Perhaps it’s the writer in me, but I view a federal judge’s decision to bar three MIT students from presenting research findings at the recent Defcon convention as a huge problem.

Not just from a free speech perspective, although, given that whole U.S. Constitution thing, that standpoint is a pretty darn valid one.

But what really grinds my gears - have I been watching too much Family Guy? -  is what this ruling might mean for security research in academia going forward.

As would have been clearly evidenced by the students’ talk - in which they planned to detail ways to hack into Boston’s subway payment system to enable free rides for life - there is some outstanding work coming out of colleges and universities across the world, specifically related to security vulnerabilities.

Time and time again, we have written stories about remarkable discoveries made by undergrads, graduates or Ph.D. students. Remember the cold-boot memory attack?

All too often, though, the legal community doesn’t see the benefits that those in the security community surely do. Judges and prosecutors assume that when a band of T-shirt wearing, long-haired youths (OK I’m massively generalizing here) get together at some hacker con to talk, it must mean they’re up to no good - and want more bad people to learn about it.

That couldn’t be any further from the truth. Talks like the one dropped from the Defcon bill last weekend actually do the opposite. They get people thinking about security, especially agencies like the Massachusetts Bay Transportation Authority, which decided to think novelty first, security second - or third, or fourth…well you get the idea…when it designed its CharlieCard subway passes.

Yet the MBTA, instead of thanking the students for their research and hopping on the Neon Express to Vegas, they filed a motion for injunction. Great.

And the judge agreed. Now, it’s difficult to say whether the judge, when making his decision, realized that the students weren’t planning on giving away the hack blueprint - just some interesting observations. But that lack of technical awareness within the judicial community is another matter entirely.

What we should be especially concerned about is in this era of black markets, where folks like Dan Kaminsky could have netted in the hundreds of thousands for his DNS design bug, these discoveries could result in monster paydays.

But if you saw Kaminsky running around the Caesar’s Palace convention center in Vegas, you could tell he was more than happy to be Black Hat’s version of Brad Pitt for the week.

These MIT students weren’t looking to make any cash on this discovery, either. They felt rewarded enough by getting an “A” from their professor and, barely old enough to gamble, address an audience in Vegas.

Not everyone will feel that way. Most will want to break the bank, much like the MIT students’ classmates had done years earlier at the blackjack tables.

So let’s not do anything to discourage the good people, while we still have them.

Imagine a web browser that sits as an application on your desktop. If you click to open, it delivers you to a previously set website. You can navigate all you want through that particular website - maybe it’s Bank of America - but don’t try going to Facebook. It won’t let you. There’s no address bar.

They’re called single-site browsers (SSBs), or site-specific browsers, or maybe some other alliteration that I haven’t heard about yet.

The security benefits are easy to get. As Andrew Jaquith of the Yankee Group - I believe the first analyst to publicly present on this topic - said in an April blog post, “Because SSBs can, by definition, browse to only one website, many of the web-based attacks against users (phishing, cross-site scripting, cross-site request forgery) won’t work.”

Bored by the security ramifications? Mac enthusiast Todd Ditchendorf explains some of the more tangible benefits here.

The concept is still a nascent one, but we can expect to hear a lot more about in the coming months. Rumor has it that when Apple releases Safari 4, will include a capability to create SSBs.

As is often the case with neat innovations, the open-source community is leading the charge.

Ditchendorf, in fact, has already designed such an Mac application to make an SSB possible. It’s called Fluid. And the smart folks over at Mozilla are working on their version, known as Prism.

A big challenge will be getting the banks and other heavily phished retailers interested in offering this to customers. But it might be worth it. As Jaquith notes, SSBs could be “a great way to ‘brand’ a website and keep users safer, all at the same time.”

Of course, as with any security technology, this is not a silver bullet. Jaquith points out that previously installed malware, such as keyloggers, can still work on SSBs, as can things like DNS exploits.

Stay tuned.

As one security researcher told me not too long ago, we are in the “golden era of the web attacker.”

At the time, we had been talking about virtualization and some of the risks that go along with that hugely important technology. But, as this researcher cautioned, the focus here and now should be on an the insecurity of the web.

Since that conversation some eight months ago, the web has only become a more threatening place. This is especially evident because of the uptick in legitimate websites being compromised to push malware. ScanSafe, earlier this month, reported a more than 400 percent increase.

What is necessary to stem the tide of web attacks? The consensus seems to be more secure code.

To this point, Microsoft this week issued a security advisory that offered companies free tools to scan for SQL injection vulnerabilities.

ScanSafe’s Mary Landesman, as quoted in the company’s Security Threat Alert Team blog, thinks the free tools, one of which comes from Hewlett-Packard, could prove helpful.

