Get FireFox for Secure Browsing
|
Thursday, May 1
Plasma TV components applied to password cracking
by
Xavier Ashe
on Thu 01 May 2008 08:44 AM EDT
Forget networked PCs or even PlayStation 3s, components commonly
found in plasma TVs are the latest thing in password cracking tools.
High performance FPGA (Field Programmable Gate Array) chips are the
Chuck Norris of number crunching, equally suited to image processing
and (with a bit of modification) password cracking.
During the Black Hat conference in Washington in February researcher
Dan Mueller used FPGA kit in an attack that cracks standard GSM
transmissions, encrypted using the A5/1 algorithm, in as little as 30
seconds.
The same technology can be applied to crack Bluetooth transmissions
in as little as eight seconds, according to security consultancy
SecureTest, which ran a demo of the technology at the recent Infosec
conference. Read the full article on The Register.
Tuesday, March 25
HP Cuts Investment in their Security Portfolio
by
Xavier Ashe
on Tue 25 Mar 2008 05:30 PM EDT
Burton Group has specifically commented on HP’s struggle to succeed
in this competitive market. Burton Group’s Identity and Privacy
Strategies Report, “The Identity Management Market 2007: An Expanding Universe”, Our Catalyst 2007 Keynote “Identity Management Market Landscape 2007: Enabling Security and Control Objectives in the Enterprise”, and our “Vantage Point 2007: Trends in Identity Management” telebriefing, all noted that HP’s ability to compete, mindshare, and market momentum has been in sharp decline.
Burton Group has been contacted by HP customers who report that HP
is no longer going to seek new customers for its Identity Center
product. We have contacted HP and the company confirms that HP
Software has decided to focus its investment in identity management
products exclusively on existing customers and not on pursuing
additional customers or market share. HP is in the process of reaching
out to each customer regarding the change. Last week Burton Group spoke
to HP Software Vice President of Products Eric Vishria regarding this
development.
Vishria explained that the Identity Center product line was not
performing in this highly competitive market at a level that’s
acceptable to HP, but added that the product supports the operations of
a number of HP’s critical customers. HP has therefore made the
decision to focus research and development efforts on existing
customers only. This was posted on the Burton's Group Identity Blog. Interesting stuff, read more: Customers of other IdM vendors and customers considering new IdM
deployments should also be carefully scrutinizing this announcement. As
the market becomes increasingly competitive it is imperative that
customers evaluate the viability and long-term strategy of their
existing and potential IdM vendors. Burton Group predicts that the
market will see continued, or even increased, consolidation in coming
months.
Sunday, March 9
Cult of the Dead Cow Releases Goolag
by
Xavier Ashe
on Sun 09 Mar 2008 10:56 AM EDT
Cult of the Dead Cow, or
cDc, an old-school hacking crew famous for its anti-censorship stance,
has shipped a new tool that turns the Google search engine into an
easy-to-use vulnerability scanner.
Taking its cue from Johnny Long's Google Dorks—search queries that reveal sensitive information—cDc's new Goolag Scan pushes the envelope even more, offering a stand-alone Windows GUI-based application to power the searchers.
The open-source program comes with about 1,500 custom Google search
queries embedded by default to run searches for vulnerable Web
applications, misconfigured Web servers with open backdoors, sensitive
user names and passwords, and other documents accidentally exposed on
the Internet.
"It's no big secret that the Web is the platform," said Oxblood Ruffin,
a spokesperson for the hacker think tank. "This platform pretty much
sucks from a security perspective. Goolag Scanner provides one more
tool for Web site owners to patch up their online properties.
"We've seen some pretty scary holes through random tests with the
scanner in North America, Europe and the Middle East. If I were a
government, a large corporation, or anyone with a large Web site, I'd
be downloading this beast and aiming it at my site yesterday. The
vulnerabilities are that serious," Ruffin said.
The utility ships as a .Net program that can be manually configured to
power Google queries for specific servers or for an entire set of
domains.
For example, a business can ask Goolag Scan to search for vulnerable
servers or "files containing juicy information" on all its Web sites,
turning the scanner into a useful auditing tool.
News report from eWeek. Try Goolag now.
