Get FireFox for Secure Browsing
|
Sunday, February 26
SIMCon retrieves deleted SMS messages
by
Xavier Ashe
on Sun 26 Feb 2006 07:58 PM EST
SIMCon is a program that allows the user to
securely image all files on a GSM SIM card to a computer file with a
standard smart card reader. The user can subsequently analyze the
contents of the card including stored numbers and text messages.
Some of SIMCon's features:
- Read all available files on a SIM card and store in an archive file
- Analyze and interpret content of files including text messages and stored numbers
- Recover deleted text messages stored on the card but not readable on phones
- Manage PIN and PUK codes
- Print report that can be used as evidence based on user selection of items
- Secure file archive using hashing
- Export items to files that can be imported in popular spreadsheet programs
- Supports international charsets
SIMCon is made for use within law enforcement and is the investigating
officer's number one choice for securing evidence on SIM cards and
present them in court. SIMCon can however be a valuable tool for others
who need to secure evidence from SIM cards, and recover items such as
deleted text messages. SIMCon is available for Microsoft Windows only.
Friday, February 24
Inside Security Rescue Toolkit
by
Xavier Ashe
on Fri 24 Feb 2006 09:55 AM EST
INSERT (the Inside Security Rescue Toolkit) aims to be a multi-functional, multi-purpose disaster recovery and network analysis system. It boots from a credit card-sized CD-ROM and is basically a stripped-down version of Knoppix. It features good hardware detection, fluxbox, emelfm, links-hacked, ssh, tcpdump, nmap, chntpwd, and much more. It provides full read-write support for NTFS partitions (using captive), and the ClamAV virus scanner (including a fairly recent signature database and a GUI). It also has a network boot facility. - full read-write support for NTFS-partitions using captive and linux-ntfs
- support for various file system types:
- locally: EXT2, EXT3, EISERFS, REISER4, JFS, XFS, NTFS, FAT, MSDOS, MINIX, UDF, HFS, HFS+, HPFS, UFS, UNIONFS
- net based: NFS, SMBFS, CIFS, NCPFS, SSHFS, AFS
- support for linux software RAID and LVM2
- support for WLAN adapters
- network analysis (e.g. nmap, tcpdump)
- disaster recovery (e.g. gparted, gpart, partimage, testdisk, recover)
- virus scanning (Clam Antivirus with GUI avscan)
- computer forensics (e.g. chkrootkit, foremost, rootkit hunter)
- surf the internet (e.g. the web browser dillo [enhanced version], the graphical FTP client gFTP)
- network boot server to boot network boot enabled clients that cannot boot from the CD (insert-remote)
- installation on a USB memory stick (usb-install)
based on Linux kernel 2.6.12.5 and Knoppix 4.0.2
.
Interview: John the Ripper 1.7, by Solar Designer
by
Xavier Ashe
on Fri 24 Feb 2006 09:21 AM EST
Should we use password generators? ...Now, this may sound like there's almost no way for an average person to
pick secure passwords and for a system administrator to enforce the use
of strong passwords (or passphrases). Luckily, there's a tool I wrote
to help the situation. It's
pam_passwdqc, a password
strength checking module for the PAM (Pluggable Authentication Modules) framework.
pam_passwdqc works on Linux, FreeBSD 5+ (in fact, it's been integrated
into FreeBSD), Solaris, HP-UX 11+, and reportedly on recent versions of
IRIX. Additionally, Damien Miller has developed a
plugin password
strength checker for OpenBSD's /usr/bin/passwd that uses the password
complexity checking code from pam_passwdqc.
What new features does the latest version 1.7 of
John the Ripper include?
Solar Designer:
The new "features" this time are primarily performance improvements
possible due to the use of better algorithms (bringing more inherent
parallelism of trying multiple candidate passwords down to processor
instruction level), better optimized code, and new hardware capabilities
(such as AltiVec available on PowerPC G4 and G5 processors).
