Mobile Banking Security

Any bank or credit union is a good deal to offer mobile banking. This is because customers demand it, people can pay their bills and balance will see, among others. Very few people, especially the younger generation do banking the old fashioned way. Some have even started a service that offers to scan checks for deposit upload.

Therefore, almost all banks, including large and small species, some mobile banking. This is obviously great, but the security of mobile banking is often overlooked because they implement the changes quickly. Bank has a lot of sensitive data, it is important that security very seriously. Not only that, but some high-profile banks have been kidnapped in the past. Bank is a target for hackers, not only for the information they hold, but others do it for political reasons.

Measures that exist in most banking sites implemented. Usually they go for a regular user name and password. Some require a code every time you login from a new location, make sure you access your personal e-mail or telephone. This is a step to verify who you are. Others have a security question you need answered. The answer is given when the user logs on. This of course saves the problem. Others require a password that is easy to guess, which consists of random letters and numbers, uppercase and lowercase letters. Some even require you to change your password periodically.

Of course, the best mobile banking security will be compromised because it does not really sure. But if the right steps taken, he would ensure that the bank may not be aligned. Customers should think in the end, even as they do not share the password with others, and use a secure connection. It would be very easy for someone to get a WiFi hotspot banking password. Customers also need to ensure that they log out of the machine together.

Mobile banking security should not be overlooked. If the site is entered directly and successfully. To open a bank for a lot of obligations. If, in addition to high-profile cases make the news, many customers lose confidence in banks and bank accounts more closely and elsewhere. Customer data is exposed to a public relations nightmare and should be avoided at all costs.

More Details... »

How to Clean Virus / Malware Security Tools

Security Tools, also known by the name Security Tool is a rogue anti-spyware program that is spread through pop-ups, Trojans and malware websites. Security Tool Pro Police deployed as Windows or Green AV (Antivirus) 2009. Rogue anti-spyware programs are distributed through websites that simulates virus scan, then users are told to download software to clean computer.

Once installed, Security Tool will automatically be active every time you turn on your PC and log into Windows. Then he will start scanning your computer and give a false list of viral infections that occur on your computer. When you try to clean the infected files (but not), then you will be reminded to buy the software.


Beware, do not believe anything said by this evil software, and do not remove / delete files that it says has been infected, because in fact those files are files that are in good condition, and necessary.


Thus appearance of Security Tool.

To clean your computer of these software problems, then you need MalwareBytes Anti-Malware.

How do I clean the computer of the Security Tool?

• Download MalwareBytes Anti-Malware.
• Install file mbam-setup.exe.
• To install it, just hit next and do not edit any of the options if you do not know anything.
• After the installation is complete, MalwareBytes Anti-Malware will start automatically and will ask you to do a software update, so just press OK.
• Open the Scan tab, select "Perform Quick Scan" and press "Scan".
• MalwareBytes Anti Malware will immediately do a scan on your PC to locate malware, including Security Tool.
• You will see a notice that reads "The scan completed successfully. Click 'Show Result' to display all objects found "after the scan is complete. Press OK.
• Now press the "Show Results".
• You will see a list of malware applications, including the Security Tool evil. make sure you have selected everything on the list and press the "Remove Selected".
• Once MalwareBytes Anti Malware finished cleaning, you can close the program and make sure your computer in safe condition.

Is there among my friends who already dikerjain by malware Security Tool? If yes, then just do the above tips, and hopefully be able to immediately address the problems faced.

More Details... »

How to restore the Task Manager, Regedit, Show Hidden Files is On Disable

Menu Task Manager could not be opened, appears a statement that the "Task Manager has bed disabled by your administrator ”









Then try opening regedit via the run to enable the registry editor REGEDIT fact can not be opened and a popup appears saying "Registry editing has been disabled by your administrator" as a popup below:

Furthermore, when we want to see hidden files (hidden files) from the folder menu options were disabled as well, dizzy head would most likely a virus, worm, or Trojan that came in through the flash had been, it could be a virus that has been used since. Immediately, I scan using an existing course antivirus with latest updates. God bless the virus is gone, now living back several settings that are usually altered by the virus.



There are several ways that we can do to restore its original settings, the first way is to remove DisableRegistryTools manually from a command prompt. way is as follows:

1.  open command prompt, start > run > Type “cmd” (without quotes) > enter.
2.  Typing di command prompt following :

reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools

3. Then will come the questions:

Delete the registry value DisableRegistryTools (Yes/No)?

4. Answer by typing : Yes

5. After that open the Registry Editor through Run menu by typing: regedit and click OK

God bless the Registry Editor is open means has opened the way to change the next setting. Next live enable task manager of the registry editor.

Listen

Read phonetically

here are the step by step1. Open Regedit
2. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
3. Make sure the value for the DisableTaskMgr REG_DWORD 0 (zero).
4. Close Regedit.

