-X.

Unstatsppd: Your Beers Statistics Distribution by Day of Week

2011-06-12T17:47:00.001+02:00

As I had some free time on my hands this week-end, and that I wanted to know on which day of the week I most enjoy beer drinking, I fired up my favorite text editor and started unstatsppd.py.

No rocket science whatsoever but an easy mean to gather those statistics and display them using the Google Charts Tools API.

Code is available here: https://github.com/xsa/unstatsppd

Prerequisites:

Python Google Chart: http://pygooglechart.slowchop.com/
Python Untappd API wrapper: https://github.com/xsa/PyUntappd

Here's an output example with my data:

HTC Incredible S, Android, Linux, and udev(7)

2011-06-10T08:34:00.000+02:00

So it all started because I wanted to take screen captures of my HTC Incredible S (I will not explain how to do that here as you'll find plenty of good tutorials on the interwebs).

One of the steps involved the Dalvik Debug Monitor Server (DDMS) which provides all kind of things you could expect from a debugging tool, including a screen capture feature.Unfortunately, I quickly noticed that it wasn't really working as expected with my new HTC Incredible S device on my Linux laptop (running RHEL):

$ pwd

/full/path/to/android-sdk-linux_x86/tools

$ ./ddms 

(ddms:15838): Gtk-WARNING **: gtk_widget_size_allocate(): attempt to allocate widget with width -5 and height 16

(ddms:15838): Gtk-WARNING **: gtk_widget_size_allocate(): attempt to allocate widget with width -5 and height 16
09:01:27 E/DDMS: insufficient permissions for device
com.android.ddmlib.AdbCommandRejectedException: insufficient permissions for device
    at com.android.ddmlib.AdbHelper.setDevice(AdbHelper.java:736)
    at com.android.ddmlib.AdbHelper.executeRemoteCommand(AdbHelper.java:373)
    at com.android.ddmlib.Device.executeShellCommand(Device.java:276)
    at com.android.ddmuilib.SysinfoPanel.loadFromDevice(SysinfoPanel.java:159)
    at com.android.ddmuilib.SysinfoPanel.deviceSelected(SysinfoPanel.java:126)
    at com.android.ddmuilib.SelectionDependentPanel.deviceSelected(SelectionDependentPanel.java:52)
    at com.android.ddms.UIThread.selectionChanged(UIThread.java:1684)
    at com.android.ddmuilib.DevicePanel.notifyListeners(DevicePanel.java:752)
    at com.android.ddmuilib.DevicePanel.notifyListeners(DevicePanel.java:740)
    at com.android.ddmuilib.DevicePanel.access$1100(DevicePanel.java:56)
    at com.android.ddmuilib.DevicePanel$1.widgetSelected(DevicePanel.java:357)
    at org.eclipse.swt.widgets.TypedListener.handleEvent(Unknown Source)
    at org.eclipse.swt.widgets.EventTable.sendEvent(Unknown Source)
    at org.eclipse.swt.widgets.Widget.sendEvent(Unknown Source)
    at org.eclipse.swt.widgets.Display.runDeferredEvents(Unknown Source)
    at org.eclipse.swt.widgets.Display.readAndDispatch(Unknown Source)
    at com.android.ddms.UIThread.runUI(UIThread.java:492)
    at com.android.ddms.Main.main(Main.java:103)

09:01:32 W/ddms: Unable to get frame buffer: insufficient permissions for device

Not what I expected, but nothing that cannot be fixed. So after googling/fiddling/ranting a bit, udev(7) came to the rescue. Pretty much, it seems I needed another rule to be added. So here's how I did it:

Look at the information that pertain to my HTC Incredible S:

$ lsusb
Bus 002 Device 006: ID 1267:0210 Logic3 / SpectraVideo plc
Bus 002 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 009: ID 0bb4:0cac High Tech Computer Corp.
Bus 001 Device 005: ID 0a5c:217f Broadcom Corp. Bluetooth Controller
Bus 001 Device 003: ID 17ef:480f Lenovo Integrated Webcam [R5U877]
Bus 001 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Create a specific android.rules file in custom rules directory /etc/udev (Note that it is one single line in the .rules file below)

$ id
uid=500(xsa) gid=500(xsa) groups=500(xsa),496(desktop_admin_r)
$ sudo -s

# cat > /etc/udev/android.rules

SUBSYSTEMS=="usb", ATTRS{idVendor} =="0bb4", ATTRS{idProduct} =="0cac", MODE="0660", OWNER="root", GROUP="desktop_admin_r"

^D

# ln -s ../android.rules /etc/udev/rules.d/90-android.rules

Reload the udev(7) rules and then launch again DDMS and you should be all set.

# /etc/init.d/udev-post reload

[...]

# exit

$ cd /full/path/to/android-sdk-linux_x86/tools

$ ./ddms 

Daily links for 04/21/2011

2011-04-22T01:18:00.001+02:00

ModSecurity Advanced Topic of the Week: Integrating IDS Signatures - SpiderLabs Anterior
"You may be familiar with the Emerging Threats project. They have a few Snort rules files related to known web application vulnerabilities and attacks: * emerging-web_server.rules * emerging-web_specific_apps.rules"
tags: modsecurity security infosec web ids snort
Oracle gives up on OpenOffice after community forks the project
"In a statement issued on Friday, Oracle announced that it intends to discontinue commercial development of the OpenOffice.org (OOo) office suite. The move comes several months after key members of the OOo community and a number of major corporate contributors forked OOo to create a vendor-neutral alternative."
tags: oracle openoffice opensource software
BSidesLondon Wrap Up « /dev/random
"It was a long but wonderful day! I woke up very early to catch my train from Brussels to London and arrived just in time. The room was already full of security guys, some well known faces and new ones. Let’s grab some coffee, some muffins and my bag full of goodies. Ready for the talks! The venue is nice, there is a good Wi-Fi coverage."
tags: infosec security bsideslondon conferences
SIEM: Out of the shadows and into the light - SC Magazine UK
"Being a property owner can be a massive headache. You end up spending thousands to protect what's yours – securing doors, windows, and every other feasible point of entry. Yet all a criminal needs is one shot – a misplaced key, say – and he is in."
tags: security infosec siem log management

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/20/2011

2011-04-20T22:07:00.001+02:00

BSidesLondon: Jedi mind tricks for building application security programs « Cатсн²² (in)sесuяitу / ChrisJohnRiley
"Most developers actually want to write secure code"
tags: infosec security bsideslondon appsec apps software development
Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly Radar
"Today at Where 2.0 Pete Warden and I will announce the discovery that your iPhone, and your 3G iPad, is regularly recording the position of your device into a hidden file. Ever since iOS 4 arrived, your device has been storing a long list of locations and time stamps. We're not sure why Apple is gathering this data, but it's clearly intentional, as the database is being restored across backups, and even device migrations. "
tags: apple iphone ipad ios privacy geolocation
BSidesLondon: How not to get hired for a security job « Cатсн²² (in)sесuяitу / ChrisJohnRiley
"Why people fail in the hiring process… by doing stupid things! Some things that I tell you NOT to do, might be what your future employer wants… it’s not easy to define."
tags: infosec security jobs bsideslondon

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/19/2011

2011-04-19T21:39:00.001+02:00

State of Software Security, Volume 3
"It’s here! Data junkies rejoice! Today we’re proud to release the third volume of our semi-annual State of Software Security report. This edition incorporates data from 4,835 applications analyzed via our cloud-based platform over the past 18 months."
tags: infosec security veracode report xss apps software
Anton Chuvakin Blog - "Security Warrior": Verizon DBIR 2011 is OUT!
"OMG, today is The Breach Day, an official security holiday. Verizon Business has just released their super-famous “2011 Data Breach Investigations Report”"
tags: infosec security verizon report vulnerability dbir
Six Months, Six Providers and IPv6 | Security to the Core | Arbor Networks Security
"This winter, the Internet passed a major milestone in its twenty-year-old wunderkind evolution from a small, experimental research network to one of the technical foundations of modern society. In a brief Miami hotel conference room ceremony, ICANN allocated the last five IPv4 address blocks on February 3 — the long anticipated endgame towards eventual Internet address space exhaustion was officially underway [1]."
tags: internet ipv6 networking

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/18/2011

2011-04-18T22:18:00.001+02:00

The Tangled Web
"The Tangled Web is my second book, and a lovingly crafted guide to the world of browser security. This is an overcrowded market, but there are two reasons why you may want to care. "
tags: books security web webapps infosec

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/14/2011

2011-04-14T23:06:00.001+02:00

cvechecker | A local CVE checker tool
"Welcome to the cvechecker tool homepage. The goal of cvechecker is to report about possible vulnerabilities on your system, by scanning the installed software and matching the results with the CVE database."
tags: cvechecker softwares tools security infosec
TechCrunch Review: RIM’s BlackBerry PlayBook Enters The Tablet Wars
"In the tablet world right now, there’s the iPad and then there’s everyone else. Sorry, Xoom, despite your hype, you just don’t cut it yet. But a new challenger is just about to take the stage and it comes from a somewhat unlikely player: RIM."
tags: hardware tablets rim

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/13/2011

2011-04-13T22:19:00.002+02:00

WordPress.com hack exposes confidential code • The Register
"The company that maintains the WordPress.com blogging platform said hackers gained root access to its servers and made off with sensitive code belonging to it and its partners."
tags: security hack wordpress privacy
ModSecurity Advanced Topic of the Week: Integrating Content Security Policy (CSP) - SpiderLabs Anterior
"Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware."
tags: mozilla web csp security xss browser
TippingPoint | DVLabs | Cloud Security: Amazon's EC2 serves up 'certified pre-owned' server images
"Cloud computing has quickly evolved from a hot industry buzz word into a multi-billion dollar emerging market, with all the big names striving to grab a piece of the pie. Amazon, with its Amazon Elastic Computer Cloud (EC2), is arguably the dominant leader of the cloud services market."
tags: amazon ec2 cloud security infosec hacking

