If you haven’t already heard about LIGATT security, you need to. I won’t do them a favor of linking to them from this blog post, but I would like to provide some information about why I’m afraid of them. No, it’s not because they have the world’s #1 hacker. There is a lot of terrific information about the company, its misgivings and wrongdoings on attrition.org’s Charlatan page for Gregory Evans, the LIGATT founder and CEO. Convicted of wire fraud in the beginning of last decade, Mr. Evans made good upon his release from prison by… marketing a caller ID spoofing service starting two days after the US House of Representatives made caller ID spoofing illegal. Another fantastic resource is the[…]
Category: hacking
For starters, let me just say that I personally have three Mac systems and three Windows systems I interact with on a regular basis. I’m writing this blog post from a Macbook Pro. However, there is a wide and growing misconception about the security of Mac systems vs. the security of Windows systems. I just came across the following post in PC Magazine’s Security Watch blog, and there is a lot of good information in there; specifically the following quote which I want to share: In the abstract, Macs are every bit as vulnerable as Windows systems, perhaps more so. But in the real world Mac malware is so rare that it actually makes news. Hundreds of Windows trojans like OpinionSpy[…]
In evaluating web application security, I’ve built up a toolbox of Firefox add-ons that make testing and experimenting much easier than manual techniques. One of my favorites is a little tool called HttpFox. While no match for a professional HTTP sniffer, HttpFox provides enough functionality for many basic testing situations. If you want to see what’s happening behind the scenes for a given web application, HttpFox lets you pull up a traffic log without leaving your browser. The plug-in displays a panel right in the lower half of the window and captures a list of every HTTP request made during a given session. (You control the capture through start and stop buttons.) Highlighting an individual request brings up detailed information[…]
Chances are, if you read 10 articles or blog posts about the 2010 RSA conference, you will hear the term “cloud computing” ten times. The cloud was clearly the dominant theme of most of the presentations, product demonstrations, and discussions which took place at the Moscone Center in the first week of March 2010. However, another theme was nearly equally present in presentations and discussions: Cybercrime.
Today Slashdot had a story about how a news story about an Australian transportation plan was broken early by a newspaper. The transport minister said the access of this information was akin to the newspaper trying to “pick the lock off a secure office and take highly confidential documents”. What was the brilliant security plan that was supposed to be protecting this information? The information was all stored on an unpublished URL with no security or authentication in place. We in the security industry call this “security by obscurity“. And it is not security at all.
The first night of ShmooCon is a wrap, at least for the presentations. First off, my shout-outs to all those that actually made it this year. The DC weather hasn’t been too kind to any of us, especially those traveling in specifically for this Con. But to those who made it, I salute you (even more so to those who had to walk a couple miles to get to their hotel because they didn’t make or take reservations at the Marriot).