Planet Security

July 04, 2009

LiquidMatrixProfessor Gets 4 Years For Sharing Drone Data

drone

Not entirely sure what the thought process was of John Roth who, after being warned, still travelled to China with a laptop containing military data relating to drones…and then shared said information with a Chinese and Iranian student.

Um, yeah.

From Scientific American:

John Reece Roth, 71, a prominent plasma physicist was sentenced to four years in prison for 18 counts of conspiracy, wire fraud and violations of the Arms Export Control Act, after he allowed a Chinese graduate student to see sensitive information on Unmanned Air Vehicles (UAVs), also known as drones.

“The illegal export of restricted military data represents a serious threat to national security,” David Kris of the U.S. Department of Justice, said in a statement, “We know that foreign governments are actively seeking this information for their own military development. Today’s sentence should serve as a warning to anyone who knowingly discloses restricted military data in violation of our laws.”

Only 4 years? I think he got off easy.

Article Link


Emergent ChaosVa Pbaterff Nffrzoyrq, Whyl 4 1776

My usual celebration of Independence day is to post, in its entirety, the Declaration of Independence. It's very much worth reading, but this year, there's a little twist, from a delightful story starring Lawren Smithline and Robert Patterson, with a cameo by Thomas Jefferson. Patterson sent Jefferson a letter which read, in part:
“I shall conclude this paper with a specimen of such writing,” he boasted, “which I may safely defy the united ingenuity of the whole human race to decypher to the end of time….”
patterson-enciphered-declaration.jpg
Well, perhaps it didn't last until the end of time, but the cipher apparently lasted until now, which is pretty darn good. There's an article in Harvard Magazine, and one in American Scientist, but it's behind a paywall. Finally, the Wall St Journal has an article, which mentions, both without linking to either.

I think what I really like about this story is how a mathematician bothered to send his new ciphertext to the author of Virginia's statue on religious liberty (as our third President preferred to be remembered). Having just finished Steven Johnson's very enjoyable "The Invention of Air," I'm struck by how broadly engaged with science and the useful arts the founders were. I think that sending an encrypted letter to President Obama would get you ... well, I don't really want to think about it, having just read the Declaration.

Fergie's Tech BlogIndependence Day 2009: Born in The USA



Happy Birthday, USA.

- ferg

Fergie's Tech BlogIndependence Day 2009 - Lest We Forget


You Are Not Forgotten.



Happy 233rd Birthday, USA.

- ferg

Fergie's Tech BlogU.S. Toll In Iraq, Afghanistan


Iraq and Afghanistan statistics via The Boston Globe (AP).

As of Friday, July 3, 2009, at least 4,322 members of the U.S. military had died in the Iraq war since it began in March 2003, according to an Associated Press count.

The figure includes nine military civilians killed in action. At least 3,456 military personnel died as a result of hostile action, according to the military's numbers.

The AP count is one more than the Defense Department's tally, last updated Thursday at 10 a.m. EDT.

As of Friday, July 3, 2009, at least 642 members of the U.S. military had died in Afghanistan, Pakistan and Uzbekistan as a result of the U.S. invasion of Afghanistan in late 2001, according to the Defense Department. The department last updated its figures Thursday at 10 a.m. EDT.

Of those, the military reports 475 were killed by hostile action.

More here and here.

And as always, the Iraq Coalition Casualty Count keeps the grim watch on their website here.

Honor the Fallen.

Computer DefenseTerminology Woes

Tonight I started thinking that one of the biggest problems affecting IT today is the lack of a clearly defined terminology (both terms and acronyms). Sure certain things have had standardization (CPE comes to mind as a great example) but generally terms are not common across the board. Let's consider a few examples.

VM - Do I mean Vulnerability Management or Virtual Machine? Depending on the industry it could mean either or both.
FP - Do I mean Fingerprint or False Positive? Again, the industry dictates the meaning or both meanings.

There was a period of time where people referred to Cross Site Scripting as CSS... occasionally I still see it places. How about RE? I'm sitting here looking at the spine of 'Reverse Engineering Code with IDA Pro'. The spine says 'RE Code with IDA Pro' but RE commonly refers to regular expressions as well. The list goes on and on, and I think it is a problem that hurts us across the industry. Now miscommunication may not occur because there's generally context around the term but it can happen. I think the bigger issue is misrepresentation outside of the industry. This could be outside of IT, or could be within disciplines of IT.

Take, for example, this blog post on the SecuriTeam blog. The title is 'Mysql authentication bypass'. I was rather excited when I saw the title in my feed reader, I thought that someone had found a way to bypass authentication and access the MySQL database directly. It turns out this wasn't the case. Instead it was talking about a method of SQL Injection that will bypass many filters/IDS and works only against MySQL, it was also a discussion that was 6 months old. A comment pointed out that this wasn't a MySQL Authentication Bypass and I tend to agree, the author disagreed in the comments.

As I see it, an Authentication Bypass is when you are bypassing the authentication process into software or a website. Prefixing it with MySQL leads me to believe we are bypassing the authentication process in mysqld. SQL Injection is so much more than simply bypassing authentication, and at the same time bypassing a filter/IDS is so much less than SQL Injection. The author of the blog post was fairly insistent that he'd titled the blost properly yet I think this is a prime example of terminology failing us.

Is there a way for us to work around this issue, or will it always exist?

Professional Security TestersEC-Council Awarded More NSA CNSS Certifications

EC-Council Awarded More NSA CNSS Certifications

EC-Council Courseware for Certified Ethical Hacker (C|EH), Computer Hacking Forensics Investigator (C|HFI), Disaster Recovery Professional (E|DRP), Certified Security Analyst (E|CSA) and Licensed Penetration Tester (L|PT) Courseware has been certified at the highest national level by the Committee of National Security Systems (CNSS).

The CNSS is a federal government entity under the U.S. Department of Defense that provides procedures and guidance for the protection of national security systems. The NSA certified these programs as meeting the CNSS 4012, 4013A, 4014, 4015 and 4016 training standards for information security professionals in the federal government.

Read more HERE.

1raindropWebsite Kidnapping

Who says business people don't understand security? The former marketing firm for Steak 'n Shake has executed a DoS, the Varnson Group is holding Steak n Shake's website hostage in a payment dispute.


The Varnson Group signed a $4.36 million, 26-month contract in mid-November, with just over half of that to be paid in Steak n Shake stock. Steak n Shake terminated the deal in early February. 

The lawsuit filed by Steak n Shake March 3 in Indianapolis doesn’t go into why the company and Varnson split. Rather, it deals with the aftermath of the breakup. Steak n Shake claims the agency is refusing to turn over myriad proprietary material, including data, Steak n Shake’s marks, promotional materials, photographs, coupon templates and other print advertisement templates. 

Additionally, Steak n Shake claims The Varnson Group refuses to release a Web site domain name where customers can access and print online coupons. Steak n Shake is seeking unspecified damages and return of the proprietary information. 


As far as we know the Hamburgler is not implicated.

Professional Security TestersOfficial Study Guide for the CEH exam

Product Description
Prepare for the CEH certification exam with this official review guide and learn how to identify security risks to networks and computers. This easy-to-use guide is organized by exam objectives for quick review so you’ll be able to get the serious preparation you need for the challenging Certified Ethical Hacker certification exam 312-50. As the only review guide officially endorsed by EC-Council, this concise book covers all of the exam objectives and includes a CD with a host of additional study tools.

From the Back Cover
Prepare for the CEH certification exam with this official review guide

Learn how to identify security risks to networks and computers and get the serious preparation you need for the challenging Certified Ethical Hacker certification exam 312-50. The only review guide officially endorsed by EC-Council, this concise book covers all of the exam objectives and includes a CD with a host of additional study tools.

  • Easy-to-use book is organized by exam objectives for quick review
  • Flexible review guide goes hand-in-hand with any learning tool on the market
  • "Exam Essentials" in each chapter helps you zero in on what you need to know
  • Book includes over 300 review questions and practice tools

Look inside for complete review coverage of all exam objectives for CEH exam 312-50.

Featured on the CD

SYBEX TEST ENGINE
Test your knowledge with advanced testing software. Includes bonus exams and glossary.

ELECTRONIC FLASHCARDS
Reinforce your understanding with flashcards that can run on your PC, Pocket PC, or Palm handheld.

Officiel CEH study book

 

Click Here for more information or to buy from Amazon.comalt

Fergie's Tech BlogEyeWonder Malware Incident Affects Popular Web Sites

Dancho Danchev writes on the ZDNet "Zero day" Blog:

During the last couple of hours, visitors of popular and high trafficked web sites such as CNN, BBC, Washington Post, Gamespot, WorldOfWarcraft, Mashable, Chow.com, ITpro.co.uk, AndroidCommunity; Engadget and Chip.de, started reporting that parts of the web sites are unreachable due to malware warnings appearing through the EyeWonder interactive digital advertising provider.

Let’s assess the butterfly effect of a single malware incident affecting an ad network whose ads get syndicated across the entire Web.

What originally started as “we have been mistakenly flagged as malware“, briefly turned into “appears the EW.com domain was potentially maliciously “hacked” causing these errant and erroneous alerts to appear” malware incident.