To Show Hidden Files, its setting is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL . Checked REG_DWORD Value for Value is 1, this value is usually changed to 2 or 0 by the virus.

Apart from the Registry Editor or regedit, we can also alter our windows PC from the Group Policy Editor. The way the entry is to type gpedit.msc in the run command menu. In the Group Policy Editor, there are 2 parts of the menu, the User Configuration and Computer Configuration.

To disable / enable the Task Manager on the menu User Configuration> Administrative Templates> System> Ctrl + Alt + Del Options. Select the setting "Remove Task Manager” and change it to "disabled" or "not configured".

Meanwhile, to disable / enable regedit is on the menu User Configuration> Administrative Templates> System. Select the setting "Prevent access to registry editing tools". Select the disabled so that we can access regedit.

If it can not also use this way:
 * Open notepad.
* Type code following in notepad.
[Version]
Signature=”$Chicago$”
Provider=mailplus
[DefaultInstall]
DelReg=del
[del]
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableTaskMgr
* Save the file with the name "aktifkan.inf" (type including save the mark).
* Open the Windows explore and run the file that you have saved by right clicking »Install.

If you still can not be opened better just reinstall the computer must be wrong deh all issues
may be useful.

More Details... »

Facebook Rolls Out New Login Security Features

Facebook is now one of the most popular targets for phishers, hackers and scammers. According to the Associated Press, however, Facebook is in the process of rolling out some new security features that will protect its users from malicious attacks, spam and phishing scams. For a while now, Facebook already offered users the ability to be notified when an account was accessed from a computer or device they hadn't used before. Now, Facebook will also alert users of unusual activity on their accounts and allow users to register their devices with Facebook.

Update: Facebook just confirmed these new security updates on its blog. We have updated this post with more information.
Suspicious Logins

If somebody tries to access your account from the other side of the world, for example, Facebook will now notify you that something is amiss with your account and add an additional layer of authorization to the log-in process. According to Facebook, these additional verification methods could include asking for a your birth date (you did enter your real birth date on Facebook, didn't you?) or asking you to identify a friend in a picture and answering a standard security questions if you previously provided one.

To read more details, please refer here:
http://www.readwriteweb.com/archives/facebook_rolls_out_new_security_features_to_fight_hackers.php

More Details... »

DNS Enumeration

A penetration testing is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source. The process involves an active analysis of the system for any potential vulnerabilities that may result from poor or improper system configuration, known and/or unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures.

The first step of penetration testing or more accurately called information security testing is information gathering. Information gathering is part of the preparatory pre-attack phase and involves accumulating data regarding a target's environment and architecture, usually for the purpose of finding ways to intrude into that environment. Information gathering can reveal system vulnerabilities and identify the ease with which they can be exploited. This is the easiest way for attacker to gather information about computer systems and the companies they belong to. The purpose of this phase is to learn as much as you can about a system, its remote access capabilities, its ports and services, and any specific aspects of its security.

Using a combination of tools and techniques, attackers can take an unknown entity and reduce it to a specific range of domain names, network blocks, subnets, routers, and individual IP addresses of systems directly connected to the Internet, as well as many other details pertaining to its security posture. Although there are many types of information gathering techniques, they are primarily aimed at discovering information related to the following environments: Internet, intranet, remote access, and extranet.

To read more details, you can download my article here:

http://www.exploit-db.com/download_pdf/12389

http://www.packetstormsecurity.org/filedesc/dns-enumeration.pdf.html

More Details... »

CRITICAL LOG REVIEW CHECKLIST FOR SECURITY INCIDENTS

This cheat sheet presents a checklist for reviewing critical logs when responding to a security incident. It can also be used for routine log review. To download it, click here:
http://www.securitywarriorconsulting.com/security-incident-log-review-checklist.pdf


General Approach

• Identify which log sources and automated tools you can use during the analysis.
• Copy log records to a single location where you will be able to review them.
• Minimize “noise” by removing routine, repetitive log entries from view after confirming that they are benign.
• Determine whether you can rely on logs’ time stamps; consider time zone differences.
• Focus on recent changes, failures, errors, status changes, access and administration events, and other events unusual for your environment.
• Go backwards in time from now to reconstruct actions after and before the incident.
• Correlate activities across different logs to get a comprehensive picture.
• Develop theories about what occurred; explore logs to confirm or disprove them.

Typical Log Locations

• Linux OS and core applications: /var/log
• Windows OS and core applications: Windows Event Log (Security, System, Application)
• Network devices: usually logged via Syslog; some use proprietary locations and formats.

What to Look for on Linux

• Successful user login- “Accepted password”, “Accepted publickey”, "session opened”
• Failed user login- “authentication failure”, “failed password”
• User log-off- “session closed”
• User account change or deletion- “password changed”, “new user”, “delete user”
• Sudo actions- “sudo: … COMMAND=…”, “FAILED su”
• Service failure- “failed” or “failure”

What to Look for on Windows
Event IDs are listed below for Windows 2000/XP. For Vista/7 security event ID, add 4096 to the event ID.Most of the events below are in the Security log; many are only logged on the domain controller.

• User logon/logoff events -Successful logon 528, 540; failed logon 529-537, 539; logoff 538, 551, etc
• User account changes- Created 624; enabled 626; changed 642; disabled 629; deleted 630
• Password changes- To self: 628; to others: 627
• Service started or stopped- 7035, 7036, etc.
• Object access denied (if auditing enabled)- 560, 567, etc

What to Look for on Network Devices
Look at both inbound and outbound activities. Examples below show log excerpts from Cisco ASA logs; other devices have similar functionality.

• Traffic allowed on firewall- “Built … connection”, “access-list … permitted”
• Traffic blocked on firewall- “access-list … denied”, “deny inbound”; “Deny … by”
• Bytes transferred (large files?)- “Teardown TCP connection … duration … bytes …”
• Bandwidth and protocol usage- “limit … exceeded”, “CPU utilization”
• Detected attack activity- “attack from”
• User account changes- “user added”, “user deleted”, “User priv level changed”
• Administrator access- “AAA user …”, “User … locked out”, “login failed”

What to Look for on Web Servers

• Excessive access attempts to non-existent files
• Code (SQL, HTML) seen as part of the URL
• Access to extensions you have not implemented
• Web service stopped/started/failed messages
• Access to “risky” pages that accept user input
• Look at logs on all servers in the load balancer pool
• Error code 200 on files that are not yours
• Failed user authentication- Error code 401, 403
• Invalid request- Error code 400
• Internal server error- Error code 500 

Other Resources

• Windows event ID lookup: www.eventid.net
• A listing of many Windows Security Log events: http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx
• Log analysis references: www.loganalysis.org
• A list of open-source log analysis tools: securitywarriorconsulting.com/logtools
• Anton Chuvakin’s log management blog: securitywarriorconsulting.com/logmanagementblog
• Other security incident response-related cheat sheets: zeltser.com/cheat-sheets

More Details... »

How to choose your Information Security Training

In the past couple of years, the economy has struck hard on organizations seeking to educate their employees. Training budgets have been cut down, and choosing the right course that will give you real Return on Investment is not an easy job. This is especially true in the offensive InfoSec arena, where training standards and qualifications are weakly defined. So how can you make sure your getting your money’s worth ?

Welcome to our “10 questions you should be asking your InfoSec Training Provider“.

1. What are the objectives of the training ?

What will the training do for you ? Anyone promising you that you will be a “hardcore penetration tester” or a “security expert” after their 5 day class has never run a pentest, or otherwise has no clue what they are talking about. Learning *any* profession in 5 days is unrealistic, let alone one as complex as IT Security, or penetration testing. This is one of the first questions I ask before attending a training… its allows me to set my goals for the course and gives me a baseline for my expectations.

2. What topics does the course cover ?

Always read the syllabus of the course you want to attend, before you attend it.  Try finding other people who have taken the class, (if possible) and get their opinion. Try to see if the syllabus follows a reasonable methodology, or if it’s just a collection of topics. If you see a list of 1500 tools on the syllabus – expect to spend around 0.6 minutes per tool. 

3. Who is your trainer ?

Are they well known in their field ? Do they have training experience ? Are they involved in the security community ? Do they practice what they preach? Although these are 4 separate questions, they all relate to one thing – the ability of the trainer to provide the goods you paid so dearly for. Finding a GOOD InfoSec trainer is NOT easy. Most computer genii are usually lacking in their social skills – something a good trainer must have.

4. What previous reviews does the class have ?

Running a few internet searches for the name of your class, or the name of the trainer is a must. Find out what people have to say about their experiences – during and after the class. Although you can’t believe *everything* on the internet, taking an average of all the reviews will usually give you a solid idea of what you are getting into.

5. What is the ratio of students to trainers ?

How many students will there be in the class ? Some training providers cram more than 30 students in one class – often with a single instructor. During a 5 day period, a trainer can’t give personal attention to 30 people, no matter what. In general, smaller classes mean a more intimate environment, more attention from the trainer, and a more productive and engaging experience.

6. What is the ratio between theory and hands-on exercises ?

Remember the famous saying “In theory, there is no difference between theory and practice – But in practice, there is”. If you don’t exercise what you learn, you are less likely to retain or understand it as nothing replaces practical experience. Ask for a rough ratio estimate for “theory VS exercise” for your class – anything above 40% class-time spent on exercises is a good sign. Of course, this greatly depends on the quality of the exercises too.

7. How often is the course updated ? Is the material relevant to modern day situations ?

Learning methods and techniques on antiquated systems will bring you little benefit in the real world. Hacking a Windows 2000 SP4 machine with RCP DCOM doesn’t cut it any more. On the other hand, don’t expect to learn “Bypassing Windows 7 Stack Protection” in an introductory buffer overflows course. You need to gauge the balance between these two elements carefully.

