[+]d'ZheNwaY's Blog[+]: How Bug Bounties Are Like Rat Farming

id='post-body-893385384109287628'>
SAN FRANCISCO--It's become fashionable of late to have people from outside the industry give keynotes at security conferences as a way of providing a fresh perspective or unique insight into what security means. Often, that fresh perspective turns out to be some variation of the "I don't know security, so let me tell you how it doesn't relate to my field" speech. Stephen Dubner fixed that.

The co-author of the ridiculously popular Freakonomics books, Dubner is a former New York Times writer and would seem an incongruous choice to kick off the talks at a security conference. But it turns out that he knows more about security than one would think. Maybe even more than he might think. His books are filled with stories meant to show the uninitiated how deeply economics and its offshoots affect our daily lives.

Much the same could be said of security and its numerous sub-disciplines. As recently as three or four years ago, many normal Internt users probably didn't give much thought, if any, to the security of their PCs. If they did think about it, they likely thought in terms of annoying viruses and worms, or maybe identity theft. But the events of the last few years have shown that no one can afford to ignore the reality of the security situation.

In his keynote speech at the United Security Summit here, Dubner said that he had great respect for the job that security professionals do, fighting the good fight against attackers and the occasional nation-state. But his most insightful comments had to do with rat farming.

What is rat farming, you ask. It turns out it's essentially a slightly more disgusting version of bug hunting. Dubner said that he was in Johannesburg, South Africa, recently, and the city was having a serious problem with rats. Officials had tried a number of remedies with no real success, and so they eventually hit upon the idea of offering a small monetary reward for every dead rat turned in. The program was a huge hit, and dead rats started flowing in.

But the idea actually created an entirely new industry: rat farming. Once people discovered that there was money to be made by turning in dead rats, they started breeding the vermin strictly for the purpose of killing them and collecting the cash. Effective, but gross.

But it has a clear analog in the bug-bounty programs that software companies such as Mozilla, Google, Barracuda and others have established in recent years. Those programs offer researchers various cash rewards for reporting vulnerabilities to the companies, and they've been quite successful in drawing submissions from a wide range of people.

But are those bugs being bred in the lab by researchers just to be led to the slaughter for a nice payday? Yes, yes they are. And that's a good thing.

nb : threatpost

Source: http://dzhenway.blogspot.com/2011/09/how-bug-bounties-are-like-rat-farming.html

»»  read more

[+]d'ZheNwaY's Blog[+]: NetworkMiner v1.1 Released – Windows ...

id='post-body-7419912513689609071'>

NetworkMiner

NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows. NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc.

without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis and to regenerate/reassemble transmitted files and certificates from PCAP files.
NetworkMiner collects data (such as forensic evidence) about hosts on the network rather than to collect data regarding the traffic on the network. The main user interface view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets/frames).

NetworkMiner has, since the first release in 2007, become popular tool among incident response teams as well as law enforcement. NetworkMiner is today used by companies and organizations all over the world.

	NetworkMiner (free edition)	NetworkMiner Professional
Live sniffing
Parse PCAP files
Receive Pcap-over-IP
OS Fingerprinting (*)
Port Independent Protocol Identification (PIPI)
Export results to CSV / Excel
Configurable file output directory
Geo IP localization (**)
Host coloring support
Command line scripting support		(through NetworkMinerCLI)
PCAP parsing speed (***)	0.581 MB/s	0.457 MB/s (GUI version) 0.735 MB/s (command line version)
Price	Free	€ 500 EUR
	Download NetworkMiner (free edition)	Buy NetworkMiner Professional

* Fingerprinting of Operating Systems (OS) is performed by using databases from Satori and p0f ** This product includes GeoLite data created by MaxMind, available from http://maxmind.com/ *** Measured by loading dump.eth0.1059726000 from Defcon 11 (189MB) on a PC with Intel Core 2 Duo (2,66GHz) and 2GB RAM

NetworkMiner can extract files and certificates transferred over the network by parsing a PCAP file or by sniffing traffic directly from the network. This functionality can be used to extract and save media files (such as audio or video files) which are streamed across a network from websites such as YouTube. Supported protocols for file extraction are FTP, TFTP, HTTP and SMB.

 

NetworkMiner Professional showing files extracted from sniffed network traffic to disk

 

 

NetworkMiner Professional showing thumnails for images extracted to disk

 

User credentials (usernames and passwords) for supported protocols are extracted by NetworkMiner and displayed under the "Credentials" tab. The credentials tab sometimes also show information that can be used to identify a particular person, such as user accounts for popular online services like Gmail or Facebook.

Another very useful feature is that the user can search sniffed or stored data for keywords.

NetworkMiner allows the user to insert arbitrary string or byte-patterns that shall be searched for with the keyword search functionality.

NetworkMiner Professional comes installed on a specially designed USB flash drive. You can run NetworkMiner directly from the USB flash drive since NetworkMiner is a portable application that doesn't require any istallation. We at Netresec do, however, recommend that you copy NetworkMiner to the local hard drive of your computer in order to achieve maximum performance.

» Buy NetworkMiner Professional «

More Information

For more information about NetworkMiner, please see the NetworkMiner Wiki page on SourceForge.
There are also several blog posts about NetworkMiner on the NETRESEC Network Security Blog:

• Pcap-over-IP in NetworkMiner


• Network Forensic Analysis of SSL MITM Attacks


• Command-line Network Forensics with NetworkMinerCLI


• NetworkMiner Video Tutorials on the Intertubes


• Webmail Information Leakage


• Analyzing the TCP/IP Weapons School Sample Lab

You can download NetworkMiner v1.1 here:

NetworkMiner_1-1.zip

nb : netresec

Source: http://dzhenway.blogspot.com/2011/09/networkminer-v11-released-windows.html

»»  read more

[+]d'ZheNwaY's Blog[+]: Nation-State Attackers Are Adobe's Biggest ...

id='post-body-2932190775506502860'>

SAN FRANCISCO--It's no secret that attackers have made Adobe's products key targets for the last couple of years, routinely going after bugs in Reader, Flash and Acrobat in targeted attacks and widespread campaigns alike. But it's not just the rank-and-file bad guys who are making Adobe a priority; it's more often nation-states, the company's top security official said.

