By Dan Cornell If you have been following these posts you know that the OWASP EU Summit in Portugal was an exhilarating, but exhausting, week - lots of work, lots of play and much was accomplished.  So you would think that it would make sense to relax on Saturday, get some rest and be up early...

By Dan Cornell This week I'm in Portugal at the OWASP EU Summit '08. Just after I arrived on Monday I had the opportunity to talk about AJAX security and sprajax to a group of students at the 1 day OWASP event at the University of Algarve.  The slide deck was a shortened version of the...

By Erhan K. The CAPTCHA (a convoluted acronym for "Completely Automated Turing Test To Tell Computers and Humans Apart") has become quite popular in the earlier part of the decade, coinciding with the rise of email spam and script dictionary attacks. The CAPTCHA's original purpose was to a...

By Dan Cornell There has been a rising concern as of late about potential security issues related to backdoor functionality included in processors.  This is predominantly a concern about state actors compromising products that are then exported to other nations.  Bruce Schneier posted earl...

By Dan Cornell UTSA's Center for Infrastructure Assurance and Security (CIAS) put on the National Collegiate Cyber Defense Competition this weekend and I had the distinct honor of being a White Team member on Sunday.  Other Denim Group folks who were also on the White Team at various times duri...

By Dan Cornell Reading through the news I noticed that Barack Obama's passport records were improperly accessed by three contract workers for the State Department.  What I thought was interesting was an excerpt toward the end of the article: The officials said that when a prominent person's pas...

By Kevin W According to this headline, there is a "new" attack that will allow one to "Hack into a Windows PC—no password needed". Basically, some guy created a tool that takes advantage of auto-execute features in Windows and the innate memory usage of Firewire.  Plug the...

By Dan Cornell There has been some hubbub as of late about some ominous involvement of NSA with NIST standards on random number generation - specifically that NSA pushed the DUAL_EC_DRBG algorithm even though it performs relatively slowly and may potentially contain a backdoor. Bruce Schneier says: ...