8. What are the pre-requisites for the class ?

How should you prepare yourself for the class? Do you need to refresh your knowledge on certain topics? Nothing is more frustrating than coming to a class, and then lagging behind because you are not up to par with the class requirements. Not good for your learning experience, and not good for your self esteem – on the other hand “no pre-requisites required” might indicate lack of depth. If the pre-requisites were defined well by the training provider, it’s definitely a good resource to use to evaluate the relevancy of the course to you.

9. Is there a certification involved ? What is it’s value ?

The “value” of a certification can be measured in the real world using two main indicators:

• The “market value” of the certification – how popular is this certification in the workforce ? Is the certificate recognized and appreciated by the industry ? And of course, will it help you get a (better) job ?

• The “practical value” of the certification – or as Eddie Murphy would say “WHAT HAVE YOU DONE FOR ME LATELY?”.  What real world skills does the certificate prove? If it proves you can memorize 100 questions, you might not be up to the job when confronted with a real world scenario.

10. What post training benefits are provided?

What ongoing benefits will you get from the training provider, if any ? Is there a continuation path for the training ? Will the trainers be available for future questions or issues that may arise ? Is there a student community you can join, to discuss the course with other student ? Or in other words, what kind of “post customer service” can you expect ?

These 10 questions should cover all the important elements you should verify before committing your valuable time and limited training budget to any service provider. The average person only gets a limited number of training opportunities per year, therefore you should always maximize the return you receive.

More Details... »

Top 5 Security No Brainers for Businesses

Occasionally folks forget about covering the fundamentals of security and start off down a rabbit hole following some shiny new technology that turns out to be just a rat hole. With today's limited security budgets you need to be sure that you've adequately covered your highest risk areas before moving on to other things. The high-risk areas are, of course, not the same for everyone and will change on you fairly frequently. The bad guys are always mixing it up; the attacks we see prevalent today are not those that we saw just a few years ago. Thus the reason for this article, to take a look at the top 5 security solutions you can put in place today to cover the widest scope of current and emerging threats. In many respects these solutions are considered obvious "no brainers". But, you'd be surprised by how many companies (big and small) that don't have them in place. Many times it is the obvious that temporarily escapes us (or at least escapes those holding the purse strings ☺)
These 5 items working together will stop more cyber attacks on your data, network and users than any other 5 items in the marketplace today. There are lots of other very useful security solutions on the market but when it comes to picking the top five most effective and readily available ones here are my choices:
Firewall – The keystone of network defense for a decade or more is still required for solid foundational security. Its job is still fairly simplistic; control what data flows can go where. Without firewalls in place to drop unwanted flows, your job of protecting your assets increases exponentially. Firewalls need to be present at your external perimeters but also inside of your network for secure segmentation of data. Deploying firewalls internally is a relatively new best practice. It is largely driven by the dissolution of any sense of a tangible, reliable network border that can differentiate trusted network traffic from untrusted external network traffic anymore. Our nice clean Internet border of old just doesn't exist anymore in modern networks. What has also recently changed is that firewalls are getting smarter and more granular in there definition of data flows. It is now common for a firewall to be able to control a data flow based on the type of application or even application function it represents. For example, a firewall can block a SIP voice call based on what number was dialed.
Secure Router (FW, IPS, QoS, VPN) – Routers are everywhere in most networks. By tradition they have been used just as traffic cops for flows. But modern routers can do so much more than that! Routers are chock full of security features, sometimes even more so than a modern firewall. Most routers in the industry today are capable of robust firewalling features, some semblance of useful IDS/IPS functionality, robust quality of service and traffic management tools and of course strong Virtual Private Network data encryption features. The list doesn't stop there either. The power of modern routers to add to the security of your network is commonly overlooked today. With modern vpn technology it is fairly straight-forward to start encrypting all of the data crossing your WAN links, but very few people do so. It is also too atypical that folks use the firewall functions and IPS features in their routers. Turn 'em on and see your security posture improve!
Wireless WPA2 – This is the no-brainer of them all. If you aren't using WPA2 wireless security then stop what you are doing and form a plan to start doing so. Many other methods of wireless security are not secure and can be compromised in minutes. Don't make it easy for the bad guys, turn on WPA2 with AES encryption today.
Email Security – We all know email is currently the top attack vector used by black hats. Viruses, malware and worms all love to use email as their propagation method. Email is also the top way we loose most of our sensitive data. On top of the threats and data loss we experience through email we also have simple junk mail, spam. About 90% of all email sent today is spam! A good email security solution will get rid of the junk and filter out the malicious stuff as well. It is likely that if you are getting a lot of spam through your current system then you are getting even more malware through it. The thought process being that the spam features in email security gateways is usually the focus, core competency of the product. So if it is not doing its job dropping spam then it certainly isn't doing its job catching malware and data leakage.
Web Security – Threats coming from port 80 and 443 are rising faster than any other threat vector today. The expanding complexity of web based attacks necessitates that a company deploy a robust web security solution. Simple URL filtering has been with us for years and it is a core component to web security for sure. However, web security needs more than just URL filtering it needs AV scanning, malware scanning, IP reputation awareness, dynamic URL categorization techniques and Data leakage prevention functions. Attackers are compromising high profile sites at such an alarming rate that if we just relied on URL white list, black list filtering we'd have nothing left in the white list anymore! Any web security solution has to be able to dynamically scan web traffic to make a decision on its validity. Of all the solutions listed here, it is in web security where taking the risk of deploying a cutting edge, best of breed solution will pay of the most. The other solutions on the list are, for the most part established and mature. Web security solutions bells and whistles are coming out as fast as the hackers are building new attacks. Well ok, not quite that fast.
What are your thoughts on my choices for top 5 security no brainers? Think I got it wrong or right? If you had to add a sixth one what would it be?
If your company doesn't have all of these 5 in place today, go bang on some doors and raise the roof on awareness! Don't let it all burn!

