<![CDATA[[SecurityRatty] tag: rss]]> http://securityratty.com/tag/rss Wed, 03 Sep 2008 15:54:03 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[A Fun List of Security Blogs]]> http://securityratty.com/article/0ecc0e3f87fa4703591cc6a022f30a9a http://securityratty.com/article/0ecc0e3f87fa4703591cc6a022f30a9a them? :-)
About me: http://www.chuvakin.org
]]> Wed, 19 Nov 2008 11:38:00 +0000 rss readers org check chuvakin A Fun List of Security Blogs <![CDATA[Summarizing Zero Day's Posts for October]]> http://securityratty.com/article/a5e118769d179df503db1386a2fbc30e http://securityratty.com/article/a5e118769d179df503db1386a2fbc30e
Here's a brief summary of all of my posts at Zero Day for October. You can also go through previous summaries for September, August and July, as well as subscribe to my personal RSS feed or Zero Day's main feed.

Notable articles for October - Scammers introduce ATM skimmers with built-in SMS notification; Inside an affiliate spam program for pharmaceuticals; CardCops: Stolen credit card details getting cheaper.

01. Cybercriminals syndicating Google Trends keywords to serve malware
02. Scammers introduce ATM skimmers with built-in SMS notification
03. Atrivo/Intercage's disconnection briefly disrupts spam levels
04. Adobe posts workaround for clickjacking flaw, NoScript releases ClearClick
05. Asus ships Eee Box PCs with malware
06. Fake Microsoft Patch Tuesday malware campaign spreading
07. Secunia: popular security suites failing to block exploits
08. Survey: 88% of Mumbai's wireless networks easy to compromise
09. Adobe's Serious Magic site SQL Injected by Asprox botnet
10. Inside an affiliate spam program for pharmaceuticals
11. Google to introduce warnings for potentially hackable sites
12. Lack of phishing attacks data sharing puts $300M at stake annually
13. CardCops: Stolen credit card details getting cheaper
14. Cybercrime friendly EstDomains loses ICANN registrar accreditation
15. Phishers apply quality assurance, start validating credit card numbers
16. Spammers targeting Bebo, generate thousands of bogus accounts
]]> Tue, 04 Nov 2008 05:28:07 +0000 posts credit card details credit card built-in sms notification adobe posts workaround adobe google google trends keywords day Summarizing Zero Day's Posts for October <![CDATA[Blue Box #85: Internet phone calls and terrorism, Georgia Tech report on Emerging Cyber Security Threats, phone jamming, 802.1X-REV, 802.1AE, VoIP sec]]> http://securityratty.com/article/cb989104e329dbb2131be2e5f8569ab2 http://securityratty.com/article/cb989104e329dbb2131be2e5f8569ab2 Synopsis: Blue Box #85: Internet phone calls and terrorism, Georgia Tech report on Emerging Cyber Security Threats, phone jamming, 802.1X-REV, 802.1AE, VoIP security news and more

Welcome to Blue Box: The VoIP Security Podcast #85, a 32-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 15 MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

Show Content:

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Thu, 23 Oct 2008 10:42:12 +0000 voip voip security news internet phone calls phone voip calls blue box voip security podcast podcast georgia tech report Blue Box #85: Internet phone calls and terrorism, Georgia Tech report on Emerging Cyber Security Threats, phone jamming, 802.1X-REV, 802.1AE, VoIP sec <![CDATA[Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more]]> http://securityratty.com/article/5ad9e83dc3458677a18e9f3f40c0fb21 http://securityratty.com/article/5ad9e83dc3458677a18e9f3f40c0fb21

Synopsis:  Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more

Welcome to Blue Box: The VoIP Security Podcast #84, a 30-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

Show Content:

NOTE: Long-time listeners will note that the show notes above are in a less descriptive form than usual. After almost three years of using one wiki for preparing for our shows, Jonathan and I switched to using a new system and are still working out some of the details that will speed the input into show notes.

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Mon, 20 Oct 2008 04:32:28 +0000 skype blue box news tools voipshield comments audio comments podcast skype messages Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more <![CDATA[Blue Box #83: SIP and Asterisk vulnerabilities, voice biometrics, P2PSIP, Aircell blocking Skype, VoIP security news and more]]> http://securityratty.com/article/3a845f6538a2b485677d7771f5d125ce http://securityratty.com/article/3a845f6538a2b485677d7771f5d125ce

Synopsis:  Blue Box #83: SIP and Asterisk vulnerabilities, voice biometrics, P2PSIP, Aircell blocking Skype, VoIP security news and more…

Welcome to Blue Box: The VoIP Security Podcast #83, a 39-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 18MB) or subscribe to the RSS feed to download the show automatically. 

