I’m planning a lazy Saturday this weekend since I spent two days last week driving for 12 hours each day. Perhaps I’ll catch up on some reading 🙂

The reading…
When IPS isn’t enough

Yesterday I blogged about how useful IPS tech is and today I’m going to blog about how it isn’t enough. How’s that for being conflicted!

White House Missing Five Million Emails

The White House has “lost” roughly five million emails from 2003 to 2005, according to a report (.pdf) yesterday by watchdog group Citizens for Responsibility and Ethics in Washington (CREW).

FISMA Dogfights

Imagine if FISMA was the operational theme guiding air combat. Consultants would spend a lot of time and money documenting American aircraft capabilities and equipment. We’d have a count of every rivet on every plane, annotated with someone’s idea that fifty rivets per leading edge is better than forty rivets per leading edge. Every plane, every spare part, and every pilot would be nicely documented after a four to six month effort costing millions of dollars. Every year a report card would provide grades on fighter squadrons FISMA reports.

The Forensic Felons: The Next Generation of Cyber Thieves

The new thieves care less about quiet entrances because they intend to meticulously clean the crime scene before they leave. They’re not just covering their tracks—they’re erasing them.

U.S. Government Contractor Injects Malicious Software into Critical Military Computers

This is just a frightening story. Basically, a contractor with a top secret security clearance was able to inject malicious code and sabotage computers used to track Navy submarines.

When is a security researcher (white hacker) a journalist?

The analogy is that a journalist uncovers fraud, mis-use, bad quality, etc in products, one example is poisonous food for cats informs the public, is he liable to being sued for damages by the company making the food?

Notes On Vista Forensics, Part One and Part Two

In part one of this series we looked at the different editions of Vista available and discussed the various encryption and backup features which might be of interest to forensic examiners. In this article we will look at the user and system features of Vista which may (or may not) present new challenges for investigators and discuss the use of Vista itself as a platform for forensic analysis.

House-trash party girl blames ‘hackers’

An English teenager whose house was trashed after she posted a party invite on MySpace has blamed computer hackers for the gatecrashing debacle.

An example of why human effort is helpful when assessing web applications

It can take some digging to discover if you’ve successfully injected any code into a web application. I was using the ALL-FUZZ-STRINGS that comes with Suru (added additional strings from sources like ha.ckers.org XSS Cheat Sheet) to run through a list of popular input validation attacks.

More info on the Windows DNS RPC interface vulnerability

Some more information for the community regarding the Windows DNS RPC vulnerability that we have been reporting on http://isc.sans.org/diary.html?storyid=2627. We have knowledge of a successful attack that occurred on April 4, 2007. This appears to be an opportunistic attack (instead of a targeted attack).

Dungeons and Dragons and Networks

This editorial on Dungeons & Dragons & Networks talks about how the boundaries present in both network troubleshooting and the D&D play format promote creativity, while tasks with less boundaries are more difficult.

Mainstream Media is Figuring Out The Industries New Disclosure Dilemma

We’ve all debating the legal and ethical issues, but it doesn’t change the fact that we’re going to lose the canary-in-the coal-mine aspect of information security. Does that mean we’re going to have to rely on compliance rather than community peer review? Eeesh!

Top 10 IT priorities at the DoD

The U.S. Department of Defense is expected to spend an estimated $23.5 million this year on IT — the most of any federal agency — according to market research firm Input.

Windows Sec and User Tools

There are few tools that I would like to try out but it is only available on Windows platform. Guess I need to install Windows in VMware for testing. I haven’t really touch anything on Windows lately except for Windows Server 2003.

Friday the 13th…queue ominous music…

Just when I thought winter was over Mother Nature shuffled the deck and dealt Fredericton another snow storm. We received about 15cm (~6in) in a 7 hour period. An hour away in St. John they only received 2cm (0.8in) which was quickly washed away by the rain that followed. I’m not sure how that’s fair, nor how it relates to security, but I had to rant about it.

Some interesting things happened this Friday, including the reports of a Zero-day RPC flaw in Microsoft DNS, details on the new Storm virus, an interesting article on “Top 10 Unusual Excuses Given for Losing Customer Data”, and a great paper on manipulating FTP clients using the PASV command.

Zero-day RPC flaw in Microsoft DNS

According to David Maynor of Erratasec, a zero-day exploit against Microsoft DNS server is being seen in the wild. This affects the most up-to-date Windows Server 2000, 2003, and 2003 R2 for all service packs. This is somewhat unusual for Microsoft’s DNS service because it’s been rock solid for many years without any DNS server flaws. Fortunately the attacks seem to be limited because this vulnerability isn’t normally exposed to the Internet on a properly configured firewall. I’ll also show you how to protect your Microsoft DNS servers below.

EXE/ZIP e-mail viruses (editorial)

Remember Bagel? It was just a couple years ago when a very similar set of viruses was making the round. Bagel arrived as a plain .exe, waiting for a gullible user to double click and execute it. It later, very much like the new “Storm” virus, used an encrypted ZIP file.

FISMA 2006 Scores

If I sound bitter, it’s because I’ve seen my taxpaying dollars wasted for the past five years while various unauthorized parties have their way with these agencies. FISMA is not working.

Spam Attack: Zipped Trojan

Security Response has seen a large spam run of what appears to be the latest in the line of Trojan.Peacomm variants. While this is nothing new, this time around the attachments are in the form of password-protected zip files. The recipient is being coerced into unzipping the attachment with the included password, then running the unzipped file, to counteract activity related to an unknown worm (with which the recipient has undoubtedly been infected).

Top 10 Unusual Excuses Given for Losing Customer Data

Keeping data secure is no easy task and requires constant vigilance. Turn your back for just a moment and just like Keyser Söze — POOF — it’s gone. All that’s left then is the dubious task of explaining to your customers why their credit card information or patient data is missing.

Insuring data breaches

Tech//404, a new venture by insurance company Darwin, sells insurance for losses due to technology and security failures. And they now publish a “Data Loss Archive”, a sort of repository of horrible acts of corporate data theft (it has potential, but should it only has a number of recent events and really should have an RSS feed).

I *heart* my IPS

Last year I vowed to do whatever I could to get myself weaned off as much dependence on Microsoft patches as I could. To wit; I started purchasing IPS and UTM devices for our offices. The main offices got the IPS units behind the beefcake firewalls and the satellite offices got UTM devices in lieu of a firewall. I also aggressively ramped up our HIPS deployment to try to get as close to 100% of our laptops covered as possible.

Bury WEP already – WEP R.I.P.

The WEP patient has been on life support for too long. Zero brain activity. Everyone agrees WEP should never be used now that WPA-PSK ships in all wireless equipment.

It’s the Data, Stupid!

Good medicine addresses root causes; bad medicine merely addresses symptoms. Likewise, good risk management methodologies address root causes; bad risk management merely addresses symptoms.

Mobile Malware Landscape?

Vulnerabilities like draining my battery? Maybe I’m goofy, but I tend to think that these sorts of articles have that “cry wolf” impact on real vulnerability/malware articles. How do we know if we can really expect an increase in Threat Events if articles like these are used to make up for a “slow news day”?

Manipulating FTP Clients Using the PASV Command

This paper discusses the FTP client flaw in detail and demonstrates how it can be used to attack common web browsers such as Konqueror, Opera and Firefox. Proof of concept code is presented that extends existing JavaScript port-scanning techniques to scan any TCP port from Firefox (even though it now implements “port banning” restrictions). Because of the way the same-origin policy is applied it is also possible to perform banner-grabbing scans against arbitrary hosts. Finally, for services that don’t return a banner an alternative fingerprinting technique is demonstrated which measures the time it takes servers to close inactive TCP connections.

Microsoft Bugs vs Features

I’m not sure if this is the result of IT security media contorting the infomation they recieve and presenting it in a provocative way, or if Microsoft are really trying to blow off these bugs as part of their application design.

‘Storm Trojan’ biggest spam run this year

According to researchers at Postini Inc., the spam run is the largest in the last 12 months, and more than three times the volume of the two biggest in recent memory: a pair of blasts in December and January. “We’re seeing 50 to 60 times the normal volume of spam,” said Adam Swidler, senior manager of solutions marketing at Postini.

Bank Botches Two-Factor Authentication

Um, hello? Having a username and a password — even if they’re both secret — does not count as two factors, two layers, or two of anything. You need to have two different authentication systems: a password and a biometric, a password and a token.

I’m starting another new section on my blog where I highlight some of the days interesting information from the blogosphere. The sites I link to may contain breaking news, helpful tips, new products, important patches, and even the occasional joke or comic. I may not be able to release a new post every day but I will certainly try (on slow news days I may just end up combining a couple of days together). Enjoy!

Sophos: China fixing spam problem; U.S. is not

The amount of spam pumping out of China dropped precipitously in the first three months of 2007, security vendor Sophos reported Wednesday.

A third of IT managers report data breaches: survey

In a recent survey of 83 corporate IT managers, 28 acknowledged having had to cope with a data breach, and half of those respondents reported significant related costs.

Slavasoft FSUM and Hashcalc md5 & File Integrity for Windows

FSUM is a fast and handy command line utility for file integrity verification. It offers a choice of 13 of the most popular hash and checksum functions for file message digest and checksum calculation.

Effective Vulnerability Management (Part 1)

Vulnerability assessment scanning has been the primary means for the majority of organizations to attempt to determine their security posture against an external threat environment. Essentially the security group will scan the environment against a database of known vulnerabilities and then request the operations team resolve the vulnerable conditions.

German Police Want the Right to Hack Computers

German Interior Minister Wolfgang Schaeuble has confirmed plans to seek a change to the constitution to allow the state secret access to the computers of private individuals, in an interview published Thursday.

Obscure Email Security Issue: 5 Lessons About Re-using Email Addresses

Does your organization ever re-use email addresses whenever someone leaves the company? Do you know that some of your customers’ and personnel’s email service providers re-use email addresses when their subscribers leave? Probably more than you realize.

Introduction to Identity Management – Part I

Depending on where you sit, Identity Management (IDM) is irrelevant, a holy grail, or a complete boondoggle. Having experienced all three situations at one time or another, and more recently seeing it actually work, it’s time to demystify the subject matter. In this article, we will cover the conceptual framework of Identity Management, and touch on some of the more important terms and methodologies.

New Vulnerability in Windows Help Files

Just in time to coincide with Microsoft Tuesday Patches, another new vulnerability is released to the world. This time the vulnerability was found in Windows Help (.hlp) files. This flaw enables an attacker to make use of a heap overflow in order to achieve arbitrary code execution.

The C-I-A Triad – weighed and found wanting

Believe it or not, the field of Information Security has changed! Foundational concepts, such as the traditional C-I-A triad (Confidentiality, Integrity, and Availability) are being challenged and supplanted by a more inclusive model known as the Parkerian Hexad