Read the full interview on SecurityFocus.
Thursday, February 23
Official CISSP Study Guide riddled with plagiarism
by
Xavier Ashe
on Thu 23 Feb 2006 11:44 AM EST
The official study guide for the CISSP Exam, created by (ISC)² appears to plagiarise several other works.
The plagiarism was first noted by Dr Michael Workman, from the College of Information at Florida State University.
In page 406 from the guide it states, "One of the main problems with
simple substitution ciphers is that they are so vulnerable to frequency
analysis..." It now appears this material was taken directly from the
paper, "The Vigenere Cipher".
DNS as an IDS sensor
by
Xavier Ashe
on Thu 23 Feb 2006 11:34 AM EST
SURFnet is looking for technologies to expand the ways they can detect network traffic anomalies like botnets. Since bots started using domain names for connection with their controller, tracking and removing them has become a hard task. This research is a first glance at the usability of DNS traffic and logs for detection of this malicious network activity. Detection of bots is possible by DNS information gathered from the network by placing counters and triggers on specific events in the data analysis. In combination with NetFlow information and IP addresses of known infected systems, detection of bots of network anomalies can be made visible. Also the behavior of a bot can be documented and additional information can be gathering about the bot. Using DNS data as a supplement to the existing detection systems can give more insight in< the suspicious network traffic. With some future research, this information can be used to compile a case against particular types of bot or spyware and help dismantling a remote controlled infrastructure as a whole.
Read the full paper (PDF)by Antoine Schonewille and Dirk-Jan van Helmond from the University of Amsterdam. This is the second research paper I have seen in the last month dealing with DNS's role is detecting malware. This is the kind of reasearch that helps products like NeuSecure become more accurate.
InqTana Bluetooth Worm
by
Xavier Ashe
on Thu 23 Feb 2006 11:20 AM EST
Trifinite.group member Kevin has published a paper
detailing the techniques he used in the development of the InqTana
Bluetooth worm that targets vulnerable Mac OS X systems. There has been
significant confusion surrounding this worm, so here are some salient
points:
- The concurrent release of the OS X Leap.A and InqTana.A worms is coincidental
- There is no conspiracy, AV vendors and Apple were notified about
Kevin's progress in developing this worm in advance of making details
publicly available
- Both 10.3 and 10.4 systems are vulnerable until patched with APPLE-SA-2005-05-03 and APPLE-SA-2005-06-08
- InqTana prompts before infecting *by design*, Kevin was just trying to be nice, but the worm could easily spread silently
Kevin's paper is available at http://www.digitalmunition.com/InqTanaThroughTheEyes.txt. Comments can be directed to the BlueTraq
mailing list. Our sympathies to those organizations who were affected
by the false-positive signatures published by overzealous AV companies. From the trifinite.blog.
Wednesday, February 22
Wireless Patent Fight
by
Xavier Ashe
on Wed 22 Feb 2006 04:29 PM EST
AirDefense, the innovator that launched the wireless LAN security
market, today announced it has invoked an interference action against a
patent application accelerated by AirTight Networks related to
“Monitoring a selected region of an air space associated with local
area networks of computing devices” (U.S. patent No. 7,002,943).
AirDefense has several pending patent applications which claim the same
subject matter in the area of wireless intrusion protection. The
AirDefense patents were filed in June 2002, predating the AirTight
patent application which was filed in October 2004.
This AirDefense press release, that was released today, comes one day after AirTight announced winning the patent: AirTight Networks™, the leading provider of wireless
perimeter security solutions, today announced that the
U.S. PTO (Patent and Trademarks Office) has issued U.S.
patent No. 7,002,943 to AirTight Networks for a “METHOD
AND SYSTEM FOR MONITORING A SELECTED REGION OF AN AIRSPACE
ASSOCIATED WITH LOCAL AREA NETWORKS OF COMPUTING DEVICES”.
