haxorthematrix

I've been a big fan of the security Linux live CDs for some time now - Phlak, Fire, Audor, Whax...and so on.

Now I have another one to check out: nUbuntu!

I've downloaded it, and burned it, but I have not had a chance to fire it up in my VM.  From reading the site, I'm impressed.  I'm also a recent Ubuntu convert.  Last weekend I flatlined my Redhat box, and installed Ubuntu after using Ubuntu on my PaulDotCom Security Weekly podcast laptop.  That is a big step - I've been a RedHat user for close to 10 years (I started with 5.2 was that 10 years ago?)

Please, check the distro out, and if anyone has any feedback, please post!

 nUbuntu - Security Live CD

Posted by Larry at 10:00 AM | Permalink | Comments (0)

A new version of aircrack-ng is out.  If you want to crack WEP or WPA, this is certainly a capable tool!  Aitcrack-ng, is the "new/reborn" version of aircrack, and it includes all the standard pieces - Airodump, aireplay, aircrack and airdecap.

Go test your wireless networks now, with permission of course.

- L

aircrack-ng-0.6.tar.gz

Posted by Larry at 09:18 AM | Permalink | Comments (0)

Here is a nice little article by our good buddy Joshua Wright, on selecting a good EAP type for your organization.  The article is short, but only because it gets right to the point - no bad mouthing, just good solid info. 

This article probably won't be anything new to PaulDotCom Security Weekly listeners, but it just confirms everything we've been saying.  Independent confirmation is always a good thing.

- L

Best EAP for an enterprise wireless LAN

Posted by Larry at 05:16 PM | Permalink | Comments (0)

I wonder if this would work with a Micro-OpenWRT installation. I suspect that Linux re-claims the WRT54G

Posted by Larry at 04:03 PM | Permalink | Comments (0)

Please, use this for the forces of good, not evil.

- L

KeyLogger Source Code Updated

Posted by Larry at 03:27 PM | Permalink | Comments (0)

It is NOT a VoIP vulnerability. XSS is not VoIP. Sure, it may be access (and elevated access at that) to to a VoIP system, but not a vulnerability in any VoIP protocol.

Either way, patches do not curently exist for this flaw, so keep your eyes peeled. Treat these applications carefully!

- L

Cisco CallManager crossite scripting

Applications: Cisco CallManager 3.1 (21.06.2006)

Posted by Larry at 11:17 AM | Permalink | Comments (0)

Give it a good read and create and enforce some policies. I don't want to see my personal information or your corporate secrets on ebay.

- L

http://csrc.nist.gov/publications/drafts/DRAFT-sp800-88-Feb3_2006.pdf

Posted by Larry at 10:44 AM | Permalink | Comments (0)

"HOT."

Now, I wish my dad were well enough to help me build this one, as I'm not an EE by any stretch of the imagination (my dad is, and and RF engineers as well). He'd get a kick out of that one.

Anyone want to build me one?

- L

"How to build a low-cost, extended-range RFID skimmer," by Ilan Kirschenbaum and Avishai Wool.

Posted by Larry at 10:39 AM | Permalink | Comments (0)

I suppose that if they didn't they's get sued back into the stone age.

I wonder if the credits will be transferrable to sans.edu? :-)

- L

First Computer Hacking Course In Britain

Posted by Larry at 10:11 AM | Permalink | Comments (0)

I love getting pre-approved apps from companies that I already have credit with, almost as much as I like getting cold sales calls from companies when I allready own their porduct.

- L

Protecting yourself from identity theft

Posted by Larry at 09:57 AM | Permalink | Comments (0)

I subscribed yesterday, but I haven't seen any messages yet. Subscribe to the Insider Threat mailing list

Posted by Larry at 09:52 AM | Permalink | Comments (0)

Now, I would agree that there is some level of acceptible risk, and that WPA-Enterprise (not WPA-PSK) is the way to go. SSID cloaking?> I don't think so. Power adjustment, and placement? I bet my antenna is bigger than yours!

- L

The six dumbest ways to secure a wireless network Posted by Larry at 09:50 AM | Permalink | Comments (0)

Now, how many people actually want to see the World Cup naked. I'm sure the are plenty of female fans....

- L

Worm lures victims with 'Naked World Cup'

Posted by Larry at 09:45 AM | Permalink | Comments (0)

I can see attacking client software will be a growing trend, so watch out for it. Update your apps as well, not just your OS.

- L

Third Microsoft Excel attack posted Posted by Larry at 09:40 AM | Permalink | Comments (0)

This particular one was a short discussion of some bluetooth tools, and some advise for both Windows and Linux. Plase check it out with the link at the end of the entry.