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/12/2011

2011-04-12T22:43:00.001+02:00

Commodore 64 viruses – time for a comeback? | Naked Security
"I can't be the only nostalgic nerd to feel a flutter of excitement at the news that a home computer from yesteryear is making a comeback."
tags: hardware history c64
Official Google Blog: Pagination comes to Google Docs
"Exactly one year ago, we launched a new version of the Google document editor, created from the ground up to take advantage of the latest capabilities in modern web browsers like Chrome. In particular, we baked in a way of supporting text features that aren’t natively included with browsers—for example, we added a ruler for controlling the margins, text that wraps around images to create eye-catching docs and discussions for a more collaborative editing experience."
tags: google web cloud apps
Lenny Zeltser on Information Security — The Random Information Security Job Title Generator
"There is a surprising number of title variations among people who work in the field that I call “information security.” I browsed through various job-search sites to get a feel for the more frequently-seen titles and created a random information security job title generator. "
tags: infosec security jobs fun

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/11/2011

2011-04-11T21:11:00.001+02:00

sqlmap: automatic SQL injection and database takeover tool
"sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. "
tags: sqlmap security infosec pentesting tools
Android App Admins gets three new Android tools | Android Development Talk
"Google has announced recently three new updates to Android’s enterprise management capabilities. This is specially developed around security and connecting with colleagues and will be available to business and education Android Applications."
tags: google android mobile apps enterprise

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/08/2011

2011-04-08T23:34:00.001+02:00

IBM jumps into cloud, customers tip-toe behind - Computerworld
"In announcing its cloud computing services on Thursday, IBM stressed repeatedly that private clouds -- or those that exist behind the corporate firewall -- are as important to its strategy as those in the public realm. "
tags: ibm cloud
Shodan HTTP Header Survey « Cатсн²² (in)sесuяitу / ChrisJohnRiley
"After a few months of back and forth, the first stage of our HTTP Header research is now live on the Shodan website."
tags: security web shodan browsers xss
Linkedin App for Android Devices now available in Android Market | Android Development Talk
"LinkedIn, the professional social network, has finally launched its Android App."
tags: mobile android linkedin apps social media

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/07/2011

2011-04-07T22:16:00.001+02:00

Content Updates
"IBM Internet Security Systems (ISS) provides security content updates for supported products through the X-Press Update feature. IBM ISS recommends installing the latest update to ensure your products are current and your protection is maximized. "
tags: ibm x-force ids ips signatures security
Flaw in ISC’s dhclient could allow remote code execution | Naked Security
"The Internet Systems Consortium (ISC), a non-profit company which develops BIND and dhcpd/dhclient, has announced a new remote code execution vulnerability present in its dhclient software."
tags: security dhcp isc bugs vulnerability

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/06/2011

2011-04-06T22:29:00.001+02:00

ModSecurity Advanced Topic of the Week: Malware Link Removal - SpiderLabs Anterior
"This is a follow-up post to ModSecurity Advanced Topic of the Week: Malware Link Detection in which we will highlight a new capability within ModSecurity v2.6 that allows for removal of data within response bodies."
tags: infosec security malware modsecurity web
SLAAC Attack – 0day Windows Network Interception Configuration Vulnerability | InfoSec Resources
"As anyone who has watched the reimagined Battlestar Galactica will tell you, Sixes are trouble. They are undoubtedly alluring, but all the while they are working covertly, following The Plan, right under the noses of their targets. Nobody realizes the true nature of the threat until it’s too late."
tags: infosec security networking ipv6
Mobile Apps Invading Your Privacy
"An article in the Wall Street Journal, dated April 5, 2011, disclosed that Federal prosecutors in New Jersey are investigating numerous smart phone application manufacturers for allegedly, illegally obtaining and distributing personal private information to third party advertisement groups."
tags: infosec security mobile softwares privacy

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/05/2011

2011-04-05T22:49:00.001+02:00

Analysis of LizaMoon: Stored XSS via SQL Injection - SpiderLabs Anterior
"More and more of today's web application attacks are leveraging multiple weaknesses, vulnerabilities and attack methods in order to achieve a desired exploitation outcome. It is becoming more and more difficult to neatly place an attack into one specific container (such as XSS, SQL Injection, etc...). These are blended attacks."
tags: infosec security lizamoon sql injection malware
Tenable Network Security: Preventing & Detecting Malware: A Multi-Facetted Approach
"Successful Attacks from Automated Malware"
tags: infosec security networking lizamoon malware monitoring nessus
IBM: Watson Could Boost Confidence of Financial Industry - PCWorld
"The software that helped IBM's Watson computer reign victorious on the Jeopardy game show in February could also help the financial industry assess risk more effectively, a pair of IBM executives stated on Monday at a high-performance computing conference. "
tags: ibm watson research

Posted from Diigo. The rest of my favorite links are here.

Daily links for 04/01/2011

2011-04-01T23:22:00.001+02:00

Frequency X Blog
Over the last few days we have been tracking a mass SQL injection attack that was first blogged by Websense On March 29th, These types of threats are nothing new to us in IBM Managed Security Services as we’ve been tracking similar attacks for years.
tags: ibm security sql injection
Hacker Group Changes Millions of Passwords to "password"; Only 38% of Users Notice - F-Secure Weblog : News from the Lab
Passwords from over 3,000,000 user accounts were apparently set to "password" late last night in a wide-spread hack that affected hundreds of news, retail and web 2.0 sites. Most affected users are completely unaware of the attack.
tags: infosec security privacy passwords

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/31/2011

2011-04-01T00:21:00.002+02:00

IBM X-Force Report: 2010 Marked a Year of Sophisticated, Targeted Security Attacks
IBM today released results from its annual X-Force 2010 Trend and Risk Report, highlighting that public and private organizations around the world faced increasingly sophisticated, customized IT security threats in 2010.
tags: ibm x-force infosec security malware spam virus
droidwall - DroidWall - Android Firewall - Google Project Hosting
DroidWall - Android Firewall is a front-end application for the powerful iptables Linux firewall. It allows you to restrict which applications are permitted to access your data networks (2G/3G and/or Wi-Fi).
tags: google android mobile firewall droidwall iptables security

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/30/2011

2011-03-30T22:11:00.000+02:00

SQL Injection attack hits nearly 50,000 domains - Security
A massive SQL Injection campaign, similar to ones seen in the past, has hit nearly 50,000 domains across the Web, including a handful of iTunes URLs. The attacking domain, lizamoon.com, is currently offline but the server hosting it remains active. Before it disappeared, the injected domain was pointing users to Rogue anti-Virus applications.
tags: infosec security vulnerability sql injection

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/29/2011

2011-03-29T21:26:00.001+02:00

Mobile Malware Statistics | Fortinet Security Blog
We often have requests on mobile malware statistics and although statistics are only an imperfect representation of reality, this is what we can share.
tags: infosec security malware mobile statistics
McAfee has its own website vulnerable to attacks | Blog do Pablo Ximenes
Today, as every ordinary Monday, I went to my e-mail box and checked messages from the security community in Full-Disclosure. As usual I came across an advisory pointing out some web security vulnerabilities that differently from usual certainly had my attention.
tags: mcafee infosec security xss vulnerability
Get Better Battery Life on Your Rooted Android Phone by Wiping Its Battery Stats
Some users, when flashing new ROMs, have noticed that their battery life goes down a little bit. With just a simple wipe of the battery stats file, though, you can get your battery back up and running to its full capacity.
tags: android mobile hardware
Java inventor James Gosling joins Google - CXOtoday.com
Google (NASDAQ:GOOG) has snapped up James Gosling who invented the Java programming language while at Sun Microsystems.
tags: google java
Color App Hack Lets You Spy On Anyone’s Photos Anywhere - Andy Greenberg - The Firewall - Forbes
For anyone sketched out by the privacy implications of Color, the highly hyped, highly funded, and highly public iOS and Android social media app that launched last week, now would be a good time to ratchet your creep-o-meter up another notch or two.
tags: infosec security social media lbs geolocation
Microsoft Hunting Rustock Controllers — Krebs on Security
Who controlled the Rustock botnet? The question remains unanswered: Microsoft’s recent takedown of the world’s largest spam engine offered tantalizing new clues to the identity and earnings of the Rustock botmasters.
tags: infosec security microsoft botnet rustock

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/28/2011

2011-03-28T22:45:00.002+02:00

Holy Crap – AB to buy Goose Island for $38 Mil | Ladies of Craft Beer
Please excuse my profanity, but I could think of nothing else to title this article. According to Adam Nason of BeerNews.org, Anheuser-Busch, Inc. will buy Goose Island Beer Company and brewmaster Greg Hall is stepping down.
tags: beers news
Protect the privacy of your Android phone
Privacy Blocker is an Android application that stops other installed applications from gathering your personal information.
tags: google android mobile privacy softwares
MySQL.com and Sun hacked through SQL injection | Naked Security
Proving that no website is ever truly secure, it is being reported that MySQL.com has succumbed to a SQL injection attack.
tags: security web sql sql injection mysql