This patent granted by the US PTO covers technologies that
are key elements of wireless intrusion detection or
prevention.
This should be interesting. I evaluated the technologies about a year ago and found AirTight to be a good step ahead of AirDefense as it came to technology and ease of use. I was Director of Security Solutions at Microtek Systems, Inc at the time and we decided to partner with AirTight. I was very happy with both the product and the company as a VAR. I will rattle the cage over at AirTight and see if I can get an inside scoop. From the looks of it, AirTight has won and AirDefense is crying foul. I'll keep you posted.
Sunday, February 12
ISC2 Reception on February 15th at RSA conference
by
Xavier Ashe
on Sun 12 Feb 2006 07:03 PM EST
(ISC)2 Reception, February 15thRSA goers, don’t forget to
join (ISC) 2 for a reception during the RSA Conference 2006 at the McEnry
Convention Center in San Jose, California at the Hilton Almaden Ballroom
(attached to the McEnry Convention Center) from 6:30 p.m – 8:00 p.m. Come along and: - Listen to Dr. Ken Knapp cover highlights from the 2005
Auburn Study
- Pick up a copy of the 2006 Resource Guide, Global Edition
- Share feedback with (ISC)2 staff and board members
- Network with fellow
members
- Win prizes
To attend, please register with Lorraine Roscoe at receptions@isc2.org. (ISC)2 Panel Discussion, February 16thJoin us as
top security experts discuss ‘CISOs – the next generation’ at (ISC) 2's panel on
Thursday, February 16, at 2p.m. in the Marriott – San Jose II at the McEnry
Convention Center. Distinguished panelists will include:
- Jane Scott Norris, MS, CISSP, CAP,
CISM, CISO, U.S. Department of State
- James R. Wade, CISSP-ISSAP, ISSMP,
CHSIII, Executive Director and COO, International Information Integrity
Institute (I-4)
- Thomas E. Marshall, PhD, Associate Professor of MIS, Auburn
University
- Betty Pierce, GSLC, ISSA International Ethics Committee
Chair
The panel will review the qualifications and experience
necessary to become a CISO and offer their views on where they believe the next
generation of CISOs will come from.
And don’t forget to stop by the (ISC) 2 booth (#2009) for information and your
chance to win exciting prizes. We look forward to seeing you!
Sarah Bohne, Director of Communications & Member Services From CCCure.org.
Thursday, February 9
Attack code published for Firefox flaw
by
Xavier Ashe
on Thu 09 Feb 2006 09:39 PM EST
A hacker Tuesday published code that exploits a vulnerability found in the latest version of the Mozilla's Firefox browser. The code, which targets the Firefox 1.5 browser, was posted Tuesday on The Metasploit Project site by a hacker known as H D Moore. Metasploit is a widely used hacking tool.
Moore said that a hacker by the name of Georgi Guninski reported the flaw to the Mozilla Foundation on Dec. 6 of last year,
and that he had simply implemented and posted the technique described by Guninski.
Mozilla published an advisory
about the exploit last Wednesday as it released the Firefox 1.5.0.1
browser, which included a patch for the flaw. According to the
advisory, the vulnerability, which had been rated as moderate, causes a
corruption in the browser's memory that could be exploitable to run
arbitrary code. Specifically, calling the "QueryInterface" method of
the built-in Location and Navigator objects of the browser could allow
a hacker to take over a Firefox 1.5 user's system by tricking the user
into viewing a maliciously encoded Web page. From Network World.
Tuesday, February 7
Treo650 Bluetooth Dial Up Networking Hack
by
Xavier Ashe
on Tue 07 Feb 2006 03:22 PM EST
When PalmOne released the Treo 650 smartphone for Sprint PCS and Cingular, they had to obey the carries requests to disable the DUN (Dial Up Networking) profile for bluetooth. Why they did this is a matter of debate, but regardless the functionality was already there. They just disabled it. Thus I set out of figure out how they disabled it and how to fix it.
