November 2008

Interesting Information Security Bits for 11/18/2008

by kriggins on November 18, 2008

in Interesting Bits

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. Part 2 of the post I mentioned yesterday is available. More good stuff.
    Carnal0wnage Blog: Oracle Pwnage with the Metasploit Oracle Modules Part 2
  2. Looks like the U.S. government is crackin' on implementing DNSSEC.
    US Government Moves Fast on DNSsec | Security to the Core | Arbor Networks Security
  3. Nice detailed write-up of finding a vulnerability in an embedded systems OS. This is part 1. It will be interesting to see where part 2 takes us.
    Exploiting Embedded Devices (Part 1) << Neohapsis Labs
  4. Be careful out there. Particularly if you plug storage cards into your Windows Mobile smartphone.
    New worm attacks Windows smartphones

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Help me out, give me ideas for new How-tos.

by kriggins on November 18, 2008

in General

My first public how-to is this one.  It walks you through setting up a bootable Backtrack 3 thumbdrive with Nessus, Firefox 3, persistent changes and the latest Nmap.

I enjoyed writing it and hope it adds value.  Here is my request of you.  What other how-tos would you like to see me work on? This, of course, assumes I did a good job on my first one :)

Now having asked for your help, let me mention the following:

  1. Topics should be information security related in some manner.
  2. Does not have to be tool or technology related.
  3. I only possess Windows, Linux and BSD based boxen. No Mac yet, so can't write one for Macs unless you want to provide me with said Mac :)

I must admit this will probably benefit me more than you. One of the best ways to learn something is to try and teach it to someone else.  I consider writing a how-to a method of teaching.

Drop a note in the comments or send me an email at kriggins _at_ infosecramblings _dot_ com with your idea.

Kevin

{ 0 comments }

Interesting Information Security Bits for 11/17/2008

by kriggins on November 17, 2008

in Interesting Bits

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. Use these practices to significantly improve the security of your code.
    Top 10 Secure Coding Practices - CERT Secure Coding Standards
  2. Here are the secure coding standards for Java, C, and C++ developed by CERT.
    CERT Secure Coding Standards - CERT Secure Coding Standards
  3. A nifty free resource on secure programming in Linux and Unix environments.
    Secure Programming for Linux and Unix HOWTO -- Information on Creating Secure Software
  4. CG has part one posted of a neat walk-through on using metasploit to find out some things about oracle databases.
    Carnal0wnage Blog: Oracle Pwnage with the Metasploit Oracle Modules Part 1
  5. Jack points out that just because your brower is not keeping track of where you going (incognito in Chrome) doesn't mean that you are leaving no tracks.
    Uncommon Sense Security: Not so private "private browsing"
  6. SynJunkie has a very cool project going on. He is writing a demonstration or walk-through of a simulated pen test. Parts one and two are up. Very cool.
    SynJunkie: The Story of a Hack - Introduction
  7. This is an interesting concept.
    QuickStudy: Identity-based encryption
  8. This looks to be fun to play with.
    NetWitness To Release Free Cyber Forensics Software -- Network Forensics Security
  9. I have talked before about privacy and the amount of information that is present on the intarwebs previously. This article walks through an attempt to remove some of that info that you no longer want available on the nets.
    Deleting your digital past -- for good

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Security Blogger’s Network Feed Issues

by kriggins on November 14, 2008

in General

As indicated by Alan here. The evil overlord Google has apparently decided to no longer support network feeds as part of the Feedburner service.

Alan is working on something that will give the feed a new home. Just in case that takes longer than planned.  Here is an sbn-members opml file that Jack Daniel provided and that I have grabbed a copy of so that it will be in at least two places.

You will probably need to right-click and save-as.

Kevin

{ 0 comments }

Interesting Information Security Bits for 11/14/2008

by kriggins on November 14, 2008

in Interesting Bits

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. RSA Conference 365: RSA Conference Blog: Ramping up for RSA Conference 2009
    Looks like registration opens today for RSA Conference 2009 in San Francisco. Press registration doesn't open until January for those interested.
  2. Interview with the SANS CEO - Part I: INFOSEC in Rural Areas
    Jeff had the opportunity to sit down and talk with Steven Northcutt. This is the first part of that interview. Well worth spending a few minutes to read.
  3. The Dark Visitor >> Chinese hacker attack flowchart
    As has been mentioned in other arenas, the online criminal community is no longer just a bunch of script kiddies. They are organized, focused and have good processes. This flowchart is a good example.
  4. PCI Blog - Compliance Demystified >> Blog Archive >> Visa sets global PCI DSS deadlines
    Check out this article so you will be aware of some upcoming global deadlines that relate to PCI DSS.
  5. Emergent Chaos: SDL Announcements
    There is some very cool stuff going on in SDL. New tools, models, and support networks.
  6. Google patches Chrome file-stealing bug
    Yup, Google also has to patch a browser.
  7. Apple plays catch-up, ads anti-fraud safeguard to Safari
    Apple joins the rest of the worlds browsers by finally offering anti-fraud functionalitly.
  8. AVG slaps Trojan label on Adobe Flash * The Register
    Looks like AVG really needs to get a handle on the quality assurance testing. Yet another miss-labeled file that breaks systems.

