OS X (both Leopard and Tiger) comes with a built-in firewall that’s disabled by default. The Leopard firewall is a little bit different than Tiger’s, so I’m focusing on that. The underlying firewall is ipfw – the same as on FreeBSD, so if you know what you’re doing, you can edit it to your heart’s content. More details on controlling the firewall from the command line are available in this O’Reilly article. This article is going to talk about dealing with the firewall through the available GUI interface. First, you have to access the firewall. System Preferences -> Security then the Firewall tab. By default, it’ll have “Allow all incoming connections”. If you’re not quite sure what you’re doing, “only[…]
Category: Technology & Tool Thursday
Each Thursday, Security Musings features a security-related technology or tool. Featured items do not imply a recommendation by Gemini Security Solutions.
In the first two parts of this series, I explained public-key cryptography and the role of trusted third parties in a PKI. In this post, I will briefly discuss some standards that have been developed and are used to implement the various pieces of a public key infrastructure.
A Sniffer, which is can also be referred to as a Network Analyzer, is a piece of software that analyze network traffic, decode it, and give it back packet information so that a network administrator can use it to help diagnose problems on the network. But because these tools can be so powerful, they can also help leverage those of the black hat world by allowing them to pull plain text information off the network as well (usernames, passwords, unencrypted emails, instant message chat, etc).
This tool for Microsoft Windows gives the user some very important information regarding running processes. It displays a very detailed (and real-time) list of files/directories accessed by a running program. This includes loaded DLLs and file system handles opened or closed during execution. The security benefits of this tool are based around detection and troubleshooting. It is common for malware to inject DLLs into running processes. With this tool, such a compromise could be easy to detect or track down. In addition to individual process information, Process Explorer also reports overall system information– memory usage, processor usage, physical memory activity, etc. In many ways, it is like an improved version of Windows Task Manager. It’s relatively small in size, and[…]
Nmap is a *very* frequently used tool for both network testing and penetration testing. However, most people don’t use half of its capability – I’ll talk about some of the more popular options in this post. Nmap is available at insecure.org, and is available for most operating systems – even Windows. However, I’m not going to discuss the fancy GUI in this post, so you’ll have to dig a bit and consider using the cygwin version. The first, most popular option is the -O option – for telling you what kind of operating system the target has. It’s pretty obvious on how it’s used, but you also have to know that the system has one open port and one closed[…]
In Part I of this series, I described public-key cryptography and why it is useful. In this installment, I will discuss what makes PKI an infrastructure. We discovered last time that while public-key cryptography is an excellent solution for signing and encrypting data, it is worthless if you can’t be certain of where the public key came from. The missing ingredient is the trusted third party.