Once digging threw the files in the 650's ROM I quickly found the "btmanager" overlays which showed the DUN option proving that it was built in. I then referenced the control to the "btmanager.prc" code and found where it was called. While tracing threw I found a subroutine that did nothing other than "hide" the control. So I just eliminated the two calls to this routine by "NOPing" them.
Read the full article on I-Hacked.com.
Monday, February 6
NSA's "Super Secret" toolset
by
Xavier Ashe
on Mon 06 Feb 2006 09:05 AM CST
I posted a new photo to RandomPics.
Botnet Detection and Reponse
by
Xavier Ashe
on Mon 06 Feb 2006 09:32 AM EST
I have come across an interesting slide deck from David Dagon at Georgia Tech (Go Jackets!) titled Botnet Detection and Response. He analyzes the DNS queries a bot makes compared to a normal user. Very interesting stuff, considering this is the kind of stuff I do every day. It's great to have security researchers out there that find these interesting correlations.
Dutch RFID e-passport cracked -- US next?
by
Xavier Ashe
on Mon 06 Feb 2006 07:00 AM EST
A Dutch television program
"Nieuwslicht" recently worked with local security firm Riscure to successfully crack and decrypt a
Dutch-prototype RFID passport. In this case, the data exchange between the RFID reader and passport was intercepted,
stored, and then the password was cracked later in just 2 hours on a PC giving full access to the digitized
fingerprint, photograph, and all other encrypted and plain text data on the RFID tag -- just perfect for slapping
together a cloned passport, eh? The flaw, at least in part, is due to the algorithm used when generating the secret key
to protect the data. The key turns out to be predictable given that it is sequentially issued and constructed from the
passport expiry date, birth date, passport number, and checksum. But don't kick back in superior isolationism just yet
kid. Starting October 2006 the US will
issue all new passports using the same ISO 14443 RFID tag and Basic Access Control encryption scheme employed by the
Dutch e-passports (and others) and adopted by the ICAO as global standards. It's still not clear at what distance the
exchange was intercepted -- while the passive ISO 14443 tag is spec'd with a read distance of only 2-milimeters you'll
find claims of reads at several meters. This is important 'cause the greater the read distance in say, the line at
airport immigration control, the greater the chance of abuse. Regardless, the Dutch e-passport system is still under
development allowing for changes, which makes us wonder, is ours? Wouldn't be the first time we've abandoned RFID
passport plans due to technology concerns. [Via The Register and Vara (Dutch), Thanks
Robin] .
Sunday, February 5
SpoofCard
by
Xavier Ashe
on Sun 05 Feb 2006 02:22 PM EST
SpoofCard
calling cards offers you the ability to change
what someone sees on their caller ID display when
they receive a phone call. Key Benefits: Make calls
truly private, Ability to record calls, Change
your voice, Fun and inexpensive, Easy to use
and fast to set up! SPOOFCARD FEATURES:
- Caller ID Spoofing
- Voice Changer
- Call Recording
- Web Control Panel
No computer needed! Simply dial the toll free number
from the calling card you purchase.
1.Enter your pin number.
3. Enter Destination number.
2. Enter Any Caller ID Number you wish to display.
4. Choose the voice you would like to use.
5. Your call is connected using the specified Caller
ID Number.
As an added bonus, we offer you the option to record
your conversation for FREE
which you can later retrive by logging-in to your control
panel or calling our 800 number from anywhere.
We also offer you the ability to change your voice
to sound like a man or women for FREE. .
Paps, a passively active port scanner
by
Xavier Ashe
on Sun 05 Feb 2006 01:05 PM EST
Paps is a passively active port scanner. It scans while posing as other
hosts in the same network segment and sniffs for responses in order to
determine port status. It is multithreaded and supports syn, fin, null,
xmas, udp and random scanning.
Download here.