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Interesting Information Security Bits for 11/13/2008

by kriggins on November 13, 2008

in Interesting Bits

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. ISP Cut off From Internet After Security Concerns - Business Center - PC World
    Interesting story about the shutdown of McColo.
  2. $10k hacking contest announced | Zero Day | ZDNet.com
    Want to test your l33t skillz? Here you go.
  3. Black Hat (r) : The World's Premier Technical Security Conference
    Call for Proposals is not open for Blackhat DC 2009 and Blackhat Europe 2009
  4. Mozilla fixes 11 new flaws in Firefox, six critical
    Time to update. Details inside.
  5. Microsoft explains seven-year-old patch delay
    Short answer: It was really hard.
  6. On Security & Risk Management Innovation | RiskAnalys.is
    Alex has posted a great article on risk management and innovation. You will not regret giving it a read. It has a great suggestion for dealing with budget cuts.
  7. Myth or truism? Security experts judge conventional wisdom - Network World
    This article is a nice read. It is interesting to read the different view points of the respondents to the same questions.
  8. Carnal0wnage Blog: Passing the Hash and other fun with Tenable smbshell
    CG points out some interesting things we can do with the smbshell tool that is provided by Tenable as part of Nessus.

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 1 comment }

Interesting Information Security Bits for 11/12/2008

by kriggins on November 12, 2008

in Interesting Bits

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. Rich has returned to a series he started some time ago. Some good info for us to consider.
    Database Encryption- Option 1, Media Protection | securosis.com
  2. This is very cool. Q1 has a new toy for us to play with. Go check it out.
    Free Q1 Labs tool collects logs, manages security and compliance
  3. Oops. Looks like AVG did a bad thing to Windows XP users. They are not alone is this type of error though.
    Update: Flawed AVG antivirus update cripples Windows XP PCs
  4. Some interesting information on the recent Android vulnerabilities that have been patched.
    Google details 'reboot' bug, Android security fixes | Latest Security News - CNET News
  5. Looks like it's time to update your SAP installations.
    Critical SAP flaw leaves systems vulnerable to attack
  6. I meant to point out this post of Didier's yesterday. Very neat walk-through of the maturation of an exploit.
    Shoulder Surfing a Malicious PDF Author << Didier Stevens

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Interesting Information Security Bits for 11/11/2008

by kriggins on November 11, 2008

in Interesting Bits

Hello everybody.  Sorry today's bits is a little late.

Here are today's Interesting Information Security Bits from around the web.

  1. VRT: Advanced Windows Buffer Overflow 5
    A new Windows Buffer Overflow exercise is ready. Time to learn something new.
  2. 'Memoryze' utility pinpoints malware code in live memory | Zero Day | ZDNet.com
    A new tool from Mandiant. Very cool. It will find malware in memory that does not exist anywhere on disk.
  3. Rational Survivability: I Can Haz TCG IF-MAP Support In Your Security Product, Please...
    Mr. Hoff has a post about a technology, IF-MAP, and extension to the Trusted Network Connect architecture that will be very useful. See his post fo details.

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Interesting Information Security Bits for 11/10/2008

by kriggins on November 10, 2008

in Interesting Bits

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. The Two Kinds Of Security Threats, And How They Affect Your Life | securosis.com
    Rich has an article posted about two kinds of security threats. You should go read it. We should really be thinking very hard about what he says as we analyze and manage our information security programs.
  2. /dev/random >> Blog Archive >> iPhone - Linux VPN
    Xavier has given a very nice article on setting up an iPhone with a VPN connection to a Linux machine. Very nice indeed.
  3. McGoodies from operat0r - Room362.com
    Mubix points us to a source, http://mccurdy.com, that has a few very handy tools that have been made to work as portable apps, w3af, Metasploit and WebScaram.
  4. Security expert talks Russian gangs, botnets | Defense in Depth - computer security, hacking, crime, viruses - CNET News
    A very interesting and complete article about the life of a botnet.

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Tomorrow is Veteran’s Day

by kriggins on November 10, 2008

in General

There are several times every year when I think about the armed services of the United States. Days like Independence Day, the anniversary of D-Day, the anniversary of the attack on Pearl Harbor and others. Many times, I have wanted to let the people who serve our country in this manner know how much I appreciate that service.

On occasion I have had the opportunity to walk up to a serving member of our armed services, shake their hand and say thank you for your service. Nearly every time, the reaction is one of surprise followed by gratitude. It deeply saddens me that the first reaction is surprise.

The men and women who serve in the Armed Services of the United States of America deserve our gratitude and our respect. It is through their sacrifice that we continue to experience the freedom and security we have.

Tomorrow is Veteran's Day. I urge you to find one person who is serving or has served in the armed services and thank them. I will be. Let's make tomorrow a special day for these people to whom we owe so much.

To all those who serve and have served to guarantee the freedom and security of the United States of America, I thank you from the bottom of my heart. Your sacrifice is greatly appreciated.

Kevin

{ 0 comments }

← Previous Entries

Next Entries →