Back in April during its Cloud Next 2019 developer conference, Google rolled out a feature that allows Android phones running Android 7.0 Nougat and up to act as Fast Identity Online (FIDO) security keys, enabling them to protect G Suite, Cloud Identity, and Google Cloud Platform accounts across Bluetooth-enabled Chrome OS, macOS, and Windows 10 devices.Google says that in the first month since launch, more than 100,000 people began using their phones as a security key, and that number is likely to climb in light of this week’s news: Today, security keys on Android phones can verify sign-ins on Apple iPads and iPhones.“Compromised credentials are one of the most common causes of security breaches,” wrote Google software engineer Kaiyu Yan and product manager of identity and security Christiaan Brand in a blog post.“While Google automatically blocks the majority of unauthorized sign-in attempts, adding two-step verification (2SV) considerably improves account security … [and now,] you can use your Android phone to verify your sign-in on Apple iPads and iPhones.”For the uninitiated, FIDO is a standard certified by the nonprofit FIDO Alliance that supports public key cryptography and multifactor authentication — specifically, the Universal Authentication Framework (UAF) and Universal Second Factor (U2F) protocols.During authentication, the device “proves possession” of the private key by prompting you to enter a PIN code or password, supply a fingerprint, or speak into a microphone.
On Bitcoin trades like Binance, BitMEX or facilitated Bitcoin wallets, for example, Coinbase or CEX?In the event that you don't have the foggiest idea, consider perusing this guide on private keys, and the MtGox hack.Here at Coinsutra, we don't expound on things that we have not actually utilized.Reinforcement and security highlights – Seed reinforcement keys and stick codes.Engineer people group – Active improvement network for support.Similarity – Compatible on various working frameworks.
Twitter is switching its security key-based two-factor authentication from the FIDO U2F standard it has used for nearly one year to the FIDO2 WebAuthn protocol.Software engineer Brian Wong said in a blog post that FIDO U2F only supported a limited number of browsers and authenticators, while WebAuthn has a wider range of support, complete with all of the phishing resistant capabilities that security key-based 2FA provides.He added that web authentication standard WebAuthn is approved by the World Wide Web Consortium and has already been adopted by other tech industry leaders.It enables strong browser-to-hardware-based authentication via devices including security keys, mobile phones and built-in authenticators such as Touch ID, exchanging user credentials using public key cryptography.WebAuthn is also supported by most modern browsers, including Chrome, Edge and Firefox.As of Thursday, WebAuthn is enabled by default, and it follows the same process people on Twitter used in the past when registering their security keys.
3
A Chinese software developer who previously expressed suicidal thoughts has been jailed after putting one of drone company DJI's AES private keys onto Github in plain text.That key, as we revealed at the time in January 2018, allowed world+dog to decrypt DJI's encrypted flight control firmware, paving the way for the curious and the malicious alike to bypass geofencing and other performance restrictions on their DJI drones.Also disclosed in plain text was a wildcard SSL key for *.dji.com, giving anyone with the right skills the ability to spoof DJI's website and decrypt encrypted comms between DJI drones and the company's own servers in China.Local Chinese-language reports indicated that the Shenzhen Municipal People's Procuratorate – the local version of the Crown Prosecution Service – successfully prosecuted the developer in early April, before the Shenzhen District Court.One summary said: “The employee was sentenced to six months in prison for infringement of trade secrets.The penalty is 200,000 yuan" (just under £23,000).
5
So long as cryptocurrency exists, so too will the extraordinary lengths to which thieves will go to try to steal it.Unfortunately, that also includes preying on weak private keys, a method that has evidently made one crypto bandit filthy rich with millions in swiped Ethereum.This was the accidental discovery made by security experts with the firm Independent Security Evaluators while performing an assessment for a cryptocurrency client.They examined a number of weak private keys—beginning with the stupidly simple key of 0x01—and discovered on the blockchain that its associated wallet had been emptied, as was the case with hundreds of similarly simple keys.In order to see how quickly their bandit was working, they sent the equivalent of a dollar’s worth of the cryptocurrency to the address associated with one of these weak private keys and found that the bandit instantly sent it to another account.By managing to swipe Ethereum using these guessable weak keys, the bandit—or, possibly, a group—managed to amass a fortune.
There’s a blockchain bandit on the loose – and they’ve already thieved over $6.1 million worth of Ethereum.According to a report published by security consulting firm Independent Security Evaluators (ISE), an unknown entity has been bypassing weak private keys to swipe large amounts of Ether.The findings show that during last year’s price rally, the stolen funds amounted to over $54 million (roughly 38,000 ETH).As part of its investigation, ISE looked at several weak private keys, starting with simple key combinations and soon realised that associated wallets had been funnelled.To determine the speed at which the thief was working at, researchers sent $1 in ETH to the address linked to one of the weak private keys and realised that it was “instantly” sent to another account.“We discovered that funds from these weak-key addresses are being pilfered and sent to a destination address belonging to an individual or group that is running active campaigns to compromise/gather private keys and obtain these funds,” said the researchers.