The opinions and information presented here are my PERSONAL views and not those of my employer. I am in no way an official spokesperson for my employer.

More Details... »

Proof of Concept for MS10-006 SMB Client-Side Bug

This is a technic to automate with no user interaction at all SMB client side bug exploitation targeting the Domain Master Browser (DMB) or PDC  (only the PDC can be a DMB)which is basicaly the perfect target in a pentest. Targeting the DMB is perfect, simply because if you control that box, you'll control all computer joined to this box tree.

Since the SRD is once again downplaying SMB client side bug i think it's important to share this kind of tricks.

It's also important to mention that Browser and NBNS abusing is well known since a long time, as theses protocols wasn't developed with security in mind, this blog post is a simple real case example.

There's two way to automate SMB client side bug;

• NBNS Spoofing (require some "kind" of user interaction in some way,   anyways  in a corporate network it works pretty well)

• Browser Protocol Abusing (the funny one)

In this case I will cover a form of Browser Protocol Abusing.

More Details... »

FBI Investigating Gawker Media Hack

The FBI confirmed to PC World that it is investigating the recent intrusion by a group of hackers into Gawker Media's servers last weekend. The hack exposed more than 200,000 reader e-mail addresses and passwords, and the data is now circulating online as a peer-to-peer torrent file. An FBI representative declined to comment further about the ongoing investigation; however, Gawker Media founder and CEO Nick Denton was scheduled to meet with federal authorities on Monday, according to The New York Post .

On Sunday, an online hacker collective calling itself Gnosis broke into the servers of Gawker Media, which owns a variety of popular online blogs including Deadspin, Fleshbot, Gawker, Gizmodo, Jezebel, io9, Jalopnik, Kotaku and Lifehacker. The hackers obtained the e-mail addresses and passwords for the company's employees, and the source code for Gawker Media's content management system. Gnosis hackers also obtained the login credentials for readers who were registered to leave comments on Gawker Media websites.

Gawker Media said most user login information was encrypted, but Gnosis managed to crack the credentials for more than 200,000 accounts. The exposed login information is now part of a data dump contained in a torrent file available on peer-to-peer file sharing networks.

It's not entirely clear what inspired the attack against Gawker, but a person claiming to represent Gnosis recently told the blog Mediaite that the hacker group broke into the company's servers because of Gawker's "outright arrogance." Previously, it was suggested the Gawker hack was related to the company's ongoing feud with members of 4chan, an online message board. The Gnosis representative said there was no connection between the hacker group and 4chan.

Despite the potentially criminal acts perpetrated by Gnosis hackers, more high-minded hackers (among software engineers the term hacker refers to someone who is a programming expert) were coming to the defense of Gawker Media users. Readers of Y Combinator's Hacker News -- a news aggregator and discussion thread for technology start-up entrepreneurs and software engineers -- banded together to create an automated e-mail program to alert the 200,000 people whose e-mails and passwords were exposed by Gnosis.

If arrested, it's not yet clear what charges those responsible for breaking into Gawker's servers would face.

This article is taken from NetworkWorld.

More Details... »

How security professionals monitor their kids

April 12, 2010 (CSO) Cell phones, texting, IM, e-mail, Facebook, MySpace -- kids are interconnected today in ways hardly imagined two decades ago. But these technology-based communication platforms also enable new forms of an age-old parenting strategy: monitoring your kids.
Who are they talking to? What are they talking about? Are they going where they said they are going?
Most of us with children think about this stuff. But parents who work by day as security professionals live in a heightened state of risk awareness, and also have the expertise and the tools to monitor kids' behavior and communication in many ways.
[Also see: Social media risks: The basics]
Is it any easier to put the proper measures in place to ensure your child's security since you already have an expertise in this area? Or do you go overboard because of you are hyperattuned to risk? And what is the right balance of freedom and guidance to provide for kids?
Turns out it was tricky issue before social networking, and remains tricky now. Here are views and strategies collected from an array of security professionals.

'Spying' on your kids?

Martin McKeay, a CISSP and security consultant who maintains a popular network security web site and blog, recently found out how divided security professionals are on the issue of monitoring children. McKeay, the father of two boys aged 8 and 10, received an intriguing message recently from someone on a mailing list who wanted his opinion.
"It asked 'What kind of software can I use to spy on my children and read their every email?'" said McKeay, who was slightly taken aback by the wording and the person's obvious, no-bones-about-it attitude that they intended to pry into their kids' lives without warning or limit.
"I consider that going over the top. So I went on Twitter and asked other people: 'How do you think this should be handled? Is it through monitoring software, or parental relationships?'" McKeay recounted. "With rare exceptions, most people said both. But there were some strong opinions about monitoring what your kids do."
McKeay said he was surprised that his responses, mostly from other security professionals, revealed many were willing to do at least some covert monitoring with software programs without the kids' knowledge or consent. The majority felt open and frank discussion, along with some disclosed parental control with products such as Net Nanny, and other similar programs that block web sites and monitor activity, was the best approach.
But he estimates about 25 percent of those who answered his question thought monitoring all actions without telling their kids they were doing so was OK.
"I kind of expected in the security community that more people would realize some of the dangers of that kind of secret monitoring. But I guess when it comes to your kids, most people seem to be more concerned with keeping them safe online than the potential impact on the relationship."
By danger, McKeay means loss of trust when the child realizes he is being "spied on," as he puts it. He believes secret, and also open-but-excessive, monitoring of a child's activities infringes on a kid's privacy rights and will set parents up for potential damage to the relationship with their children in the future. He also thinks leaving them no room to make mistakes means they won't learn the security skills they need when navigating the dangers of the internet.

To see full article, read here:
http://www.computerworld.com/s/article/print/9175373/How_security_professionals_monitor_their_kids?taxonomyName=Security&taxonomyId=17

More Details... »

Android 2.0 ,2.1, 2.1.1 WebKit Use-After-Free Exploit

This is the exploit used in my Austin bsides presentation that returns a shell. 

The slides are at http://www.slideshare.net/mjza/bsides
email: mkeith@exploitscience.org

More Details... »

Spyware compromises 150,000+ Symbian devices

A new variant of spyware "Spy.Felxispy" on Symbian devices causing privacy leakage has recently been captured by the National Computer Virus Emergency Response Centre of China.

According to NetQin Mobile, there are more than a dozen variants of the spyware since the first was spotted, and the latest has affected 150,000+ devices.

Once installed, the spyware will turn on the Conference Call feature of the device without users' awareness. When users are making phone calls, the spyware automatically adds itself to the call to monitor the conversation.

"The Conference Call feature allows more than two parties to join a conversation, and it's easily available to most smart-phone users. The privacy stealers exploit the vulnerability of this feature for financial purposes. The privacy protection on mobile devices becomes more important than ever," said Dr. Zou Shihong, Vice President of R&D from NetQin.

NetQin Cloud Security Centre detects that the spyware can remotely turn on the speaker on the phone to monitor sounds around users without the users' awareness. Apart from that, the spyware is also capable of synchronizing the messages the user received and delivered to the monitoring phone. These performances will compromise users' privacy.

The privacy stealers usually install the spyware on the phone or send MMS containing the spyware to users to lure them to click. As the spyware is artfully disguised, users will easily be trapped.

NetQin warns that smart-phone users are exposed to more mobile security threats than ever and users should always be cautious whenever performing operations on their mobile devices.

To stay safe, NetQin experts give the following tips in using your phone:

1. Never click open MMS from unknown numbers as they may get your phone infected. Instead, delete them upon receipt.
2. Be on alert for unusual behavior on your phone, such as unusual SMS.
3. Don't leave your phone out of your sight in public environments.
4. Install a trusted security application to protect your phone from security threats.

Article taken from HELP NET SECURITY

More Details... »

Arachni v0.2.2.1 is out!

Updated: Added link to CDE package.
Update #2: Watch the new WebUI v0.1-pre screencast on Vimeo.

Hello good people,
I’m very glad to announce the release of the v0.2.2.1 version of the Arachni framework which bears a lot of new features, improvements, optimizations and a brand new, although experimental, Web user interface.
There are new plugins, new modules, new system components, support for high-level meta-analysis using meta-module components, a brand new HTML report and much more.
Acknowledgements

Before continuing, I’d like to thank all the people who helped make this release as good as it turned out to be.
First and foremost, I’d like to thank Christos Chiotis (of Survive the Internet ) for volunteering his time, designer talent and good taste in order to create the new HTML scan report.
I’d also like to thank Matt and Michelangelo for their relentless testing and plethora of feature suggestions.