NOTE: This show was recorded on September 4, 2008.

You may also listen to this podcast right now:

Show Content:

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Thu, 16 Oct 2008 06:48:11 +0000 voip voip security news voip companies voice biometrics voice blue box p2psip voip security podcast comments Blue Box #83: SIP and Asterisk vulnerabilities, voice biometrics, P2PSIP, Aircell blocking Skype, VoIP security news and more <![CDATA[Summarizing Zero Day's Posts for September]]> http://securityratty.com/article/0862d75223b7c454c16ff0e7eaa11124 http://securityratty.com/article/0862d75223b7c454c16ff0e7eaa11124
As usual, here's September's summary of all of my posts at Zero Day. You may also want to catch up and go through August's and July's summaries, next to adding my personal RSS feed or Zero Day's main feed to your RSS reader.

Notable article for September - Spamming vendor launches managed spamming service.

01. DoS vulnerability hits Google's Chrome, crashes with all tabs
02. Malware and spam attacks exploiting Picasa and ImageShack
03. Spamming vendor launches managed spamming service
04. Facebook introducing new security warning feature
05. Google downplays Chrome's carpet-bombing flaw
06. Targeted malware attack against U.S schools intercepted
07. The most "dangerous" celebrities to search for in 2008
08. Norwegian BitTorrent tracker under DDoS attack
09. Attacker: Hacking Sarah Palin's email was easy
10. Bill O'Reilly's web site hacked, attackers release personal details of users
11. India's government: At last, we've cracked Blackberry's encryption
12. Memory exhaustion DoS vulnerability hits Google's Chrome
13. 44% of second hand mobile devices still contain sensitive data
14. Spammers attacking Microsoft's CAPTCHA -- again
]]> Tue, 07 Oct 2008 06:54:00 +0000 google downplays chrome chrome vendor launches day september norwegian bittorrent tracker malware hand mobile devices malware attack Summarizing Zero Day's Posts for September <![CDATA[Around The Web For Friday]]> http://securityratty.com/article/854f3c7cd7fbfd4b803df29d7a415b9d http://securityratty.com/article/854f3c7cd7fbfd4b803df29d7a415b9d We’re frequently asked what we’re reading and what we like in blog posts, so here are some interesting things that hit our RSS readers that you may have missed:

COBIT rivals ITIL from The IT Skeptic

“Everyone is tiptoeing around the fact that COBIT offers a significant competitive body of knowledge (BOK) to ITIL. Sure ITIL goes into more depth in places, but to say COBIT sits over the top is to grossly understate the overlap. COBIT extends a long way down into the “how” and it does it with an intellectual rigour that ITIL lacks.”

Interesting stuff that.  A detailed mapping might help some folks.  Either way, the good news for those keen on understanding risk management is that governance metrics, done right, allow us to understand a part of that “capability to manage risk” we’re always looking for.   Assurance, verification and the acquisition and interpretation of knowledge is king.   Speaking of which….

How To Tell When “Nothing Happens” by Pete Lindstrom

“…problem is that, it isn’t really true that “nothing happens” when you employ some specific security control to prevent an exploit. Not only that, but even when it is difficult to collect data on what didn’t happen, one can devise experiments to tell how frequently that nothing occurred.”

Good analysis is all about the uncertainty.   Speaking of accounting for uncertainty…

Assets Good Until Reached For by Gunnar Peterson

“If you have a 100,000 dekstops or 100,000 servers it hard to manage. You will need to automate and to do that you need to abstract, but you should also realize that its a drawing on a whiteboard not reality. You need abstraction assurance.”

And there’s the trick.  We might call “abstraction assurance” an analog to “confidence” or “uncertainty” in certain priors (metrics) or posteriors (calculated values based on those metrics).  The stronger that abstraction assurance is, the less uncertainty we have in our knowledge and the better our ability to create wisdom from that knowledge (you know, make decisions).

Epstein, Snow and Flake: Three Views of Software Security by Adam Shostack

Adam’s focus is on software security, but the discussion here can be abstracted out into the broader realm of risk management quite nicely.

Two-thirds of firms hit by cybercrime from Security Focus

The US DoJ says that in 2005 (there’s some timely data) 2/3 of their surveyed firms detected at least one cybercrime.  “Cybercrime” is “classified … into cyber attacks, cyber theft, and other incidents.”  Pretty general.  Also from the report:  “Computer viruses made up more than half of all cyber attacks.”