Adobe, like many other large software companies, has contacts in the big defense contractors, government agencies and other organizations that are most often the targets of state-sponsored attacks. So when a new attack begins, the company typically hears about it within hours as customers begin to call and report a new threat involving an Adobe product. Since the company began its software security program several years ago, the sophistication level of the people finding and exploiting new bugs in Flash or Reader has gone up significantly.

Now, says Brad Arkin, the senior director of product security and privacy at Adobe, it's at a point where the company's main adversaries are state-sponsored actors.

"In the last eighteen months, the only zero days found in our software have been found by what Dave Aitel would call carrier-class adversaries," Arkin said in his keynote speech at the United Security Summit here Tuesday. "These are the groups that have enough money to build an aircraft carrier. Those are our adversaries."

Arkin said that when a new attack involving a zero-day bug in one of Adobe's products starts, it typically will begin with attacks against a select group of high-profile organizations. That usually means defense contractors, government agencies or large financial services companies. Once the security teams at those organizations find and analyze the threat, Arkin said his team will begin getting a flurry of calls within an hour or two as the campaign hits.

From there, the attack will often then move down the ladder to other large enterprises and then smaller ones as the new exploit shows up in crimeware packs and automated attack tools. By that time, it's likely an entirely different set of attackers using the exploit. But it's the well-funder and highly skilled attackers who are doing the real heavy lifting in terms of finding new bugs and designing methods to exploit them.

"These samples trickle downhill really quickly and show up in crime packs," Arkin said. "The actual exploits it turns out are very, very expensive and difficult to build. Finding the flaw is a lot easier than writing the exploit. If you want to defend against the carrier-class adversary, it's a very different cost."

Perhaps the most famous example of this kind of targeted attack is the one that hit RSA Security earlier this year. In that case, the company was compromised through the use of a phishing email that contained an Excel file with a malicious SWF file embedded inside it. An employee opened the email and then the attachment and the attack was off and running from there. Arkin said that while his team didn't get a sample of the malicious file from RSA, it did see others from organizations that likely were targeted by the same campaign.

"We have lots of friends in the places where people get attacked a lot and I don't think that RSA was the only target in that campaign," he said.

nb : threatpost

Source: http://dzhenway.blogspot.com/2011/09/nation-state-attackers-are-adobes.html

»»  read more

[+]d'ZheNwaY's Blog[+]: McAfee Delivers Comprehensive Protection ...

id='post-body-6378720536249347675'>
Just when you were starting to get ahead of the curve when it comes to locking down the network and protecting PCs, everything went mobile. Not just laptops--but tablets, and smartphones that run unique operating systems and applications on completely different hardware. To help you combat the dramatic rise in mobile security threats, McAfee has developed Enterprise Mobility Management.

Smartphones and tablets have enjoyed some degree of security by obscurity. Although it has always been theoretically possible to hack or compromise mobile devices one way or another, the incentive wasn't there. But, with smartphones and tablets storing 32GB, 64GB or more of data, and providing access to sensitive resources, malware developers are paying more attention.

McAfee EMM takes a three-pronged approach to protecting mobile devices and data.The nascent nature of mobile device hardware and software, though, make it new territory for you to wrestle with and try to protect. As if that isn't enough, the very point of mobile devices is to be mobile--so there is no pretense of a "perimeter" to hide inside. These devices are out there roaming about, and you need tools to protect the information they contain.

Another challenge you face is the sheer diversity of platforms. Businesses typically have some degree of standardization when it comes to PC hardware, operating system, Web browser, and installed software. But, with mobile devices you might be dealing with iOS, Android, BlackBerry, Windows Phone, and more--plus the diversity of hardware and apps that come with each mobile platform.

"Mobile device adoption is exploding, and unfortunately, so are the threats targeting mobile platforms. If McAfee’s historical experience analyzing threats on numerous platforms is any indication, we believe that the emerging mobile malware we are seeing today is just the beginning," said John Dasher, senior director, mobile security for McAfee. "It’s a whole new world, and a challenge for IT to craft security policies that make sense while updating their infrastructure. At McAfee, we’re working hard to create new technology to help enterprises address the challenge of securely incorporating these new mobile platforms into their environment."

McAfee Enterprise Mobility Management (EMM) uses a three-pronged approach to mobile security--protecting the device itself, the data it contains, and the apps that run on it. The device protection brings the familiar controls and security measures from McAfee desktop security solutions and applies it to mobile devices. The device protection also includes VirusScan Mobile to guard against malware, and McAfee Site Advisor to protect mobile devices from malicious websites and phishing attacks.

McAfee EMM has data leak prevention controls. McAfee claims that data remains protected even on jailbroken or rooted devices. The data protection measures also include remote backup, lock, and wipe functionality to protect data if the device is lost or stolen, and McAfee is working on additional controls to separate business data from personal data.

The apps that run on these mobile devices can be a security threat in and of itself. Some platforms are more susceptible than others to rogue, malicious apps. The McAfee EMM app protection includes McAfee App Alert which lets users know how they apps are accessing or using personal data. McAfee is also expanding the Global Threat Intelligence network to include mobile app reputation services to help identify potentially malicious apps.

Mobile threats will continue to escalate and proliferate, so the sooner you get a security framework in place to protect your mobile devices and the data they contain, the better. Visit McAfee Mobile Security Solutions for more details on Enterprise Mobility Management.

nb : pcworld

Source: http://dzhenway.blogspot.com/2011/09/mcafee-delivers-comprehensive.html

»»  read more

[+]d'ZheNwaY's Blog[+]: Microsoft dumps partner over telephone ...

id='post-body-2431855549272850708'>

One of Microsoft's Gold Partners has had its relationship with the software giant unceremoniously terminated, after being revealed to be orchestrating a telephone support scam.

Comantra, based in India, are said to have cold-called computer users in the UK, Australia, Canada and elsewhere, claiming to offer assistance in cleaning up virus infections.
The bogus support calls came from Comantra employees who claimed to be representing Microsoft, and used scare tactics to talk users into opening the Event Viewer on Windows, where a seemingly dangerous list of errors would be seen.

Once terrified by what appears to be a worrying collection of warning messages, and believing this was evidence of a malware infection, users would be tricked into allowing Comantra technicians to gain remote access to their computer, and hand over their credit card details to fix any "problems".
In the past, vulnerable elderly people have even been told by scammers that heavy rain may have caused a computer virus infection.

