Wednesday, May 31, 2006

"Weapon of Mass Destruction" Targets Sex Shop In FL

In Waldo, people have held prayer vigils and protests aimed at an adult bookstore along US 301, trying to keep the "Cafe Risque" from opening its doors on time.

Those efforts have all failed, so investigators say it looks like someone has turned to what they're calling a clear act of terrorism to keep the store's owner from opening up shop.

Tuesday, May 30, 2006

Spam Or Ham

SpamOrHam.org is a web site where you can help anti-spammers (like SpamOrHam creator John Graham-Cumming) by manually sorting email. In order to accurately test spam filters anti-spammers need to have large amounts of email that has been accurately divided into spam and ham (normal) messages.

Although there are some existing sets of sorted messages available (such as the SpamAssassin public corpus and the TREC 2005 Public Spam Corpus), they are either small or have been sorted by machine and may contain errors.

SpamOrHam.org has been created to solve that problem by harnessing people power. By manually classifying (clicking This is Spam or This is Ham) a small number of messages a large number of people can quickly sort thousands of messages.

You can help out by clicking through messages that are randomly displayed and saying whether you think the message is spam or ham. It's as simple as that.

Saturday, May 27, 2006

Linux for Human Beings

"Ubuntu" is an ancient African word, meaning "humanity to others". Ubuntu also means "I am what I am because of who we all are". The Ubuntu Linux distribution brings the spirit of Ubuntu to the software world.
I can't say enough good things about this free distribution. Ubuntu is a free, open source operating system based on Debian. A single disk is all you need for install and a Live CD ver is also available.

Great stuff...

Friday, May 26, 2006

Fridays are for Fun! No prison stay for 5-foot-1 child molester

A man found guilty of sexually assaulting a child has been given 10 years of probation by a judge who said the man was too small to survive prison.

District Judge Kristine Cecava of Cheyenne County sentenced Richard W. Thompson, 50, Tuesday on two counts of sexually assaulting a minor.

“What you have done is absolutely inexcusable,” she said.

His crimes deserved a long sentence, Cecava said, but she expressed concern that the 5-foot-1 Thompson would be especially imperiled by prison dangers.

Reporting Vulnerabilities - Not for the Faint of Heart

Interesting essay, and interesting comments, along with an article on the essay.
Nothing bad happened to me, but it could have, for two reasons.

The first reason is that whenever you do something “unnecessary”, such as reporting a vulnerability, police wonder why, and how you found out. Police also wonders if you found one vulnerability, could you have found more and not reported them? Who did you disclose that information to? Did you get into the web site, and do anything there that you shouldn’t have? It’s normal for the police to think that way. They have to. Unfortunately, it makes it very uninteresting to report any problems.

The second reason that bad things could have happened to me is that I’m stubborn and believe that in a university setting, it should be acceptable for students who stumble across a problem to report vulnerabilities anonymously through an approved person (e.g., a staff member or faculty) and mechanism. Why anonymously? Because student vulnerability reporters are akin to whistleblowers.

Thursday, May 18, 2006

Top ten spam-generating countries by Spamhaus.org

We are number one!

The US is the leading spam origin country. China and Russia are next.

Wednesday, May 17, 2006

Management Problems

“There are management solutions to technical problems, but there are no technical solutions to management problems.”

This is true in any business environment, but it is especially true in the security world. Often executive management will look at security and see something that can be “fixed” with a magic box, maybe a firewall, an encryption device, etc.

However, the only way to really fix security is to have management truly understand the right reasons for needing an effective security program vs only perusing security due to external pressures/mandates to do so. Then once they have grasped this basic tenant then and only then can they successfully transmit this message to the troops.

Security can be looked at as an art or even a religion, but with out a foundation built on integrity, reality and wisdom… It is nothing but a lot of smoke and mirrors.

Sunday, May 07, 2006

Fridays are for Fun - Cryptography Rap

Crap its Sunday not Friday! Oh well, fun anyway...

The rapper MC Plus+ has written a song about cryptography, "Alice and Bob." It mentions DES, AES, Blowfish, RSA, SHA-1, and more...

Quiz Of The Week

What does JDAN ENTERPRISES, Inc. do?

Ck their website here.

Computer-Savvy Thieves Rip-Off Gas Stations

For almost any crime there needs to be motivation... High Gas $s = motivation
At least two St. Louis gas station owners or managers say somebody is breaking into gas pumps, reprogramming interior keypads and instructing the machines to dispense fuel at no charge.

Free gas is certainly not what the gas station owners had in mind.

Kevin Tippit is manager of the Phillips 66 at Lindell and Boyle in St. Louis. Tippit says his boss lost between $6,000 and $10,000 worth of gas Friday before a regular customer tipped-off an employee.

"They (the thieves) have a key to the pump and then after they open up the pump they go in and they reprogram the pump, so they can have free gas. And then everybody behind them sees what they're doing, and they continue," says Tippit.

Wednesday, May 03, 2006

X-ray Machines Fail to Detect Assault Weapon

Narcotics officers found the Professional Ordnance Carbon-15 Type-97 pistol in the car of a drug suspect in Newark and noticed it was a cut above the usual weaponry employed by local drug dealers, Fontoura said.

Officers in his ballistics laboratory, who said they had never seen an assault weapon made with so much plastic, had it taken to Newark Liberty International Airport earlier today for a test-run through the security scanners — minus its 30-round clip.

The image on the X-ray appeared as a straight metal rod, with no outline of a stock or a trigger guard, something an inattentive security guard may view as no more threatening than a curling iron, the sheriff said.

How a Boarding Pass Can Get You More Than a Plane Ride

Read how a small stub can enable access to personal information, including passport numbers, date of birth and nationality. Providing the building blocks for stealing an identity, ruining future travel plans - and even creating a fake passport.

Friday, April 28, 2006

The Use by Banks of Non-SSL Login Forms

A recent SANS blog re-addresses the issue that many banks are using non-SSL login forms and raises some valid concerns about the lack of good Banking security. They have also posted this Online Banking score board showing which Banks are practicing good online security and which aren't.

Fridays are for Fun - Judge creates own Da Vinci code

Per a BBC report, The Times and The Register the judge who presided over the failed Da Vinci Code plagiarism case at London's High Court hid his own secret code in his written judgement.

Seemingly random italicized letters were included in the 71-page judgment given by Mr Justice Peter Smith, which apparently spell out a message.

Mr Justice Smith said he would confirm the code if someone broke it.

"I can't discuss the judgment, but I don't see why a judgment should not be a matter of fun," he said.

You can check it out for yourself here.

Thursday, April 27, 2006

Security Myths and Passwords

Very good essay by Gene Spafford on passwords...

Policies requiring regular password changes (e.g., monthly) are an example of exactly this form of infosec folk wisdom.

From a high-level perspective, let me observe that one problem with any widespread change policy is that it fails to take into account the various threats and other defenses that may be in place. Policies should always be based on a sound understanding of risks, vulnerabilities, and defenses. “Best practice” is intended as a default policy for those who don’t have the necessary data or training to do a reasonable risk assessment.

Tuesday, April 25, 2006

Tool Time - Cmos password recovery tools 4.8

CmosPwd decrypts password stored in cmos used to access BIOS SETUP.
Works with the following BIOSes

* ACER/IBM BIOS
* AMI BIOS
* AMI WinBIOS 2.5
* Award 4.5x/4.6x/6.0
* Compaq (1992)
* Compaq (New version)
* IBM (PS/2, Activa, Thinkpad)
* Packard Bell
* Phoenix 1.00.09.AC0 (1994), a486 1.03, 1.04, 1.10 A03, 4.05 rev 1.02.943, 4.06 rev 1.13.1107
* Phoenix 4 release 6 (User)
* Gateway Solo - Phoenix 4.0 release 6
* Toshiba
* Zenith AMI

With CmosPwd, you can also backup, restore and erase/kill cmos.

Cain & Abel v2.8.9 released

New features:

- Added hashes syncronization functions (Export/Import) to/from Cain for PocketPC via ActiveSync.
- Added VoIP sniffer support for the following codecs: G723.1, G726-16, G726-24, G726-32, G726-40, LPC-10.
- Added support for Winpcap v3.2.

Download here.

Monday, April 24, 2006

Home Security - Man dies when large hole opens in home

If not one hole it's another...
It was like a scene from a horror film: A 27-year-old man plummeted into a gaping hole that suddenly opened beneath a house, trapping him beneath foundation rubble and killing him.

"It's unbelievable," Placer County Sheriff's Department spokeswoman Dena Erwin said. "From the front of the house, it's absolutely normal. Then, in the middle of the house, is this enormous hole."

The victim was awake and on the ground floor about 9:30 p.m. Friday when the concrete foundation near the kitchen gave way, sending him plunging into to the ground, Erwin said.
Full story here.

Saturday, April 22, 2006

Super-Glue: Best practice for countering key stroke loggers

For one the greatest attempted bank heists in history, the bank robbers installed key logger devices on machines inside the bank and eventually got access to Sumitomo Bank's wire transfer capability. They then proceeded to transfer more than $440 million to various accounts in other countries.

Read all the details in this article.

The one thing not mention in the article is that it is reported that Sumitomo Bank's best practice for avoiding a repeat attack is that they now super-glue the keyboard connections into the backs of their PCs.

Tuesday, April 18, 2006

Image stealing by phishers

From F-Secure Blog...


Lazy phishers are often simply making a copy of the original bank site with some malicious modifications. As an example, take a look at this currently active phishing site targeting Chase Bank.

Chase phishing site

This phishing site is running on an infected home computer in Spain. Only the html is hosted there; all the images are actually loaded directly from a real chase.com server.

Now, activity like this could be detected by the website of the bank automatically. How about modifying the logic of the bank web server to do something along these lines:

If somebody

a) loads my images but
b) does not load the corresponding html file and
c) has http referrer -values outside of my domain

then, for this user, lets change this image:

Chase logo before

to this image:

Case logo after


This could be activated only after the activity has happened from, say, 10 different IP addresses, to make it harder for the attackers to spot it until it's too late.

And, in most cases the REFERRER fields would directly point the bank staff to the real phishing site which they could now start closing down.

Eventually, attackers would move to host their own images, but for now they still typically don't.

 
Copyright 2018 e2e Security. Powered by Blogger Blogger Templates create by Deluxe Templates. WP by Masterplan