Is the EyeWonder attack a typical malvertising campaign where malicious content is pushed on legitimate sites through the ad network, or did their web site actually got compromised in the ongoing Cold Fusion web sites compromise attack?

Sadly, it could be an indication of both, since I managed to reproduce the actual exploit serving attack at the Washington Post, using the exact link given by an affected reader within the comments of the article. However, what might have triggered the actual badware alert appears to a compromise of the site itself.

More here.

Emergent ChaosThoughts on Iran

Our love affair with the Iranian Tweetolution has worn off. The thugs declared their election valid, told their armed representatives to

Sorry, next tweet: go impose some law or order or something, and it was done.

Well, as it often turns out, there was more to it than fits in 140 characters, and the real story is far more complicated. There's a good write up from StratFor, "The Real Struggle in Iran and Implications for U.S. Dialogue:"

This is because the real struggle in Iran has not yet been settled, nor was it ever about the liberalization of the regime. Rather, it has been about the role of the clergy — particularly the old-guard clergy — in Iranian life, and the future of particular personalities among this clergy.

[...]

The key to understanding the situation in Iran is realizing that the past weeks have seen not an uprising against the regime, but a struggle within the regime. Ahmadinejad is not part of the establishment, but rather has been struggling against it, accusing it of having betrayed the principles of the Islamic Revolution. The post-election unrest in Iran therefore was not a matter of a repressive regime suppressing liberals (as in Prague in 1989), but a struggle between two Islamist factions that are each committed to the regime, but opposed to each other.

BufferOverrunimg200.jpg [Flickr]

July 03, 2009

The Register - Security McAfee false-positive glitch fells PCs worldwide

When AV attacks

IT admins across the globe are letting out a collective groan after servers and PCs running McAfee VirusScan were brought down when the anti-virus program attack their core system files. In some cases, this caused the machines to display the dreaded blue screen of death.…

Case Study: WhatsUp keeps Legoland turnstyles ringing

Privacy DigestApple patching serious SMS vulnerability on iPhone

Apple patching serious SMS vulnerability on iPhone: Via computerworld.

Apple may be working to fix an iPhone vulnerability that could possibly allow an attacker to remotely install and run unsigned software code with root access to the phone.

The theoretical attack in question exploits a weakness in the way iPhones handle text messages received via SMS (Short Message Service), said security researcher Charlie Miller, during a presentation at the SyScan conference in Singapore on Thursday. He didn't provide a detailed technical description of the SMS vulnerability.

Miller, the principal security analyst at Independent Security Evaluators, is an authority on MacOS X security, and is a co-author of The Mac Hacker's Handbook. He and another security researcher, Colin Mulliner, discovered the SMS vulnerability together.

An SMS flaw might allow an attacker to run software code on the phone that is sent by SMS over a mobile operator's network. In Miller's case, it appears he used the flaw he found to remotely crash an iPhone, a sign that a more serious attack might be possible.

"I don't have a working exploit for it, just a suspicious looking crash," Miller said.  read more »

hackadayLego modded antenna tuner


legomoddedtunner

This antenna tuner is controlled remotely using geared motors and legos. The tuner needed to be closer to the antenna for performance reasons. This created a problem; most of the radio gear is inside while the tuner is outside. The gear motors and Legos combine to form a closed loop servo, operating two air core caps and an inductor switch. A control box placed near the radio is hard wired to the modded tuner outside. We would like to see something like this under gesture control using the Wii MotionPlus + Arduino.

Schneier on SecurityFriday Squid Blogging: Office Squid

Schneier on SecurityFriday Squid Blogging: Office Squid

Schneier on SecurityFriday Squid Blogging: Office Squid

SANS Internet Storm CenterBCP/DRP, (Fri, Jul 3rd)

Question, what do Bing.com and Authorize.net have in common? Who would have guessed that they both have servers located in a data center that has had a fire? Or that they may have to put more into the planning portion of Disaster Recovery and Business Continuity? Authorize.net has been completely down for several hours now. Bing.com/travel had this to say: A fire occurred at Fisher Plaza in downtown Seattle just after midnight on Friday morning. The blown transformer knocked out power to the entire building, which is home to the Bing Travel servers. We're hard at work to restore service following this unexpected event. Our current estimate for re-establishing Bing Travel functionality is 5pm PST, July 3rd. Perhaps they should have read one of our SANS papers on BCP/DRP planning. Reading room link is here. More information is available at this twitter http://twitter.com/authorizenet where Authorize.net are tweeting. The media are also following the story, KOMO a local station was knocked offline but are broadcasting from a backup site.
Update: Authorize.net appear to be at least partially back up and running.


Cheers,

Adrien de Beaupr

EWA-Canada.com
Teaching SANS Cutting-Edge Hacking Techniques in Ottawa this September.

Errata SecurityThe Economist on the Kindle

You can now get a subscription to the Economist on the Kindle (or Kindle readers on devices like the iPhone).

Economics is the red pill. It explains how the world really works. Whereas a normal newspaper will report an event as inexplicable, The Economist might explain how it's the expected result of an economics concept, like decreasing marginal returns, incentives, opportunity cost, etc.

For example, last year a hurricane took out oil refinery production in the south. The result was long gas lines, with people waiting hours to get gasoline. Typical news stories talked about how the government should act to reduce prices, shorten lines, and crack down on "gougers". Economics explains that the gas lines are the direct consequence of the government's anti-gouging law, and that if the government allowed "gouging", prices would rise a little bit and the lines would disappear.

If you know basic economics, The Economist is a great explanation of the news. If you don't, then it's a great use of the news to explain basic economics. Or, a combination of both: I studied economics in college, but it wasn't until I started ready The Economist that I really started to grok the subject.

If you want to learn economics, I recommend Principles of Economics by Greg Mankiw.

PS: The Economist has a left-wing bias like much of the rest of the media, but at least it's a saner left-wing bias. For example, it believes in global warming, but correctly points out that the "cap-and-trade" mechanism used in Europe (and soon to be used in the United States if the Senate bill passes) is expensive and corrupt, compared to a more efficient and transparent carbon tax.

PPS: The Kindle isn't the future of publishing, but it certainly fits my lifestyle of heavy reading and traveling.

SANS Internet Storm CenterHappy 4th of July!, (Fri, Jul 3rd)

Celebrate, watch fireworks, but don't click on links in emails or surf to sites with Fourth of July, Independence day, or Fireworks as key words. Websense is reporting that Waledac will be using the above subjects in emails with links to sites that appear to be a video, but instead downloads malware. Their alert is here. More information is also available at the ESET blog here.


Cheers,

Adrien de Beaupr

EWA-Canada.com
Teaching SANS Cutting-Edge Hacking Techniques in Ottawa this September.

Schneier on SecurityThe Pros and Cons of Password Masking

Usability guru Jakob Nielsen opened up a can of worms when he made the case for unmasking passwords in his blog. I chimed in that I agreed. Almost 165 comments on my blog (and several articles, essays, and many other blog posts) later, the consensus is that we were wrong.

I was certainly too glib. Like any security countermeasure, password masking has value. But like any countermeasure, password masking is not a panacea. And the costs of password masking need to be balanced with the benefits.

The cost is accuracy. When users don't get visual feedback from what they're typing, they're more prone to make mistakes. This is especially true with character strings that have non-standard characters and capitalization. This has several ancillary costs:

  • Users get pissed off.
  • Users are more likely to choose easy-to-type passwords, reducing both mistakes and security. Removing password masking will make people more comfortable with complicated passwords: they'll become easier to memorize and easier to use.

The benefits of password masking are more obvious:

  • Security from shoulder surfing. If people can't look over your shoulder and see what you're typing, they're much less likely to be able to steal your password. Yes, they can look at your fingers instead, but that's much harder than looking at the screen. Surveillance cameras are also an issue: it's easier to watch someone's fingers on recorded video, but reading a cleartext password off a screen is trivial.

    In some situations, there is a trust dynamic involved. Do you type your password while your boss is standing over your shoulder watching? How about your spouse or partner? Your parent or child? Your teacher or students? At ATMs, there's a social convention of standing away from someone using the machine, but that convention doesn't apply to computers. You might not trust the person standing next to you enough to let him see your password, but don't feel comfortable telling him to look away. Password masking solves that social awkwardness.

  • Security from screen scraping malware. This is less of an issue; keyboard loggers are more common and unaffected by password masking. And if you have that kind of malware on your computer, you've got all sorts of problems.

  • A security "signal." Password masking alerts users, and I'm thinking users who aren't particularly security savvy, that passwords are a secret.

I believe that shoulder surfing isn't nearly the problem it's made out to be. One, lots of people use their computers in private, with no one looking over their shoulders. Two, personal handheld devices are used very close to the body, making shoulder surfing all that much harder. Three, it's hard to quickly and accurately memorize a random non-alphanumeric string that flashes on the screen for a second or so.

This is not to say that shoulder surfing isn't a threat. It is. And, as many readers pointed out, password masking is one of the reasons it isn't more of a threat. And the threat is greater for those who are not fluent computer users: slow typists and people who are likely to choose bad passwords. But I believe that the risks are overstated.

