Interesting Information Security Bits for 09/30/2008

September 30, 2008

Good afternoon everybody! I hope your day is going well.
Here are today’s Interesting Information Security Bits from around the web.

  1. *nux Live Acquisition Techniques
    Cutaway gives us a nice walk-through of how he dealt with some issues when trying to acquire drive images during a recent incident response.
  2. Fiction Versus Function: Three Unspoken Annoynaces of Cisco & VMware’s Virtualization “Partnership”
    Beaker pens another interesting missive about VMWare and Cisco getting together and what that might mean for both server admins and network admins.
  3. Impact of the Economic Crisis on Security
    Rich has a great post up with some insightful observations about what effect the current financial situation may have on our industry and our jobs. You should go read it.
  4. FAQ: Clickjacking — should you be worried?
    A very good explanation for what Clickjacking is.
    Hat tip: @jeremiahg
  5. Dark Reading – New DOS Attack Is a Killer – Snake Bytes
    Some interesting stuff coming out of Sweden, interesting as in the sky is falling.
  6. Sex, death and Gartner IT security summits
    David give’s us an overview of the opening day of the Gartner IT Security Summit in London. Interesting stuff being talked about there.
  7. FOXNews.com – For Sale: Used Spy Camera With Top Secret Terror Records – Science News | Science & Technology | Technology News
    When things like this happen, you just want smack yourself in the forehead and ask how can people not get it to this degree?

    Hat tip: @cre8tn

  8. Andrew Hay >> Blog Archive >> Secure Life Ep 1
    Neat cartoon that really gets to the point.

That’s it for today. Have fun!
Kevin


It’s quicker, but don’t forget to fix it…

September 30, 2008

Good morning/afternoon/evening everybody.

Hope your day was/is/will be great! :)

Lori MacVittie over at DevCentral, who you should all read, wrote Which security strategy takes more time: configuration or coding? recently. It’s a good article with some very valid points, but it made me think of something else we need to be aware of when we make “time trade-off” choices.

I agree that WAFs, ACLs, black holing traffic, etc. are all good and
effective methods of mitigating risk and protecting against known
threats and in some case unknown threats. For example, how often have you whipped up a solution to a problem and slapped it into place?  You know it is not an appropriate long term solution, but you say to yourself, “I’ll come back and do that better when I have time.”

Fast forward 3 years and your quick fix is still in production causing all sorts of grief because it was never intended to be a long term solution and/or nobody knows what this things is doing and they remove it, again, causing all kinds of grief.

Maybe I’m stating the obvious, but we need to make sure we have effective policies and procedures in place to ensure that we are addressing things in an appropriate manner, independent of the “this is quicker” mentality. Again, I am not saying that quicker shouldn’t be used.  It has it’s place and often is the best short term choice.  I just want to remind everybody that we need to keep that long term horizon in sight also.

Agree, disagree, think I’m looney?  Leave me a note in the comments with your thoughts.

Kevin

Image courtsey of jakeliefer


Interesting Information Security Bits for 09/29/2008

September 29, 2008

Good afternoon everybody! I hope your day is going well.
Here are today’s Interesting Information Security Bits from around the web.

