passwords

Hello there! Just wanted to let you know that this Bits post is the last one you will likely see this year. I am taking some time off from the day gig and decided I am also going to do the same here. You might see a post or two if something strikes my fancy, but the Bits posts will be on hiatus.

We'll be picking back up on January 4th.

Here are today's Interesting Information Security Bits from around the web.

Another great FUDSec article.
FUD and Other Sales Errors - fudsec.com
Tags: ( fud )
Want to build a custom wordlist based on a website for password cracking? Look no further. Here is nice how-to on getting that setup.
Will Hack For SUSHI >> Wordlist Generation - CeWL on Ubuntu
Tags: ( wordlist password )
George has put together a nice how-to on setting up a logging virtual machine using syslog-ng, splunk and vmware. Very good stuff.
Building a logging VM - syslog-ng and Splunk | George Starcher
Tags: ( loging splunk )
Some good information on NTLM reflection.
Reflecting on NTLM Reflection
Tags: ( ntlm reflection )
Here is a fun fictional story about a 'lost' laptop.
The Confessions of a Chief Executive and his lost laptop | Infosec Cynic
Tags: ( story laptop encryption )
I always get a kick of walk-through/how-we-did-it stories. This is the beginning of a series about a physical pen test.
Red Team Physical Security Penetration Test
Tags: ( pentest )
This is absolutely full of awesome sauce. Go check it out.
'Twas the night before D-DoS << wirewatcher
Tags: ( poem )
If you are not familiar with SteadyState and are responsible or kiosks, labs, etc., you should check out this page.
Maintain Shared Computers with the Free Windows SteadyState Tool
Tags: ( kiosk )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Interesting Information Security Bits for 11/02/2009

by kriggins on November 2, 2009

in Interesting Bits

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

A very good article on an issue that we need to think about as those who are very social media focused are working in our organizations.
Lifestyle Hackers - CSO Online - Security and Risk
Tags: ( social-media )
You know you've been wanting to try it.
Electric Alchemy: Cracking Passwords in the Cloud: Breaking PGP on EC2 with EDPR
Tags: ( passwords cloud cracking )
Wonder what the latest changes to MA 201 CMR 17.00 are? Jack does us all a wonderful service by showing us the differences.
Uncommon Sense Security: diff MA 201 CMR 17.00
Tags: ( ma-201-cmr-17 )
Part two of SynJunkie's latest story is up.
Syn: Bobs Double Penetration Adventure - Part 2
Tags: ( story wifi pentest )
The latest version of Microsoft's Security Intelligence Report is available.
Download details: Microsoft Security Intelligence Report volume 7 (January - June 2009)
Tags: ( intelligence report microsoft )
This post points out that we really need to be able to communicate with non-technical audiences. It then points to a new SANS short course that helps us learn how to do that more effectively. Looks very interesting.
Keys to Professional Communication | Courses, Training | Enclave Forensics
Tags: ( presenting speaking writing )
This page contains links to a wealth of information on psychology and information security. Fascinating stuff that will keep you busy for quite some time.
Hat tip: Adam @ The New School of Information Security Blog
Psychology and Security Resource Page
Tags: ( psychology )
Here is the third and final part of SpyLogic's Enterprise Open Source Intelligence Gathering series. It focuses on monitoring and social media policies.
Enterprise Open Source Intelligence Gathering - Part 3 Monitoring and Social Media Policies -- spylogic.net
Tags: ( gathering intelligence )
This is a nicely detailed post on using OWASP ESAPI for output validation. You are validating your output, right? It is actual the second in a series. The first part on input validation is linked to at the beginning and is also worthy of a gander.
Output Validation using the OWASP ESAPI << Security Ninja
Tags: ( output-validation owasp esapi )
Anton posits that FUD is good sometimes. Interesting perspective. The New School Security blog has an interseted reponse too: http://newschoolsecurity.com/2009/10/just-say-no-to-fud/
A Treatise on FUD - fudsec.com
Tags: ( iis fud )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Interesting Information Security Bits RSA Catch-up Part 1

by kriggins on October 25, 2009

in Interesting Bits

Hi there folks. I know it's been awhile since we've had a bits post, but never fear. I did not just click 'mark all read' and am making my way through the back log. For the next few days you should see a bits post for that day and a catch-up post. This is the first catch-up post. I apologize, but the catch-up posts will probably be commentless like this one.

