CyberGuardians

While collisions in MD5 hashes are nothing new, this most recent study by Wegner, Stevens, Lenstra ( Article Link ) adds even more concern to the trustworthiness of an MD5 hash. If you can't trust a signed executable, what can you trust? I think nothing. Their technique however requires much premeditation. Its not as if you can create a collision on an existing executable. To be effective in a malicious way, it would require that you create two executables up front with the same hash. This is done by appending 832 bytes of useless data to the existing executables. As you can imagine, this would make it very easy for a criminal to create two versions of software, one with a backdoor, that have the exact same MD5 hash. Of course, it would be easy for them to get the good one signed and then create a download site with the malicious one. While this is somewhat sophisticated, i could definitely see this being utilized by the hack for money crews. It doesn't take much to get your s...

Windows Forensics and Incident Recovery Notes Windows Event Log -clearing the Security Event Log generates event ID 517 -Stealing info via USB drive may cause event ID 134: "Removable Storage Service"; If logs have been cleared,check HKEY_LOCAL_MACHINE\System\MountedDevices Registry key. A right click on these entries may show "RemoveableMedia" -Logon events http://support.microsoft.com/default.aspx?kbid=174073 -Logon types http://support.microsoft.com/default.aspx?scid=kb;en-us;140714 -More security Events http://support.microsoft.com/kb/174074/ CMD Line History - doskey /history or the RunMRU registry key File Associations - C:\>assoc will list out every association; C:\>assoc .exe ---> .exe=exefile - ftype exefile ---> exefile="%1" %* ; shows what variables used at runtime; matched the value in HKEY_CLASSES_ROOT\exefile\shell\open\command - if this value has been moded by malware use --> C:\>ftype exefile="%1" %* to change ba...

I had the pleasure of reading Protect Your Windows Network From Perimeter To Data by Jesper Johansson and Steve Riley. Even though it lacks Vista coverage being written in 2005, it is still very relevant and useful to security professionals today. It's a book that I wish I had read sooner, as its a very good primer to security in a windows environment. Its the perfect companion to the Windows Security Resource Kit . The book's two authors are both seasoned security veterans and their IT geek humor is enjoyed throughout the book. I found myself thinking, "Yeah, I've been there before" several times and laughing at the absurdity of the situations we are frequently presented with. Two notes of caution about this book before delving in. These guys were both Microsoft employees at the time of the writing, so yes you will see some mild MS bias throughout, but they do a good job of reminding you in the text as well. I mean really, who recommends ISA server over a FW...

Protect Your Windows Network From Perimeter to Data by Jesper M. Johansson and Steve Riley 1 - Introduction to Network Protection Information technology is working properly only when users can stop thinking about how or why it works Security Management is about spending good money to have nothing happen Fundamental Tradeoffs are between Cost, Level of Security, and Usefullness/Usability Microsoft Library - Security Center A protected network is one with an absence of unmitigated vulnerabilities that can be used to compromise the network To have a truly secure network you must enumerate every place where it might be insecure and demonstrate that it is not insecure in any of them. This is only possible in theory not in practice (i.e. Chasing Unicorns) 2 - Anatomy of a Hack No network is any more secure than the least-secure device connected to it SQL injection is a vulnerability in the application, not the DBMS itself The only proper way to clean a compromised system is to nuke and pav...

After reading a very spirited, informative discussion on this topic over at SecurityFocus I decided to throw my own hat into the ring. I want to expand on several relevant topics. 1 - Certifications are a joke - A certification alone, without experience is typically not worth that much in the real world. It proves that the candidate can pass a test, often with having the questions in advance( see Testking/ActualTests). All it really guarantees, is that the candidate has some basic knowledge of the subject. Even the certs with experience requirements are pitiful, due to the fact that they do not audit every candidate. And if they did, there's always a chance they lied, like most people do on their resume. 2 - Certifcations are necessary - until the HR machine is overhauled, you cannot afford to not have certifications. Unless you have a good contact in the company, most non-certified individuals will be screened out by the non-technical HR employee, who basically knows keywords. ...

As ridiculous as that sounds, startup Robot Genius aims to do just that. Talk about an ambitious project. Not only do they want to scour the entire internet, they also want to analyze the binaries present on the websites for malicious characteristics. Such a product is sure to be in high demand, given that web-based malware has taken the reigns from email-based malware as the vector of choice. This biggest gap I see, is how quickly they can do this. Its very common for malware authors to change IPs on a daily or weekly basis to stay ahead of the whitehats. With such a dynamic environment as the internet, surely they will not be able to keep uptodate with the daily changes. More realistically monthly changes would be feasible. Still, I see the value of the service as a more accurate blacklist then has been delivered in the past. I think this will serve to raise the bar for other AV/Security vendors to improve their products as well. And if that doesn't work, some behemoth like Syman...

So I'm still undecided on whether or not Mondo Armando and Müstaschio are for real. All the news reporters seem to think so, but I think it could also be just another April fools joke. Either way, if they actually produce some Myspace exploits, that would be awesome. Myspace has such a history of slow response to security issues, that I'm not feeling sorry for them in any way. And given that it hosts millions of peoples personal information and they tend to be mostly computer illiterate and lack security knowledge, it looks like a good target for hackers. I also really like the approach these guys are taking, by making fun of the other Month of Whatever projects. HD Moore's original Month of Browser Bugs was awesome, but the ones that followed seemed to get less and less important. So in the end, I guess we will just have to wait and see whether this is just another publicity stunt or if these guys have something to offer other then humour. Stay tuned. Read the Story HERE

Brian Krebs has written a few articles recently focusing on how bad identitiy theft and credit card fraud really is. There are 2 facts that I find really hard to ignore, which are also really infuriating. The first is that according to Symantec, the majority of the Credit Card trafficking is being done on servers located inside the USA. So what happened to that Patriot act? Why are these criminals allowed to continue doing this, when clearly the FBI has the power to stop it. I know the logic they are using is that they are going after the kingpins and not the small fish, which makes sense. Except that tens of thousands of US citizens are getting thier lives destroyed in the process. And even though they may take down a kingpin one day, another one pops up the next. So eitherway, US citizens are getting screwed. The second problem I have is that we are infact subsidizing our own credit cards getting stolen. The Credit Card industry on a whole acknowledges fraud as an acceptable loss an...