Password masking is definitely important on public terminals with short PINs. (I'm thinking of ATMs.) The value of the PIN is large, shoulder surfing is more common, and a four-digit PIN is easy to remember in any case.

And lastly, this problem largely disappears on the Internet on your personal computer. Most browsers include the ability to save and then automatically populate password fields, making the usability problem go away at the expense of another security problem (the security of the password becomes the security of the computer). There's a Firefox plugin that gets rid of password masking. And programs like my own Password Safe allow passwords to be cut and pasted into applications, also eliminating the usability problem.

One approach is to make it a configurable option. High-risk banking applications could turn password masking on by default; other applications could turn it off by default. Browsers in public locations could turn it on by default. I like this, but it complicates the user interface.

A reader mentioned BlackBerry's solution, which is to display each character briefly before masking it; that seems like an excellent compromise.

I, for one, would like the option. I cannot type complicated WEP keys into Windows -- twice! what's the deal with that? -- without making mistakes. I cannot type my rarely used and very complicated PGP keys without making a mistake unless I turn off password masking. That's what I was reacting to when I said "I agree."

So was I wrong? Maybe. Okay, probably. Password masking definitely improves security; many readers pointed out that they regularly use their computer in crowded environments, and rely on password masking to protect their passwords. On the other hand, password masking reduces accuracy and makes it less likely that users will choose secure and hard-to-remember passwords, I will concede that the password masking trade-off is more beneficial than I thought in my snap reaction, but also that the answer is not nearly as obvious as we have historically assumed.

Schneier on SecurityThe Pros and Cons of Password Masking

Usability guru Jakob Nielsen opened up a can of worms when he made the case for unmasking passwords in his blog. I chimed in that I agreed. Almost 165 comments on my blog (and several articles, essays, and many other blog posts) later, the consensus is that we were wrong.

I was certainly too glib. Like any security countermeasure, password masking has value. But like any countermeasure, password masking is not a panacea. And the costs of password masking need to be balanced with the benefits.

The cost is accuracy. When users don't get visual feedback from what they're typing, they're more prone to make mistakes. This is especially true with character strings that have non-standard characters and capitalization. This has several ancillary costs:

  • Users get pissed off.
  • Users are more likely to choose easy-to-type passwords, reducing both mistakes and security. Removing password masking will make people more comfortable with complicated passwords: they'll become easier to memorize and easier to use.

The benefits of password masking are more obvious:

  • Security from shoulder surfing. If people can't look over your shoulder and see what you're typing, they're much less likely to be able to steal your password. Yes, they can look at your fingers instead, but that's much harder than looking at the screen. Surveillance cameras are also an issue: it's easier to watch someone's fingers on recorded video, but reading a cleartext password off a screen is trivial.

    In some situations, there is a trust dynamic involved. Do you type your password while your boss is standing over your shoulder watching? How about your spouse or partner? Your parent or child? Your teacher or students? At ATMs, there's a social convention of standing away from someone using the machine, but that convention doesn't apply to computers. You might not trust the person standing next to you enough to let him see your password, but don't feel comfortable telling him to look away. Password masking solves that social awkwardness.

  • Security from screen scraping malware. This is less of an issue; keyboard loggers are more common and unaffected by password masking. And if you have that kind of malware on your computer, you've got all sorts of problems.

  • A security "signal." Password masking alerts users, and I'm thinking users who aren't particularly security savvy, that passwords are a secret.

I believe that shoulder surfing isn't nearly the problem it's made out to be. One, lots of people use their computers in private, with no one looking over their shoulders. Two, personal handheld devices are used very close to the body, making shoulder surfing all that much harder. Three, it's hard to quickly and accurately memorize a random non-alphanumeric string that flashes on the screen for a second or so.

This is not to say that shoulder surfing isn't a threat. It is. And, as many readers pointed out, password masking is one of the reasons it isn't more of a threat. And the threat is greater for those who are not fluent computer users: slow typists and people who are likely to choose bad passwords. But I believe that the risks are overstated.

Password masking is definitely important on public terminals with short PINs. (I'm thinking of ATMs.) The value of the PIN is large, shoulder surfing is more common, and a four-digit PIN is easy to remember in any case.

And lastly, this problem largely disappears on the Internet on your personal computer. Most browsers include the ability to save and then automatically populate password fields, making the usability problem go away at the expense of another security problem (the security of the password becomes the security of the computer). There's a Firefox plugin that gets rid of password masking. And programs like my own Password Safe allow passwords to be cut and pasted into applications, also eliminating the usability problem.

One approach is to make it a configurable option. High-risk banking applications could turn password masking on by default; other applications could turn it off by default. Browsers in public locations could turn it on by default. I like this, but it complicates the user interface.

A reader mentioned BlackBerry's solution, which is to display each character briefly before masking it; that seems like an excellent compromise.

I, for one, would like the option. I cannot type complicated WEP keys into Windows -- twice! what's the deal with that? -- without making mistakes. I cannot type my rarely used and very complicated PGP keys without making a mistake unless I turn off password masking. That's what I was reacting to when I said "I agree."

So was I wrong? Maybe. Okay, probably. Password masking definitely improves security; many readers pointed out that they regularly use their computer in crowded environments, and rely on password masking to protect their passwords. On the other hand, password masking reduces accuracy and makes it less likely that users will choose secure and hard-to-remember passwords, I will concede that the password masking trade-off is more beneficial than I thought in my snap reaction, but also that the answer is not nearly as obvious as we have historically assumed.

Schneier on SecurityThe Pros and Cons of Password Masking

Usability guru Jakob Nielsen opened up a can of worms when he made the case for unmasking passwords in his blog. I chimed in that I agreed. Almost 165 comments on my blog (and several articles, essays, and many other blog posts) later, the consensus is that we were wrong.

I was certainly too glib. Like any security countermeasure, password masking has value. But like any countermeasure, password masking is not a panacea. And the costs of password masking need to be balanced with the benefits.

The cost is accuracy. When users don't get visual feedback from what they're typing, they're more prone to make mistakes. This is especially true with character strings that have non-standard characters and capitalization. This has several ancillary costs:

  • Users get pissed off.
  • Users are more likely to choose easy-to-type passwords, reducing both mistakes and security. Removing password masking will make people more comfortable with complicated passwords: they'll become easier to memorize and easier to use.

The benefits of password masking are more obvious:

  • Security from shoulder surfing. If people can't look over your shoulder and see what you're typing, they're much less likely to be able to steal your password. Yes, they can look at your fingers instead, but that's much harder than looking at the screen. Surveillance cameras are also an issue: it's easier to watch someone's fingers on recorded video, but reading a cleartext password off a screen is trivial.

    In some situations, there is a trust dynamic involved. Do you type your password while your boss is standing over your shoulder watching? How about your spouse or partner? Your parent or child? Your teacher or students? At ATMs, there's a social convention of standing away from someone using the machine, but that convention doesn't apply to computers. You might not trust the person standing next to you enough to let him see your password, but don't feel comfortable telling him to look away. Password masking solves that social awkwardness.

  • Security from screen scraping malware. This is less of an issue; keyboard loggers are more common and unaffected by password masking. And if you have that kind of malware on your computer, you've got all sorts of problems.

  • A security "signal." Password masking alerts users, and I'm thinking users who aren't particularly security savvy, that passwords are a secret.

I believe that shoulder surfing isn't nearly the problem it's made out to be. One, lots of people use their computers in private, with no one looking over their shoulders. Two, personal handheld devices are used very close to the body, making shoulder surfing all that much harder. Three, it's hard to quickly and accurately memorize a random non-alphanumeric string that flashes on the screen for a second or so.

This is not to say that shoulder surfing isn't a threat. It is. And, as many readers pointed out, password masking is one of the reasons it isn't more of a threat. And the threat is greater for those who are not fluent computer users: slow typists and people who are likely to choose bad passwords. But I believe that the risks are overstated.

Password masking is definitely important on public terminals with short PINs. (I'm thinking of ATMs.) The value of the PIN is large, shoulder surfing is more common, and a four-digit PIN is easy to remember in any case.

And lastly, this problem largely disappears on the Internet on your personal computer. Most browsers include the ability to save and then automatically populate password fields, making the usability problem go away at the expense of another security problem (the security of the password becomes the security of the computer). There's a Firefox plugin that gets rid of password masking. And programs like my own Password Safe allow passwords to be cut and pasted into applications, also eliminating the usability problem.

One approach is to make it a configurable option. High-risk banking applications could turn password masking on by default; other applications could turn it off by default. Browsers in public locations could turn it on by default. I like this, but it complicates the user interface.

A reader mentioned BlackBerry's solution, which is to display each character briefly before masking it; that seems like an excellent compromise.

I, for one, would like the option. I cannot type complicated WEP keys into Windows -- twice! what's the deal with that? -- without making mistakes. I cannot type my rarely used and very complicated PGP keys without making a mistake unless I turn off password masking. That's what I was reacting to when I said "I agree."

So was I wrong? Maybe. Okay, probably. Password masking definitely improves security; many readers pointed out that they regularly use their computer in crowded environments, and rely on password masking to protect their passwords. On the other hand, password masking reduces accuracy and makes it less likely that users will choose secure and hard-to-remember passwords, I will concede that the password masking trade-off is more beneficial than I thought in my snap reaction, but also that the answer is not nearly as obvious as we have historically assumed.

hackadayLast day to preorder your Bus Pirate


Bus Pirate banner by Aaron Silber http://theajblog.com/

Today is the last day to pre-order a Bus Pirate. Get your own Bus Pirate, fully assembled and shipped worldwide, for only $30. We don’t plan to make more soon, this could be your last chance.

A special shout out to our partner, Seeed Studio, who handled the rush of orders like pros. The first pre-order is already being manufactured, and will ship as soon as possible. Seeed still has a few V2a PCBs if you’d like to roll your own Bus Pirate.

You’ve made this pre-order a huge success, and we’d like to make more projects available in the future. Were you just interested in the Bus Pirate? Should we arrange pre-orders of future Hack a Day hardware? Are there any past projects that we should revisit?

Thanks for the artwork [Aaron], licensed under Creative Commons Attribution 3.0.

The Register - Security Kentucky payroll phishing scam nets small fortune

Blue grass county hit by Trojan-fueled cybercrime

A gang of cybercrooks has made off with $415,000 from the coffers of Bullitt County, Kentucky following the conclusion of an elaborate phishing scam, The Washington Post reports.…

Financial CryptographyChina regulates virtual money

Jim points to: China bans online 'gold farming' by Dave Rosenberg China has unveiled the first official rule on the use of virtual currency in the trade of real goods and services to limit possible impact on the real financial system. The Chinese government also spelled out the definition of "virtual currency" for the first time, which includes prepaid cards of cybergames, according to a joint announcement from the Ministry of Culture and the Ministry of Commerce Friday. It said: The virtual currency, which is converted into real money at a certain exchange rate, will only be allowed to trade in virtual goods and services provided by its issuer, not real goods and services. So effectively, the virtual currency is locked into one obvious thing, one scope, that we all feel good about. It is such a feeling of de ja vue that I feel I have to write about it. In the early 1990s there was a phenomena called digital cash that rode a wave of hype. Superficially it surrounded the DigiCash company and invention in the Netherlands, but it was also driven by the European smartcard invention. In response to the normal and baseless FUD, the Bundesbank (central bank of Germany) decided that digital cash in all its forms must be banned for all except banks. The reasons for this I won't go into at the moment. So, the Bundesbank led a project to create a Directive (European super-law) to reserve all issuance of money to the banks. It created a sort of exception that said "if you look like a bank, smell like a bank and taste like a bank, then you can be a money issuer." Nobody much was fooled. Digital money took off in the Americas and other places, where either the powers-that-be understood and left well alone, or they didn't notice, and ignored. Later on came the cleanup effort. After a decade of waiting, the Europeans realised they'd been tricked. So they rewrote the directive to be much friendly, in 2000. It still wasn't enough because they still thought they knew how to do this, and they still thought that banks had a reasonable case. Now, in 2008, they've just released another directive that significantly opens it up, and allows full virtual money to be issued by a non-bank. It's still tight, far too tight for innovation. But there are clear signs in there that they no longer believe this should be banking, and we can probably predict that by the time the 2015 directive is released, it will be workable. Now here comes China, around 15 years behind the Europeans: The ban is primarily aimed at "gold farming," an Internet-age phenomenon in which players in less developed countries collect and sell virtual gold (common to games like World of Warcraft) to wealthier gamers in the developed world. This enables gamers who have the means to buy virtual gold to get ahead in the games without actually having to accomplish the grunt work. One assumes that China is not regulating games at all, that would be beyond stupidity for China to say what is fair and what is not in a game. Clearly, this is about getting control of the virtual money market for economics and competition reasons. Likely it is the same old problem: the banks don't like it, and take their FUD to the central bank. But the banks won't play in it, so a devil's choice is given to the central bank: either you back us and get rid of our competition, or our competition is likely to undermine our control of payment systems. Which means that banks will be undermined, and although we just got through a global crisis brought on by those same banks, nobody much is thinking of a world in which banks are no longer the power. The trading of virtual currency for real cash generates between $200 million and $1 billion annually, according to a 2008 survey conducted by Richard Heeks at the University of Manchester. Not a huge market, but consider that everyone one of those fees represents a vote to take a payment away from a bank, a vote for freedom of trade. The unfortunate part of this is that any regulation against virtual money will take the virtual money away from the people. Which means that the people are being taxed to preserve the old banking infrastructure. This is why the European Commission is slowly realising that virtual money isn't the problem, banking is. And that the solution is found in how to shift the banks, not in how to protect them. Virtual money is part of the solution, not the problem. China may be a bit newer to this power game. OK, but in another way, it is a long way ahead of the Europeans. Although it is now making the same 1994 mistake that the EC made, it is making it in 2009, *after* the market took off. China's got a market that it can regulate to death, if it so chooses. In contrast, the EC has a bunch of corpses that it killed with regulation-at-birth, and now it's trying to resuscitate them with more of the same. I know which one I'd pick if I was a state planner. Well, it's an old story, it just happened to be more interesting because I'm reading the new 2008 directive on virtual money, payment systems providers, etc, right now. I'll leave you with this typical western hypocrisy: The average user will only partially care about this ban. They might be disappointed that they can't buy their way to higher status, but I assume that Tencent and other popular sites will figure out a way to do in-game trades and that eventually the farmers will figure out how to bypass the restrictions. The ban may scare off smaller shops, but the sophisticated organizations will continue on the same path. It reminds me of Japanese pachinko parlors where you can only win tokens (wink, wink) that you take next door for actual cash. While I'm not convinced that gold farming is good or bad, there is a very persuasive argument that it's driving economic development in China, and that anything that perpetuates economic stimulus is a good thing. Rich people playing games will pay more for getting up in the game! Shocking! Poor people will work to provide them the ability to play at a higher level. Exploitation! Why is it that the world's comfortable elite always bemoan apparent unfairness, and at the same time, are so quick to cut the poor people out of an honest job?...

SANS Internet Storm CenterFCKEditor advisory, (Fri, Jul 3rd)

FCKeditor, a web based open source HTML text editor, suffers from a remote file upload vulnerability. The advisory is here. CVE-2009-2265 has been assigned to the vulnerability. The patch and a new version of the editor will be available next week (06 July). Keep a close eye on any system with this package installed on it, it is recommended to follow mitigation steps in the advisory in the meantime. A number of compromises have been reported as a result of the exploit being used prior to now. Thanks Andrea.


Cheers,

Adrien de Beaupr

EWA-Canada.com
Teaching SANS Cutting-Edge Hacking Techniques in Ottawa this September.

infosecurity.usIndependence Day July 4, 2009

SANS Internet Storm CenterAuthorize.net down, (Fri, Jul 3rd)

The credit card payment gateway authorize.net is currently down. A fire at their data center is apparently the cause. Thanks to Joey, Tommy, and Jonathan for writing in.


Cheers,

Adrien de Beaupr

EWA-Canada.com
Teaching SANS Cutting-Edge Hacking Techniques in Ottawa this September.

infosecurity.usDilbert: Marketing Redux

infosecurity.usOracle Patch Bus Is Rolling: Multiple Enterprise Linux Patches Released

ORACLE AT MOSCONE

Oracle Corporation (NasdaqGS: ORCL) has announced the release of several patches to the software giant’s Enterprise Linux branded distribution. Ranging from relatively trivial user application updates to critical kernel level security patches, this is a great way to end the week, before a holiday weekend no less… We suggest a thorough examination of the list to determine your patching requirements and to align this patch set with your change management policy. Oracle Enterprise Linux is a variant of RED HAT, INC.’s (NYSE: RHTRed Hat Enterprise Linux OS. Additional information - including release notes and linkage - appears, after the jump

Enterprise Linux Security Advisory ELSA-2009-1134

https://rhn.redhat.com/errata/RHSA-2009-1134.html

The following updated rpms for Enterprise Linux 4 have been uploaded to the Unbreakable Linux Network:

i386:
seamonkey-1.0.9-44.0.1.el4_8.

i386.rpm
seamonkey-chat-1.0.9-44.0.1.el4_8.i386.rpm
seamonkey-devel-1.0.9-44.0.1.el4_8.i386.rpm
seamonkey-dom-inspector-1.0.9-44.0.1.el4_8.i386.rpm
seamonkey-js-debugger-1.0.9-44.0.1.el4_8.i386.rpm
seamonkey-mail-1.0.9-44.0.1.el4_8.i386.rpm

x86_64:
seamonkey-1.0.9-44.0.1.el4_8.x86_64.rpm
seamonkey-chat-1.0.9-44.0.1.el4_8.x86_64.rpm
seamonkey-devel-1.0.9-44.0.1.el4_8.x86_64.rpm
seamonkey-dom-inspector-1.0.9-44.0.1.el4_8.x86_64.rpm
seamonkey-js-debugger-1.0.9-44.0.1.el4_8.x86_64.rpm
seamonkey-mail-1.0.9-44.0.1.el4_8.x86_64.rpm

ia64:
seamonkey-1.0.9-44.0.1.el4_8.ia64.rpm
seamonkey-chat-1.0.9-44.0.1.el4_8.ia64.rpm
seamonkey-devel-1.0.9-44.0.1.el4_8.ia64.rpm
seamonkey-dom-inspector-1.0.9-44.0.1.el4_8.ia64.rpm
seamonkey-js-debugger-1.0.9-44.0.1.el4_8.ia64.rpm
seamonkey-mail-1.0.9-44.0.1.el4_8.ia64.rpm