Hopefully the end result will be far fewer compromised websites and a corresponding decrease in the number of password stealers and backdoors being foisted onto users’ systems when they browse the Web. In May 2008, the rate of Web-based exposure to password stealers and backdoors had increased 855% compared to May 2007 - largely a result of these ongoing SQL injection attacks.

Another development on the secure coding front is the new Payment Card Industry Data Security Standard section 6.6 guidelines, which take effect Monday. While they don’t necessarily address the possibility of an attacker compromising a legit website to spread malicious code, they do speak to writing secure web applications as a way to protect customers’ credit card information.

Under the rules, which are enforced by the payment card brands, merchants can either implement a web application firewall or a conduct a code review.

The importance of building secure code is more important than ever before. Let’s hope these recommendations (from Microsoft) and requirements (through PCI) give companies the nudging they so desperately need.

Hats off to Apple for another in a two-decade long series of electrifying product announcements yesterday.

While Hollywood is the master at creating frenzy over a new release, often spending as much on marketing as production, the enthusiasm with which Apple announcements are greeted is no less hysterical. But in Apple’s case, the passion is most often justified. The products deserve the impassioned response. They deliver, they’re innovative, they’re simple to operate, they do what they’re supposed to.

I received perhaps 20 different press releases yesterday announcing some aspect of the new iPhone 3G. There was a separate release for each country in which the device was about to receive distribution (July 11, in case you were in a coma). And there were a number of third-party partnership announcements.

One of the key developments with the new generation communication device is its integration into enterprise use. That is, Apple is making every effort to increase its appeal to business users. The new iPhone 3G now supports Microsoft Exchange ActiveSync, which allows road warriors to send and receive email and have access to their calendar and contacts. It also gives mobile users the ability to securely tap into the corporate network via Cisco IPsec VPN and wireless network services with WPA2 Enterprise and 802.1X authentication.

On top of all this, Apple has made it simple for anyone to create applications to be used on the iPhone.

And that’s what information security professionals need to take a look at. In all the news and hoopla greeting the introduction of the iPhone 3G, there was not a word about security issues these wireless tools and third-party apps may bring to the market.

The technology is moving swiftly. But along with these tremendous developments come attendant potential calamities – everything from new generations of malware developed specifically for mobile networks, to viruses introduced via third-party apps.

Apple, so far, has largely avoided the infections that have targeted Microsoft products. But now that the Cupertino, Calif.-based company is increasing its alliance with the Redmond, Wash.-based company in this move to grab a larger enterprise market share – not to mention a growing share of the consumer market as well, particularly with the price point coming down significantly – it wouldn’t be unexpected to see a growth in attacks spreading via the iPhone network.

What’s being done to keep the network secure? We’ll do our best to stay on top of developments. Let us know what you know.

On Thursday, SC Magazine and just about everyone else reported on the hacker takedown of Comcast’s homepage and email service for several hours during the pre-dawn on Thursday. It was a pretty big deal considering Comcast has some 14 million subscribers.

Later Thursday, Wired scored an interview with the two hackers - “Defiant” and “EBK” - who claimed responsibility for the attack.

Hackers, it is important to note, are no different than any narcissistic criminal who is more out for fame than fortune. These two teens craved that one big interview before they are shackled up and led off to jail, which judging from their willingness to detail a step-by-step blow of their hack, shouldn’t be too far off.

The Wired piece has some memorable quotes, so be sure to check it out. I’d print them here but I’m not sure how my boss would feel about transcribing Defiant’s visual re-enactment of the last time he was arrested for hacking.

So what did we learn about these two ? For one, they hate Comcast. They were never out to steal any personal information - although they claim they could have easily sniffed for data packets once they exploited a flaw at Comcast’s domain management provider, which allowed them to take control of Comcast domains and redirect traffic to their own server.

The pair admits it is nervous about getting pinched, but they said they tried to notify a Comcast IT manager, who apparently hung up on them when they tried to tell him what they were doing. (Reminds me of another major company that didn’t take IT advice, even after being breached for millions of records).

Then, the Comcast hackers figured, if nobody cares and we’re already in, why not keep going?

The biggest takeaway from this event might be that the hackers claimed to take advantage of a flaw at the domain management firm, Network Solutions, which basically means more websites could be open to a similar attack - or worse. (Network Solutions, the provider, however, denies playing any role in the episode).

We should also point out that Defiant and EBK are members of the “Kryogeniks” hacking contingent. That same group made the news when a non-member hacked some celebrity profiles on MySpace to send out spam bulletins announcing support for the group in hopes of impressing members.

Whenever some expert wants to evangelize about the current state of security, he or she will gush about how the current threat landscape is driven by greedy, profit-driven hackers out to steal your life’s savings right from under your keyboard.

The days of nuisance-driven, teenage script kiddies are all but over.

Farewell Melissa virus, hello Russian Business Network.

And for the most part, he or she would be right.