The Ethical Hacker Network - SSHliders
Tags: ( challenge )
Nikto 2.10 released << Ramblings of the anal security guy
Tags: ( nikto tools webappsec )
Twitter Risks | The Infosec Cynic
Tags: ( twitter humor )
Syn: Abusing VLANs With BackTrack
Tags: ( vlans backtrack )
Carnal0wnage Blog: Oracle Hacker's Handbook Book Review
Tags: ( book review oracle )
Securosis Blog | IDM: Reality Sets In
Tags: ( idm )
Do the Evolution... - fudsec.com
Tags: ( profession )
Are Security "Best Practices" Unethical? << The New School of Information Security
Tags: ( best-practices risk-management )
Information Escapology << wirewatcher
Tags: ( passwords logging )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 1 comment }

Interesting Information Security Bits for 10/09/2009

by kriggins on October 9, 2009

in Interesting Bits

Wow, this has been a crazy busy week.

My apologies for not taking the time to get the daily bits posts out the door. However, don't despair. I have a bumper crop for you today because I have been keeping my eye on things.

Unfortunately you will have to do without my pithy (or so I'd like to believe) comments today. 🙂

Also, RSA Europe 2009, where I'll be speaking, is right around the corner along with some vacation time, so you will see fewer bits posts over the next couple weeks and they will probably be like this one. I will be back in full gear after the conference. I will blog when I can on what I see at RSA though.

Anywho, here are today's (this weeks) Interesting Information Security Bits from around the web.

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Interesting Information Security Bits for 09/17/2009

by kriggins on September 17, 2009

in Interesting Bits

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

Microsoft has released a couple of nifty tools for developers to help them ensure their code is more secure. Bonus: They are FREE!
Jeff Jones Security Blog : SDL Team Adds Test Tools to the SDL Tools Arsenel
Tags: ( sdl )
Here is a method to help you generate easily recreatable (for you) complex passwords. I have used similar methods before.
Magic Formula for Passwords : The Security Catalyst
Tags: ( passwords )
A closer step to using frequency analysis to detect encrypted traffic on your network. Neat stuff.
Detecting encrypted traffic with net-entropy, part one << wirewatcher
Tags: ( monitoring encryption )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 2 comments }

Interesting Information Security Bits for 09/15/2009

by kriggins on September 15, 2009

in Interesting Bits

Good afternoon everybody! Sorry for missing both Friday's and yesterdays bits posts. My Friday was spent working with Habitat for Humanity on a new home for a deserving family. It was a great experience and I heartily recommend it as time well spent. Yesterday was just too busy 🙂

Anyway, here are today's, and a few from this weekend, Interesting Information Security Bits from around the web.

A new version of OffVis is available along with a training video.
Security Research & Defense : OffVis updated, Office file format training video created
Tags: ( tools microsoft office )
Here is an interesting adaption of "The Joel Test."
Matasano Security LLC - Chargen - The Joel Test: 12 Steps To Better IT Management
Tags: ( general )
A great article from Russel. This one contains some tips for building an Information Security Risk Scorecard.
12 Tips for Designing an InfoSec Risk Scorecard (its harder than it looks) << The New School of Information Security
Tags: ( scorecard risk )
This is a very interesting article about backups and virtualization strategies. A very import part of your strategy needs to be, How are you going to deal with backups?
The Side Effects of Backup on Server Virtualization - Backup & Beyond
Tags: ( virtualization backup )
The latest version of the SANS Top Cyber Security Risks report is out.
SANS: The Top Cyber Security Risks
Tags: ( risks )
Here is a nice article with some questions to ask when considering the implementation of an identity management solutions. (Hat Tip: http://securityblog.typepad.com)
12 questions to ask before implementing an identity management system -- Government Computer News
Tags: ( identity-management )
The Security Twits bus is off on another adventure as it gathers up a bunch to twits and heads to SecTor. Let Jack know if you want to be picked up 🙂
Uncommon Sense Security: Security Twits Road Trip III, the SecTorBus
Tags: ( conferences security-twits )
Rsnake has a whole pile of HTTP headers for you to play with should you want to. I bet some interesting things can be found out.
Half a Million HTTP Headers ha.ckers.org web application security lab
Tags: ( data )
An entirely virtual security conference is taking place on November 6th-8th. Very cool. What's even better is that all CFPs are being accepted.
SecurityTubeCon - Democratizing Hacker Cons
Tags: ( conference cfp securitytube )
Want to setup some motion sensors to tweet activity? Ax0n shows us how.
HiR Information Report: Gustav, the hackerspace twitter-bot
Tags: ( hardware-hacking )
SynJunkie took a short break from his CCNA studies (good posts in that series too) to give a post about using Fgdump, John the Ripper and Powershell together to do some nifty scripted password auditing.
Syn: Password Auditing with Fgdump, John the Ripper & PowerShell
Tags: ( passwords cracking )
Russel has an interesting challenge for us. I know a few in academia that might enjoy this conversation.
This Friday is "Take an Academic Friend to Work Day" << The New School of Information Security
Tags: ( general )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Interesting Information Security Bits for 08/28/2009