SRPMS:
http://oss.oracle.com/el4/SRPMS-updates/seamonkey-1.0.9-44.0.1.el4_8.src.rpm

Description of changes:

[1.0.9-44.0.1.el4_8]
- Added mozilla-oracle-default-prefs.js, and
mozilla-oracle-default-bookmarks.html
and removed corresponding Redhat ones

[1.0.9-44.el4]
- Added fix for mozbz#495057

Enterprise Linux Security Advisory ELSA-2009-1132

https://rhn.redhat.com/errata/RHSA-2009-1132.html

The following updated rpms for Enterprise Linux 4 have been uploaded to the Unbreakable Linux Network:

i386:
kernel-2.6.9-89.0.3.0.1.EL.

i686.rpm
kernel-devel-2.6.9-89.0.3.0.1.EL.i686.rpm
kernel-doc-2.6.9-89.0.3.0.1.EL.noarch.rpm
kernel-hugemem-2.6.9-89.0.3.0.1.EL.i686.rpm
kernel-hugemem-devel-2.6.9-89.0.3.0.1.EL.i686.rpm
kernel-smp-2.6.9-89.0.3.0.1.EL.i686.rpm
kernel-smp-devel-2.6.9-89.0.3.0.1.EL.i686.rpm
kernel-xenU-2.6.9-89.0.3.0.1.EL.i686.rpm
kernel-xenU-devel-2.6.9-89.0.3.0.1.EL.i686.rpm

x86_64:
kernel-2.6.9-89.0.3.0.1.EL.x86_64.rpm
kernel-devel-2.6.9-89.0.3.0.1.EL.x86_64.rpm
kernel-doc-2.6.9-89.0.3.0.1.EL.noarch.rpm
kernel-largesmp-2.6.9-89.0.3.0.1.EL.x86_64.rpm
kernel-largesmp-devel-2.6.9-89.0.3.0.1.EL.x86_64.rpm
kernel-smp-2.6.9-89.0.3.0.1.EL.x86_64.rpm
kernel-smp-devel-2.6.9-89.0.3.0.1.EL.x86_64.rpm
kernel-xenU-2.6.9-89.0.3.0.1.EL.x86_64.rpm
kernel-xenU-devel-2.6.9-89.0.3.0.1.EL.x86_64.rpm

ia64:
kernel-2.6.9-89.0.3.0.1.EL.ia64.rpm
kernel-devel-2.6.9-89.0.3.0.1.EL.ia64.rpm
kernel-doc-2.6.9-89.0.3.0.1.EL.noarch.rpm
kernel-largesmp-2.6.9-89.0.3.0.1.EL.ia64.rpm
kernel-largesmp-devel-2.6.9-89.0.3.0.1.EL.ia64.rpm

SRPMS:
http://oss.oracle.com/el4/SRPMS-updates/kernel-2.6.9-89.0.3.0.1.EL.src.rpm

The following packages were rebuilt to be in sync with the updated
kernel version (no changes other than updating the version number):

i386:
oracleasm-2.6.9-89.0.3.0.1.EL-2.0.5-1.el4.i686.rpm
oracleasm-2.6.9-89.0.3.0.1.ELhugemem-2.0.5-1.el4.i686.rpm
oracleasm-2.6.9-89.0.3.0.1.ELsmp-2.0.5-1.el4.i686.rpm
oracleasm-2.6.9-89.0.3.0.1.ELxenU-2.0.5-1.el4.i686.rpm
ocfs2-2.6.9-89.0.3.0.1.EL-1.2.9-1.el4.i686.rpm
ocfs2-2.6.9-89.0.3.0.1.ELhugemem-1.2.9-1.el4.i686.rpm
ocfs2-2.6.9-89.0.3.0.1.ELsmp-1.2.9-1.el4.i686.rpm
ocfs2-2.6.9-89.0.3.0.1.ELxenU-1.2.9-1.el4.i686.rpm

x86_64:
oracleasm-2.6.9-89.0.3.0.1.EL-2.0.5-1.el4.x86_64.rpm
oracleasm-2.6.9-89.0.3.0.1.ELlargesmp-2.0.5-1.el4.x86_64.rpm
oracleasm-2.6.9-89.0.3.0.1.ELsmp-2.0.5-1.el4.x86_64.rpm
oracleasm-2.6.9-89.0.3.0.1.ELxenU-2.0.5-1.el4.x86_64.rpm
ocfs2-2.6.9-89.0.3.0.1.EL-1.2.9-1.el4.x86_64.rpm
ocfs2-2.6.9-89.0.3.0.1.ELlargesmp-1.2.9-1.el4.x86_64.rpm
ocfs2-2.6.9-89.0.3.0.1.ELsmp-1.2.9-1.el4.x86_64.rpm
ocfs2-2.6.9-89.0.3.0.1.ELxenU-1.2.9-1.el4.x86_64.rpm

ia64:
oracleasm-2.6.9-89.0.3.0.1.EL-2.0.5-1.el4.ia64.rpm
oracleasm-2.6.9-89.0.3.0.1.ELlargesmp-2.0.5-1.el4.ia64.rpm
ocfs2-2.6.9-89.0.3.0.1.EL-1.2.9-1.el4.ia64.rpm
ocfs2-2.6.9-89.0.3.0.1.ELlargesmp-1.2.9-1.el4.ia64.rpm

SRPMS:
http://oss.oracle.com/el4/SRPMS-updates/oracleasm-2.6.9-89.0.3.0.1.EL-2.0.5-1.el4.src.rpm
http://oss.oracle.com/el4/SRPMS-updates/ocfs2-2.6.9-89.0.3.0.1.EL-1.2.9-1.el4.src.rpm

Description of changes:

[2.6.9-89.0.3.0.1.EL]
- fix skb alignment that was causing sendto() to fail with EFAULT (Olaf
Kirch)[orabug 6845794]
fix  enomem due to larger mtu size page alloc (Zach Brown) [orabug
5486128]
- backout patch sysrq-b that queues upto keventd thread (Guru
Anbalagane)[orabug 6125546]
- netrx/netpoll race avoidance (Tina Yang) [orabug 6143381]
- [XEN] Fix elf_core_dump (Tina Yang) [orabug 6995928]
- use lfence instead of cpuid instruction to implement memory barriers
(Herbert van den Bergh) [orabug 7452412]
- add netpoll support to xen netfront (Tina Yang) [orabz 7261]
- [xen] execshield: fix endless GPF fault loop (Stephen Tweedie) [orabug
7175395]
- [xen]: port el5u2 patch that allows 64-bit PVHVM guest to boot with
32-bit dom0 [orabug 7452107] xenstore
- [mm] update shrink_zone patch to allow 100% swap utilization (John
Sobecki,
Chris Mason, Chuck Anderson, Dave McCracken) [orabug 7566319,6086839]
- [kernel] backport report_lost_ticks patch from EL5.2 (John
Sobecki)[orabug 6110605]
- [xen] fix for hung JVM thread after #GPF [orabug 7916406] (Chuck Anderson)
- port EL5U3 patch to adjust totalhigh_pages in the balloon driver
[orabug 8300888]
- check to see if hypervisor supports memory reservation change (Chuck
Anderson) [orabug7556514]
- [XEN] use hypercall to fixmap pte updates (Mukesh Rathor) [orabug 8433329]
- [XEN] Extend physical mask to 40bit for machine above 64G [orabug 8312526]
- fix oops in show_partition using RCU (Wen gang Wang) [orabug 8423936]

[2.6.9-89.0.3]
-agp: zero pages before sending to userspace (Jiri Olsa) [497023 497024]
{CVE-2009-1192}
-agp: fix boot issue with agp zero pages patch (Jiri Olsa) [497023
497024] {CVE-2009-1192}
-e1000: fix skb_over_panic (Neil Horman) [502982 502983] {CVE-2009-1385}
-kernel: proc: avoid information leaks to non privileged processes
(Amerigo Wang) [499549 499548]
-netpoll: bust poll_lock when doing netdump (Neil Horman) [504565 494688]

[2.6.9-89.0.2]
-xen: local denial of service [500948 500949] {CVE-2009-1758}
-nfs: fix client handling of MAY_EXEC in nfs_permission [500299 500300]
{CVE-2009-1630}

[2.6.9-89.0.1]
-Reapply: fix race condition in input.c (Vivek Goyal) [501804 501064]
-nfs: inode of the overwritten file will remain in the icache (Flavio
Leitner) [501802 494015]
-fix timespec off by one errors (Jason Baron) [501800 496201]
-add some long missing capabilities to cap_fs_mask (Eric Paris) [499073
499074] [497269 497270] {CVE-2009-1072}
-net: tcp: clear probes_out more aggressively in tcp_ack (Jiri Pirko)
[501754 494428]

