November 2008

Here are today's Interesting Information Security Bits from around the web.

  1. This is pretty neat. You can patch Microsoft virtual machines while they are offline. VMWare has similar capabilities.
    Patching offline virtual machines | Security4all - Dedicated to digital security, enterprise 2.0 and presentation skills
  2. Looks like CBS has joined the ranks of major sites who have served up malware.
    Liquidmatrix Security Digest >> CBS.Com Compromised
  3. The evil overlords won't be able to listen in to you calls anymore.
    Techworld.com - Windows Mobile gets encrypted phone calls

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 2 comments }

Hi everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. Paul has a nice how-to up on creating custom dictionaries for password cracking. Custom dictionaries built intelligently are much more effective than general ones.
    PaulDotCom: Archives
  2. Splunk is a great tool for log management and alerting. Rich shows how to get it working on FreeBSD 7.0.
    TaoSecurity: Splunk on FreeBSD 7.0
  3. F-Secures handy Rescue CD has been updated. Check it out.
    F-Secure Linux weblog >> Blog Archive >> Rescue CD 3.01 released
  4. Google says there is not security flaw. Victims were phished.
    Google silences Gmail security blogorumors * The Register
  5. Secunia's Personal Software Inspector has gone final with version 1.0. This is a great tool to help you keep your systems up-to-date.
    Download - Personal (PSI) - Vulnerability Scanning - Secunia.com
  6. Chris highly recommends this video and slide deck. It's going on the list for me to watch.
    Cryptography for Penetration Testers << Ramblings of the anal security guy
  7. The CSI 2008 presentations are online and available for download.
    CSI 2008

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. This looks very interesting.
    IEEE 1667: One standard worth watching | Security - CNET News
  2. Interesting, but two things. Have to have a cell card installed and working for the service to work and what about spoofed cell number. Just saying.
    Lenovo service disables laptops with text message - Network World
  3. This looks like it will be fun to play with. Of course, only for the learning experience.
    Browser Rider - A hacking framework for browser exploitation
  4. Another paper from ENISA.
    ENISA launches Position Paper on mobile eID security issues | Security4all - Dedicated to digital security, enterprise 2.0 and presentation skills
  5. Some nastiness that preys on Mac OS X. Not anything new, but worth noting.
    New OS X Malcode: Not Just a DNSChanger | Security to the Core | Arbor Networks Security
  6. Bruce gave a keynote at RSA Europe 2008. The idea presented in this article was also shared there. Interesting stuff.
    Schneier on Security: The Future of Ephemeral Conversation
  7. ENISA has a new paper out.
    ENISA's New Paper: "Inside the matrix: Privacy & data protection challenges". | Security4all - Dedicated to digital security, enterprise 2.0 and presentation skills
  8. Looks like Google plugged the filter problem.
    Google Fixes Gmail Cross-site Request Forgery Vulnerability - Netcraft
  9. CG has another nice write-up on using Metasploit. This time he shows us how to use WMAP.
    Carnal0wnage Blog
  10. Part 4 of CG's how to beat up Oracle with Metasploit.
    Carnal0wnage Blog: Oracle Pwnage with the Metasploit Oracle Modules Part 4
  11. Part 5 of CG's series on beating up Oracle.
    Carnal0wnage Blog: Oracle Pwnage Part 5 -- Password Cracking with JTR

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

In this post I offered three tips on writing that make it easier for your reader. Someone anonymously left the following comment.

Is this like the April 1st-type advice? Clearly, these tips are about writing for rejectees from “Are you smarter than a 5th grader?”…. Come on!

Not the most constructive comment, but he does bring up a point I want to address.

Writing in a clear, concise, easy to read, and easy to understand manner is not a judgment of the intelligence of your reader. It’s about making something less complicated than it needs to be. It’s about making it easy for your readers to read and internalize.

Can your readers understand long sentences? Of course they can, but are they willing too? Can you banish white space? Sure, but is that in your reader’s best interest? Can you use your encyclopedic vocabulary? Yup. But “big words” would have worked in the last question just as well.

