passwords

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. Hoff points to an interesting project that addresses the distributed authentication issue in web based systems.
    MashSSL - An Excellent Idea You've Probably Never Heard Of... | Rational Survivability
    Tags: ( authentication ssl web )
  2. Get your Security Threat Report 2010 while it's hot!
    Sophos Security Threat Report 2010 | Graham Cluley's blog
    Tags: ( threats reports )
  3. Jennifer is involved in a few talks at Security BSides San Fran. Vote for her!
    Security Uncorked >> The Skinny on Security BSides San Francisco
    Tags: ( conferences bsides )
  4. The finalists for the Social Security Blogger Awards 2010 have been selected.
    The Ashimmy Blog: Envelope please, and the winners are . . .
    Tags: ( awards )
  5. Very cool. Encrypt your logs before sending them across the wire.
    Immutable Security >> Using OSSEC for Encrypted Log Transport
    Tags: ( logging encryption ossec )
  6. Similar to the Amazon EC2 experiment last year, this time it is done with Microsoft's Azure.
    Breaking Password Based Encryption with Azure - Gotham Digital Science
    Tags: ( passwords cracking cloud )
  7. Looks like status quo for the PCI DSS this year.
    Security.exe - Powered by The CISO Group >> Blog Archive >> No major changes to PCI DSS in 2010, but watch for chip and pin in the future
    Tags: ( pci )
  8. Graham points out something those who use twitter should be aware of. Lists as spamming tools.
    Twitter list spam
    Tags: ( lists )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Boy, you can tell it's a Monday. We have a big batch of interesting bits to take a peak at today.

Here are today's Interesting Information Security Bits from around the web.

  1. This is a long post, but a great recap of the 2009 CSAW-CTF competition. Good stuff in there. You can even try some of the challenges yourself.
    Matasano Security LLC - Chargen - Exercises for a burgeoning Army of Ninjas
    Tags: ( challenge )
  2. I don't usual point to recap posts, but Rich has a very good thought in the introduction to last week's Friday summary. Something I am dealing with myself.
    Securosis Blog | Friday Summary: January 22, 2010
    Tags: ( general )
  3. It isn't only credit card, SSNs and bank account details that are being traded by the fraudsters anymore.
    Zscaler Research: Watch out Bill Gates...
    Tags: ( social-media fraudsters )
  4. If you use any of these passwords anywhere, I strongly suggest you go change it right now.
    Top 20 website passwords you shouldn't be using | Graham Cluley's blog
    Tags: ( passwords )
  5. The latest pass at the old 'is certification worth a pickle?' question. Actually, a good article with some good advice. The comments are of value too.
    Securosis Blog | The Certification Myth
    Tags: ( certification )
  6. Dave peels back a couple layers of the security mind and peeks at what's inside.
    ShackF00 >> A Glimpse Into the Security Mindset
    Tags: ( security mindset )
  7. Ax0n digs into a new lock. Nifty stuff.
    HiR Information Report: Review: Master 1500iD "Speed Dial" lock
    Tags: ( locks )
  8. Hoff offers some sage advice on compliance and cloud computing.
    Cloud: Security Doesn't Matter (Or, In Cloud, Nobody Can Hear You Scream) | Rational Survivability
    Tags: ( cloud compliance )
  9. Brian has a neat little exploration of a browser exploit kit.
    A Peek Inside the 'Eleonore' Browser Exploit Kit -- Krebs on Security
    Tags: ( exploit browser )
  10. This time we learn a little more about Wim, a very good on-line friend of mine. We haven't met in person yet, but I know that will happen some day.
    Andrew Hay >> Blog Archive >> Information Security D-List Interview: Wim Remes
    Tags: ( interview d-list )
  11. Oops. Looks like Google forgot their 'Do no evil' motto again.
    Sunbelt Blog: Google Toolbar tracks searches after it's disabled.
    Tags: ( google-toolbar data-leakage )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Hello there! Just wanted to let you know that this Bits post is the last one you will likely see this year. I am taking some time off from the day gig and decided I am also going to do the same here. You might see a post or two if something strikes my fancy, but the Bits posts will be on hiatus.

We'll  be picking back up on January 4th.

Here are today's Interesting Information Security Bits from around the web.

