safari browser in order to serve custom applications, in this very same way malicious attackers would like to remotely identify iPhone devices through a basic pen-testing practice known as OS detection or OS fingerprinting. It seems that the difficulty level of identifying an iPhone device using nmap's criteria is a "trivial joke", namely, it's too easy to accomplish :"So, nmap 4.

July 30, 2008 by in Security

Newsletters

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
See All
See All

Top Stories