"Evil Thug" goes after Full-Disk Encryption

Boy do I have news for you security people out there; I have a 100% reliable way of breaking all encryption! I call it the "Evil Thug" attack. I provide this service for a small fee. The entry level service will get me or an employee for a hour, this is all it will take to break any encryption in the world (and no we don't need a prostitute, even for 2048bit RSA encryption).

Continue reading ""Evil Thug" goes after Full-Disk Encryption"

Monday, October 19. 2009
Posted by Dominic White in Security
Comments (4) | Trackbacks (0)

When AntiVirus was the Virus

This weekend was rather eventful, and we learned a valuable lesson about viruses, security software, and professional scepticism in IT environments. I've briefly documented it below so you can learn from our mistakes.

Last week Wednesday a virus was detected on a client's network. The anti-virus (AV) host intrusion prevention system (HIPS) was updated to block access to the URLs the virus was using to fetch its payload and other control instruction.. However, the domain lookups[1] to these URLs increased massively by Friday, so much so, they caused the internal firewalls to fail due to the load from trying to inspect this traffic. Domain lookups were then blocked at the firewall, but the source of the lookups persisted. However, network access was restored and outwardly there was nothing wrong.

Continue reading "When AntiVirus was the Virus"

Monday, October 19. 2009
Posted by Dominic White in Security
Comments (2) | Trackbacks (0)

Speaking "Business" in South Africa

I'm sure this is a global trend, but certainly within SA, there is a nasty creeping use of all sorts of unnecessary and redundant (see what I did there) phrases. I've decided to keep track of some of them here, so that I can be publicly called-out if I'm ever caught using these. I also hope, that it will help you to stop talking "business" and start speaking sense.

Continue reading "Speaking "Business" in South Africa"

Friday, October 16. 2009
Posted by Dominic White in Politics
Comments (0) | Trackbacks (0)

Twilter - Filtering Twitter for higer Signal

I really love twitter, and use it more than I should. The only problem is, like most conversation, the signal to noise ratio isn't wonderful. However, unlike most conversation, this is digitial and "we can make it better". This is where my idea for "twilter" came from. It's just an idea, as I don't have the time or skill to implement it, but I'm hoping this forms a functional spec of sorts for someone who does.

Continue reading "Twilter - Filtering Twitter for higer Signal"

Friday, July 17. 2009
Posted by Dominic White in Geek
Comments (4) | Trackbacks (0)

Monitoring your Laptop/Desktop Processes Reduces Frustration

Using a computer can be frustrating; you click on something and it doesn't complete as fast as it usually does, and you don't know why. Advanced users tend to look at their CPU usage, to provide some form of explanation. "Oh look, my CPU is really busy, that's why stuff is slow." This is often turned into a widget/gadget/screenlet that sits on their desktop blinking the current CPU usage.

Continue reading "Monitoring your Laptop/Desktop Processes Reduces Frustration"

Sunday, June 28. 2009
Posted by Dominic White in Geek
Comments (0) | Trackbacks (0)

Conficker Claims its First Human

Conficker has claimed it's first victim, this time a live one. Conficker, a computer virus that security researchers have warned will do severe damage to computing systems from April 1st, has claimed millions of computer victims to date. However, Harry Hermulen's computer was luckier than he was.

Continue reading "Conficker Claims its First Human"

Wednesday, April 1. 2009
Posted by Dominic White in Security
Comment (1) | Trackbacks (0)

SA AV Vendor Recycling News for FUD Marketing

ClassicFM just phoned me for comment on this story. I did some quick research and was rather dismayed to find that this appears to be an attempt to drum up some press references for marketing rather than a responsible informing of the public.

Update: ClassicFM has put up the story with a soundbite.

Continue reading "SA AV Vendor Recycling News for FUD Marketing"

Tuesday, March 17. 2009
Posted by Dominic White in Security
Comments (2) | Trackbacks (0)

Using Maltego to Data Mine Twitter

I've previously, spoken about Paterva's awesome data mining tool Maltego in 2007. I've recently had cause to start playing with it again as part of the Privacy work I'm currently doing, and it's come a long way baby.

Continue reading "Using Maltego to Data Mine Twitter"

Wednesday, March 11. 2009
Posted by Dominic White in Security
Comment (1) | Trackback (1)

Cybersquatting and Prank Redirects - Malema and the DA

Update: Verashni has since written a story on the matter.