Enterprise Linux Bug Fix Advisory ELBA-2009-1133

https://rhn.redhat.com/errata/RHBA-2009-1133.html

The following updated rpms for Enterprise Linux 5 have been uploaded to the Unbreakable Linux Network:

i386:
kernel-2.6.18-128.1.16.0.1.

el5.i686.rpm
kernel-PAE-2.6.18-128.1.16.0.1.el5.i686.rpm
kernel-PAE-devel-2.6.18-128.1.16.0.1.el5.i686.rpm
kernel-debug-2.6.18-128.1.16.0.1.el5.i686.rpm
kernel-debug-devel-2.6.18-128.1.16.0.1.el5.i686.rpm
kernel-devel-2.6.18-128.1.16.0.1.el5.i686.rpm
kernel-doc-2.6.18-128.1.16.0.1.el5.noarch.rpm
kernel-headers-2.6.18-128.1.16.0.1.el5.i386.rpm
kernel-xen-2.6.18-128.1.16.0.1.el5.i686.rpm
kernel-xen-devel-2.6.18-128.1.16.0.1.el5.i686.rpm

x86_64:
kernel-2.6.18-128.1.16.0.1.el5.x86_64.rpm
kernel-debug-2.6.18-128.1.16.0.1.el5.x86_64.rpm
kernel-debug-devel-2.6.18-128.1.16.0.1.el5.x86_64.rpm
kernel-devel-2.6.18-128.1.16.0.1.el5.x86_64.rpm
kernel-doc-2.6.18-128.1.16.0.1.el5.noarch.rpm
kernel-headers-2.6.18-128.1.16.0.1.el5.x86_64.rpm
kernel-xen-2.6.18-128.1.16.0.1.el5.x86_64.rpm
kernel-xen-devel-2.6.18-128.1.16.0.1.el5.x86_64.rpm

SRPMS:
http://oss.oracle.com/el5/SRPMS-updates/kernel-2.6.18-128.1.16.0.1.el5.src.rpm

The following packages were rebuilt to be in sync with the updated
kernel version (no changes other than updating the version number):

i386:
oracleasm-2.6.18-128.1.16.0.1.el5-2.0.5-1.el5.i686.rpm
oracleasm-2.6.18-128.1.16.0.1.el5PAE-2.0.5-1.el5.i686.rpm
oracleasm-2.6.18-128.1.16.0.1.el5xen-2.0.5-1.el5.i686.rpm
oracleasm-2.6.18-128.1.16.0.1.el5debug-2.0.5-1.el5.i686.rpm
ocfs2-2.6.18-128.1.16.0.1.el5-1.2.9-1.el5.i686.rpm
ocfs2-2.6.18-128.1.16.0.1.el5PAE-1.2.9-1.el5.i686.rpm
ocfs2-2.6.18-128.1.16.0.1.el5xen-1.2.9-1.el5.i686.rpm
ocfs2-2.6.18-128.1.16.0.1.el5debug-1.2.9-1.el5.i686.rpm
ocfs2-2.6.18-128.1.16.0.1.el5-1.4.2-1.el5.i686.rpm
ocfs2-2.6.18-128.1.16.0.1.el5PAE-1.4.2-1.el5.i686.rpm
ocfs2-2.6.18-128.1.16.0.1.el5xen-1.4.2-1.el5.i686.rpm
ocfs2-2.6.18-128.1.16.0.1.el5debug-1.4.2-1.el5.i686.rpm

x86_64:
oracleasm-2.6.18-128.1.16.0.1.el5-2.0.5-1.el5.x86_64.rpm
oracleasm-2.6.18-128.1.16.0.1.el5xen-2.0.5-1.el5.x86_64.rpm
oracleasm-2.6.18-128.1.16.0.1.el5debug-2.0.5-1.el5.x86_64.rpm
ocfs2-2.6.18-128.1.16.0.1.el5-1.2.9-1.el5.x86_64.rpm
ocfs2-2.6.18-128.1.16.0.1.el5xen-1.2.9-1.el5.x86_64.rpm
ocfs2-2.6.18-128.1.16.0.1.el5debug-1.2.9-1.el5.x86_64.rpm
ocfs2-2.6.18-128.1.16.0.1.el5-1.4.2-1.el5.x86_64.rpm
ocfs2-2.6.18-128.1.16.0.1.el5xen-1.4.2-1.el5.x86_64.rpm
ocfs2-2.6.18-128.1.16.0.1.el5debug-1.4.2-1.el5.x86_64.rpm

SRPMS:
http://oss.oracle.com/el5/SRPMS-updates/oracleasm-2.6.18-128.1.16.0.1.el5-2.0.5-1.el5.src.rpm
http://oss.oracle.com/el5/SRPMS-updates/ocfs2-2.6.18-128.1.16.0.1.el5-1.2.9-1.el5.src.rpm
http://oss.oracle.com/el5/SRPMS-updates/ocfs2-2.6.18-128.1.16.0.1.el5-1.4.2-1.el5.src.rpm

Description of changes:

[2.6.18-128.1.16.0.1.el5]
- [NET] Add entropy support to e1000 and bnx2 (John Sobecki,Guru
Anbalagane) [orabug 6045759]
- [MM]  shrink zone patch (John Sobecki,Chris Mason) [orabug 6086839]
- [NET] Add xen pv/bonding  netconsole support (Tina yang) [orabug
6993043] [bz 7258]
- [nfs] convert ENETUNREACH to ENOTCONN (Guru Anbalagane) [orabug 7689332]
- [xen] check to see if hypervisor supports memory reservation change
(Chuck Anderson) [orabug 7556514]
- [MM] balloon code needs to adjust totalhigh_pages (Chuck Anderson)
[orabug 8300888]
- [NET] Add entropy support to igb ( John Sobecki) [orabug 7607479]

[2.6.18-128.1.16.el5]
- [mm] prevent panic in copy_hugetlb_page_range (Larry Woodman ) [508030
507860]

[2.6.18-128.1.15.el5]
- [mm] fix swap race condition in fork-gup-race patch (Andrea Arcangeli
) [507297 506684]

Enterprise Linux Bug Fix Advisory ELBA-2009-1137

https://rhn.redhat.com/errata/RHBA-2009-1137.html

The following updated rpms for Enterprise Linux 5 have been uploaded to the Unbreakable Linux Network:

i386:
bind-9.3.4-10.P1.el5_3.1.i386.

rpm
bind-chroot-9.3.4-10.P1.el5_3.1.i386.rpm
bind-devel-9.3.4-10.P1.el5_3.1.i386.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.1.i386.rpm
bind-libs-9.3.4-10.P1.el5_3.1.i386.rpm
bind-sdb-9.3.4-10.P1.el5_3.1.i386.rpm
bind-utils-9.3.4-10.P1.el5_3.1.i386.rpm
caching-nameserver-9.3.4-10.P1.el5_3.1.i386.rpm

x86_64:
bind-9.3.4-10.P1.el5_3.1.x86_64.rpm
bind-chroot-9.3.4-10.P1.el5_3.1.x86_64.rpm
bind-devel-9.3.4-10.P1.el5_3.1.i386.rpm
bind-devel-9.3.4-10.P1.el5_3.1.x86_64.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.1.i386.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.1.x86_64.rpm
bind-libs-9.3.4-10.P1.el5_3.1.i386.rpm
bind-libs-9.3.4-10.P1.el5_3.1.x86_64.rpm
bind-sdb-9.3.4-10.P1.el5_3.1.x86_64.rpm
bind-utils-9.3.4-10.P1.el5_3.1.x86_64.rpm
caching-nameserver-9.3.4-10.P1.el5_3.1.x86_64.rpm

SRPMS:
http://oss.oracle.com/el5/SRPMS-updates/bind-9.3.4-10.P1.el5_3.1.src.rpm

Description of changes:

[9.3.4-10.P1.1]
- handle unknown DLV algorithms well (#504794)

Enterprise Linux Security Advisory ELSA-2009-1138

https://rhn.redhat.com/errata/RHSA-2009-1138.html

The following updated rpms for Enterprise Linux 5 have been uploaded to the Unbreakable Linux Network:

i386:
openswan-2.6.14-1.el5_3.3.

i386.rpm
openswan-doc-2.6.14-1.el5_3.3.i386.rpm

x86_64:
openswan-2.6.14-1.el5_3.3.x86_64.rpm
openswan-doc-2.6.14-1.el5_3.3.x86_64.rpm

SRPMS:
http://oss.oracle.com/el5/SRPMS-updates/openswan-2.6.14-1.el5_3.3.src.rpm

Description of changes:

[2.6.14-1.3]
- security update (CVE-2009-2185)
Resolves: CVE-2009-2185

Enterprise Linux Security Advisory ELSA-2009-1139

https://rhn.redhat.com/errata/RHSA-2009-1139.html

The following updated rpms for Enterprise Linux 4 have been uploaded to
the Unbreakable Linux Network:

i386:
finch-2.5.8-1.el4.i386.rpm
finch-devel-2.5.8-1.el4.i386.

