A Quick and Dirty Intro to Nessus (Hacking Illustrated Series) - Nice swf movie to walk you through using Nessus from the Auditor boot CD. There are also more great videos and a nice resource under thier General Network Security section. Be sure to use thier RSS Feed.
SecurityFocus HOME News: Trojan attack takes files hostage: "The Trojan downloader (download-aag AKA Pgpcoder) exploits a well-known Internet Explorer vulnerability (MS04-023) to download hostile code onto vulnerable Windows boxes. It then searches for files with various extensions and encodes them. The original documents are deleted and the newly encoded files become unreadable. The malware also drops a message onto the system with instructions on how to buy the tool needed to decode the files, demanding payment of $200 from victims if they ever want to see their documents again. "
I'm in the wrong business. This seems to be the first of it's kind in the fact that your files are held for ransom, and I expect in the upcoming years that this type virus will become commonplace. Another reason why backups are a Good Thing. But for all of you who don't back up your files, have fun with this one.
May 19, 2005
Best Sites for Windows Powered Pocket PCs, Handheld PCs, and Smartphones: Awesome resource for those who own or support handheld mobile devices.
May 16, 2005
Although I don't own a Treo 650, I have been called upon to support these devices. Here are a few resources that I found helpful.
palmOne - Support - Treo 650 - The official support site.
palmOne - FREE Newsletters - keep up-to-date on updates.
Treo650Faq: The Treo 650 Knowledge Base. - tons upon tons of info.
palmOne - Community - Tips for Treo 650 Smartphone - A large list of tips.
Some notes I found interesting:
Access error log after crash:
Press the Phone button.
Using the on-screen dialpad or the number keys enter #*377 (#*ERR on the dialpad for error) and choose Dial.
Google It With Your Treo
A new service from Google enables you to ask questions, retrieve definitions, and much more. Using the Treo messaging program, enter a phrase, for example define pandering, and send it as a text message to 46645. Usually within a minute Google will respond with the definition. Other phrases you can use include pizza followed by a Zip Code to find the names and address of local pizza joints.
May 10, 2005
Microsoft Security Bulletin MS05-024: Vulnerability in Web View Could Allow Remote Code Execution (894320) - Important
Almost as good as no updates. Great Birthday present from MS!
May 04, 2005
How a Bookmaker and a Whiz Kid Took On an Extortionist — and Won - CSO Magazine - May 2005: "Facing an online extortion threat, Mickey Richardson bet his Web-based business on a networking whiz from Sacramento who first beat back the bad guys, then helped the cops nab them. If you collect revenue online, you'd better read this."
Huge article covering Online Extortion; worth the read.
The Java Telnet Application/Applet v2.0: "... is a fully featured telnet implementation coupled with a very sophisticated terminal emulation for VT and ANSI terminals."
April 18, 2005
Wired News: U.S. Military's Elite Hacker Crew: "The U.S. military has assembled the world's most formidable hacker posse: a super-secret, multimillion-dollar weapons program that may be ready to launch bloodless cyberwar against enemy networks -- from electric grids to telephone nets."
"In simple terms and sans any military jargon, the unit could best be described as the world's most formidable hacker posse. Ever."
It is interesting to read reports like this. "Cyberwar", "hacker posse", etc. What is the media's facination with this romantized vision of the great computer war? This isn't Neuromancer where "Console Cowboys" "punch deck" and mesh with the "Ice" and ride on a digital shark to "cut the AI" (or in Johnny Neumonic, but it was a digital dolphin that helped "Hack his Brain"). This isn't the final "Hack the Gibson" scene in the movie "Hackers" where you float around a "data city".
The reality of the situation boring, nothing like the images the media conjures to describe the "Cyberwar". So the Military has some guys that call themselves hackers (who doesn't). They probably sit around in some cubes, a few computer screens in front of them, typing away at some command prompt, running scans on foriegn IPs, looking for exploits, intercepting traffic. Probably very boring, nothing like what it is hyped up to be. Maybe it's just me, but I'd love to see the media portray the real, unhyped world of hackers (or just anything to do with computers), but that would be too boring for the masses.
April 14, 2005
eEye Digital Security - is offering a free new utility, the Retina WiFi Scanner for Windows and for Pocket PC. eEye always produces fine security tools, I suggest you check them out.