4
But he started instead with the simplest of questions: What if an Ethereum owner stored their digital money with a private key—the unguessable, 78-digit string of numbers that protects the currency stashed at a certain address—that had a value of 1?But the cash had already been taken out of the Ethereum wallet that used it—almost certainly by a thief who had thought to guess a private key of 1 long before Bednarek had.So he and his colleagues at the security consultant Internet Security Evaluators wrote some code, fired up some cloud servers, and tried a few dozen billion more.A single Ethereum account seems to have siphoned off a fortune of 45,000 ether—worth at one point more than $50 million—using those same key-guessing tricks."Whoever this guy or these guys are, they're spending a lot of computing time sniffing for new wallets, watching every transaction, and seeing if they have the key to them."To explain how that blockchain banditry works, it helps to understand that the the odds of guessing a randomly generated Ethereum private key is 1 in 115 quattuorvigintillion.
6
If you own cryptocurrencies, chances are they’re sitting on an exchange, such as Coinbase or Binance.If somebody manages to log in to your account, nothing is stopping them from sending those assets to other wallets and stealing everything.In other words, leaving your cryptocurrencies on an exchange means you give your assets to that exchange and hope they properly take care of them.And if you don’t follow instructions properly, you might end up losing access to your wallet or accidentally sharing private keys.Former TechCrunch editor Ouriel Ohayon and his team think the perfect wallet app involves a smartphone you own paired with ZenGo’s servers.The company uses threshold signatures, which means that you need both ZenGo’s servers and your smartphone to initiate a transaction.
As a result, many email accounts have been hacked, including such high profile cases as the phishing attack on Hillary Clinton's top campaign advisor John Podesta and the 2016 email hack of one of Vladimir Putin's top aides.The team--Professors Jason Nieh and Steve Bellovin and their PhD student John S. Koh--presented its study today at EuroSys '19 in Dresden, Germany, one of the world's top forums focused on computer systems software research and development."Email privacy grows ever more critical as our email inboxes increase in size," notes Koh, the paper's lead author."Thanks to free and widely popular mail services like Gmail, users are keeping more and more emails, thus providing a one-stop shop for hackers who can compromise all of a user's emails with a single successful attack."Ever since 1999, when the seminal "Why Johnny Can't Encrypt" paper showed how extraordinarily hard it was for people to send encrypted email, researchers have been trying to design encryption systems that are easier for the average user to manage.While these solutions certainly work and offer the most security, PGP and S/MIME, the encryption solutions most favored by experts, are so complex that they are impractical, almost unusable, for a non-technical user.
With the advent of blockchain technology, development of cryptocurrency wallets came into operations.Cryptocurrency wallet helps people store private and public keys which enables them to receive and send cryptocurrency with just the press of a button.Third party custodian looks after these private keys and saves them for the future.Custodial wallets come integrated with San Francisco-based cryptocurrency exchange and Hong Kong-based Bitfinex platforms and do not need to resort if the users need to use them.Software wallets are available in three formats and provide a myriad of options to the users:Desktop Wallets: First and foremost reason for using a desktop wallet is mainly because they can be easily stored in a laptop or a PC. Read Full Blog Here
A co-founder of cybersecurity company RSA who also co-developed its public key cryptography algorithm couldn't make it to the RSA Conference in San Francisco this year.It seems he couldn't get a visa from the US government.In a video message played at the major cybersecurity gathering, Israeli cryptography expert Adi Shamir -- the "S" in RSA -- said he hadn't received a response to his request for a tourist visa, despite having applied two months ago.Shamir also suggested that if he, a well-known and award-winning security expert, couldn't get a US visa, then it might be time to rethink where scientific conferences are held.Shamir is the Borman Professor of Computer Science at Israel's Weizmann Institute.He's well-known for his work on the RSA cryptosystem as well as identity-based cryptography.
The Federal Communications Commission will consider "regulatory intervention" if major phone companies fail to adopt a new anti-robocall technology this year.Most major providers have committed to doing so, but Pai issued a warning to laggards yesterday."I applaud those companies that have committed to deploy the SHAKEN/STIR framework in 2019," Pai said in his statement yesterday.If it appears major carriers won't meet the deadline to get this done this year, the FCC will have to consider regulatory intervention.""STIR and SHAKEN use digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure," telecom software provider TransNexus explains.The certificate technology enables the called party to verify that the calling number is accurate and has not been spoofed."
Blockchain is meant to be secure – but a new paper from quantum computing scientists warns that quickly advancing quantum technology poses a vulnerability for the much-hyped blockchain.But quantum computers may soon have the ability to break its codes.They’re only protected by public key cryptography, whereas banking has human tellers, plastic cards, and ATMs.Quantum computers are simply a new kind of computer processor whose quantum bits, or qubits, can take on values between zero and one during the calculation and interact with all the mathematics of regular computers, plus new operations based on the physics of subatomic particles.Data is normally encrypted using one-way functions, an operation such that it’s easy to combine two inputs but difficult to untangle them.Computers can generate a code by performing the easy task of multiplying large prime numbers, but computers have difficulty factoring large numbers into primes without having some information about what went in.
