Read up on the latest ideas and technologies from companies that sell hardware, software and services. Best Practice in Building an Integrated Information Management Strategy
Choices in Storage Architecture for Oracle Environments
Did you GET the memo? Getting you from Web 1.0 to Web 2.0 Security
Revolutionising Back-up and Recovery
Radicati Market Quadrant 2008 on Corporate Web Security
Email Archiving Implementation: Five Costly Mistakes to Avoid
Optimized Back-up and Recovery for VMWare for VMWare Infrastructure with EMC Avamar
Understanding Email Marketing: A Guide for SMBs
Zones provide focussed content from Computerworld and leading technology partners.Newsletter Subscription
SafeWeb Inc., a developer of online privacy technology used by consumers, political dissidents and government agencies, including the CIA, last week said there are security gaps in its software that could put the identities of users at risk.
The flaws, discovered by David Martin, a computer science professor at Boston University, and Andrew Schulman, a researcher at the Privacy Foundation in Denver, stem from the way the SafeWeb software handles JavaScript and its use of master cookies, which store cookie information from multiple sites. Using a series of attacks, the researchers showed how they were able to trick a Web browser into divulging a user's IP address and cookie information, and they also installed spyware for the duration of the SafeWeb session.
"We have found that the SafeWeb service is seriously and fundamentally flawed," said Schulman. "We're not talking about a few implementation errors or imperfections. Our paper documents spectacular failures of the service, based on extremely simple attacks."
Computerworld's investigation into Schulman and Martin's study ignited a series of e-mail exchanges between the researchers and executives at Emeryville, Calif.-based SafeWeb and prompted the company to issue a statement Feb. 13 in which it acknowledged the security flaws.
SafeWeb was aware of the problems as early as last year, said co-founder and CEO Stephen Hsu, but the company decided not to develop patches after abandoning its consumer business and licensing its technology to Los Angeles-based PrivaSec LLC in August.
In a statement, PrivaSec CEO Geoffrey Riggs acknowledged that "there are certain vulnerabilities to SafeWeb and SurfSecure secure surfing technology" and added that the company is working to develop patches. However, PrivaSec claims that the "likelihood of such an attack on a user living in a free, non-politically-repressed society is relatively low."
Martin characterized PrivaSec's explanation as security through obscurity. "Frankly, I can't think of any other security system that is considered secure by nature of it being unlikely to be attacked," he said.
SafeWeb is used by thousands of politically oppressed people around the world to shield their Web activities.
Computerworld Member Login
Prioritizing Services with IT Service Management (ITSM)
Computerworld Live Webinar
Wednesday 20th, August 2008
11:00am EST (Sydney, Australia)
To be repeated on:
Thursday 4th, September 2008
11:00am EST (Sydney Australia)
Sign up and receive a free copy of The Forrester WaveTM Service Desk Management Tools, Q2 2008 at the conclusion of the Webinar.
Attend and discover:
- How to deliver value to your business through ITSM
- Best practice ITSM implementation
- Why emphasis is changing from optimizing IT management processes to better servicing customers and demonstrating real dollar value
- If service-oriented ITSM is best for your business
- +
Computerworld Live Podcast #97: The Future of Enterprise Networking 25/07/2008 09:45:36
This week CW Live chats with Mark Thompson, global sales and marketing manager for HP ProCurve, on the future of the enterprise networking. Mark discusses the trends we can expect to see in the near future and how the right infrastructure can ensure your enterprise network is secure. - +
Computerworld Live Podcast #96: Security at the Edge 11/06/2008 09:22:22
CW Live speaks with Amol Mitra, HP ProCurve Director of Marketing for Asia Pacific and Japan. Today's topic: how enterprises are starting to shift away from simply controlling security via server logins, firewalls and moving to more adaptive security frameworks. - +
Data Management Edition #10: Multi-Petascale Systems 02/05/2008 09:12:33
This week we look at sustainability and the development of multicore technologies to build multi-petascale systems. - +
IT Security Edition #11: How to poison the Storm botnet 01/05/2008 08:51:55
This week CW Live presents a case study on how to poison the notorious Storm botnet . Plus we take a look at Cisco's plans for Ironport. - +
IT Security Edition #10: Cyber-battles fought and won 24/04/2008 11:09:47
Vendors bow to end user pressure to improve product security, and we take a look at the latest concepts shaping the cyber-battlefield of the future.
Viva la Verticals! Key to Vendor Growth is Through Vertical Market Opportunities, Says IDC 2008-09-05 11:05:00+10
F-Secure delivers fastest protection in the online world 2008-09-04 16:50:00+10
NETGEAR expands ProSafe team as business-class products take off in SME market 2008-09-04 16:27:00+10
Rogue security apps dominate Fortinet's Aug 2008 IT threat report 2008-09-04 16:00:00+10
Adaptec Intelligent Power Management Reduces Storage Power Consumption Up to 70 Percent 2008-09-04 11:28:00+10
Web Security SaaS: The Next Generation of Web Security
Discover the latest web security SaaS solutions. Learn how to increase overall security effectiveness and reduce the burden on your IT department. Uncover the security challenges facing SMB environments today and identify the critical elements that can provide you with lower-cost and easier-to-manage web security solutions.