rpm
libpurple-2.5.8-1.el4.i386.rpm
libpurple-devel-2.5.8-1.el4.i386.rpm
libpurple-perl-2.5.8-1.el4.i386.rpm
libpurple-tcl-2.5.8-1.el4.i386.rpm
pidgin-2.5.8-1.el4.i386.rpm
pidgin-devel-2.5.8-1.el4.i386.rpm
pidgin-perl-2.5.8-1.el4.i386.rpm

x86_64:
finch-2.5.8-1.el4.x86_64.rpm
finch-devel-2.5.8-1.el4.x86_64.rpm
libpurple-2.5.8-1.el4.x86_64.rpm
libpurple-devel-2.5.8-1.el4.x86_64.rpm
libpurple-perl-2.5.8-1.el4.x86_64.rpm
libpurple-tcl-2.5.8-1.el4.x86_64.rpm
pidgin-2.5.8-1.el4.x86_64.rpm
pidgin-devel-2.5.8-1.el4.x86_64.rpm
pidgin-perl-2.5.8-1.el4.x86_64.rpm

ia64:
finch-2.5.8-1.el4.ia64.rpm
finch-devel-2.5.8-1.el4.ia64.rpm
libpurple-2.5.8-1.el4.ia64.rpm
libpurple-devel-2.5.8-1.el4.ia64.rpm
libpurple-perl-2.5.8-1.el4.ia64.rpm
libpurple-tcl-2.5.8-1.el4.ia64.rpm
pidgin-2.5.8-1.el4.ia64.rpm
pidgin-devel-2.5.8-1.el4.ia64.rpm
pidgin-perl-2.5.8-1.el4.ia64.rpm

SRPMS:
http://oss.oracle.com/el4/SRPMS-updates/pidgin-2.5.8-1.el4.src.rpm

Description of changes:

[2.5.8-1]
- 2.5.8 with several important bug fixes

[2.5.7-2]
- glib2 compat with RHEL-4

[2.5.7-1]
- 2.5.7 with Yahoo Protocol 16 support

[2.5.6-1]
- 2.5.6

[2.5.5-3]
- F12+ removed krb4

Enterprise Linux Security Advisory ELSA-2009-1140

https://rhn.redhat.com/errata/RHSA-2009-1140.html

The following updated rpms for Enterprise Linux 5 have been uploaded to the Unbreakable Linux Network:

i386:
ruby-1.8.5-5.el5_3.7.i386.rpm
ruby-devel-1.8.5-5.el5_3.7.

i386.rpm
ruby-docs-1.8.5-5.el5_3.7.i386.rpm
ruby-irb-1.8.5-5.el5_3.7.i386.rpm
ruby-libs-1.8.5-5.el5_3.7.i386.rpm
ruby-mode-1.8.5-5.el5_3.7.i386.rpm
ruby-rdoc-1.8.5-5.el5_3.7.i386.rpm
ruby-ri-1.8.5-5.el5_3.7.i386.rpm
ruby-tcltk-1.8.5-5.el5_3.7.i386.rpm

x86_64:
ruby-1.8.5-5.el5_3.7.x86_64.rpm
ruby-devel-1.8.5-5.el5_3.7.i386.rpm
ruby-devel-1.8.5-5.el5_3.7.x86_64.rpm
ruby-docs-1.8.5-5.el5_3.7.x86_64.rpm
ruby-irb-1.8.5-5.el5_3.7.x86_64.rpm
ruby-libs-1.8.5-5.el5_3.7.i386.rpm
ruby-libs-1.8.5-5.el5_3.7.x86_64.rpm
ruby-mode-1.8.5-5.el5_3.7.x86_64.rpm
ruby-rdoc-1.8.5-5.el5_3.7.x86_64.rpm
ruby-ri-1.8.5-5.el5_3.7.x86_64.rpm
ruby-tcltk-1.8.5-5.el5_3.7.x86_64.rpm

SRPMS:
http://oss.oracle.com/el5/SRPMS-updates/ruby-1.8.5-5.el5_3.7.src.rpm

Description of changes:

[1.8.5-5.el5_3.7]
- security fixes. (#505087)
- CVE-2007-1558: APOP password disclosure vulnerability.
- CVE-2009-0642: Incorrect checks for validity of X.509 certificates.
- CVE-2009-1904: DoS vulnerability in BigDecimal.

Enterprise Linux Security Advisory ELSA-2009-1140

https://rhn.redhat.com/errata/RHSA-2009-1140.html

The following updated rpms for Enterprise Linux 4 have been uploaded to the Unbreakable Linux Network:

i386:
irb-1.8.1-7.0.1.el4_8.3.i386.

rpm
ruby-1.8.1-7.0.1.el4_8.3.i386.rpm
ruby-devel-1.8.1-7.0.1.el4_8.3.i386.rpm
ruby-docs-1.8.1-7.0.1.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.0.1.el4_8.3.i386.rpm
ruby-mode-1.8.1-7.0.1.el4_8.3.i386.rpm
ruby-tcltk-1.8.1-7.0.1.el4_8.3.i386.rpm

x86_64:
irb-1.8.1-7.0.1.el4_8.3.x86_64.rpm
ruby-1.8.1-7.0.1.el4_8.3.x86_64.rpm
ruby-devel-1.8.1-7.0.1.el4_8.3.x86_64.rpm
ruby-docs-1.8.1-7.0.1.el4_8.3.x86_64.rpm
ruby-libs-1.8.1-7.0.1.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.0.1.el4_8.3.x86_64.rpm
ruby-mode-1.8.1-7.0.1.el4_8.3.x86_64.rpm
ruby-tcltk-1.8.1-7.0.1.el4_8.3.x86_64.rpm

ia64:
irb-1.8.1-7.0.1.el4_8.3.ia64.rpm
ruby-1.8.1-7.0.1.el4_8.3.ia64.rpm
ruby-devel-1.8.1-7.0.1.el4_8.3.ia64.rpm
ruby-docs-1.8.1-7.0.1.el4_8.3.ia64.rpm
ruby-libs-1.8.1-7.0.1.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.0.1.el4_8.3.ia64.rpm
ruby-mode-1.8.1-7.0.1.el4_8.3.ia64.rpm
ruby-tcltk-1.8.1-7.0.1.el4_8.3.ia64.rpm

SRPMS:
http://oss.oracle.com/el4/SRPMS-updates/ruby-1.8.1-7.0.1.el4_8.3.src.rpm

Description of changes:

[1.8.1-7.0.1.el4_8.3]
- Update release and rebuild to be latest on ULN channel

[1.8.1-7.el4_8.3]
- security fixes. (#505085)
- CVE-2007-1558: APOP password disclosure vulnerability.
- CVE-2009-0642: Incorrect checks for validity of X.509 certificates.
- CVE-2009-1904: DoS vulnerability in BigDecimal.

Reblog this post [with Zemanta]

Network World on SecuritySuit over China's Web filter to target Lenovo, Acer, Sony

A U.S. company will seek legal action against Lenovo, Acer and Sony next week over their shipment in China of controversial software that the company says stole its programming code.

Network World on SecurityRSA's Coviello: Cloud computing not secure enough

Cloud-based services are being rolled out without enough attention being paid to securing these services and the information they handle. That was the finding of a recent study commissioned by RSA Security.

Network World on SecurityApple may be exempt from China's Web filter mandate

Apple appears to be exempt from China's mandate that a controversial Internet filtering program be shipped with all computers sold in the country.

infosecurity.usXKCD: Qwertial Aphasia

hackadayTiniest bot, sort of. CNC controlled


tinybot

Here’s an interesting concept, the bot pictured above has no internal control mechanisms.  His claims to have built the smallest bot are dubious, considering it requires a much larger control platform to function, so lets just set that aside and look at how it works. The bot itself is basically a hollow box with a hinged manipulator mounted on it. He has then built a modified CNC type structure with various magnets below a platform. The magnets can move the bot and control the manipulator (assuming the bot isn’t trying to pick up anything magnetic). He talks about this being a possible control scheme for smaller bots, though we think he would have to make some major advancements to his magnetic controls for accuracy’s sake. As for his claims of being the smallest, well, we’re sure we’ve seem similarly sized bots, even hexapods,  that were completely self contained.

eWEEK SecurityApple iPhone 3GS Jailbreaking Tool Hits the Street

The hacker who made the news in 2007 for unlocking Apple's first iPhone has released the a new application for jailbreaking the iPhone 3GS. The tool is currently available for Windows only.
- George Hotz, the 19-year old hacker who made headlines for unlocking Apples original iPhone, has now released the first-known jailbreaking tool for iPhone 3GS. The tool, called ‘purplea1n, is only available for versions of the Windows operating system - excluding Windows 7 - at the moment, but H...