(That sound you hear is me tapping my forehead lightly on large iron object)

Lessons Learned from “Personal” Risk Management By: Christopher Daugherty

“This process is what I call “personal risk management.”  All of us have done it and will continue to do so.  Why is it, then, many companies have ignored following similar principles with the on-going health of the business?  This is a debate with many different answers so I ask you to select the best answer for your employer:

a) Have not ignored as this keeps me awake at night!

b) Please restate the problem, I cannot hear well with my head buried in the sand.

c) We passed our SOX audit so we checked this off the list!

d) We are informed of the challenge but we have a business to run and profits to make

e) Is this what internal audit and risk management has been telling us?”

]]> Fri, 26 Sep 2008 08:56:15 +0000 call abstraction assurance abstraction assurance personal risk management risk management assurance itil itil lacks cobit rivals itil software security Around The Web For Friday <![CDATA[Web 2.0 Attacks Revealed]]> http://securityratty.com/article/399f63346ff3bf5fef48d6879df090c4 http://securityratty.com/article/399f63346ff3bf5fef48d6879df090c4 Sun, 14 Sep 2008 20:00:00 +0000 web paper paper details asynchronous java script technologies atom feeds security concerns mashups ajax Web 2.0 Attacks Revealed <![CDATA[Links List 9.12.08]]> http://securityratty.com/article/b6c1e13955ab002ad9018715db59c1d8 http://securityratty.com/article/b6c1e13955ab002ad9018715db59c1d8 image HP forgot to “knock on wood”. The London Stock Exchange, touted in an HP case study as an example of having “produced unprecedented levels of performance and reliability” crashed on Monday. Seems that the LSE’s new trading system, TradElect, could not handle the volume of trades triggered by the Fannie Mae and Freddie Mac news. I’m sure there will be enough blame to go around – from the contractor to the contractor’s choice of Microsoft SQL Server and .NET.

Following in the footsteps of social networking projects like Intellipedia, A-Space, an online collaboration environment for intelligence analysts, will go live on September 22. A-Space allows analysts to share information, form communities, and work together all under one environment. The analysts from sixteen intelligence agencies will have access to shared and personal workspaces, wikis, blogs, widgets, RSS feeds and other tools, as well as be able to search for content on other agencies’ data sources and even on data that allied countries might share.

Karen Sage, Cisco’s director of product management for network management, said that it’s “actually a good thing when network management is struggling, because is say that innovation is really happening at a fast rate”.

Joe Weinman, Strategic Solutions Sales VP for AT&T Global Business Services, created The 10 Laws of Cloudonomics. Weinman expands upon his laws by comparing public utility cloud services, traditional data center environments and private enterprise clouds.

I’m not making this up. HP has a new reality show coming out. “Engine Room” will be broadcast on MTV and on the Web and will feature teams of designers from around the world who understake a series of challenges with the help of HP computers. Can’t hardly wait.

]]> Fri, 12 Sep 2008 17:43:51 +0000 online collaboration environment agencies data sources intelligence analysts analysts data network management environment strategic solutions sales freddie mac news Links List 9.12.08 <![CDATA[Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk]]> http://securityratty.com/article/ceff3c168541790ec71113285297b6e6 http://securityratty.com/article/ceff3c168541790ec71113285297b6e6

Synopsis:  Blue Box Special Edition #26: Astricon 2007 presentation - "Hacking and Attacking VoIP Systems: What you need to worry about"

Welcome to Blue Box: The VoIP Security Podcast Special Edition #26, a 55-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 6MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

Show Content:

A year ago in September 2007, I (Dan York) spoke at Astricon 2007 in Arizona, USA, about "Hacking and Attacking VoIP Systems: What You Need To Worry About" My presentation covered a lot of the typical VoIP security threats, tools and best practices but also expanded a bit into specific security issues with Asterisk.  Please do keep in mind that it has been a year since this presentation and so some of the issues I mention have been addressed. (Astricon, for those who don't know, is an annual developer conference for those who work with the Asterisk open source telephony platform. Astricon 2008 is, in fact, coming up in about 3 weeks but I will not be attending this year.)

The slides for this talk are available from Slideshare:

Hacking and Attacking VoIP Systems - What You Need To Know
View SlideShare presentation or Upload your own. (tags: voip voipsecurity)

(And yes, at some point I'll sync the audio with the slides.)

Production assistance on this Special Edition was provided by Michael Graves who had a very tough task given the poor quality of the recording that I gave to him!  Kudos to Michael for getting it to sound as good as it does.

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Wed, 03 Sep 2008 15:54:03 +0000 presentation astricon view slideshare presentation slideshare voip systems audio comments audio specific security issues listener comment line Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk