Top 10 Stories

PC World: Security experts have expressed doubts about a hacker claim that there’s a new vulnerability in the patched version of OpenSSL, the widely used cryptographic library repaired in early April. A group of five hackers writes in a posting on Pastebin that they worked for two weeks to find the bug and developed code to exploit it. They’ve offered the code for the price of 2.5 bitcoins, around $870.  

Business Insider: Well-known hacker Andrew "Weev" Auernheimer, who released thousands of iPad users' email addresses to point out a flaw in AT&T's servers, is starting a hedge fund. His fund will be called "TRO LLC" (clever) and the primary strategy will be to short companies.    

Infosecurity: Google has incorporated a new TLS cipher suite in Chrome that operates three times faster than AES-GCM on devices that don’t have AES hardware acceleration, including most Android phones, wearable devices such as Google Glass and older computers. This improves user experience, reducing latency and saving battery life by cutting down the amount of time spent encrypting and decrypting data – but it also gives security a boost. Given recent attacks against older, commonly-used encryption modes...

Infoworld: Mozilla plans to more strictly enforce industry best practices for SSL certificates in future versions of Firefox with a new certificate verification system. The new system will be implemented as a library called "mozilla::pkix" and will start being used by Firefox 31, which is expected to be released in July. Many of the certificate verification changes in the new library are subtle and are related to technical requirements specified in the "Baseline Requirements for...

Arstechnica: Demonstrating yet another way the catastrophic Heartbleed vulnerability threatens users, malicious hackers were able to exploit the bug to successfully bypass multifactor authentication and fraud detection on an organization's virtual private network (VPN), security researchers said. Until you get a new key, consider your OpenSSL-powered VPN network compromised. When the critical flaw in the OpenSSL cryptographic librarycame to light 11 days ago, it was best known as a dangerous hole that allowed attackers to siphon...

IB Times: According to new research, almost half of UK employees do not tell their IT departments about downloads to their work computers which could leave their businesses vulnerable to data breaches A survey conducted by Censuswide and commissioned by Symantec found that 42% of UK workers would not inform techies about new apps, programmes or software that they may install for work purposes.  

Network World: Knock, knock! Secret Service here.  "Is this your customer payment card data?" By all accounts, many of the massive data breaches in the news these days are first revealed to the victims by law enforcement, the Secret Service and Federal Bureau of Investigation (FBI). But how do the agencies figure it out before the companies know they have been breached, especially given the millions companies spend on security and their intense focus on...

Motherboard: World leaders may be fretting over whether the NSA bugged their phones, but Canadian government officials aren't particularly worried—they bought theirs directly from the agency. A survey of procurement records kept on public government websites reveals that Canada has spent over $50 million purchasing a bevy of secure communications equipment from the largest branch of the American intelligence community.   There are at least 100 different contracts listed, the earliest of which date back to 2004. They include procurements...

BBC: An inquiry is under way after three Welsh councils said people's personal data may have been mistakenly sold. The Information Commissioner's Office (ICO) said it was concerned about incidents involving Rhondda Cynon Taf, Caerphilly and Torfaen. Their electoral rolls were passed to credit reference agencies, including details which should not go to third parties.  

  eWeek: Microsoft pushed out a bad update to its Security Essentials software, crashing Windows XP machines and underscoring the fragility of the Windows XP ecosystem. An update to Microsoft Security Essentials, the software company's free anti-malware software, crashed Windows XP computers last week, causing business disruptions to customers still relying on the outdated—and, in many cases, now-unsupported—operating system. - See more at: http://www.eweek.com/security/bug-in-microsoft-security-essentials-downs-windows-xp-machines.html#sthash.SMFalaUh.dpuf