Archive for the 'security' Category
CloudAV prototypes anti-virus scanning via cloud computing
This is interesting research, but is it something you would use?
The researchers’ new approach, called CloudAV, moves antivirus functionality into the “network cloud” and off personal computers. CloudAV analyzes suspicious files using multiple antivirus and behavioral detection programs simultaneously.
In general, that’s not a bad idea. It might save a few CPU cycles on your local workstation by not having to directly virus scan files. Then again, you have to use network resources uploading each file to the cloud, where it is scanned for you.
Each time a computer or device receives a new document or program, that item is automatically detected and sent to the antivirus cloud for analysis.
The privacy concerns here are obvious. Would you trust CloudAV to receive a copy of every file you want to virus scan? How sure can you be that they don’t use the contents for something else, or accidentally leak private information?
I think this idea has more merit as an internal virus scanning system for a large organization. That way sensitive data doesn’t have to leave the corporate boundary, or be sent to a third party. The benefit is that you have a more thorough and updated virus scanning engine, possibly using several different products at once.
Researchers develop next-generation antivirus system.
No commentsRuby vulnerabilities
There are already plenty of people talking/screaming/crying about the recent bugs found in the Ruby programming language:
The list of CVEs created to track these bugs:
The funny thing is, these vulnerabilities were created in the run-time implementation of Ruby, which is itself written in C. So it’s really not all that surprising, considering how hard it is to write secure, large, bug-free C programs.
Classic insider threat example
IT director gets fired. IT director still has remote access to company network. IT director deletes a bunch of stuff and causes some damage.
This is a cut and dry example of why the insider threat is such a major issue. I guess some companies need to learn the hard way: Disable all accounts belonging to terminated employees; if it’s an admin (or the IT director), change all the root passwords as well. Of course, this implies that a company has to keep track of all the accounts an employee might have, which is not easy. The important thing to remember is that this is more of a people/policy challenge than a technical one.
No commentsWindows command line utilities
We all know that Windows can’t compete with Linux or UNIX when it comes to useful command line utilities (excluding Cygwin). But what most people don’t know is how many commands actually are available in Windows. If your job is to investigate intrusions on Windows machines, there are some nifty little command line tools that can help make your job easier.
This article by Ed Skoudis lists a few of them, with handy examples of how the commands might be used in a security investigation. He mostly talks about wmic, openfiles (which I had never heard of before), and netstat. Unless you’ve done recent Windows administration work, you’ve probably never had to use wmic, but it’s really powerful, with tons of options. Also, be sure to check out the second part of his article, which goes into more advanced command line tricks - like “for” loops and querying the registry.
A more comprehensive list, although less detailed, was published by Kevin Beaver. There is overlap, but Kevin mentions a few addiontal commands.
No commentsWeb Security
Google has some good content about web security available on their Google Code University portal. There’s introdutory course material, and even some videos. The one titled “How to Break Web Software” is pretty interesting.
No comments