Shorter sentences, shorter paragraphs, and common language do not mean dumbing down your writing. It means making the information you are trying to share easier to get at for your reader. That's why you are writing in the first place isn't it?

Kevin

{ 1 comment }

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. This has potential to be a big problem. Check it out.
    Researchers find vulnerability in Windows Vista - Network World
  2. Looks like Trend Micro is doing something right. They have been named as Computer Reseller News' 'Security Vendor of the Year'. Congrats to all involved.
    Trend micro as security vendor of the year award >> Computer internet security
  3. The first in a series of articles that will explore security in Windows 7.
    Security in Windows 7: Setup - Reviews by PC Magazine
  4. Second article in on Windows 7 security.
    Security in Windows 7: UAC and You - Reviews by PC Magazine
  5. Third article on Windows 7 and security.
    Security in Windows 7: Firewall and Networking - Reviews by PC Magazine
  6. The ITSecurityGuy points out a fun questionnaire that you can use the next time you have to interview a consultant.
    The IT Security Guy: Do You Trust That IT Security Consultant?
  7. An interesting exploration of data execution protection (DEP). It might not be present when you think it is.
    VRT: Fun with SSDT Hooks and DEP
  8. This is an interesting tool. Check it out, 5 distros in one.
    Dr. InfoSec: SUMO Linux - New Multi-OS Distro
  9. This is a pretty neat idea. I like it.
    TaoSecurity: Digital Asset Scorecards
  10. A nice way to limit secure file copy using ssh.
    secure file uploading with scponly | Robert Penz Blog

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Security Bloggers Network has a new home.

by kriggins on November 24, 2008

in General

The Security Bloggers Network feed is back!  You can find it here: http://www.securitybloggers.net.

Subscribe to the feed here: http://www.securitybloggers.net/feed.

Thanks to Alan and crew for keeping this great resource alive.

Kevin

{ 0 comments }

Are you wearing your readers out?

Are you making it hard for us to read what you have to say?

Are you making it hard for us to understand what you are trying to tell us?

Last week I attended a class called "Customer-Focused Writing." Don't go away yet. Customer in this case means whoever is reading your writings. It was presented by Ben Shank of Writing Consultants, Inc. The class was great and I learned quite a few things.  I'd like to share three of them with you.

  1. Keep your sentences short.
  2. Keep your paragraphs short.
  3. Keep your words short.

There, go forth and capture readers!

Heh. Okay. I have a little more to say about each tip.

Before we start I would like to mention what kinds of writing I am talking about. Every kind . Emails, memos, letters, long reports, and blog posts.  They all can benefit from these three suggestions.

Keep your sentences short.

There have been many studies done on sentence length. A quick Google search for "sentence length" will return many opinions on the subject. Some of them about prison sentence length, but we're not going to get into that.

What is the idea that keeps turning up? You got it. Keep your sentences short. Sentences of 15-20 words are easier to read. Over 25 words and we often just give up.

Short sentences keep your reader moving.  We don't have to keep re-reading everything to get the thought or idea you are trying to get across. Short sentences also help establish a pace. Think about books that you have read quickly. I bet they didn't have huge sentences in them.

Keep your paragraphs short.

If keeping sentences short helps capture a readers attention, what do you think long paragraphs will do? Scare em' half to death more than likely. What is short? Five to six lines. Since taking the class, I have been paying close attention to my reading habits. Let me tell you what I have noticed.

I am less likely to want to read a piece that is one huge paragraph. As advertisers and marketing folks have said for years, white space is important. Frequent breaks as we read let us digest the information being presented.

Pay attention over the next few days.  Watch for large paragraphs and see if you prefer them to shorter ones.

Keep your words short.

We have a theme going here, don't we? Why use the word 'utilize' when 'use' works just fine. Why stick a bunch of five syllable words in your writing when they are often not needed.

Some will say, "I do a lot of technical writing. I have to write long sentences and use long words." In most cases, you don't. Sometimes you do. Sometimes the only word that will work is a long one. Go ahead and use it. But, only if you really need to.

