Diary of Michael Daw » Main

Asking for trouble…

wooshy — Thu, 06 Nov 2008 11:02:43 +0000

The UK Prime Minister, Gordon Brown admits something that we knew all along in that the weakest point of secure system are the people who use it! It was reported that mistakes that happened in the most recent loss of tax return information by Atos Origin were “human” and mistakes would happen because people were involved in handling data.

The implications of those remarks are alledgedly quite bad. Those comments are an open invitation to hackers, online criminals and organised crime to redouble their efforts to steal this data according to a security expert.

Mac – No DNS patch, No Safari

wooshy — Tue, 09 Sep 2008 23:03:05 +0000

There is still backlash from Dan Kaminsky and his DNS poisoning find. There is still concern that apple have not got with the programme still. There appear to have a fix for servers but not for clients.
In other news, Mac users have been told to use Firefox or Opera instead of Safari. Safari appear to not have a good anti-phishing protection program associated with it.

Pwnie Awards

wooshy — Wed, 23 Jul 2008 23:24:36 +0000

The nominees are in for the security’s answer to the Oscars.

Get a warm fuzzer feeling…

wooshy — Thu, 26 Jun 2008 23:31:16 +0000

Fuzzers are not stuff found in your belly button. No but they can be thought of something that randomly prods belly buttons. Seriously though they are automated programs that can look for vulnerabilities in applications by injecting random code that could break them. Basically, you are looking how applications respond. Is your try-catch-finally statements up to scratch? How is your error-handling? Find out with this selection of fuzzer toys. This appears to be a good guide too.

Security sites and XSS

wooshy — Tue, 24 Jun 2008 23:08:00 +0000

You should always practice what you preach and the giants are not doing that all… Check out xssed! Versign, McAfee and Symantec have been found to be vulnerable according to the ‘hacker safe’ certification does not cover all XSS according to holisticinfosec.org.

Leaking…

wooshy — Sun, 22 Jun 2008 02:33:51 +0000

Really, it doesn’t matter whether you leave, lose or have something of value stolen. It’s not good but there have been a number of stories doing the rounds including that top secret being left on a train and this local government official. Now I don’t know about actual files, if it’s top secret, you should know that lives literally depend on it! I’d make sure they are left in secure areas.

For laptops and other devices, at least you can set power-on passwords and use encrypted drives. But a determined person will find a way of getting into hard drive.

Dos and Don’ts of Firewalling

wooshy — Sat, 21 Jun 2008 22:53:53 +0000

Firewalls are usually your first line of defence and often in an n-tier environment, your second and third line too. As someone told me, you are only as secure as your weakest link. And as Anne Robinson would tell you, humans are the weakest link. Firewalls need policies in place created by you’ve guessed it humans.
But all is not lost! There are good guides on creating decent policies from seclists.org, principle logic and the whitepaper from windowsecurity.com.

Let’s take it from security assessment point of view. You have been given a firewall configuration. You can use the above guides to make some suggestions about policies. Now I don’t profess to be a know-it-all at firewalls but you should look for and be suspicious of any traffic that is permitted between two interfaces. Permit and any rules are always suspicious! Is the traffic encrypted? Is it using a standard port? Are the interfaces in question externally interfacing? Any non-standard/unfamiliar ports should be looked into and establish what they are exactly used for, if this is possible. It maybe that these ports are related to the vendor software. In which case, you should look up any weaknesses relating to the port service offered by the vendor. For example, if there is a rule for SIP (port 5060) then they maybe vulnerable to this cisco advisory.

Dumbest ideas in Computer Security

wooshy — Thu, 19 Jun 2008 22:49:10 +0000

Here’s six of the best from Marcus Ranum

1. Default Permit
2. Enumerating Badness (should only track the good things)
3. Penetrate and Patch
4. Hacking is Cool
5. Educating Users
6. Action is Better Than Inaction

Top 10 Weird Disasters

wooshy — Wed, 18 Jun 2008 08:04:10 +0000

The weirdest data disasters… It’s a bit like when I was in school and my cat ate my homework… really it did happen! This is courtesy of silicon

10. All in a spin: A customer who told engineers she had ‘washed away all her data’ after putting a USB stick through a cycle in her washing machine.
9. Feeding time: A father who, while feeding his baby daughter, forgot about the USB stick in his top pocket. As he leant over the high-chair the device fell into a dish of apple puree.
8. Row, row your boat: A fisherman took his laptop in his rowing boat. Both he and the laptop went overboard, taking all his data to the bottom of a lake.
7. Honeymoon hell: One wedding photographer overwrote the photos of one wedding with another event – and needed to escape the wrath of the newly weds.
6. Melting point: During an experiment, a scientist spilt acid on an external hard drive and burnt away his important data.
5. Shattering blow: In the middle of an argument, a businessman threw a USB stick at his partner, with the device ending up in several pieces on the floor. Unfortunately it contained valuable company plans.
4. Fire alarm: A fire destroyed an office, sparing only a few CDs which had melted to the inside of their cases.
3. Ooooops: A scientist was fed up with his hard drive squeaking, so drilled a hole through the casing and poured in oil – which stopped both the squeaking and the hard drive.
2. Here goes…: To test the functionality of a parachute, a camera was dropped from a plane. The parachute failed and the camera shattered into several pieces but the device’s memory stick was reassembled and the footage was recovered.

And the number one weird and wonderful data disaster is…
1. Data repellent: After discovering ants had taken up residence in his external hard drive, a photographer took the cover off and sprayed the interior with insect repellent. The ants were killed off and the data was eventually recovered.

All the hardware on the list was recovered, the company said.