Black Hat DC 2009: Joanna Rutkowska on Intel TXT flaws

Date: Feb 20, 2009

In this Black Hat DC session excerpt, Joanna Rutkowska of the Invisible Things Lab, explains how she and researcher Rafal Wojtczuk found weaknesses in current Intel Trusted Execution Technology (TXT) implementations and how they can be exploited. Intel acknowledges that the bugs affect Intel mobile, desktop and server motherboards.The researchers plan to publish details of the bugs and exploits at the Black Hat USA conference at the end of July.

More on Emerging Information Security Threats

NSA’s Sager on cyberwarfare, likelihood of ‘digital Pearl Harbor’
VIDEO - The NSA’s Tony Sager discusses the likelihood of ‘digital Pearl Harbor’ and how to prepare for cyberattacks by cost-effectively disrupting attackers.
NSA’s Sager on trends of 2011 security breaches, advanced persistent threat hype
VIDEO - The NSA’s Tony Sager discusses macro trends of 2011 security breaches, why advanced persistent threat hype isn’t justified, and infosec lessons learned from his wife and kids.
Black Hat 2011: Attack vectors, vulnerabilities and malware analysis
VIDEO - Rodrigo Branco talks about vulnerabilities, malware sophistication and whether the move to cloud-based services will change the way cybercriminals work.
Submit your questions about infosec threats
Answer - Nick Lewis is standing by to give you free, unbiased advice on information security threats.
Ranum chat: APT attacks and malware evolution
Magazine - Security expert Marcus Ranum talks with Joel Yonts, a seasoned security executive with a passion for information security research.
Information Security Magazine: FEBRUARY 2012
Magazine - Learn about the latest malware threats targeting enterprises and what you can do to reduce the risk of infection.
Mac enterprise security: Going beyond Mac malware scans
Tip - More attackers see an opportunity in Mac enterprise environments. Mike Cobb explains how to ensure a Mac enterprise security plan goes beyond Mac malware scans.
Exploring Google Chromebook security for the enterprise
Tip - The Chromebook is unique among new entrants in the mobile device arena. Mike Cobb breaks down the key Google Chromebook security issues enterprises need to know.

Security Channel
- Survey results: VARs report customers’ IT spending 2012 expectations
  
  VARs expect customers to increase spending on security more than any other IT area in 2012. See which security segments will grow the most.
- Create a computer security blog to attract and retain customers
  
  Blogging can produce new leads for security solution providers. Focus on content in your computer security blog that connects with customers.
- Penetration testing tutorial: Guidance for effective pen tests
  
  This penetration testing tutorial contains essential tips to help solution providers uncover vulnerabilities in clients’ networks.
Cloud Security
- Are cloud providers HIPAA business associates?
  
  Deciding whether your cloud provider is a business associate comes down to a judgment call based on the type of cloud usage.
- SaaS security: Weighing SaaS encryption options
  
  A look at SaaS encryption techniques and challenges.
- Panel debates cloud computing governance issues
  
  Problems with data governance in the cloud aren’t much different than traditional outsourcing.
searchMidmarketSecurity
- Windows Phone 7 security: Assessing WP7 security features
  
  Windows Phone 7 security features are proving to be a mixed bag. Sam Cattle assesses the enterprise security pros and cons of the latest Windows mobile platform.
- Choosing the best security certifications for your career
  
  Whether starting your career or planning your next step as an IT security professional, this tip will guide you toward the best certifications for your interests and experience.
- Midmarket security tutorials
  
  SearchMidmarketSecurity.com’s tutorials offer IT professionals in-depth lessons and technical advice on the hottest topics in the midmarket IT security industry. Through our tutorials we seek to provide site members with the foundational knowledge needed to deal with the increasingly challenging job of keeping their organizations secure.
searchFinancialSecurity
- Web application threats: What you really need to know
  
  In this special presentation, Mike Rothman details today's top Web application threats and pragmatic methods to integrate security into the Web application development process.
- Ramnit worm variant now dangerous banking malware
  
  The Ramnit worm now supports man-in-the-middle attacks, giving cybercriminals the ability to drain a victim’s bank account.
- SIEM vendors make the case for extending SIEM product capabilities
  
  Advanced features can reduce the threat of wire fraud. New rule sets can be shared among banks and credit unions.
Security UK
- Study finds attacks slip past spotty patch management policies
  
  A study finds attackers targeting firms with poor patch management policies, exploiting vulnerabilities that should have been patched years ago.
- Survey: Types of DDoS attacks on the rise due to hacktivist groups
  
  New DDoS statistics suggest hactivist groups are to blame for an increase in the number and types of DDoS attacks across the Internet.
- Web application vulnerability statistics show security losing ground
  
  New Web application vulnerability statistics show the number of vulnerabilities is rising, despite the use of Web application development frameworks.
searchSecurityAU
- AISA launches new website
  
  With a reinvigorated look and feel, improved back-end infrastructure, and regularly updated information about the association the Australian Information Security Association website has been re-launched for the benefit of its members and the Australian IT Security industry.
- Cisco hardening guides for IOS, IOS-XR and NX-OS devices
  
  Patching routing and switching infrastructure in any organisation is often delayed, sometimes due to the potential impact on production systems and sometimes because the IT resources are simply too busy fighting fires.
- Cloud providers and data sovereignty issues
  
  Australian cloud provider Ninefold warn that understanding who has legal access to company and personal private data is not as simple as checking a box and selecting the 'in-country' option.
Information Security
- Airtel’s DLP technology rollout makes data egress a thing of the past
  
  Airtel’s DLP technology implementation, India’s largest, went live in December 2010. Join us in exploring its inner workings, even as it is poised for bigger things.
- February 2012 Patch Tuesday to address 21 vulnerabilities
  
  Microsoft plans to fix coding errors in Internet Explorer, .NET Silverlight and Microsoft Office.
- IDFC’s information security awareness week tastes success with ‘Mr Gobo’
  
  Financial major IDFC set out to craft its information security awareness initiative with a portal that led users via a ‘Mafia don’s den’. Step in for more.

Latest Headlines

Topics

Hot Topics

Advice & Tutorials

Technology Dictionary

Tips

Answers

Ask a Question

Research Library

Product Demos

Resource Centers

Blogs

Black Hat DC 2009: Joanna Rutkowska on Intel TXT flaws

Black Hat DC 2009: Joanna Rutkowska on Intel TXT flaws

More on Emerging Information Security Threats

More from Related TechTarget Sites