In a recent article, Bruce Schneier, a renowned expert on cryptology and security highlighted that a new random-number standard (for encryption) includes an algorithm that is slow, badly designed and just might contain a backdoor for the US National Security Agency.
The standard is found in NIST Special Publication 800-90.
The article may be quite technical but is enough to raise concerns that backdoors may exist in a puportedly secure software component.
This leads to the conclusion and emphasis that it is imperative for nations to have their own indigeneous technologies inkey security areas in order to minimise exposure to shortcomings or backdoors that leave the system vulnerable to attacks or intrusions. >> More ..
Tuesday, November 20, 2007
Monday, November 19, 2007
2006 OS Vulnerability Summary
This report analyses and discuss about the OS Vulnerabilities. >> More..
Wednesday, November 14, 2007
Make No Assumptions. Security Begins With the Basics. YOU
There have been previous news about vendors releasing software with viruses, security vendor sites being compromised and similar incidents.
The mishaps continue ...
In a recent news article in Network World Asia titled "Seagate ships virus-laden hard drives", it was reported that:
"If you bought one of Seagate's Maxtor Basics consumer hard drives recently, check it for viruses. Especially if you're a gamer.
Seagate is warning that a "small number" of its Maxtor Basics Personal Storage 3200 hard drives recently shipped with the Virus.Win32.AutoRun.ah virus, malicious software that "searches for passwords for online games and sends them to a server located in China," according to a note posted on the Seagate Web site. Only drives purchased since August 2007 are affected, Seagate said." >> More ..
This time it is gaming software players who are the targets. Could it be anything else next time like bank accounts or access to corporate sites .... the possibility is so broad.
In yet another article in Network World Asia titled "Indian news site dispensing malware", it was mentioned that:
"The Web site of IndiaTimes, the online news site of the Times Group, one of India's large news and entertainment groups, exposed visitors to malware, according to an advisory Friday by ScanSafe Inc.
ScanSafe first detected and blocked malware on the site on October 25. ScanSafe is still investigating the reach of this attack, but given the popularity of the site and the amount of malware involved, the company is urging caution, it said in its advisory Friday. Only certain pages of the Indiatimes.com are infected, the advisory added." >> More ..
The above news basically pass the message that all users should not make any assumptions about any hardware or software they acquire or install and any website that they access as the malware can be embedded in just about anywhere and in the most unlikely of all places.
Hence defence against the consequences of such incidents requires users to be sufficiently aware, educated and acculturated about good computing practices including:
1. Having good anti-malware protection that is installed and running
2. Access to credible sites only and avoid strange or unusual sites
3. Ensure that any devices plugged in especially the usb devices are scanned for viruses before use.
4. Reminding peers about good computing practices.
A good defence for both personal and organisational or corporate use begins with YOU.
It may be that through your simple negligence, the whole corporate network that you are using and critical systems can be affected.
The mishaps continue ...
In a recent news article in Network World Asia titled "Seagate ships virus-laden hard drives", it was reported that:
"If you bought one of Seagate's Maxtor Basics consumer hard drives recently, check it for viruses. Especially if you're a gamer.
Seagate is warning that a "small number" of its Maxtor Basics Personal Storage 3200 hard drives recently shipped with the Virus.Win32.AutoRun.ah virus, malicious software that "searches for passwords for online games and sends them to a server located in China," according to a note posted on the Seagate Web site. Only drives purchased since August 2007 are affected, Seagate said." >> More ..
This time it is gaming software players who are the targets. Could it be anything else next time like bank accounts or access to corporate sites .... the possibility is so broad.
In yet another article in Network World Asia titled "Indian news site dispensing malware", it was mentioned that:
"The Web site of IndiaTimes, the online news site of the Times Group, one of India's large news and entertainment groups, exposed visitors to malware, according to an advisory Friday by ScanSafe Inc.
ScanSafe first detected and blocked malware on the site on October 25. ScanSafe is still investigating the reach of this attack, but given the popularity of the site and the amount of malware involved, the company is urging caution, it said in its advisory Friday. Only certain pages of the Indiatimes.com are infected, the advisory added." >> More ..
The above news basically pass the message that all users should not make any assumptions about any hardware or software they acquire or install and any website that they access as the malware can be embedded in just about anywhere and in the most unlikely of all places.
Hence defence against the consequences of such incidents requires users to be sufficiently aware, educated and acculturated about good computing practices including:
1. Having good anti-malware protection that is installed and running
2. Access to credible sites only and avoid strange or unusual sites
3. Ensure that any devices plugged in especially the usb devices are scanned for viruses before use.
4. Reminding peers about good computing practices.
A good defence for both personal and organisational or corporate use begins with YOU.
It may be that through your simple negligence, the whole corporate network that you are using and critical systems can be affected.
Monday, November 12, 2007
Pentagon: Our new robot army will be controlled by malware
This article emphasises the importance of developing indigeneous technologies rather than outsource the critical elements.
A US defence department advisory board has warned of the danger that American war robots scheduled for delivery within a decade might be riddled with malicious code. The kill machines will use software largely written overseas, and it is feared that sinister forces might meddle with it in production, thus gaining control of the future mechanoid military.
The most eye-catching of the equipment mentioned is the lineup of the US Army's Future Combat Systems (FCS) programme. FCS was originally supposed to include a wide range of deadly unmanned systems, including a small, possibly rocket-firing flying Dalek, a heavily armed autonomous helicopter gunship, and a robot tank packing guided missiles and cannon. There would also be intelligent sensor minefields, droid-mule transport systems and loads of other stuff; and all of it is supposed to be linked together by a data network. >> More..
A US defence department advisory board has warned of the danger that American war robots scheduled for delivery within a decade might be riddled with malicious code. The kill machines will use software largely written overseas, and it is feared that sinister forces might meddle with it in production, thus gaining control of the future mechanoid military.
The most eye-catching of the equipment mentioned is the lineup of the US Army's Future Combat Systems (FCS) programme. FCS was originally supposed to include a wide range of deadly unmanned systems, including a small, possibly rocket-firing flying Dalek, a heavily armed autonomous helicopter gunship, and a robot tank packing guided missiles and cannon. There would also be intelligent sensor minefields, droid-mule transport systems and loads of other stuff; and all of it is supposed to be linked together by a data network. >> More..
Israel suspected of 'hacking' Syrian air defences
Questions are mounting over how Israeli planes were able to sneak past Syria's defences and bomb a "strategic target" in the country in September 2007
Israeli F-15s and F-16s bombed a military construction site on 6 September. Earlier reports of the attack were confirmed this week when Israeli Army radio said Israeli planes had attacked a military target "deep inside Syria", quoting the military censor.
The motives for the strike, much less what was hit and what damage was caused, remain unclear. One theory is that a fledgling nuclear research centre, the fruits of alleged collaboration between Syria and North Korea, may have been hit. Others speculate that a store of arms shipments bound for the Lebanese militant group Hezbollah might have been targeted. A test against Syria's air defences has also being suggested in some quarters. None of these theories appear to be much better than educated guesswork.
Bombers carrying out the raid are believed to have entered Syrian airspace from the Mediterranean Sea. Unmarked fuel drop tanks were later found on Turkish soil near the Syrian border, providing evidence of a possible escape route. Witnesses said the Israeli jets were engaged by Syrian air defences in Tall al-Abyad, near the border with Turkey.
This location is deep within Turkey, prompting questions about how the fighters avoided detection until so long into their mission. Neither F-15s nor F-16s used by the Israeli air force in the raids are fitted with stealth technology. >> More..
Israeli F-15s and F-16s bombed a military construction site on 6 September. Earlier reports of the attack were confirmed this week when Israeli Army radio said Israeli planes had attacked a military target "deep inside Syria", quoting the military censor.
The motives for the strike, much less what was hit and what damage was caused, remain unclear. One theory is that a fledgling nuclear research centre, the fruits of alleged collaboration between Syria and North Korea, may have been hit. Others speculate that a store of arms shipments bound for the Lebanese militant group Hezbollah might have been targeted. A test against Syria's air defences has also being suggested in some quarters. None of these theories appear to be much better than educated guesswork.
Bombers carrying out the raid are believed to have entered Syrian airspace from the Mediterranean Sea. Unmarked fuel drop tanks were later found on Turkish soil near the Syrian border, providing evidence of a possible escape route. Witnesses said the Israeli jets were engaged by Syrian air defences in Tall al-Abyad, near the border with Turkey.
This location is deep within Turkey, prompting questions about how the fighters avoided detection until so long into their mission. Neither F-15s nor F-16s used by the Israeli air force in the raids are fitted with stealth technology. >> More..
Two charged with hacking PeopleSoft to fix grades
Two Cal State-Fresno students face up to 20 years in prison and fines up to $250,000 for hacking into the school's PeopleSoft system to change their grades. >> More..
US regional bank hacked
Hackers infiltrated the systems of Commerce Bank and accessed the records of 20 customers, the US regional bank said in October 2007.
The attack by persons unknown was partially thwarted - but not before a database of 3,000 records was hacked into and the data of 20 exposed. Compromised data included personal information such as names, addresses, Social Security numbers, phone numbers and, in a few cases, Commerce Bank account numbers, the Columbia Business Journal reports
Security staff shut down the attack and called in police to investigate after uncovering the breach a week ago. The FBI is investigating.
The method used in the attack is unclear, and something the bank will be keen that it stays unclear, to avoid the possibility of copycat attacks. There are many avenues of assault, of which one common tactic is to exploit web application vulnerabilities by using SQL injection attacksto access information of back-end databases. >> More ..
The attack by persons unknown was partially thwarted - but not before a database of 3,000 records was hacked into and the data of 20 exposed. Compromised data included personal information such as names, addresses, Social Security numbers, phone numbers and, in a few cases, Commerce Bank account numbers, the Columbia Business Journal reports
Security staff shut down the attack and called in police to investigate after uncovering the breach a week ago. The FBI is investigating.
The method used in the attack is unclear, and something the bank will be keen that it stays unclear, to avoid the possibility of copycat attacks. There are many avenues of assault, of which one common tactic is to exploit web application vulnerabilities by using SQL injection attacksto access information of back-end databases. >> More ..
Online trading site was left wide open
The conventional wisdom that banking organisations are more diligent with security was skewered in a presentation at the RSA conference this week.
Security consultancy Comsec outlined how they discovered that an online stock trading website they were asked to test was riddled with security holes. A rush job meant that basic security measures, such as the use of a secure login, were absent from the multimillion dollar system. >> More ..
Security consultancy Comsec outlined how they discovered that an online stock trading website they were asked to test was riddled with security holes. A rush job meant that basic security measures, such as the use of a secure login, were absent from the multimillion dollar system. >> More ..
More security education needed to avoid a cybersecurity disaster, experts warn
The United States is more prepared than ever for a major cybersecurity attack, but a panel of prominent security experts warned Tuesday that more needs to be done to increase awareness about cybersecurity issues and better educate future IT pros.
"We need to provide resources for future problems," said Eugene Spafford, the executive director of Purdue University's Center for Education and Research in Information Assurance and Security (CERIAS). "Patching the latest problem isn't getting us anywhere."
Spafford joined well known security experts Howard Schmidt, president and CEO of H&L Security Consulting and security luminary Bruce Schneier at the Information Security Decisions conference in Chicago for a discussion about cyber threats in 2008 and beyond. The panelists agreed that it would likely take a major cybersecurity event before the public becomes motivated enough to demand better security.
The panelists agreed that growing backdoor Trojan horse programs and herds of bots continue to be a problem moving forward, but it's unclear if they'll by used by cybercriminals to take down the electronic infrastructure of entire nations or in isolated targeted incidents for financial gain. >> More ..
"We need to provide resources for future problems," said Eugene Spafford, the executive director of Purdue University's Center for Education and Research in Information Assurance and Security (CERIAS). "Patching the latest problem isn't getting us anywhere."
Spafford joined well known security experts Howard Schmidt, president and CEO of H&L Security Consulting and security luminary Bruce Schneier at the Information Security Decisions conference in Chicago for a discussion about cyber threats in 2008 and beyond. The panelists agreed that it would likely take a major cybersecurity event before the public becomes motivated enough to demand better security.
The panelists agreed that growing backdoor Trojan horse programs and herds of bots continue to be a problem moving forward, but it's unclear if they'll by used by cybercriminals to take down the electronic infrastructure of entire nations or in isolated targeted incidents for financial gain. >> More ..
Secure Program Coding
It has often be questioned as to whether software developers are doing enough and knowledgable enough to code their applications with security in mind.
This article discusses this issue.
A new certification called the GIAC Secure Software Programmer (GSSP) program, teaches programmers how to write secure code. This can be taught or incorporated in the software curriculum in institutions of higher learning so that software developers can graduate ready with secure software development in mind. >> More ..
This article discusses this issue.
A new certification called the GIAC Secure Software Programmer (GSSP) program, teaches programmers how to write secure code. This can be taught or incorporated in the software curriculum in institutions of higher learning so that software developers can graduate ready with secure software development in mind. >> More ..
Sunday, November 11, 2007
Website for Computer Security Experts Hacked
It can happen to anybody's website, including a security website..
First Forensic Forum - a UK based association of computer security professionals - has been hacked.
F3.org's website was defaced with a message poking fun at the association of computer forensic experts. The timing of the defacement on Thursday was fortuitous (or well planned) since the organisation is coming to the end of a two day conference.
document.
The perpetrator of the attack posted a message taunting the organisation. "The F3 For Security Hacked. What's Happened In The world. Thay Are No Security Or What," S4udi-S3curity-T3rror writes. >> More ..
First Forensic Forum - a UK based association of computer security professionals - has been hacked.
F3.org's website was defaced with a message poking fun at the association of computer forensic experts. The timing of the defacement on Thursday was fortuitous (or well planned) since the organisation is coming to the end of a two day conference.
document.
The perpetrator of the attack posted a message taunting the organisation. "The F3 For Security Hacked. What's Happened In The world. Thay Are No Security Or What," S4udi-S3curity-T3rror writes. >> More ..
Task Force Aims to improve US Cybersecurity
A blue-ribbon panel of three dozen security experts hopes to craft a strategy to improve the United States' cybersecurity by the time the next president takes office, the Center for Strategic and International Studies (CSIS), and the task force's Congressional sponsors, announced on Tuesday.
The bipartisan Commission on Cyber Security for the 44th Presidency will be tasked with creating a plan to secure the nation's computers and critical infrastructure and presenting that plan to the next president. >> More ...
The bipartisan Commission on Cyber Security for the 44th Presidency will be tasked with creating a plan to secure the nation's computers and critical infrastructure and presenting that plan to the next president. >> More ...
Saturday, November 3, 2007
Security Companies also Vulnerable to Attacks
Nobody is perfect and no company is perfect. But all try their best to protect themselves from attacks. The lesson learnt as always, is that security is an ongoing process and not a destination. And the process has to be alert to both internal measures that has to be diligently kept updated as well as to be aware of new threats and attack vectors.
The following link provides a list of security companies and organisations including CERTS whose web presence have been compromised in one way or another. There are other interesting information as well. Read on ..
The following link provides a list of security companies and organisations including CERTS whose web presence have been compromised in one way or another. There are other interesting information as well. Read on ..
Subscribe to:
Comments (Atom)
Posts