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/25/2011

2011-03-25T21:23:00.002+01:00

How to Practice Your Web Application Testing Skill... - HP Software Solutions Community online forum
For those who are learning web application security testing (or just trying to stay sharp) it's often difficult to find quality websites to test one's skills. There are a few scattered around the Internet (see the link in the notes section below) but it would be nice to have a solid collection of test sites all in one place.
tags: pentesting security
IBM Introduces New Social Media Metrics And Tracking Tools « Turbotodd
If you interact with the social media world at all, you know what an immense opportunity there is to gather, analyze, and act on all the great data floating around.
tags: ibm social media
Firefox joins Chrome in supporting HTTP Strict Transport Security (HSTS) | Naked Security
Although the Firefox team has an entire page on the mozilla.com website dedicated to the new security features in Firefox 4, they seem to have forgotten to mention HTTP Strict Transport Security (HSTS).
tags: browser mozilla firefox chrome web hsts
GWEB - Web Application Security Certification
GIAC is launching a new certification for developers and application security professionals involved in defending web applications.
tags: infosec security web webapps certifications
Google Holds Honeycomb Tight - BusinessWeek
In the great mobile-device wars, Google (GOOG) has portrayed itself as the open-source crusader doing battle against the leaders in proprietary software—Apple (AAPL), Microsoft (MSFT), and Research In Motion (RIM:CN).
tags: google android tablets opensource development
Nobody Needs a Tablet. So Why Are We Gobbling Them Up? | Gadget Lab | Wired.com
Apple’s iPad is just one year old, and more than 15 million customers have voted with their wallets. The tablet is officially mainstream.
tags: apple ipad tablets

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/24/2011

2011-03-24T22:08:00.001+01:00

Pastenum – Pastebin/pastie enumeration tool | Corelan Team
When conducting a pen-test, the process typically starts with the reconnaissance phase, the process of gathering information about your target(s) system, organization or person. Today, we want to present a tool that can be added to your reconnaissance toolkit.
tags: infosec security pentesting softwares
Is the new HP just an IBM clone? - Big Tech - Fortune Tech
Behold the new HP. After a series of scandals, a change in CEOs and a rebuilding of its board, the tech giant revealed the new HP to the world: It's still very much a company that wants to be another company -- IBM.
tags: ibm hp
Android Developers Blog: Memory Analysis for Android Applications
The Dalvik runtime may be garbage-collected, but that doesn't mean you can ignore memory management. You should be especially mindful of memory usage on mobile devices, where memory is more constrained.
tags: google android softwares development
Is the iPad 2 Old Tech Already?
This morning at CTIA 2011, Samsung brought us a revised Galaxy Tab 10.1″ that has beat out the iPad 2 in its thinness and light weight specs. This of course brings to question how long does your tech stay current these days?
tags: apple ipad tablets samsung android google multimedia

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/23/2011

2011-03-23T23:19:00.002+01:00

BlackBerry Playbook: A More Secure Tablet?
Today, RIM began taking advance orders on its new tablet. The first Playbook will connect to the internet via Wi-Fi and, at $499, will compete on price with the iPad.
tags: rim tablets playbook ipad
Securosis Blog | McAfee Acquires Sentrigo
McAfee announced this morning its intention to acquire Sentrigo, a Database Activity Monitoring company. McAfee has had a partnership with Sentrigo for a couple years, and both companies have cooperatively sold the Sentrigo solution and developed high-level integration with McAfee’s security management software.
tags: mcafee acquisition sentrigo database infosec

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/22/2011

2011-03-22T20:59:00.002+01:00

E L S U A ~ A KM Blog Thinking Outside The Inbox by Luis Suarez » Staying Healthy – 11 Ergonomic Tips for Avoiding RSI
One of the biggest challenges we, knowledge (Web) workers, keep facing over the course of time, as we get more and more heavily involved with knowledge work being carried out through both traditional and emergent collaboration and knowledge sharing tools out there on the Social Web, is the fact that, now more than ever, we need to stay healthy
tags: ergonomic health
HD Moore Reveals His Process for Security Research | InfoSec Resources
In our ongoing series of interviews, we got HD Moore to answer a few questions and pull back the curtain a bit on the methods, tools and motivation for the research he does discovering security exploits.
tags: infosec security rapid7 metasploit people interview
CIO CITY
CIOnet is Europe's leading Network for CIO's and IT Directors, operating in the UK, Spain, France, Italy, Norway, The Netherlands and Belgium.
tags: it cio europe
Frequency X Blog
Last week there was widespread media coverage of a successful effort by Microsoft and US Marshals to take down the command and control capabilities of the Rustock botnet.
tags: infosec security botnet spam microsoft rustock

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/21/2011

2011-03-21T23:29:00.001+01:00

Google cops €100k French spank in Street View slurp outrage • The Register
French privacy watchdogs have hit Google with its very first fine for allowing its Street View cars to snoop on citizens' Wi-Fi data.
tags: google privacy
IBBM
Iron Brussels Beer Marathon
tags: beers brussels
Hackers Embarrass Security Company EMC
The world's biggest maker of data storage computers on Thursday said that its security division has been hacked, and that the intruders compromised a widely used technology for preventing computer break-ins.
tags: security hacking infosec emc
BlackHat Europe 2011 / Day 02 | Corelan Team
BlackHat Europe 2011 / Day 02
tags: blackhat infosec security conferences report

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/18/2011

2011-03-18T15:12:00.002+01:00

Careers in Application Security
After 15 years of managing cybersecurity programs and performing IT security engineering functions, Richard Tychansky, an information assurance engineer at Lockheed Martin Corp, finds his role transforming.
tags: security infosec softwares owasp
BlackHat Europe 2011 / Day 01 | Corelan Team
So, as promised in yesterdays preview, what follows is the report of my first day at Black Hat Europe 2011.
tags: blackhat conferences infosec security report

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/17/2011

2011-03-17T20:47:00.001+01:00

How to create your first foursquare special
Late last week, foursquare launched an entirely revamped platform for businesses. It opens up lots of new options for creating specials and makes the process of creating specials easier to manage, especially for companies with multiple locations.
tags: foursquare social media
Does my mac need more memory? | Macintosh How To
When your computer is running a little bit slowly, how can you tell if getting more memory will help you? Here is a simple way to check whether all the RAM you have in your mac is being used. It works for any macintosh running OS X – G4, G5 or intel macs.
tags: apple macintosh macosx hardware
NovaInfosec D-List Interview – Georgia Weidman | NovaInfosecPortal.com
Today’s interview is with SMS smartphone researcher Georgia Weidman. Georgia is is currently Director of “Cyberwarface” at Reverse Space and resident videographer at NoVa Hackers. Oh and then there is that full time day job thing.
tags: infosec security interview people
Why have I not yet implemented File Integrity Management (FIM)? « ERE-Security Blog
If you have not yet deployed FIM perhaps now is a good time to ask “why not”. If your organization is now addressing data loss prevention (DLP) by minimizing the risk of damage by malicious code and by enforcing strict access controls to mitigate unauthorized access, then FIM is something you might also want to consider.
tags: security infosec pci-dss fim
Pwn2Own Winner Criticizes Event – flyingpenguin
Dr. Charlie Miller says the Pwn2Own event is managed in a way that has dangerous exploits "left over"
tags: cansecwest pwn2own infosec
Android Developers Blog: Android 3.0 Hardware Acceleration
One of the biggest changes we made to Android in this release is the addition of a new rendering pipeline so that applications can benefit from hardware accelerated 2D graphics.
tags: google android mobile
Metasploit Framework Code Swarm on Vimeo
a Code Swarm done for the Metasploit framework SVN trunk from the past 5 years, kinda neat to watch ^_^ enjoy.
tags: metasploit video softwares security infosec

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/15/2011

2011-03-15T21:47:00.000+01:00

F-Secure Mac security scanner bug bins benign files • The Register
F-Secure has apologised about a bug in its consumer-focused Mac security software that left surfers fighting against their own browsers as clean files were wrongly classified as malign.
tags: f-secure antivirus bugs macintosh macosx
Credibility Busters that Could Ruin Your Career
Whether you're an employee, leader, or entrepreneur, personal credibility is truly a "magic bullet" for success. It's simple: if you have no credibility, people won't trust you.
tags: career jobs
Android Application Developers gets more Stats from AppBrain | Android Development Talk
With Android Applications flooding the Android Eco system, AppBrain, has introduced AppBrain Android Stats. Android Developers can view the Android Market, Android Phones, and AppBrain usage.
tags: google android mobile softwares sdk statistics
How Charlie Miller Does Research | InfoSec Resources
As the first in an ongoing series of interviews, we got recent Pwn2Own winner Charlie Miller to answer a few questions and pull back the curtain a bit on the methods, tools and motivation for the research he does discovering security exploits.
tags: infosec security interview people

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/14/2011

2011-03-14T23:20:00.000+01:00

Voltage Superconductor : The coolest jobs in information security
tags: jobs infosec security
Alexander "Sasha" Volokh -- Pi press release
Mnemonic gives 167 digits of famous geometric constant
tags: mathematics pi mnemonic
NetBSD Blog
It is with great pleasure that we officially announce the release of the first NetBSD Amazon Images for the Amazon Elastic Compute Cloud (better known as Amazon EC2) for all currently available regions: US East (Northern Virginia), US West (Northern California), EU (Ireland), Asia Pacific (Singapore), and Asia Pacific (Tokyo).
tags: netbsd amazon cloud

Posted from Diigo. The rest of my favorite links are here.

Want to get your Plancast plans to show up in your Google Calendar?

2011-03-14T10:13:00.000+01:00

Want to get your Plancast plans to show up in your Google Calendar? It's not that hard. It's actually a few clicks away.

Go to your Plancast.com profile (http://plancast.com//).
In the "Export these Plans" section, click on the "Calendar Feed" link, a window will pop-up.
Select the "Google" link, obviously, and follow the instructions on how to add that to your Google Calendar.

