The Urban Legend of Multipass Hard Disk Overwrite

It is "known" that to securely delete the data from the disk you need to write the data over the deleted blocks several times (different sources say from 3 to 35 times). But is this true?


The Urban Legend of Multipass Hard Disk Overwrite article will tell you what the state of things is as of now (well, of '2011).


The overall conclusion, I think, is "if you are paranoid, physical destruction of the disks is recommended".

Internet of Things strikes back

The Internet Of Things is another big hype around the corner. Or ... right in your room already, if you have one of those consumer devices, which are silently powered by general-purpose (or wide-spread proprietary specialized) operating system like Linux or that Cisco OS that powers all their products. The devices include network appliances, smart (and some "dumb") TV sets, and also surveillance cameras and DVRs.

And all those "things" are part of Internet, either by incident (due to misconfigured and overly opened networks) or intentionally. 

What happens if the hacker finds a way to one of those things, is described in this article. In the article the malware (bitcoin miner) was silently installed over Telnet port opened by default (and properly not blocked on the nearest router/NAT). And the miner is a small evil, comparing to what can happen if hackers get to camera recorder, disable recording and then join some robbers to rob the protected house.

Important new security extension

There was a new security extension introduced in RFC 7169. Please check it for details.

Hardware attacks are still more effective

An attack was taken on victims computers, but in quite unusual way - by physically breaking into victims' room and installing spyware on their computers from the offline medium. This appeared to be much simpler, than trying to hack into the computer remotely.

More on http://www.f-secure.com/weblog/archives/00002647.html

The end of cryptography?

I've just now come across the words by Adi Shamir (one of fathers of modern cryptography) in February when he said, that "cryptography is becoming less and less important". He explained that recent attacks successfully penetrated even the strongest barriers. And from this fact he concludes that cryptography is becoming less important.

This is an erroneous and misleading judgment, and it becomes even worse when it comes from the cryptography specialist. The most obvious conclusion which could have been made from the successful attacks would be that stronger barriers are needed. There's more significant problem to be addressed though - quality of defense.

Current software developers and system integrators don't pay much attention to overall quality and to security in particular. Businesses demand the shortest possible time-to-market and this of course contradicts the goal of obtaining proper security level. In addition there's a shortage in supply of developers and IT specialists on the market, and it's even harder to find security-aware software developers.

So the right conclusion must be "we must educate more security specialists and create a dedicated industry of digital security services". That's what I would expect to hear from any security-oriented person.