Supposed to be a nice day today so perhaps I’ll try and get 9 holes in before I have to pick my wife up at the airport tonight 🙂

Here’s the list:

The Big Ol’ Ubuntu Security Resource – This is a few days old but a good article to read through regardless.

If you’ve recently switched from Windows to the Linux distribution Ubuntu, you’ve probably experienced a decrease in spyware — and malware in general — on your system. But although Ubuntu is billed as the ultra-secure solution, you should know that even though Ubuntu’s default install has its flaws, like every other operating system.

To combat these weaknesses, IT Security has prepared a guide to help you close your system’s backdoors and protect you from some of the common Ubuntu exploits. Look at this big ol’ Ubuntu security resource as an introductory guide to securing Ubuntu, along with a list of the software you’ll need to stay protected.

Insider Threat Example: Ex-Coca-Cola Employees Sentenced to Prison For Trying To Sell Trade Secrets To Pepsi – This is the example I typically use when justifying the purchase of an SEM/SIM/SEIM/NSM solution. Nice to see that I wasn’t inventing a scenario that wasn’t possible 🙂

CNN reported that a couple of ex-Coca-Cola employees were sentenced to prison and ordered to pay $40,000 each for “conspiring to steal and sell trade secrets to rival Pepsi.”

One will get 8 years in prison and the other will get 5 years.

Another ex-Coca-Cola-worker was also involved and will be charged with wire fraud and unlawfully stealing and selling trade secrets, as were the other two, and sentenced this summer.

Pepsi notified Coca-Cola that the three had offered to sell samples of a new Coke product to Pepsi for $1.5 million.

Foundstone Blast – TCP Network Service Stress Test Tool – Another cool tool to add to your kit.

Foundstone Blast v2.0 is a small, quick TCP service stress test tool. Blast does a good amount of work very quickly and can help spot potential weaknesses in your network servers.

Features:

/trial switch adds the ability to see how the buffer looks before sending it
/v switch adds verbose option – off by default
/nr switch turns off initial receive after initial connect – HTTP services don’t send and initial response, Mail services do
The /nr switch fixes the effect of HTTP timeouts when sending GET strings
/dr adds double LF/CR’s to buffers(useful for GET requests) off by default

“Defeating” Whole Disk Encryption – Part 2 “Ok, I’ve got the password, now what” – Part two in the series.

In my last post I discussed some techniques for obtaining a PGP encrypted password from a DD image of the physical memory. Let’s quickly take a look at how to tackle a dead box before we start to tie all this together.

Latest test results from Andreas Marx – Sounds like a good test.

We tested 29 products for the detection of most recently seen verified working Win32 PE malware of the last 12 month — separated into the four categories backdoors, bots, trojan horses and worms.

Only detection has been tested, as this was the main request of magazines and readers, some more reviews regarding the system disinfection capabilities and the proactive (behaviour-based) detection will follow within the next two months. Furthermore, as announced during the International Antivirus Testing Workshop last week, we will more closely review the lifecycle of the products, to get a better impression about the developments of the products over time and also risky situations.

Dell & Google Secretly Installing Software to Make Money Off Your Typos – Those….bastards….how is this business practice not illegal?

New Dell machines that include the Google toolbar as part of a marketing agreement also include a secret program that redirects non-url information typed into a browser window to a Dell-branded page filled with ads. For example if you type in dogfood.cim, instead of getting a browser error message, the secret Google Address Redirector redirects the query to an ad-filled page of search results.

The Most Famous (or Infamous) Viruses and Worms of All Time – This is a great slide show that would make a great presentation to senior management.

The last few years have seen no shortage of viruses and worms. Here’s a not-so-fond look back.

Protecting against SSH brute-force attacks – Good article on a common attack method.

Practically all UNIX-based servers run a SSH server to allow remote administration across the Internet. From time to time, you might notice a large number of failed login attempts. Often, these are brute-force attacks against your SSH server

In this hack, we’ll show you 5 tips to protect machines running SSH daemons from brute-force attacks.

Adobe Lies, Badly – This blows my mind!

Adobe just posted a workaround for a security bug in their installer: Security bulletin: Workaround available for security vulnerability caused by installing Adobe Version Cue CS3 Server on some Mac systems.

In the Details section of the advisory, Adobe says:

To be granted access to these ports, the installer must first turn off the personal firewall. Currently, it is not automatically re-activating the firewall once it sets up Version Cue CS3 Server, creating a potential security vulnerability.