Bejtlich points out Gartner Wisdom
by
Xavier Ashe
on Sun 09 Mar 2008 10:28 AM EDT
 2003: "IDSs [intrusion detection systems] have failed to provide value relative to its costs and will be obsolete by 2005." (Gartner, "Gartner Information Security Hype Cycle Declares Intrusion Detection Systems a Market Failure")  2008: "Our adversaries are very adept at hiding attacks in normal traffic. The only true way to protect our networks is to have an intrusion detection system." (Robert Jamison, Under Secretary of the National Protection and Programs Directorate at DHS) .
Tuesday, March 4
Funny "Hacking" Story
by
Xavier Ashe
on Tue 04 Mar 2008 04:54 PM EST
After a bit more back-and-forth about how he could "just answer any questions I had right now", the sales rep pointed me to their sample ads, a 7mb PDF with sixteen pages of seemingly real companies, all with the same phone number (555-555-5555) and the same website (00000000000.com). Somehow, that didn't convince me to "invest" several hundred dollars, so the salesman faxed over some more inforation with a single, real ad.
As I eagerly waited for the follow-up call later that day, I thought I'd take a minute or two to check out their website. Almost immediately, I came across their Federal Procurement Officers Only page. Out of curiousity, I entered a username and password, and then clicked the Login button. Instantly, a JavaScript dialog popped-up...
Since there's really only one thing that could cause such a dialog to pop-up so fast, I checked the source code...
Entertaining story posted on The Daily WTF.
Monday, March 3
It's official: Pirates crack Vista at last
by
Xavier Ashe
on Mon 03 Mar 2008 02:21 PM EST
A genuine crack for Windows Vista has just been released by pirate
group Pantheon, which allows a pirated, non-activated installation of
Vista (Home Basic/Premium and Ultimate) to be properly activated and
made fully-operational.
Unlike cracks which have been floating around since Vista RTM was
released in late November, this crack doesn’t simply get around product
activation with beta activation files or timestop cracks - it actually
makes use of the activation process. It seems that Microsoft has
allowed large OEMs like ASUS to ship their products with a
pre-installed version of Vista that doesn’t require product activation
– apparently because end users would find it too inconvenient. Read More on APC.
Tuesday, February 26
Best practices for IT security management
by
Xavier Ashe
on Tue 26 Feb 2008 12:11 PM EST
The nuts and bolts of an information risk management (IRM)
framework are best put in place long before you install the technology.
But it's never too late to mitigate business risk by working out the
mechanics of functions, requirements and controls. Discover and report
on the right priorities, and you can construct a framework for making
well-informed decisions.
Read Five steps to building information risk management frameworks and Developing Controls for People, Processes and Technology by Forrester analyst Khalid Kark who details how to build a sound IRM solution in your organization, including:
 |
 |
|
Defining domains for your IRM framework |
|
|
Three questions to ask when assessing the criticality of IRM requirements |
|
|
Overcoming two significant challenges in defining security metrics programs |
|
|
Converging physical and logical security through process collaboration |
Kark is a principal analyst at Forrester Research. His research focuses
on information risk management strategy, governance, best practices,
measurement and reporting.
This expert advice is part of a continuing series on
IBM best practices for IT security management. IBM security services
and solutions such as Tivoli®, Internet Security Systems™, and
Rational® enable customers to better manage their infrastructure,
operations and IT processes.
Tuesday, February 19
PCI compliance drives identity management spending, says IBM's GRC chief
by
Xavier Ashe
on Tue 19 Feb 2008 03:58 PM EST
Great interview with Kristin Lovejoy, the director of IBM Governance and Risk Management Strategy over at Information Security Magazine. When Consul was acquired, how difficult was the technology integration?Kristin
Lovejoy: There was a good bit of integration work that had to occur.
Most of it was around assuring that the product offering met the
scalability requirements that had to be defined by IBM. IBM's
acquisition of the technology undergoes a blue-washing process. The
blue washing process assures that the technology sold to IBM customers
are not packaged with any kind of code that is not documented—no open
source components. Also the database infrastructure had to be reworked
and released for DB2. You've been viewed as a leader in driving the implementation of
auditing as a required step in identity and access management. Talk
about the importance of auditing.Lovejoy: Of course it was
Sarbanes Oxley where the concept was initiated. Section 404 required
organizations to not only look at their business controls but also
their IT controls. It points to a requirement that organizations adopt
a control framework within the finance, accounting organization, making
sure there's no conflict of interest. Sarbanes Oxley made people say
trust is ok but now I have to verify. We saw a lot of companies want to
be able to monitor privileged users such as database administrators and
developers. They wanted to ensure that those that were working in the
preproduction environment were only working in the preproduction
environment.
