Gmail takes the lead on email security: Via EFF.org Updates.

Last night, Google announced that Gmail sessions will now be fully encrypted with HTTPS by default. This is excellent news — EFF congratulates Google for taking this significant step to safeguard their users' privacy and security.

Previously, it was possible to encrypt your access to Gmail, but it required altering the default configuration. Now every Gmail user will get the benefits of encryption without needing to know that they need it.

With this development, Google has taken a clear two-step lead over its competition: other major hubs for personal communication such as Facebook, Yahoo! mail, Hotmail, and LiveJournal do not even make the use of HTTPS possible, let alone the default. A handful of smaller, specialist webmail providers do offer HTTPS, but Google is alone in bringing basic email security to the mainstream Web. [ Read more ... ]

Google Turns on Gmail Encryption to Protect Wi-Fi Users: Via Threat Level.

Google is now encrypting all Gmail traffic from its servers to its users in a bid to foil sniffers who sit in cafes, eavesdropping in on traffic passing by, the company announced Wednesday.

The change comes just a day after the company announced it might pull its offices from China after discovering concerted attempts to break into Gmail accounts of human rights activists. The switch to always-on HTTPS adds more security, but does not help prevent the kind of attacks Google announced Tuesday.

All Gmail users will now default to using HTTPS, the secure, encrypted method for communicating with a remote server, for their entire e-mail sessions, not just for log-in. Session-long HTTPS has been an official option for Gmail users since 2008 (and unofficial for much longer), but Google says it [ Read more ... ]

More flash drive firms warn of security flaw; NIST investigates: Via Computerworld Security News.

The drives were certified to meet NIST standards

SanDisk Corp. and Verbatim Corp. have joined Kingston Technology Inc. in warning customers about a potential security threat posed by a flaw in the hardware-based AES 256-bit encryption on their USB flash drives.

The hole could allow unauthorized access to encrypted data on a USB flash drive by circumventing the password authorization software on a host computer.

"It's really onerous. It's a stupid crypto mistake and they screwed up, and they should be rightfully embarrassed for making it," said cryptographer and computer security specialist Bruce Schneier. [ Read more ... ]

Hackers show it's easy to snoop on a GSM call: Via Computerworld Security News.

Computer security researchers say that the GSM phones used by the majority of the world's mobile-phone users can be listened in on with just a few thousand dollars worth of hardware and some free open-source tools.

In a presentation given Sunday at the Chaos Communication Conference in Berlin, researcher Karsten Nohl said that he had compiled 2 terabytes worth of data -- cracking tables that can be used as a kind of reverse phone-book to determine the encryption key used to secure a GSM (Global System for Mobile communications) telephone conversation or text message.

While Nohl stopped short of releasing a GSM-cracking device -- that would be illegal in many countries, including the U.S. -- he said he divulged information that has been common knowledge in academic circles and made it "practically useable." [ Read more ... ]

Predator drones use less encryption than your TV, DVDs: Via Law & Disorder Section - Ars Technica.

What three-letter Internet acronym best fits the bizarre news out of Iraq and Afghanistan that militants there have been intercepting US Predator drone video feeds using laptops and a $30 piece of Russian software: LOL, WTF, or OMG? [ Read more ... ]

"Evil Maid" Attacks on Encrypted Hard Drives: Via Schneier on Security.

Earlier this month, Joanna Rutkowska implemented the "evil maid" attack against TrueCrypt. The same kind of attack should work against any whole-disk encryption, including PGP Disk and BitLocker. Basically, the attack works like this:

Step 1: Attacker gains access to your shut-down computer and boots it from a separate volume. The attacker writes a hacked bootloader onto your system, then shuts it down.

Step 2: You boot your computer using the attacker's hacked bootloader, entering your encryption key. Once the disk is unlocked, the hacked bootloader does its mischief. It might install malware to capture the key and send it over the Internet somewhere, or store it in some location on the disk to be retrieved later, or whatever. [ Read more ... ]

US healthcare data plan slammed for encryption get-out clause: Via The Register(UK).

New data breach rules for US healthcare providers have come under criticism from a security firm that specialises in encryption.

As part of the Health Information Technology for Economic and Clinical Health (HITECH) Act, which comes into effect from 23 September, health organisations in the US that use encryption will no longer be obliged to notify clients of breaches.

More specifically (as explained here - PDF) only HIPAA-covered healthcare providers and health plans that omit the use of encryption or information destruction will be obliged to notify individuals about a breach of their personal health information. [ Read more ... ]

Apple betrays the iPhone's business hopes by InfoWorld: Yahoo! Tech: Via InfoWorld: Yahoo! Tech.

Thousands of users have been accessing e-mail, calendars, and contacts over Exchange connections through their iPhones or iPod Touches, not knowing they were compromising their corporate security. During that entire time, Apple has extolled its support of Exchange and convinced many businesses that the iPhone was a corporate-class device they should embrace or, at least, tolerate.

