Archive for the ‘Security’ Category

McAfee’s Phoney Phishing

Tuesday, November 21st, 2006

McAfee has been forced to backtrack on claims that one of its products was misrepresented in a test of anti-phishing toolbars.

According to McAfee, last month’s Microsoft-sponsored report by researchers 3Sharp, which rated the software as poor at detecting phishing websites, was unfair because the version of SiteAdvisor assessed had never been designed to perform this function.

The company also said 3Sharp had refused to remove SiteAdvisor from the study, despite its requests to do so, resulting in the product receiving an embarrassingly low score of only 3 out of a possible 200.

At the time of the tests, SiteAdvisor was described on the company website as having phishing as one of its features. It also had a degree of anti-phishing capability before the company was acquired by McAfee in April this year. But it now appears that McAfee quietly removed or scaled back this capability without telling the world, generating confusion over its abilities.

Techworld.com - Security News - McAfee faces phoney phishing claims

That’s just entertaining - in a sad way *snickers* - but it begs to ask something almost entirely off the topic. Can vendor supported studies be trusted and - if not - who will pay for studies? Should they be trusted? Sure. There is a gaping maw between what should be and reality often times.

It is my opinion the majority of studies can be trusted when they come from third party non-biased groups even when sponsored by the vendor. What I feel probably can’t be trusted is the favorable spin then placed on those studies, the criteria studies are often forced to follow, and the resulting evidence being touted as proof.

Hackers Train Sights on Vista, Forefront

Monday, November 20th, 2006

Dark Reading - Desktop Security - Hackers Train Sights on Vista, Forefront - Security News Analysis

From the link:

Got a visual of hackers snickering at Microsoft’s Windows Vista and security tools and effortlessly hacking away at them from their workstations? Or, maybe of exhausted, caffeine-guzzling hackers pounding their fists in frustration at the newly fortressed Vista that has them locked out?

Either way, you’ve got the picture all wrong.

The article seems on target and to hint to the nature of security. No OS, browser, or network is secure. They never will be. Security is a process, not an application. It is an understanding of the risks and then a clear choice to accept those risks in order to accomplish your goals. You can try to minimize the potential risks, you can tweak and protect, you can update and upgrade, you can change software and hardware - and you can do all of those until you’re blue in the face. You’ll still be far from secure.

Security Vendor Settles Charges

Friday, November 17th, 2006

Guidance Software Inc., vendor of computer forensics and security products, has settled a complaint filed by the U.S. Federal Trade Commission (FTC), which accused it of failing to take reasonable security measures to protect sensitive computer data.

Security vendor settles charges after getting hacked - Network World

And then scroll down a bit:

The settlement prohibits the company from misrepresenting security measures in the future. The company will be subject to record-keeping and reporting provisions to allow the FTC to monitor compliance.

My question? Where’s the multimillion dollar fine?

Hacking Charges Pressed

Friday, November 17th, 2006

Prosecutors have alleged that Stevan Hoffacker, who worked for Source Media and its predecessor company from 1998 to 2003, hacked into the company’s e-mail network and sent e-mails to two Source Media employees in August and in September of this year, alerting them that they might lose their jobs. The messages were sent from a Yahoo account, according to court documents.

Read the Article from NewsFactor Network

Like bad seed politicians this is yet another black eye for IT. *sighs* It is good to see it prosecuted though.