Daily links for 03/11/2011

2011-03-11T22:31:00.001+01:00

Microsoft: Pwn2Own flaw already fixed in IE9 | ZDNet
Microsoft says the vulnerability used by researcher Stephen Fewer to exploit Internet Explorer 8 has already been fixed in the RC and RTM versions of Internet Explorer 9.
tags: cansecwest pwn2own microsoft browser web security
Lenny Zeltser on Information Security — How can we use fun as a motivator for changing the...
How can we use fun as a motivator for changing the behavior of computer users to improve information security?
tags: infosec security fun
The best Top 5 Atom Syndicators for Android phones | Android Development Talk
Atom is a great way of keeping track of the latest news and content published by your favourite websites as it allows individuals to control which news updates, blogs, articles, forums etc they keep up to date with.
tags: google android mobile news softwares
Pwn2Own 2011: BlackBerry falls to WebKit browser attack | ZDNet
Research in Motion’s recent decision to add a WebKit browser to BlackBerry has immediately backfired.
tags: cansecwest pwn2own blackberry security exploit browser
Charlie Miller wins Pwn2Own again with iPhone 4 exploit | ZDNet
Charlie Miller kept his Pwn2Own winning streak intact with another successful hack of an Apple product.
tags: cansecwest pwn2own apple iphone security exploit browser

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/10/2011

2011-03-10T23:36:00.002+01:00

Adrian Dimcev's Blog | A quick look over some browsers and their SSL/TLS implementations
Here are a few observations regarding some browsers and their SSL/TLS implementations.
tags: browser security ssl tls
CanSecWest: Researchers Show Off Method For Disabling Phones Via SMS | threatpost
A pair of security researchers from Germany demonstrated several techniques at the CanSecWest conference here Wednesday that enable them to remotely reboot, shut down or even completely disable many popular mobile phones with SMS messages.
tags: cansecwest mobile security
Why Pwn2Own Is What's Right With Security | threatpost
When the Pwn2Own contest began in 2007, it was dismissed by some in the industry as nothing more than a publicity stunt meant to inflate the egos of researchers while embarrassing software vendors
tags: pwn2own security infosec
Safari/MacBook first to fall at Pwn2Own 2011 | ZDNet
A team of security researchers from the French pen-testing firm VUPEN successfully exploited a zero-day flaw in Apple’s Safari browser to win this year’s Pwn2Own hacker challenge.
tags: pwn2own security infosec browser apple safari macosx
Pwn2Own 2011: IE8 on Windows 7 hijacked with 3 vulnerabilities | ZDNet
Using three different vulnerabilities and clever exploitation techniques, Irish security researcher Stephen Fewer successfully hacked into a 64-bit Windows 7 (SP1) running Internet Explorer 8 to win this year’s CanSecWest hacker challenge.
tags: pwn2own security infosec browser windows

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/09/2011

2011-03-09T23:02:00.000+01:00

The Android OS Update Problem | alexking.org
he reasons that Android phones are either slow to get system updates, or fail to get them entirely are pretty clear. The process of getting an update ready to push to a handset is decidedly non-trivial
tags: android google mobile hardware softwares
OWASP Zed Attack Proxy Project - OWASP
The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
tags: pentesting softwares security owasp infosec web webapps
It all started with a check-in: the vision for #4sq3 and beyond | Foursquare Blog
It was almost exactly two years today that Naveen and I flipped the switch on foursquare, jumped on a plane to Austin and introduced the folks at SXSW 2009 to our idea of “turning life into a game
tags: foursquare social media

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/07/2011

2011-03-07T23:20:00.002+01:00

Introducing the Google APIs Explorer - The official Google Code blog
Google is always looking for new ways to make it easier for developers to get started with our APIs. When you come across a new Google API, you often want to try it out without investing too much time. With that in mind, we are happy to announce the Google APIs Explorer, an interactive tool that lets you easily try out Google APIs right from your browser.
tags: google api programming softwares web
jon.oberheide.org - blog - how i almost won pwn2own via xss
The actual vulnerability was an incredibly low-hanging naive persistent XSS in the Android web market. When posting an Android application through the publishing interface, there’s a description field for you to describe your application
tags: google android pwn2own cansecwest security
Hacker kills his own Pwn2Own bug for Android phones • The Register
A vulnerability that a researcher planned to use to compromise an Android cellphone at a hacking contest later this week got squashed after Google fixed the underlying bug in the Android Market.
tags: google android pwn2own cansecwest security
TEHTRI-Security :: Blog: About iPhone iOS 4.3 Personal Hotspot
During the latest Apple Special Event of March 2011, Apple CEO Steve Jobs announced new features and products. One of those masterpieces is a new option called “Personal Hotspot”. This new functionality transforms your iPhone into a Wireless Access Point, so that you can share your 3G connections. This will be released in few days with the next iPhone update (iOS 4.3).
tags: apple iphone ios wireless security
BSDCan2011: BSDCan 2011
tags: bsdcan bsd openbsd netbsd freebsd conferences

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/04/2011

2011-03-04T22:35:00.001+01:00

Frequency X Blog
If you paid attention to the news this week, you'll know that there were a bunch of Android apps pulled from the Android Market because they contained malware. There were over 50 infected applications - these apps were copies of "legitimate" apps from legitimate publishers that were modified to include two root exploits and a rogue application downloader.
tags: google android mobile malware ibm x-force
Main Page - The Penetration Testing Execution Standard
Welcome to the Penetration Testing Execution Standard homepage. This will be the ultimate home for the penetration testing execution standard.
tags: security infosec pentesting
Android DroidDream Uses Two Vulnerabilities | Fortinet Security Blog
We are pretty busy these days with malicious samples on Android. You probably haven’t missed DroidDream (Android/DrdDream.A!tr) which trojaned several applications on the Android Market and several blog posts on the matter
tags: android google malware mobile softwares

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/02/2011

2011-03-02T22:59:00.001+01:00

Changes to minimum password length for Google Apps accounts - Google Apps Developer Blog
As part of our continuous efforts to help our users protect their information, we recently launched 2-step verification for all Google accounts. Starting March 14, we will also increase the minimum password length requirement for Google Apps accounts from 6 characters to 8.
tags: google infosec passwords privacy
Google pulls 21 apps in Android malware scare - CNN.com
Google has just pulled 21 popular free apps from the Android Market. According to the company, the apps are malware aimed at getting root access to the user's device, gathering a wide range of available data, and downloading more code to it without the user's knowledge.
tags: google android malware softwares mobile
Malware in the Android Market - Securelist
Every day, we see more reports about malware in the Android Market. This time three developers known as MYOURNET, Kingmall2010, and we20090202, possibly the same person, were offering a number of Android apps for free download.
tags: google android malware softwares mobile
Nearly 40% Of Organizations With Mobile Devices Say They Need More Security For Them - Darkreading
A new IBM report found that more than 70 percent of organizations are allowing nontraditional endpoint devices -- think smartphones, iPads, and point-of-sale devices -- to connect to their corporate networks, but some 36 percent say these devices aren't properly secured.
tags: security mobile infosec ibm

Posted from Diigo. The rest of my favorite links are here.

Daily links for 03/01/2011

2011-03-01T23:21:00.002+01:00

How far will Apple go towards spreading around some of that Thunderbolt love? | Edible Apple
Apple last week introduced a new line of MacBook Pros. Chief among the improvements was the introduction of Thunderbolt, the name Apple bestowed upon Intel’s Light Peak transfer technology that can impressively transfer data at 10 Gbps both up and down.
tags: apple hardware thunderbolt
Gmail back soon for everyone - Official Gmail Blog
Imagine the sinking feeling of logging in to your Gmail account and finding it empty. That’s what happened to 0.02% of Gmail users yesterday, and we’re very sorry.
tags: google gmail fail backup
Intel completes McAfee acquisition
Intel announced the acquisition of McAfee is complete.
tags: mcafee intel security acquisition

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/28/2011

2011-02-28T21:25:00.000+01:00

Apple asks security experts to examine OS X Lion | Edible Apple
For as much as Mac OS X has a reputation for being safer than Windows, security researchers won’t hesitate to point out that the opposite is, in fact, true. Indeed, the primary reason why the Mac has been relatively immune from security threats often found on Windows is because the Mac’s relatively paltry market share makes it an unattractive target for malicious hackers.
tags: apple macosx security hacking
Proving the Network is Not the Problem With iperf - Packet Life
When an application fails to perform as expected, the network is often the first thing blamed. I suppose this is because end users typically view the network as the sole limiting factor with regard to throughput, unaware of the intricacies of application, database, and storage performance.
tags: networking iperf

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/24/2011

2011-02-24T22:07:00.001+01:00

Official Google Blog: Slice and dice your recipe search results
As a second-generation Indian who has grown up in the United States, I’ve developed a taste for great home-cooked Indian food, but not a knack for how to make it. Somehow my cooking efforts result in foods that taste over-spiced yet bland at the same time. My parents follow the art of cooking by intuition, where the right amount of each spice is measured out by gut feel, but that’s never worked very well for me.
tags: google food recipe web
Layer 8
Yep, I’m the Bastard Security Officer From Hell.
tags: security infosec humor

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/23/2011

2011-02-23T22:31:00.002+01:00

ModSecurity Advanced Topic of the Week: Passive Vulnerability Scanning Part 1 - OSVDB Checks - SpiderLabs Anterior
One of the most under-appreciated capabilities of web application firewalls (WAFs) is traffic monitoring and analysis. Due to the fact that WAFs have access to the full inbound request and outbound response payloads, they are able to glean valuable insight into vulnerabilities and configuration issues such as missing HttpOnly or Secure cookie flags, etc...
tags: security modsecurity vulnerability scanning pvs osvdb
How Code Rot Can Lead to Vulnerabilities
As a web developer you’re always told you need to keep up to date on the latest and greatest technologies. Usually this is for creating applications which can take advantage of new technologies to deliver a better experience to your users. However, I think there is another angle to this, in particular; Code Rot.
tags: security infosec web webapps
RSA Conference: RSA Conference Blog: RSA Conference 2011 Cool Links
tags: rsac infosec security
Portable C Compiler 1.0 Branched!
Thanks to the hard work of Anders "Ragge" Magnusson and his team plus the help of donors from around the world, the Portable C Compiler is now ready for final beta testing in preparation for its 1.0 release.
tags: compilers pcc opensource
Android Developers Blog: Final Android 3.0 Platform and Updated SDK Tools
We are pleased to announce that the full SDK for Android 3.0 is now available to developers. The APIs are final, and you can now develop apps targeting this new platform and publish them to Android Market. The new API level is 11.
tags: google android sdk softwares programming