Many non-technical people don't realise how easy it is to manipulate many of the core internet protocols. 2008 Was a particularly bad year for it with some key weaknesses being pointed out in critical protocols such as DNS, SSL and BGP (again) which have joined the ranks of SMTP, Ethernet and in-line SQL as broken. However, with all the technofeats, I forget how easy it is to do something simple that appears to be manipulation to the general public. A journo friend of mine, Verashni, noticed (amoung others) that visiting www.malema.co.za will take you to the DA's website. For any forein readers, this is funny as I'm sure Julius Malema has a dartboard with, opposing political party leader, Hellen Zille's face on it. I did a quick check of who had registered the domain and it was fairly obvious this was a prank:

2f. billingaccount : The ANC
2g. billingemail : neveranc@gmail.com
2i. invoiceaddress : Not 54 Sauer Street, Johannesburg, 2001
2j. registrantphone : +2774 115 9505
2k. registrantfax :
2l. registrantemail : neveranc@gmail.com

Continue reading "Cybersquatting and Prank Redirects - Malema and the DA"

Thursday, February 26. 2009
Posted by Dominic White in Security
Comments (0) | Trackbacks (0)

A Response to Bejtlich on DLP

Richard Bejtlich just posted an entry entitle "Data Leakage Protection Thoughts." In it he argues that Data Leak Prevention products will just lead to a new barrage of alerts for someone to ignore (ala IPS/IDS), or blocking a too-small-set of data for which a significant amount of time would need to be invested to understand how to block. I'm paraphrasing, but I think it provides the gist.

Continue reading "A Response to Bejtlich on DLP"

Wednesday, February 4. 2009
Posted by Dominic White in Security
Comments (0) | Trackbacks (0)

Opt-Out of Online Advertiser's Profiling

I've been saying to anyone who would listen, that many advertisers (such as Google and DoubleClick - owned by Google) don't let you opt-out of their profiling. Essentially, many advertisers set a cookie and use it to track you across sites. This is useful to add state to stateless HTTP, but often lots of third-party cookies are set by advertisers which have no function other than to help profile you, i.e. it's possible to have a perfectly functional site without these cookies.

Continue reading "Opt-Out of Online Advertiser's Profiling"

Monday, February 2. 2009
Posted by Dominic White in Security
Comment (1) | Trackbacks (0)

ARIAD - AutoRun.Inf Access Denied

Viruses using the autorun.inf file of removable media such as flash sticks and iPods to automatically execute and install themselves whenever they are plugged into a machine can now be thwarted by Ariad. This is a big vector at the moment.

It's a file system filter (I didn't know about these, they're cool) that blocks access to autorun.inf and effectively stops windows from automatically installing viruses for you (aka a design flaw). Group Policy should allow you to do the same thing, but if you have either incompetent domain admins, some inheritance complexity of multiple policy applications have self-imploded, or a family member who uses their USB without protection, this can help fill the gap.

Courtesy DiderStevens - Ariad

Dider asked me to add that at the time of writing this is beta software, so test it first.

Sunday, January 25. 2009
Posted by Dominic White in Security
Comments (2) | Trackbacks (0)

Connecting to a Microsoft Office Communicator or Live Office Communicator Server in Ubuntu

As part of my ongoing attempt to not use Windows this year, I have been struggling to find a way to get OCS/LCS working in Linux. Due to some recent work on the SIPE/SIPLCS Pidgin plugin, it is now working.

Continue reading "Connecting to a Microsoft Office Communicator or Live Office Communicator Server in Ubuntu"

Monday, January 19. 2009
Posted by Dominic White in Geek
Comment (1) | Trackbacks (0)

WorkTime Script to Prevent Innapropriate Web Surfing

Not only does BASH cure cancer, but it can stop you from wasting time on the intertubes. While lying on the grass today I realised that I have a few 'jumping off' sites for non-work meanders; gateway drugs of sorts. By blocking these sites, I can stop myself from getting sidetracked most of the time and prevent Work Avoidance Behaviour (WABbing). If you're one of those people who can stick to a schedule, you could even cron it. Read the crufty-4am-produced shell script yourself, or the English below.

Continue reading "WorkTime Script to Prevent Innapropriate Web Surfing"

Sunday, January 18. 2009
Posted by Dominic White in Geek
Comments (0) | Trackbacks (0)

Why Patch Management will Remain Hard

A discussion with haroon yesterday revived some of my interest in my MSc thesis topic. Then serendipity brought Eric Schultze commentary/apology on the MS09-001 patch to my attention.

Continue reading "Why Patch Management will Remain Hard"

Saturday, January 17. 2009
Posted by Dominic White in Security
Comment (1) | Trackbacks (0)

« previous page (Page 10 of 15, totaling 212 entries) next page »

.tHE pRODUCT - Security & Privacy Blog