Content by Mathew J. Schwartz

New Flaw: POODLE Puts Browsers at Risk

Mathew J. Schwartz  •  October 15, 2014

Security experts urge organizations to disable support for SSL on clients and servers because of flaws in the cryptographic protocol that could be used to impersonate website users and decrypt HTTPS traffic.

'Mayhem' Malware Exploits Shellshock

Mathew J. Schwartz  •  October 10, 2014

Malware known as "Mayhem" that targets Unix and Linux systems has been updated to exploit Shellshock flaws, security experts warn. But with few Unix-flavor systems running anti-virus software, how can it be stopped?

Malware Attacks Drain Russian ATMs

Mathew J. Schwartz  •  October 8, 2014

Criminals have infected at least 50 ATMs in Eastern Europe, including Russia, with malware, dispensing millions of dollars in cash directly to money mules. Interpol warns such attacks could spread worldwide.

Yahoo: Shellshock Attackers Got Lucky

Mathew J. Schwartz  •  October 7, 2014

Yahoo confirms Shellshock-targeting attackers hacked into three of its servers, but claims they didn't exploit Bash flaws. Meanwhile, Lycos denies it's been breached and WinZip isn't responding directly to a report that it was hacked.

Report: Shellshock Attack Hits Yahoo

Mathew J. Schwartz  •  October 6, 2014

Shellshock threats continue to escalate, with security researchers now counting 11 types of exploits that target the Bash flaws. Yahoo, Lycos and WinZip are reportedly among the "Bash attack" victims.

Beyond Chase: 9 More Banks Breached?

Mathew J. Schwartz  •  October 6, 2014

The hackers who breached JPMorgan Chase also infiltrated about nine other financial institutions, and may be operating from Russia, according to one news report. But security experts caution against jumping to conclusions over attackers' identities or motives.

Feds Fumble Spyware Story

Mathew J. Schwartz  •  October 3, 2014

"Selling spyware is not just reprehensible, it's a crime," says a U.S. Justice Department official. So why are 245 local U.S. law enforcement agencies and prosecutors giving spyware away for free?

Hackers Exploit U.S. Army, Microsoft

Mathew J. Schwartz  •  October 1, 2014

The Justice Department announces that four alleged members of an international hacking ring have been charged with stealing intellectual property valued at $100 million, including a U.S. Army Apache helicopter simulator and Microsoft Xbox prototypes.

Feds Bust Mobile Spyware Maker

Mathew J. Schwartz  •  September 30, 2014

The CEO of a Pakistani software company has been charged with developing, selling and advertising spyware for illegal purposes. But a legal expert questions whether those charges will stick.

Infographic: A Guide to Apple Pay

Mathew J. Schwartz  •  September 29, 2014

When the new Apple Pay mobile payment system launches in October in the United States, it could help improve payment security. This infographic reviews the system's features and how to put them to use.

Shellshock DDoS Attacks Spike

Mathew J. Schwartz  •  September 29, 2014

More than 1.5 million DDoS attacks daily are targeting the Bash bug flaws known as Shellshock. Researchers have now discovered a total of four Shellshock vulnerabilities and warn that more may follow.

Attackers Exploit Shellshock Bug

Mathew J. Schwartz  •  September 26, 2014

Attackers have exploited the Shellshock vulnerability - a.k.a. Bash bug - to infect at least 700 Linux systems with malware that includes the ability to launch DDoS attacks. Users of Unix systems are vulnerable.

Shellshock Bug: How to Respond

Mathew J. Schwartz  •  September 26, 2014

To mitigate the newly discovered Bash bug - AKA Shellshock - which may make millions of systems vulnerable to remote takeover, organizations must take several key steps, says security expert Alan Woodward.

Bash Bug: Bigger Than Heartbleed

Mathew J. Schwartz  •  September 25, 2014

Security experts are warning that millions of systems - Apache servers, Linux and Mac systems, and innumerable Internet of Things devices - may be vulnerable to a flaw in Unix that attackers are already using to gain shell access.

Apple iPhone 6 Touch ID Hacked

Mathew J. Schwartz  •  September 23, 2014

A researcher says he tricked the Touch ID biometric fingerprint scanner built into the new iPhone 6, using a fake fingerprint created with glue. But it remains to be seen how well would-be fraudsters could employ this technique.