Security ‘net

The ‘web has been abuzz with security stuff the last couple of weeks; forthwith a small collection for your edification.

The man in the middle attack is about as overused as the trite slippery slope fallacy in logic and modern political “discourse” (loosely termed — political discourse is the latest term to enter the encyclopedia of oxymorons as it’s mostly been reduced to calling people names and cyberbullying, — but of course, putting the social media mob in charge of stopping bullying will fix all of that). But there are, really, such things as man in the middle attacks, and they are used to gather information that would otherwise be unavailable because of normal security provided by on the wire encryption. An example? There is no way to tell if your cell phone is connecting to a real cell phone tower or a man-in-the-middle device that sucks all your information out and ships it to an unintended recipient before forwarding your information along to its correct destination.

The list of aliases used by the devices that masquerade as a cell phone tower, trick your phone into connecting with them, and suck up your data, seems to grow every day. But Continue reading

Avoiding an ISSUe on the Nexus 5000

The idea for this post came from someone I was working with recently. Thanks Fan (and Carson, and Shree) :-)

In Service Software Upgrade (ISSU) is a method of upgrading software on a switch without interrupting the flow of traffic through the switch. The conditions for successfully completing an ISSU are usually pretty strict and if you don’t comply, the hitless upgrade can all of a sudden become impacting.

The conditions for ISSU on the Nexus 5000 are pretty well documented (cisco.com link) however, there are a couple bits of knowledge that are not.  This post is a reminder of the ISSU conditions you need to comply with and a call out to the bits of information that aren’t so well documented.

The two major ISSU conditions on the n5k are:

  1. You must unconfigure all Layer 3 features
  2. The n5k must not have any Spanning Tree (STP) ports in Designated state unless the port is an Edge port.

The first one is easy: the switch cannot be doing any routing. Even if the switch is Layer 2 only, this condition will still fail if any of the following are true:

UK police arrest man suspected of Vtech toy hacking

UK police arrest man suspected of Vtech toy hackingPolice investigating the hacking of Chinese toy company Vtech have made an arrest in the U.K.In the attack on Nov. 14, someone gained access to information about Vtech customers, including names, email addresses, birth dates, photos and weakly encrypted passwords, the company said.The information was stored in a database for its Learning Lodge app store, used by many of the company's educational toys.Later last month, Vtech said the data breach affected around 4.8 million of its customers, but by early this month the figure had risen to 11.6 million, including 6.4 million children.To read this article in full or to leave a comment, please click here

UK police arrest man suspected of Vtech toy hack that affected millions of customers

Police investigating the hacking of Chinese toy company Vtech have made an arrest in the U.K.In the attack on Nov. 14, someone gained access to information about Vtech customers, including names, email addresses, birth dates, photos and weakly encrypted passwords, the company said.The information was stored in a database for its Learning Lodge app store, used by many of the company's educational toys.Later last month, Vtech said the data breach affected around 4.8 million of its customers, but by early this month the figure had risen to 11.6 million, including 6.4 million children.To read this article in full or to leave a comment, please click here

What security pros want for the new year

It’s that time of year when we ask security executives in a variety of industries what they would like to include on their holiday wish lists.Some of the responses we received were in the realm of pure fantasy. For example, one security chief asked for technology tools that address all of the major security threats, don’t cost anything and have top-notch 7x24x365 support with response times inside 15 minutes!+ ALSO ON NETWORK WORLD Follow all of our predictions for 2016 +Most of the wishes submitted are a bit closer to reality, and some might even come true if factors align the right way. So, with the completion of another year approaching, once again we present a listing of what security executives say they are hoping for, as they continue in their mission to protect their organizations’ systems and data.To read this article in full or to leave a comment, please click here

Microsoft on Macs – ARGH!

I moved my Mum onto a Mac a few years ago, and the calls for support dropped off dramatically.  She’s a very non-technical user, but tries hard to get to grips with the modern technology.

She’s recently decided she’d like to put some photos in a Word document, and write a message underneath – to send round to people at Christmas, you know?  How hard can that be?