  1. Indirect iPhone Forensics << SANS Computer Forensics, Investigation, and Response
    Um, folks, large portions of the data on your iPhone or Ipod devices are likely on your computer too. Check out John’s writeup on how to read said info.
  2. Security Ripcord >> Blog Archive >> Dumping Files Names from MS Windows Directory
    Nifty batch file to get a list of files in a directory. Very nice when hooked up to the context sensitive menu as suggested in the article. Slight modification to write to new media would make it handy for forensics too.
  3. HiR Information Report: Introduction to Proximity Cards
    An interesting introduction to proximity cards. Very detailed but understandable.
  4. StillSecure, After All These Years: Do you need a free vulnerability management solution?
    Free tool available from StillSecure. Looks interesting. Will have to play with it later.
  5. Security School: Getting the most out of your SIM deployment
    Adrean Lane’s Integration of Networking and Security School on SearchSecurity.com.
  6. Data loss prevention: Data Protection Security School: Security Schools: SearchSecurity.com
    Rich Mogulls SearchSecurity Data Protection Security School.
  7. Protecting your Cookies
    Dan has an interesting post up that discusses his progression from single browser to multiple browsers to browsers with SSBs and finally to two browsers in the attempt keep his sensitive data segregated with browsing the evil internets. Go look.
  8. New version of Helix Forensics LiveCD released
    Title says it all.
  9. Maltego 2 and beyond – Part 2
    Mubix has part 2 up of a series of posts that walk us through using Maltego.
  10. Why Blog?
    Not directly related to InfoSec, but a very good post on reasons to blog has been posted by Richard. Give it a read and see if it doesn’t help you either take that step to blog or better focus the blogging you do.
  11. Friday Summary
    Rich as posted some pointers to some things he and Adrian have been doing lately. The DLP and SIM security schools over at TechTarget look very interesting.
  12. Quickpost: Stored User Names and Passwords
    Didier gives us some interesting info about where Windows keeps stored passwords. He also points us to some tools to work with them.

That’s it for today. Have fun!
Kevin


Interesting Information Security Bits for 09/26/2008

September 26, 2008

Good afternoon everybody! I hope your day is going well.
Here are today’s Interesting Information Security Bits from around the web.

  1. PaulDotCom: Archives
    Larry has a good post up about watching where your data is, particularly in this day of an ever increasingly mobile workforce.
  2. Net pariah Intercage back among the dead * The Register
    Read the article for the details, but title pretty much explains it.
  3. /dev/random >> Blog Archive >> Workstation (Un)locking Using Bluetooth
    Interesting idea, but I agree with the reviewer, needs a little more that just the presence of a phone or bluetooth device to unlock. Besides which, what if you leave your phone at your desk…oops.
  4. Wigle.net: The 411 on Wireless Access Points – Security Fix
    See if your AP is known to the world. While my neighborhood is on the map with some APs, mine isn’t there.
  5. The Security Shoggoth: Malware Analysis Contest
    The Security Shoggoth (Tyler) announced that a malware analysis contest will be starting on October 1st. Go check it out. Could be a lot of fun.
    Hat Tip: Tom at Spylogic
  6. IT Security: Can We Be Compliant and Yet Insecure?
    Bill Sieglein asks in an article on CSOOnline, “Can we be Compliant and Yet Insecure?” Um…yup. However, Bill doesn’t just ask the question and answer it. He also provides some good advice on how to avoid getting trapped in “Just get through the audit” land.
  7. Memory exhaustion DoS vulnerability hits Google’s Chrome | Zero Day | ZDNet.com
    Dancho shares with us that there has been another vulnerability found in Google’s Chrome browser. He talks with the group who found it. Interesting read.
  8. Myths, Misconceptions, Half-Truths and Lies about Virtualization << Amrit Williams Blog
    A great post by Amrit discussing virtualization and many of the challenges associated with it that people tend to overlook.

That’s it for today. Have fun!
Kevin


Headed to RSA Europe 2008

September 26, 2008

Cool news folks.  I am now an accredited press/analyst for RSA Europe 2008.  Even better, I’m going. Hotel reservations have been made and flights booked.  I am looking forward to attending.  This will be my first RSA and looking at the agenda, it appears that there will be plenty of interesting talks to sit in on.

More importantly though, I am looking forward to meeting and talking with other information security professionals.  I already know that several of the @SecurityTwits are going to be there.  Please drop me a note or leave a comment if you are going to be there.  I’m thinking a meetup might be in order if enough are interested.  If not, lunches and hallways are always available for meeting and greeting.

I look forward to hearing from you all.

Kevin


Interesting Information Security Bits for 09/25/2008

September 25, 2008

Good afternoon everybody! I hope your day is going well.
Here are today’s Interesting Information Security Bits from around the web.

