Skip to main content


Showing posts from December, 2008

Patch Tuesday Catylst for 0-Day Wednesday

As well intentioned as Microsoft is regarding getting security patches out to the public, they've created a vulnerability for people by setting a date for the release of security fixes each month and on a monthly basis. By releasing previously unknown (by Microsoft) vulnerabilities the day after the fixes are released they get maximum exposure (about 30 days or so) unless MS provides an out-of-band patch. Is this recent behavior enough to get Microsoft to abolish their practices of once a month patch releases? I think it should be - as patches should be released as soon as possible for each fix. But I also understand it costs money to test and out releases. Plus this still doesn't even touch the issue of the unannounced vulnerabilities, which in my opinion is a much greater risk than the ones we know about.

Early gifts - Security related products updated before the holiday

Not quite Christmas yet, but here are a few links of early presents to look into over the holidays: Burp Suite V1.2 - IMO the best security proxy / attack tool, and now with a paid-for license you get semi-automatic scanning! OSX 10.5.6 - not really a security tool - but some much sought-after fixes to some OSX problems. VirtualBox 2.1 - we all like useful things we don't have to pay for. Microsoft OOB Patch for Internet Explorer OLEDB Issue - Ok, maybe this isn't like a present, but we were all waiting for it to arrive still. NetworkMiner - Cool utility for extracting stuff from pcap files. OWASP V3 - The third edition of the community sourced effort to standardize application security testing. Happy Holidays!

Google Publishes Browser Security Handbook

In addition to other excellent google security products like ratproxy , they have released a handbook to browser security functionality, including details on support across all of the common platforms. After reading through this material, it is an essential resource to understanding common security issues related to the way browsers handle the security of a site. It also appears that its being expanded to include information on future browsers as they are released. It even includes sample code to describe the concepts which are discussed! Thank you Google for another great resource.

0-Day IE Vulnerability

Another example of a 0-day vulnerability has been described by SANS. This one on a fully-patched version of IE7 which according to recent browser stats 47% of you are using. As I've written about before, there appears to be more evidence pointing to the ineffectiveness of our existing controls - AV in dealing with these threats. The most worrying thing about the trend of 0-day exploits is how many unpatched exploits exist which haven't yet been reported? Based on the ability for researchers to turn these into profits I would bet that there are an equal number.

Consumer Benefits of Credit Card Security

Recently, new types of credit card security features have be debuted, such as this one from Visa. And as some of the comments on Bruce Schneier's blog point out, its questionable how effective this is. I want to figure out what the motivation is behind these ideas, as it appears banks and the major credit card brands are not completely transparent about the benefits to the consumer. My example is this, one source has that in 2005 $2.8 million was lost due to credit card fraud from Visa and MasterCard in Canada alone. These costs are absorbed by the credit card companies as they protect their cardholders from liability, but as can be expected these costs are directly applied to the card brand customers, people and merchants, in the form of fees and interest rates. Now lets say that card brands can deploy a technology to eliminate 90% of this fraud and associated insurance and liability costs. Likely a large savings both in Canada and globally. Would we, the public and mercha

Apple recommending OSX anti-virus? Is this true, do I run out and buy it?

As others have pointed out on November 21st, Apple silently recommends anti-virus products for OSX. "Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one application to circumvent, thus making the whole virus writing process more difficult." This isn't as clearly written as many of the other Apple support articles, and there are a few related topics which should have more clarity. Who is the audience for this advice? Is it the majority of non-technical mac owners who are unaware of the types of malware? Or is it all OSX users? Are they also recommended that multiple, as in more than one, anti-virus utilities be used at once? If so how many are recommended, two, three? Apple also has a handful of other references to anti-virus on OSX 10.5. As stated in a support article from April: "6) Check for Viruses Macs are far more less likely to get a computer virus like Windows PCs are prone to but that doesn'