Simply placing a password on files won’t always do – as you’d need a way of sending the password to the recipient securely in the first place!This is especially useful when you want to share files that are too large to email.The specific steps you need to follow plus the strength of the encryption used will vary depending on the piece of software in question.You will of course need a way to send the password to the recipient securely after sending the file.PGP and GPG are two programs which make use of public key cryptography to send files securely.The easiest way is probably to install the cross-platform email client Mozilla Thunderbird, then use the free add-on Enigmail which has a handy step-by-step wizard.
A major dust-up on an Internet discussion forum is touching off troubling questions about the security of some browser-trusted HTTPS certificates when it revealed the CEO of a certificate reseller emailed a partner the sensitive private keys for 23,000 TLS certificates.The email was sent on Tuesday by the CEO of Trustico, a UK-based reseller of TLS certificates issued by the browser-trusted certificate authorities Comodo and, until recently, Symantec.It was sent to Jeremy Rowley, an executive vice president at DigiCert, a certificate authority that acquired Symantec's certificate issuance business after Symantec was caught flouting binding industry rules, prompting Google to distrust Symantec certificates in its Chrome browser.In communications earlier this month, Trustico notified DigiCert that 50,000 Symantec-issued certificates Trustico had resold should be mass revoked because of security concerns.When Rowley asked for proof the certificates were compromised, the Trustico CEO emailed the private keys of 23,000 certificates, according to an account posted to a Mozilla security policy forum.The report produced a collective gasp among many security practitioners who said it demonstrated a shockingly cavalier treatment of the digital certificates that form one of the most basic foundations of website security.
A study by web security expert Scott Helme, published on Tuesday, found that HTTPS adoption by the web's most-visited sites had grown more than 7 percentage points from 30.8 per cent over the last sixth months since October 2017.Helme's latest biannual web security sitrep threw up the surprising finding that a security technology Google decided to depreciate last October has risen, not shrunk, in popularity."The most surprising thing is probably the string growth in HPKP [HTTP public key pinning], a technology being abandoned by many and soon Google Chrome too," Helme told El Reg.Google said it was abandoning HPKP, a next-generation web crypto technology it initially championed, back in October, as previously reported.Experts including Helme and Ivan Ristic have criticised the technology as being both tricky to apply and potentially calamitous, if incorrectly set up.Fast forward four months and Helme has found that larger sites are less likely to use HPKP, the reverse of the trend for every other metric.
Public-key encryption protocols are complicated, and in computer networks, they're executed by software.But that won't work in the internet of things, an envisioned network that would connect many different sensors - embedded in vehicles, appliances, civil structures, manufacturing equipment, and even livestock tags - to online servers.Embedded sensors that need to maximize battery life can't afford the energy and memory space that software execution of encryption protocols would require.It also uses about 1/10 as much memory and executes 500 times faster.The researchers describe the chip in a paper they're presenting this week at the International Solid-State Circuits Conference.In the past, researchers - including the same MIT group that developed the new chip - have built chips hardwired to handle specific elliptic curves or families of curves.
Now, Google has come up with an innovative approach to deal with such threats.The tech giant says that it can protect its high-risk users, who are likely to be targeted by cybercriminals, with a physical key that locks down their accounts like never before.The keys function as a more secure version of two-factor authentication and make use of "public-key cryptography and digital signatures" to authenticate the legitimacy of the account holder.The additional layer of security provided by the physical keys ensure that malicious hackers are blocked from accessing vulnerable users' accounts, even if they possess the users' passwords."Even for people with very limited technology chops, this is a way for them to have an extremely protected profile."Although traditional two-factor authentication measures are generally considered to provide enough protection against most attacks, in some cases, they may not be enough.
CD: All organizations rely on SSH as an encrypted protocol to authenticate privileged users, establish trusted access and connect administrators and machines.SSH use spans many critical systems, including application servers, routers, firewalls, virtual machines, cloud instances, and many other devices and systems.Collectively, the number of systems using SSH can be extensive.Included in this number are many systems that use SSH in automated applications and scripts without human input or review.CD: Without SSH, remote access would be conducted over unsecured networks, exposing an organization’s most critical systems and data.Without the safeguards of SSH, attackers can more easily intercept sensitive communications or impersonate a trusted system to gain access.
Hardly a week goes by without a high-profile hacking story, and now Google is launching a new security system for those who take their data really, really seriously.The Google Advanced Protection Program builds on the company’s existing two-factor authentication with a more stringent system.Despite the target audience, though, there’s some good news for the rest of us.As Google explains it, Advanced Protection is designed for those who might be a more alluring target for hackers for one reason or another, and who “are willing to trade off a bit of convenience for more protection of their personal Google Accounts.” It uses USB security keys, with digital signatures and public-key cryptography.If you want access to your account, you’ll need to plug your security key in first.Right now, Gmail and Drive access will be solely limited to Google apps, though the company says that it does expect to expand on that in the future.
More

Top