George C. Dimitriou

The Internet Crime Complaint Center (IC3), a partnership between the FBI and the National White Collar Crime Center (NW3C), released the 2009 annual report about fraudulent activity on the Internet.

Online crime complaints increased substantially once again last year, according to the report. The IC3 received a total of 336,655 complaints, a 22.3 percent increase from 2008. The total loss linked to online fraud was $559.7 million; this is up from $265 million in 2008.

The 2009 Internet Crime Report details information related to the volume and scope of complaints, complainant and perpetrator characteristics, geographical data, most frequently reported scams and results of IC3 referrals.

The report is posted in its entirety on the IC3 website.

Is your browser configuration rare or unique? If so, web sites may be able to track you, even if you limit or disable cookies.

Panopticlick, a research project of the Electronic Frontier Foundation tests your browser to see how unique it is based on the information it will share with sites it visits.

Imperva, a Data Security firm, announced today the release of study analyzing 32 million passwords recently exposed in the Rockyou.com breach. Imperva’s Application Defense Center (ADC) analyzed the strength of the passwords in a report, Consumer Password Worst Practices, that analyzes 32 million passwords to help consumers and website administrators identify the most commonly used passwords they should avoid when using social networking or e-commerce sites.

The report can be downloaded at: http://www.imperva.com/ld/password_report.asp

The report identifies the most commonly used passwords:

1. 123456
2. 12345
3. 123456789
4. Password
5. iloveyou
6. princess
7. rockyou
8. 1234567
9. 12345678
10.   abc123

In a statement issued yesterday, the German Federal Office for Security in Information Technology recommends that all Internet Explorer users switch to an alternative browser. They may resume using Explorer after a fix is issued by Microsoft for a critical vulnerability that has been implicated in the Chinese cyber attack against Google.

Affected are the versions 6, 7 to 8 Internet Explorer on Windows systems XP, Vista and Windows 7 Microsoft has released a security advisory in which it discusses ways of minimizing risk and is already working on a patch to close the security gap. The BSI expects that this vulnerability will be used in a short time for attacks on the Internet.

According to the statement from BSI, even running Internet Explorer in “protected” mode is not enough to prevent a hacker from exploiting this security flaw.

Researchers of the Cryptology and Information Security group of the Centrum Wiskunde & Informatica (CWI) in Amsterdam with partners from Germany (BSI and Bonn University), France (INRIA Nancy), Japan (NTT) and Switzerland (EPFL) have broken a 768-bit RSA key by finding its prime factors. This new record demonstrates the vulnerability of 768-bit RSA keys.

The first 512-bit RSA key was broken in 1999, in 2005 followed by the first 663-bit key. Extrapolating this trend, it is reasonable to expect that 1024-bit keys will exhibit a similar degree of vulnerability within the next decade as 768-bit keys do now.
The 768-bit factored key is an integer of 232 digits. During a timeframe of 2.5 years many thousands of CPUs on a large number of different locations were deployed to break this key. The total amount of computing power used is equivalent to 1700 2.2 GHz CPUs during one year.

Technical summary:
https://documents.epfl.ch/users/l/le/lenstra/public/papers/rsa768.txt
Preprint paper:
http://eprint.iacr.org/2010/006.pdf

The latest «State of the Internet 2009» report issued by CA, Inc. profiles the top online threats from 2009. The study, based on data compiled by CA’s Global Security Advisor researchers, found that rogue security software, search index poisoning, social networks and cybersquatting were among the most notable online threats of 2009.

CA security researchers also offer predictions for the top Internet threats for 2010, including an increase in “malvertising” and the potential for another big computer worm outbreak like Conficker.

View/Download (529 KB PDF)

The January issue of Technology Review features an important article discussing whether cloud computing is secure enough for broad public use. “Security in the Ether,” by David Talbot, brings to light some of the serious technology concerns from cloud based applications including Gmail, Twitter and Facebook.