In Through The Out Door

The researchers tracked three browsers (MSIE, Firefox, Opera) in 2004 and counted which days they were “known unsafe.” Their definition of “known unsafe”: a remotely exploitable security vulnerability had been publicly announced and no patch was yet available.MSIE was 98% unsafe. There were only 7 days in 2004 without an unpatched publicly disclosed security hole.Firefox was 15% unsafe…. That number is accidentally a little better than it should be, as two of the upatched periods happened to overlap.This underestimates the risk, because it doesn’t count vulnerabilities known to the bad guys but not publicly disclosed (and it’s foolish to think that such things don’t exist). So the “98% unsafe” figure for MSIE is generous, and the situation might be even worse.Wow.

Windows 0 Day Exploit:Fully patched Windows systems affected. It appears that a new zero-day exploit affecting fully-patched Windows installations is afoot, according to the Sans Internet Storm Center and users in our Security Forum. Merely viewing a malicious WMF image in Internet Explorer will install various..

Headline: Targeted hacking attacks tipped to rise:The new breed of cybercriminals who develop sophisticated targeted attacks against specific businesses will continue to be a serious threat in 2006, MessageLabs warned this week.In its 2005 Global Security Report, MessageLabs reported that it saw a significant increase in the number of targeted attacks on both organisations of all types in the last year.These included attacks where Trojan horse programs were sent to a certain company’s employees with the aim of using spyware to steal information. This danger was highlighted in March of this year, when an alleged attempt to use spyware to steal 220m from Japanese bank Sumitomo Mitsui was thwarted.MessageLabs said it is currently intercepting several targeted email attacks each week, and expects that data thieves may step up their activities next year.

New Tech Behind NSA Snoop Case?:There’s more to the NSA domestic spying case than the current storyline — that much is clear. The idea that the Bush Administration needed to bypass the courts to get wiretaps quickly makes no sense; under the current system, you can start eavesdropping, and get a warrant later. The notion that disclosing the surveillance would somehow tip off potential terrorists is laughable, too; Al Qaeda types know they’re being monitored.That’s all assuming, of course, that the wiretaps in this case are the same as in any other…. Look at what former senator Bob Graham (D-Fla.), who was briefed on the eavesdropping program, told the Washington Post: “I came out of the room with the full sense that we were dealing with a change in technology but not policy,” Graham said, with new opportunities to intercept overseas calls that passed through U.S. switches. Or what New York Times editor Bill Keller had to say about the paper’s year-long delay in breaking the story:In the course of subsequent reporting we satisfied ourselves that we could write about this program — withholding a number of technical details — in a way that would not expose any intelligence-gathering methods or capabilities that are not already on the public record.So maybe the NSA wiretaps were using a new kind of capability; one that terror suspects might not have know about; one that might have even made the FISA court uncomfortable, somehow.

From Europe, although I doubt it’s any different in the U.S.:One in five workers (21%) let family and friends use company laptops and PCs to access the Internet.More than half (51%) connect their own devices or gadgets to their work PC.A quarter of these do so every day.Around 60% admit to storing personal content on their work PC.One in ten confessed to downloading content at work they shouldn’t.Two thirds (62%) admitted they have a very limited knowledge of IT Security.More than half (51%) had no idea how to update the anti-virus protection on their company PC.Five percent say they have accessed areas of their IT system they shouldn’t have.One caveat: the study is from McAfee, and as the article rightly notes:Naturally McAfee has a vested interest in talking up this kind of threat….And finally:Based on its survey, McAfee has identified four types of employees who put their workplace at risk:The Security Softie – This group comprises the vast majority of employees. They have a very limited knowledge of security and put their business at risk through using their work computer at home or letting family members surf the Internet on their work PC.The Gadget Geek – Those that come to work armed with a variety of devices/gadgets, all of which get plugged into their PC.The Squatter – Those who use the company IT resources in ways they shouldn’t (i.e. by storing content or playing games).The Saboteur – A very small minority of employees. This group will maliciously hack into areas of the IT system to which they shouldn’t have access or infect the network purposely from withinI like the list.

NSA and Bush’s Illegal EavesdroppingWhen President Bush directed the National Security Agency to secretly eavesdrop on American citizens, he transferred an authority previously under the purview of the Justice Department to the Defense Department and bypassed the very laws put in place to protect Americans against widespread government eavesdropping…. The Justice Department can request FISA warrants to monitor foreign communications as well as communications by American citizens, provided that they meet certain minimal criteria.The FISC issued about 500 FISA warrants per year from 1979 through 1995, and has slowly increased subsequently — 1,758 were issued in 2004…. (We don’t know any details, of course, as the court proceedings are secret.)FISA warrants are carried out by the FBI, but in the days immediately after the terrorist attacks, there was a widespread perception in Washington that the FBI wasn’t up to dealing with these new threats — they couldn’t uncover plots in a timely manner…. Although there is no evidence that the Bush administration has employed Echelon to monitor communications to and from the U.S., this surveillance capability is probably exactly what the president wanted and may explain why the administration sought to bypass the FISA process of acquiring a warrant for searches.Perhaps the NSA just didn’t have any experience submitting FISA warrants, so Bush unilaterally waived that requirement…. Terrorism is a serious risk to our nation, but an even greater threat is the centralization of American political power in the hands of any single branch of the government.Over 200 years ago, the framers of the U.S. Constitution established an ingenious security device against tyrannical government: they divided government power among three different bodies.

Ping: ICMP vs. ARP:Network and system administrators are well-versed in using the ping utility for troubleshooting purposes, but where do you turn when ping doesn’t do the trick?

