Press & Media Coverage

Cybersecurity Certification in the Spotlight Again

DarkReading | Swiss technology non-profit group joins others, such as the Obama-era President's Commission, in recommending that certain classes of technology products be tested.

Press (EN)

Google’s Project Zero Targets Cybersecurity Research

WSJ | So-called zero day vulnerabilities – software bugs that have not been previously discovered – can fetch anywhere from $40,000 up to $1 million

Press (EN)

Computer Security, A digital fortress?

Economist | Measuring the severity of the problem is difficult because of the lucrative black market in zero-day exploits

Robert Lemos (EN)

Global Bounty Program to Cut Software Flaw Prevalence

eweek | A new study proposes that software firms buy the most critical code flaws as a cost-effective way to reduce rising economic losses from cyber-crime

Krebs On Security (EN)

The Case for a Compulsory Bug Bounty

KrebsOnSecurity | Security experts have long opined that one way to make software more secure is to hold software makers liable for vulnerabilities in their products.

Krebs On Security (EN)

How Many Zero-Days Hit You Today?

KrebsOnSecurity | Frei pored over reports from and aboutprivate vendors - including boutique exploit providers like Endgame Systems, Exodus, Netragard, ReVuln and VUPEN - and concluded that jointly these firms alone have the capacity to sell more than 100 zero-day exploits per year.

Robert Lemos (EN)

Stacked Security Tools Detect Less Malware than Predicted

eweek | The study found that many products missed a "significant number" of older exploits, and that basic evasion techniques foiled many defenses.

Press (EN)

Layered defenses largely fail to block exploits

CSO Online | Research lab finds a mix of products from different vendors is best for 'defense in depth'

Krebs On Security (EN)

Flaw Flood Busts Bug Bank

KrebsOnSecurity | NSS’s Stefan Frei found that 2012 reversed a long running trend of decreasing vulnerability disclosures each year.

Press (EN)

NSS Labs Vulnerability Threat Report

Yahoo | NSS Labs Vulnerability Threat Report Sees Significant Rise in Vulnerability Disclosures in 2012 After 5 Years of Decline

Press (EN)

HUAWEI Cyber Security Perspectives

Huawei | In a presentation to the RSA Conference Dr Stefan Frei articulated how the threat environment is changing.

Robert Lemos (EN)

Better security needs 'more informed patching'

CSO Online | Security firm Secunia finds that the most popular three-dozen programs account for 80 percent of vulnerabilities.

Press (EN)

Unpatched PCs remain a threat

SC Magazine | An unpatched PC is a greater threat than any zero-day vulnerability.

Press (EN)

Patching the Security Update Process

MIT Tech Review | There is ample evidence to suggest that the average user can't be bothered to installsecurity updates in a timely fashion--unless the process is more or less automated.

Krebs On Security (EN)

Yep, There’s a Patch for That

KrebsOnSecurity | Those programs come from more than 22 vendors, so as a first order estimate the number of different vendors you have on your box is the number of different update mechanisms you have to master,” Frei said. “This is doomed to fail

The Register (EN)

Think software patching is a hassle? You're not alone

TheRegister | In fact, it is highly unlikely that even skilled enthusiasts will patch their systems as frequently as the whitepaper's findings indicate.

Press (EN)

IT-Experte: «Hacker kann man nicht finden»

20min | Das überrascht den Cybercrime-Experten Stefan Frei von der ETH Zürich nicht. «Solche Angriffe wird es in Zukunft vermutlich vermehrt geben», sagt er.

Press (EN)

Firefox, Chrome users more up to date than Safari and Opera

Ars Technica | Firefox, Chrome users more up to date than Safari and Opera

Press (EN)

Safari, Opera Users Lag Behind in Security Updates

WashingtonPost | The analysis, from researchers at Google Switzerland and the ETH Zurich, pored through anonymized logs from Google's Web servers

Press (EN)

Convenience is number one factor in keeping browsers secure

Ars Technica | A crawl through Google's search logs reveals that end users are generally …

The Register (EN)

Easy updates best for browser patching

TheRegister | Easy update mechanisms have a far greater effect on browser patching than perceived threats or other factors, according to a new study by Google and Swiss academics.

Schneier On Security (EN)

Software makers should take responsibility

The Guardian | A recent study of Internet browsers worldwide discovered that over half – 52% – of Internet Explorer users weren't using the current version of the software.

Press (EN)

Online risk due to browser flaws

BBC | Almost half the online population is at risk because users have not installed security updates to their browsers, says a study.

Schneier On Security (EN)

Browser Insecurity

Schneier on Security | This excellent paper measures insecurity in the global population of browsers, using Google's web server logs

The Register (EN)

Built-in browser expiry proposed to fight botnet menace

TheRegister | Built-in browser expiry proposed to fight botnet menace: 45% fail to update surfing software.

Press (EN)

Forty Percent of Web Users Surf With Unsafe Browsers

WashingtonPost | The report concluded that Firefox users were more likely to be using the latest version because Mozilla's patch process is the quickest and most painless (no arguments there).

The Register (EN)

Apple lags MS in security response

TheRegister | Apple is trailing way behind Microsoft in security patch responsiveness, according to a study by security researchers.

Press (EN)

Apples Security Patch Process Gets Worse While Microsofts Gets Better

InfoWeek | Swiss researchers suggest that the revived popularity of Apple's products may have left the company unable to keep up with security risks.

Press (EN)

Email attack could kill servers

NewScientist | A crafty way of knocking out any email server using a few carefully constructed emails has been identified by a team of computer security experts.

The Register (EN)

The Joe Job DoS attack

TheRegister | A problem with the way that non-delivery notifications are sent by many mail servers could be exploited to launch "mail bomb" denial of service attacks.

PUBLICATIONS

Press & Media Coverage

Some of my talks, publications, and research output resonated quite a bit in the community, the press and various media outlets.

Articles & Interviews