Cain for PocketPC (ARM) v1.2 released
by
Xavier Ashe
on Sun 05 Feb 2006 12:53 PM EST
Cain
for PocketPC (ARM) v1.2 released. Download it here. Requirements:
- PocketPC 2003 device with an ARM based microprocessor architecture (eg: ipaq6515, Qtek 2020, Qtek 9090 ....)
- Microsoft Windows CE or Windows Mobile operating system.
- 5 Mb of free memory
Features:- Rainbowcrack-online client (works with any Internet connection available such as GPRS, ActiveSync .... )
- Dictionary Attacks for the following hash types: MD2, MD4, MD5, SHA1, RIPEMD160, CiscoPIX, MySQL v3.23, MySQL v3.23 + challange, MySQL SHA1, MySQL SHA1 + challange, LM, LM + challange, NTLM, NTLM + challange, NTLM Session Security.
- Hash Calculator
- Base64 Password Decoder
- Cisco Type-7 Password Decoder
- Cisco VPN Client Password Decoder
- VNC Password Decoder
- Microsoft Messenger Password Decoder
- Internet Explorer Password Decoder
- ActiveSync Password Decoder.
Your
help is needed for the recovery of Pocket Outlook passwords ! They are
probably stored into "pmailFolders" database under the form of security
BLOBS. If you find details about the correct way to decrypt them,
please send them to me and I'll update Cain as soon as possible.
Saturday, February 4
Defense information assurance manual posted online
by
Xavier Ashe
on Sat 04 Feb 2006 09:27 PM EST
The
training manual for Defense Department information assurance
professionals that was finalized in December is now available online.
The manual,
DOD 8570.01-M: Information Assurance Workforce Improvement Program,
will be was posted today, according to Robert Lentz, director of
information assurance for the Pentagon.
The manual sets the requirements for training and
certification of approximately 80,000 IA professionals within the
department, Lentz said. Defense contractors who provide IA services to
the Pentagon also will be expected to provide staff who meet the
requirements. DOD CIO John Grimes said in a foreword to the
manual that it “is effective immediately and mandatory for use by all
the DOD components.” The basis for the manual is an August 2004 directive from deputy secretary Paul Wolfowitz that assigned responsibilities for IA training. See original article at: http://www.gcn.com/vol1_no1/daily-updates/38125-1.html Via CCCure.org.
Feature: The Top 10 Infosec Myths
by
Xavier Ashe
on Sat 04 Feb 2006 08:00 AM EST
Merriam-Webster defines a myth as a popular belief or tradition that
has grown up around something or someone but is often unverifiable.
When it comes to information security, there's a lot of popular wisdom
available, but much of it is unfounded and won't necessarily improve
your organization's security.
Why do such beliefs persist? The answer is that we don't challenge new
and existing ideas enough. We must test and evaluate the validity of
new security concepts, so the good ones can become standards. Only by
cutting through the hype to separate reality from myth can IT
professionals help take their enterprises to the next level. Here are
10 network security myths that bear further examination. - MYTH #1: Organizations are more secure now than they were a year ago.
- MYTH #2: The presence or absence of regulations greatly matters when it comes to protecting both personal and customer data.
- MYTH #3: External consultants know more about information security than in-house personnel do.
- MYTH #4: Information security must be managed as a separate business unit to be effective.
- MYTH #5: Complex, frequently changed passwords will make my enterprise secure.
- MYTH #6: The padlock icon present during an SSL session means my data is safe.
- MYTH #7: Migrating from Internet Explorer to Firefox will make my enterprise secure.
- MYTH #8: Increased security spending results in greater security.
- MYTH #9: Wireless networks aren't secure.
- MYTH #10: Dumping Windows for Linux will make increase security.
Not a bad read from the guys at Security Pipeline. My only the issue is the use of absolutes. #1 is true when you realize the increase of the number of threats and our ability to maintain viable networks has stayed about the same. #2, 5, 6, 7, and 9 is false as an absolute, but it sure helps out a lot. What's your thoughts?
|
|
