Skip to main content

Posts

Showing posts from 2008

Patch Tuesday Catylst for 0-Day Wednesday

As well intentioned as Microsoft is regarding getting security patches out to the public, they've created a vulnerability for people by setting a date for the release of security fixes each month and on a monthly basis. By releasing previously unknown (by Microsoft) vulnerabilities the day after the fixes are released they get maximum exposure (about 30 days or so) unless MS provides an out-of-band patch.

Is this recent behavior enough to get Microsoft to abolish their practices of once a month patch releases? I think it should be - as patches should be released as soon as possible for each fix. But I also understand it costs money to test and out releases.

Plus this still doesn't even touch the issue of the unannounced vulnerabilities, which in my opinion is a much greater risk than the ones we know about.

Early gifts - Security related products updated before the holiday

Not quite Christmas yet, but here are a few links of early presents to look into over the holidays:

Burp Suite V1.2 - IMO the best security proxy / attack tool, and now with a paid-for license you get semi-automatic scanning!OSX 10.5.6 - not really a security tool - but some much sought-after fixes to some OSX problems.VirtualBox 2.1 - we all like useful things we don't have to pay for.Microsoft OOB Patch for Internet Explorer OLEDB Issue - Ok, maybe this isn't like a present, but we were all waiting for it to arrive still.NetworkMiner - Cool utility for extracting stuff from pcap files.OWASP V3 - The third edition of the community sourced effort to standardize application security testing.
Happy Holidays!

Google Publishes Browser Security Handbook

In addition to other excellent google security products like ratproxy, they have released a handbook to browser security functionality, including details on support across all of the common platforms.

After reading through this material, it is an essential resource to understanding common security issues related to the way browsers handle the security of a site. It also appears that its being expanded to include information on future browsers as they are released.

It even includes sample code to describe the concepts which are discussed! Thank you Google for another great resource.

0-Day IE Vulnerability

Another example of a 0-day vulnerability has been described by SANS. This one on a fully-patched version of IE7 which according to recent browser stats 47% of you are using.

As I've written about before, there appears to be more evidence pointing to the ineffectiveness of our existing controls - AV in dealing with these threats.

The most worrying thing about the trend of 0-day exploits is how many unpatched exploits exist which haven't yet been reported? Based on the ability for researchers to turn these into profits I would bet that there are an equal number.

Consumer Benefits of Credit Card Security

Recently, new types of credit card security features have be debuted, such as this one from Visa. And as some of the comments on Bruce Schneier's blog point out, its questionable how effective this is. I want to figure out what the motivation is behind these ideas, as it appears banks and the major credit card brands are not completely transparent about the benefits to the consumer.

My example is this, one source has that in 2005 $2.8 million was lost due to credit card fraud from Visa and MasterCard in Canada alone. These costs are absorbed by the credit card companies as they protect their cardholders from liability, but as can be expected these costs are directly applied to the card brand customers, people and merchants, in the form of fees and interest rates.

Now lets say that card brands can deploy a technology to eliminate 90% of this fraud and associated insurance and liability costs. Likely a large savings both in Canada and globally. Would we, the public and merchants…

Apple recommending OSX anti-virus? Is this true, do I run out and buy it?

As others have pointed out on November 21st, Apple silently recommends anti-virus products for OSX.
"Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one application to circumvent, thus making the whole virus writing process more difficult."
This isn't as clearly written as many of the other Apple support articles, and there are a few related topics which should have more clarity.
Who is the audience for this advice? Is it the majority of non-technical mac owners who are unaware of the types of malware? Or is it all OSX users?Are they also recommended that multiple, as in more than one, anti-virus utilities be used at once? If so how many are recommended, two, three?
Apple also has a handful of other references to anti-virus on OSX 10.5. As stated in a support article from April:

"6) Check for Viruses
Macs are far more less likely to get a computer virus like Windows PCs are prone to but that doesn't mean …

Passive Information Gathering Tools for Firefox

There are all kinds of great tools popping up these days to help the security professional with their job. Here are a couple of the ones that I've found useful:

PassiveRecon in particular automates, to some degree, the mining of social and public information which is available about a target without actually connecting in any way to the host or web service.

AdvancedDork provides an easy way to use the advanced Google options (googledorking) to find additional or more refined public information regarding what's highlighted.

Anytime a utility can help cut down on the amount of time it takes to collect information, and allows more time to be spent on analyzing what's found it gets put into the toolbox.

Distributed SQL Injection Analysis - Excellent Description!

The guys over at Bloombit (British Columbia based firm) have provided an excellent analysis of an automated encoded SQL Injection attack which describes many of the techniques that malware distributors are using these days. And also provides some good pointers on how to prevent them. A few of the key points I got from the article:
Enforcement of parameterized SQL statements is important where possible.Google and other web-based search tools are used to find starting points to conduct their probes (find your sites before they do!)Profit motivated criminals drive this issue - not script-kiddies.If you are involved in coding any database driven Internet sites or applications give this a read.

Google and AARP Security and Privacy Videos

Google and the former Assocation of American Retired Persons (AARP.org - via wikipedia) have co-produced a set of six videos geared to help educate the masses on the types of things people should be doing to protect themselves better on-line. The messages here are great for the average Internet user, and contains information on Safe starts, Practicing password safety, Sharing your content safely online, Know what's posted about you online, Shopping safely online, and Avoiding phishing scams.

Free Downloadable Log Management Tool - Q1 Labs

Q1 Labs has released a free version of their QRadar product - albeit a limited version (50 events / second). For any small or medium sized business that's looking to get a handle on their security logs from hosts firewalls and ID/PSs this seems like the right price point. Be aware that they are collecting contact information to that a sales guy will call and hopefully upsell you to the paid for enterprise version.

CIPS - ICE Conference Presentation

I was lucky enough to be invited to speak at the recent Computer Information Processing Society'sICE Conference with one of the senior auditors from the Office of the Auditor General of Alberta. Our talk regarding the Myths of IT Risk and Control was well received and had a lot of questions and interest from the crowd.

I've posted a copy of the presentation in both PDF and PPTX format for anyone that would like a copy. And if anyone would like me to present on this topic to their organization please just let me know.