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/19/2011 - 02/22/2011

2011-02-23T00:24:00.002+01:00

Free iPhone and iPad risk management app
Citicus MoCA is a new, free risk management application for the iPhone, iPad or iPod touch. It provides a simple way for decision-makers to identify the business impact of their organization's assets and processes being disrupted.
tags: risk management iphone softwares
Site to highlight social networks' security soft spots • The Register
Security researchers have set up a site designed to prod social networking websites into practising what they preach about web security.
tags: security infosec web social media
ipTrust Partners With IBM Managed Security Services to Deliver Advanced IP Reputation Intelligence
SAN FRANCISCO, CA and ATLANTA, GA--(Marketwire - February 15, 2011) - RSA Conference, Booth # 2754 -- ipTrust, a leading provider of security intelligence as a service, is announcing a partnership with IBM to integrate ipTrust's reputation analytics into IBM Managed Security Services.
tags: security ibm iptrust mss analytics partnership
Meeting notes from the First Belgian IPv6 Council - IPv6 Council - Belgium
First Meeting of IPv6 Council Location:UCL Campus of Woluwe-St-Lambert Date: 16 of February 2011.
tags: ipv6 networking belgium

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/15/2011

2011-02-16T02:26:00.000+01:00

IBM Launches New Appliance to Extend Enterprise Security -- SAN FRANCISCO, Feb. 15, 2011 /PRNewswire/ --
SAN FRANCISCO, Feb. 15, 2011 /PRNewswire/ -- In an effort to help clients proactively identify and prevent potential threats to their organization, IBM (NYSE: IBM) today at the RSA Conference introduced the industry's fastest and most comprehensive network security appliance.
tags: ibm x-force security appliances proventia networking
Android Gmail App: Stealing Emails via XSS « Spare Clock Cycles
This post documents an XSS vulnerability that I discovered in the default Gmail app (v1.3) provided by Google in Android 2.1 and prior.
tags: android mobile google security xss vulnerability gmail

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/14/2011

2011-02-14T22:17:00.001+01:00

IronBee: Creating an open source web application firewall
Qualys announced IronBee, a new open source project to provide the next-generation of web application firewall (WAF) technology.
tags: qualys ironbee waf security firewall softwares
RSA 2011 To Go? There’s An App For That | Liquidmatrix Security Digest
This year at RSA 2011 the conference has made things a little easier. Rather than lugging around a large printed schedule (which they still provide) they now have an app.
tags: rsac conferences mobile softwares iphone

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/10/2011

2011-02-10T23:40:00.001+01:00

Set Up Google's Two-Step Verification Now for Seriously Enhanced Security for Your Google Account
Google just launched two-step verification for all Google accounts, a system which makes your Google/Gmail account—the account possibly containing the lion's share of your private communication online—considerably more secure.
tags: google gmail web privacy security
Social engineering: 3 examples of human hacking - CSO Online - Security and Risk
Chris Hadnagy gets paid to fool people, and he's gotten pretty good at it over the years. A co-founder of social-engineering.org and author of Social Engineering: The Art of Human Hacking, Hadnagy has been using manipulation tactics for more than a decade to show clients how criminals get inside information.
tags: infosec security social engineering

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/09/2011

2011-02-09T22:01:00.002+01:00

HP makes Google Android look even more creaky (and RIM, Nokia, Microsoft not in the game) — Scobleizer
Short? HP has a winner that other players MUST consider now.
tags: tablets hardware hp apple google android
The Honeynet Project Releases New Tool: PhoneyC | The Honeynet Project
Here is another new release from the Project: a release of a new tool called PhoneyC, a virtual client honeypot.
tags: honeypots virtualization security infosec python
Restrict USB Autorun: Update for Windows (KB971029) - F-Secure Weblog : News from the Lab
It's an "important, non-security update" that restricts "AutoRun entries in the AutoPlay dialog to only CD and DVD drives".
tags: microsoft windows malware security infosec
Python tools for penetration testers | Secondary Logic – There is always a theory !!!
If you are involved in vulnerability research, reverse engineering or penetration testing, I suggest to try out the Python programming language. It has a rich set of useful libraries and programs. This page lists some of them.
tags: pentesting python softwares security infosec
bluepot - Project Hosting on Google Code
Bluepot is a Bluetooth Honeypot written in Java, it runs on Linux.
tags: bluetooth bluepot honeypots security infosec linux
Google invests in anti-malware start-up | ZDNet
The venture capital arm of web search giant Google has joined the latest round of funding for Dasient, a Web security start-up founded by a pair of ex-Googlers.
tags: malware infosec security google dasient

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/08/2011

2011-02-08T22:56:00.002+01:00

The 6 Crappiest Interview Questions - The Oatmeal
tags: comics interview jobs
Safer Internet Day - Insafe
Safer Internet Day is organised by Insafe each year in February to promote safer and more responsible use of online technology and mobile phones, especially amongst children and young people across the world.
tags: internet security infosec privacy mobile

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/07/2011

2011-02-07T22:29:00.001+01:00

IPv6 Council warns: Belgium lagging behind in move to IPv6 - IPv6 Council - Belgium
Despite a large penetration of the Internet in Belgium, measurements performed within the the IPv6 Council of Belgium, a non-profit non-Governmental organization www.ipv6council.be, indicate that Belgium is behind many other countries for the IPv6 Internet.
tags: ipv4 ipv6 belgium networking
Guidelines for the Secure Deployment of IPv6
Recommendations of the National Institute of Standards and Technology
tags: ipv6 nist networking publications

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/04/2011

2011-02-04T21:32:00.002+01:00

New Android Market web store could open backdoor for phone hackers | Naked Security
If you are follow the Google Android operating system scene, you will probably have heard about the new, web based Android Market store which was launched a few days ago.
tags: google android mobile hacking softwares
The forgotten tale of IPv5
With everyone talking about the pressing need to switch from IPv4 to IPv6, few people ask what should be an obvious question: what about IPv5?
tags: ipv4 ipv5 ipv6 networking history
YouTube - ShmooCon 2011: Hackers for Charity
tags: hackers for charity uganda shmoocon video johnny long
Free Pool of IPv4 Address Space Depleted | The Number Resource Organization
Montevideo, 3 February 2011 – The Number Resource Organization (NRO) announced today that the free pool of available IPv4 addresses is now fully depleted.
tags: networking ipv4 ipv6 history

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/03/2011

2011-02-04T12:01:00.002+01:00

TippingPoint | DVLabs | Announcing Pwn2Own 2011
It's that time of year again and the Zero Day Initiative (ZDI) team here at HP TippingPoint is proud to announce the 5th annual Pwn2Own competition is back.
tags: tippingpoint dvlabs zdi pwn2own browser mobile

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/02/2011

2011-02-02T22:22:00.002+01:00

Accepting Mistakes Reduces Their Frequency – flyingpenguin
Many years ago when I was Director of IT and Security at a very large enterprise I was fond of saying “fail faster” to my staff. I wanted them to feel comfortable with the idea that they should focus on always improving. The CIO was not fond of this and constantly asked me why a Director of Security, of all people, would encourage failure?
tags: security
w3af - Web Application Attack and Audit Framework
w3af is a Web Application Attack and Audit Framework. The project's goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.
tags: w3af webapps framework pentesting security infosec
IBM Provides for the Cloud and Smart Phones - Unified Communications Strategies
IBM has announced a new initiative, designed to provide organizations with a broad support for smart phones and cloud delivery models.
tags: ibm cloud mobile social media

Posted from Diigo. The rest of my favorite links are here.

Daily links for 02/01/2011

2011-02-01T22:06:00.001+01:00

Tenable Network Security: Shmoocon 2011 Conference Wrap-Up
Getting to ShmooCon each year is always challenging (as is trying to get home). Mother Nature seems to enjoy disrupting the travel to and from the conference, which is held in Washington, D.C in January or February of each year. Despite the weather issues, I've always found it to be a conference worth attending.
tags: hacking infosec shmoocon conferences security
Official Google Blog: Check in with Google Latitude
We first introduced Google Latitude to help you stay in touch with your friends and family by making it easy to share where you are. For the 10 million people actively using Latitude each month, this “where” has been a location on a map. Starting today in Google Maps 5.1 for Android, you can also connect that location to a real place by checking in there using Latitude.
tags: google google latitude lbs mobile foursquare
Demystifying Mentoring - Amy Gallo - Best Practices - Harvard Business Review
When people think of mentoring, they often think of an older executive counseling a young upstart. The senior leader advises the junior employee on his career, how to navigate the world of work, and what he needs to do to get ahead. But mentoring has changed a lot in the last few decades.
tags: communication mentoring career

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/31/2011

2011-02-01T09:46:00.001+01:00

Stop Cross-Site Scripting Errors Now: Veracode Launches Free Detection Service | Business Wire
Cross-site scripting (XSS) errors are responsible for more than half of all web application vulnerabilities1. So, in this age of accountability and expectations for secure, high quality software, what’s being done about it?
tags: security web webapps xss infosec
SourceForge applies global password reset after hack attack • The Register
Open-source code repository SourceForge has advised users to change their passwords following a concerted hacking attack.
tags: sourceforge security privacy infosec opensource
How Apple and Google will kill the password - Computerworld
Imagine sitting down at a public PC, surfing the Web, visiting Facebook, checking your online bank account and buying something on Amazon.com -- all without entering passwords or credit card information.
tags: apple google mobile phone privacy web