Mark Rasch: Tracked by cellphone:

Infocus: Demystifying Denial-Of-Service attacks, part one…:

Infocus: Demystifying Denial-Of-Service attacks, part one

Brief: Industry gives U.S. security efforts Cs…:

Brief: Industry gives U.S. security efforts Cs and Ds

The Internet is Broken:MIT Tech Review’s three part series. MIT Technology Review has been running a three part series (Part 1, Part 2, Part 3) entitled “The Internet is broken”. The first part explores some of the Internet’s basic security and performance flaws, the second part explores some ideas on how to..

Rootkits - A Sign Of Things To Come:

Security-Enhanced Linux Moving into Mainstream:Security Enhanced Linux has moved into the mainstream of operating system architecture in recent years. For those who don’t understand the technology, many articles exist.

Practical VoIP Using VOCAL:While many books describe the theory behind Voice over IP, only Practical VoIP Using VOCAL describes how such a phone system was actually built, and how you too can acquire the source code, install it onto a system, connect phones, and make calls. VOCAL (the Vovida Open Communication Application Library) is an open source software project that provides call control, routing, media, policy, billing information and provisioning on a system that can range from a single box in a lab with a few test phones to a large, multi-host carrier grade network supporting hundreds of thousands of users…. A Silicon Valley start-up called Vovida Networks, Inc (think of VOice, VIdeo, DAta) created VOCAL and invested over one hundred man years into its development…. Because VOCAL is open source, you can look “under the hood” to the base code and protocol stack levels and discover not only how the system works, but also how common problems are being worked out in the development environment…. Written by a team from Vovida Networks, Practical VoIP Using VOCAL includes the following topics: Installing and configuring VOCAL 1.4.0 onto a single host and onto a multi-host network with phones and gateways C++, C and Java architecture found within VOCAL Provisioning a VoIP system SIP (Session Initiation Protocol), SDP (Session Description Protocol) and RTP (Real-time Transport Protocol) for call control and media TRIP (Telephony Routing over IP), DNS SRV and ENUM for routing MGCP (Media Gateway Control Protocol) and H.323 for call control and translation into SIP COPS (Common Open Policy Service), OSP (Open Settlement Protocol) and RSVP (Reservation Protocol) for policy and Quality of Service RADIUS (Remote Authentication Dial In User Service) for interfacing with billing servers SNMP (Simple Network Management Protocol) If you’re interested in VoIP, this is the only book available that focuses on the real issues facing programmers and administrators who need to work with these technologies.

N-Eye
Published: 2005-12-17,
Last Updated: 2005-12-17 18:22:12 UTC by Kevin Liston (Version: 1)
While checking out the Chinese Honeynet Project, I happened upon their tool N-Eye: http://www.honeynet.org.cn/honeyneten/Tool.htm

Google’s use of MySQL:There’s a good blog article on the Xooglers (ex-Googlers) web site about how they use MySQL to run their adwords program.  If you’re not familiar, adwords generates something like 99.9% of Google’s advertising revenues, so it certainly a business critical application.  While Google is generally quite secretive about their internal operations, there are some interesting tidbits in this posting about how Google tried a commercial, closed-source database but it was never able to perform as well as MySQL.  A few select quotes: "AdWords was built using the MySQL database, which is open-source and therefore available for free. It is by now also nearly as full-featured as the best commercial databases, but back in 2000 this was not the case." "Many managers seem to have this idea that it is invariably true that you get what you pay for, and that therefore nothing that is available for free can possibly be any good. Using MySQL was acceptable as an expedient to get things up and running quickly and with a minimal of capital outlay, but now that things were settling down it was time to recognize that this was really, fundamentally, a mistake, and it should be fixed sooner rather than later." "We finally decided to go with a commercial database (I won’t say which one) over the objections of a number of engineers, including myself…. Some heroic optimization efforts eventually produced acceptable performance, but it was never as good as the old MySQL-based system had been." "I have heard through the grapevine that they eventually went back to MySQL. (Since then, MySQL has added many of the features that had been missing at the time.)"It’s a good article and provides some insight into the thinking around open source from a user’s perspective.  Here’s a couple of other interesting links.

My sysadmin toolbox:I’m that odd guy who puts Linux on virtually everything, and will take something apart just because I can. My Linksys WRT54G runs Talisman from Sveasoft, my iPaq runs Familiar, and even my TiVos (DirecTiVo and Series 2) have been hacked up a bit. So what does a guy like me use for software tools?

Creating secure wireless access points with OpenBSD and OpenVPN:You know how insecure 802.11x wireless networks are. In this article we’ll create an OpenBSD-based secure wireless access point that prevents unauthorized access and encrypts every packet using a VPN tunnel. OpenBSD is one of the most secure operating systems available, is easy to use, and includes almost everything you need for this project in the base installation.

Sleepycat releases Berkeley DB 4.4:After spending a year enhancing Berkeley DB, Sleepycat Software has released version 4.4.

How about 99-cent software that’s available for Windows and Macs and that constantly backs up your files in the background?… It works with any attached drives, including pen drives, MP3 players and, of course, hard drives.You can set it to immediately back up changed files or make the back ups every certain number of minutes…. I had a good experience with the Windows version saving to a second hard drive, but couldn’t get the Mac version to work across a LAN because of networking problems on my end.The 99-cent deal ends on Dec. 31, when the price returns to $29.95. The 90-day special is an effort by NTI to attract customers to the site to possibly purchase other products, including its traditional backup application called NTI Backup Now!… But you might find that the 99-cent version is enough back-up power for you.