This week Troy Hunt wrote a piece where he called for disclosure by websites (and really all applications) of the password storage mechanism.His explanation of what this might change in terms of Internet security is great, and while this might not actually make applications more secure, I’m not sure that many companies would want to be forced to disclose they are storing passwords in plain text. Consumers are becoming more savvy and realize this is a poor way of managing systems and will quickly learn what are strong and no-so-strong algorithms.

A researcher warned that a weakness in an Oracle login system—used in the company’s databases which grant access to sensitive information—makes it trivial for attackers to crack user passwords and gain entry without authorization, Tthe problem stems from a session key the Oracle Database 11g Releases 1 and 2 sends to users each time they attempt to log on, according to Threatpost. The key leaks information about a cryptographic hash used to obscure the plaintext password. The hash, in turn, can be cracked using off-the-shelf hardware, free software, and a variety of attack methods that have grown increasingly powerful over the past decade. Proof-of-concept code exploiting the weakness can crack an eight-character alphabetic password in about five hours using standard CPUs.

Oracle engineers  corrected the problem in Oracle Database version 12 of the authentication protocol, but apparently they have no plans to fix it in version 11.1,  Even in version 12, the vulnerability isn’t removed until an administrator changes the configuration of a server to use only the new version of the authentication system. There are no overt signs when an outsider has targeted the weakness, the session key is sent whenever a remote user sends a few network packets or uses standard Oracle desktop software to contact the database server. All an attacker needs is a valid username on the system and a rudimentary background in password cracking.

The best way to prevent attacks that exploit the vulnerability is to install the patch and make the necessary configuration changes. Even those who continue to use vulnerable systems can take precautions that will go a long way. Passwords for all users should be randomly generated and contain a minimum of nine characters, although 13 or even 20 characters is better. The strategy here is to create a passcode that will take months or years to crack using brute-force methods, which systematically guess every possible combination of letters, numbers, and symbols.

To fix 163 issues a massive patch was recently published  to WebKit, an open source technology for rendering HTML used by iTunes and many other applications, including Safari, Google’s Chrome, and Yahoo Messenger.

The major incidents that have impacted users of the Mac OS X operating system target vulnerabilities in the Java platform.  The good news is Qualys did not find any issues that seemed particularly critical. 

The latest security update moves iTunes to version 10.7. The company announced on Wednesday that in October it would update the program with user interface changes to put the content front and center.

The most exploited attack vectors,areoutdated PDF readers and old Java installations.

Recent attacksfocused on exploiting Javae,g this month, , Oracle rushed out a patch to fix a flaw in the Java runtime environment that allows an attacker to take control of a Windows, Mac, or Linux system with no actions on the part of the user, aside from visiting a website with a Java-enabled browser. Earlier this year, the Flashback trojan infected some 600,000 Mac OS X systems using a vulnerability in Java.

Hackers got their hands on a database of 12 million Apple Unique Device Identifiers (UDIDs) apparently by hacking an FBI laptop.

 Why does an FBI agent have user identification information about 12 million iPhone users on his laptop? How did the FBI get their hands on this data in the first place?

FBI said, “The FBI is aware of published reports alleging that an FBI laptop was compromised and private data regarding Apple UDIDs was exposed. At this time there is no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data.”

Apple also denies giving the database to the FBI.

So form where did the database come from? And are there really 12 million, or only one million.  Lots of honeypot and conspirator speculations on the blogs about this.

another recent repoet is that Fingerprint-reading software preinstalled on laptops sold by Dell, Sony, and at least 14 other PC makers contains a serious weakness that makes it trivial for hackers with physical control of the machine to quickly recover account passwords, security researchers said.

The UPEK Protector Suite, which was acquired by Melbourne, Florida-based Authentec two years ago, is marketed as a secure means for logging into Windows computers using an owner’s unique fingerprint, rather than a user-memorized password. In reality, using the software seesm to make users less secure than they otherwise would be. When activated, the software writes Windows account passwords to the registry and encrypts those with a key that is easy for hackers to retrieve. Once the key is acquired, it takes seconds to decrypt the password.

Windows account passwords are stored in Windows registry almost in plain text, barely scrambled but not encrypted,  said an advisory issued by Elcomsoft, a Russia-based developer of password-cracking software. When Protector Suite isn’t activated, Windows doesn’t store account passwords in the registry unless users have specifically configured an account to automatically log in. Security experts have long counseled people not to use automatic login.

. The most obvious disadvantage is for those computers that have a Windows feature known as Encrypting File System enabled to prevent third parties from accessing sensitive files or folders. The key that unlocks that encrypted data is controlled by a Windows account password. Once the password is retrieved, the EFS-encrypted data stored on the computer can quickly be decrypted.

The account password could unlock other data that might otherwise be harder to obtain. The Windows Data Protection application programming interface, for example, is also closely tied to account passwords and controls access to credentials used by Outlook, Internet Explorer, and possibly other applications.

any time a PC is physically controlled by a hacker, its passwords are vulnerable to cracking attacks but without the use of the UPEK Protector Suite, hackers have access only to one-way password hashes, which, depending on the complexity of the underlying passcode, can take years or centuries to recover using brute-force methods. Use of the fingerprint software almsot guarantees the success of the cracking operation, and it can also significantly reduce the time it takes.

The easily cracked passwords are stored in the Windows registry even after the Protector Suite software has been deactivated, and it is only removed when a user manually deletes it. The precise registry location of the encrypted password is not yet known. .

Authentec no longer actively markets Protector Suite, but according to archived data from the UPEK website, the app ships—or used to ship—on laptops manufactured by 16 different companies. In addition to Dell and Acer, other PC makers include Amoi, Asus, Clevo, Compal, Dell, Gateway, IBM/Lenovo, Itronix, MPC, MSI, NEC, Sager, Samsung, Sony, and Toshiba.

Biometric readers are only as secure as the software that implements with those readers. That is why we sell hand punch readers with 13 bit encyrption.