Network Security Blog

Bill Brenner quoted me a couple times for a Search Security article on the possible Sourcefire IPO.  Richard Bejtlich was also quoted in the article, but he was looking at the financials more than I was.  I’m just confident that Sourcefire know’s that the community support is largely responsible for their success.  Richard’s also looking at how much money they made or loss, which is probably more important to an IPO. 

Technorati Tags: security, McKeay, Sourcefire, Bejtlich

According to the SFGate, the intrusion that AT&T reported earlier this week was not aimed at stealing credit card information, it was aimed at providing the raw data to allow the crackers to perform targetted phishing attacks on a massive scale.  By seeding an email with information gathered from AT&T’s database, the phishers can add a level authenticity that makes even some of the most suspicious people on the Internet accept an email as authentic.

This is just one more reason to never respond directly to any request from a merchant or bank that comes to you in the form of an email.  As always, if you think an email alert is real, open a browser window and manually type in your bank’s URL, never click on the link in the email. 

Technorati Tags: security, McKeay, AT&T, phishing

What an evil, sneaky, underhanded way to social engineer a business!  I like it!  This company took twenty USB thumb drives, seeded them liberally with malware and pictures, and left them on the ground outside the credit union they were targeting.   People fell for it, and quite frankly I can’t say I blame them.  If I found a thumb drive laying around in the parking lot, I’d probably plug it into a system to see who it belonged to myself.  Or at least I would have before I read this article. 

This was done as part of a penatration test, with the full approval of the company that was attacked.  But is it really safe for anyone to assume that the any media you find laying around was lost, not placed there on purpose?  This really would be a good way to target almost any company you might want to mention.  It’s so much safer to always assume a malicious intent and take the proper precautions than it is to assume innocence.  This is why I always get so angry when businesses talk about stolen laptops and the thieves not knowing what they have.  You have to assume malicious intent and prove that none exists, not the other way around.

Technorati Tags: security, USB drive, social engineering

Comments I made on my ComputerWorld blog were quoted today in an article on SearchSecurity about the Black Frog/Okopipi project.  After talking to one or two members of the project, I think I oversimplified the challenges Okopipi will be facing, but I’m still dubious abou the project.  It’s something that’s going to have to be handled with great care, and I’m not sure an open source project is the way to go.  Every unsubscribe link is going to have to be verified by a real person, not just a program, and I still see several ways spammers could turn this project to evil.  I don’t think this is reason enough not to at least try, but I don’t believe I’ll be participating in a distributed, P2P anti-spam solution any time soon.

Technorati Tags: security, Okopipi, spam

It looks like the spammers have won the battle against Blue Security.  The company is closing down their service, having realized that their solution to spam isn’t going to do much more than create an ever-escalating war with the spammers.  I didn’t think an active, attack-back technology like Blue Security ever had much of a chance of being effective, but I’m still a little saddened to see them have to shut down the service.  On the other hand, give it a year or two and I’m sure some other company will try almost exactly the same thing. 

Technorati Tags: security, spam, Blue Security

Mikko at F-Secure had a good idea for fighting phishing.  A significant amount of phishing sites aren’t hosting the images they use, they’re directing the browser to download the real image from bank they’re imitating.  So what if the banks added some relatively simple code to instruct the web server to send a alternative image if they received a significant number of referals to the original image?  Using Mikko’s idea, the bank’s alternative image would include a stamp that would make it clear that the refering site was illegitimate and give the consumer a phone number to call.  The idea could be circumvented by smart phishers, but it would add one more hoop they’d have to jump through.  Even if it only stops the lazy phishers, that’s a couple more percentages of the total scams that wouldn’t work. 

Technorati Tags: security, phishing

No, I didn’t write it myself.  Alessandro Perilli at Security Zero has written up his impressions of Strata Guard Free 4.5, and includes a lot of screenshots of the product and his own conclusions.  Seeing the GUI helps me a lot in understanding a product, and Alessandro has some good observations.

Earlier this month when I interviewed Alan Shimel, I asked him when they were going to have a Virtual Machine install of their Strata Guard product.  Apparently, the answer is “today”.  You can download a copy of the virtual machine at www.stillsecure.org.  I hope I can find some time to take a look at it myself this weekend.  If you get a chance to try this out, send me some feedback at netsecpodcast@mckeay.net or 916-231-9479

Technorati Tags: security, stillsecure, IDS

I’m really disappointed that the government has interfered with this merger.

Technorati Tags: security, Sourcefire, IDS

Forbes is running an article about the federal government holding up the purchase of Sourcefire by the Israeli company, Check Point.  On his blog, Alan Shimel has some opinions of his own, and I’ve expressed my own opinions on my Computerworld blog.  Now I want to know what you think about the 45 day hold for examination.  Comment here, send me an email at netsecpodcast@mckeay.net, or leave me a voicemail at 916-231-9479.  Is this a case of the government doing it’s job, a case of xenophobia (which some might call racism) or is there more going on here?  Let me know what you think.

Technorati Tags: Security, IDS, Sourcefire, Check Point