War Nibbling. Sounds kinky. Me likes.

- L

Bluecasing: War Nibbling, Bluetooth and Petty Theft

Posted by Larry at 02:39 PM | Permalink | Comments (0)

To my surprise, a LOT of people use it for video chat. Not only that, I think that it may be part of Microsoft's Live Communications Server (but don't quote me on that). Ok I thought, I bet this is an old version.

I couldn't find it installed on my XP box. It wasn't in the Start menu anywhere. I started to research...

Warm.

NetMeeting comes installed on every XP installation, on the Start menu or not. Do a "Start, Run, conf.exe". NetMeeting starts. Cool. Ok, old version right?

Warmer.

Now, My XP box is up to date. I checked the version - 3.01. The up to date version IS the vulnerable version.

Disco.

Time to advisse all those users to find a differrent product or discontinue use on sensitive environments until Microsoft releases a patch.

- L

Microsoft NetMeeting Null Pointer

"Microsoft NetMeeting is an application that provides multipoint audio/video conferencing and supporting services (desktop sharing, whiteboard, remote control, file transfer) for Microsoft Windows platform."

Posted by Larry at 01:51 PM | Permalink | Comments (0)

Cipher trus is reporting that while 23% of the SPAM zombies are in the US, a clear 64% of the hosts that control thois Zombies are located in Taiwan.

It is clear from these statistics that we ened MUCH better protection BUILT IN (not optional) to the operating systems.

That, and we need to null route all of Taiwan. :-)

- L

Taiwan fingered as the hub of spam distribution

Botnet epicenter

Almost two thirds (64 per cent) of servers controlling spam traffic are located in Taiwan, according to a survey by email security firm CipherTrust.…

Posted by Larry at 09:35 AM | Permalink | Comments (0)

Microsoft released some statistics about the usage of thier Malicious Software Removal Tool (yay Microsoft). Now, while you all may say that Microsoft should just fix thier OS, and not offer us this "hoax" to mask that thier software is junk. I agree with that in part, but I will say that the figures that they released were valuable, and quite staggering.

To paraphrase, MSRT was run nearly 2.7 billion times on 5.7 million unique PCs. It removed more than 16 million instances of malware, 62% of those backdoors - and mostly bots.

That is a LOT of bot clients!

- L

MS clean-up stats shed light on malware infections

Posted by Larry at 09:19 AM | Permalink | Comments (0)

Looks like he will be talking about attacking preferred network lists with KARMA, hotspot injection attacks with AirPWN and 802.11 protocol fuzzing research. Josh is, in fact, the man. Check out Clemept's post, as well as the webcast (Wed, June 14th) at http://www.ihavebeenhacked.com

- L

Webcast Featuring Josha Wright

NOTE FROM CLEMENT:
A great webcast you do not want to miss. My friend Joshua Wright will be talking about emerging wireless attack. Joshua is god at finding wireless vulnerability. A webcast worth watching for sure. Here is Josh email about it followed by the formal announcement:

I'm participating in a webcast next week to talk about some research I've been doing on emerging 802.11 attacks with colleagues from Juniper and IGX.

The marketing people at Aruba say I have to spend a few slides talking about our products, but then my material is all wireless-attacks, I promise. :)

Specifically, I'm going to talk about attacking preferred network lists with KARMA, hotspot injection attacks with AirPWN and 802.11 protocol fuzzing research.

I've also seen the slides from Bob Spognardi at Juniper and I'm personally excited to hear what he has to say about federal data privacy requirements and wireless networking.

If you are interested in catching the webcast, you can sign up at www.ihavebeenhacked.com (no, really).

Thanks, Josh

Here is the formal announcement:
Please join your peers and the members of igxglobal, Aruba and Juniper Networks for a Live Lunch and Learn Webinar:

* igxglobal will discuss identification and mitigation ofvulnerabilities over the air and best practices.* Juniper Networks will talk about their Funk Software Product securing wireless LAN and Data Privacy.

* Aruba will talk about Emerging 802.11 Attacks. Mr. Barry Johnson, igxglobal's Director of Threat Mitigation, will share his extensive 15 year experience in assisting major corporations as well as the government sector in developing, implementing and educating clients on security risks, compliance and regulatory standards such as GLBA, HIPAA, SOX, PCI and others to assist in securing their IT environments.

Mr. Bob Spognardi, Northeast Sales Manager from Juniper Networks brings an extensive background in the Security Arena now passionately representing Funk Software. Mr. Spognardi worked in sales for information security companies for the past 10 years. Since 2002, has been the northeast sales manager for Funk Software (now Juniper Networks). Before Funk, worked in sales for Sonicwall, Netscreen and RSA Security.