Leave the monster vocabulary at home unless your goal is to show how many big words you know. Your reader doesn't really care. They just want the information you are trying to give to them. Don't make them pull out the dictionary just to read your stuff.

A few bonus tips.

Good titles are vital. They are what first grabs your readers attention.

Good opening are even more vital. They keep the writers attention. In a lot of cases, the opening is the only part that will get read. If you really want them to know something, get it in there early.

Finally, good closings are vital.  They help cement what you are trying to say in your readers mind.

Use short words, write short sentences and keep your paragraphs short too. I promise you that your readers will appreciate it.

Kevin

PS - If you want to contact Writing Consultants, here is their email address mail (at) writeconsult (dot) net. I have no affiliation with them other than being a satisfied student.

{ 4 comments }

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. Part 2 of Jeff's talk with Steven Northcutt is ready for your reading pleasure.
    Interview with the SANS CEO - Part II: Security Cultures in Business
  2. Like the title says, some links to incident response cheatsheets.
    Incident Response Cheatsheets | Startup Security
  3. The results are in. There is some good reading in there about the process folks use to reverse malwer.
    Contest Results
  4. Ever wanted to be able to us PyDbg from within IDA. Cody of over at DVLabs is here to show you how.
    TippingPoint | DVLabs | MindshaRE: Utilizing PyDbg Within IDA
  5. A nice tutorial on using ssh for port forwarding under a number of situations.

    Hat tip: @afongen
    NDC Logical Firewall - SSH Port Forwarding

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. Richard puts forth some interesting thoughts regarding steal it or develop it from a security assurance professional's perspective.
    TaoSecurity: Intellectual Property: Develop or Steal
  2. Part three of CG's having fun with metasplolit and Oracle is ready for your review.
    Carnal0wnage Blog: Oracle Pwnage Part 3
  3. I have needed to do this in the past. Therefore, I can vouch for how handy it would have been to have the instruction that Kees has prepared for us.
    Kees Leune: Setting up your own certificate authority
  4. Rich and Adrian have the first part of what will be a multi-part exploration of creating a Web Application Security Program. Should be a very good series and one that we can all benefit from.
    Building a Web Application Security Program: Part 1, Introduction | securosis.com
  5. Looks like the U.K. is putting some bite into their privacy regulations.
    Dr. InfoSec: Businesses could be fined 10% of revenues for data protection breaches
  6. This is a great walk-through on using some nifty tools to perform live memory forensics on windows boxen. Cool stuff.
    Memory Forensic Acquisition and Analysis 101 << SANS Computer Forensics, Investigation, and Response

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 2 comments }

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. Like the link says, version 3.2 is available at a store near you.
    /dev/random >> Blog Archive >> MetaSploit FrameWork 3.2 Released
  2. Domdingelom has a nice post up talking about eSSO. Worth a read.
    Domdingelom on security, fun and life: can we escape from password hell ?
  3. Didier has made available the presentation he gave at his ISSA/OWASP talk. You can also grab the demo files. Neato stuff.
    My ISSA / OWASP Talk "Risky PDF" << Didier Stevens
  4. I used to tinker with hardware a lot. Over the years I have drifted away from it. However, recently I have been getting the itch to get back to it. Larry has posted some great tips and resources for those who want to smell the scent of hot solder and warm flux.
    Larry's Introduction to Hardware Hacking
  5. Damon has a great article up for start-ups. He offers some ideas for making disclosure easier for those who might find problems with your site or product. Responsible disclosure is always easier if there is a clearly documented method for doing so.
    On Responsible Disclosure in the Non-Enterprise World | Startup Security
  6. Looks like Microsoft is joining the ranks of those who offer free anti-virus and anti-malware products.
    Microsoft Throws In The Towel on Windows Live OneCare; New Anti-Malware Tool To Be Free - Security Watch
  7. Looks like McColo was able to get back on the net for a while on Saturday. Don't count on the spam counts remaining low.
    Dead network provider arms Rustock botnet from the hereafter * The Register

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }