<![CDATA[[SecurityRatty] tag: oct]]> http://securityratty.com/tag/oct Wed, 24 Sep 2008 17:13:28 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Spam is silenced, but where are the feds?]]> http://securityratty.com/article/0ae12b17de41f03b5a8bcd86652d8434 http://securityratty.com/article/0ae12b17de41f03b5a8bcd86652d8434 Add to digg Add to StumbleUpon Add to Twitter Add to Slashdot
]]> Tue, 25 Nov 2008 02:00:00 +0000 federal trade commission zealand police federal bureau investigation oct Spam is silenced, but where are the feds? <![CDATA[Spam is silenced, but where are the feds?]]> http://securityratty.com/article/b8902cdcbd67d18bed8613ec7c80444b http://securityratty.com/article/b8902cdcbd67d18bed8613ec7c80444b

]]> Mon, 24 Nov 2008 21:00:00 +0000 federal trade commission zealand police federal bureau investigation oct Spam is silenced, but where are the feds? <![CDATA[Small attack triggered Microsoft's emergency patch, says researcher]]> http://securityratty.com/article/09e3d1328d4344d9ad694a6557a179db http://securityratty.com/article/09e3d1328d4344d9ad694a6557a179db Add to digg Add to StumbleUpon Add to Twitter Add to Slashdot
]]> Tue, 04 Nov 2008 02:00:00 +0000 emergency patch trojan horse computers prior microsoft security researcher fix windows month release Small attack triggered Microsoft's emergency patch, says researcher <![CDATA[CSI 35th 2008 Discount Passes]]> http://securityratty.com/article/f1ad94b6283c47c53696f0ea9e012fac http://securityratty.com/article/f1ad94b6283c47c53696f0ea9e012fac CSI 35th Annual Conference (on SIEM, believe it or now), I can again give out discount conference passes:

"The passes cover the full conference, Monday–Wednesday, November 17–19, 2008, for a 55% discount! To pass along your discount passes, send your guests to CSI 2008 Registration to register for a CSI 2008 Conference Pass and have them enter the below Priority Code in the box provided: SPK73

*Please note: This offer is only for new registrations, we cannot re-price current registrations."

UPDATE: THE OFFER BELOW HAVE BEEN TAKEN AS OF 5:00PM Oct 30th.

For those rare people who read all the way to here :-), I can also give our 1 (one!) FREE CSI pass; please email me for it as it will be given on "a first come, first served" basis and can only be used by my loyal blog readers :-)

About me: http://www.chuvakin.org
]]> Wed, 29 Oct 2008 11:08:00 +0000 discount passes discount pass conference pass csi free csi pass conference discount conference passes registrations CSI 35th 2008 Discount Passes <![CDATA[A security lesson from the Joe the Plumber snooper]]> http://securityratty.com/article/d007ccda5cc293eb33a027960cfbed41 http://securityratty.com/article/d007ccda5cc293eb33a027960cfbed41 First we had the Gov. Palin Yahoo email break in to teach us the vulnerabilities of weak password reset schemes. Now we have a Joe the Plumber government records snooper teaching us about proper computer account management.

The Columbia Dispatch is reporting that a state employee with access to a “test account” has been accessing Joe the Plumber’s government records:

“We’re trying to pinpoint where it came from,” she said. The investigation could become “criminal in nature,” she said. Brindisi would not identify the account that pulled the information on Oct. 16.

Records show it was a “test account” assigned to the information technology section of the attorney general’s office, said Department of Public Safety spokesman Thomas Hunter.

Brindisi later said investigators have confirmed that Wurzelbacher’s information was not accessed within the attorney general’s office. She declined to provide details. The office’s test accounts are shared with and used by other law enforcement-related agencies, she said.

Security best practices require that test accounts be removed before a system is put into production and loaded with real data. Otherwise there is no accountability to any one individual. Shared accounts such as test accounts are frequently abused so that the snooper can get away undetected. The investigation should look at what other data has been snooped on using this test account. Perhaps this has been going on for a long time and no one noticed.

It is still likely that the perpetrator can be tracked down if he or she accessed the data from an internal system and the records application logged the IP address that connected to it. Even if the IP address doesn’t connect back to an individual’s computer and to a shared machine, the search will have been narrowed down greatly.

]]> Sat, 25 Oct 2008 16:22:44 +0000 offices test accounts accounts test accounts account test account attorney generals office records plumbers government records information A security lesson from the Joe the Plumber snooper <![CDATA[Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more]]> http://securityratty.com/article/5ad9e83dc3458677a18e9f3f40c0fb21 http://securityratty.com/article/5ad9e83dc3458677a18e9f3f40c0fb21

Synopsis:  Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more

Welcome to Blue Box: The VoIP Security Podcast #84, a 30-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

Show Content:

NOTE: Long-time listeners will note that the show notes above are in a less descriptive form than usual. After almost three years of using one wiki for preparing for our shows, Jonathan and I switched to using a new system and are still working out some of the details that will speed the input into show notes.

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Mon, 20 Oct 2008 04:32:28 +0000 skype blue box news tools voipshield comments audio comments podcast skype messages Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more <![CDATA[OWASP AppSec Asia 2008 - Taiwan]]> http://securityratty.com/article/e79fc46b6ee63dd9ff5215cefbd04d13 http://securityratty.com/article/e79fc46b6ee63dd9ff5215cefbd04d13 Here is the latest on OWASP AppSec Asia 2008 - Taiwan.  I will be giving a talk on Oct 27th about Proxy Caches and Web Application Security–using the recent Google Docs 0-day as an example.

Some of the background for this presentation are Proxy Caches are a Challenging Threat to Internet Security and A New Security Breach in Google Docs Revealed.

]]> Tue, 14 Oct 2008 10:48:37 +0000 owasp appsec asia proxy caches google docs taiwan security breach oct 27th internet security web application presentation OWASP AppSec Asia 2008 - Taiwan <![CDATA[Fun Reading on Security - 8]]> http://securityratty.com/article/d60cc90ef226fd7624953a3c03f282d4 http://securityratty.com/article/d60cc90ef226fd7624953a3c03f282d4 Instead of my usual "blogging frenzy" machine gun blast of short posts, I will just combine them into my new blog series "Fun Reading on Security." Here is an issue #7, dated October 2nd, 2008.

  1. Great paper that complements the whole "SIEM is dead?" saga - "Most enterprises are looking for a product that will solve all of their problems in some sort of off-the-shelf miracle, and when they find out that the currently available tools can't do it, they either postpone their deployment or put them on the back burner. "
  2. "The Mess: looking for someone to blame?" is an awesome piece on Internet security and its architecture - and so is Gunnar's follow-up ("If a tree falls in someone else's silo...")
  3. Mike call to "Rise up against Mediocrity."  - "Dilbert makes the risk of the lowest common denominator approach abundantly clear."; in other words, you say 'best practices', I say 'mediocrity!' Mike also remind us, in vain, to do "Security FIRST!" (and compliance second)
  4. A great piece from Burton: "On Response" - I think the world needs another 10-20 million reminders that PREVENTION FAILS. This is definitely a good one for those still in the "we'll just block the threat world" - "we will not win a continuing war of escalation" and "using response can be more cost effective than installing the latest and greatest preventative tool"
  5. More on metrics, including the highly-awaited ISO27004.
  6. Pretty dumb paper by a person confused by why PCI DSS exists (the guy needs to read this). PCI doesn't "fall short," it helps people who will otherwise not do anything and their systems will "power" those botnets of the future...
  7. While we are on this subject: a really good coverage of PCI 1.2. changes, released Oct 1st. More PCI fun here. And more here ("PCI Compliance - dispelling some common myths"). And, more PCI myths. And more good ideas on PCI from Mike R. Sorry, can't stop thinking about PCI :-)  - also this is good.
  8. Adrian on behavioral monitoring; mostly in DAM, but also elsewhere in security.
  9. "Premature Chasm-Crossing"  - a must-read for all security vendors and especially their marketing (and  their easily-excitable PR teams...) - "Shouldn't vendors be spending more time fighting the problems that security managers are facing today, right this minute?" (Mike R also comments on that). A related - and  just as interesting point is made here: "Security is not a solution"
  10. More on compliance and security checklists, good and bad: "I think this is a dangerous trend unless the "checklist" is all inclusive." (how can a checklist include ALL? :-))
  11. "SANS Top 7 New IR/Forensic Trends In 2008"
  12. Read "The three approaches to computer security!"  Why? Come on, it is from Joanna! :-)
  13. A fun discussion about a hot new technology: network IDS. Is IDS absolutely indispensable to ALL companies? No. Can it be incredibly useful? You bet. End of discussion.
  14. On an unrelated note, are lasers the future of warfare? Some say no.
  15. Finally, some security humor from Gartner (!): "Get Rich Quick With Network Security"

Enjoy!

Previous security reading.

About me: http://www.chuvakin.org
]]> Thu, 02 Oct 2008 06:31:00 +0000 security security managers previous security pci pci dss exists computer security pci fun security checklists network security Fun Reading on Security - 8 <![CDATA[Gambling Domains Seized by Kentucky]]> http://securityratty.com/article/b2a12ce3b79bb2383d563ad1918217f7 http://securityratty.com/article/b2a12ce3b79bb2383d563ad1918217f7 click here for a copy of the initial order) was signed by a circuit judge, but later reports indicate that the judge is holding further hearings and seeking further arguments. A hearing will be held Oct. 7, according to TheDomains. See page 4 of the seizure order for a complete list of the 141 domains. Here are some of them:
  • 123bingo.com
  • 777dragon.com
  • indiancasino.com
  • jackpotcity.com
  • powerbet.com
  • crazypoker.com
  • vegaslucky.com
That sort of thing. According to DomainNameNews, several of the domains are for popular sites, including PokerStars.com, FullTiltPoker.com, BodogLife.com, GoldenPalace.com, Bet21.com, DoylesRoom.com and IndianCasino.com. It also reports that at least one registrar (Enom) has transferred domains pursuant to the order, including one whose registrant died of a heart attack this summer. The seizure order says that the domains are to be transferred by any registrar to a plaintiff's account at that registrar (the plaintiff being the Commonwealth of Kentucky), but that the domain names' configuration will be otherwise unchanged. This means that any gambling sites run on those domains or, for that matter, anything else on those domains, such as PPC ads, would remain functional. All things considered, this seems like simple-minded grandstanding without any good law behind it. The Constitution vests Congress with power to regulate interstate commerce, which the domain name market clearly is. In fact, these businesses are truly international. And it's a safe bet that none of the gambling companies or registrars operates in Kentucky, perhaps not even any of the domain name holders. That the state argues that residents of Kentucky engage in illegal gambling doesn't give the state jurisdiction. The Internet Commerce Association, a domainer lobby, has weighed in on the matter in opposition to the state's move.

]]> Sun, 28 Sep 2008 03:32:49 +0000 domains kentucky domains pursuant domain domain names kentucky engage internet commerce association seizure commerce Gambling Domains Seized by Kentucky <![CDATA[Wee-Fi: Wi-Fi Robot Attack; Silicon Valley Plan Proceeds]]> http://securityratty.com/article/a73229a533aa9f53897566105f7e6501 http://securityratty.com/article/a73229a533aa9f53897566105f7e6501 The Spykee is a $300 Wi-Fi Skype robot: Lots of strange coolness here. I don't know how I missed hearing about this before, but apparently an actual customer got his hands on the thing and recorded a video. It's cute. You can access its video through control software or a remote Skype video connection. It's got a speaker and microphone, and can be used for VoIP calls. The control software allows it to move around, play sound effects, and produce music. Like the computer in Superman III (or a Roomba), it craves power, and knows to return to its charger.

spykee_1.jpg

The name reveals some of its creepy appeal: Spykee = Spy Camera. I suppose the nanny you're trying to make sure isn't shaking your baby might be freaked out when it suddenly starts emitting Star Wars music, or such like. Made by Meccano under the Erector brand, its control software is Mac and Windows compatible.

I, for one, welcome our new Spykee overlords--on 15-Oct-2008 when it starts to ship generally.

Silicon Valley project finally gets underway: It's a still a pilot, small, with no promised outcome. And after all this time, a switch of partners, and new parameters, they've still mounted just 20 of 28 access points.

]]> Wed, 24 Sep 2008 17:13:28 +0000 control software spykee spykee overlords suddenly starts wi-fi skype robot silicon valley project star wars music play sound effects starts Wee-Fi: Wi-Fi Robot Attack; Silicon Valley Plan Proceeds