It also turns out that Apple had a similar issue -- with a similarly stealthy fix -- in its iPhone OS 3.0 update, which corrected misreporting about its VPN policy support. [ Read more ... ]

HHS’ New Harm Standard for Breach Notification: Via CDT - PolicyBeta.

In late August, the Dept. of Health and Human Services (HHS) released an interim final rule on health data breach notification. Through the rule, HHS establishes data security standards that HHS believes are strong enough to eliminate the need to notify consumers of a data breach. That is, if a health care entity applies one of these security processes to its data, and then that data is lost or otherwise breached, the entity does not have to inform patients. Some of the rule’s security processes are quite good, such as strong encryption standards. Unfortunately, however, HHS packed an overly broad and unreliable standard in with the good ones: the “harm standard.”

(CDT had issued comments to the HHS rulemaking in May 09. For more information about the interim final rule and CDT’s comments, please see our earlier blog post.) [ Read more ... ]

One-minute WiFi crack puts further pressure on WPA: Via Law & Disorder Section - Ars Technica.

Researchers have come a step closer to breaking open a common WiFi encryption scheme. An attacker can now read and falsify short packets in the common TKIP version of WiFi Protected Access (WPA) encryption in about one minute—a huge speed increase from the previously-required 12-15 minutes. [ Read more ... ]

Laptop Security while Crossing Borders: Via Schneier on Security.

Last year, I wrote about the increasing propensity for governments, including the U.S. and Great Britain, to search the contents of people's laptops at customs. What we know is still based on anecdote, as no country has clarified the rules about what their customs officers are and are not allowed to do, and what rights people have.

Companies and individuals have dealt with this problem in several ways, from keeping sensitive data off laptops traveling internationally, to storing the data -- encrypted, of course -- on websites and then downloading it at the destination. I have never liked either solution. I do a lot of work on the road, and need to carry all sorts of data with me all the time. It's a lot of data, and downloading it can take a long time. Also, I like to work on long international flights.

There's another solution, one that works with whole-disk encryption products like PGP Disk (I'm on PGP's advisory board), TrueCrypt, and BitLocker: Encrypt the data to a key you don't know. [ Read more ... ]

Will security firms detect police spyware? | CNET News.com: "A recent federal court decision raises the question of whether antivirus companies may intentionally overlook spyware that is secretly placed on computers by police.

In the case decided earlier this month by the 9th U.S. Circuit Court of Appeals, federal agents used spyware with a keystroke logger--call it fedware--to record the typing of a suspected Ecstasy manufacturer who used encryption to thwart the police.

A CNET News.com survey of 13 leading antispyware vendors found that not one company acknowledged cooperating unofficially with government agencies. Some, however, indicated that they would not alert customers to the presence of fedware if they were ordered by a court to remain quiet. [ Read more ... ]

Encryption vendor claims AACS infringes its patents, sues Sony:Canadian encryption vendor Certicom yesterday filed a wide-ranging lawsuit against Sony, claiming that many of the products offered by the electronics giant infringe on two Certicom patents. This might sound like business as usual until you realize what's being targeted: AACS and (by extension) the PlayStation 3.

Certicom has done extensive work in elliptic curve cryptography (ECC), and the patents in question build on this work. The patents have already been licensed by groups like the US National Security Agency, which paid $25 million back in 2003 for the right to use 26 Certicom patents, including the two in the Sony case. [ Read more ... ]

New AACS cracks cannot be revoked, says hacker: "In addition to being irrevocable, the hack has the potential to make future decryption even easier. 'This hack/technique enables us to figure out how the Volume ID is stored on the disc,' arnezami explained. 'It's very possible we would figure out [...] how the KCD is stored on the disc. Knowing that and being able to teach a PC drive how to read a KCD will open the door for what I called third-generation decryption.' [ Read more ... ]

Cracked HD-DVD and Blu-Ray app keys revoked: "

Disavowed

A next-generation DVD security group has responded to hack attacks that allow unfettered access to Blu-Ray and HD-DVD content by pulling the encryption keys of PC applications associated with the attack.

The move makes it impossible to play newly released high-definition movies via versions of playback software, including versions of Intervideo WinDVD 8, known to be weak or flawed.

WinDVD 8 users need to update their software, closing the security hole and obtaining fresh encryption keys in the process. [ Read more ... ]

Why Encryption Didn't Save TJX: "TJX: It's the target of the largest known customer record theft of all time, and it's a case in point that encryption is not a silver bullet.

This is the heart of the encryption problem, quoted from the 10-K filing The TJX Companies made to the Securities and Exchange Commission:

'Despite our masking and encryption practices on our Framingham system in 2006, the technology utilized in the Computer Intrusion during 2006 could have enabled the Intruder to steal payment card data from our Framingham system during the payment card issuer's approval process, in which data (including the track 2 data) is transmitted to payment card issuer's without encryption. Further, we believe that the Intruder had access to the decryption tool for the encryption software utilized by TJX.' [ Read more ... ]