  1. (IN)SECURE Magazine
    Issue 18 is out.
  2. Dailydave: “ClickJacking”
    A good description of clickjacking.
    Hat tip: @lmacvittie
  3. BSQL Hacker – Automated SQL Injection Framework | Darknet – The Darkside
    Title defines it pretty well.
  4. Tenable Network Security: Nessus Virtual Appliance
    Nessus has released a virtual appliance image for Nessus 3. Pretty cool.
  5. Dark Reading – Outside Insight – Snake Bytes
    RSnake reminds us to not forget yesterday’s issues.
  6. HubLog: Logout/Login CSRF
    Wow. Not a good thing at all. You really need to check this out. Remember to check who you are logged in as periodically.
    Hat tip: @geekgrrl
  7. HttpFox :: Firefox Add-ons
    Nifty plugin to explore what is happening during http communications.
    Hat tip: @lmacvittie

That’s it for today. Have fun!
Kevin


Interesting Information Security Bits for 09/24/2008

September 24, 2008

Good afternoon everybody! I hope your day is going well.
Here are today’s Interesting Information Security Bits from around the web.

  1. Raise user security awareness with a free training kit | IT Security | TechRepublic.com
    Chad Perrin has the first of a series of articles that will explore using the free materials that area available from Microsoft for Security Awareness training.
  2. samsclass.info: Sam Bowne Class Information
    This site is referred to by on of the other posts mentioned today, but I thought it deserved its own mention. Good resource for free training materials if you are so inclined.
  3. ‘Profiler’ Hacks Global Hacker Culture – Desktop Security News Analysis – Dark Reading
    An interesting article by Kelly Jackson Higgins about profiling hackers and one man’s efforts to do so.
  4. Certification still pays for CISSPs, CISMs
    Carolyn Gibnet has some info gleaned from the Foote Partners IT Salary Survey about how the CISSP and CISM certifications affects your salary.
  5. Researchers discover PDF exploit packs | Zero Day | ZDNet.com
    There is an exploit pack that targets PDFs running around. Ryan gives us more info.
  6. India’s government: At last, we’ve cracked Blackberry’s encryption | Zero Day | ZDNet.com
    Dancho relays a report that the Indian government claims to have cracked Blackberry’s encryption, kind of.
  7. Graham Cluley’s blog
    Sophos has a new release that contains “enhanced malware protection.” Probably worth playing with.
  8. Dirty dozen: Firefox ships patch for 12 security flaws | Zero Day | ZDNet.com
    Time to patch Firefox. Ryan breaks down what the latest update fixes.
  9. Coding Horror: Cross-Site Request Forgeries and You
    Jeff explains very clearly how csrf attacks work.
  10. Dismantling an XML-Bomb << Didier Stevens
    Didier walks us through how easy it is to create an XML bomb and then gives us some suggestions on how to defend against them. Very cool stuff.
  11. Teaching Hacking at College by Sam Bowne(Hacking Illustrated Series InfoSec Tutorial Videos)
    Irongeek points out Sam Bowne’s DefCon 15 talk about teaching hacking at college. Good stuff.

That’s it for today. Have fun!
Kevin


OT: Workflow for Interesting Bits posts…

September 23, 2008

This weekend I decided I wanted a more automated way to publish my ‘Interesting Information Security Bits’ posts. To do that I decided I needed two things 1) a workflow process and 2) some tools to do the dirty work for me. So that is what I set out to setup. The rest of this post gives details of the work flow and the script that I came up with to create the posts.