  1. Another great FUDSec article.
    FUD and Other Sales Errors - fudsec.com
    Tags: ( fud )
  2. Want to build a custom wordlist based on a website for password cracking? Look no further. Here is nice how-to on getting that setup.
    Will Hack For SUSHI >> Wordlist Generation - CeWL on Ubuntu
    Tags: ( wordlist password )
  3. George has put together a nice how-to on setting up a logging virtual machine using syslog-ng, splunk and vmware. Very good stuff.
    Building a logging VM - syslog-ng and Splunk | George Starcher
    Tags: ( loging splunk )
  4. Some good information on NTLM reflection.
    Reflecting on NTLM Reflection
    Tags: ( ntlm reflection )
  5. Here is a fun fictional story about a 'lost' laptop.
    The Confessions of a Chief Executive and his lost laptop | Infosec Cynic
    Tags: ( story laptop encryption )
  6. I always get a kick of walk-through/how-we-did-it stories. This is the beginning of a series about a physical pen test.
    Red Team Physical Security Penetration Test
    Tags: ( pentest )
  7. This is absolutely full of awesome sauce. Go check it out.
    'Twas the night before D-DoS << wirewatcher
    Tags: ( poem )
  8. If you are not familiar with SteadyState and are responsible or kiosks, labs, etc., you should check out this page.
    Maintain Shared Computers with the Free Windows SteadyState Tool
    Tags: ( kiosk )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. A very good article on an issue that we need to think about as those who are very social media focused are working in our organizations.
    Lifestyle Hackers - CSO Online - Security and Risk
    Tags: ( social-media )
  2. You know you've been wanting to try it.
    Electric Alchemy: Cracking Passwords in the Cloud: Breaking PGP on EC2 with EDPR
    Tags: ( passwords cloud cracking )
  3. Wonder what the latest changes to MA 201 CMR 17.00 are? Jack does us all a wonderful service by showing us the differences.
    Uncommon Sense Security: diff MA 201 CMR 17.00
    Tags: ( ma-201-cmr-17 )
  4. Part two of SynJunkie's latest story is up.
    Syn: Bobs Double Penetration Adventure - Part 2
    Tags: ( story wifi pentest )
  5. The latest version of Microsoft's Security Intelligence Report is available.
    Download details: Microsoft Security Intelligence Report volume 7 (January - June 2009)
    Tags: ( intelligence report microsoft )
  6. This post points out that we really need to be able to communicate with non-technical audiences. It then points to a new SANS short course that helps us learn how to do that more effectively. Looks very interesting.
    Keys to Professional Communication | Courses, Training | Enclave Forensics
    Tags: ( presenting speaking writing )
  7. This page contains links to a wealth of information on psychology and information security. Fascinating stuff that will keep you busy for quite some time.
    Hat tip: Adam @ The New School of Information Security Blog
    Psychology and Security Resource Page
    Tags: ( psychology )
  8. Here is the third and final part of SpyLogic's Enterprise Open Source Intelligence Gathering series. It focuses on monitoring and social media policies.
    Enterprise Open Source Intelligence Gathering - Part 3 Monitoring and Social Media Policies -- spylogic.net
    Tags: ( gathering intelligence )
  9. This is a nicely detailed post on using OWASP ESAPI for output validation. You are validating your output, right? It is actual the second in a series. The first part on input validation is linked to at the beginning and is also worthy of a gander.
    Output Validation using the OWASP ESAPI << Security Ninja
    Tags: ( output-validation owasp esapi )
  10. Anton posits that FUD is good sometimes. Interesting perspective. The New School Security blog has an interseted reponse too: http://newschoolsecurity.com/2009/10/just-say-no-to-fud/
    A Treatise on FUD - fudsec.com
    Tags: ( iis fud )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Hi there folks. I know it's been awhile since we've had a bits post, but never fear. I did not just click 'mark all read' and am making my way through the back log. For the next few days you should see a bits post for that day and a catch-up post. This is the first catch-up post. I apologize, but the catch-up posts will probably be commentless like this one.

  1. The Ethical Hacker Network - SSHliders
    Tags: ( challenge )
  2. Nikto 2.10 released << Ramblings of the anal security guy
    Tags: ( nikto tools webappsec )
  3. Twitter Risks | The Infosec Cynic
    Tags: ( twitter humor )
  4. Syn: Abusing VLANs With BackTrack
    Tags: ( vlans backtrack )
  5. Carnal0wnage Blog: Oracle Hacker's Handbook Book Review
    Tags: ( book review oracle )
  6. Securosis Blog | IDM: Reality Sets In
    Tags: ( idm )
  7. Do the Evolution... - fudsec.com
    Tags: ( profession )
  8. Are Security "Best Practices" Unethical? << The New School of Information Security
    Tags: ( best-practices risk-management )
  9. Information Escapology << wirewatcher
    Tags: ( passwords logging )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 1 comment }

Wow, this has been a crazy busy week.