by kriggins on August 28, 2009

in Interesting Bits

Good afternoon everybody! I hope your day is going well.

Here are today's Interesting Information Security Bits from around the web.

Download your HAR2009 videos here.
HAR2009: where to get the presentation videos | Security4all - Dedicated to digital security, enterprise 2.0 and presentation skills
Tags: ( har2009 videos )
A nice list of password managers worthy of a gander.
Password Managers, something worth considering. Some Options | Security Active Blog
Tags: ( passwords tools )
The ToorCon 11 Call for Papers is open.
ToorCon - Conference
Tags: ( toorcon conferences cfp )
Kees is trying to get a infosec community going on Long Island. If you are in that area, check it out.
Long Island Information Security - Kees Leune
Tags: ( general )

That's it for today. Have fun!

Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.

Kevin

{ 0 comments }

Interesting Information Security Bits for 07/21/2009

by kriggins on July 21, 2009

in Interesting Bits

Good afternoon everybody! I hope your day is going well. Sorry for the missing Bits posts on Friday and yesterday. I took Friday off and just didn't get it done yesterday. Therefore, we have quite a crop today.

Here are today's Interesting Information Security Bits from around the web.

Here is an interesting article on how Mozilla finds bugs that crash their products.
How Mozilla finds crash bugs at Mozilla Security Blog
Tags: ( mozilla )
Here is a handy list of on-line malware scanners.
List of Online Malware Scanners | PenTestIT
Tags: ( tools malware scanners )
The last of the three Panda challenges is up. I understand some answers have already been submitted, but you never know, they could be wrong.
Panda Challenge: Hard Level - PandaLabs
Tags: ( challenge )
Wow. Just wow.
I Can Has UR .htaccess File
Tags: ( twitter )
Raf's next interview. This time he talks to Mike "mckt" Bailey.
Digital Soapbox - Preaching Security to the Digital Masses: 31337 Spotlight: "mckt"
Tags: ( interviews )
RSnake finds some interesting things you can do with/to wget.
wget DNS-rebinding and Weak Intranet Port Scanning ha.ckers.org web application security lab
Tags: ( wget )
Here some information for you if you are interested in hacking your Defcon 17 badge.
DC17 Badge Pre-Release Information - Defcon Forums
Tags: ( defcon17 )
Answers to the 2nd Panda Challenge.
2nd Panda Challenge solution & winners - PandaLabs
Tags: ( challenge )
Raf interviewed Mubix for the first of a series of interviews of security folk.
Digital Soapbox - Preaching Security to the Digital Masses: 31337 Spotlight: Mubix
Tags: ( interview )
An interesting article which brings up some good points. I would add password age to this type of consideration also, provided compensating controls are in place like lockouts as presented in the paper.
Do Strong Web Passwords Accomplish Anything? (PDF)
Tags: ( passwords )
Inferno put together a couple things and came up with a fairly scaring attack on CRSF tokens.
Hacking CSRF Tokens using CSS History Hack | SecureThoughts.com
Tags: ( hacking crsf )

passwords

Interesting Information Security Bits for 12/18/2009

Interesting Information Security Bits RSA Catch-up Part 1

Interesting Information Security Bits for 10/09/2009

Interesting Information Security Bits for 09/17/2009

Interesting Information Security Bits for 09/15/2009

Interesting Information Security Bits for 08/28/2009

Interesting Information Security Bits for 07/21/2009

Subscription Options

Facebook

Recent Posts

Pages

Speaking Schedule

Recent Comments

Categories