In addition to Sarbanes Oxley, there have been over time lots
of requirements like PCI DSS and HIPPA that requires you to do audit
logging. These requirements, which always said you need to maintain the
logs, are now beginning to indicate that it's not simply collecting
logs, but you also have to be able to review the activity in logs and
identify areas potentially anomalous activity. Read More.
New IBM Redbook - Deployment Guide Series: IBM Tivoli Compliance Insight Manager
by
Xavier Ashe
on Tue 19 Feb 2008 11:03 AM EST
In order to comply with government and industry regulations, such as Sarbanes-Oxley, Gramm-Leach-Bliley, and COBIT, enterprises have to constantly detect, validate, and report unauthorized change and out-of-compliance actions on their IT infrastructure. The Tivoli Compliance Insight Manager v8.0 solution allows organizations to improve the security of their information systems by capturing comprehensive log data, correlating this data through sophisticated log interpretation and normalization, and communicating results through a dashboard and a full set of audit and compliance reporting. We discuss the business context of security audit and compliance software for organizations, and we show a typical deployment within a business scenario. This is the second IBM Redbook covering IBM Tivoli Compliance Insight Manager - the first book being the Compliance Management Design Guide with IBM Tivoli Compliance Insight Manager, SG24-7530. This IBM Redbooks publication is a valuable resource for security officers, administrators, and architects who wish to understand and deploy a centralized security audit and compliance solution. Download the Deployment Guide Series: IBM Tivoli Compliance Insight ManagerPublish Date: February 15, 2008 ISBN Number: 0738485705
Monday, February 11
Security in Dilbert
by
Xavier Ashe
on Mon 11 Feb 2008 01:22 PM EST
Tuesday, February 5
TSOM and TCIM Integration! (TSIEM)
by
Xavier Ashe
on Tue 05 Feb 2008 12:01 PM EST
Chief Security Officers (CSOs) and Chief Information Security Officers (CISOs) today are focused on prioritizing security initiatives to support their business goals, and on managing technical risk and governance. Their organizations are challenged to both minimize security-based business disruptions and ensure and demonstrate compliance with privacy regulatory requirements, with a limited set of resources. Security information and event management (SIEM) technology can provide a solution to these challenges, and provide greater leverage of people and greater visibility of their existing security infrastructure. IBM offers two SIEM complementary capabilities for the security information and events: - A real-time, network event-oriented management dashboard that facilitates attack recognition and incident management
- An information analysis dashboard to assess how well an organization adheres to its security and governance policies
IBM Tivoli Security Information and Event Manager V1.0 (TSIEM) is comprised of two products: IBM Tivoli Security Operations Manager V4.1 (TSOM) and IBM Tivoli Compliance Insight Manager V8.5 (TCIM). These products, working together, help you realize the full promise of enterprise SIEM. By centralizing log collection and event correlation across your enterprise, you can leverage an advanced compliance dashboard to link security events and user behavior to your corporate policies. Tivoli Security Information and Event Manager delivers a comprehensive foundation to help address your SIEM requirements. As a result, IT organizations can reduce their exposure to security breaches; collect, analyze, and report on compliance events; and manage the complexity of heterogeneous technologies and infrastructures. TSIEM provides support for numerous applications, operating systems, security products, and network infrastructures, as well as desktop and mainframe systems. Using TCIM and TSOM together provides the benefits of both products, through their complementary user-centric and network-centric perspectives. Integration between TSOM and TCIM can provide additional unique capabilities: - Identify important audit and administrative events from the network/security infrastructure for privileged user monitoring and compliance reporting. This leverages the broad network and security product support of TSOM and its correlation capabilities to provide added value auditable events for use in the TCIM privileged user monitoring and audit and compliance reports.
- Identify network-centric policy violations with TSOM, and forward these high level correlated events to TCIM for consolidated compliance dashboard and reporting and views.
The integration described in this document provides the foundation to accomplish these two general use cases. It describes the specific of configuring TSOM to send events to TCIM. Dowload the Tivoli Security Information and Event Manager: Tivoli Security Operations Manager and Tivoli Compliance Insight Manager Integration Guide
Saturday, February 2
Pass-The-Hash Toolkit
by
Xavier Ashe
on Sat 02 Feb 2008 10:03 AM EST
|
|
