Markus Jakobsson's Blog

RSS Link

by Markus Jakobsson

Dr. Markus Jakobsson is Principal Scientist at Palo Alto Research Center. He is a founder of the security startup RavenWhite, which addresses security problems associated with authentication, malware and click-fraud. He is also one of the founders of SecurityCartoon, an educational approach targeting typical Internet users. He is a firm believer in technology to address security problems, but believes that a holistic view that includes the end user and his/her behavior is crucial. Unexpected user behavior can thwart the best security measures, and any security measure must be designed with social engineering and human failure in mind. Dr. Jakobsson's recent books Phishing and Countermeasures (Wiley, 2006) and Crimeware: Understanding New Attacks and Defenses (Symantec Press, 2008) chart new territory in online security. He received his PhD from University of California at San Diego in 1997.

Sarah Palin goes the way of Paris Hilton

Posted Sep 19, 2008 - 11:15 am

Wednesday, it was reported that Sarah Palin's Yahoo account was hacked by a perpetrator wishing to find incriminating information in her emails. It was not done using some strange computer security vulnerability. It was not done by guessing her password. It was done just in the same way as Paris Hilton's T-Mobile account was hacked some time ago: by guessing the answers to security questions.
- 45 comments
- Like
  
  6
- Tweet
- Security, email, Paris Hilton
How Herbert Thompson stole his friend's identity

Posted Aug 22, 2008 - 12:27 pm

This is a great account of how easy it is to break into people's accounts.
- Like
- Tweet
- Security, data mining, gmail
What you always wanted to know about malware (but were afraid to ask)

Posted Aug 21, 2008 - 08:07 pm

Malware, like real-world epidemics, has the strange property that it does not only matter to your health how well protected you are, but also, how well average people "out there" are. The more machines that are infected, the higher is your risk of also becoming infected. But that is not all: You are at risk even if you are well protected!
- 1 comment
- Like
- Tweet
- Security, botnet, malware
Why no news is bad news -- at least when it comes to malware

Posted Aug 19, 2008 - 07:55 pm

Once upon a time, malware authors wrote code to infect thousands of machines for entertainment and intellectual stimulation. Today, it's all about the money, and the greatest threat may lie in the silence, making a far more dangerous landscape.
- 1 comment
- Like
- Tweet
- Security, malware, silence
Google Tech talk on Password Reset

Posted Aug 14, 2008 - 11:35 pm

In a recent post, I described the problems with password reset, and how current password reset questions can be attacked. Watch my recent Google Tech talk on this subject...
- Like
  
  1
- Tweet
- Security, Google, password
What is worse than reusing passwords?

Posted Aug 12, 2008 - 08:22 pm

Think your password resets are secure? Think again. The city you grew up in and your mother's maiden name can be derived from public records. Facebook might unwittingly tell the name of your best friend. And, until quite recently, Ford with its 25% market share had a pretty good chance of being the brand of your first car!
- 16 comments
- Like
  
  2
- Tweet
- Security, fraud, password
Forty-one million stolen credit cards is just the beginning

Posted Aug 07, 2008 - 11:55 am

Federal prosecutors have charged 11 people with stealing 41 million credit cards, obtained by wardriving. The criminals drove around and scanned wireless networks for vulnerabilities, then installed sniffers that stole credit card information. Was this kind of attack inevitable? I believe it was. And we have more coming.
- 3 comments
- Like
- Tweet
- Security, epidemic, pharming
Google knows who you are

Posted Aug 05, 2008 - 09:47 am

Search engines and ISPs know who you are and where you've been. Phishers and advertisers do too. But can the average Joe learn this about you? Yes -- for good and bad.
- Like
- Tweet
- Security, advertising, browser
Can you tell a good URL from a bad one?

Posted Jul 29, 2008 - 12:58 pm

Look at these three URLs: www.accountonline.com, www.democratic-party.us, www.wachovia.pin-update.com. Can you tell which (if any) correspond to legitimate service providers? Do you think the average Internet user can tell, too?
- 8 comments
- Like
- Tweet
- Security, crimeware, deceit
Better law enforcement -- always good for us?

Posted Jul 22, 2008 - 09:47 am

If law enforcement improves, we will all be safer. Right? Well actually, maybe not.
- 2 comments
- Like
- Tweet
- Security, crimeware, data mining

February is...
Open Source Month

FEATURE: Spotlight on open source
TRAINING: Win FREE Java training from ITworld and Webucator
CAREER: What to Include in Your Open Source Resume
LIST: 10 best (unknown) open source projects

Facebook's 'man in the middle' attack on our data

17 comments
Canonical aligns Kubuntu as community flavor

6 comments
MegaUpload takedown didn't slow pirate downloads, just moved them offshore

3 comments
How to kill Web trackers dead

3 comments
Even after rewrites, Google Wallet retains gaping security holes, mainly due to Android

3 comments

White Papers & Webcasts

White Paper

Overcome Top 7 Admin Challenges of Active Directory

As Active Directory's role in the enterprise has drastically increased, so has the need to secure the data. Gain insight on creating repeatable, enforceable processes that reduces administrative overhead and enables robust, customizable reporting and auditing capabilities. Brought to you by NetIQ.

White Paper

Insiders Can Ruin Your Company. Take Action.

Did you know that 80 percent of threats to an organization come from the inside? The threat from insiders is often overlooked in organizations worldwide. This white paper from NetIQ, discusses key technology solutions that help to prevent and detect insider threats.

White Paper

Streamline Compliance and Increase ROI

Streamline, simplify, and automate compliance related activities; especially those that impact multiple business units. This white paper from NetIQ, outlines solutions that will help your business gain the maximum return on investment possible while aligning your compliance programs.

White Paper

X-Ray of the PCI Process-4 Proactive Steps

This white paper from Forrester Research Inc., helps break PCI into understandable components. Security and risk professionals will gain knowledge and insight into creating a compliant and secure IT environment. Follow these four proactive steps now before your next audit. Brought to you by NetIQ.

See more White Papers | Webcasts