My apologies for not taking the time to get the daily bits posts out the door. However, don't despair. I have a bumper crop for you today because I have been keeping my eye on things.

Unfortunately you will have to do without my pithy (or so I'd like to believe) comments today. 🙂

Also, RSA Europe 2009, where I'll be speaking, is right around the corner along with some vacation time, so you will see fewer bits posts over the next couple weeks and they will probably be like this one.   I will be back in full gear after the conference. I will blog when I can on what I see at RSA though.

Anywho, here are today's (this weeks) Interesting Information Security Bits from around the web.

  1. Immutable Security >> Low and Slow SSH Brute Force Attacks
    Tags: ( ssh )
  2. Real World Stories: How Pen Tests Complement Vulnerability Scans << Core Security Technologies
    Tags: ( wepappsec pentest )
  3. Visa Announces New Data Encryption Practices
    Tags: ( pci )
  4. 'What's wrong with Smelly Widgets?' - Packet Challenge << I Smell Packets
    Tags: ( challenge packet )
  5. The Professional Security Testers Warehouse for the CEH GPEN QISP Q/ISP OPST CPTS - FRHACK01 copy of presentations
    Tags: ( conference presentations )
  6. Avert Labs Paper: Inside the Password Stealing Business:the Who and How of Identity Theft | Hackers Center Blogs
    Tags: ( passwords )
  7. AVG Stepping Up Consumer Anti-Virus Offerings | Darknet - The Darkside
    Tags: ( anti-virus avg )
  8. Man banished from PayPal for showing how to hack PayPal * The Register
    Tags: ( paypal )
  9. Book Review: The Rootkit Arsenal << McGrew Security Blog
    Tags: ( books reviews )
  10. Jeremiah Grossman: All about Website Password Policies
    Tags: ( infosce passwords )
  11. Digital Soapbox - Preaching Security to the Digital Masses: Things I Learned at SecTor 2009
    Tags: ( conference toorcon recap )
  12. TaoSecurity: Technical Visibility Levels
    Tags: ( avialability monitoring )
  13. SSL Still Mostly Misunderstood - DarkReading
    Tags: ( ssl )
  14. Anton Chuvakin Blog - "Security Warrior": Compliance != Security, Does Security = Compliance?
    Tags: ( compliance security )
  15. A Page from Singapore's Cybersecurity Playbook | Optimal Security: The Lumension Blog
    Tags: ( general )
  16. You Can't Always Be Proactive - Hacked Off - Dark Reading
    Tags: ( general )
  17. Security Uncorked >> Good, Bad and Ugly: On SecTor's Wall of Shame
    Tags: ( passwords wireless )
  18. CSS History Hack Used To Ban Torrent Users ha.ckers.org web application security lab
    Tags: ( css )
  19. Yahoo Best Jobs in America ranks infosec professional #8
    Tags: ( career )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. Microsoft has released a couple of nifty tools for developers to help them ensure their code is more secure. Bonus: They are FREE!
    Jeff Jones Security Blog : SDL Team Adds Test Tools to the SDL Tools Arsenel
    Tags: ( sdl )
  2. Here is a method to help you generate easily recreatable (for you) complex passwords. I have used similar methods before.
    Magic Formula for Passwords : The Security Catalyst
    Tags: ( passwords )
  3. A closer step to using frequency analysis to detect encrypted traffic on your network. Neat stuff.
    Detecting encrypted traffic with net-entropy, part one << wirewatcher
    Tags: ( monitoring encryption )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 2 comments }

Good afternoon everybody! Sorry for missing both Friday's and yesterdays bits posts. My Friday was spent working with Habitat for Humanity on a new home for a deserving family. It was a great experience and I heartily recommend it as time well spent. Yesterday was just too busy 🙂

Anyway, here are today's, and a few from this weekend, Interesting Information Security Bits from around the web.

