e2e Security

Might just be the best Dilbert ever!

2012-02-14T15:34:00.000-05:00

Alice and Bob

2012-02-10T10:16:00.000-05:00

http://imgs.xkcd.com/comics/alice_and_bob.png

Benefits of being a CISSP

2012-02-07T10:24:00.000-05:00

More good stuff here: http://www.youtube.com/user/InfosecCynic?feature=watch

“It’s really, really bad,”

2011-12-13T15:37:00.000-05:00

Friday Fun - How to Rob a Bank

2011-12-09T14:17:00.001-05:00

From AOTS - Twilight: Breaking Dawn Explained (skip the movie, this is way better)

2011-11-30T09:35:00.000-05:00

Game Reviews - E3 2012 - Comedy

16% of Cellphones Have Poop on Them [INFOGRAPHIC]

2011-11-10T13:55:00.000-05:00

FRONTLINE - Top Secret America

2011-09-07T14:49:00.000-04:00

Watch the full episode. See more FRONTLINE.

Consultants

2011-07-29T15:41:00.002-04:00

http://blackhats.com/infosuck/0x004b.png

Mikko Hypponen: Fighting viruses, defending the net

2011-07-20T10:26:00.000-04:00

FIRST WORLD PROBLEMS: THE PENTESTER'... DILEMMA

2011-07-16T15:04:00.002-04:00

Wikileaks, Mastercard commercial parody

2011-07-01T13:11:00.000-04:00

Just because...

2011-06-22T12:08:00.000-04:00

25 Years of Bugs

2011-03-18T11:10:00.000-04:00

How to become an information security thought leader.

2011-02-18T13:44:00.000-05:00

It must be time for ShmooCon... It is snowing!

2011-01-26T10:51:00.000-05:00

Best SPAM Ever!

2010-12-08T09:07:00.000-05:00

-----Original Message-----
From: Miss Freya [mailto:artzgale@gmail.com]
Sent: Wednesday, December 08, 2010 12:02 AM
To:
Subject: Dear Internet User

DEAR RECEIVER,

You have just received a Taliban virus. Since we are not so technologicaly advanced in Afghanistan, this is a MANUAL virus. Please delete all the files on your hard disk yourself and send this mail to everyone you know.

Thank you very much for helping us.

Thanks & Regard's

Miss Freya

TWiT Live Specials 52: Tron: Legacy

2010-12-05T00:48:00.003-05:00

TWiT Live Specials 52: Tron: Legacy
Host: Sarah Lane

Behind the scenes of TRON: Legacy with the filmmakers and cast.

Happy Thanksgiving!

2010-11-25T10:37:00.002-05:00

V for Vendetta Hacker Strikes at Washington State University

2010-11-10T23:28:00.001-05:00

The idea of this makes me smile... Plus it is a great movie.
Wired story here.

Snuggly the Security Bear - Wire Taps

2010-10-16T21:04:00.001-04:00

Practical Lock Picking: A Physical Penetration Tester's Training Guide [Paperback]

2010-09-25T12:22:00.000-04:00

Great book for the beginner or an old pro. Been reading lock picking books for 35 years and this is one of the best... Deviant Ollam, one of the security industry's best-known lockpicking teachers, has assembled an instructional manual geared specifically toward penetration testers. Unlike other texts on the subject (which tend to be either massive volumes detailing every conceivable style of lock or brief "spy manuals" that only skim the surface) this book is for INFOSEC professionals that need essential, core knowledge of lockpicking and seek the ability to open most locks with relative ease.

Happy Left Handers Day!

2010-08-13T15:41:00.000-04:00

August 13th is Left Handers Day 2010

Teenagers accused of running cybercrime ring

2010-08-13T10:58:00.001-04:00

From F-Secure News from the Lab: AMF

New Tron Legacy Trailer

2010-08-01T11:58:00.000-04:00

The Guild Season 4 - Music Video - "Game On"

2010-07-27T21:00:00.000-04:00

<a href="http://video.msn.com/?mkt=en-us&from=sp&fg=shareEmbed&vid=8cb424dc-cbdb-40be-90c5-8fb450462d2f" target="_new" title="Season 4 - Music Video - "Game On"">Video: Season 4 - Music Video - "Game On"</a>

Cuban Spy Gets Life Without Parole, Wife Gets 6 ½ Years

2010-07-18T00:29:00.001-04:00

The 73-year-old great grandson of Alexander Graham Bell was sentenced Friday to life in prison without parole for quietly spying for Cuba for nearly a third of a century from inside the State Department. His wife was sentenced to 5½ years.

Retired intelligence analyst Kendall Myers said he meant his country no harm and stole secrets only to help Cuba's people who "have good reason to feel threatened" by U.S. intentions of ousting the communist Castro government.

But U.S. District Judge Reggie Walton said Myers and his 72-year-old wife, Gwendolyn, had betrayed America and should receive heavy punishment.

Full background story here.

The best Nanny Cam ever!

2010-07-16T17:04:00.001-04:00

CrossTalk: From Anna Chapman to Cyber Warfare

2010-07-14T15:11:00.000-04:00

How Video Games Should Be... Happy Friday!

2010-07-09T12:26:00.002-04:00

Bill Murray on Cybersecurity bill

2010-06-26T10:45:00.000-04:00

Friday Sort of Fun, But Sad...

2010-06-11T07:52:00.002-04:00

U.S. Banks

2010-05-12T01:01:00.002-04:00

FDIC closed...
25 in 2008
140 in 2009
64 so far this year...

2010-05-02T11:46:00.000-04:00

Mine is due to arrive tomorrow, more soon...

本: běn. The Chinese character 本 signifies an origin or the beginning place; It signifies exactly what the first version of the NanoNote is: a beginning.
The 本 version of NanoNote is an ultra small form factor computing device. The device sports a 336 MHz processor, 2GB of flash memory, microSD slot, head phone jack, USB device and 850mAh Li-ion battery. It boots Linux out of the box and also boots over USB. It’s targeted squarely at developers who see the promise of open hardware and want to roll their own end user experience. It’s the perfect companion for open content; we envision developers turning the device into a music or video player for Ogg or an offline Wikipedia or MIT OpenCourseWare appliance. Or you can simply amaze your friends by creating an ultra small handheld notebook computer. You choose the distribution. The 本 Nanonote is the first in a line of products that will see the addition of other hardware capabilities. Get your NanoNote and start a Nanoproject today. Or join one of the existing projects in our developer community.

WTF a PCI Compliant Limo Company?

2010-03-26T21:50:00.001-04:00

Salmonella outbreak tracked by shopper cards

2010-03-15T04:37:00.000-04:00

What do you think - good thing or bad? Can certainly see the good use, but what if used for the wrong reasons? A witch hunt of sorts...

Health authorities in the U.S. have for the first time used department store credit cards to help trace the source of a recent salmonella outbreak that left hundreds of Americans ill.

Investigators at the Centers for Disease Control and Prevention were scrambling to find the source of the outbreak when they hit upon the idea of tracking grocery purchases of those who became ill.

With permission from the patients, health authorities followed the trail of grocery purchases to a Rhode Island company that makes salami, then zeroed in on the pepper used to season the meat.

Read more: http://www.cbc.ca/health/story/2010/03/12/consumer-salmonella.html#ixzz0iFhw2XUI

New Tron Legacy Trailer

2010-03-13T12:59:00.000-05:00

Look what Uncle Bill made...

2010-03-13T00:18:00.002-05:00

Pee-wee Gets An iPad!

2010-03-12T00:31:00.000-05:00

Fridays are for fun!

Pee-wee Gets An iPad! from Pee-wee Herman

Rainbow Tables hosted on an SSD

2010-03-11T18:41:00.000-05:00

New work on a rainbow table system that will crack a 14 char XP password in
under 6 seconds.

Read about it here.

Try it out: demo

SANS/CWE Top 25 Dangerous Programming Errors list

2010-03-11T18:03:00.000-05:00

SANS/CWE released a top 25 dangerous programming errors list. It contains their list of the most common errors that developers are likely to make. The intention is to raise awareness to these problems and help prioritize the order of importance for organizations new into the security game. Their blog has been covering each of the Top 25 problems and provides some commentary on each of them. They are up to #13

Read all about it here.

Tron Legacy (2010) Trailer

2010-03-10T22:45:00.000-05:00

I loved the original... this looks good...

Friday Fun - Bacon Rocket

2010-03-05T01:00:00.002-05:00

Report: The Command Structure of the Aurora Botnet: History, Patterns, and Findings

2010-03-03T19:24:00.001-05:00

Did the "experts" get it wrong? Were the attacks on Google by amateurs?

"Many security vendors have explained the operation against Google, dubbed “Operation Aurora,” using a military vernacular. However, based upon analysis of exhaustive data surrounding these attacks and examination of both the malware and the CnC topologies used by the criminals behind Aurora, it appears that this threat can best be classified as a just another common botnet attack – and one that is more amateur than average."

Read the report from Damballa here.

Defrauding and Hacking Ticketmaster

2010-03-01T18:18:00.004-05:00

This really a hack?

"To defeat the Online Ticket Vendors' technologies, the defendants worked with computer programmers in Bulgaria to establish a nationwide network of computers that impersonated individual visitors to the Online Ticket Vendors' websites, the indictment alleges. The network – described as the "CAPTCHA Bots" in the indictment – gave Wiseguys the ability to flood the Online Ticket Vendors' computers at the exact moment that event tickets went on sale."

Full story here.

PUNKED in the data center...

2010-03-01T09:28:00.000-05:00

More info here.

UBS Access Key (IBM Zone Trusted Information Channel)

2010-02-26T18:20:00.004-05:00

What do you think... good idea? Biz banking saver?

Hitler and Cloud Computing Security

2010-02-24T19:23:00.003-05:00

Don't Be A Dummy - InfoSec is About Trust

2010-02-19T01:06:00.006-05:00

I read your email...

Martial Law for Cyberspace?

2010-02-17T13:53:00.001-05:00

Danger Will Robinson - the iPhone will be the end of civilization!

The federal government isn't prepared to cope with a widespread cyber attack, former top Bush and Clinton administration officials said Tuesday.

The officials participated in a public cybersecurity war game, where they simulated how the government would respond to a widespread cyber attack. The scenario started with malware spread through an iPhone app; the attack eventually crippled cell phone networks and Internet service, and it ended with much of the East Coast without power due to a failing electrical grid.

Full story here.

Simon the IT Dummy

2010-02-17T00:18:00.001-05:00

This whole series rocks. Simon the IT Dummy, the poster boy for under appreciated IT (Security) people everywhere.

ShmooCon 2010 Wrap Up

2010-02-16T00:33:00.001-05:00

Sweet and complete 2010 ShmooCon wrap up here.

Cloud security news and whimsy sans the bullshit.

2010-02-14T14:25:00.000-05:00

Similar format to Liquidmatrix.org a new site dedicated to cloud security.

DC Snowpocalypse 2010

2010-02-09T23:36:00.000-05:00

McAfee Labs Quarterly Threat Report Posted

2010-02-09T23:24:00.000-05:00

A good read... You can find it here.

How to catch an iPhone thief

2010-01-27T17:21:00.001-05:00

Thanks to Brian Krebs for finding... this is a way cool story.

Monday - The Setup

The whole thing started when my plane landed in Los Angeles on Monday afternoon at 2:55pm coming from Cabo San Lucas. The guy sitting next to me on the plane asked me to loan him a pen so that he could fill out his customs form. I watched him fill out the form and clearly remember his birth year of 1984, but am a bit unsure about his name. I think it was -----, but in this story, we will refer to him as Pinche.

The rest of the story here.

"Operation Aurora" nice post on aurora research

2010-01-20T22:07:00.000-05:00

Operation Aurora: Clues in the Code

Secure Your Pants

2010-01-17T01:50:00.002-05:00

Note to terrorist

2010-01-15T01:16:00.023-05:00

You really want to terrorize the US? Just put a dud bomb in your butt, get on a plane and tell people about it. Next up... cavity searches for everyone!

Robertson: Haiti had pact with devil

2010-01-14T18:02:00.010-05:00

WTF! Why not blame it on the Easter Bunny or Santa. Relating what he called a "true story," Rev. Pat Robertson asserted on his TV show, "The 700 Club" that Haiti was struck by a devastating earthquake because its founding fathers made a pact with the devil.

Money Mules Helped to Rob W. Va. Bank

2010-01-13T10:36:00.000-05:00

Interesting story from Brian Krebs.

BackTrack 4 Final Released

2010-01-11T17:56:00.000-05:00

http://www.backtrack-linux.org/downloads/

Fun site for toys

2010-01-07T23:55:00.000-05:00

Some of the product descriptions are a fun read...

http://www.chinawholesale365.com/

The Coolest Data Center Video Tours

2009-12-30T21:30:00.000-05:00

Here’s a look at five of the coolest video tours of major data centers, along with a list of links to 10 other worthwhile video tours.

OWASP Testing Guide v3 and Secure Software Development

2009-12-26T19:48:00.002-05:00

Happy Holidays!

2009-12-24T10:01:00.000-05:00

Instant Chewbacca

2009-11-27T14:35:00.002-05:00

As you can never have enough Chewbacca

Some Interesting Password Data from MS

2009-11-27T09:42:00.000-05:00

Do and don’ts for p@$$w0rd$

Here is a top 10 list with the most common user names used in automated attacks:

User names	Count
Administrator	136971
Administrateur	107670
admin	8043
andrew	5570
dave	4569
steve	4569
tsinternetuser	4566
tsinternetusers	4566
paul	4276
adam	3287

And a similar list for passwords:

Passwords	Count
password	1188
123456	1137
#!comment:	248
changeme	172
F**kyou (edited)	170
abc123	155
peter	154
Michael	152
andrew	151
matthew	151

Full story here.

From AVG - Facebook Worm - warning R-rated!

2009-11-24T08:31:00.001-05:00

Non-profit Organization - ISC(2) Teaches Va. Kids About Internet Safety

2009-11-19T13:24:00.000-05:00

60 Minutes--Cyberwar: Sabotaging the system

2009-11-09T01:52:00.002-05:00

Truth or Dare?

Watch CBS News Videos Online

HNNCast for the Last Week of October, 2009

2009-11-08T12:19:00.000-05:00

Job Security

2009-11-08T12:17:00.000-05:00

Every year, Americans eat 35 million cows, 115 million pigs, and 9 billion chickens and turkeys.

- The New Yorker

HNNCast for the Third week of October 2009

2009-10-26T12:29:00.002-04:00

Balloon Boy Game (Friday Fun a Little Late)

2009-10-24T23:29:00.000-04:00

heyzap.com - embed games

Social engineering for penetration testers

2009-10-16T11:43:00.000-04:00

Sharon Conheady's BruCON talk discusses the practical aspects of a social engineering attack, providing plenty of war stories from her career as a social engineer. The key to preventing social engineering attacks from being successful lies in education and awareness. This talk will give the audience an insight into the techniques used by social engineers, whether as part of an ethical social engineering test or as a malicious social engineering attack.

Social engineering for penetration testers - Sharon Conheady - BruCON 2009 from security4all on Vimeo.

30 years of Failure: the Username/Password combo.

2009-10-15T22:59:00.000-04:00

Interesting new study, which is being published by the Human Factors and Ergonomics Society.

"The use of alphanumeric usernames and passwords is the
most often used (and also the cheapest) method of computer
authentication. However, unfortunately human beings are
limited in their information processing capabilities (Cowan, et
al., 2008). People either use simple passwords that are easy to
remember but easy to crack or difficult passwords which are
difficult to remember. Results of our study have shown that
there are very few people who do not deviate from the best
practices for password use."

CNN Money - 50 Best Jobs in America

2009-10-10T23:50:00.003-04:00

8. Computer/Network Security Consultant

Median salary (experienced): $99,700
Top pay: $152,000
Job growth (10-year forecast): 27%
Sector: Information Technology

What they do: Protect computer systems and networks against hackers, spyware, and viruses. "I consider myself a cybercrime fighter," says Gregory Evans, an independent computer security consultant in Atlanta.

Why it's great: No company or government agency can afford to have a serious breach in the security of its computer system. New technologies and an unending supply of creative hackers around the world keep the field challenging. Consultants can often work from home. And top-level pros command big paychecks.

Drawbacks: Talk about stress. If a system is infiltrated by a virus or hacker, it could mean lights out for the security consultant's career. "This is a job you can't afford to ever fail in," says Evans.

Pre-reqs: Mostly major geekdom, since the skills can be self-taught. Still, a computer science degree comes in handy. An information systems security professional certification (CISSP) is increasingly favored. Experience is key for better-paying positions: Most companies won't hire a consultant with less than five years of experience.

Story here.

Happy Meal?

2009-10-09T19:33:00.002-04:00

Someone dressed an already dead deer in a clown outfit and wig, and dropped it for a family to see.

Banking Trojan Infections Tripled.

2009-10-03T12:05:00.004-04:00

Banking trojan infections almost tripled (up 186 per cent) between Q4 2008 and Q2 2009 according to APWG report.

Crooks, Trojans & Mules

2009-09-30T08:03:00.003-04:00

Interesting report from finjan.

In the third issue of its Cybercrime Intelligence Report for 2009, Finjan shows how cybercrooks used a combination of Trojans and money mules to rake in hundreds of thousands of Euros and to minimize detection by the anti-fraud systems used by banks. After infection, a bank Trojan was installed on the victims’ machines and started communication with its Command & Control (C&C) server for instructions. These instructions included the amount to be stolen from specific bank accounts and to which money mule-accounts the stolen money should be transferred. The use of this Anti anti-fraud method signals a new trend in cybercrime.

OWASP Podcast Series #41

2009-09-26T21:38:00.000-04:00

David Rice, is an internationally recognized information security professional and an accomplished educator and visionary. For a decade he has advised, counseled, and defended global IT networks for government and private industry. David has been awarded by the U.S. Department of Defense for “significant contributions” advancing security of critical national infrastructure and global networks. Additionally, David has authored numerous IT security courses and publications, teaches for the prestigious SANS Institute, and has served as adjunct faculty at James Madison University. He is a frequent speaker at information security conferences and currently Director of The Monterey Group.

Listen

A Stick Figure Guide to the Advanced Encryption Standard (AES)

2009-09-25T23:51:00.001-04:00

A very nice explanation of AES, even has example code with it...

Man sues BofA for "1,784 billion, trillion dollars"

2009-09-25T10:14:00.002-04:00

More Friday Fun!

Dalton Chiscolm is unhappy about Bank of America's customer service -- really, really unhappy.

Chiscolm in August sued the largest U.S. bank and its board, demanding that "1,784 billion, trillion dollars" be deposited into his account the next day. He also demanded an additional $200,164,000, court papers show.

Reuters story here.

Friday Fun with the DataLoss database

2009-09-25T09:33:00.003-04:00

The DataLoss folks have come with some fun ways of querying their data.

Start here.

Couple's Lawsuit Against Bank Over Breach To Move Forward

2009-09-24T17:20:00.004-04:00

So who is responsible the Bank/FI or the end user?

A U.S. District Court ruling in a lawsuit against a bank over a hacked online account has raised thorny questions about who's ultimately responsible for the breach of a customer's account.

An Illinois district court denied Citizens Financial Bank's request to dismiss a lawsuit that charges the bank was negligent in protecting a couple's bank account after their user name and password were stolen and used to pilfer $26,000 from their account. The ruling lets the couple, Marsha and Michael Shames-Yeakel, continue with their lawsuit, mostly based on their allegations that the bank failed to properly secure their account.

Full story here.

What Star Trek Predicts About The Future of Information Security

2009-09-22T08:03:00.002-04:00

This is great and the future might be now...

ShmooCon 2010 - Registration

2009-09-21T00:31:00.001-04:00

Important Dates and Deadlines

* November 1, 2009, Noon EDT - first round of ticket sales
* December 1, 2009, Noon EST - second round of ticket sales
* January 1, 2010, Noon EST - third and final round of ticket sales

Don't Copy That 2 (Official Sequel to Don't Copy That Floppy)

2009-09-14T00:05:00.002-04:00

In this sequel to 1992's "Don't Copy That Floppy," MC Double Def DP continues his crusade against piracy in the digital age. Brought to you by SIIA (formerly SPA).

What do you think?

Cyber War Gets Its Own Museum Show

2009-09-10T09:46:00.001-04:00

The International Spy Museum in Washington plans will launch a cyber war show dubbed Weapons of Mass Disruption next month.

The show will be heavy on video interviews with folks such as Director of National Intelligence Dennis Blair; former Special Advisor to the President on Cyber Security Richard A. Clarke; Lee Hamilton, co-author of The 9/11 Commission Report; Sen. Christopher "Kit" Bond, vice chairman of the Senate Select Committee on Intelligence; and R. James Woolsey, former CIA director.

Story here.

Spy Museum

Vista/2008/Windows 7 SMB2 BSD 0Day

2009-09-08T08:34:00.002-04:00

Is this not a one big "Well Duh"?

If you are not blocking 445 then... you have more problems than this one...

From SANS -

"We have received a report from Tyler that a vulnerability affecting Microsoft SMB2 can be remotely crashed with proof-of-concept code that has been published yesterday and a Metasploit module is out.

We have confirmed it affects Windows 7/Vista/Server 2008. The exploit needs no authentication, only file sharing enabled with one 1 packet to create a BSOD. We recommend filtering access to port TCP 445 with a firewall.

Windows 2000/XP are NOT affected by this exploit."

Free Book

2009-09-07T22:50:00.006-04:00

Download Vulnerability Management for Dummies.

Have Skimmer, will Travel

2009-09-04T09:06:00.004-04:00

Police in New Zealand have apprehended two Bulgarian nationals in Nelson overnight. The Bulgarians have been charged with carrying out data-skimming attacks on ATM machines in Nelson and Canterbury, the NZPA has reported on September 4. Reportedly, the police investigation is still ongoing, with authorities trying to determine whether the pair were successful in their scheme, and if so, to assess the damages.

More here.

Weaponizing the Web from DEFCON

2009-09-02T10:43:00.003-04:00

Shawn Moyer and Nathan Hamiel spent some time last year looking at this problem as it related specifically to social networks. This year, they talk about a previously unnoticed attack vector for lots and lots of web applications with user-generated content, and releasing a handy tool to exploit it.

Shawn Moyer and Nathan Hamiel: Weaponizing the Web (DefCon 17) from Vim EeeeOOO on Vimeo.

Happy Birthday INET

2009-09-02T08:42:00.002-04:00

September 2, 1969, ARPANET, the forerunner of INTERNET was developed when two computers at University of California, Los Angeles were connected on an experimental military network by a team at UCLA.

Wikipedia ARPANET Timeline

Wachovia Banking Wizard - XSS - PoC

2009-08-30T22:19:00.007-04:00

Full Disclosure

United Breaks Guitars

2009-08-28T01:00:00.003-04:00

Song 1

Song 2

XSS AF

2009-08-25T22:31:00.002-04:00

For the past five months, a website for investment services giant Ameriprise Financial contained bugs that allowed even low-level criminals to inject malicious content into official company webpages and steal user's cookies, according to Russ McRee of HolisticInfoSec.org who first identified the bugs.

Amex cardholders' data stolen by employee

2009-08-15T16:46:00.002-04:00

American Express Co. spokeswoman Susan Korchak said a "relatively small portion" of card members was involved, but declined to be more specific.

The small portion included me! I got the letter early this week. No new card, just told to keep an eye on things...

The former employee has been arrested and the company is investigating how the data was obtained, she said.

AP story here.

Hack? What Hack?

2009-08-09T22:38:00.005-04:00

Ex-worker accused of hacking into Mt. Airy computers using co-workers’ IDs to access computer from his residence.

A lot of things are wrong here, but not much hacking...

Leo Harry Hornbaker III, 37, of Bodle Road, a former employee at the Monroe County casino, is accused of using other employees’ user names and passwords to access the casino’s computer from his residence, according to arrest records filed by the state police Bureau of Criminal Investigations Unit.

Story here.