If you don’t feel like installing anything at all you can download the self-contained Linux CDE package from the downloads section.
The CDE package will allow you to run Arachni out of the box without requiring installation or any sort of root access.
ChangeLog
- Web UI v0.1-pre (Utilizing the Client - Dispatch-server XMLRPC architecture) (New)
   - Basically a front-end to the XMLRPC client
   - Support for parallel scans
   - Report management
   - Can be used to monitor and control any running Dispatcher
- Changed classification from "Vulnerabilities" to "Issues" (New)
- Improved detection of custom 404 pages.
- Reports updated to show plug-in results.
- Updated framework-wide cookie handling.
- Added parameter flipping functionality ( cheers to Nilesh Bhosale )
- Major performance optimizations (4x faster in most tests)
   - All modules now use asynchronous requests and are optimized for highest traffic efficiency
   - All index Arrays have been replaced by Sets to minimize look-up times
   - Mark-up parsing has been reduced dramatically
   - File I/O blocking in modules has been eliminated
- Crawler
   - Improved performance
   - Added '--spider-first" option  (New)
- Substituted the XMLRPC server with an XMLRPC dispatch server  (New)
   - Multiple clients
   - Parallel scans
   - Extensive logging
   - SSL cert based client authentication
- Added modules  (New)
   - Audit
      - XSS in event attributes of HTML elements
      - XSS in HTML tags
      - XSS in HTML 'script' tags
      - Blind SQL injection using timing attacks
      - Blind code injection using timing attacks (PHP, Ruby, Python, JSP, ASP.NET)
      - Blind OS command injection using timing attacks (*nix, Windows)
   - Recon
      - Common backdoors    -- Looks for common shell names
      - .htaccess LIMIT misconfiguration
      - Interesting responses   -- Listens to all traffic and logs interesting server messages
      - HTML object grepper
      - E-mail address disclosure
      - US Social Security Number disclosure
      - Forceful directory listing
- Added plugins  (New)
   - Dictionary attacker for HTTP Auth
   - Dictionary attacker for form based authentication
   - Cookie collector    -- Listens to all traffic and logs changes in cookies
   - Healthmap -- Generates sitemap showing the health of each crawled/audited URL
   - Content-types -- Logs content-types of server responses aiding in the identification of interesting (possibly leaked) files
   - WAF (Web Application Firewall) Detector
   - MetaModules -- Loads and runs high-level meta-analysis modules pre/mid/post-scan
      - AutoThrottle -- Dynamically adjusts HTTP throughput during the scan for maximum bandwidth utilization
      - TimeoutNotice -- Provides a notice for issues uncovered by timing attacks when the affected audited pages returned unusually high response times to begin with.
           It also points out the danger of DoS attacks against pages that perform heavy-duty processing.
      - Uniformity -- Reports inputs that are uniformly vulnerable across a number of pages hinting to the lack of a central point of input sanitization.
- New behavior on Ctrl+C
   - The system continues to run in the background instead of pausing
   - The user is presented with an auto-refreshing report and progress stats
- Updated module API
   - Timing/delay attacks have been abstracted and simplified via helper methods
   - The modules are given access to vector skipping decisions
   - Simplified issue logging
   - Added the option of substring matching instead of regexp matching in order to improve performance.
   - Substituted regular expression matching with substring matching wherever possible.
- Reports:
   - Added plug-in formatter components allowing plug-ins to have a say in how their results are presented (New)
   - New HTML report (Cheers to Christos Chiotis for designing the new HTML report template.) (New)
   - Updated reports to include Plug-in results:
      - XML report
      - Stdout report
      - Text report

I sincerely hope that you enjoy and find it useful, if you have any suggestions or problems don’t hesitate to open a ticket @ https://github.com/Zapotek/arachni/issues.

Cheers,
Tasos “Zapotek” Laskos (Lead Developer)

To download this tool, please click this link:
https://github.com/Zapotek/arachni/zipball/v0.2.2.1
To watch a video about this tool:
http://vimeo.com/19928281

More Details... »

Emergency Message to all Inj3ct0r Users

Dear Inj3ct0r users =]

Inj3ct0r blocked the domain again. =\
Nothing! Inj3ct0r Team will live forever. Our new domain : http://www.1337day.com/
Official sources with Inj3ct0r.com is:
http://twitter.com/inj3ct0r
http://www.facebook.com/inj3ct0rs

mr.inj3ct0r@gmail.com
if the domain is unavailable, Inj3ct0r project is available at http://77.120.120.218/
------------------------------------------------

Unavailable :
inj3ct0r.com , inj3ct0r.org , inj3ct0r.net , 0xr00t.com , 0x0day.com, 1337db.com
------------------------------------------------

Help us financially. We will be very happy.
As more domains will be closed the more we'll register ;)
Please distribute this message on their blogs!
Underground h4x0r forever!

