Infosecurity.US

US Retail Banks, Federal Information Security Dust Up

Reports indicae, commercial banking institutions in the United States are peeved with the federal response to data security related attacks (evidence fingers Iranian sources for the specific attacks under scrutiny)...

ℑ

Metasploit: ARMITAGE Removed From Distribution

News, via Raphael Mudge, of the removal of graphical user interfaces utilized within the Metasploit environment. In essence, Armitage has been dropped in the Metasploit 4.6 distribution.

Ostensibly dropped by the Metasploit Project to disambiguate supported product responsibility, both are still availble and under active development for inclusion in customized environments for your penetration testing efforts. Notwitstanding the lack of a default install [through the Kali Linux  install routines] the Kali Linux team has included an Armitage package [apt-get install armitage] in the repository.

⋒ ⋏ ⋣ ⋬ ∀

Metasploit Pro + OWASP Top Ten 2013 Test Capabilities

News, via Rapid7's Christian Kirsch, of the Metasploit 4.6 release. This time, with the inclusion of OWASP Top Ten 2013 testing capability support - once the Top Ten 2013 (currently in release candidate stage, as of this posting) are unleashed, that is.

Security BSides London: Privilege Escalation

 

Web application privilege escalation, the Movie, from last years Security BSides London 2012. This year's event, Security BSides London 2013 [slated for 2013/04/24; at the Kensington and Chelsea Town Hall, ensconced on Hornton Street in London ] is this month's MustAttend event.

㎯  ①  ♽

Apple ID Flaw, Explained

One of the better explanatory posts, detailing the methodology behind the recently revealed Apple Inc. (NAsdaqGS: AAPL) UID reset flaw.

①   ♼

 

A Call to Arms - Clean Up Google Play

News, via the inimitable Brian Krebs, detailing the astonishing malfeasance displayed by Google Inc. (NasdaqGS: GOOG) in policing the Google Play storefornt. Essentially, Krebs On Security reports discovering a thriving marketplace in the buying and selling of verified developer accounts by Android malware authors. Thinking about moving to the Android platform? Think again. Read it and weep.

☠

Evernote, Attacked

Saturday, twas a wet and stormy day... First came a new sub-version update to Evernote, then comes word of a service-wide password reset due to suspicious activity...

'The investigation has shown, however, that the individual(s) responsible were able to gain access to Evernote user information, which includes usernames, email addresses associated with Evernote accounts, and encrypted passwords.' - Evernote' Operations & Security Team

 ⚠   ☠  ☢

Cerf, Rivest, Shamir, Kahn and Hopcroft: The Networked Future

via the Association for Computing Machines [ACM], panelists Vint Cerf, John Hopcroft, Bob Kahn, Ron Rivest and Adi Shamir:

"explore some specifics of the digital information revolution, notably theory and practice in securing, authenticating and maintaining the integrity of information (Cerf); and roots of modern cryptography and current topics in this area (Rivest and Shamir)..." - ACM

Simply Outstanding.

ↀ

Attribution, Lack of

Meanwhile, in flawed intelligence analysis news (now promoted by elected officials) the latest  'Iranian State Sponsored Financial Institution Attacks' attribution statements lack both clarity and firm evidential artifacts.  Kudos to InformationWeek's' Mathew J. Schwartz for making the appalling flaws clear.

Notwithstanding the reported lack of evidence, the reality of the overt linkage between and betwixt the Iranian national defense infrastructure (e.g., the IRIA, Gendarmerie, IRGC, Oghab 2, Quds Force, and the Army of the Guardians of the Islamic Revolution, etc.) and external-to-the-government hacker collectives is is just that - overt, rather than covert.

The smoking gun, as it were, will likely target those Iranian nationals [rather than the theocratic State]; but again, predicated on conjecture, rather than evidentiary proof.

Whilst a multitude of electronic acts of warfare can be sourced to the Islamic Republic of Iran or the nations-states' thralls, the current activities cannot yet be attributed with finality of judgment. The key concept here is evidence leading to a reasoned and prudent understanding of attribution within the scope of information security and electronic warfare realms, specifically focused on the attacks under scrutiny.

