Archive for May, 2008

May 20 2008

Twitter madness: NetSecPodcast

Published by under Blogging,Podcast

Rich and I have created a new Twitter account: NetSecPodcast. We won’t be updating it all that often, but it’ll be there and it’ll give you an idea of some of the things we have planned for the show. We are talking about possibly doing some live streaming of the podcast recording and other stuff, but nothing solid yet. We’ll let you know through the Twitter stream when we do though.

While I’m at it, you can subscribe to my twitter stream at mckeay and Rich’s at rmogull. Easy as pie, at least when Twitter is stable that is. And I hope I haven’t just opened us up to a steady stream of spam twitter friends by posting this.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

May 19 2008

Version Blah Blah??

Published by under General,Simple Security

I’ve been playing City of Heroes/City of Villains since Day One. Actually, I was part of the beta testers and participated in the ‘three day head start’ they gave people who preordered the original game. That was just over four years ago and I’ve loved playing the game the whole time. Yes, I’m an roleplaying game geek, and superheroes are my genre of choice.

For the last several weeks I’ve been anticipating the latest upgrade to the franchise, Episode 12. When my system started downloading a patch this morning, I didn’t think it was a big deal, but I wanted to check out the patch notes to see what had changed and been updated. Imagine my surprise when instead of the normal patch notes, the notes were empty and the version was listed as ‘Version Blah Blah’.

Now this is probably part of the scheduled downtime indicated on the Server Status page, but it still made me pause for more than a few minutes and wonder if there wasn’t something more serious wrong with my favorite game. Had someone infiltrated the game and set up a malicious patch? Was it just an administrator who had more important things to do than update the patch page? Or was this a conscious decision to attempt to be funny? Since the patch and the downtime were anticipated, I’m voting for the last, but as a security professional, it makes me more than a little uncomfortable to see this.

It’s too early in the morning to read too much into this, but I still worry when a vendor, whether a game vendor or a security product vendor, doesn’t take their patching seriously. We have too many security issues out in the wild to joke about the patching products. Or maybe I just need to go back to sleep for a couple of hours and come back when the server updates have been finished.

Update: Yup, it was just a placeholder while the other work was being done. Now the real patch notes are up and the servers are all in the process of being restarted.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

May 19 2008

Card skimming is alive and well

Published by under Hacking

How much attention do you pay the ATM machine at your local bank? Would
you notice if someone put an additional device on it that looks
legitimate? Even if you would, do you think your mother or grandmother
would? I know my grandmother has a hard enough time even seeing the
ATM, let alone being able to tell if anyone added anything to it.

I’ve never seen a Redbox, but they’ve had a few systems in Arizona that received an additional card reader
earlier this month. These readers were set up above the normal card
reader, probably powered by a AA battery, and I’m sure the owners were
planning on coming back a few days later to either retrieve them or at
least download what they’d collected so far.

Card skimming has been a real threat for some time now and is
probably only going to get worse. With the proliferation of devices
that take credit cards (Redbox appears to be a DVD rental system) it’s
only going to get worse. Both of the examples Redbox shows are pretty
obvious if you know what you’re looking for, but there have been other
skimmers that are much harder to detect. And they’re only going to get
better at disguising the skimmers as time goes by.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

One response so far

May 16 2008

Data isn’t ‘private’ if you put it on a social networking site

Published by under Privacy

Private: confined to particular persons or groups or providing privacy; “a private place”; “private discussions”; “private lessons”; “a private club” … i.e. something a social network isn’t.

I get annoyed with people who use the word ‘privacy’ when talking about their information on a social networking site; by definition, anything put on a Facebook or MySpace is there for sharing and is no longer private. If you want to keep your information private, don’t put it somewhere that’s specifically designed around the concept of blasting your info to as many people as possible in the first place!

We’ve got mashables and all the other technologies that are designed to share our information, or data portability as it’s called. People want to be able take their information from one application to another as easily and transparently as possible. That’s great, it’s wonderful for sharing information. It’s also about as far away from ‘privacy’ as you can get.

There’s a big hubbub in the blogosphere because Facebook is blocking or limiting the amount of information other sites, like Google’s Friend Connect, can collect from the Facebook API. Facebook claims it’s about privacy; they believe users should have the right to control where their information goes and how it’s being used. I agree with that statement, but if someone is putting their personal information on Facebook, then they’ve made the choice of giving up that control, since any screen scraper or search engine can be used to pull down the information with very little effort. While I hate agreeing with Michael Arrington, he’s right; Facebook’s decision to limit what other social networks can pull from the FB API is about protecting Facebook’s business model and has nothing at all to do with their user’s privacy. Facebook wants to squeeze every possible cent from the value of your information before they let anyone else have it. I don’t blame them, I just don’t have to give them anything to work with.

