Liquidmatrix Security Digest

Security Briefing: November 20th

Dave Lewis — Thu, 20 Nov 2008 16:09:12 +0000

Good morning all! I’m taking over the news for the day (and should have yesterday but, I punted) while the intern gets stuff done. Now, I can crawl back into bed as I watch my staycation slip away.

Cheers!
Dave

Click here to subscribe to Liquidmatrix Security Digest!.

And now, the news…

China’s hackers stealing US defence secrets, says congressional panel | The Guardian
Teenager Pleads Guilty to Botnet, ’swatting’ Charges | PC World
Hospitals still fighting virus infection - day three | Silicon.com
German Secret Intelligence Service (BND) T-Systems network assignments | Wikileaks
S4 Training Preview: Advanced Security Testing of Control System Components | Digital Bond
US Army bans USB devices to contain worm | The Register
International Challenges in PCI Security | Network World
BlackBerry’s Storm: Awkward and Disappointing | PC World

Tags: News, Daily Links, Security Blog, Information Security, Security News

ISOC Response To Spam Scam

Dave Lewis — Thu, 20 Nov 2008 01:30:44 +0000

I find this interesting. I received this email today,

Dear colleagues

The Internet Society (ISOC) has recently become aware that there is an email scam circulating, which claims to be part of a competition sponsored by ISOC.

The email, which claims that ISOC is a sponsor of the “FAN-OF-THE-WEB Promotion for 2008″, promises a prize will be sent once the recipient provides certain personal details, including passport information, as well as a payment for shipping fees.

Please be advised that ISOC is not connected in any way with these emails, nor does it sponsor the competition named in those mails. Furthermore, ISOC is not involved in any competitions or awards that would result in unsolicited emails of this nature.

ISOC urges all Internet users to be careful of any unsolicited emails that ask you to provide money or personal information. If you have any doubts about any mail which purports to be connected to ISOC, please feel welcome to contact us directly:

Um, here’s a thought. Why not digitally sign your emails?

Hmm?

Spyware Maker Blocked In US Court

Dave Lewis — Tue, 18 Nov 2008 15:49:26 +0000

Monitoring software sales model gets the rug pulled out from under it. RemoteSpy, a keystroke logger application, sold by CyberSpy Software (fail on name alone) has had its sales blocked by a US court.

From PC World:

The FTC’s complaint said CyberSpy violated regulations prohibiting the installation of software without the consent of a user and surreptitiously collecting personal data. The FTC is seeking a permanent ban on the sale of RemoteSpy and wants the company to forfeit its gains from sales of the program.

RemoteSpy was advertised as being undetectable by antivirus software and was sold using the slogan “Spy on Anyone. From Anywhere.” The company’s Web site was down as of Tuesday, but Google’s cache of its home page showed the program sold for US$89.95 with free technical support.

CyberSpy Software gave its customers special instructions on how to e-mail the program to an intended victim, disguising it as a harmless photo file.

For under $90 you too can violate someone’s privacy. WTF? I find it odd that this product which has been on sale since 2005 is only now receiving the ire of the FTC. Don’t get me wrong I’m pleased to see it.

From the cached version of the website,

CyberSpy is an award-winning spy software that features powerful computer monitoring and internet monitoring.

CyberSpy software started with CyberSpy, our flagship computer monitoring product. CyberSpy is a local computer monitoring product perfect for monitoring your home or office computers. With stealth capabilities CyberSpy can secretly record all keystrokes typed, websites visited, internet conversations, documents opened, and so much more!

Award winning? There are awards for spyware? Do they have a dinner with watered down drinks, rented tuxedos and rubber chicken dinners?

Article Link

Security Briefings - November 18th

The Intern — Tue, 18 Nov 2008 14:40:03 +0000

G’morning,

The sun is bright and high this morning, here’s hoping this day has great things in store.
Thank you for your continued support.

Cheers!

The Intern

Click here to subscribe to Liquidmatrix Security Digest!.

And now, the news…

Rational Risk Management, ‘Angry Italians’ and Irrational Security Analysts - RiskAnalys.is
Microsoft sees value in exploitability index - Security Focus
Widespread Account-Sharing Threatens Corporate Security, Revenues - Dark Reading
November 24 Deemed Black Monday - Dark Reading
Law professor fires back at file-sharing lawsuits - The Globe and Mail
Lego: 14-Pound Lego Safe Is Guarded By 305 Billion Codes - Gizmodo Need a weekend project? Look no further.
Gartner: open source software ‘pervasive’ - The Register
Mobile phones will cut off Al Qaeda says DHS - The Register Again, security dependent on something mutable - and you know that Auntie Ruth on her trip to Palm Springs for the winter is going to be whipping out her classic Moto Brick and trying to display a high rez bar code on that 12 digit 7-seg LED display. As Myrcurial would say - it’s all blinkie lights and shiny things for some people. /rant

The classic Moto Brick

Tags: News, Daily Links, Security Blog, Information Security, Security News

Security Briefings - November 17th

The Intern — Mon, 17 Nov 2008 14:25:49 +0000

Good morning, glad you’re joining us. Hope your Monday is without speed traps and detours!

The Intern

Click here to subscribe to Liquidmatrix Security Digest!.

And now, the news…

McColo takedown nets massive drop in spam - The Register
SDL announcements - Emergent Chaos
Cloud Security Macro Layers? I’ll Take “It’ll Never Sell” for $1000, Alex… - Rational Survivability
Microsoft’s Stance on Piracy Affects Us All - Security Focus
Why Security, Privacy and Compliancy Don’t Mix. - Layer 8
Who Should We Be? - Kevin Kelly
CohesiveFT VPN-Cubed: Not Your Daddy’s Encrypted Tunnel - Rational Survivability
Via Rail explores entertainment download business - The Globe and Mail THIS is what they come up with for a new revenue stream? Wth.
Half Life hacker refused FBI sting bait - The Register

And, finally, who hasn’t been slightly red in the face come Monday morning? Maybe it’s only me.

5 Ways to Keep Your Drunken Self Away From the Internet - Mashable

Tags: News, Daily Links, Security Blog, Information Security, Security News

7th

Security Briefings - November 13th

The Intern — Thu, 13 Nov 2008 13:50:45 +0000

Hola! Como Esta?

Make it a great day - thanks for joining us!

Signed,

The Intern

Click here to subscribe to Liquidmatrix Security Digest!.

And now, the news…

The Economics of Spam - Bruce Schneier If you read only one article today, make it this one. And don’t skip the comments.
@kevinscold is Funny… Is It Legal? - Mashable
On Security & Risk Management Innovation Risk Analys.is
Patch Tuesday a fairly minor one for Microsoft - Security Focus
Intrusion Threatens Data of 330,000 at UF - Dark Reading
A copyright call to arms - The Globe and Mail
Why clouds should be more like operating systems - The Register
ISP boss pledges to undermine Great Aussie Firewall - The Register
Tips for getting started in Information Security - Kees Leune I meant to post this last week, apologies.
Firefox update fixes four critical flaws - The Register

And finally, if you think you’re having a bad day, at least yours wasn’t being recorded for all and sundry:

Texas cop tasers himself - The Register Yes! With video!

Peace Out, Boy Scout.

Tags: News, Daily Links, Security Blog, Information Security, Security News

What’s My Twitter Rank…Whut, My Password? Sure

Dave Lewis — Thu, 13 Nov 2008 00:28:02 +0000

In the wide world of silly things I am never one to think I’ve seen it all. Today there was a buzz on Twitter about a website called Twitterank that would calculate the individual users overall ranking.

Well, see the problem with that is that the site in question asked for your Twitter username AND password.

Who knows (at this point) he might be legit (doubtful). In all honesty where is that little voice that screams at people that “this is not a good idea“?

And when one has a peek at the source code for the site we see this comment;

I am about to ask you for your Twitter user ID and password. You should be afraid. This is where you ask yourself, “Do I really want to find out my twitterank badly enough to give some random dude on teh interweb my account info?” And if that’s not what you’re asking yourself, shame on you.

Um, yeah.

Burp 1.2 Approaches!

Dave Lewis — Wed, 12 Nov 2008 14:25:13 +0000

I have been using Paros (and others) for a while now and this was an easy enough tool to use historically. Problem is that it hasn’t been maintained for a long time. One tool that I was introduced to a couple years back was the Burp Suite written by PortSwigger. This is a great application for doing all types of web testing. This has become my “go to” power tool for testing web applications.

This month (yes, I’m late with this one) PortSwigger is posting a feature per day for the new version that he is getting set to release. It looks very cool. The feature per day is his Month of Burp Pron (MoBP). I highly suggest that you check the site out to get an idea of what’s coming in the new version. I’m looking forward to getting my hands on this when it’s available.

Seriously, if you haven’t tried this tool before go download and try out the demo version of 1.1 now. For the full version there is a nominal cost involved that is well worth it.

Article Link

IT Tales Of Woe

Dave Lewis — Wed, 12 Nov 2008 14:00:07 +0000

OK, I’m starting to get back into the swing of things again. Been a rough ride of late but, I’m back. I figured this would be a perfect article to share.

This comes from the good folks at Computerworld:

“Although I was not official IT and didn’t have any network background, because of the physical distance I had the privilege of checking out user complaints and then passing legitimate help requests on up the chain of command,” says fish.

“One day, I received a request to help with a networking issue: The user was not able to get to the Internet. I did the usual first look and found that the LAN cable was connected. When I checked ipconfig, it showed that the computer had failed to pick up an IP address.”

And it just gets worse from that point. A very funny and sad story all at once. For the full story read on.

Article Link