Comment Re:Best Part (Score 1) 174
Some intruders download Windows service packs to check the bandwidth available.
Comment Re:Want to buy (Score 1) 175
Theobroma hit retail availability two years ago, and is pretty widely carried. When in season, it's not hard to find - ask your retailer to ask their distributor to get some stock. Follow @dogfishbeer on twitter to know when they're brewing which recipe.
Comment Re:Want to buy (Score 1) 175
... retail locations, all in Delaware.
Their products are available (almost*) nationwide, and in some international locations.
* Except for a small number of states that do not permit distribution of regular-ABV beers.
Palm WebOS Hacked Via SMS Messages 99
gondaba writes "Security researchers at the Intrepidus Group have hacked into Palm's new WebOS platform, using nothing more than text messages to exploit a slew of dangerous web app vulnerabilities. The white hat hackers found that the WebOS SMS client did not properly perform input/output validation on any SMS messages sent to the handset, leading to a rudimentary HTML injection bug. Coupled with the fact that HTML injection leads directly to injecting code into a WebOS application, the attacks made possible were quite dangerous (especially considering they could all be delivered over an SMS message)."
Comment BlockHosts (Score 2, Informative) 497
We started using BlockHosts to feed iptables rules, and our failure logs went from 30-50k per day to 100. Basically, with more than 'x' failed logins within 'y' time frame, the source IP is blocked for 'z' time period. Since it uses iptables, you could block it from just the ssh port, or the entire system (we do the latter).
All three variables are configurable, and we also have whitelisted a few select standby IPs for contingency use. (As another poster said, you **will** lock yourself out eventually.)
Comment Re:Won't someone please think of the children (Score 1) 256
You said
"HTTPS only works one IP per host, so that gives a positive track to where they were going."
That is not correct. If you inspect HTTPS traffic you'll see that clients issue something like the following:
CONNECT www.myawesomehost.net:443 HTTP/1.1
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Proxy-Connection: keep-alive
Host: www.myawesomehost.net
The same IP address can host www.myawesomehost.net and plenty of other Web sites. With HTTPS the Feds would just track the CONNECT and Host: fields since those are in the clear.
Submission + - Report: 7 Years of Advanced Persistent Threat (mandiant.com)
psychosis writes: Mandiant's "M-Trends" report highlights more than seven years of lessons learned while conducting computer and network intrusion investigations for the U.S. government, the defense industrial base, and commercial organizations. Recently, a number of device vendors and "security" shops have been attempting to surf the "APT PR wave," but Mandiant has been actively engaged in responding to the APT for longer than most in the industry have even acknowledged such a pervasive threat exists.
This report offers a comprehensive, FIRST HAND account, and includes several case studies.
Bottom line: if you run a computer network that is now or may someday be of interest to foreign governments or criminal organizations you should request and read this report.
Free registration required, but worth the 5sec of effort...
This report offers a comprehensive, FIRST HAND account, and includes several case studies.
Bottom line: if you run a computer network that is now or may someday be of interest to foreign governments or criminal organizations you should request and read this report.
Free registration required, but worth the 5sec of effort...
Comment Re:Thanks! (Score 1) 216
"I know the book has pissed some people off, especially when I take on their particular sacred cows (e.g., intrusion detection)."
"Sacred cows" have nothing to do with it. The book just isn't that interesting.
Comment Richard Bejtlich's Observation of CDX 2009 (Score 1) 219
Richard Bejtlich from the TaoSecurity Blog was invited by NSA's Tony Sager to visit the CDX in person:
http://taosecurity.blogspot.com/2009/05/thoughts-on-2009-cdx.html
Bejtlich mentions that CDX participants were given a budget for the exercise. This means it cost them "marks" (in exercise language) to replace the Windows images NSA provided with alternative systems like FreeBSD or Linux. That decision caused the team to have less resources for other tasks.
The Army didn't win just because they used Linux. Bejtlich posts reasons why they won here:
http://taosecurity.blogspot.com/2009/05/lessons-from-cdx.html
Comment Linked pdf is not the result of the 60 day study (Score 1) 133
Watch for a report from Melissa Hathaway, who is leading the effort. The linked
Comment Association of Former Information Warriors (Score 1) 426
As a result of this discussion, the Association of Former Information Warriors was created.
LinkedIn Group:
http://www.linkedin.com/groups?about=&gid=1847393
Blog:
Submission + - Cox To Begin Throttling P2P, Software Updates (gallopinc.com)
tlhorset writes: "Given the infamous head-to-head in between Comcast and the FCC last year over the practice of bandwidth throttling based on traffic type, one might be surprised to hear that Cox Communications is going down the very same path..."
Bookmark Cox To Begin Throttling P2P, Software Updates (gallopinc.com)
Bookmark Another Reason to Ditch your Land-Line (gallopinc.com)
Submission + - Top 10 Personal Technology Services Of 2008 (gallopinc.com)
tlhorset writes: "We use technology services everyday. Internet, TV, Phone, even Software as a Service or remote content delivery, they all impact our daily lives. A review and summary of the top 10 personal technology services of 2008, how they impacted users and how they led the market to change."
