Press Release: Passwords^12

World's best password hackers gather in Oslo, Dec 3-5

Bergen/Oslo, 27. November 2012
The world's best password hackers gather in Oslo on December 3-5 to speak & participate at Passwords^12, a 3-day conference ONLY about passwords & PIN codes. This is the first and only conference dedicated to research in an area that affects us all on a daily basis. The conference brings together an "all-star" team of international researchers, hackers, and security professionals. The conference aims to increase security, while simultaneously keeping and improving usability aspects for everyday users.

Pressemelding: Passwords^12

Verdens beste passordhackere samles i Oslo 3-5 desember

Bergen/Oslo, 27. november 2012
Verdens beste passordhackere samles i Oslo 3-5 desember for å delta på Passwords^12, en 3 dagers konferanse utelukkende om passord og PIN koder. Dette er verdens første og eneste konferanse som er dedikert til forskning på et fagområde som vi alle påvirkes av daglig. Konferansen bringer sammen et stjernelag av internasjonale forskere, hackere og sikkerhetsspesialister. Konferansen har en klar målsetning om å bidra til en sikrere og enklere hverdag for oss alle.

Sikker tilgang til offentlige data

[Hvorfor sensurere eller kryptere? Det er offentlig tilgjengelig...]

Oppdatert 4. April 2013: Gule Sider / Eniro har forlengst fikset SSL og oppdatert sine apper. Stor takk til dem for rask respons på min kontakt + bloggpost.

Denne er til deg Eivind, selv om jeg tror andre vil finne dette interessant også. Du spurte meg tidligere om jeg/vi (www.vsc.no) hadde sett nærmere på sikkerheten i de mest populære appene. Vi har sett på en del taxi apper, og resultatet presenteres på DND medlemsmøte i Bergen den 20 November. (Presentasjon derfra vil bli gjort tilgjengelig i etterkant.)

Jeg installerte Gule Sider appen for Android på min Samsung Galaxy SII for kort tid siden, og ble litt nysgjerrig på den. Litt pakkesniffing, litt lesing på nett og litt sammenligning mot andre, og her er noen enkle observasjoner, risiko og anbefalinger:

Analysis of the Punto.pe Leak

That extremely frustrated feeling you get when you cannot crack 50% of a moderately large leak within minutes. When rockyou.txt only nets you 6,124 plains. When 1.2 billion words + 40,000 rules results in a paltry 24,000 plains. Oh, that frustrated feeling.

And let's not forget that "you have to be freaking kidding me" feeling you get when you realize that the dump you have been working with for 26 hours actually contains plaintext passwords for 70% of the hashes -- after you've already busted your ass to crack 81% of them. A mistake easily made when you hastily extract only the hashes from a dump, without bothering to look at the rest of the data.

Rosing IT Security Award finalist 2012

[Oh yeah, you can zoom in on it!]

This is my proof of being not only nominated, but also ending up as one of three finalists for the Rosing IT Security Award in 2012, presented by the Norwegian Computer Society. On Thursday Oct 18 the winner was announced at their annual conference, with Gjøvik University College (HiG) as the winner. Very few individuals has been nominated for the award since its inception in 2002, and I am incredibly proud to be one of them. I am also very happy to congratulate all the excellent people I know there; Christoph, Tone, Morten, Patrick, Kirsi, Nils and others as well. I really look forward to our continued cooperation!

Criteria for the award (Google translated text):
The prize will be awarded to businesses in Norway, or in special occasions to individuals. The receiver will in a positive way - directly or indirectly - have contributed to increased information security and IT security. The contribution may be through dissemination, training or awareness-raising activities, by promoting innovative thinking or to have developed and implemented appropriate methods, standards, concepts, technologies or services that have provided great merits - or otherwise have contributed to this.

New PGP key

I've created a new GPG key with KeyID 7861BC12. Synced to keyserver.ubuntu.com, pool.sks-keyservers.net, keyserver.pgp.com and keys.gnupg.net. It even includes a picture. You can get it here.
My old key (KeyID D0D0AEF6) has been set to expired.

Ny runde: Anonyme Spørreundersøkelser

[Spam eller på ekte? Faktisk vanskelig finne ut av...]

Kjære Eurocard. Jeg benytter meg av deres tjenester. Dere har noen glimrende sikkerhetsløsninger som jeg har brukt som "skoleeksempler" i flere foredrag, hvor brukervennlig sikkerhet har vært et viktig punkt. Der scorer dere høyt. Dessverre faller dere fullstendig igjennom når dere (?) sender ut undersøkelser som den jeg har mottatt, avbildet over.

Java patching i Norge

[Java. Du trenger ikke å like det, men du må dessverre ha det i Norge.]

Marie Moe i NorCERT er overrasket når Digi.no forteller henne at tall fra sikkerhetsselskapet Mnemonic viser at 78% har enda ikke oppgradert Java programvaren sin til nyeste versjon. Nyeste versjon anses sikker pr dags dato, i betydningen "Ingen offentlig kjente sårbarheter pr dags dato".

Hun burde ikke være overrasket.

Elcomsoft, UPEK & more

[That was one *awesome* passphrase! :-)]

Elcomsoft has announced that certain versions of fingerprint software named Protector Suite made by UPEK (now part of Authentec) stores your Windows password in a 'scrambled' format in registry. This allows an attacker through different entry points to get easy access to a users Windows password. I have no reason not to believe Elcomsoft in their claims, but UPEK/Autentec seriously disagrees. In the middle of this I happen to have some questions, and an opinion regarding biometric software today.

Spying on ex-employees & others using Computrace

[Hi, and welcome to 1984!]

The Norwegian Data Protection Authority (Datatilsynet) has strict guidelines on the use of tracking software & hardware enabling position tracking of people. Easily summarized: A user has to agree on being tracked (in writing), and can recall his/her consent at any given time. Consequences of not agreeing on being tracked may of course be denied access to the service in question, etc.

In Norway it has become pretty common that employees get to keep their laptop & smartphone when leaving a company due to downsizing. Enter the problematic world of asset tracking & inventory software hardcoded into your system BIOS.