Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×

Submission + - Uptick in TOR traffic: More Privacy or more Malware? (sans.edu)

Submitted by Anonymous Coward
An anonymous reader writes: A number of sources commented on the significant uptick in TOR users in the middle of August. The uptick coincided with yet another set of leaks from Edward Snowden about internet wide spying, and the release of some new privacy tools. But can this explain the uptick? Or is it just some new malware that uses TOR as a C&C channel?
Security

Submission + - Why you should wipe the drive after a compromise (sans.edu)

Submitted by
UnderAttack
UnderAttack writes: "After a malware infection, or a compromise of the system in a more targeted attack, there is always a push to get "back into business" as quickly as possible. The malware artifact is quickly removed and the system is put back into service without too much scrutiny. Sadly, this way backdoors and other hidden gifts the attacker left behind are frequently overlooked. The result is that the system is compromised again quickly. The only real solution is wiping the drive and starting from scratch (and hoping that you have decent backups). This two part series by Mark Bagget makes this point by outlining some of the tricks an attacker may use to hide backdoors and to have them automatically executed on a system. Part 1 talks about how to usurp the windows update process to reinstall malware, and Part 2 shows how to use the unescaped space bug and the service restart tool to get the malware to start."
Networking

Submission + - Is your network managed by a "Slumlord"? (forbes.com)

Submitted by
UnderAttack
UnderAttack writes: "The “Section 8 Bible”, a must read book for aspiring landlords, introduces a simple rule to deal with broken equipment in the apartment: If law does not require it, remove it. Don’t fix it. For example, interior doors are not necessarily required and can be removed. Network security professionals frequently follow similar guidance: If there is no business requirement, disable it. The rule assumes that minimizing features minimizes exposure. The fewer lines of code we run, the less likely are we going to be vulnerable to a bug.

How valid is slumlord network security? Can it really protect a network? Does it do more harm then good?"
Government

Submission + - A Reporter's Doubts About AntiSec's Claim of Hacking Apple Data from FBI (cio.com)

Submitted by
Curseyoukhan
Curseyoukhan writes: "AntiSec says they got it from Christopher K. Stangl, an agent featured in a 2009 recruitment video titled “Wanted by the FBI: Cyber Security Experts.” Not saying it didn't happen but the irony level is so high it should make you suspicious. That's not the only oddly perfect claim AntiSec made, either."

Comment Report it to DShield.org (Score 5, Informative) 241

"Random" attacks can be reported to DShield.org . They have a number of scripts to automatically submit firewall logs (including from Linux firewalls). See http://www.dshield.org/howto.html . Once set up, it just "runs" and DShield aggregates the data, uses it for research and reports worst offenders to ISPs and other contacts.
Security

Submission + - Is Your Network Security Guy a "Slumlord"? (forbes.com) 1

Submitted by
UnderAttack
UnderAttack writes: "The “Section 8 Bible”, a must read book for aspiring landlords, introduces a simple rule to deal with broken equipment in the apartment: If law does not require it, remove it. Don’t fix it. For example, interior doors are not necessarily required and can be removed. Network security professionals frequently follow similar guidance: If there is no business requirement, disable it. The rule assumes that minimizing features minimizes exposure. The fewer lines of code we run, the less likely are we going to be vulnerable to a bug. Is your network like that? Does it work for or against security?"
Security

Submission + - IPMI: Hack a server that is turned "off" (sans.edu)

Submitted by
UnderAttack
UnderAttack writes: "A common joke in infosec is that you can't hack a server that is turned off. You better make sure that the power cord is unplugged too. Otherwise, you may be exposed via IPMI, a component present on many servers for remote management that can be used to flash firmware, get a remote console and power cycle the server even after the normal power button has been pressed to turn the server off."
Microsoft

Submission + - Windows bug found - affects all versions since NT (theregister.co.uk)

Submitted by garg0yle
garg0yle writes: A researcher has found a security bug that could allow privilege escalation in Windows. Nothing new there, right? Well, this affects the Virtual DOS Machine, found in every 32-bit version of Windows all the way back to Windows NT. That's 17 years worth of Windows and counting.
The Internet

Submission + - APNIC warns IPv6 delay could cost you more (computerworld.com.au)

Submitted by Anonymous Coward
An anonymous reader writes: Computerworld is reporting that APNIC — one of the regional bodies responsible for distributing IP addresses — is warning it could cost consumers and businesses more for their internet access if the adoption of IPv6 isn't sped up.

The official representative of the five regional bodies that oversee distribution of Internet number resources — the Number Resource Organization (NRO) — has announced the remaining allocation of IPv4 addresses had dropped below 10 per cent.

The article quotes APNIC chief scientist Geoff Huston as saying the rise of many Asian economies along with mobile devices is driving the accelerated decline of IPv4

"It's not that there won't be addresses [IPv4] to be had, but the price will make folks' eyes water," Huston is quoted as saying. "Because the only source of addresses will be someone who already has them and, in a market where scarcity dominates, you start to get an entirely different pricing structure."

http://www.computerworld.com.au/article/333162/apnic_ipv6_adoption_delay_could_create_costs/?c=4717
Security

Submission + - CCTV catches Aussie thief infect firm with malware (itnews.com.au)

Submitted by Anonymous Coward
An anonymous reader writes: South Australian Police are hunting a male who broke into a recruitment firm and spent three hours installing remote access software on one of its computers. The incident was captured on closed-circuit television. The CCTV footage showed the suspect "basically open a few doors in other offices" before sitting down at the computer and "working away for a couple of hours."
Google

Submission + - China strikes again, this time against journalists

Submitted by Anonymous Coward
An anonymous reader writes: You may have heard that the Chinese government allegedly attacked Google, targeting intellectual property and Chinese dissidents' GMail accounts. And if you were paying attention, you might have read that they allegedly attacked a law firm that was suing the government and several Chinese companies. It now appears that they (allegedly) attacked foreign journalists GMail accounts as well, using the same techniques. I have only one question: Just how many people are dumb enough to store seriously confidential information in a public webmail service? Don't the dissidents have any sense? Can't the AP provide something secure? WTF?
The Almighty Buck

Submission + - Fight Fraudulant Disaster Domains

Submitted by
UnderAttack
UnderAttack writes: "The SANS Internet Strom Center (ISC) setup a web page listing about 500 domains that use keywords related to the Virginia Tech shooting. Turns out that most of them got registered just the last 2 days. While some are used for innocent purposes, others are used for fraud. The page allows everybody with an ISC or DShield account to help categorize the pages. The ISC did the same after Hurricane Katrina, which spurred a lot of these scum-domains."
Security

Submission + - Hacking Web Applications Over Lunch

Submitted by
Anonymous Coward
Anonymous Coward writes: "Vuljnerable web applications are a huge problem. A new SANS paper: Web Application Auditing Over Lunch shows some very simple tricks on how to check your web application for common security issues.

After all, many web application didn't take longer then that to write. So why not break them in the same time. The paper is pretty platform neutral. However, I found the mentioned firefox extension "Tamper Data" to be very usefull."

Slashdot Top Deals

It's a naive, domestic operating system without any breeding, but I think you'll be amused by its presumption.

Close