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/28/2011

2011-01-29T10:26:00.002+01:00

Want to Track People? There's an App for That - Technology Review
More than half of all iPhone apps collect and share a unique code that could be used to track users without their knowledge, according to a recent study.
tags: iphone ios apple privacy softwares infosec
Loic Le Meur Blog: 7 digital trends at Davos 2011 [World Economic Forum talk]
It's my 9th Davos in a row and I am lucky to be invited to speak twice this year, I'm giving a talk on future trends "digital convergence" in David Kirkpatrick's session and I moderate my own dinner on "social networking addiction" tonight
tags: davos web social media social networking
SourceForge.net Attack Update « SourceForge.net: Project sourceforge
As we mentioned yesterday, we have discovered that sourceforge.net was attacked and several servers were compromised.
tags: security hacking opensource sourceforge

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/27/2011

2011-01-27T23:41:00.001+01:00

Android 3.0 tablet: Five key features
Tablet application developers can rejoice now that Google has released its software development kit for Android 3.0, the new edition of the platform designed specifically for tablets.
tags: google android mobile tablets hardware
Google has forked Android | ZDNet
The last thing I wanted to see was Android to split into two “official” versions. Well, guess what, for all intents and purposes that’s what’s happened. Ack!
tags: google android mobile softwares

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/26/2011

2011-01-26T21:52:00.001+01:00

Peep show: inside the world of unsecured IP security cameras
If you’re in public, you’re on camera. If you walk into a coffee shop, the owner gets you at the register. Visit a larger store, and chances are they have your face as soon as you cross the threshold. At least one or two of your neighbors catch you on camera when you walk around your neighborhood, and many cities monitor traffic using red light cameras at major intersections.
tags: security privacy infosec
YouTube - The Day The Routers Died...
The Day The Routers Died... a song performed by the secret-wg in the closing plenary of the RIPE 55 conference
tags: video ipv6 networking
Man knows when you're signed in to GMail, Twitter, Digg • The Register
A UK-based web developer has figured out a simple way to tell if visitors to his site are logged in to Gmail, Facebook, Twitter, Digg and thousands of other websites.
tags: infosec security privacy web

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/25/2011

2011-01-26T21:51:00.001+01:00

Combating Conficker: What Worked, What Didn't - Darkreading
Postmortem report looks at lessons learned from the Conficker Working Group's efforts to keep potentially massive and damaging botnet at bay
tags: infosec conficker malware security

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/24/2011

2011-01-24T22:18:00.002+01:00

Anton Chuvakin Blog - "Security Warrior": Bottom 11 Log Management "Worst Practices"
Many organizations talk about “best practices” for security, log management, SIEM, etc. The definition of such practice is often fuzzy (and overrun by marketing influences…) but can be loosely related to what leaders in the field are doing today and what practices generally lead to great results. Following the same model, we can create a definition of a “worst practice”
tags: infosec security siem log management
Greg Avola Talks about Untappd - Crafted
Untappd, the popular mobile web app that allows beer drinkers to record and share information about the beers they’re drinking and where they’re drinking them, has gained the attention of many in the beer community. The app recently hit a milestone, surpassing 10,000 registered users in the Untappd community. And if you drink beer and pay attention to social media, chances are, you’ve probably heard of Untappd, if you’re not using it already.
tags: beers social media untappd
Security and Tech: Security Issue Exposed by Android AccountManager
It is a painful experience for users to repeatedly enter their credentials on small devices, such as mobile phones. Because of password strength requirements from individual service providers, the combination of upper-lower-case letters, digits and special symbols, makes sign-in on smart phones a very unpleasant process.
tags: android google mobile privacy
Troy Hunt: SSL is not about encryption
It’s about assurance. It’s about establishing a degree of trust in a site’s legitimacy that’s sufficient for you to confidently transmit and receive data with the knowledge that it’s reaching its intended destination without being intercepted or manipulated in the process.
tags: security web browser ssl

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/22/2011

2011-01-24T11:25:00.001+01:00

lcamtuf's blog: CSP, HTML5, and the aesthetics of security
Modern browsers are incredibly complex beasts, pushed well beyond their intended limits - and in that capacity, broken in more ways than we can imagine. We are only beginning to scratch the surface of all the design problems ahead of us - say, new and unexpected classes of UI vulnerabilities - but even within the bounds of what we understand and know how to fix, some fascinating and very human discourse patterns emerge... and will ultimately shape the future of the web.
tags: infosec security web browser html5
Trustwave's Global Security Report 2011: Web Application Risks - SpiderLabs Anterior
While there is a ton of great data within the GSR 2011 report, for this blog post, I wanted to focus a bit of attention to the web application sections of the report.
tags: infosec security web webapps pentesting report
Ready for Cyberwar? — Krebs on Security
Security vendor Imperva today blogged about a hacker who claims to have access to and control over several top dot-gov, dot-mil and dot-edu Web sites. I’ve seen some of the back-end evidence of his hacks, so it doesn’t seem like he’s making this up.
tags: infosec security hack web

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/21/2011

2011-01-21T23:07:00.000+01:00

IBM100 - Welcome to IBM100
In 2011, IBM reflects on 100 years of innovation, bold risks and transformative breakthroughs. We celebrate the big wins—and the mistakes we've overcome. We renew our purpose, unite in our legacy and define our aspirations for the future.
tags: ibm innovations

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/20/2011

2011-01-20T22:22:00.001+01:00

New Twitter worm redirects to Fake AV - Securelist
A new Twitter worm is spreading fast, using the “goo.gl” URL shortening service to distribute malicious links.
tags: twitter virus worm security
Android handset used for USB hack attack | THINQ.co.uk
Two researchers have discovered a way of compromising pretty much any computer using nothing more nefarious than an Android handset and a USB cable.
tags: android mobile security malware virus
Upcoming BSD/BSDA Events
Looks like the first half of 2011 will be pretty busy. Here are the events that have been confirmed so far:
tags: bsd conferences
Researchers’ Android Trojan Can “Hear” Credit Card Numbers - Andy Greenberg - The Firewall - Forbes
Smartphones running Android try to prevent the sort of viruses and Trojans that plague PCs by carefully walling off which of the phones’ features and data applications can access. But one team of researchers has demonstrated that a clever piece of malware can listen through the walls–literally.
tags: security mobile android google virus malware

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/19/2011

2011-01-19T22:42:00.000+01:00

Google's Niels Provos battles malware on the Web | InSecurity Complex - CNET News
During 2000 and 2001, Ph.D. student Niels Provos would occasionally drive from the University of Michigan across the border into Canada and spend the weekend working on an open-source cryptography project that would end up becoming one of the most widely used network security technologies ever: OpenSSH.
tags: security infosec malware google niels provos
Metasploit: Mobile Device Security and Android File Disclosure
Back in November, Thomas Cannon brought to light an issue within the Android operating system. Specifically, he found that it was possible to obtain the contents of files on an Android device by simply persuading its owner to visit a web site under attacker control. The issue only garners a 3.5 CVSS score, but yet it’s still fairly serious.
tags: security metasploit google android mobile
Troy Hunt: Who’s who of bad password practices – banks, airlines and more
Ah, passwords. Love ‘em or hate ‘em, they’re a necessary evil of the digital age. The reality is we all end up with an alphabet soup of passwords spread over dozens of various sites and services across the internet. Whilst we might not always practice it, we all know the theory of creating a good password; uniqueness, randomness and length. The more of each, the better.
tags: infosec privacy security web

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/18/2011

2011-01-18T22:16:00.001+01:00

Quickpost: Checking ASLR « Didier Stevens
Some people asked me for a simple way to check shell extensions for their ASLR support. You can do this with Process Explorer.
tags: infosec windows vulnerability hacking
Jeremiah Grossman: Top Ten Web Hacking Techniques of 2010 (Official)
Every year the Web security community produces a stunning amount of new hacking techniques published in various white papers, blog posts, magazine articles, mailing list emails, etc. Within the thousands of pages are the latest ways to attack websites, Web browsers, Web proxies, and so on. Beyond individual vulnerability instances with CVE numbers or system compromises, we're talking about actual new and creative methods of Web-based attack.
tags: infosec security web webapps hacking

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/14/2011

2011-01-17T09:30:00.001+01:00

Ask a Pentester
Welcome to Ask A Pentester, where you can get your security questions answered by members of the IT Security community!
tags: infosec security pentesting
TippingPoint | DVLabs | Year in Review: 2010
2010 was a record year for the DVLabs team here at TippingPoint. The Zero Day Initiative hit an all-time personal and industry record of 300 vulnerabilities fixed through the program (triple the number for 2009).
tags: infosec security tippingpoint zdi
Frequency X Blog
Over the Christmas holiday season – starting December, 25th, 2010 – there was a steep world-wide decline of spam volume. We were not the only ones who recognized this significant drop. However, since Monday, January 10th, 2011, spam levels reached nearly the old volume seen before Christmas.
tags: ibm x-force security spam infosec

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/13/2011

2011-01-13T22:03:00.001+01:00

IBM's Database Security Strategy: A Closer Look - Darkreading
Today’s largest enterprises still rely on one of the industry’s oldest and most established databases to store their most sensitive and business-critical data. DB2 has traditionally been at the heart of the data center, literally and figuratively.
tags: ibm security database
Lenny Zeltser on Information Security — Quora Essentials for Information Security Professionals
If you haven’t taken a close look at Quora yet, you should. All signs point to it becoming the next mighty social network, joining the ranks of Twitter, LinkedIn and Facebook. Quora is a platform for asking and answering questions. But its social networking features make it more powerful and engaging than StackExchange. And its focus on Q&A make it more elegant than similar features built into LinkedIn and Facebook.
tags: infosec quora social media

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/12/2011

2011-01-12T22:14:00.000+01:00

Detecting Malice with ModSecurity: CSRF Attacks - SpiderLabs Anterior
This week's installment of Detecting Malice with ModSecurity will discuss how to detect and prevent Cross-Site Request Forgery (CSRF) Attacks.
tags: modsecurity security webapps waf firewall

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/11/2011

2011-01-11T21:58:00.000+01:00

Dive Into HTML5
Dive Into HTML5 seeks to elaborate on a hand-picked Selection of features from the HTML5 specification and other fine Standards. The final manuscript has been published on paper by O’Reilly, under the Google Press imprint.
tags: html5 books web programming
0-day Clothing | T-Shirts for hackers, engineers and geeks
Welcome, total stranger, to 0-day Clothing, the only online T-shirt store for hackers, engineers and geeks that is run by hackers, engineers and geeks.
tags: clothing geek
The Ashimmy Blog: And the winners are ..
It is that time of year again! Starting today voting is open for the 3rd annual Social Security Blogger Awards.
tags: security blogs
Off-the-Record Messaging
tags: security privacy softwares encryption

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/10/2011

2011-01-10T21:21:00.001+01:00

Computers, Privacy & Data Protection
CPDP 2011 - Computers, Privacy and Data Protection is a three-day conference organised by academics from all over Europe, which has the ambition of becoming Europe’s most important forum for academics, practitioners, policymakers and activists.
tags: security privacy conferences
torchat - Project Hosting on Google Code
TorChat is a peer to peer instant messenger with a completely decentralized design, built on top of Tor's location hidden services, giving you extremely strong anonymity while being very easy to use without the need to install or configure anything.
tags: security privacy tor softwares

Posted from Diigo. The rest of my favorite links are here.