Over the phone, I told her to go to Photos, select the photo and do Edit | Copy from the menu.  Then go to Word and do Edit | Paste to put it in the document.

Nope.

Tried it on my Mac, and sure enough, Word doesn’t know there’s anything in the clipboard to paste!   But if you open anything else (e.g. Textedit) it works fine.

Not really sure whose problem this is, since Word is able to paste in an image that is not in Photos (i.e. an image on the hard disk).  Instructions for that are here:  https://support.office.com/en-in/article/Add-or-replace-a-picture-in-Office-for-Mac-2011-c0a7f0d4-ed59-4183-8fe1-ed615b94cf80?ui=en-US&rs=en-IN&ad=IN

For a novice user like mum, finding that simple things like cutting and pasting are broken is extremely confusing. Of course she thinks it is her Continue reading

Amplifying Black Energy

Click here to download the full report. The Black Energy malware family has a long and storied history dating back to 2007. Originally a monolithic DDoS platform, significant advancements were made in 2010 including support for an extensible plugin architecture that allowed Black Energy 2 to more easily expand beyond DDoS into other activities such […]

Amplifying Black Energy

Click here to download the full report.

The Black Energy malware family has a long and storied history dating back to 2007. Originally a monolithic DDoS platform, significant advancements were made in 2010 including support for an extensible plugin architecture that allowed Black Energy 2 to more easily expand beyond DDoS into other activities such as info-stealing, web-based banking attacks, spamming, etc.

This report examines, in-depth, a new Black Energy 2 plugin (ntp.dll) that allows “BE2” botnets to launch true distributed NTP reflection/amplification attacks. This is significant for a couple of reasons:

  • To the best of our knowledge, this may represent one of the first C&C-controlled (not standalone) Windows bots to correctly and effectively implement an NTP-based reflection/amplification attack.
  • Reflection/amplification attacks are already responsible for generating the largest of DDoS attacks. Integrating this attack method into traditional Windows botnets could increase the impact of these attacks even further.

In detailing the relatively impressive technical implementation of this new BE2 DDoS attack plugin, this report provides some excellent general networking insights, an understanding of what it takes to really pull off a reflection/amplification attack on the Windows platform, and a somewhat humorous look at some prior attempts by other malware Continue reading

Leftover Training Budget? Let Me Help You

If you have some leftover training budget for 2015, there’s no better way to spend it than to invest it in a workgroup ipSpace.net subscription ;)

You can choose between two standard packages (6 or 21 users) which include online consulting sessions, or create your own customized package.

Finally, if you plan to buy one of the standard packages, hurry up – the Dec15 promotional code gives you 10% discount till the end of the year.

Avoiding an ISSUe on the Nexus 5000

The idea for this post came from someone I was working with recently. Thanks Fan (and Carson, and Shree) :-)

In Service Software Upgrade (ISSU) is a method of upgrading software on a switch without interrupting the flow of traffic through the switch. The conditions for successfully completing an ISSU are usually pretty strict and if you don't comply, the hitless upgrade can all of a sudden become impacting.

The conditions for ISSU on the Nexus 5000 are pretty well documented (cisco.com link) however, there are a couple bits of knowledge that are not. This post is a reminder of the ISSU conditions you need to comply with and a call out to the bits of information that aren't so well documented.

Joomla patches critical remote execution bug

The open-source project behind the widely used Joomla content management system has issued a patch for a vulnerability that is now being widely used by hackers.Sucuri, a company that specializes in securing websites, wrote on Monday that attackers have been trying exploit the flaw for the last two days.As of Monday, Sucuri said "the wave of attacks is even bigger, with basically every site and honeypot we have being attacked. That means that probably every other Joomla site out there is being targeted as well."The vulnerability, which affects Joomla versions 1.5 to 3.4.5, involves the user agent string, which is information transmitted by a browser to a Web server when a user visits a Web page.To read this article in full or to leave a comment, please click here

1 … 3,146 3,147 3,148 3,149 3,150 … 3,773