Cody Taylor

McGruber writes “Northrup-Grumman’s Govtrip.com website has been shut down following a security breach, according to a report by ‘Security Fix’ blogger Brian Krebs. Being a federal employee and frequent work traveler, I am (was?) a Govtrip user. My agency required me to use Govtrip to book all of my trips, including my airfare, car rentals, and hotel reservations, so Northrup-Grumman’s Govtrip databases contain my frequent flier numbers, Avis & Budget car rental numbers and frequent hotel guest (Choice Privileges, Marriott Rewards, Priority Club, etc.) numbers. Northrup-Grumman also stored all of my trip itineraries, including destinations, dates & modes of travel and the particular vendors (airline, hotel, rental car brand, etc.) used on a particular trip. Also stored on the website were my work travel credit-card (it has a ,000 charge limit), personal checking account where my travel reimbursements were deposited, my home address, and emergency contacts … just imagine what an accomplished social engineer can do with that combination of information!”

Read more of this story at Slashdot.

A security researcher has demonstrated a way to hijack Secure Sockets Layer (SSL) sessions to intercept login data.Moxie Marlinspike, who spoke at the Black Hat security conference on Wednesday, explained how to subvert an SSL session by performing a man-in-the-middle attack. The anarchist researcher explained in…