♃, ☊

Outlook Hijack Hijinks

Newly released cookie hijacking hijinks targeting Microsoft Corporation's (NasdaqGS: MSFT) on-line Outlook mail service.

^

PortSwigger Releases Burp 1.5

News, of the latest release of Burp, now at version 1.5 by PortSwigger. A superb solution for discovering vulnerabilities in your web applications, the free version is available as well. Outstanding.

Ǣ

Facebook Goes Off The Record

$5.oo for nearly 1 million UIDs revealed during supposedly confidential discssion between social network behemoth Facebook and Czech blogger Bogomil Shopov.

Ħ , Ɯ

Developers, Lessons Not Learned

Those pesky developers...

ᶎ

Pandoras' Revelations

Pandora's revealing nature...

ᴟ

Secret Cloud

  

Astonishing news, via NextGov, of the decision by our nations Services de Renseignement to migrate classified Matériel to the cloud. Phenomenal...

đ

Dis-Harmony, The Crackage

Not the conventional view of a happy ending - more on the eHarmony dump and crack, with reports of the majority of password objects cracked by Trustwave's SpiderLabs (utlizing two of our favorites -  John the Ripper and oclHashcat).

Ʊ

TOR, Surveilled

Another well crafted screed from the inimitable John Leyden of El Reg - this time detailing the dust-up between and betwixt CyberRoam and the TOR project. Allegations of mass surveillance are rampant, whilst answers are apparently not up to snuff...

ẗ

PII Carrion aka Spokeo

More on one what is most likely the most egregious personal privacy violator (other than Facebook) on the Interwebs -  Spokeo. Read and weep...

➑

Germanischen Cyberkrieg

Evidently, the Germans have their very own electronic warfare unit... What next - an electronic Ligne Maginot française - on the opposite side of the now, non-existent, electronic border? Astonishing.

ṧ

The Unit

The open secret of successful, focused national security and infrastrucure within Israel, and the companies created by the Unit's veterans.

 

 

J4VV4D: Flaming FUD

 

ŭ

Nitrozac and Snaggy: Investment Grade Facebookery

via the comic genius of Nitrozac and Snaggy at The Joy of Tech™

Twitter's Feet of Clay

Outstanding screed, crafted with thoughtful erudition, by the inimitable Dustin Curtis; in which, the good Curtis illuminates the peccadiloes of Twitter, et al.

ѭ

La Bêtise Flagrante Twitter

...or, why I have terminated the use of Twitter. Permanently.

Ѯ

 

Stand Your Cyberground

 

Insightful article, via The Atlanic's Dr. Patrick Lin [The Good Doctor is the director of the Ethics + Emerging Sciences Group, at California Polytechnic State University, San Luis Obispo] , targeting the Cyber Intelligence Sharing and Protection Act (CISPA).  Dr. Lin's screed is far more erudite than any comment I could make, as such, I highly recommend detailed scrutiny of his post. Today's MustRead.

Ȫ , IJ

The Pulse of SSL

via Ivan Ristić, author of ModSecurity, and Apache Security, and one of the great minds in information security today, comes news of The Trustworty Internet Movement SSL Pulse. SSL Pulse, is essentially, a information dashboard provisioning significant data relevant to the current state of the SSL ecosystem, if you will. Absolutely Outstanding.

✺, Ẩ

TLS/SSL SNAFUs Lead To Flawed Site Security, Go Figure...

 
Evidently, site and web administrator's need a refresher course in socket and transport layer security configurations... Not particularly surprising, that. 

ƫ 

Litany of the Great Unpatched: 13 Year Old Oracle TNS Listener Flaw

News, of a thirteen year old Oracle Corporation (NasdaqGS: ORCL) Transparent Network Substrate Listener (TNS) flaw, reported, in error (a timing error, not in essence)... Regardless, flawed listener bits permit egregious Oracle Database attacks. Oops, all-around.

❆ , ◀, Ǣ , Ħ