The MYK-78 "Clipper" chip, the 1990's version of the "golden key."

In the face of a Federal Bureau of Investigation proposal requesting backdoors into encrypted communications, a noted encryption expert urged Congress not to adopt the requirements due to technical faults in the plan. The shortcomings in question would allow anyone to easily defeat the measure with little technical effort.

Please note, the testimony referenced above was delivered on May 11, 1993. However, that doesn't change its applicability today. In fact, current pressure being applied by law enforcement and intelligence officials over end-to-end encrypted communications appears eerily reminiscent of a similar battle nearly 25 years ago.

Last week, FBI Director James Comey again pushed forward arguments for law enforcement "backdoors" into encrypted communication applications. Comey claimed that the gunmen who attempted to attack a Texas anti-Muslim cartoon event used encrypted communications several times on the day of the attack to contact an overseas individual tied to terrorism. The revelation is part of a renewed lobbying effort to get technology providers to provide what Comey once described as a "golden key" to access encrypted communications. Though the FBI director reluctantly dropped his lobbying efforts for such a backdoor this summer, the attacks in Paris and San Bernardino have raised the issue again. Even President Obama recently asked for technology companies to help give the government access to communications over messaging applications and social media.

Enlarge / An payload that's been modified so it can't be misused. Malicious hackers are using it to perform an object injection attack that leads to a full remote command execution. (credit: Sucuri)

Attackers are actively exploiting a critical remote command-execution vulnerability that has plagued the Joomla content management system for almost eight years, security researchers said.

A patch for the vulnerability, which affects versions 1.5 through 3.4.5, was released Monday morning. It was too late: the bug was already being exploited in the wild, researchers from security firm Sucuri warned in a blog post. The attacks started on Saturday from a handful of IP addresses and by Sunday included hundreds of exploit attempts to sites monitored by Sucuri.

"Today (Dec 14th), the wave of attacks is even bigger, with basically every site and honeypot we have being attacked," the blog post reported. "That means that probably every other Joomla site out there is being targeted as well."

Enlarge (credit: @coldhakca)

Twitter has warned dozens of users that their account data may have been targeted by state-sponsored hackers.

In e-mails sent to security researchers, journalists, and activists over the past few days, Twitter officials said there's no evidence the attacks were successful. Still, the messages said Twitter officials are actively investigating the possibility that the accounts were breached. Dozens of users have reported receiving the advisory, with this list showing 36 people and this one listing 32 users.

"As a precaution, we are alerting you that your Twitter account is one of a small group of accounts that may have been targeted by state-sponsored actors," one e-mail warned. "We believe that these actors (possibly associated with a government) may have been trying to obtain information such as e-mail addresses, IP addresses and/or phone numbers."

Qubes OS, the security-focused operating system that Edward Snowden said in November he was “really excited” about, announced this week that laptop maker Purism will ship their privacy-focused Librem 13 notebook with Qubes pre-installed.

Built on a security-hardened version of the Xen hypervisor, Qubes protects users by allowing them to partition their digital lives into virtual machines. Rather than focus solely on security by correctness, or hide behind security by obscurity, Qubes implements security by isolation—the OS assumes that the device will eventually be breached, and compartmentalises all of its various subsystems to prevent an attacker from gaining full control of the device. Qubes supports Fedora and Debian Linux VMs, and Windows 7 VMs.

A screenshot of Qubes and KDE, with three documents in three different compartmentalised regions.

One of the biggest problems with Qubes is that hardware support can be tricky. In order to take full advantage of the OS's many innovative security features, you'll need a CPU that supports virtualisation technology, including both Intel VT-x (or AMD-v) and Intel VT-d (or IOMMU), plus a BIOS with TPM (for Anti-Evil Maid). Running a dozen VMs or more, as many Qubes users do, can be resource-intensive, so plenty of RAM and a fast processor are essential.