The Glider

I remember being excited when I was asked to use a sledgehammer to tear down a covered garage that wasn't approved by the city. It had been standing beside my girlfriend's house for years. You could tell it was built intelligently and with love. The supporting beams were twice as thick as required by code, and every nail and screw was driven straight. The lumber itself was top shelf, not a knot or bend in it.

read more

I remember being excited when I was asked to use a sledgehammer to tear down a covered garage that wasn't approved by the city. It had been standing beside my girlfriend's house for years. You could tell it was built intelligently and with love. The supporting beams were twice as thick as required by code, and every nail and screw was driven straight. The lumber itself was top shelf, not a knot or bend in it.

read more

Facebook has introduced a new authentication feature designed to help users better protect their accounts from being hijacked by password-stealing miscreants. The opt-in feature — which requires users to share their mobile phone number — is a welcome security measure, but may be a tough sell to users already wary of providing too much information to the social networking giant.

Facebook intern Andrew Song explains how the new “Login Approvals” feature works, in a blog post:

“If we ever see a login from an unrecognized device, you’ll be notified upon your next login and asked to verify the attempted account access.  If you don’t recognize this login, you’ll be able to change your password with the knowledge that while some one else may have known your login credentials, they were unable to access your account and cause any harm. Once you have entered this security code, you’ll have the option to save the device to your account so that you don’t see this challenge on future logins.”

“If you ever lose or forget your phone and have login approvals turned on, you will still have the option to authorize your login provided you are accessing your account from a saved device. Having these recognized machines associated with your account prevents lockout and ensures that you can regain access to your profile.”

Facebook users can enable Login Approvals by navigating to Account Settings and then Account Security. When I enabled this feature and provided the digits for a mobile phone I own, it quickly sent that phone a six character, alphanumeric code via text message that I used to successfully authenticate on Facebook.com.

It’s not clear from Song’s blog post whether enabling this feature changes any privacy settings you may have established in your Facebook account. Facebook’s privacy policies have been constantly evolving as the social networking provider adds and tweaks features (I pinged Facebook’s press folks to find out and will update this section if they reply). Depending on how much data you’ve already shared, what apps you have installed on your Facebook account and your mobile phone, and what your privacy settings are, you might be surprised how much mobile data you already are sharing with your “friends,” and vice versa. Check out your Facebook Phonebook to find out which of your friends have already shared their mobile contact information.

It’s important for people to remember that Facebook — like most social networking applications and other “free” online services — is not really free: All of us pay for these services in micropayments of personal information over time. And to quote noted security curmudgeon Bruce Schneier: “Don’t make the mistake of thinking you’re Facebook’s customer, you’re not – you’re the product. Its customers are the advertisers.”

Yes, I realize that’s an ambitious title for a blog post about staying secure online, but there are a handful of basic security principles that — if followed religiously — can blunt the majority of malicious threats out there today.

Krebs’s Number One Rule for Staying Safe Online: “If you didn’t go looking for it, don’t install it!” A great many online threats rely on tricking the user into taking some action — whether it be clicking an email link or attachment, or installing a custom browser plugin or application. Typically, these attacks take the form of scareware pop-ups that try to frighten people into installing a security scanner; other popular scams direct you to a video but then complain that you need to install a special “codec,” video player or app to view the content. Only install software or browser add-ons if you went looking for them in the first place. And before you install anything, it’s a good idea to grab the software directly from the source. Sites like Majorgeeks.com and Download.com claim to screen programs that they offer for download, but just as you wouldn’t buy a product online without doing some basic research about its quality and performance, take a few minutes to search for and read comments and reviews left by other users of that software to make sure you’re not signing up for more than you bargained. Also, avoid directly responding to email alerts that (appear to) come from Facebook, LinkedIn, Twitter, your bank or some other site that holds your personal information. Instead, visit these sites using a Web browser bookmark.

Krebs’s Rule #2 for Staying Safe Online: “If you installed it, update it.” Yes, keeping the operating system current with the latest patches is important, but maintaining a secure computer also requires care and feeding for the applications that run on top of the operating system. Bad guys are constantly attacking flaws in widely-installed software products, such as Java, Adobe PDF Reader, Flash and QuickTime. The vendors that make these products ship updates to fix security bugs several times a year, so it’s important to update to the latest versions of these products as soon as possible. Some of these products may alert users to new updates, but these notices often come days or weeks after patches are released. I try to help readers stay on top of these fixes by posting alerts for the major packages, but even I can’t keep up with them all. A wonderful resource for anyone feeling update fatigue is Secunia’s Personal Software Inspector, a free tool that periodically scans for and alerts users to outdated security software. The latest version of the PSI also can be set to update such products automatically. FileHippo also has a nice, free update checker, available here (requires Microsoft .NET).

Krebs’s Rule #3 for Staying Safe Online: “If you no longer need it, remove it.” Clutter is the nemesis of a speedy computer. Unfortunately, many computer makers ship machines with gobs of bloatware that most customers never use even once. On top of the direct-from-manufacturer junk software, the average user tends to install dozens of programs and add-ons over the course of months and years. In the aggregate, these items can take their toll on the performance of your computer. Many programs add themselves to the list of items that start up whenever the computer is rebooted, which can make restarting the computer a bit like watching paint dry. And remember, the more programs you have installed, the more time you have to spend keeping them up-to-date with the latest security patches. For example, Java is a powerful program and Web browser plugin that most people have on their machines but seldom use (the bulky program also adds itself to the startup menu in Windows every time you update it). Meanwhile, attackers are constantly targeting systems with outdated versions of this software. If you don’t need Java, uninstall it. You can always reinstall it if you find it is needed for some Web site or third-party application. If you can’t bring yourself to completely remove Java or if you have desktop programs that require it, consider unhooking it from the browser by disabling the Java add-on in whatever browser you use.

Every organization that develops software or write scripts should embrace security development lifecycle (SDL). However, it remains a rare practice. That's a shame, because developing software with fewer security bugs better protects users and data for less money.

read more

Every organization that develops software or write scripts should embrace security development lifecycle (SDL). However, it remains a rare practice. That's a shame, because developing software with fewer security bugs better protects users and data for less money.

read more

Every organization that develops software or write scripts should embrace security development lifecycle (SDL). However, it remains a rare practice. That's a shame, because developing software with fewer security bugs better protects users and data for less money.

read more

A collection of tools, just for fun. It includes LetDown, ReverseRaider and Httsquash.
LetDown is a tcp flooder I have programmed after reading Fyodor article "TCP Resource Exhaustion and Botched Disclosure" (you can read it at http://insecure.org/stf/tcp-dos-attack-explained.html). It has an (experimental) userland TCP/IP stack, and supports multistage payloads for complex protocols, fragmentation of packets and variable tcp window.
NOTE: LetDown is based on Fyodor NDos, it's not about (...) - Security Tools / Vulnerability Scanner, Network Discovery, Complemento

Metagoofil is an information gathering tool designed for extracting metadata of public documents (pdf,doc,xls,ppt,odp,ods) availables in the target/victim websites.
It will generate a html page with the results of the metadata extracted, plus a list of potential usernames very useful for preparing a bruteforce attack on open services like ftp, pop3,web applications, vpn, etc. Also it will extract a list of disclosed PATHs in the metadata, with this information you can guess OS, network (...) - Security Tools / Information Gathering, Data Mining, MetaGooFil

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field.
Version 0.9 RC1
New Features
Support for the http_headers keyword was added
libhtp was updated to version 0.2.3
Privilege dropping using libcap-ng is now supported
Proper support for "pass" rules was added
Inline mode for Windows was added (...) - Security Tools / IDS, Suricata