Heise Security"Luxembourg attacks" on AES encryption

Although the attacks don't affect the practical security of AES, they represent substantial cryptological progress

Heise SecurityStudy shows rise in spam botnets

According to MessageLabs, June 2009 saw a worldwide increase in spam being sent via botnets to 83.2 per cent, up from only 57.6 per cent in May

CNET News.com - SecuritySymantec's Ramzan on solving the antivirus puzzle

q&a From puzzles and chess to ciphers and antivirus software, Zulfikar Ramzan talks about how he got into the computer security business and where it's headed.

hackadayWTF-O-meter


wtf-button

Here’s something every office probably needs. Ours does at least. It’s a WTF counter. When the office gets just a little too weird, someone hits the button and it gets logged. It’s probably pretty easy to judge the day by the WTF chart. The button is connected to an Arduino that updates the status on a local web server. We can imagine a nice bar graph of WTFs per day, or possibly a pie chart with normal time vs WTF time. Unfortunately, imagining is all we’re going to do. They didn’t include any examples of the visualizations. Can you imagine saying something to a co worker just for them to promptly march over and slap the WTF button? Maybe we don’t need one.

Anton ChuvakinWorkshop on the Analysis of System Logs (WASL) 2009 CFP EXTENDED

Just FYI, the CFP deadline for Workshop on the Analysis of System Logs (WASL) 2009 has been extended to next Monday, July 6th.

BTW, the above date is a proposal submission date; the full paper is only due in Sep 2009.

Submit something loggy now!

Internet Security and ProgrammingKentucky payroll phishing scam nets small fortune

Blue grass county hit by Trojan-fueled cybercrime
A gang of cybercrooks has made off with $415,000 from the coffers of Bullitt County, Kentucky following the conclusion of an elaborate phishing scam, The Washington Post reports.…
Case Study: WhatsUp keeps Legoland turnstyles ringing

Read more…

The Register - Security Latin Best Buy surfers sprayed by drive-by download malware

¡Ay, Caramba!

Hackers have invaded the Best Buy website to plant exploit code targeted at South and central American surfers.…

Digital SoapBoxFun PDF Stuffing "Feature"... (hack)

I was sent this link today because I think someone really wanted to start my weekend right. As if there weren't enough ways to make use of the PDF format, now here's a very simple (and quite cool) way to embed files inside a PDF and effectively hide them from the casual passer-by.

Great post from the author, and a neat little python script is posted as well - try it... it's fun!

Makes you wonder, doesn't it? What sorts of things are hidden inside the PDFs you pass around and forward?

Go read: "Embedding and Hiding Files in PDF Documents" and Didier's full blog with other interesting stuff at http://blog.didierstevens.com/.

ItoolBox Networking and InfrastructureDeveloping Proposal Project Budgets

The purpose of this task is to develop the proposal project budget estimates for tracking and monitoring the proposal project’s financial performance. Preparing the Proposal Project Budget Use the standard project financial management tool to prepa...

Heise SecurityAlledged critical security vulnerability in iPhone SMS application

According to US media reports, Apple is working on an update for the iPhone to fix a critical vulnerability in its texting application

Schneier on SecurityThe Insecurity of Secrecy

Good essay -- "The Staggering Cost of Playing it 'Safe'" -- about the political motivations for terrorist security policy.

Senator Barbara Boxer has led an effort to at least put together a public database of ash storage sites so that people can judge the risk to the areas where they live. However, even this effort has been blocked not by coal companies or utilities, but by the DHS. How could it possibly be a national security interest to cover up the location of material that's "not toxic or anything?" It's not. In fact, even if the ash turns out to be as bad as its worst critics fear, blocking the database is far more dangerous than revealing the location of these sites. Not only has there not been any threat against these sites by terrorists, and no workable scenario by which they might cause a problem, coal slurry impoundments are already failing with regularity, dousing parts of America with millions of gallons of this material. It doesn't take terrorists to make this happen.

Blocking the release of this information doesn't protect the citizens of the United States in any way. It's just another example of the same creeping secrecy that makes cities more difficult to manage because of secrecy over facilities. The same creeping secrecy that "blurs" national monuments from images and puts intentional gaps in public information. The same creeping secrecy that increasingly elevates the most unlikely attack -- the shoe bombers of the world -- above our right to know what's going on around us so that we can make informed decisions. The same secrecy that defends torturers.

Schneier on SecurityThe Insecurity of Secrecy

Good essay -- "The Staggering Cost of Playing it 'Safe'" -- about the political motivations for terrorist security policy.

Senator Barbara Boxer has led an effort to at least put together a public database of ash storage sites so that people can judge the risk to the areas where they live. However, even this effort has been blocked not by coal companies or utilities, but by the DHS. How could it possibly be a national security interest to cover up the location of material that's "not toxic or anything?" It's not. In fact, even if the ash turns out to be as bad as its worst critics fear, blocking the database is far more dangerous than revealing the location of these sites. Not only has there not been any threat against these sites by terrorists, and no workable scenario by which they might cause a problem, coal slurry impoundments are already failing with regularity, dousing parts of America with millions of gallons of this material. It doesn't take terrorists to make this happen.

Blocking the release of this information doesn't protect the citizens of the United States in any way. It's just another example of the same creeping secrecy that makes cities more difficult to manage because of secrecy over facilities. The same creeping secrecy that "blurs" national monuments from images and puts intentional gaps in public information. The same creeping secrecy that increasingly elevates the most unlikely attack -- the shoe bombers of the world -- above our right to know what's going on around us so that we can make informed decisions. The same secrecy that defends torturers.

Schneier on SecurityThe Insecurity of Secrecy

Good essay -- "The Staggering Cost of Playing it 'Safe'" -- about the political motivations for terrorist security policy.

Senator Barbara Boxer has led an effort to at least put together a public database of ash storage sites so that people can judge the risk to the areas where they live. However, even this effort has been blocked not by coal companies or utilities, but by the DHS. How could it possibly be a national security interest to cover up the location of material that's "not toxic or anything?" It's not. In fact, even if the ash turns out to be as bad as its worst critics fear, blocking the database is far more dangerous than revealing the location of these sites. Not only has there not been any threat against these sites by terrorists, and no workable scenario by which they might cause a problem, coal slurry impoundments are already failing with regularity, dousing parts of America with millions of gallons of this material. It doesn't take terrorists to make this happen.

Blocking the release of this information doesn't protect the citizens of the United States in any way. It's just another example of the same creeping secrecy that makes cities more difficult to manage because of secrecy over facilities. The same creeping secrecy that "blurs" national monuments from images and puts intentional gaps in public information. The same creeping secrecy that increasingly elevates the most unlikely attack -- the shoe bombers of the world -- above our right to know what's going on around us so that we can make informed decisions. The same secrecy that defends torturers.

Kaspersky.com / Virus NewsMonthly Malware Statistics From Kaspersky Lab: June 2009

As in previous months, this malware rating is compiled from data generated by the Kaspersky Security Network (KSN). However, slightly different methods have been used to select and analyse the data.

Kaspersky.com / Virus NewsMonthly Malware Statistics: june 2009

As in previous months, this malware rating is compiled from data generated by the Kaspersky Security Network (KSN). However, slightly different methods have been used to select and analyze the data.

ItoolBox Networking and InfrastructureConducting Green Team Proposal Reviews

The purpose of this task is to review and challenge the technical solution, management approach, and costing assumptions. What is a Green Team Review? This review focuses on delivery responsibilities with a view to obtaining delivery support of the...

The Register - Security A practical guide to disaster recovery planning

Two papers for smaller businesses

Typically, vendor white papers are written with the ITDM or senior ITDM at a large company, in mind. [ITDM is industry jargon for "IT decision maker", since you ask.] People working at smaller companies are rather less well served, in quantity and quality. So today we focus our Reg Library selection on a couple of good papers aimed at small and medium-sized businesses.…

Case Study: WhatsUp keeps Legoland turnstyles ringing

The Register - Security Hackers crack ColdFusion

Drive-by download attack hits multiple hosts

Hackers are running a mass compromise against sites running vulnerable ColdFusion application server installations.…

Darknet HackersThe Middler – User Session Cloning & MITM Tool

The Middler is a Man in the Middle tool to demonstrate protocol middling attacks. Led by Jay Beale, the project involves a team of authors including InGuardians agents Justin Searle and Matt Carpenter. The Middler is intended to man in the middle, or “middle” for short, every protocol for which we can create code. In [...]

Read the full post at darknet.org.uk

F-Secure - News from the LabBait Files

It's always interesting to browse through the bait document files used in targeted attacks. These are files that have been used to infect specific individuals in different organizations in order to gain access to their computer.

All the documents shown below contained exploits that installed backdoors. Targets of these attacks are not known.

targeted attack

targeted attack

targeted attack

targeted attack

targeted attack

targeted attack

targeted attack

This is just a quick sampling; we get a lot of these.

On 03/07/09 At 09:50 AM

ItoolBox Networking and InfrastructureLate riser or can't see the tree for the forest?

This morning I lazily opened up my eyes, looked at the blurred hands of my watch, then jumped up like a scolded cat. I was late and for some reason I thought it was a Saturday morning and not a Friday one. There is a saying that if you start the day late then you spend the rest of it catching up. This was running through my mind as I went through my morning routine (which included winning a couple

Yahoo! News: Computer Security and VirusesYou don't know tech: The InfoWorld news quiz (InfoWorld)

InfoWorld - You win some; you lose some. This week China decided its Web censorship filtering software was not quite ready for prime time, while U.S. courts sentenced phone hackers and file swappers to some crime time.