Course Materials For Malware Analysis Released On Github

For those more interested in malware.

Reddit Discussion On MMO Hacking

Essentially, on the server end trust nothing clients send to you. Anything you expose can and probably will be abused.

The MonkeySphere Project

Attempting to expand the PGP Web Of Trust model to other things. Currently working on ssh trust, where admins sign public keys so users can check, rather than just blindly accepting server fingerprints.

What Is My Local IP

Did you know that with new browser extensions, people can learns what your internal IP address is? Try it pre/post VPN connection!

Cyptsy Bitcoin Exchange Hacked

Third party code for a specific blockchain currency contained an IRC backdoor, eventually allowing for in the ability to steal from other wallets. Cryptsy apparently knew this for a while, and has only disclosed recently. Someone pointed out this backdoor in march of last year on Github.

Lots of news over the week, so thought I would do a pre-weekend digest.

More and more hardware vulnerability stories:

Critical Flaws Found In Network Management Services

Maybe we should score some companies based on the security of their products? Or at least notify our customers who we know use these products when these things are released?

Trend Micro security software made passwords vulnerable, allowed remote code execution

I mean, seriously, if someone has a product that proved to be a security vulnerability, it makes sense that their security score should be kinda low, right? Especially if it is a security product like a password manager.

Cisco Patches Hardcoded Password, DOS Vulnerabilities In Software, Devices

At least Cisco found these themselves, having launched a code review in the wake of Juniper.

Advantech EKI Vulnerable To Bypass, Possible Backdoor

“Researchers with Rapid 7 pointed out in early December that EKI-1322 was still vulnerable to Shellshock and Heartbleed, bugs that affected machines running Bash, and OpenSSL respectively, in 2014.”

It’s Too Easy To Hack The Hospital

Almost missed this article from November. Hackers stealing data through medical devices! Hospital system honeypots! Hacking devices to do lethal things!

And an assortment of other news:

The CIA Secret To CyberSecurity That No One Seems To Get

“As Ajay Arora, CEO of file security company Vera, notes, there is no perimeter anymore.”

Password Storage In A Highly Parallel World

From compute-hard passwords to memory-hard passwords.

Papers Please

Interesting article on how one organization audits their SSH usage.

Hacking Team Leak Helped Find 0-Day Vulnerability

A tale of white hat turning black hat. Hackers being hacked. Monitoring for vulnerabilities based on coding style/reuse.

The Dragnet

How one con divined the existence of the Stringray

Google’s Creepy Plan To Kill The Password

Using a combination of biometrics, the way you walk, your keystroke patterns, your speech patterns, your face, etc to build a ‘trust score’ that unlocks your device. Unsure what happens if you totally mess up one of those algorithms by breaking your leg or something. And, I mean, something is going to be storing all that data.

More SHA1 News

SLOTH Attacks Make It Even More Important To Get Rid of SHA1 and MD5

Not just for TLS, but SSH as well. “Against IKE initiator authentication, the researchers were able to carry out impersonation attacks, and downgrade attacks against SHA-1 in SSH 2 and TLS 1.1 handshakes.”

32c3 Videos

Latest c3 conference presentations, which contain quite a few security topics. Just found out about this, so haven’t watched anything yet, but a few I plan to watch:

• Neither Snow Nor Rain Nor MITM - The State of Email Security in 2015
• APT Reports and OPSEC Evolution, or: These are not the APT reports you are looking for
• Beyond your cable modem - How not to do DOCSIS networks
• Breaking Honeypots for Fun and Profit
• Lifting the Fog on Red Star OS - A deep dive into the surveillance features of North Korea’s operating system
• Logjam: Diffie-Hellman, discrete logs, the NSA, and you
• State Of The Onion
• Shopshifting - The potential for payment system abuse
• (In)Security of Embedded Devices’ Firmware - Fast and Furious at Large Scale

Lots Of Security Issues With Hardware Appliances

More Juniper Fixes on the Way

After a more extensive review, Juniper to replace random number generation in a number of products. Said random number generation (Dual_EC), was known to be backdoored in 2007.

Modem Vulnerability Left Blackphone Vulnerable

Remote root level exploit discovered in modem system.

Comcast Home Security System Vulnerable To Attack

Jamming sensor communication causes base station to think everything is fine. An example of failing ‘open’ as a problem.

FireEye Patches Vulnerability in Passive Monitoring System

Allowing for attackers to have FireEye execute malicious code via email, without any human intervention.

On The More Business-y Side:

Cockroaches Vs Unicorns

Venture Capital and Cyber-Security.

How To Make Your Security Assessments Actionable Short post, but interesting read given we are essentially making security assessments. What extra information can we provide to make sure our issues are easily actionable?

Google To Start Penalizing SHA1 Certificates

Interesting to note:

• They are penalizing ones that are issued after January 1st, as these were not supposed to be issued.
• Also plan to start penalizing if intermediate certificates are still use SHA1.
• Potential to treat them all as untrusted as early as July 1st, 2016

Real World Cryptography Conference 2016

Kicked off yesterday, and has some interesting sounding sessions, including several talks about TLS.

Dutch Government Supports Encryption, Against Backdoors meanwhile China Uses US Encryption Fight to Pass Backdoor Legislation

Want Access To A Physical Linux Machine? Press Backspace 28 Times

GRUB2 Authentication Bug that was in the wild from December 2009

Hacking Blame Game

Interesting article on knee-jerk attribution of hacks.

‘We Take Your Security Seriously’

The apologetic cry of breached companies everywhere.

Since joining SecurityScorecard, I have been more observant of the security related news that crosses my news feeds.

Inspired by HighScalability’s ‘Stuff The Internet Says On Scalability’, O’Reilley’s ‘4 Short Links’, and Trivium I decided to share what I believe to be the most interesting pieces with my co-workers, trying to gather stories and track trends.

The result has become a weekly newsletter of sorts, of which you can now find here.