Here is an excerpt: "The Retina WiFi Scanner is a comprehensive wireless detection tool that incorporates Retina Network Security Scanner technology to discover all active wireless devices and connections on a company network. Installed on a Windows laptop or desktop PC, Retina WiFi enables security and IT professionals to detect wireless access devices, scan for service and generate detailed reports on their wireless security. Retina WiFi Scanner for Windows can push data to eEye's REM Security Management Console to integrate into a company’s overall vulnerability management system."
April 12, 2005
Microsoft Security Bulletin MS05-016: Vulnerability in Windows Shell that Could Allow Remote Code Execution (893086) - Important
Microsoft Security Bulletin MS05-017: Vulnerability in Message Queuing Could Allow Code Execution (892944) - Important
Microsoft Security Bulletin MS05-018: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege and Denial of Service (890859) - Important
Microsoft Security Bulletin MS05-019: Vulnerabilities in TCP/IP Could Allow Remote Code Execution and Denial of Service (893066) - Critical
Microsoft Security Bulletin MS05-020: Cumulative Security Update for Internet Explorer (890923) - Critical
Microsoft Security Bulletin MS05-021: Vulnerability in Exchange Server Could Allow Remote Code Execution (894549) - Critical
Microsoft Security Bulletin MS05-022: Vulnerability in MSN Messenger Could Lead to Remote Code Execution (896597) - Critical
Microsoft Security Bulletin MS05-023: Vulnerabilities in Microsoft Word May Lead to Remote Code Execution (890169) - Critical
MS05-019 looks like it can be a huge pain. Have fun!
April 08, 2005
CPAU: "Command line tool for starting process in alternate security context. Basically this is a runas replacement. Also allows you to create job files and encode the id, password, and command line in a file so it can be used by normal users."
This is an awesome little tool. Worth adding to your toolkit. Also has it's own forum for help from the user community.
Powercfg: Enables an administrator to control the power settings on a system.
This is a great command-line tool to control those bloody power options. In the past I posted about the GPO solution from EneryStar, but it turned out to just be too much trouble. This .exe is built into Windows XP SP2, so no software installation is necessary. It allows you to list the power schemes, query thier settings, create, delete, change, and more. You can configure via command line everything that you can configure via the GUI. This has really saved me a ton of headaches, since I have over 150 systems that require always on (no hibernation/standby) and the user is locked down to the point that it is impossible to change the power config without changing the GPO settings for all the machines. A little Powercfg and logon script and it's problem solved!
April 06, 2005
Beware of WinXP XP2 and group policy issue: "After you install Windows XP [SP2], you may notice an issue when you configure the Windows firewall group policy settings: Group policy-based software distribution does not always occur with the first or second reboot and other group policies are not always applied."
By default, Windows XP does not wait for the network to be initialized at startup and logon, thus some GPOs and GPO settings are missed until the next reboot. This can be changed (as the article states) at 'Computer Configuration\Administrative Templates\System\Logon.'"
On another note, the Search/TechTarget site contains a wealth of great information/resources on a (large) variety of subjects. I personally subscribe to over 10 of thier many, many mailing lists and recieve great tips in my email daily. You may want to check them out.
How to Use Dumpchk.exe to Check a Memory Dump File: "This article describes Dumpchk.exe, which is a command-line utility that you can use to verify that a memory dump file has been created correctly. Dumpchk does not require access to symbols."
Analyzing Windows 2000 Memory Dumps - From LabMice.net
Troubleshooting Windows STOP Errors (BSOD) and Freezes from the UltraTech Knowledgebase
April 05, 2005
Rexploit - is a group of security folks that put together a great collection of security tools/information. Best of all, they coupled it with Knoppix (bootable Linux) and threw it all on a CD! It's a fairly slow download, but it looks like it'll be well worth the wait. This CD is even recommended by the FBI.
Another good Knoppix-based security CD I've used (and loved) in the past is Knoppix STD. "{It} is a collection of hundreds if not thousands of open source security tools. It's a Live Linux Distro, which means it runs from a bootable CD in memory without changing the native operating system of the host computer. Its sole purpose in life is to put as many security tools at your disposal with as slick an interface as it can."
Subscribe to:
Posts (Atom)