Mr. Josh Wright is a Senior Security Architect for Aruba Networks and the author of several open-source wireless security assessment tools designed to illustrate and raise awareness of common vulnerabilities in wireless networks. His current assignment includes research into new techniques used by attackers to compromise the security of wireless networks including IEEE 802.11 and Bluetooth LANs. When not breaking wireless networks, he practices Aiki-Jutsu, where he tries not to break things.

About igxglobal: Go to www.igxglobal.com
About Juniper Networks: Go to www.juniper.net
About Aruba: Go to www.arubanetworks.com

If you have any questions please contact: Katarina Almqvist at:
Phone: 201-615-3458
E-mail: kalmqvist@igxglobal.com or
Website: www.ihavebeenhacked.com
When: Wednesday June 14th, 12.00 - 1.00pm

Attendees will have the chance to win a free external scan for up to 6 ip-addresses, iPod or a $200 American Express Gift Certificate at the end of the Q/A Session.

Agenda: 12.00 pm - 12.05 pm
Webinar Introduction by Victor Machado, Security Sales Professional,

igxglobal. 12.05 pm - 12.20 pm
Identity & Information Theft over the Air and Best Practices.
Speaker: Barry Johnson, Director of Threat Mitigation, igxglobal.

12.20 pm - 12.35 pm
Secure Wireless Lan Authentication and Data Privacy.
Speaker: Bob Spognardi, Northeast Regional Sales Manager Juniper Networks.

12.35 pm - 12.55 pm
Emerging 802.11 Attacks.
Speaker: Josh Wright, Senior Security Architect for Aruba Networks.

12.55 pm - 01.00 pm
Questions & Answers with Victor Machado, igxglobal, Juniper and Aruba.

Posted by Larry at 12:52 PM | Permalink | Comments (0)

I was impressed me with the tech was the name: Bluebag reminds me of blueballs. The article even says that Bluetooth is like sex: it is better with protection.

- L

'BlueBag' exposes Bluetooth vulnerabilities

'BlueBag,' a PC-based device created by Milan's Secure Network SRL to study how malicious software might be able to spread among devices that use the Bluetooth wireless standard, has been making the rounds of train stations, shopping malls and trade-show floors. What it found may unnerve you.

Posted by Larry at 03:46 PM | Permalink | Comments (0)

Go read the blog entry, and go order your free fraud prevention DVDs.

- L

Valuable Fraud Prevention Resource (and how to use it)

Posted by Larry at 03:54 PM | Permalink | Comments (0)

Just goes to show, unencrypted, unauthenticated wireless is bad.

- L

Wireless Camera Hunter makes spying fun

Filed under: Digital Cameras, Portable Video

If you thought Billy Baldwin had a pretty sweet setup in Sliver, but you don't have the time nor the funds to build your own monitor-filled "observatory," then a product called the Wireless Camera Hunter may be just the ticket to feeding your voyeuristic jones. Sporting two antennae and a 2.5-inch TFT LCD for maximum peeping enjoyment, the WCH DD9000 is a video Walkman-sized device that scans the airwaves for wireless video transmissions in the 900MHz to 2.52GHz range, and locks in on any usable signals within 500 feet. For $500, it would be nice to get some rechargeable batteries instead of having to use your own AAs with this model, but sometimes you have to sacrifice the little things for the greater good of spying on your friends and neighbors.

Posted by Larry at 03:49 PM | Permalink | Comments (0)

Dancho: Sorry for posting the whole article, linked to you as you asked...

- L

Skype as the Attack Vector

Posted by Larry at 03:41 PM | Permalink | Comments (0)

So what is with all of these laptops with sensiteive data that is unencrypted? The VA, hotels.com, EDS and E&Y...what gives guys? I think that this is going to be a growing trend....and someone needs to be punished, and severely.

- L

Stolen YMCA laptop contained data on 68,000 members

The information included Social Security numbers, credit card and debit card numbers, checking account information and some medical data about children in various day care programs.

Posted by Larry at 03:38 PM | Permalink | Comments (1)

This only affected one particular driver for Windows 95/98, but come on! How does this happen?

Those who do not learn from history are destined to repeat it I suppose. HP had this same issue (same virus too) back in 2000. Whatever happened to scanning with AV before posting for your customers...?

- L HP printer drivers hit with Funlove virus

Hewlett-Packard Co. has removed a printer driver from its Web site after a security vendor reported that the software was infected with the same computer virus that infected HP's drivers more than five years ago.

Posted by Larry at 03:34 PM | Permalink | Comments (0)