What makes the scam particularly audacious is that during the scam campaign, Comantra were a certified Gold partner of Microsoft, and when quizzed by skeptical computer owners would use their status to trick potential victims into believing the call was legitimate.

A search for "Comantra" on the internet finds a large number of posts and complaints about the scam telephone calls, stretching back over 18 months. Some users have even asked on Microsoft's own message forums how it is possible for the firm to have "Gold Partner" status.

As PC Pro reports, a Microsoft spokesperson has now confirmed that Comantra has at long last been struck off their Gold Partner list:

"We were made aware of a matter involving one of the members of the Microsoft Partner Network acting in a manner that caused us to raise concerns about this member's business practices. Following an investigation, the allegations were confirmed and we took action to terminate our relationship with the partner in question and revoke their Gold status."
"There are no circumstances under which we would ever allow partners or any other organisations to pose as Microsoft. We view matters such as these extremely seriously and take immediate action if such behaviour is brought to our attention and found to be the case."

Hmm.. Maybe someone should tell Comantra to update their website and remove that Gold Partner logo?

Listen to this great podcast by Sophos experts Paul Ducklin and Sean Richmond where they discuss the problem of fake tech support calls, and the ways in which you can avoid falling for scams like this yourself:

(Duration 6:15 minutes, size 4.5MBytes)

Also, make sure that your family and friends are on their guard against suspicious tech support calls telling them about infections on their computer - even if the callers do claim to be from Microsoft. It only takes a lapse of common sense for you to hand your credit card details straight down the line to a criminal.

nb : nakedsecurity.sophos

Source: http://dzhenway.blogspot.com/2011/09/microsoft-dumps-partner-over-telephone.html

»»  read more

[+]d'ZheNwaY's Blog[+]: Malicious spam campaigns proliferating

id='post-body-6791725755399361126'>

Summary: In a recent blog post, researchers from Commtouch have summarized their observation status, and pointed out that someone is actively building crimeware-friendly botnets.

With spam continuing to represent the distribution vector of choice for the majority of cybercriminals, it shouldn’t be surprising that the volume of malicious spam campaigns is proliferating.

In a recent blog post, researchers from Commtouch have summarized their observation status on the malicious spam campaigns from last month, namely, UPS/FedEx, Map of love and Hotel charge error and pointed out that someone is actively building crimeware-friendly botnets:

“Pre-outbreak levels varied between a few hundred million emails to around 2 billion per day.  The peak outbreak included distribution of nearly 25 billion emails with attached malware in one day.”

Malware campaigns have cyclical pattern of distribution, namely, cybercriminals constantly rotate and introduce new topics, once the lifecycle of the previous campaign have reached the maturity stage. Meanwhile, users continue interacting with spam emails, clicking on links, downloading attachments and unsubscribing themselves, prompting the success of spam in general.

Now, that the cybercriminals have set up the foundations for their botnet aggregation practices by spamvertising billions of emails, it’s worth keeping an eye on the actual response rate of the command and control servers used in the campaigns in order to roughly estimate the damage caused by the campaigns.

nb : zdnet

Source: http://dzhenway.blogspot.com/2011/09/malicious-spam-campaigns-proliferating.html

»»  read more

[+]d'ZheNwaY's Blog[+]: Massachusetts Attorney General, Victim of ...

id='post-body-3426297939823368000'>
Massachusetts Attorney General Martha Coakley said on Tuesday that her office would be inquiring into long-standing complaints about fraudulent purchases that leverage Apple's popular online music store.

In a lunchtime address to business and technology leaders in Massachusetts, Coakley said she was a victim of identity theft in recent months, and that her stolen credit card information was used to make fraudulent iTunes purchases. When asked (by Threatpost) about whether such fraud constitutes a reportable event under the Bay State's strict data breach notification law, Coakley said that her office would be looking into that question and demanding answers from Cupertino, California based Apple, which has steadfastly refused to comment, or report the breaches to Massachusetts regulators.

Coakley was speaking before an audience of technology and business leaders at an inaugural lunch for Massachusetts' Advanced Cyber Security Center (ACSC). Coakley said that her investment in protecting consumers from identity theft was personal, acknowledging that her bank account was emptied after cyber criminals stole her debit card information during a ski trip to New Hampshire. It was not the first time Coakley had mentioned the incident in public. After skimming the card info, Coakley said the thieves attempted to use it to purchase a laptop from Dell Computer, which detected the fraudulent transaction and contacted Coakley. Not so Apple, whose iTunes media store was used to make a slew of transactions that emptied the Attorney General's account.

Informed of the well documented pattern of fraud through iTunes, in which stolen credit cards or bogus iTunes gift cards are matched with compromised iTunes accounts and used to purchase merchandise, Coakley said she wasn't aware of the larger pattern, but that it could be a reportable offense under the State's data privacy law. She promised her office would be contacting Apple for more information that very afternoon - a statement that received hearty applause from the audience.

Despite the tough tone, Coakley's speech was tailored more to a business audience wary of burdensome enforcement of State data privacy laws, including the State's data breach notification law and 201 CMR 17, the Massachusetts Data Protection Law. That law took effect in March, 2010 but the first fine under the law was issued in March of 2011 to Briar Group, a Boston-area restaurant chain that showed gross negligence in securing its networks and handling customers' credit card numbers.

Coakley said that companies that attempt, in good faith, to adhere to the State's privacy laws have little to fear in the way of fines or prosecution. However, organizations that flaunt the law or ignore the need for data security should count themselves warned.

Describing her office as the first line of defense for consumers, Coakley said her office was pursuing a "common sense" approach to enforcement and notification. Large breaches, such as the hack of Massachusetts retailer TJX, warrant an all out effort to notify the public. In the case of smaller breaches, Coakley said her office wanted to work with victim organizations to make sure that holes in their defenses and IT security practice are addressed.

The Attorney General said her office has received around 480 data breach notifications so far in 2011, and 1,166 since the law took effect in March, 2010 - suggesting that the incidence of data breaches is holding steady, despite a tough economy. The vast majority of those breaches are small in nature. Eighty two percent of disclosed breaches affected fewer than 100 people, and just 4% affected between 1,000 and 10,000 people. Similarly, hacking incidents only made up a quarter of the reported breaches, with another quarter due to inadvertent human error, Coakley said.