//r0073r
# 1337day.com [2011-02-21]

More Details... »

Pyrit Tool- GPU Cracker for Attacking WPA/WPA2 PSK Protocols

Pyrit allows to create massive databases, pre-computing part of the IEEE 802.11 WPA/WPA2-PSK authentication phase in a space-time-tradeoff. Exploiting the computational power of Many-Core- and other platforms through ATI-Stream, Nvidia CUDA, OpenCL and VIA Padlock, it is currently by far the most powerful attack against one of the world's most used security-protocols.

WPA/WPA2-PSK is a subset of IEEE 802.11 WPA/WPA2 that skips the complex task of key distribution and client authentication by assigning every participating party the same pre shared key. This master key is derived from a password which the administrating user has to pre-configure e.g. on his laptop and the Access Point. When the laptop creates a connection to the Access Point, a new session key is derived from the master key to encrypt and authenticate following traffic. The "shortcut" of using a single master key instead ofper-user keys eases deployment of WPA/WPA2-protected networks for home- and small-office-use at the cost of making the protocol vulnerable to brute-force-attacks against it's key negotiation phase; it allows to ultimately reveal the password that protects the network. This vulnerability has to be considered exceptionally disastrous as the protocol allows much of the key derivation to be pre-computed, making simple brute-force-attacks even more alluring to the attacker. For more background see this article on the project's blog.

The author does not encourage or support using Pyrit for the infringement of peoples' communication-privacy. The exploration and realization of the technology discussed here motivate as a purpose of their own; this is documented by the open development, strictly sourcecode-based distribution and 'copyleft'-licensing.

Pyrit is free software - free as in freedom. Everyone can inspect, copy or modify it and share derived work under the GNU General Public License v3+. It compiles and executes on a wide variety of platforms including FreeBSD, MacOS X and Linux as operation-system and x86-, alpha-, arm-, hppa-, mips-, powerpc-, s390 and sparc-processors.

Attacking WPA/WPA2 by brute-force boils down to to computing Pairwise Master Keys as fast as possible. Every Pairwise Master Key is 'worth' exactly one megabyte of data getting pushed through PBKDF2-HMAC-SHA1. In turn, computing 10.000 PMKs per second is equivalent to hashing 9,8 gigabyte of data with SHA1 in one second. The following graph shows various performance numbers measured on platforms supported by Pyrit.

You can see Youtube how to use this tool:
http://www.youtube.com/watch?v=HY9Y99bOyhE

To download the latest Pyrit 0.40, please see this link:

http://code.google.com/p/pyrit/downloads/list

For more information about this Pyrit  tool, please see the link below:

http://code.google.com/p/pyrit/

More Details... »

Inguma - Penetration Testing Toolkit

Inguma is a penetration testing toolkit entirely written in python. The framework includes modules to discover hosts, gather information about, fuzz targets, brute force user names and passwords and, of course, exploits.
While the current exploitation capabilities in Inguma may be limited, this program provides numerous tools for information gathering and target auditing. Inguma is still being heavily developed so be sure to stay current and check back for news and updates.

You can see more details about Inguma and documentations here:
http://code.google.com/p/inguma/

More Details... »

Mantra - Free and Open Source Browser Based Security Framework

The Mantra is a powerful set of tools to make the attacker's task easier. The beta version of Mantra Security Toolkit contains following tools built onto it. You can also always suggest any tools/ scripts that you would like see in the next release.

• Access Me
• Add N Edit Cookies+
• Chickenfoot
• CookieSwap
• DOM inspector
• Domain Details
• Firebug
• Firebug Autocompleter
• Firecookie
• FireFTP
• Firesheep
• FormBug
• FoxyProxy
• Google Site Indexer
• Greasemonkey
• Groundspeed
• HackBar
• Host Spy
• HttpFox
• iMacros
• JavaScript Deobfuscator
• JSview
• Key Manager
• Library Detector
• Live HTTP Headers
• PassiveRecon
• Poster
• RefControl
• Refspoof
• RESTClient
• RESTTest
• Resurrect Pages
• Selenium IDE
• SQL Inject ME
• Tamper Data
• URL Flipper
• User Agent Switcher
• Vitzo WHOIS
• Wappalyzer
• Web Developer
• XSS Me

You can download Mantra from this link:
http://www.getmantra.com/download/index.html

More Details... »

How To Remove Spyware Clean Up Security Tool

why you should be eliminated? Instead Security Tool is a tool that innate rather than Windows? Yes, initially looked like hell so, I also had nearly fooled initially. Security Tool is actually a spyware (malicious viruses) that aims to steal sensitive data we like usernames, passwords and credit card.

Well, this spyware pretending to be anti-spyware tool that works to clean up our computers. And that's a fake! Security Tool displays an error message that your computer is infected with viruses, spyware and malware is dangerous, and we are required to "clean up". Though the files mentioned that in normal circumstances. Anyway, do not believe in anything that is said by the Security Tool.

More Details... »