November was a slow posting month, the reason being that I’m working on a rather time consuming project, one of the areas I’ve had to focus on again is Linux Security.

Security goes on and on forever, you can do as much or as little as you deem necessary, too much will consume resources*, too little opens you up to attack; this article talks about some steps I take, be advised tho’ this will generate a load of e-mails, and if you’re not going to read them why bother implementing them.

Here you are, a cisco security “tid bit”, you can secure backup the running config of your Cisco ASA over https, now you should enable AAA and set a username, but for now, here’s default url & command for wget.

It’s a few days old, but I’ve just found this post….

Metasploit: Metasploit 3.0 Automated Exploitation
A recurring theme in my presentations about Metasploit 3.0 is the need for exploit automation

WOW, reading this just shows the dangers of not patching; it’d be nice to try and put some time aside to set up a lab and have a go.

It would have been irresponsible of me to write this any earlier, but a few days of past and hopefully the majority have installed the appropiate patch or at the very least are running personal/perimeter firewalls until they complete their change control.

Many may have seen e-mail alerts and news articles that say exploit in the wild and may not appreciate what this actually means. You hear people say “It’ll never happen to me” or “it’s only geeky Linux kids who can do this, my business isn’t at risk”; OK but do you know actually how easy it is ?

Network Intrusion detection systems (NIDS) , and Network Intrusion Prevention (NIPS) systems are a common complement to a firewall implementation; couple this with Host IDS (HIDS) or Host IPS (HIPS) and you’ve made a good start at implementing an advanced security infrastructure

What’s the difference ?

Sadly there’s no hard an fast rule, what’s important is understanding what you’re buying. Traditional IDS systems used sniffers & signatures to detect attacks very similar to how virus’s are found with AV; the problem with this kind of system is that it relies on a signature being available to recognize the attack; there is also a margin of error with sniffer technology, this means it’s possible to flood a network with “safe” traffic, and then slip the attack in under the radar.

He,he,he, I thought this was funny….

If your system gets infiltrated by a rootkit, you might as
well just “waste the system entirely,” a Microsoft official told
fellow security professionals last week

From: Information Security News: Microsoft exec warns of rootkits

This is quite a funny statement, but the point is very serious, if you have been “root’d“, the only way to recover is from a trusted source

This is a quick note to myself really, as a security professional I get asked these questions a lot, and sadly each time I forget a nice simple answer, well this is what I think:

What’s the difference between a Virus and a Worm ?
A Virus is an application of malicious code.
A Worm is malicious code that can reproduce it’s self.
Following Feedback: Better Suggestions

• A Virus infects another application for propagation.
• Worms are self propagating code.

I really like Site Advisor, the best thing about it is the search engine integration, check out this screen-shot*

As you can see, you get a quick report before you even click on the link, only visiting green sites mean less pop-ups, less spy-ware and in overall a better Internet experience.

So Why am I mentioning this now ? Well my site just got it’s green tick, I’ve also signed up as a reviewer. Being a reviewer means that you can add the ‘human factor’ to their tests, so If you get a bad experience from a green site, or find a miss classified red one, you can get your voice heard !

Secure Voice over IP: Zfone

By Philip Zimmermann

Secure Voice over IP: Zfone

14 Mar 2006 - I’ve just released Zfone, a new product that takes a new approach to make a secure telephone for the Internet.

I think it’s better than the other approaches to secure VoIP, because it achieves security without reliance on a PKI, key certification, trust models, certificate authorities, or key management complexity that bedevils the email encryption world. It also does not rely on SIP signaling for the key management, and in fact does not rely on any servers at all.

Nokia 6136 Phone

Smooth and seamless transitions between GSM and WLAN networks
…..

Available: Planned in the second quarter of 2006

All I can say is watch this space … <thinking aloud>What’ll be most interesting is how they achieve the voip/wlan link - cisco integration, skype, avaya? - gonna have to do some investigation me thinks ! </thinking aloud>

I found this over the weekend….

Spyware, Adware, Spam, Phishing, Viruses, Identity Theft Protection | SiteAdvisor
SiteAdvisor helps protect you from all kinds of Web-based security threats including spyware, adware, spam, viruses, browser-based attacks, phishing, online fraud and identity theft.

It seems cool, a different approach the the anit-phishing type stuff. Basically you get a simple security report about the sites you visit. The report comes in the flavour of a traffic light in your browser toolbar, green is safe - red is not. Another nice touch is the traffic light is added to our google results, so before you even click on a site you can determine how ‘hostile’ the webmaster may be.

This article from yesterday cannot go unmentioned….

BBC NEWS | Business | Nokia launching net call handsets
Nokia is introducing new mobile phone handsets that will enable users to make calls over the Internet.

Nokia putting Skype were the 1st people to try and offer consumers or “Joe public” voip phones for home use, it’s not that the technology is new, cisco & avaya have been offering businesses the technology for years, it’s just that it wasn’t quite right for the market at large.

BBC NEWS | Technology | UK court to unmask ‘file-sharers’

Pirated Windows CD
About a quarter of software in the UK is estimated to be pirated
Ten Internet service providers have been ordered to hand over the details of 150 UK customers accused of illegally sharing software.

The High Court order follows a 12-month covert investigation by the Federation Against Software Theft (Fast).

Among the Internet providers are BT, NTL, Telewest and Tiscali.

Over the next two weeks, they are expected to provide the names, addresses and other personal details of the alleged file-sharers.

Protect your savings from Phishing attacks.

Anti-Phishing toolbars are trendy at the moment, google and ebay are a couple of the big players.

I agree with tool bars for security, in fact, one of the best things about firefox is the fact that you can extend it so easily, the problem is they generally need a specific version or browser, ebay’s need internet explorer and googles only works on firefox 1.5+ - what about those on macs or people like me who still run firefox 1.0 ?