Robert Scoble is wrong, privacy isn’t dead; people are just willing to give up privacy for the convenience of being part of a social network. If someone wants their data to be private, they shouldn’t be putting it online. Privacy isn’t dead, but you’ve made a decision to give up your privacy when you put it online. You have to weigh the value of having that social interaction versus what your information is worth to you. Most people make that decision without any conscious thought, which isn’t Facebook’s fault. Not everyone is a professional paranoid who spend a large amount of their time thinking about these issues, but everyone should at least be aware of what they’re putting online.

The Internet, and especially a social network, is designed around the concept of information sharing. Privacy is about controlling your information and controlling who has access to your information. If you put that information on Facebook, you’ve ceded that control to them, and even they don’t have that much control over who can access it. You can control where and when you put your information online, but once it’s there, privacy isn’t applicable. You’ve chosen to put it in a public forum, therefore your information obviously wasn’t something you wanted to keep private in the first place.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

One response so far

May 15 2008

xkcd: Security Holes

Published by under Uncategorized

Not to be outdone by Dilbert, xkcd has it’s own Debian related humor today. Who ever thought that the words “encryption” and “humor” would apply to the same blog post.


[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

3 responses so far

May 15 2008

The Debian random number generator

Published by under Humor

http://img502.imageshack.us/img502/2996/pmeo9hcjp7aw9.jpg

Ouch! That hurts, and I don’t even run Debian. Thanks, Stepto.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

2 responses so far

May 15 2008

Time to get a new set of keys

If you’re using Debian or Ubuntu, it looks like you need to generate a new set of keys immediately, if not sooner! The SSH keys on those systems used the PID of the process as a seed for generating the old keys, which severely limits the randomness of the keys and has made it possible for a rainbow table of all possible keys to be generated.

There’s some debate about whether this vulnerability is related to an increase in SSH scanning on the Internet, but that’s really immaterial; it will cause a rise in SSH scans soon. Better to secure your system now and stay ahead of the curve than be one of the people unlucky enough to get compromised. As always, the real danger is not what’s happening today, but what happens in a few months when the awareness dies down and people who didn’t get the alerts leave their vulnerable machines on the Internet.

The Internet Storm Center thinks this is really important, so you probably should too.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

3 responses so far

May 14 2008

May SRT: RSA Conference – Beyond the Hype

Published by under General,Podcast

Shortly after the end of RSA 2008, Michael Santarcangelo organized the latest Security Roundtable podcast. We were joined by a varied crowd of characters in the form of Dr. Anton Chauvakin, James Costello, and Jennifer Leggio. We had a lot of fun recording this conversation, even if poor Anton fell off fairly early due to phone problems. Luckily we let him get some of his shots in early.

Rich and I talked about this on an episode of the NSP, but there were no real ‘themes’ to this years RSA. There were a lot of interesting things going on, but it wasn’t on the showroom floor or in the key note presentations. I’m hoping that this means the industry is maturing, but it may just mean we’re in a lull between waves of marketing hype. Guess you’ll have to tune into next year’s SRT RSA podcast to find out.

Security Roundtable for May 2008 | RSA Conference – Beyond the Hype

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

May 14 2008

Microcast: Ron Gula on Nessus license changes

Published by under Podcast,Security Advisories

Rich and I got a chance to talk to Ron Gula, CEO of Tenable Network Security about the changes that were made today the the changes in the Nessus licensing model. This is a follow up to the post I wrote this morning and explains the reasoning behind the changes straight from the man in charge.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

May 14 2008

WP Security Scan

Published by under Uncategorized

I don’t care if you’re a security blogger or just plain vanilla blogger, you owe it to yourself to check out WP Security Scan. This plugin will scan your WordPress installation and give you suggestions on how to make it more more secure. It found a number of permissions on my blog that had been set incorrectly (now fixed) and gave me other suggestions such as changing the names of the directories from the easily guessed defaults. I know that a lot of people have a hard enough time just keeping their blogs up to date, but given the rash of WordPress compromises I’ve heard of recently, this is something everyone running a WP installation needs to do.

Another plugin in the same vein worth checking out is WordPress Automatic Upgrade. No more waiting for your service provider to get around to the upgrade or mess with all the funky files yourself. The only problem I have with it is re-enabling the plugins after an upgrade, which is a relatively minor issue. I run the plugin occasionally just to get a backup of the blog. See, I do learn from my mistakes occasionally.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

One response so far

« Prev - Next »