Workflow

I decided to use Delicious to collect the things that I want to appear in the posts.  They were going to end up there anyway and an API exists to get at them in an automated fashion.  In order to be able to selectively get just the posts I wanted for a given day, I had to come up with a tagging scheme that would differentiate these bookmarks from any others I might save. I did this by tagging them by date, in YYYYMMDD format, and with ‘iisb.’  For this first iteration of the script, I am only using the date portion.  The iisb tag will be used later as I expand this effort.  So my workflow goes like this:

  1. Find interesting things (web, twitter, RSS,etc.)
  2. Bookmark them on Delicious.
  3. Run script once a day.
  4. Profit (not really)

A couple notes about how I bookmark things on Delicious.  I use the Firefox add-in for this.  It makes it so much easier.  When I bookmark something, I make sure to enter a description.  This becomes the text explaining why I think that particular item is interesting. Finally, I also tag the item with other tags.  These tags are for my personal use and also will be used in future expansions of the script.

Script

So, now I have a bunch of things that I believe are interesting that I want to tell all of you about.  Instead of having to spend a lot of time with a blog post editor, I simply login to my linux machine and execute

./dailypost.pl

Tada, magical blog post.

This script is written in perl because that’s the language I can churn things out quickly in at this time.  It uses several CPAN modules, but the most important ones are Net::Delicious and WordPress::XMLRPC. Why reinvent the wheel.  Eventually, the posting part will be automatic using cron, but I still have some things I want to do before I turn it loose.

For those interested in the guts of the script, here it is.  It consists of the dailypost.pl perl script and a config file.  Obviously, replace my comments below with your info if you want to try it.  I currently have it set to create the posts as drafts and I then go and publish them manually.  Again, this is because this is a pretty young process.

Config file (must be named dailypost.cfg and in the same directory as the script at this time)

[delicious]
  user="username"
  pswd="delicious password"
  count=100
[wordpress]
  prefix="What you want the opening to be."
  postfix="What you want the ending to be."
  category="Wordpress category"
  title="post title prefix. The date will be appended"
  publish=0
  username="username"
  password="wordpress password"
  xmlrpcurl="http://<your site>/xmlrpc.php"

Script.  (I apologize for the complete lack of comments. Quick and dirty was what I was after.)

#!/usr/bin/perl -CS

use Net::Delicious;
use WordPress::XMLRPC;
use Config::Simple;
use Log::Dispatch::Screen;
use Text::Unidecode;
use Date::Format;

my $config = new Config::Simple('dailypost.cfg');
my $description = '';
my $body = '';
my $postDate = time2str("%Y%m%d", time);

my $del = Net::Delicious->new($config);

my $o = WordPress::XMLRPC->new({
  username => $config->param("wordpress.username"),
  password => $config->param("wordpress.password"),
  proxy => $config->param("wordpress.xmlrpcurl"),
  blog_id => $config->param("wordpress.blog_id")
});

foreach my $p ($del->recent_posts({tag => "$postDate",
               count => $config->param("delicious.count")})) {
  $body .= "<li><a target='_blank' href='" . $p->href() .
               "'>" . unidecode($p->description) . "</a>\n" .
  unidecode($p->extended()) . "</li>\n";
}

$description = $config->param("wordpress.prefix") .
$body .
$config->param("wordpress.postfix");
$post->{categories} = [$config->param("wordpress.category")];
$post->{title} = $config->param("wordpress.title") .
                           time2str("%m/%d/%Y",time);
$post->{description} = $description;

$page_num = $o->newPost($post,$config->param("wordpress.publish"));

print $description . "\n";
print "page num = ", $page_num, "\n";

That’s basically it.  I’m happy to have discussion about this with anyone who has questions and feel free to take and use anything you want.  I am also happy to email the config file and script to anyone who wants it.  Just drop me a note a kriggins _at_ infosecramblings.com.

Kevin


Interesting Information Security Bits for 09/23/2008

September 23, 2008

Good afternoon everybody! I hope your day is going well.
Here are today’s Interesting Information Security Bits from around the web.

