Monthly Archives: September 2011

Mozilla Firefox 7 now available

The Mozilla foundation has released the latest version of Firefox 

http://isc.sans.org/diary/Firefox+v+7+0+1+Is+Live/11698

http://www.mozilla.org/en-US/firefox/new/

See you in Vegas!



Jessica has let her hair down and she and the Gnome are ready to party … um I mean learn about SMB solutions at SMBnation.com

See you in Vegas!

New TLS/SSL Security Vulnerabilities – Best Practices for Protection

Trend Micro shares some excellent user safety tips and administrative design standards to help mitigate attacks.  One key practice is to close secure websites by logging out to keep sessions as short as possible.

BEAST and TLS/SSL Security: What It Means For Users and Web Admins http://blog.trendmicro.com/beast-and-tlsssl-security-what-it-means-for-users-and-web-admins/
What can users do?

• Keep time spent on sensitive SSL sessions as short as possible. The attacker needs time to decode the encrypted message. If the session cookie is invalid before the attacker has finished, this attack fails.

• When leaving an SSL protected site, be sure to actually log out, not just move to a new site. In many cases, actively logging out will invalidate any cookie/session data that the attacker may have successfully decoded.

• Standard security best practices still work. For this attack to be successful, the attacker must have access to either your network or your computer. At the very least, up-to-date security software will make life harder for an attacker.
What can website administrators do?

• Make sure your logout button performs the expected action. You are leaving users at risk if your site does not actually invalidate session cookies when they click “log out”.

• Ensure that session cookies are tied to an IP address where the session was established. If that IP address changes, consider validating that the source of the requests is still your user. This will not prevent this attack, but it will make it harder to exploit your users.

• Resist the temptation to change SSL ciphers without carefully considering the risks first. While it is true that RC4 is not subject to this attack, it presents more risk than AES. Also, it isn’t a bad idea to keep an eye on the IETF TLS working group.  New versions of the TLS standard exist that eliminate the weaknesses used in this attack. Unfortunately HTTP server and browser coverage of these new standards is spotty at the moment at the moment. So you have to carefully consider both your environment and your user base before such a change.

TLS (Transport Layer Security) Working Group http://datatracker.ietf.org/wg/tls/charter/

TLD4 Rootkit – New Variant of MBR version emerges

TLD4 is one of the most advanced Windows malware agents circulating.  It is highly stealth and hides in the master boot record of the Windows O/S.  Trend Micro shares developments related to a new version:

TDL4 Worm Component Employs Bitcoin Mining http://blog.trendmicro.com/the-worm-tdl4-and-botcoin-miners/

QUOTE: TDL4 is a well known variant of the TDSS malware family known for evading detection by antivirus products by infecting affected systems’ boot sector. We’ve been monitoring developments related to TDSS, and earlier this year we saw TDL4 exhibit propagation routines through a worm component that Trend Micro detects as WORM_OTORUN.ASH.

Amazon Kindle Fire – High Tech and Low Cost e-Book reader

This is an interesting development as a low-cost high technology tablet:

Amazon Unveils $199 Kindle Fire Tablet http://www.bloomberg.com/news/2011-09-28/amazon-unveils-199-kindle-fire-tablet.html

QUOTE: The Kindle Fire will have a 7-inch display and sell for $199, compared with $499 for Apple’s cheapest iPad, Amazon executives said in interviews with Bloomberg Businessweek. The device, a souped-up version of the Kindle electronic-book reader, will run on Google Inc.’s Android software, the Seattle-based company said. Amazon also introduced a touch-screen version of its e-reader, to be called Kindle Touch.

F-Secure ShareSafe Beta – Security Application for Facebook

F-Secure has developed a security product designed to integrate with Facebook and check for malicious links.

F-Secure ShareSafe Beta – Security Application for Facebook http://www.f-secure.com/weblog/archives/00002243.html

QUOTE: Security applications and Facebook tend to mix together like oil and water.  Therefore, when attempting to develop a security application for Facebook… it had better not be boring. And that brings us to our new beta: F-Secure ShareSafe. The development team behind ShareSafe aims to build an entertaining Facebook app, with security benefits tagging along for the ride.

