New PGP key

I've created a new GPG key with KeyID 7861BC12. Synced to keyserver.ubuntu.com, pool.sks-keyservers.net, keyserver.pgp.com and keys.gnupg.net. It even includes a picture. You can get it here.
My old key (KeyID D0D0AEF6) has been set to expired.

Ny runde: Anonyme Spørreundersøkelser

[Spam eller på ekte? Faktisk vanskelig finne ut av...]

Kjære Eurocard. Jeg benytter meg av deres tjenester. Dere har noen glimrende sikkerhetsløsninger som jeg har brukt som "skoleeksempler" i flere foredrag, hvor brukervennlig sikkerhet har vært et viktig punkt. Der scorer dere høyt. Dessverre faller dere fullstendig igjennom når dere (?) sender ut undersøkelser som den jeg har mottatt, avbildet over.

Java patching i Norge

[Java. Du trenger ikke å like det, men du må dessverre ha det i Norge.]

Marie Moe i NorCERT er overrasket når Digi.no forteller henne at tall fra sikkerhetsselskapet Mnemonic viser at 78% har enda ikke oppgradert Java programvaren sin til nyeste versjon. Nyeste versjon anses sikker pr dags dato, i betydningen "Ingen offentlig kjente sårbarheter pr dags dato".

Hun burde ikke være overrasket.

Elcomsoft, UPEK & more

[That was one *awesome* passphrase! :-)]

Elcomsoft has announced that certain versions of fingerprint software named Protector Suite made by UPEK (now part of Authentec) stores your Windows password in a 'scrambled' format in registry. This allows an attacker through different entry points to get easy access to a users Windows password. I have no reason not to believe Elcomsoft in their claims, but UPEK/Autentec seriously disagrees. In the middle of this I happen to have some questions, and an opinion regarding biometric software today.

Spying on ex-employees & others using Computrace

[Hi, and welcome to 1984!]

The Norwegian Data Protection Authority (Datatilsynet) has strict guidelines on the use of tracking software & hardware enabling position tracking of people. Easily summarized: A user has to agree on being tracked (in writing), and can recall his/her consent at any given time. Consequences of not agreeing on being tracked may of course be denied access to the service in question, etc.

In Norway it has become pretty common that employees get to keep their laptop & smartphone when leaving a company due to downsizing. Enter the problematic world of asset tracking & inventory software hardcoded into your system BIOS.

Windows 8 Password Security

[Retro-style static boot splash graphic in Windows 8.]

I installed Windows 8 Consumer Preview (and some earlier versions as well) into a VM so that I could have a look for changes in password security. After quite a few screenshots etc from CP, I decided to wait for RTM, so that I wouldn't have to an entirely new one if there were major differences. I'm happy I did that. Lets take a look at what we get with Windows 8 in terms of password security.

Preliminary speaking schedule

Just a few links to conferences/events where I will be presenting during the next couple of months:

--
I will be speaking together with my friend Erlend Dyrnes about "social & mobile (in)security" in Haugesund (Norway) on Thursday, 8 August. Co-located with a subsea conference, this security conference is primarily targeted at companies within the Norwegian/international offshore/subsea operations market. Program and more info here: http://www.uop-sikkerhet.no/?page_id=159
--
I will be speaking at a breakfast seminar held by my employer EVRY in Grenland (Porsgrunn, Norway) on Thursday, 23 August. I will be focusing on mobile security issues here as well, with some legal concerns applicable specifically to Norway to top it off.
--
On September 3-5 it is once again time for the annual ISF autumn conference (Program info in Norwegian), where I will give my full story on what happened before and after the story appeared *everywhere*
--
...And I just might also appear at my employers annual EVRY INSIGHT conference in Tønsberg, September 19-20.
--
On September 26-27 the beautiful Hotel Alexandra in Loen will be the arena for the annual IT-forum conference. I will do a keynote there, with the conference using "BYOD - chaos or success?" as this years headline.
--
More to come - and then there's Passwords^12 in December!

----------------

And that was the not-so-important news today. Go Curiosity!

Vacation Observations

[Panorama view from mountain top near Puerto De Pollensa, Mallorca)

Ahh... Vacation.. Those days of the year where infosec professionals get some time to glimpse into another parallel world, by some... wifes... referred to as "the real world". Anyway; I like to take a look around, even when I go on vacation. Here's a few security observations made this summer.

The Final Word on the LinkedIn Leak

As you are undoubtedly aware of by now, two weeks ago the professional networking site LinkedIn became the victim of a rather unfortunate mishap: they sprung a little leak, and 6.4 million password hashes trickled out onto the internet. And in those two short weeks, hundreds of security experts the world over, all of various backgrounds whose hats range from white to black, have been feverishly clawing their way through that list in an attempt to crack all 6.4 million passwords. However, few have made more progress in their pursuit than my associate d3ad0ne and me.

Linkedin Password Infographic

[ Oh yeah, you can click it for *full* size! Free to use, please show credits. ] 

  
Jeremi Gosney (@jmgosney) have done a terrific job on cracking the Linkedin hashes. In fact, he has cracked some 90% of them now. So I asked Jeremi if I could ask one of my UX colleagues to try to make an infographic, he happily agreed. The result can be seeen in all its glory from the above supersize infographic (Print it if you like!)