View source for Episode58

=Episode Media=

[http://archive.securityweekly.com/pauldotcom-SW-episode58.mp3 mp3]

== Stories for Discussion ==
[http://www.itsecurity.com/blog/20070112/while-phishing-gets-more-sophisticated-so-does-security/ Phishing Gets Sneakier and so do Security Measures] - [Joe] - Not a ground breaking article, but I like the hitman scheme... also it is interesting to learn that PayPal will be offering the RSA SecureID Token device for its customers.  [Larry] - Dear listeners:  Send us all of your money, or we'll send ninjas after you.  Not Pirates, Ninjas.  Also, I'm glad to see that paypal is doing the secure token thing as well (Is is RSA?).  Keep in mind that paypal is not a bank, but they are being progressive in securing thier customers money in a more appropriate/novel way, as compared to most of the banking industry.

[http://isc.sans.org/diary.php?storyid=2067 Port 2000/TCP Scanning] - [Paul] - Scanning for SCADA systems!  Did anyone read Zero-Day exploit: Countdown to Darkness?

[http://lifehacker.com/software/privacy/hack-attack-bolster-your-browsing-privacy-at-work-228841.php Nice little how-to on making your browsing private] - [Joe] - We've seen this topic a 1000 times before, but what I like is this grease monkey script to force you to connect to https versions of sites. The foxyproxy firefox extension allows you to select what sites you visit torified too. Me likey!

[http://www.professionalsecuritytesters.org/modules.php?name=News&file=article&sid=738 AJAX Sniffers] - [Paul Asadoorian] - DO NOT SNIFF AJAX, but you can use AJAX for sniffing the network.  Thats cool!  But bad...

[http://www.securitypark.co.uk/article.asp?articleid=26330&CategoryID=1 The most common hacker is probably sitting in the cubicle next to you] - [Joe] - According to the FBI, the most common hacker is probably sitting in the cubicle next to you, right now. This is someone who gets to work early, takes his or her turn cleaning out the office fridge, tells funny stories at lunch and, at some point, makes a very dumb move. It often starts when this hacker-next-door sees a file directory or workstation that’s just too juicy to pass by, like one named “Salary Comparison.” It’s simply too tempting NOT to peek inside. [Larry] - The insider threat is allegedly the biggest.  how do you protect agains these individuals.  Let's discuss...

[http://www.schneier.com/blog/archives/2007/01/choosing_secure.html Passwords Suck] - [Paul] - They do suck, and people abuse this all the time, its just to easy!  Why can't I make my password "password"?

[http://applefun.blogspot.com/2007/01/colloquy-is-vulnerable-to-format-string.html MOAB Fun with Colloquy] - [Paul] - Props to the colloquy team for fixing it, very scary exploit that relies on data coming into your app without user interaction!  AJAX?  IM? P2P?

[http://news.com.com/T.J.+Maxx+hack+exposes+consumer+data/2100-1029_3-6151017.html?tag=cd.top TJ Maxx gets some Haxx] - [Joe] - "Intruders accessed systems used to process and store customer transaction data, Framingham, Mass.-based TJX said in a statement. The retailer has identified some customer information that was taken, but the full extent of the data theft and number of affected customers is yet unknown, it said."

[http://www.securiteam.com/securitynews/5KP0D2AKAE.html Java GIF Vulnerability] - [Joe] - A security vulnerability in processing GIF images in the Java Runtime Environment may allow an untrusted applet to elevate it's privileges. Details and vendor patch posted at the link

[http://www.boingboing.net/2007/01/17/hotel_pennsylvania_s.html Hotel Pennsylvania, RIP] - [Larry] - It would appear that the owners of the Hotel Pennsylvania, the host of the HOPE conferences, will be demolishing the building to make was for an office highrise.  The HOPE organizers suspect that this may have a very severe impact on an east coast/New Work conference from now on.

[http://www.securityfocus.com/brief/407?ref=rss Rainbow tables for office documents] - [Larry] - Swiss company Objectif Sécurité released rainbow tables and 0phtcrack_office, which with 4 gigs of data can crack 99.6% of all Word and Excel password protected documents in under 5 minutes. Well, that reducees the time, however there are other companies that have been able to perform dictionary and real time attacks on these files and others (Zip, PDF, PST, etc), by brute force, and with inherent weaknesses in the algorithms and implementations.  Document passwords are not safe.  If you need protection, use something that will encrypt, and place a password on them - such as truecrypt, or PGP.

[http://www.hackinthebox.org/url.php?url=22286 The sad state of Cap'n Crunch] - [Larry] - Poor guy.  A brilliant mind, broke and loving in squallor.  Just think, he used to be a pioneer at Apple, Autodesk, etc.

[http://www.securedvd.org/index.html SecureDVD] - [Larry] - Thanks to Martin McKeay for pointing this one out.  Want a security based Live CD?  Here's 10.  Sweet.  We get asked all of the time on how to get started...download this and play with all of the tools.

[http://www.sans.org/newsletters/newsbites/newsbites.php?vol=9&issue=4 Certified Malware Remover?] - [Larry] - I really hope that SANS reconsiders this one.  I just cant see how this will go well.  Besides, in many cases, the only SAFE way to get rid of malware is to backup, format and reinstall.  Will that get me a certificate?

[http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9007940&source=rss_topic82 Covert WiFi auditing] - [Larry] - An attempt at making wireless pentesting sound like a covert operation.  While fun, I'm not sure how spy-tech it is.  Good info on somethings to consider however, but come on, duct tape?

[http://www.ex-parrot.com/~pete/upside-down-ternet.html Neighbors stealing your wifi?] - [Larry] So instead of securing your network, mess with the leeches!  Squid proxy, some scripting, and violla, the internet has gone all topsy-turvy like.  Or all goatse-like.  While you should SECURE your wireless, it does seem like a whole lot of fun to pwn the neighbors.

[http://www.zdnetindia.com/news/security/stories/167750.html Web app hacking...] - [Larry] - Well sort of.  IDG (who puts on Macworld) used Javascript to enhance the user's experience, and were "revealing" codes to get free $1600 platinum passes.  Now, the codes were hashed and "encrypted" ans were allegedly easily reversed.  I suspect that many web app testing products would have barfed all over this.  It is important (and time consuming) to have the human element involved.

[[Category:Show Notes]]