Archive: 2012
TrueCrypt review
Posted by David Balaban on December 31, 2012
Free
TrueCrypt 7.1a effectively secures sensitive data by utilizing military-grade crypto algorithms.
Usability: Features: Efficiency: Support: Overall:
Download
TrueCrypt 7.1a is one of the simplest, best organized and most efficient encryption utilities we have come...
VX – The Virus Underground 6: Hoaxes, Social Engineering and Cryptography
Posted by david b. on December 30, 2012
At the end of the Q&A part, SkyOut touches upon VXer’s attitude to hoaxes, cryptography, and the blurred line between the legal and illegal in their activity.
QUESTIONS?
– You mentioned hoaxes. You say you do viruses and you don’t want to harm anybody, but to prove that hoaxes work you need to...
avast! Free Antivirus 2015 review
Posted by David Balaban on December 29, 2012
Free
avast! Free Antivirus 2015 is light on the system, remarkably easy to use, and fairly effective in malware protection.
Usability: Features: Efficiency: Support: Overall:
Download
Quick setup, comprehensive controls, commendable speediness, decent feature set, and...
VX – The Virus Underground 5: Discussing Interaction with Antivirus Companies
Posted by david b. on December 28, 2012
SkyOut now invites 24C3 conference attendees to participate in a more down-to-earth discussion which starts with insight into relation between AVs and VXers.
QUESTIONS?
Ok, we have a lot of time, so we can have a little discussion if you want.
– So, first question would be: in the beginning and the end...
VX – The Virus Underground 4: Problems of the VX Scene
Posted by david b. on December 27, 2012
SkyOut brings attention to the main problems of the virus underground, and summarizes the presentation’s key points with regard to the state of VX scene.
Connection between VX and AV
So what connection do we have between VX and AV: VX – virus exchangers, and AV – antivirus companies?
–...
VX – The Virus Underground 3: VXers’ Communication Channels
Posted by david b. on December 26, 2012
The subjects touched upon by Marcell Dietl in this part are types of payloads and malware out there, as well as the way VXers communicate with each other.
Types of Payloads
So, what types of payloads do we have? First of all, what’s a payload? A payload is everything else but reproduction. Reproduction is...
VX – The Virus Underground 2: Cross-Platform Malware and Virus Spreading Techniques
Posted by david b. on December 26, 2012
As part of his insider’s perspective, VXer SkyOut now focuses on the underground’s prevalent programming languages applicable for coding cross-platform malware, and highlights the common techniques used for virus distribution.
Cross-Platform Malware
So, let’s talk a bit about cross-platform malware,...
VX – The Virus Underground
Posted by david b. on December 24, 2012
The German VXer and social engineer Marcell Dietl, aka SkyOut, gives a presentation at 24C3 conference organized by Chaos Computer Club (CCC) to describe the different groups of virus coders and shed light on how they are affecting the VX scene.
Ok, what shall this speech be about? Well, it shall be an...
G Data AntiVirus review
Posted by David Balaban on December 24, 2012
$29.95
G Data AntiVirus is a streamlined and highly effective solution for everyday security provision.
Usability: Features: Efficiency: Support: Overall:
Buy Now
Not only does the motto “Security Made in Germany” being currently used in G Data product...
Owning Bad Guys and Mafia with JavaScript Botnets 5: Tips to Maintain Online Privacy
Posted by david b. on December 22, 2012
The final part of Chema Alonso’s Defcon talk comprises a demo on infecting users through the rogue proxy server, and some general security tips to follow.
I wanted to do a real demo, but first I’d like to show you the control panel and what it looks like. Of course, we turned off the proxy server on...
Owning Bad Guys and Mafia with JavaScript Botnets 4: Bypassing Anonymity
Posted by david b. on December 21, 2012
In this entry Chema Alonso continues exposing the weird, perverted, maleficent, and simply naive people whose personal data got retrieved under the research.
Of course, we discovered psychotics. This is what the control panel looks like (see image), and as you can see, this guy was searching xnxx.com for...
Owning Bad Guys and Mafia with JavaScript Botnets 3: Scammers Exposed
Posted by david b. on December 20, 2012
Chema Alonso demonstrates several hilarious findings retrieved during his research, dissecting the Nigerian, dating, and other popular scams out there.
So, the question is: who the hell uses proxy services on the Internet? How many of you are using this kind of services on the Internet? If you read related...
Microsoft Security Essentials review
Posted by David Balaban on December 20, 2012
Free
Microsoft Security Essentials does the trick for those who seek basic virus protection.
Usability: Features: Efficiency: Support: Overall:
Download
Microsoft Security Essentials was introduced in 2008 as a free antivirus solution maintaining adequate protection for...
Owning Bad Guys and Mafia with JavaScript Botnets 2: Creating a JavaScript Botnet from Scratch
Posted by david b. on December 19, 2012
Having rejected several overly complicated tactics, Chema Alonso and his colleagues came up with a fairly simple, yet effective method for making a botnet to be used in their study, which is being thoroughly described in this part of the presentation.
Another idea that we thought might work in our case is...
Owning Bad Guys and Mafia with JavaScript Botnets
Posted by david b. on December 18, 2012
Spanish computer security expert Chema Alonso gives a great talk at Defcon 20 about the ways to expose online scammers through the use of JavaScript botnets.
The title of this session is “Owning bad guys and mafia with JavaScript botnets”. I hope you will enjoy the topic.
But before I start, I...
Getting Ahead of the Security Poverty Line 8: Questions and Answers
Posted by david b. on December 17, 2012
Final part of Andy Ellis’ keynote at HITBSecConf 2012 is dedicated to answering questions from the event attendees, relating to the role of CSO in a company.
