I’ve got everything booked for my trip to Houston and I’m looking forward to the BBQ I plan on enjoying 😛

Here’s the list:

Soloway: Another spammer bites the dust – Chalk one up for the good guys!

A notorious spammer once sued by Microsoft was arrested in Seattle this morning, a week after a federal grand jury indicted him under seal for allegedly illegal — and prolific — spamming.

NIST readies guidance on IT security assessments – If you’ve got comments you have until July 31st to make them.

The National Institute of Standards and Technology has finished the third and possibly final draft of its revised guidelines for assessing the adequacy of IT security. Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems, will be released for comment June 4.

Germany declares hacking tools ‘verboten’ – This is terrible because there is no clear indication of what a “hacking tool” is.

Updates to Germany’s computer crime laws banning so-called “hacking tools” have been criticised as ill-considered and counterproductive.
The revamp to the German criminal code is designed to tighten definitions, making denial of service attacks and attempts to sniff data on third-party wireless networks, for example, clearly criminal. Attacks would be punishable by a fine and up to 10 years imprisonment.

A New Vector For Hackers — Firefox Add-Ons – Something to look out for.

Makers of some of the most popular extensions, or “add-ons,” for Mozilla’s Firefox Web browser may have inadvertently introduced security holes that criminals could use to steal sensitive data from millions of users.

By design, each Firefox extension — any of a number of free software applications that can be added to the popular open-source browser — is hard-coded with a unique Internet address that will contact the creator’s update server each time Firefox starts. This feature lets the Firefox browser determine whether a new version of the add-on is available.

IPS app available for free – I look forward to testing this out.

Network managers looking for an inexpensive way to better secure traffic crossing their nets might want to check out a free application from Intoto.

Intoto, a provider of security software for enterprise network equipment and CPE gateways, last week at Interop, introduced a stand-alone intrusion-prevention system (IPS) application that the company says will help small and midsize companies looking for enterprise-scale security tools.

Web application scan-o-meter – Another document to put on your “to-read” list.

The new OWASP Top 10 2007 has recently be made available. Excellent work on behalf of all the contributors. As described on the website, “This document is first and foremost an education piece, not a standard.”, and it’ll do just that. Educate. Last week I provided project team with updated text (unpublished) that more accurately describes the current capabilities of “black box” automated scanners in identifying the various issues on the list. The exercise provided ideas for the remainder of this blog post; estimating how effective scanners are at finding the issues organized by OWASP Top-10.

I’m back home after my NSM presentation in Ottawa only to find out that I’m heading to Houston, TX on Sunday for a few days.

Here’s the list:

Find vulnerable Windows wireless drivers – Maybe it’s a good time to audit your own laptop 🙂

As more and more businesses move from legacy wireless security models, attackers are looking for new techniques to exploit wireless networks. One technique that is rapidly gaining popularity is to exploit vulnerabilities in wireless network drivers.

Taxonomy of glitch and side channel attacks – Very interesting article.

There are a number of things to try when developing such attacks, depending on the device and countermeasures present. We’ll assume that the attacker has possession of several instances of the device and a moderate budget. This limits an attacker to non-invasive and slightly invasive methods.

Technitium Free MAC Address Changer v4.5 Released – Be on the lookout for a tool of this nature on your network.

Technitium MAC Address Changer allows you to change Media Access Control (MAC) Address of your Network Interface Card (NIC) irrespective to your NIC manufacturer or its driver. It has a very simple user interface and provides ample of information regarding each NIC in the machine. Every NIC has an MAC address hard coded in its circuit by its manufacturer. This hard coded MAC address is used by windows drivers to access Ethernet Networks (LAN). This tool can set a new MAC address to your NIC, bypassing the original hard coded MAC address. Technitium MAC Address Changer is a must tool in every security professionals tool box.

MPack, Packed Full of Badness – Nice piece of analysis in this article.

A nasty piece of malware was sent our way this weekend that we are detecting as Trojan.Mpkit!html and Downloader. This malware is yet another malware distribution and attack kit in the same vein as other kits, such as WebAttacker. This kit, called MPack, is a professionally written collection of PHP software components designed to be hosted and run from a PHP server with a database backend. It is sold by a Russian gang and comes ready to install on a PHP server, and it also comes complete with a collection of exploit modules to be used out of the box.

Snort Report 6 Posted – I’m looking forward to reading this whole report (probably some time this weekend when I have some time).

This is the first of two Snort Reports in which I address output options. Without output options, consultants and VARs can’t produce Snort data in a meaningful manner. Because output options vary widely, it’s important to understand the capabilities and limitations of different features. In this edition of Snort Report, I describe output options available from the command line and their equivalent options (if available) in the snort.conf file. I don’t discuss the Unix socket option (-A unsock or alert_unixsock). I will conclude with a description of logging directly to a MySQL database, which I don’t recommend but explain for completeness.

There’s just something about having to get up at 4:15am to get on a plane that kind of ruins your day.

Here’s the list:

Enhanced Operating System Identification with Nessus – I’m in favor of finding better ways to profile OS’…how about you?

Tenable’s Research group recently introduced a highly accurate form of operating system identification. This new method combines input from various other plugins that perform separate techniques to guess or identify a remote operating system. This blog entry describes this new process and shows some example results .

Prefetch Analysis – I’ve never known so much about something I previously knew nothing about 🙂

I’ve seen a couple of posts recently on other blogs (here’s one from Mark McKinnon) pertaining to the Windows XP Prefetch capability, and I thought I’d throw out some interesting stuff on analysis that I’ve done with regards to the Prefetch folder.

Essential Bluetooth hacking tools – I can honestly say that I haven’t run into a situation where I’ve had to test and/or analyze Bluetooth devices yet. At least I now know where to get some tools.

If you are planning to gain a deeper understanding of Bluetooth security, you will need a good set of tools with which to work. By familiarizing yourself with the following tools, you will not only gain a knowledge of the vulnerabilities inherent in Bluetooth-enabled devices, but you will also get a glimpse at how an attacker might exploit them.

VMware Security and NAT Problems – This is the first I’ve heard of such problems.

As helpful as VMware is I can honestly say that it has caused me quite a bit of grief lately. My feelings of frustration have mainly been my fault but tonight I also received a warning to update to the latest version of VMware Workstation. And when Ed Skoudis tells you to update immediately I listen, as should you.

The problems with VMware started on Tuesday when the culmination of the SANS Hacker Techniques, Exploits & Incident Handling started. During the last week of this SANS @Home course the whole class is given access to a virtual lab which contains a vulnerable environment for the hacking. As it is a training situation Ed provides detailed instructions on how the students are suppose to set up their attacking systems. I spent the better part of that night and the next night hacking with a team and individually. I thought that I would do really well but in the end I just could not get anything to work correctly.

Recovering a FAT filesystem directory entry in five phases – Good article to cap things off.

This is the last in a series of posts about five phases that digital forensics tools go through to recover data structures (digital evidence) from a stream of bytes. The first post covered fundamental concepts of data structures, as well as a high level overview of the phases. The second post examined each phase in more depth. This post applies the five phases to recovering a directory entry from a FAT file system.