Gmail S/MIME is a pretty cool Firefox add-on that adds signing and encrypting capabilities to Gmail. The add-on integrates smoothly with the user interface so that you might think Google had added the feature themselves. It still needs some work (it’s currently at version 0.4) but has the potential to be a very useful tool for security-conscious users.
Category: Technology & Tool Thursday
Each Thursday, Security Musings features a security-related technology or tool. Featured items do not imply a recommendation by Gemini Security Solutions.
“w3af” (Web Application Attack and Audit Framework) is a complete environment for auditing and attacking web applications. This environment provides a solid platform for auditing and penetration-testing. The framework will work on all platforms that support Python (Linux, WinXP, Vista, OpenBSD, etc )
FireGPG is an OpenPGP MIME-compliant add-on to Firefox that allows you to select some text on a web page (or entered in a form) and perform some cryptographic operations on it. This add-on provides immediate security benefits. It can allow you to easily and quickly encrypt a message and send it over a public channel without even having to leave your browser. For example, you can send a (short) secret message to someone by encrypting it and posting the block in a public forum or on a public blog– as long as the recipients have the correct key, they can decrypt it. This add-on can also be used to generate digital signatures, providing both integrity and non-repudiation. Below is an[…]
This entry continues where Sniffing Networks Part 1 left off. If you didn’t read it, as long as you understand how switches work and why we have MAC addresses, you’ll be able to understand this entry. The physical wire may talk in MAC addresses, but when’s the last time you typed a MAC address into a browser location bar? (You haven’t, except by accident, and certainly not expecting to get anywhere with it.) Computers talk in IP addresses, not MAC addresses, so how does the switch know what port to send the packet on to if it’s only given the IP address? Address Resolution Protocol, or ARP. ARP is another table that lives in each router (and computer) to map[…]
When you notice suspicious activity on your Windows system, it’s a good bet that whatever malware has breached your security measures has configured some mechanism to automatically launch the misbehaving process after a reboot. The Autoruns utility is very useful for finding and eliminating those items that allow malware to run without any user action.
Although people are starting to become more willing to keep their computers secure with frequent security updates, sometimes it’s easy to forget about all the other vulnerabilities computers may have. Fortunately, some programs help keep things in check. Microsoft’s Baseline Security Analyzer (MBSA) is a free program that goes through a user’s computer making a note of all the potential security misconfigurations it finds (checking Windows settings, registry keys, installed Microsoft products, etc). MBSA checks everything from IE web content “zones” to the permissions of user accounts allowed to use the CmdExec role in SQL Server. It even checks the strength of passwords and software security update statuses. Although it was designed for scanning multiple computers on a network, it[…]