The State's breach notification law, dubbed 201 CMR 17, sets clear guidelines for the types of incidents that constitute reportable breaches. Any incident resulting in "the unauthorized acquisition or unauthorized use of unencrypted data or, encrypted electronic data" that creates a "substantial risk of identity theft or fraud against a resident of the commonwealth" need to be disclosed, as well as combinations of personal information, such as a name and credit card number, must be reported. That would seem to describe the use of Coakley's credit card information on iTunes. However, its is unclear whether Apple actually holds the data used to process the transaction on iTunes, or whether the purchases are merely "pass through" transactions about which Apple has no knowledge or visibility, according to a source within the Attorney General's Office.

nb : threatpost

Source: http://dzhenway.blogspot.com/2011/09/massachusetts-attorney-general-victim.html

»»  read more

[+]d'ZheNwaY's Blog[+]: Adobe to rush out Flash Player patch to ...

id='post-body-7088203643024160985'>

Summary: Another in-the-wild zero-day attack prompts an urgent Flash Player patch from Adobe.

Adobe is planning to rush out a critical Flash Player patch later today (September 21, 2011) to fix security holes that are being used in targeted zero-day attacks.

According to Adobe, the Flash Player update will address critical security issues in the product as well as an importantuniversal cross-site scripting issue that is reportedly being exploited in the wild in targeted attacks.

The company is expected to fix at least 16 documented vulnerabilities, some critical enough to expose Windows and Mac users to code execution attacks via Flash files hosted on Web pages.

The Adobe patch comes a day after Google shipped a Chrome update that “includes an update to Flash Player that addresses a zero-day vulnerability.”
Details on the targeted zero-day attacks are not yet available but it’s clear these types of attacks are happening at a very high level.

Just this week at the United Security Summit, Adobe security chief Brad Arkin said the company’s main adversaries are state-sponsored actors.
From Threatpost’s Dennis Fisher:

“In the last eighteen months, the only zero days found in our software have been found by what Dave Aitel would call carrier-class adversaries,” Arkin said in his keynote speech at the United Security Summit here Tuesday. “These are the groups that have enough money to build an aircraft carrier. Those are our adversaries.”

Arkin said that when a new attack involving a zero-day bug in one of Adobe’s products starts, it typically will begin with attacks against a select group of high-profile organizations. That usually means defense contractors, government agencies or large financial services companies. Once the security teams at those organizations find and analyze the threat, Arkin said his team will begin getting a flurry of calls within an hour or two as the campaign hits.

From there, the attack will often then move down the ladder to other large enterprises and then smaller ones as the new exploit shows up in crimeware packs and automated attack tools. By that time, it’s likely an entirely different set of attackers using the exploit. But it’s the well-funder and highly skilled attackers who are doing the real heavy lifting in terms of finding new bugs and designing methods to exploit them.

“These samples trickle downhill really quickly and show up in crime packs,” Arkin said. “The actual exploits it turns out are very, very expensive and difficult to build. Finding the flaw is a lot easier than writing the exploit. If you want to defend against the carrier-class adversary, it’s a very different cost.”

In addition to Flash Player, Adobe’s PDF Reader and Acrobat software products are among the main targets for sophisticated attacks.

nb : zdnet

Source: http://dzhenway.blogspot.com/2011/09/adobe-to-rush-out-flash-player-patch-to.html

»»  read more

[+]d'ZheNwaY's Blog[+]: Fixes in the Works For SSL Attack, But ...

id='post-body-865207864838393674'>

With the release of the BEAST SSL attack research due tomorrow, researchers are beginning to take note of potential fixes and mitigations for the attack. One of the possibilities is moving to newer versions of TLS that are not vulnerable to the attack, but the problem is that there is precious little adoption of those newer versions.

Some of the browser vendors have been looking at possible remedies for the attack on TLS developed by Juliano Rizzo and Thai Duong, and Opera was the first to develop a fix for it. The company initially implemented the fix in its browser, but then discovered that it broke a small percentage of sites and did not push the fix into the final version of Opera. The default configuration of Opera isn't vulnerable to the new attack, but if users change some settings, the browser can become susceptible to the attack.

Rizzo and Duong's attack, which Rizzo will present at the Ekoparty conference on Friday, is aimed at TLS 1.0, which is an older version of the protocol, and the newer versions are not vulnerable. However, as Opera's own research found, the adoption of TLS 1.1 and 1.2 among Web sites is far too low to just make the switch in the browser. Opera found that just 0.25 percent of sites supports TLS 1.1 and 0.02 percent support version 1.2. TLS 1.0 is quite an old standard, and even versions 1.1 and 1.2 have been approved for several years now, but many of the more recent versions of the major browsers don't support the newer releases of TLS, which presents a problem for site operators who would like to upgrade. If their users can't handle TLS 1.1 or 1.2, upgrading could cost them customers.

For example, the latest version of Mozilla Firefox has the boxes for SSL 3.0 and TLS 1.0 checked by default and there is no option for users to enable support for newer versions of TLS. Internet Explorer 9 gives users the ability to enable support for TLS 1.1 and 1.2 in Internet Options under the Advanced tab. But, unless the site on the other end of the connection is using a newer version of the protocol as well, that doesn't do the user much good.

Opera isn't the only vendor who is working on a fix. Google also has been preparing a patch for its Chrome browser and the company has pushed that fix to its development channel already, officials say. The company is hoping to have the fix go through the typical process of moving to the beta channel and then the stable channel without having to push it out as an emergency fix.

A new report by security researcher Thierry Zoller that looked at browser support for various versions of the TLS protocol found that support for anything newer than TLS 1.0 is quite spotty. Also in the report, Zoller recommends that sites that use SSL drop support for SSL 2.0 and 3.0 and only support TLS 1.0 and later.

nb : threatpost

Source: http://dzhenway.blogspot.com/2011/09/fixes-in-works-for-ssl-attack-but.html

»»  read more

[+]d'ZheNwaY's Blog[+]: Secure Boot in Windows 8 Worries ...

id='post-body-5673862193886367424'>

Windows 8, like Windows 7 and Vista before it, is being touted as the most secure version of Windows ever. In past releases, many of the security improvements have come through exploit mitigations such as ASLR and DEP and better software security practices during development. In Windows 8, however, one of the major changes is the addition of UEFI, a BIOS replacement that will include a secure boot sequence to help prevent low-level malware infections. That change, however, is not sitting well with everyone.

The way that Windows 8 client machines will boot is going to be quite different from the way that current Windows PCs do. Instead of a BIOS, Windows 8 PCs will include an implementation of UEFI (Unified Extensible Firmware Interface), which is more flexible and programmable than BIOS is. UEFI will sit between the firmware and the Windows operating system and Microsoft is reportedly going to require that any client machine that runs Windows 8 have a secure boot sequence enabled by default. That sequence will require that whatever software is loaded during boot be signed by one of the keys included in the firmware. If the firmware or software isn't signed by a trusted certificate authority, Windows 8 will not load it.

The impetus for this change in the boot process is that attackers have become proficient in recent years at finding methods to load malware into the BIOS and firmware that underlie the OS. In some cases, rootkits, bootkits and malware that infects the master boot record can not be removed from the machine without re-installing the operating system. Microsoft and security vendors have been trying to find ways defeat these attacks for several years now, and the move to UEFI and secure boot is one of the results of that effort.

It's been a long journey for Microsoft to arrive at this destination. The company has been pushing various versions of a hardware-based security system for nearly a decade now. An early version, originally known as the Windows Next Generation Secure Computing Base and later Palladium, generated quite a bit of controversy when it was first discussed. Many of the elements of the Palladium system are now included as part of some laptops and the Windows 8 UEFI implementation: hardware security modules, secure boot, signing of software, encrypted storage of files. While some portions of what Microsoft has implemented in Windows 8 won't require the use of a TPM (Trusted Platform Module), others will, including support for encrypted hard drives.

These security additions to Windows 8 have some benefits, but there also are some potential drawbacks that worry security and privacy advocates. Ross Anderson of the University of Cambridge worries that there is the potential for hardware-based lock-in included with the Windows 8 changes.

"The extension of Microsoft’s OS monopoly to hardware would be a disaster, with increased lock-in, decreased consumer choice and lack of space to innovate. It is clearly unlawful and must not succeed," Anderson said in a blog post.
There also has been concern in the open-source community that the changes in Windows 8 will prevent users from loading alternate operating systems on Windows-based PCs. There may be some ways for users to circumvent the UEFI implementation and find a method for loading a separate OS, but it would likely be difficult.

"There's no indication that Microsoft will prevent vendors from providing firmware support for disabling this feature and running unsigned code. However, experience indicates that many firmware vendors and OEMs are interested in providing only the minimum of firmware functionality required for their market. It's almost certainly the case that some systems will ship with the option of disabling this. Equally, it's almost certainly the case that some systems won't. It's probably not worth panicking yet. But it is worth being concerned," wrote Matthew Garrett, a developer at Red Hat, in a blog post on the Windows 8 changes.

nb : threatpost

Source: http://dzhenway.blogspot.com/2011/09/secure-boot-in-windows-8-worries.html

»»  read more

[+]d'ZheNwaY's Blog[+]: DroidSheep Android App Hijacks Sessions ...

id='post-body-6219452665845572370'>
Following the success of the Firesheep application, a new Android application called DroidSheep allows users to hijack Web sessions of popular online services over insecure Wifi connections.

DroidSheep enables Android-based man in the middle attacks against a wide range of Web sites, including Facebook.com, Flickr.com, Twitter.com, Linkedin.com, and non-encrypted services like “maps” on Google. DroidSheep’s official website claims that the app will work on almost any website that uses cookies.

It’s a pretty simple process once downloaded, a user only has to start running DroidSheep, click start, and wait for someone to connect to a given service on the same wifi network, at which point the user will be prompted on whether or not they want to jump in on that session.

All a user needs is a device that runs Android version 2.1 or higher, whether that device is a smartphone or some sort of tablet, with root access (and the app itself, obviously).

DroidSheep supports OPEN, WEP, WPA, and WPA2 secured networks, using a DNS-Spoofing attack on the last two.

As with the original FireSheep application, the developers of DroidSheep note that their application is “NOT INTENDED TO STEAL IDENTITIES,” but to show the weak security properties of big websites.

The release of a Firefox extension called “FireSheep” at the 2010 ToorCon conference caused an uproar, and prompted popular services like Facebook and Twitter among others to implement secure browsing features. It also helped fuel a larger discussion about the necessity of utilizing HTTPS encryption across the Web.

nb : threatpost

Source: http://dzhenway.blogspot.com/2011/09/droidsheep-android-app-hijacks-sessions.html

»»  read more

[+]d'ZheNwaY's Blog[+]: Homeless hacker arrested by FBI in LulzSec ...

id='post-body-2667302627901596215'>

According to media reports, the FBI has arrested two alleged hackers in San Francisco and Phoenix, believed to be associated with the LulzSec and Anonymous hacktivist groups.

And one of them is homeless.

FoxNews reports that search warrants have also been executed in the states of Minnesota, Montana and New Jersey as part of a wider FBI investigation into the groups who have launched attacks against government websites as well as corporations such as Sony.

23-year-old Cody Kretsinger, from Phoenix, Arizona, has been charged with computer offences, and is alleged to be the LulzSec member known as "Recursion". Kretsinger is accused of being involved in an SQL injection attack that stole information from Sony Pictures in June, exposing users email addresses and passwords.

According to the indictment against Kretsinger, he is accused of using the hidemyass.com proxy service to cloak probes he made of Sony Pictures' computer systems in May 2011, hunting for vulnerabilities.

Approximately 150,000 confidential records were subsequently published online by LulzSec who criticised Sony's weak security.

Authorities allege that Kretsinger wiped the hard drives used to carry out the attack on Sony in an attempt to hide forensic evidence.

"Recursion" is one of many handles used by members of the LulzSec hacking gang, and features in internet chat logs that have previously published of the group having what they believed to be private conversations.

Meanwhile, the FBI arrested an alleged Anonymous member in San Francisco. The man, who is reported to be homeless, is said to have been involved in internet attacks against Santa Cruz County government websites.

Just because a man is homeless, of course, doesn't mean that he can't get an internet connection. Coffee houses, cafes, libraries, etc can all offer cheap or free internet access - and because the computer being used can be a shared device, it may be harder to identify who might have been responsible for an attack compared to a PC at a home.

At the same time, public places are often watched with CCTV cameras which means that if the authorities were able to identify a time and place, they may also be able to gather evidence as to who was at the location when an attack was begun from a particular computer.

Both LulzSec and the larger Anonymous hacktivist collective have had a tough time of late, with a series of arrests in the USA, UK and elsewhere around the globe.

Wannabe hackers might be wise to read the FBI's press release about the Kretsinger arrest, which points out that if convicted of the hacking offences he could face up to 15 years in prison.

nb : nakedsecurity.sophos

Source: http://dzhenway.blogspot.com/2011/09/homeless-hacker-arrested-by-fbi-in.html

»»  read more

Ec-Council: Certifed Ethical Hacker v7

Ec-Council: Certifed Ethical Hacker v7
English | ISO + PDF | 19 Modules | 16.95GB
Genre: eLearning

EC-Council releases the most advanced ethical hacking program in the world. This much anticipated version was designed by hackers and security researchers. CEH v7 is a revolutionary training program that combines class metrics, advance lab environment, cutting edge hacking techniques and excellent presentation materials. EC-Council has spent several years in developing this version.

The Certified Ethical Hacker courseware has undergone tremendous improvement from its predecessor. We have invested 4 times the regular investment in the research and development since the last release, and have given CEHv7 a complete makeover.

The new version is a breakaway from earlier releases with more emphasis on techniques and methodologies, which attackers may use to carry out possible attacks against system/networks.

Picture speaks thousand words and we at EC-Council have enforced the saying by practicing it. The instructor slides and student manuals in CEHv7 has it all. The new version empowers the instructor with flawless flow and outstanding diagrammatic representation of the hacking techniques, which makes it easier to teach and enables students to understand the concepts better.
CEHv7 provides a comprehensive ethical hacking and network security-training program to meet the standards of highly skilled security professionals. Hundreds of SMEs and authors have contributed towards the content presented in the CEHv7 courseware. Latest tools and exploits uncovered from the underground community are featured in the new package. Our researchers have invested thousands of man hours researching the latest trends and uncovering the covert techniques used by the underground community.

In addition to the makeover, CEHv7 includes two additional bundles; a Monster Hacking Tool Repository, Codenamed Frankenstein and a subscription based Virtual Lab Environment codenamed iLabs.

Frankenstein

Frankenstein provides user with an ease for searching, downloading and installing the latest hacking and penetration testing tools. By using Frankenstein Version 1.0, users can check the release date of the tool, category under which it is published, probable size of the tool, name of the publisher/author, the website details and technical requirements for the tool to run. This will help all the Certified Members to keep themselves updated of tools released in the wild.

Key benefits:

• Repository of categorized latest tools
• User can download the tool in less time with comparison to manual search
• Helps the user to synchronize & manage the tools from the server
• Search specific tools from the available list of tools
• The system provides a means to generate a HTML report of all the tools downloaded by the user


iLabs

The iLabs is a subscription based service that allows students to logon to a virtualized remote machine running Windows 2003 Server to perform various exercises featured in the CEHv7Lab Guide. All you need is a web browser to connect and start experimenting. The virtual machine setup reduces the time and effort spent by instructors and partners prior to the classroom engagement. It is a hassle free service available 24x7 x number of days subscribed.

Benefits

• Enables students to practice various hacking techniques in a real time and simulated environment
• The course tools and programs are preloaded on the iLabs machine thereby saving productive time and effort

Key Features of CEH v7

• Well organized DVD-ROM content; a repository of approximately 20GB of latest hacking and security tools and more than 1000 minutes of videos demonstrating hacking techniques.
• Well organized content for a better understanding and learning experience
• Concepts are well-illustrated to create self-explanatory slides.
• Diagrammatic representation of concepts and attacks
• Industry standard key tools are featured in detail and other tools are presented as a list for students to try
• Exclusive section for countermeasures against different attacks with detailed explanation of how to implement these countermeasures in real time environment
• The new version has complete section dedicated for penetration testing. It illustrates how to implement learned concepts to test network system security
• A result oriented, descriptive and analytical lab manual; the labs showcased in the courseware are tested against latest Operating Systems with all the patches and hot fixes applied

http://www.filesonic.com/file/1294589414/CEHv7.part01.rar
http://www.filesonic.com/file/1294589364/CEHv7.part02.rar
http://www.filesonic.com/file/1294592734/CEHv7.part03.rar
http://www.filesonic.com/file/1294592714/CEHv7.part04.rar
http://www.filesonic.com/file/1294592724/CEHv7.part05.rar
http://www.filesonic.com/file/1294592694/CEHv7.part06.rar
http://www.filesonic.com/file/1294604324/CEHv7.part07.rar
http://www.filesonic.com/file/1294606954/CEHv7.part08.rar
http://www.filesonic.com/file/1294619134/CEHv7.part09.rar
http://www.filesonic.com/file/1294621804/CEHv7.part10.rar
http://www.filesonic.com/file/1294621594/CEHv7.part11.rar
http://www.filesonic.com/file/1294621634/CEHv7.part12.rar
http://www.filesonic.com/file/1294621664/CEHv7.part13.rar
http://www.filesonic.com/file/1294621624/CEHv7.part14.rar
http://www.filesonic.com/file/1294644324/CEHv7.part15.rar
http://www.filesonic.com/file/1294645014/CEHv7.part16.rar
http://www.filesonic.com/file/1294655454/CEHv7.part17.rar
http://www.filesonic.com/file/1294657454/CEHv7.part18.rar
http://www.filesonic.com/file/1294657344/CEHv7.part19.rar
http://www.filesonic.com/file/1294657434/CEHv7.part20.rar
http://www.filesonic.com/file/1294660204/CEHv7.part21.rar
http://www.filesonic.com/file/1294660024/CEHv7.part22.rar
http://www.filesonic.com/file/1294672914/CEHv7.part23.rar
http://www.filesonic.com/file/1294672834/CEHv7.part24.rar
http://www.filesonic.com/file/1294690474/CEHv7.part25.rar
http://www.filesonic.com/file/1294690514/CEHv7.part26.rar
http://www.filesonic.com/file/1294692674/CEHv7.part27.rar
http://www.filesonic.com/file/1294697524/CEHv7.part28.rar
http://www.filesonic.com/file/1294697584/CEHv7.part29.rar
http://www.filesonic.com/file/1294697654/CEHv7.part30.rar
http://www.filesonic.com/file/1294712484/CEHv7.part31.rar
http://www.filesonic.com/file/1294712414/CEHv7.part32.rar
http://www.filesonic.com/file/1294727984/CEHv7.part33.rar
http://www.filesonic.com/file/1294728034/CEHv7.part34.rar
http://www.filesonic.com/file/1294731514/CEHv7.part35.rar
http://www.filesonic.com/file/1294731684/CEHv7.part36.rar
http://www.filesonic.com/file/1294731744/CEHv7.part37.rar
http://www.filesonic.com/file/1294731774/CEHv7.part38.rar
http://www.filesonic.com/file/1294753034/CEHv7.part39.rar
http://www.filesonic.com/file/1295071424/CEHv7.part40.rar
http://www.filesonic.com/file/1294749654/CEHv7.part40.rar
http://www.filesonic.com/file/1294763084/CEHv7.part41.rar
http://www.filesonic.com/file/1294775024/CEHv7.part42.rar
http://www.filesonic.com/file/1294788524/CEHv7.part43.rar
http://www.filesonic.com/file/1294788584/CEHv7.part44.rar
http://www.filesonic.com/file/1294788664/CEHv7.part45.rar
http://www.filesonic.com/file/1294788694/CEHv7.part46.rar
http://www.filesonic.com/file/1294848204/CEHv7.part47.rar
http://www.filesonic.com/file/1294849004/CEHv7.part48.rar
http://www.filesonic.com/file/1294918854/CEHv7.part49.rar
http://www.filesonic.com/file/1294919074/CEHv7.part50.rar
http://www.filesonic.com/file/1294921654/CEHv7.part51.rar
http://www.filesonic.com/file/1294921694/CEHv7.part52.rar
http://www.filesonic.com/file/1294924624/CEHv7.part53.rar
http://www.filesonic.com/file/1294924664/CEHv7.part54.rar
http://www.filesonic.com/file/1294937294/CEHv7.part55.rar
http://www.filesonic.com/file/1294938254/CEHv7.part56.rar
http://www.filesonic.com/file/1295018034/CEHv7.part57.rar
http://www.filesonic.com/file/1295018074/CEHv7.part58.rar
http://www.filesonic.com/file/1295047264/CEHv7.part59.rar
http://www.filesonic.com/file/1295047304/CEHv7.part60.rar
http://www.filesonic.com/file/1295047494/CEHv7.part61.rar
http://www.filesonic.com/file/1295047514/CEHv7.part62.rar
http://www.filesonic.com/file/1295058354/CEHv7.part63.rar
http://www.filesonic.com/file/1295059344/CEHv7.part64.rar
http://www.filesonic.com/file/1295069514/CEHv7.part65.rar
http://www.filesonic.com/file/1295069564/CEHv7.part66.rar
http://www.filesonic.com/file/1295059284/CEHv7.part67.rar

»»  read more

Tấn công SQL injection kiểu mới dai dẳng hơn

Một hãng bảo mật cho biết, các cuộc tấn công kiểu SQL injection lợi dụng hình thức đơn giản của mạng ngang hàng (peer-to-peer) khiến mạng bị tổn hại khó có thể gỡ xuống.

Làm hại website bằng kỹ thuật SQL injection từ lâu đã là mối quan tâm bảo mật hàng đầu của các nhà phát triển web và chủ sở hữu website. Giờ đây, các cuộc tấn công này có thể còn trở nên khó phát hiện và ngăn chặn hơn, theo phân tích của một công ty bảo mật.

Công ty bảo mật web Armorize thông báo đã phát hiện một kiểu tấn công mới với cách thức SQL injection hàng loạt. Kiểu tấn công mới này lợi sử dụng hình thức đơn giản của mạng ngang hàng (peer-to-peer) để làm cho mạng bị tổn hại khó có thể gỡ xuống. Về mặt lịch sử, các cuộc tấn công web hàng loạt rất đơn giản: Mã được viết bằng ngôn ngữ truy vấn có cấu trúc (SQL) được gửi đến cơ sở dữ liệu web phụ trợ (back-end) nhờ sử dụng một lỗ hổng trong mã của website. Khi lỗ hổng bảo mật nằm trong một ứng dụng thông thường, cuộc tấn công có thể làm hại hàng ngàn website cùng một lúc.

Trong phiên bản mới nhất của kiểu tấn công, thay vì chèn vào các website một đoạn mã lệnh tĩnh đơn nhất trỏ trình duyệt truy cập đến một số website tải về mã độc hại, những kẻ tấn công tạo ra một đoạn mã lệnh động dẫn khách truy cập tới máy chủ web đã bị xâm nhập từ trước. Kỹ thuật mới làm cho việc lập danh sách đen (blacklisting) khó khăn hơn nhiều, chủ tịch kiêm giám đốc công nghệ Wayne Huang của Armorize nói.

Cuộc tấn công hiện tại có một điểm yếu, đồng sáng lập kiêm Giám đốc công nghệ Neil Daswani của công ty bảo mật Dasient chỉ ra. Làm sạch mã độc hại từ các website bị nhiễm sẽ ngăn chặn mã đang được tải về. Tuy nhiên, điều đó sẽ chỉ đúng trong một thời gian ngắn, ông nói.

Theo giám đốc bảo mật Thomas Kristensen của Secunia, các chủ sở hữu website cần làm phân tích bảo mật tốt hơn về website của họ để tránh bị tấn công.

Theo PC World VN

»»  read more

Infosecurity - May/June 2011

Infosecurity - May/June 2011

True PDF | 52 pages | English |48.95 MB

Infosecurity Magazine is dedicated to the strategy and technique of information security, delivering critical business and technical information that IT security professionals need to make informed business decisions.

unibytes.com

filesonic.com

hotfile.com

»»  read more

USB Secure 1.6.1

USB Secure 1.6.1 | 1.4 MB

Where there is a USB Drive, there has to be USB Secure! USB Secure can password protect USB drives. Protection is PC independent, doesn't require installation and doesn't require administrator rights at the other end. Never again worry about lost or stolen USB drives if you have protected it with USB Secure. USB Secure works with all types of portable media like USB Flash drives, Thumb drives, Memory sticks, External drives and Memory Cards.

What is USB Secure?

USB Secure helps you password protect USB drive, thumb drive, memory stick, pen drive, jump drive, flash drive and external hard drive. It supports plug and play and runs automatically once a USB drive is plugged in, asking you the password for it. USB Secure is hassle free and it doesn’t need a rocket scientist to master.

USB drives are the most popular way to move data from one PC to another. They are small in size but can carry gigabytes of data. They are easy to use, convenient, affordable, but at the same time they pose a security risk and can be easily lost, stolen or misplaced. A secure USB drive i.e., a password protected USB drive is a must these days as the data that it contains may cost you millions of dollars if stolen or lost.

You can easily lock USB drives with USB Secure and can also password protect memory sticks and all other external storage devices with just a single mouse click. An easy to use setup program will guide you to put the program on your USB drive. It can automatically detect all such drives currently plugged into your PC. After installing simply run the software, set and confirm a password, protect USB drive and sit back and relax!

It’s not necessary to run the software every time you want to protect USB drive; you can simply choose ‘Protect This USB Drive’ option from the Windows Autoplay that pops up every time you plug-in your USB drive. You can also double click the USB drive in your PC to launch the program. To unprotect your secure USB drive, click 'Unprotect' and enter correct password to access your data again.

Another great feature of USB Secure is that it doesn’t require any Administrator rights to run and therefore there is no need to install it at the other end to retrieve the password protected data. The program also supports plug & play and asks for a password immediately when the drive is plugged-in. Password protect USB drive and other portable media with USB Secure.

Home Page - http://www.newsoftwares.net/usb-secure/

Download from FileSonic

»»  read more

VTC Using Security Tools

VTC Using Security Tools
Video: H.264 MPEG-4 AVC 800x600 10fps | Audio: MPEG AAC Stereo 44.100kHz | MOV | 9hrs | 91 tutorials

Introduction
Course Introduction
General Utilities
Secure Shell (ssh)
VNC
NX Client
VMware pt. 1
VMware pt. 2
Host Security
Anti-Virus pt. 1
Anti-Virus pt. 2
Anti-Malware
Linux Host Lockdown Tools
Windows Host Lockdown Tools (SCAT) pt. 1
Windows Host Lockdown Tools (SCAT) pt. 2
Windows Utilities
Windows Command-Line Tools pt. 1
Windows Command-Line Tools pt. 2
Windows Firewall pt. 1
Windows Firewall pt. 2
MBSA
MSConfig
Linux Tools
User Tools pt. 1
User Tools pt. 2
tcpdump (05:51)
Inetd/TCP Wrappers & Xinetd pt. 1
Inetd/TCP Wrappers & Xinetd pt. 2
md5sum (05:51)
File Security Tools
su & sudo
Scanning & Reconnaisance Tools
Nmap pt. 1
Nmap pt. 2
Nessus pt. 1
Nessus pt. 2
Hping3 (07:19)
Look-at-Lan
nslookup & dig
Ping & Traceroute pt. 1
Ping & Traceroute pt. 2
Superscan pt. 1
Superscan pt. 2
Fing
Network Security Tools
SmoothWall Firewall pt. 1
SmoothWall Firewall pt. 2
SmoothWall Firewall pt. 3
SmoothWall Firewall pt. 4
Linux Firewalls pt. 1
Linux Firewalls pt. 2
3rd Party Windows Firewalls pt. 1
3rd Party Windows Firewalls pt. 2
Wireshark pt. 1
Wireshark pt. 2
Wireless Security
Net Stumbler
inSSIDer
Wireless Capture Tools pt. 1
Wireless Capture Tools pt. 2
Web Tools
Google Hacking Techniques pt. 1
Google Hacking Techniques pt. 2
Nikto/Wikto
NetCraft
whois
Paros Proxy
Encryption Tools
TrueCrypt (07:55)
Encrypting Files in Linux pt. 1
Encrypting Files in Linux pt. 2
Microsoft Windows EFS
Using Encrypted Email - PGP pt. 1
Using Encrypted Email - PGP pt. 2
Penetration Testing tools
Metasploit Framework pt. 1
Metasploit Framework pt. 2
Netcat
John the Ripper pt. 1
John the Ripper pt. 2
Cain & Abel pt. 1
Cain & Abel pt. 2
Colasoft Packet Builder
Computer Forensics Tools
Adepto
Adepto Demonstration
Ghost
Autopsy
Forensics Tool Kit pt. 1
Forensics Tool Kit pt. 2
Live Linux Distros
Backtrack 4
Helix
Damn Vulnerable Linux
Building a Security Toolbox
Creating a Security Toolbox
Dual-Booting a Security Laptop pt. 1
Dual-Booting a Security Laptop pt. 2
Creating a Security USB Stick pt. 1
Creating a Security USB Stick pt. 2
Creating Your Own Live Security CD pt. 1
Creating Your Own Live Security CD pt. 2
Conclusion
Using Security Tools - Conclusion
Resources


http://www.vtc.com/modules/products/titleDetails.php?doorway=Using-Security-Tools-Tutorials.htm


DOWNLOAD
http://www.filesonic.com/folder/6776631

»»  read more

Your Password Should Be At Least 12 Random Characters Long to Be Safe

Your Password Should Be At Least 12 Random Characters Long to Be Safe

Source: http://qp-techelp.blogspot.com/2010/08/your-password-should-be-at-least-12.html

»»  read more

Vietnam Security Group

Vietnam Security Group hoạt động trên lĩnh vực tư vấn bảo mật hệ thống, bảo mật dữ liệu cho các Tổ chức và Doanh nghiệp Việt Nam một cách miễn phí và tự nguyện nhằm nâng cao ý thức bảo mật hệ thống . Việc nhận thức và nâng cao ý thức bảo mật là rất quan trọng gíúp cho các Đơn vị cơ quan và DN của chúng ta có được những kiến thức cơ bản và thông tin kịp thời về an ninh mạng. VSG sẽ được hoạt động bởi sự tham gia tự nguyện của các Hacker , các chuyên viên bảo mật của Việt nam. Chúng tôi hứa sẽ cùng nhau nghiên cứu và cung cấp các thông tin và giải pháp tốt nhất có thể được nhằm đóng góp một phần cho sự phát triển của Hacker và An ninh mạng Việt Nam cũng như đem lại lợi ích cho các tổ chức và cá nhân VN.
Mọi thông tin hợp tác và hỗ trợ xin gửi mail về địa chỉ: vietnamsecurity@gmail.com

»»  read more