  1. A new version of OffVis is available along with a training video.
    Security Research & Defense : OffVis updated, Office file format training video created
    Tags: ( tools microsoft office )
  2. Here is an interesting adaption of "The Joel Test."
    Matasano Security LLC - Chargen - The Joel Test: 12 Steps To Better IT Management
    Tags: ( general )
  3. A great article from Russel. This one contains some tips for building an Information Security Risk Scorecard.
    12 Tips for Designing an InfoSec Risk Scorecard (its harder than it looks) << The New School of Information Security
    Tags: ( scorecard risk )
  4. This is a very interesting article about backups and virtualization strategies. A very import part of your strategy needs to be, How are you going to deal with backups?
    The Side Effects of Backup on Server Virtualization - Backup & Beyond
    Tags: ( virtualization backup )
  5. The latest version of the SANS Top Cyber Security Risks report is out.
    SANS: The Top Cyber Security Risks
    Tags: ( risks )
  6. Here is a nice article with some questions to ask when considering the implementation of an identity management solutions. (Hat Tip: http://securityblog.typepad.com)
    12 questions to ask before implementing an identity management system -- Government Computer News
    Tags: ( identity-management )
  7. The Security Twits bus is off on another adventure as it gathers up a bunch to twits and heads to SecTor. Let Jack know if you want to be picked up 🙂
    Uncommon Sense Security: Security Twits Road Trip III, the SecTorBus
    Tags: ( conferences security-twits )
  8. Rsnake has a whole pile of HTTP headers for you to play with should you want to. I bet some interesting things can be found out.
    Half a Million HTTP Headers ha.ckers.org web application security lab
    Tags: ( data )
  9. An entirely virtual security conference is taking place on November 6th-8th. Very cool. What's even better is that all CFPs are being accepted.
    SecurityTubeCon - Democratizing Hacker Cons
    Tags: ( conference cfp securitytube )
  10. Want to setup some motion sensors to tweet activity? Ax0n shows us how.
    HiR Information Report: Gustav, the hackerspace twitter-bot
    Tags: ( hardware-hacking )
  11. SynJunkie took a short break from his CCNA studies (good posts in that series too) to give a post about using Fgdump, John the Ripper and Powershell together to do some nifty scripted password auditing.
    Syn: Password Auditing with Fgdump, John the Ripper & PowerShell
    Tags: ( passwords cracking )
  12. Russel has an interesting challenge for us. I know a few in academia that might enjoy this conversation.
    This Friday is "Take an Academic Friend to Work Day" << The New School of Information Security
    Tags: ( general )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

  1. Download your HAR2009 videos here.
    HAR2009: where to get the presentation videos | Security4all - Dedicated to digital security, enterprise 2.0 and presentation skills
    Tags: ( har2009 videos )
  2. A nice list of password managers worthy of a gander.
    Password Managers, something worth considering. Some Options | Security Active Blog
    Tags: ( passwords tools )
  3. The ToorCon 11 Call for Papers is open.
    ToorCon - Conference
    Tags: ( toorcon conferences cfp )
  4. Kees is trying to get a infosec community going on Long Island. If you are in that area, check it out.
    Long Island Information Security - Kees Leune
    Tags: ( general )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Good afternoon everybody! I hope your day is going well. Sorry for the missing Bits posts on Friday and yesterday. I took Friday off and just didn't get it done yesterday. Therefore, we have quite a crop today.

Here are today's Interesting Information Security Bits from around the web.

  1. Here is an interesting article on how Mozilla finds bugs that crash their products.
    How Mozilla finds crash bugs at Mozilla Security Blog
    Tags: ( mozilla )
  2. Here is a handy list of on-line malware scanners.
    List of Online Malware Scanners | PenTestIT
    Tags: ( tools malware scanners )
  3. The last of the three Panda challenges is up. I understand some answers have already been submitted, but you never know, they could be wrong.
    Panda Challenge: Hard Level - PandaLabs
    Tags: ( challenge )
  4. Wow. Just wow.
    I Can Has UR .htaccess File
    Tags: ( twitter )
  5. Raf's next interview. This time he talks to Mike "mckt" Bailey.
    Digital Soapbox - Preaching Security to the Digital Masses: 31337 Spotlight: "mckt"
    Tags: ( interviews )
  6. RSnake finds some interesting things you can do with/to wget.
    wget DNS-rebinding and Weak Intranet Port Scanning ha.ckers.org web application security lab
    Tags: ( wget )
  7. Here some information for you if you are interested in hacking your Defcon 17 badge.
    DC17 Badge Pre-Release Information - Defcon Forums
    Tags: ( defcon17 )
  8. Answers to the 2nd Panda Challenge.
    2nd Panda Challenge solution & winners - PandaLabs
    Tags: ( challenge )
  9. Raf interviewed Mubix for the first of a series of interviews of security folk.
    Digital Soapbox - Preaching Security to the Digital Masses: 31337 Spotlight: Mubix
    Tags: ( interview )
  10. An interesting article which brings up some good points. I would add password age to this type of consideration also, provided compensating controls are in place like lockouts as presented in the paper.
    Do Strong Web Passwords Accomplish Anything? (PDF)
    Tags: ( passwords )
  11. Inferno put together a couple things and came up with a fairly scaring attack on CRSF tokens.
    Hacking CSRF Tokens using CSS History Hack | SecureThoughts.com
    Tags: ( hacking crsf )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }