= Announcements & Shameless Plugs =
Live from the
PaulDotCom Studios Welcome to PaulDotCom Security Weekly, Episode 120 for August 28st, 2008
PaulDotCom Security Weekly, a show for security professionals, by security professionals.
pauldotcom.com/sans/ PaulDotCom SANS Click-Through] - Go there, register for fabulous SANS training! Go now!
* [http://www.whitewolfsecurity.com/ice2.htm ICE (Integrated Cyber Exercise) - Oct. 1-3 at SANS Las Vegas!] - Interview in this episode!
* NS2008! Paul giving keynote: Things That Go Bump In The Network: Embedded Device (In)Security and teaching SEC535, Network Security Projects Using Hacked Wireless Routers! Don't forget our live podcast immediately following!
[http://www.sans.org/mentor/details.php?nid=12904 "I met you yesterday at SANS and was wondering if you could help me promote my mentor session of SEC508 starting on September 23rd. If you could forward this invitation onto your network of contacts, that would be awesome."] - Evan
= Listener Feedback: Listener Scott Is Evil =
= Stories Of Interest =
[http://www.whitewolfsecurity.com/publications/biometric_locks.php Hacking Biometric Locks]
securityvulns.com/ Udocument435.html VMware Releases A TON of Patches] - [ PaulDotCom] - Patches still pending for VM Fusion, WTF! You should patch, its important, especially because the security of multiple machines is at risk, in a platform independent kind of way.
blog. ncircle.com/ blogs/vert/archives/2008/09/ the_browser_with_bling.html Chrome is Shiny, but scratches easily] - [ PaulDotCom] - Oh hey look, a new web browser! And look, vulnerabilities in the new web browser! Who would have thought? All software has vulnerabilities, especially new software. People have been hacking away at Firefox for quite some time, and they do a decent job of keeping things patched. Sure, they implement new features, which then could present software vulnerabilities, but they get fixed in a timely manner, a manner which best fits with my security requirements, so I am sticking with Firefox. Lets not even talk about IE, a browser still plagued with security flaws, and ones that don' t get fixed until MS decides to bless us with their holy than thou bi-monthly patches.
howto. wired.com/ wiki/Secure_Your_iPhone "Securing" Your iPhone] - [ PaulDotCom] - I was excited about this article, until I read it. The first two items are implementing a 4 digit pass code, because that provides security , right. Then make sure your phone locks, well duh. And somehow re-mapping my home button protects my information, at least it prevents people from bypassing the lock and accessing my address book. Is that really security or just a workaround? The best part about the article? The screenshot of the iPhone shows they have 3 apps that need updating, doesn't keeping your software up-to-date apply to your phone as well? Also, none of this protects your information as it flys in clear text over open wireless networks...
theregister. co.uk/2008/09/03/mythbusters_gagged/ Mythbusters Prevented From Running RFID Hacking Show] - [ PaulDotCom] - Conflicting stories abound, it appears that CC companies do not want RFID shortcomings to be public knowledge. I don't think that talking about RFID hacking and vulnerabilities is a crime, so look for some things coming soon.
darkreading. com/ document. asp? doc_id= 162800&f_src=darkreading_section_297 HP Adds Smart Card Readers to HP Printers] - [ PaulDotCom] - Okay, here's a newsflash, authentication is not the major security problem on printers and multi-function devices!!!!! How about implementing software without vulnerabilities, using secure protocols to transfer data, hardening the operating system, and encrypting the files/filesystem? Now you have no excuse, if you are building on technologies such as smart cards to these devices, you can implement all of the other security measures.
shadowserver. org/ wiki/ pmwiki. php?n=Stats.BotCounts Botnet Counts: For Good Measure] - [ PaulDotCom] - Some really cool graphs on the number of botnet drones, yes they have sharply increased over the past few months. However, even more frightening, the number of C&C servers increased ([http://www.shadowserver.org/wiki/pmwiki.php?n=Stats.BotnetCharts Reference]). This means, more drones and more individual botnets, confirming suspiciouns that botnets are more abundant and perhaps purpose built to avoid detection and eventual shutdown. The reason, seems to correlate with the rising SQL injection flaws. SQL injection flaws, ah yes, I've responded to incidents where these flaws are rampent. I also think that targeted phishing attacks are more common as well, especially in university settings.