Microsoft Windows 8 – eWeek shares 15 screenshots of new features

A total of 15 screenshots illustrate some of the initial features for this new operating system.

eWeek Microsoft’s Windows 8 Developer Preview: First Look http://www.eweek.com/c/a/Enterprise-Applications/Microsofts-Windows-8-Developer-Preview-First-Look-432584/

QUOTE: Microsoft has offered its Developer Preview of its upcoming Windows 8 to the world. This early glimpse of the operating system, while nowhere near finished, offers a one-of-a-kind perspective into Microsoft’s thinking when it comes to the next generation of Windows. For one thing, the company also intends Windows 8 to make substantial inroads into the tablet category, currently dominated by Apple’s iPad—and it plans to do so by offering a touch-centric “Metro” interface that consists of colorful tiles linked to applications.

Microsoft MSRT – Seconnd Release in September 2011 for Kelihos botnet

Early this morning, Windows Automatic Update notified me of a second MSRT update and below are the details.  Wishing them success in eradicating this malicious threat.

Microsoft MSRT – 2nd Release for September 2011
http://blogs.technet.com/b/mmpc/archive/2011/09/26/operation-b79-kelihos-and-additional-msrt-september-release.aspx

QUOTE: For the month of September, Microsoft is adding the Win32/Kelihos family to a second release of the Malicious Software Removal Tool. This additional release is to support the most recent action in Project MARS- Operation b79 which targets the Kelihos botnet. The Win32/Kelihos malware family distributes spam email messages that may contain links to web sites serving installers of Kelihos itself. It may also communicate with remote computers to exchange information that it uses to execute various tasks such as bootstrapping to the botnet, sending spam emails promoting bogus products or services, stealing sensitive information, or downloading and executing arbitrary files.

Microsoft killed Kelihos botnet http://isc.sans.org/diary/Microsoft+killed+Kelihos+botnet/11644

QUOTE: Great news for Internet security. Microsoft has effectively killed off the Kelihos botnet which has about 42-45K nodes. The signature to remove the botnet agent from infected machine is added to the Malicious Software Removal Tool which will be rolled out to users taking automatic updates. Microsoft also took a proactive approach on the legal front, filing for court order to get Verisign (the domain registrar for the malicious domains) to take down the malicious domains related to the botnet operations.

Book review: Parallel Programming with Microsoft VS 2010

[Disclaimer: I’ve received a free copy of this book for reviewing]

A few days ago, I’ve received a copy of the Parallel Programming With MS VS 2010 book. Before delving into the parallel lib, the books starts by presenting several interesting concepts related with parallel/multithreaded programming. From chapter 2 onwards, it’s all about the Parallel Lib. Chapter 2 presents several concepts related with adding task parallelism in your apps and Chapter 3 moves forward and tries to present several interesting ideas associated with data parallelism. Chapter 5 wraps it up by presenting several PLINQ related concepts. In Chapter 5, the author presents the concurrent collections and Chapter 6 wraps it up by talking a little bit about the available options for customizing the parallel lib.

I must say that I was really excited when I received the book. After all, multithreading programming is one of the areas that I really like to dig into. Unfortunately, the excitement was gone after reading the first 3/4 chapters. I’ve got two problems with this book: the first is it presents the code step by step and then it shows all the code. In other words, the book has lots of extra pages which really don’t add anything to it. The second issue I have with the book is that it doesn’t go deep enough. The examples shown are rather simple and, in my opinion, don’t really bring much more than the online docs. Overall, I’m giving it a 5/10.

Up next we’re going to Europe!!

Up next we’re going to Europe!!

http://mvptour2011.sbsmigration.com/event_selector.php?event_id=173

We’ll be in Göteborg, Sweden with Mikael Nystrom



03 October 2011 9:30 to 4:30 p.m

Recent Comments