Now I’m happy to take a question or two or five from the crowd, if anybody wants them.
– Hi! My question is: often a big mistake that...
Getting Ahead of the Security Poverty Line 7: Increasing Security Value over Time
Posted by david b. on December 16, 2012
Andy Ellis elaborates here on the methods to prioritize security tasks within organizations and thus maintain high security value in the long-term perspective.
As security professionals, we have a lot on our plates, we have a lot of things to do. How many people here juggle? If you try to learn to juggle,...
Getting Ahead of the Security Poverty Line 6: Third-Party Security Reviews
Posted by david b. on December 15, 2012
This section of the keynote sheds light on common mistakes made while evaluating vendor services, and outlines the most judicious approach to this activity.
Another area we’ve recently been looking at is third-party security reviews. Everybody probably has this, certainly, in these days of outsourcing;...
Getting Ahead of the Security Poverty Line 5: Security Awareness Enhancement Practices
Posted by david b. on December 14, 2012
This part of the keynote is dedicated to optimization of security awareness training programs, and the common drawbacks of external audits for organizations.
Let’s talk about a couple of other problems and things we’ve done to deal with them. Security awareness – anybody here involved in security...
Getting Ahead of the Security Poverty Line 4: Effecting Long-Term Change
Posted by david b. on December 13, 2012
Andy Ellis now makes emphasis on risk reduction in a long-term perspective, concurrently highlighting some scare techniques security vendors tend to leverage.
Now let’s look at some ways that people act, and I’m going to include a couple of my anecdotes here. First one isn’t me. So, I went and took 3...
Getting Ahead of the Security Poverty Line 3: Perceived and Actual Risk
Posted by david b. on December 12, 2012
The subject matter Andy Ellis focuses on here is the so-called Set-Point Theory of Risk Tolerance addressing the concept of perceived and actual risk.
The Peltzman Effect
Why are things getting worse for the organizations? And this comes back to the Peltzman effect. Sam Peltzman is an economist at the...
Getting Ahead of the Security Poverty Line 2: Degrees of Security Value
Posted by david b. on December 11, 2012
In this entry, Akamai’s Andy Ellis dwells on the degrees of security assurance within organizations, and explains why adversaries succeed in their attacks.
How much security value is ‘good enough’? We’d all love to have perfect security; we’re not going to be there though. This graph is...
Getting Ahead of the Security Poverty Line
Posted by david b. on December 10, 2012
Andy Ellis, the Chief Security Officer at Akamai Technologies, gives a keynote at ‘Hack in the Box Amsterdam’ event, providing an in-depth view of the concept of present-day information security, its goals and constituents.
Let’s start off with defining the security poverty line; the security...
Secure Password Managers and Military-Grade Encryption on Smartphones 5: The Summary
Posted by david b. on December 7, 2012
Elcomsoft employee Dmitry Sklyarov draws conclusions based on the study he and his colleague Andrey Belenko conducted about password keepers for smartphones.
Now I’m going to move on to summary and conclusions. We mentioned iOS passcode many times during this presentation, and it’s probably a really good...
Secure Password Managers and Military-Grade Encryption on Smartphones 4: Paid iOS Password Managers
Posted by david b. on December 6, 2012
Having shed light on the specificities of free password managers for iOS, Dmitry Sklyarov now focuses on the popular paid password apps for this platform.
Now that we have reviewed free password applications, it’s actually fair to assume that paid apps should be better than free ones. They should...
Secure Password Managers and Military-Grade Encryption on Smartphones 3: Free Password Keepers for iOS
Posted by david b. on December 5, 2012
It’s Dmitry Sklyarov’s turn to take the floor and talk about popular free password managers for iOS, their security implementation details, and common drawbacks.
iOS Password Managers (Free)
Actually, there are lots of applications available for people in the App Store, and we’ll start with free...
Secure Password Managers and Military-Grade Encryption on Smartphones 2: Device Backup and BlackBerry Password Managers
Posted by david b. on December 4, 2012
This part of the presentation accentuates data backup on smartphones, and provides an overview of popular password management applications for BlackBerry.
Threat Model
Let’s now move to the threat model. Throughout the research we assume that the attacker has physical access to the device, or the attacker...
Secure Password Managers and Military-Grade Encryption on Smartphones: Oh, Really?
Posted by david b. on December 3, 2012
Andrey Belenko and Dmitry Sklyarov, security researchers representing Elcomsoft Co. Ltd headquartered in Moscow, give a presentation at Black Hat Europe event to raise relevant issues of data protection on smartphones.
We would like to welcome you on our talk at Black Hat Europe 2012. Today I’m here with...
Social Engineering Defense Contractors on LinkedIn and Facebook 6: Preventive Measures
Posted by david b. on December 1, 2012
In conclusion, Jordan Harbinger tells a few stories from his past experience to underscore the weakest human component in information security chain.
Solutions
So, the solutions are obvious, right? Training: sure, you got policies with respect to social media in your company, and you’ve got this classified...
Social Engineering Defense Contractors on LinkedIn and Facebook 5: Tactic for Eliciting Private Data
Posted by david b. on November 30, 2012
Having obtained basic data on the targets, Jordan Harbinger makes a bold move to get their almost intimate details by applying more advanced social engineering.
Step 6: [Hypothetically] Elicit classified info
Now that I have tons of information about the company, the facilities and how things work from the...
Mikko Hypponen
Bruce Schneier
Moxie Marlinspike
Eugene Kaspersky
Brian Krebs