  1. WASC Web Application Security Statistics Project 2007 published | Security4all – Dedicated to digital security, enterprise 2.0 and presentation skills
    Security4all points out that the WASC (Web Application Security) Statistics Project 2007 has published their results. Worth peaknig at.
  2. Tenable Network Security: Detecting Manually Compiled Network Daemons
    A nifty plugin for Nessus that scans for services that are not an integral part of the operating system or known package. These types of services, while not neccessarily bad, often deserve a closer look.
  3. PaulDotCom: Archives – September Late-Breaking Computer Attack Vectors
    Pauldotcom.com’s September attack vectors update is on September 24th at 2:00pm EDT (GMT -4:00).
  4. Lawyers Can Help You Document << SANS Computer Forensics, Investigation, and Response
    J. Michael Butler writes that it is important to document things during a forensic invesitigation, but maybe even more importantly, it is important to be very careful how we document due to the new e-discovery rules. Great article with some addtional resources worth reading mentioned.
  5. IBM Rational Application Security Insider: Winamp NowPlaying Unspecified Vulnerability: The Details
    Yair Amit discusses a vulnerability in WinAmp that has since been resolved. An interesting read.

That’s it for today. Have fun!
Kevin


Interesting Information Security Bits for 09/22/2008

September 22, 2008

Good afternoon everybody! I hope your day is going well. Here are today’s Interesting Information Security Bits from around the web.

  1. Modern Exploits – Do You Still Need To Learn Assembly Language (ASM) | Darknet – The Darkside
    Yup. I agree with Darknet.org.uk’s stance. A little Assembly never hurt anybody and can be very helpful. Granted, many areas of InfoSec may not need it, but it sure doesn’t hurt.
  2. Initech, Inc. Risktical Ramblings
    From the Post:
    “As part of my goal of wanting to post some risk scenarios and accompanying assessments on the blog, I went ahead and posted a profile of a company (and one of its subsidiaries) over on the “Initech, Inc” page. Instead of having to write background and “given” information for each and every risk scenario – doing it once will save a lot of time.”
    This is a really neat idea. I look forward to seeing what Chris will bring us in the future.
  3. KU: Technology Documentation:
    Vi @jfug on twitter, a link to a good set of resources published by the security department at Kansas University. Some good stuff there.
  4. HiR Information Report: Make your own lock picks – Part 1
    Ax0n has a series of articles that show you how to make you own set of lock picks. Nifty.
  5. DecaffeinatID: A Very Simple IDS / Log Watching App / ARPWatch For Windows
    DecaffeinatID has been updated. Go take a gander.
  6. Neopwn, the World’s First Pentesting Mobile Phone
    ** Posted using Viigo: Mobile RSS, Sports, Current Events and more ** thefanboy writes “What do you get when you cross BackTrack Linux apps with a mobile phone? This is the first ever publicly available mobile phone running a full custom Linux network auditing distribution, and it runs it surprisingly well. One can literally go from phone to pwn in 2 seconds. Based off of the Openmoko Neo Freerunner, many steps have been taken to compensate from the lack of a QWERTY keyboard with automation scripts, dialogs, and a point-and-pwn menu. It runs applications such as Metasploit and the Aircrack suite quite well, especially given the fact that it supports a wide array of USB WLAN cards.”

    Read more of this story at Slashdot.

  7. McAfee offers $465 million for Secure Computing | News – Security – CNET News
    More consolidation in the information security vendor space.
  8. IT Security Expert: Eugene Kaspersky on the Latest Malware Trends
    Dave Whitelegg had the opportunity to talk with Eugene Kaspersky recently.
  9. VMWare issues “critical” ESXi security advisory – Zero Day – ZDNet.com
    Ryan Naraine points out on the Zero Day blog that VMWare has issued a critical ESXi security advisory. Time to patch folks.
  10. 1 Raindrop: Mark Curphey On Builders and Breakers
    Gunnar writes about builders vs. breakers. He references Security Buddha’s excellent article on the same subject. Both are worth reading.

That’s it for today.

Have fun!

Kevin


Follow

Get every new post delivered to your Inbox.