Infosecurity.US

Ranum / Schneier - Software Liability

 

∥

Metasploit Pro + OWASP Top Ten 2013 Test Capabilities

News, via Rapid7's Christian Kirsch, of the Metasploit 4.6 release. This time, with the inclusion of OWASP Top Ten 2013 testing capability support - once the Top Ten 2013 (currently in release candidate stage, as of this posting) are unleashed, that is.

Security BSides London: Privilege Escalation

 

Web application privilege escalation, the Movie, from last years Security BSides London 2012. This year's event, Security BSides London 2013 [slated for 2013/04/24; at the Kensington and Chelsea Town Hall, ensconced on Hornton Street in London ] is this month's MustAttend event.

㎯  ①  ♽

Command Leadership Failure At DOD: Pirated Software, Defense Contractors

via San Francisco Chronicle and The Verge, by way of the Associated Press, comes the sorry tale of failed information security software development governance, leadership failures and jurisprudence [both military and civilian], otherwise known as "How To Build Patriot Missiles With Purloined Bits"...

≩ ≼

Malus Emergentium

A newly discovered and pernicious  SQL Server targeting malware package has emerged, in this case targeting Microsoft Corporation (NasdaqGS: MSFT) SQL Server databases utilizing an OLEDB vector, specifically in the Middle East. Monikered W32.Narilam, this worm appears to function like most other infect code, copying and traversing drives and network file shares.

⎈

Enfour the Shamer

Simply astounding. In an effort to control it's apparently pirated bits, Enfour's licensing code fails to measure up, and tweets false statements related to legal licensees of the company's products. What next - public spanking?

Ṧ, Ộ

 

Flash-in-the-Box

Sandboxed?

Notwithstanding the goal of attack mitigation [admirable], this action fails to alleviate the Cruft-That-Is-Flash performance syndrome. which also affects availability, a key component of the oft-mentioned security triad [Confidentiality, Integrity, Availability].

Ł

Sophos Fail

Oops...

Another flawed anti-virus vendor product is discovered, this time, by a security researcher at Google Inc. (NasdaqGS: GOOG). Surprised?

Ǽ

SONY PS3 Decrypt Keys Released

Keys.., apparently, its' what's for dinner...

Ƥ

DKIM Rabbit Hole

via the inimitable Kim Zetter at Wired, comes this tale of information security intrigue, the failure of DKIM, employment recruiting and Google Inc (NasdaqGS: GOOG). Todays' Must Read.

Ȭ

Where The Sun Shineth Not...

Solar collector systems management and control products are apparently vulnerable to attack. Certainly, in-line with other reported SCADA vulns, this news is not altogether surprising. Dark skies ahead, indeed...

Ề

Developers, Lessons Not Learned

Those pesky developers...

ᶎ

Exploit iPhone du Jour: SMS Spoof



pod2g's newly discovered Apple Inc. (NasdaqGS: AAPL)  iPhone SMS exploit, scrutans.

ʨ , ᴂ

 

The LinkedIn - Dickensonian Reciprocity

Well crafted tale, worthy of Charles John Huffam Dickens, detailing the fascinating connection between the LinkedIn password fiasco and Charles Dickens. Highly Pickwickian.

Ð

The Pulse of SSL

via Ivan Ristić, author of ModSecurity, and Apache Security, and one of the great minds in information security today, comes news of The Trustworty Internet Movement SSL Pulse. SSL Pulse, is essentially, a information dashboard provisioning significant data relevant to the current state of the SSL ecosystem, if you will. Absolutely Outstanding.

✺, Ẩ

TLS/SSL SNAFUs Lead To Flawed Site Security, Go Figure...

 
Evidently, site and web administrator's need a refresher course in socket and transport layer security configurations... Not particularly surprising, that. 

ƫ 

Cybercrime Statistics: Estimation is Futile

via ArsTechnica's Curt Hopkins, comes reportage of significance: Microsoft Corporations' (NasdaqGS: MSFT) Research group has released a fascinating report "Sex, Lies and Cyber-crime Surveys", detailing interesting statistical analytics, and the resultant scenarios thereof. I'll let you decide for yourself regarding the efficacy of both the report, and the fine art of cybercrime loss statistical analysis.

⅄ , Ↄ

Archive Team Targets Digital Dark Ages

Well crafted screed, via Long Now Foundation's Charlotte van den Hout, focusing on The Archive Team. Led by Jason Scott, the group targets the so-called Digital Dark Age. Deemed todays' MustRead.

"...Archive Team is a loose collective of rogue archivists, programmers, writers and loudmouths dedicated to saving our digital heritage. Since 2009 this variant force of nature has caught wind of shutdowns, shutoffs, mergers, and plain old deletions - and done our best to save the history before it's lost forever. Along the way, we've gotten attention, resistance, press and discussion, but most importantly, we've gotten the message out: IT DOESN'T HAVE TO BE THIS WAY. This website is intended to be an offloading point and information depot for a number of archiving projects, all related to saving websites or data that is in danger of being lost. Besides serving as a hub for team-based pulling down and mirroring of data, this site will provide advice on managing your own data and rescuing it from the brink of destruction. Feel free to join us on the IRC channel! We're on the EFnet network in a channel called #archiveteam, where we say truly awful things..." via The Archive Team

Ω

Malware, Making Fun of