Then, we hear about this: Hackers recently exploited a vulnerability on the Epilepsy Foundation’s website to plant copious amounts of links on the support forum claiming to offer advice to sufferers. Clicking on the link, though, brought users to websites that featured rapidly exploding bursts of light.

Sounds harmless, enough, right? Wrong. When you have epilepsy, violent flashes of light tend to trigger a seizure.

As a result of the incident, users are no longer able to post animated images to the forum or embed links to other sites.

So it appears not every digital criminal is out for your money. There also are ones out there who could kill you.

It’s probably safe to assume that this prank was committed by a group of teenagers who didn’t have death in mind and instead did it for a good laugh among their circle.

Still, it is a pretty twisted act.

How can we fight back?

Secure website code. Plain and simple. Don’t give these miscreants the opportunity to commit something like this.

How many incidents have to happen before website operators realize that their site is almost assuredly loaded with holes that can be easily exploited by the mean spirited?

In what likely will be a recurring theme for companies that deal in software, aerospace manufacturing giant Lockheed Martin has announced it is partnering with the SANS Institute to certify 75 of its programmers in secure code development.

Bethesda, Md.-based Lockheed, a $42 billion company that provides IT solutions and services to the federal government, becomes the first systems integrator to offer application assurance to customers, SANS’ research head Alan Paller said.

Programmers will receive skills development, assessment and certification under the SANS Global Information Assurance Certification standard. They will be trained in common language frameworks, including Java and .NET.

“Lockheed Martin integrates all aspects of information assurance into every solution it delivers and continues to invest in proactive security measures,” said Eric Cole, senior cybersecurity fellow at Lockheed. “We are committed to improving secure software development practices and are certifying our employees who are working in the area of cybersecurity on customer programs.”

This news is particularly important because Lockheed’s largest customer is the U.S. Department of Defense.

Lockheed said that depending how successful the certification program, it may extend beyond the 75 programmers.

The company did not say what might happen to the programmers if they are unable to achieve certification.

The topic of security is one that is undoubtedly working its way into different IT roles and functions - including code development - but at least some backlash is sure to emerge. It is likely that training in secure code writing will be something new for these developers, and they may, at least initially, bark at the idea of another training requirement.

But that mindset is sure to change across verticals. While it may always be impossible to make a piece of software vulnerability free, it is nice to see a mega corporation like Lockheed blazing the trail.

If you’re an IT administrator responsible for hundreds of machines, I didn’t envy your job this week. Then again, I don’t really envy it any week - probably because I could never do it - but the past few days have been particularly brutal.

That is because we’ve seen enough patch roll-outs to make your head spin. The names read like a laundry list of popular consumer and business software: Adobe Reader, Apple QuickTime, Sun Java, Skype, WordPress, Firefox.

And, on Tuesday, the big daddy comes when Microsoft delivers 12 fixes, seven critical, the most we’ve seen since February 2007.

 Woof. I guess it is safe to say the holiday lull is over.

This, of course, provides clear evidence that the bad guys find it really, really beneficial to exploit client-side, widely-deployed software that most users think to always trust.

Good luck.

I was intrigued to learn this week that the U.S. Army is planning to introduce more Macs to their environment for the sole purpose of security.

This is, aside from the additional cost (which will, of course, pale in comparison to other war expenditures), a great move for the Army. It’s true that Macs are dramatically safer than their Windows counterparts.

But the more we read about Apple making up ground in market share against its PC competition, it begs the question: How long can Mac users go without worrying about security. Seeing the Army deploy Macs won’t help matters.

Sure, Macs are built on the inherently more secure Unix framework - but there are vulnerabilities in everything.

When will the hackers’ interest reach the tipping point?

It’s the million-dollar question - and unless Macs receive widespread deployment in corporations and other government entities - it may be never come. But you better believe that the hacker community isn’t sitting back, watching the PC vs. Mac commercials preaching Apple security, without craving the opportunity to prove them wrong.

On Monday, we told you about a serious 3ivx codec flaw, which could be exploited by hackers to take complete control of an affected system. Proof-of-concept code was spotted affecting Windows Media Player 6.4 and Winamp 5.32, and experts worried whether the bug may be exploitable in more recent versions of the popular media applications as well.

But protection is on the way, as 3ivx told SCMagazineUS.com today in an email that the company plans to issue a software update later this week. A company spokeswoman said the vulnerability is actually in the MP4 file format reader, not the MPEG-4 codec.

“The specific vulnerability is when MP4 or M4A file metadata (Artist, Album, Title, etc.) data is larger than expected, thus causing a buffer overflow,” she said. “The problem with the various attacks available is they require a specific version of an MPEG-4 filter to be installed, and a specific player to be used to play the crafted MP4. Interestingly, if this were to become a serious problem for video content portals, it would be possible to scan content for invalid metadata before making the content available to the public. A little bit like virus scanning.”

Don’t let it come to that. Make sure you upgrade to the 5.0.2 release.