Sync Birthdays Between Your Google Account and Your Android Native Calendar App

2011-01-08T12:33:00.004+01:00

While the sync between my HTC Magic (running Android Eclair - 2.1) and my Google Mail account works as expected, by default I was missing my contacts' birthdays information. To fix this somewhat-lack-of-default-support annoyance, I had to:

Go to my Google Calendar Settings
Browse interesting calendars
Select the More tab
Subscribe to Contacts' birthdays and events
Sync mobile handheld with Google Mail account

Although this does what I wanted, I'm still looking to enable automatic reminders for birthdays. If anyone's got any tips to easily enable that in the native calendar app, shoot me an e-mail. Thanks.

Daily links for 01/07/2011

2011-01-07T23:00:00.001+01:00

Mac App Store – hacks lead to piracy now, malware later? | Naked Security
As my colleague Rich Baldry pointed out earlier, Apple officially launched the Mac App Store today with their release of OS X 10.6.6. The App Store provides undeniable benefits to users who wish to easily find new programs and reduce the number of companies they share their credit card details with.
tags: apple macintosh macosx malware
Trend Micro Launches Mobile Security for Android | Information Security News, IT Security News & Expert Insights: SecurityWeek.Com
Trend Micro today announced Trend Micro™ Mobile Security, new software designed to help protect Android-powered mobile devices against cyber-attacks.
tags: android mobile security malware trendmicro
A Person of the Year: Sam Palmisano - Forbes.com
Sam Palmisano is the president and chief executive officer of IBM. In leading the company to operational excellence, he placed India at the centre of its global services.
tags: ibm ceo
How Not to Store Passwords in iOS
I was looking for an open source iOS application and quickly came across the WordPress app. Once you log in to your WordPress blog via the app your credentials are then stored on the device itself.
tags: apple iphone ios softwares security

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/06/2011

2011-01-07T09:10:00.001+01:00

Become invisible to anti-virus protection « Rapid7 Network Security Blog

"Wouldn’t it be fantastic to be invisible for a day? Walk straight into a bank vault in the morning, be a fly on the wall in the Oval Office for lunch, and spend an evening in your favorite movie star’s house. Well, now you can – with Metasploit!"

tags: metasploit security pentesting antivirus
Apple’s Mac App Store Opens With More Than 1,000 Apps

"Apple this morning announced that the Mac App Store is now open for business, as previously announced, with more than 1,000 free and paid apps."

tags: apple macintosh macosx softwares
Amazon to open Android App store, and it could be a game-changer | ZDNet

"From the “I really didn’t see that coming” files - Amazon is preparing to open an Android App store of its own, one that sounds a lot like Apple’s App Store."

tags: google android amazon softwares
Google versus Microsoft – handbags at dawn | Naked Security

"By some accounts, Microsoft and Google are at each other's throats over the disclosure of vulnerabilities. Summarising what seems to have happened in fewer than 100 words is a challenging exercise, but here goes:"

tags: google microsoft vulnerability full disclosure bugs
TaoSecurity: The "IT as a Business" Train Wreck

"When IT is a business, selling to its internal customers, its principal product is software that "meets requirements." This all but ensures a less-than-optimal solution, lack of business ownership, and poor acceptance of the results..."

tags: it business

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/05/2011

2011-01-05T23:28:00.001+01:00

How to set up a pentesting lab « Rapid7 Network Security Blog

"One of my biggest challenges in learning how to pentest was finding systems to test against. I heard that using your neighbors network is “frowned upon”, and hanging out in a Starbucks and pwning your fellow coffee drinkers on the public wifi raises the occasional eyebrow. So what do I do? Build a test environment. "

tags: rapid7 pentesting security
Asus Unveils Android Tablets at CES 2011 | Android Development Talk

"At the CES 2011 conference, Asus showcased its new Android Tablets . The interesting part is that the newly launched Android tablets features a physical keyboard."

tags: asus google android tablets
ModSecurity Advanced Topic of the Week: Credit Card Tracking - SpiderLabs Anterior

"The just released CRS v2.1.0 includes Credit Card Tracking rules. These will both track legitimate credit card usage and also prevent full credit card number leakages. Much of the following data was taken from a previous blog post by Ofer Shezaf however many sections have been updated with current ModSecurity and CRS information."

tags: modsecurity firewall waf security infosec
TaoSecurity: TaoSecurity Lab

"In a recent blog comment one of you asked about TaoSecurity lab. This is a collection of my own gear -- nothing associated with my corporate employer. I decided to post the diagram at left in case someone found it useful. "

tags: networking hardware

Posted from Diigo. The rest of my favorite links are here.

IBM X-Force Videos on Security Trending Topics

2011-01-05T15:01:00.007+01:00

Today I came across a few small videos recently posted in IBM Security Solutions YouTube Channel. Those videos were recorded by some of the IBM X-Force researchers on various trending topics, i.e., Malware, SEO, Browser Attacks, ... I have listed a few of them below but make sure you check & subscribe to the YouTube Channel for more bits.

Social Engineering Attacks, by Jon Larimer (@shydemeanor) http://youtu.be/hBr5u9A_bPw
Web Browser Attacks, by Robert Freeman http://youtu.be/-PSsPxAGoiQ
SEO Attacks, by Michelle Alvarez http://youtu.be/QHa51b6UptI
Protocol Analysis Module (PAM), by Clinton McFadden http://youtu.be/Xb5lH-z8YkU

IBM X-Force website: http://www.ibm.com/security/x-force

Daily links for 01/04/2011

2011-01-04T22:30:00.001+01:00

ASA 8.3 Upgrade - What You Need to Know - Cisco Support Community

tags: cisco firewall security hardware softwares
List of Portable Hardware Devices for Penetration Testing! — PenTestIT

"We have done many List’s of before this post. To name a few – List of FREE VPN Providers!, List of Cell Phone Forensic tools! and List of TOP LiveCD’s for Penetration Testers!. But, nothing like the one we are doing today."

tags: security infosec pentesting hardware
Ladies of Craft Beer | Women Teaching Women About Craft Beer

Women Teaching Women About Craft Beer

tags: beers

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/03/2011

2011-01-03T21:47:00.001+01:00

VRT: (Successfully) Building Shared Object Rules (and Snort) under OpenBSD

"Here at the VRT, we have been adding support for more platforms and operating systems for shared object rules in the VRT Certified rule packs. Recently we started work on building shared object rules for Snort under OpenBSD. We ran into problems. After careful investigation, I have found the cause of the problem and can now present a fix for it. The following has been successfully tested under OpenBSD 4.8 on the amd64 platform."

tags: openbsd snort ids unix
TaoSecurity: Starting the New Year Right

"Today's a company holiday (odd, but ok), so I figured what better way to start the New Year than to see if my Commodore 64 still works? I bought it in mid-1986, so it's almost 25 years old, and it's been over seven years since I posted My C-64 Rides Again. Since then the monitor I used with my C-64 died, but my dad shipped me his old RBG monitor."

tags: c64 commodore hardware
Craft Beer Reviews With Lee Williams

tags: beers
Penetration Testing Rapidly Becoming Obsolete | carnal0wnage.attackresearch.com

"Yesterday I made a tweet stating that pen testing and pen testers are obsolete. Here's what I mean by that. Originally, pen testing was a simulation of what real attackers would do. Then it became more about validating vuln scan/assessment results. Now its essentially about compliance check boxing. (PCI)"

tags: security pentesting infosec
IBM Plays Jeopardy! - Forbes.com

"Watson, IBM's Jeopardy!-playing supercomputer, is going to make a massively parallel impact on an unsuspecting world in February, when the powerful Q&A machine goes up against the two greatest Jeopardy! champions of all time, Ken Jennings and Brad Rutter, on national television."

tags: ibm jeopardy technology
PSFK » Rio De Janeiro Partners With IBM To Build A Smarter City

"In it’s bid to be the dominant platform in the emerging Smart City market, IBM has announced a partnership with Eduardo Paes, the mayor of Rio de Janeiro, to build a “Single City Operations Center” that would allow the mayor to monitor, command, & forecast critical events across the city. "

tags: ibm smarterplanet smartercities

Posted from Diigo. The rest of my favorite links are here.

Daily links for 01/01/2011

2011-01-01T23:58:00.000+01:00

TaoSecurity: Best Book Bejtlich Read in 2010

"It's the end of the year, which means it's time to name the winner of the Best Book Bejtlich Read award for 2010! "

tags: infosec security books
lcamtuf's blog: Announcing cross_fuzz, a potential 0-day in circulation, and more

" am happy to announce the availability of cross_fuzz - an amazingly effective but notoriously annoying cross-document DOM binding fuzzer that helped identify about one hundred bugs in all browsers on the market - many of said bugs exploitable - and is still finding more. "

tags: browser security fuzzing

Posted from Diigo. The rest of my favorite links are here.

Daily links for 12/31/2010

2011-01-01T10:22:00.001+01:00

Android SMS bug sends your messages to random contacts | ZDNet

"The Android bug relates to SMS messages, specifically SMS messages being composed with one recipient in mind and actually being set to a completely different person in the contacts list …"

tags: google android mobile
Podcasts for Cyber Security Professionals

tags: security infosec podcast
Home Internet with Anonymity Built In - Technology Review

"A router that runs the Tor software prevents Web tracking."

tags: infosec tor privacy security networking
Chinese bot will slurp your Droid • The Register

"A Trojan capable of stealing data from infected Android smartphones, and bundled with botnet-style functionality, has appeared in China."

tags: google android mobile malware security infosec
Android malware enters 2011

"One thing a lot of security researchers have been predicting for years is rise in mobile malware. However, due to mobile phones with low power, a lot of operating systems, closed environments and many other reasons we haven’t seen any significant mobile malware until this year. And just in time for 2011 a new trojan for Android has been found by a company called Lookout. While Android trojans have been very popular, this one was pretty advanced and that is why it caught everyone’s attention."

tags: google mobile android malware security infosec
NSS Labs: Network Intrusion Prevention Group Test Released

"The security analysts at NSS Labs tested 13 different network IPS products, including stand-alone IPS and multi-function gateways, and one unified threat management product. "

tags: networking security ips ibm

Posted from Diigo. The rest of my favorite links are here.

Daily links for 12/30/2010

2010-12-30T23:05:00.000+01:00

Geek Time with Chris DiBona - Google Open Source Blog

"The end of the year is always a great time to take a moment and look back at the developments of the past twelve months. Two members of the Google Open Source Programs Office, Chris DiBona and Jeremy Allison, sat down together for a review of open source accomplishments in 2010"

tags: google opensource softwares

Posted from Diigo. The rest of my favorite links are here.

Daily links for 12/28/2010

2010-12-28T22:44:00.000+01:00

TaoSecurity: FreeBSD on Amazon EC2

"Thanks to Colin Percival you can try FreeBSD on Amazon EC2! According to Colin's blog more is to come, but for now you can try FreeBSD 8.2-RC1 and FreeBSD 9.0-CURRENT. "

tags: freebsd amazon cloud
Securosis Blog | Web Application Firewalls Really Work

"The end result was that WAFs do have value when used properly, and may provide value beyond pure security, but aren't a panacea. Since you could say that about the value of a gerbil for defending against APT too, here's a little more detail..."

tags: security webapps waf firewall pentesting
Windows 7 and 2008 R2 IIS FTP Telnet IAC Remote DoS PoC Tutorial

"The vulnerability occurs when the FTP server attempts to encode Telnet IAC (Interpret As Command) character in the FTP response. "

tags: security hacking exploit windows video
IBM Press room - 2010-12-27 IBM Reveals Five Innovations That Will Change Our Lives in the Next Five Years - United States

"Today IBM (NYSE: IBM) formally unveiled the fifth annual "Next Five in Five" – a list of innovations that have the potential to change the way people work, live and play over the next five years: • You'll beam up your friends in 3-D • Batteries will breathe air to power our devices • You won’t need to be a scientist to save the planet • Your commute will be personalized • Computers will help energize your city"

tags: ibm innovations technology
Python Shell - Google Chrome extension gallery

"An online Python shell for your Chrome browser. "

tags: google chrome browser python shell programming
Mozilla accidentally publishes user IDs and passwords | Naked Security

"On Monday, Mozilla, the developer of popular open source applications like Firefox and Thunderbird, announced that a database containing usernames and password hashes belonging to users of addons.mozilla.org had been posted publicly by accident."

tags: security privacy mozilla

Posted from Diigo. The rest of my favorite links are here.

Daily links for 12/27/2010

2010-12-27T22:43:00.001+01:00

64 New APIs: Real-time Facebook, Twitter Streaming and Google Shopping

"This week we had 64 new APIs added to our API directory including a visual CAPTCHA service, genealogy service, user profile service, sentiment analysis for twitter service and cloud storage service. We also covered two of these APIs with full blog posts. We looked into iFixIt, the World’s First Fix-it API and deadpooled Google Base when it was axed in favor of two new shopping APIs. Below is more detail on all 64 of these new APIs. "

tags: web webapps programming softwares api
OWASP Secure Coding Practices Quick Reference Guide (PDF File)

"This technology agnostic document defines a set of general software security coding practices, in a checklist format, that can be integrated into the software development lifecycle. Implementation of these practices will mitigate most common software vulnerabilities."

tags: security coding owasp softwares
Social Spam Q&A - F-Secure Weblog : News from the Lab

"Q: What is "social spam"? A: Social spam is spam that uses social networking, media and news related websites to spread links."

tags: security social media spam
The 10 Most Destructive Hacker Attacks In The Past 25 Years

"From a computer virus named for a stripper to swarming botnet attacks on the Pentagon and Microsoft, The Daily Beast lists the 10 most infamous hacks, worms, and DDoS takedowns in the last 25 years."

tags: security hacking malware

Posted from Diigo. The rest of my favorite links are here.

Daily links for 12/26/2010

2010-12-26T21:53:00.000+01:00

live-android - Project Hosting on Google Code

"LiveAndroid, a LiveCD for Android running on x86 platforms. Want to give Google Android a try, but don't feel like buying a T-Mobile G1/G2/G3? LiveAndroid lets you download a LiveCD disc image of the Google Android operating system. Just burn the image to a disc, stick it in a CD-ROM drive, and reboot your computer and you can check out Android without installing it or affecting any files on your PC. "

tags: google android mobile virtualization
kod: CSS3 themable, Node.js powered editor for OS X - The Changelog - Open Source moves fast. Keep up.

"It’s a very Merry Christmas for Mac developers. Rasmus Andersson has open sourced Kod, the “programmers’ editor for OS X.”"

tags: macosx softwares editors
wavsep - Project Hosting on Google Code

"A web application that contains a collection of unique vulnerable pages designed to help assessing the features, quality and accuracy of web application vulnerability scanners. "

tags: security vulnerability management webapps softwares
Security Tools Benchmarking: Web Application Scanner Benchmark (v1.0)

"Comparison & Assessment of 43 Free & Open Source Black Box Web Application Vulnerability Scanners"

tags: security vulnerability management webapps
Detecting Google Hacks Against Your Website

"Google or other search engines have been used for many purposes such as finding useful information, important websites and latest news on different topics. Google's index has a huge number of web pages and is growing daily. From the security prospective these indexed pages may contain a lot of sensitive information. "

tags: google web security
YouTube - Beers Filling Up Through the Bottom!

tags: video beers
Suspekt… » Blog Archive » Improving the ASLR of Mac OS X Snow Leopard

"Last week I presented my research about “Adding ASLR to jailbroken iPhones” at the Power of Community 2010 (POC2010) security conference in Seoul. During my talk I explained how one can use a modified ‘rebase’ utility to rebase the dynamic linker dyld on the iPhone. Rebasing dyld is important because it contains enough code gadgets that can be used to kickstart arbitrary shellcode on jailbroken iPhones. A tool called Antid0te will be released until the end of this year that allows normal users to add ASLR to their iPhones."

tags: hacking apple macosx security

Posted from Diigo. The rest of my favorite links are here.

Daily links for 12/25/2010

2010-12-25T21:25:00.001+01:00

Owned and Exposed - Exploit Database

"There’s nothing like having your butt kicked Christmas morning, which is exactly what happened to us today. We were owned and exposed, in true fashion."

tags: hacking security
Attack code posted for new IE zero-day vulnerability | ZDNet

"Exploit code for the vulnerability has been added to the Metasploit tool and a video has been posted to provide a demo of the severity."

tags: hacking browser metasploit security exploit
Some Google employees defect, then rebel - CNN.com

"Brian Kennish traded his job at Google for a table at Starbucks, where he works on his privacy software called Disconnect."

tags: google privacy browser
OpenBSD 4.8-current on a midrange laptop: Dell Studio 15

"Ian Darwin (ian@) writes in with a story he did together with Holger Mikolon about their efforts to get OpenBSD running on new hardware."

tags: openbsd

Posted from Diigo. The rest of my favorite links are here.

Daily links for 12/24/2010

2010-12-25T13:14:00.000+01:00

The Beer Mapping Project

"beermapping.com is a project by someone who likes knowing exactly where he is and how far he needs to go for good beer."

tags: beers
HP, IBM, VMware Rank Highest For Configuration Management Tools - Network Computing

"An industry analysis released this month rates Hewlett-Packard, IBM and VMware as "value leaders" for configuration management tools that can identify software applications running on a network and the impact of network configuration changes that will affect how those applications run."

tags: ibm networking
[Round Table] What are your security predictions for 2011? : netsec

"As every year comes to an end you'll find lots of security bloggers posting up lists of their 2011 security predictions. I'd like to hear what major developments /r/netsec thinks will occur in the field of information security over the course of the next year. If you've already posted your thoughts on a personal or work blog, feel free to link to it in the comments; but please include a short summary. If this takes off, we'll revisit it in December 2011 to see who's predictions played out. If you've been lurking but haven't commented yet, this is a great opportunity for you to start!"

tags: security infosec
OpenBSD Project Finds Two Bugs In Software's IPsec Implementation - Darkreading

"OpenBSD Project Finds Two Bugs In Software's IPsec Implementation"

tags: openbsd

Posted from Diigo. The rest of my favorite links are here.