<![CDATA[[SecurityRatty] tag: circle]]> http://securityratty.com/tag/circle Wed, 13 Feb 2008 07:18:26 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Blue Box #82: Asterisk & Skype security vulnerabilities, new VoIP security tools, VoIP steganography, VoIP security news and much, much more...]]> http://securityratty.com/article/ab8e0e22ebb1851ff664c3be0a3baa7d http://securityratty.com/article/ab8e0e22ebb1851ff664c3be0a3baa7d

Synopsis:  Blue Box #82: Asterisk & Skype security vulnerabilities, new VoIP security tools, VoIP steganography, VoIP security news and much, much more...

Welcome to Blue Box: The VoIP Security Podcast #82, a 47-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 21MB) or subscribe to the RSS feed to download the show automatically. 

NOTE: This show was originally recorded on June 21, 2008.

You may also listen to this podcast right now:

Show Content:

  • 00:20 - Intro to the show, contact information and how to provide comments.  Welcome to all the new listeners - and to all those listeners who have been here for so long!
  • Programming notes:
    • Note about the production team – new special editions coming soon.
    • Note about URLs for the media files
  • AST-2008-008 – Remote Crash Vulnerability in SIP channel driver when run in pedantic mode
  • AST-2008-009 – Remote crash vulnerability in ooh323 channel driver
  • Skype-SB-2008-003 – Skype File URI Security Bypass Code Execution Vulnerability

  • New version of SIPvicious

  • Sipflanker – tool to find SIP devices with web GUIs

    • Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

    Thank you for listening and please do let us know what you think of the show.

    ]]> Wed, 27 Aug 2008 16:53:17 +0000 voip security voip security news voip voip security tools voip steganography voip services security skype security vulnerabilities voip security podcast Blue Box #82: Asterisk & Skype security vulnerabilities, new VoIP security tools, VoIP steganography, VoIP security news and much, much more... <![CDATA[Blue Box #82: Asterisk & Skype security vulnerabilities, new VoIP security tools, VoIP steganography, VoIP security news and much, much more...]]> http://securityratty.com/article/48c1a58b9d39348008877ad191ffcfea http://securityratty.com/article/48c1a58b9d39348008877ad191ffcfea

    Synopsis:  Blue Box #82: Asterisk & Skype security vulnerabilities, new VoIP security tools, VoIP steganography, VoIP security news and much, much more...

    Welcome to Blue Box: The VoIP Security Podcast #82, a 47-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

    Download the show here (MP3, 21MB) or subscribe to the RSS feed to download the show automatically. 

    NOTE: This show was originally recorded on June 21, 2008.

    You may also listen to this podcast right now:

    Show Content:

    • 00:20 - Intro to the show, contact information and how to provide comments.  Welcome to all the new listeners - and to all those listeners who have been here for so long!
    • Programming notes:
      • Note about the production team – new special editions coming soon.
      • Note about URLs for the media files
    • AST-2008-008 – Remote Crash Vulnerability in SIP channel driver when run in pedantic mode
    • AST-2008-009 – Remote crash vulnerability in ooh323 channel driver
    • Skype-SB-2008-003 – Skype File URI Security Bypass Code Execution Vulnerability

    • New version of SIPvicious

    • Sipflanker – tool to find SIP devices with web GUIs

      • Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

      Thank you for listening and please do let us know what you think of the show.

      ]]> Wed, 27 Aug 2008 15:53:18 +0000 voip security voip security news voip voip security tools voip steganography voip services security skype security vulnerabilities voip security podcast Blue Box #82: Asterisk & Skype security vulnerabilities, new VoIP security tools, VoIP steganography, VoIP security news and much, much more... <![CDATA[DNS Vulnerability Survives Scrutiny of Peer Review]]> http://securityratty.com/article/9fc8d3f7899f8f693bb1b89afdd9ebc5 http://securityratty.com/article/9fc8d3f7899f8f693bb1b89afdd9ebc5 The security community is cynical. So much so, that most of the chatter that’s taken place over the past 24-36 hours has suggested that Kaminsky’s DNS vulnerability was little more than a publicity stunt and that his BlackHat presentation would be an over-hyped rehash of prior art. Granted, one has to suspend disbelief to even consider that something monumental would be discovered in DNS — that’s the protocol itself — but hell, it’s always nice to give a guy the benefit of the doubt.

      Faced with nearly a month of criticism and questioning, and understanding the persuasive power of a technical peer review, Dan decided to expand the inner circle, so to speak. Rich Mogull arranged a phone call with Tom Ptacek and Dino Dai Zovi so that Dan could spill the beans and let them decide for themselves whether it was spin or substance. Turns out there was substance.

      Now we sit around and wait until August 6th to cram into a ballroom with a thousand sweaty conference-goers to hear the juicy details. And Dan’s presentations are usually packed to the brim even when he’s not announcing anything.

      In the meantime… how about patching those servers?

      ]]>       Wed, 09 Jul 2008 21:30:48 +0000 dns kaminskys dns vulnerability technical peer review dino dai zovi persuasive power blackhat presentation dan tom ptacek substance DNS Vulnerability Survives Scrutiny of Peer Review       <![CDATA[Fun Reading on Logs and Log Management]]> http://securityratty.com/article/e85ee9ea7645529bf3a4211d03fa5124 http://securityratty.com/article/e85ee9ea7645529bf3a4211d03fa5124 I am amazed (no, AMAZED!) about how many people now write about logs; it is definitely not "the original logging evangelist" anymore :-) Here is a quick sample, useful for those struggling with logs (aka "everybody" :-))

      1. A very fun read from Patrick Mueller (ex-Neohapsis now turned lawyer): "Facing The Monster: The Labors Of Log Management." I am happy that log management has been finally granted a monster status :-)
      2. I am happy to see that one of the "five questions to ask before sending your data in the cloud" is "Will I have access to logging and auditing data?" This is indeed a big deal (well, it will be soon) and you will be hearing more about this. I call this "a case of log ransom," since you might need to pay the ransom to see what is "yours" - the logs
      3. Again on leaving [some] logs behind. Remember, the point is not that "collecting all" is a good idea, it is that figuring what to pick is IMPOSSIBLE, while "collecting all" is simply very hard :-)
      4. This is hot stuff: "Ten reasons you will be unhappy with your SIM solution" (no, I didn't write it :-), but this is mine)
      5. Why HA for log management from our star engineer. Those thinking about the reliability of their logging systems should read it.
      6. Fun info on web server log analysis for different purposes.
      7. "Why Logs and Logging Matters - Part 1" and "Why Logs Matter - Part 2, A Letter" present really good intro logging for compliance and other purposes (even specifically saying "what you do with the logs that matters.")
      8. "Smart Business Leaders Support Effective Log Management Practices and Necessary Resources" from Rebecca Herold is a nice basic piece, especially for those outside the circle of logging literati.
      9. More from Sanford on logging standards: "Drawing Lines", an awesome post indeed.
      10. A MUST read on SIEM and log management from Greg Shipley (I promise this is a coincidence! :-)) In this piece, Mr Neohapsis drop kicks more than a few "latest generation" SIEM tools. Guess which product review mentions "pain" 3 times on one page :-)
      11. Finally, this is also worth a read: "Ode to Log Management" where Mr Baum laments logs being pigeonholed in to "another IT management tool" silo despite their broad relevance. He is right - but focusing on one use case after another works...

      Enjoy!

      About me: http://www.chuvakin.org
      ]]>       Mon, 30 Jun 2008 12:09:00 +0000 logs log management logs matter baum laments logs fun nice basic piece piece ransom siem Fun Reading on Logs and Log Management       <![CDATA[Security Function as a Business Enabler]]> http://securityratty.com/article/3180c5cc4bdef8e6f23843201b85d663 http://securityratty.com/article/3180c5cc4bdef8e6f23843201b85d663 In one of my earlier blog posts I branded Information Security function (as part of IT) as an overhead of an overhead. It is utmost important for security manager to run the security function in a way that it enables the business.

      The various components (sub functions) of security organization should align with the business objectives of the IT and the whole organization. There needs to be a cohesive security strategy in order to align the various comoponents. One good way of understanding the business objective is why is the business parting with money for deploying a specific security component. Why is business giving me money for Compliance? Why is business giving me money to implement IDP? Constitutive questions such as these will help you to understand the fundamental concerns for the business and based on these we can come up with a strategy suitably aligned with the business.

      One good example is the area of compliance. Attempting to make each every units of your business complaint with certain standards/legal regulations and so on would be a tall order. First define the scope, draw a circle around the units that need to be compliant, then come up with a strategy to make it compliant by formulating your objective - derived from the business objective of why the business gave you money.

      Any security implementation effort should have a well defined focus (scope), business objective and strategy to bind the various components cohesively that aligns with the ultimate business objective. By this business will view security organization with dignity else security organization will end up being a spoke in the wheel of business.

      In the past, I was involved in discussion about the ROI of information security and security is insurance and so on. After eating the forbidden apple from the tree of paradise, I realize security has neither ROI nor akin to insurance. Information security is way of doing business with due care. Security is way of enhancing the trust of a business among customers and thus enhancing the identity (or brand image of the company). Few years down the line people won't even question why you do security, it will become a part of  your background conversation. Nobody questions why we buy hybrid vehicles anymore right?

      If components of security function is not cohesively aligned with business objective it is spoke in the wheel of business else it is a brand enhancer of business.

       

       

      ]]>       Fri, 27 Jun 2008 16:50:00 +0000 security view security organization security organization business information security function organization information security cohesive security strategy strategy Security Function as a Business Enabler       <![CDATA[Pentagon Inked $97 Million Deal With Shady Kremlin Outfit]]> http://securityratty.com/article/ef02162cebc829d20ac7ef25d2c368ac http://securityratty.com/article/ef02162cebc829d20ac7ef25d2c368ac
      ]]>       Thu, 12 Jun 2008 08:00:00 +0000 shady russian outfit missile defense agency million contract fbi raids pentagon brass congressman circle access questions Pentagon Inked $97 Million Deal With Shady Kremlin Outfit       <![CDATA[Clear communications]]> http://securityratty.com/article/211c1a1048ac0bb30d34914489bbc452 http://securityratty.com/article/211c1a1048ac0bb30d34914489bbc452 Sunday Times and an article in which an American judge talks about Harry Potter novels. It brought to mind an email I received from some-one in my organisation a few days ago which simply stated "thank you, I could actually understand what this means" in response to some information I had distributed, which I took to actually mean "as opposed to the undecipherable hieroglyphics you usually post..." As an industry, if we were to stand accused of producing gibberish and terms that would be meaningless in any other context then the verdict would be a unanimous guilty as charged. The problem is that this leads people to believe that information security is purely a technical subject, driven by techies, communicating in techno-speak. I like to think that the secret of my own success is clarity in my communication. However, when I look back through some of the messages I've recently sent out some of them are full of three letter acronymns and industry specific terminology that no-one outside of the "circle-of-trust" is likely to understand - let alone somebody who doesn't have English as their first languge. So, take a note Mrs Jones. Reminder to self - consider the audience and make the messages understandable. ]]> Sun, 20 Apr 2008 03:13:18 +0000 information information security industry specific terminology industry messages understandable messages people american judge talks leads people Clear communications <![CDATA[Video Blogger Kevin Sites Keeps One Foot in the War Zone]]> http://securityratty.com/article/2f0e2de0b794b63d3e99e9c3d9c90993 http://securityratty.com/article/2f0e2de0b794b63d3e99e9c3d9c90993
      ]]>       Fri, 18 Apr 2008 14:00:00 +0000 hot zones war zones disaster sites circle congo set Video Blogger Kevin Sites Keeps One Foot in the War Zone       <![CDATA[End to end trust]]> http://securityratty.com/article/41a353c56c63adbe1583cd6c0d37a8f0 http://securityratty.com/article/41a353c56c63adbe1583cd6c0d37a8f0 RSA conference, I'm in Vienna looking out of the window of the airport lounge in hope that my flight home might both arrive and depart on time. Would I prefer to be in San Francisco? Yes! On saying that, I do like Vienna - in fact, it's one of my favorite cities. Friendly people, beautiful architecture, and great food. In fact, here's my latest recommendation for a good meal here: Figls.http://www.figls.at. I usually dislike travelling because, frankly, I'm not really into all the smalltalk that one is often forced into making with fellow travellers. This trip has not been so bad because my wife has accompanied me and I can just about make small-talk with her! Being ever entrepreneurial I suggested to her that we start a website dedicated to the theme of hooking up like-minded people who happen to have the same travel arrangements so that you end up sitting next to somebody you don't mind having to converse with. However, inevitably the discussion turned to the theme of security and the pitfalls of such a service. How would you prove the identity of your travel buddy? How would you protect your own (i.e. you'd be telling the world that you're going away from home and potentially leaving your house empty)? So, that led me to thinking about the whole online identity issue and in turn that brings me full circle back to the theme of the current RSA Conference where Microsoft's Scott Charney has been talking about "Creating a More Trusted Internet." In the accompanying article, Scott states
      We need to create a system that allows people to pass identity claims (sometimes a full name perhaps, but at other times just an attribute such as proof of age or citizenship). This system must also address the issues of authentication, authorization, access and audit. Finally we need a good alignment of technological, social, political and economic forces so that we make real progress. The goal is to put users in control of their computing environments, increasing security and privacy, and preserving other values that we cherish such as anonymity and freedom of speech.
      The associated white paper elaborates on these themes and it's well worth a read. Download it here . The privacy buffs will no doubt claim that such initiatives will see the end of Internet anonymity. But would that be such a bad thing? Scott Charney, himself, states "The fact that anyone can connect to the Internet without paying for the costs of an identification regime has certainly enhanced its growth." And just look at the storm over Phorm at the mearest suggestion that anonymity might be compromised. But I think it's time for this initiative and I'm not unhappy about Microsoft taking the lead - after all I'm writing this blog on a Microsoft powered PC and I'll bet of the millions of you out there reading this that the majority of you are doing likewise. So, good food for thought...and as it's looks like todays flight is running to schedule, it's time for me to sign off! ]]>       Wed, 09 Apr 2008 11:12:21 +0000 online identity issue identity internet anonymity internet scott scott charney current rsa conference rsa conference pass identity claims End to end trust       <![CDATA[Visualizing a SEO Links Farm]]> http://securityratty.com/article/a2924d82e48f03f749dce53712d798a6 http://securityratty.com/article/a2924d82e48f03f749dce53712d798a6 This visualization was generated over a month ago, using one of the two search engine optimization link farms I blogged about before, as a sample. Perhaps the most important issue to point out is that the farms are automatically generated with the help of blackhat SEO tools, where the level of internal linking has been set a relatively modest one, as for instance, the core pages extensively link one another, but a huge proportion of the SEO content remains burried in a number of hops a crawler may not be interested in making - this could be automatically taken care of in the process of generating the content to end up with a closed circle when visualizing.
      ]]>       Wed, 13 Feb 2008 07:18:26 +0000 seo content remains content blackhat seo tools huge proportion month ago crawler visualization care issue Visualizing a SEO Links Farm