All News (127 Posts)

<< Next - First ... 9 10 11 12 13 . Last - Previous >>

Attack on Quantum Cryptography

#47 - Posted on 15 August 2011 - Author: SM - Category: Cryptography

There is a recent BBC article on a new attack against a key component of Quantum Cryptography: Key Transportation.

There are 3 main components to a cryptographic system:
– The strength of the algorithms used (close/open, random generator, collision, etc)
– The integrity of the system (implementation, key storage, devices security, etc)
– The transportation of keys (no full or partial interception of the keys, etc)

Quantum Cryptography has for some been seen as the future for ensuring the integrity and detection of any interception attempts during key transportation.

I am not a Quantum Physic expert, but what I understand is that key transportation is done through light, where photons of light are sent to the receiver who will inspect the states of those photons to reconstruct the key. It is similar of sending a stream of bits which make the key, apart from the fact that in Quantum Physics a photon has not just a binary state ...
>>[READ MORE]

Dropbox in the Enterprise

#46 - Posted on 5 July 2011 - Author: SM - Category: Security

In the never ending story that is more issues/concerns with Dropbox, there is an interesting article discussing the recent changes of Terms and Conditions with using Dropbox:

TechRepublic Post

In a nutshell, Dropbox is trying to protect themselves with what they do and can do with your data hosted in their data centre. So it means granting Dropbox and those they work with“worldwide, non-exclusive, royalty-free, sub-licensable rights to use, copy, distribute, prepare derivative works “ from your data.

The TechRepublic article stresses that it is already the case with sites such as Facebook. There is however a big difference. Facebook is mainly used for social content, personal “stuff” (to use Dropbox’s term). Dropbox is not only used for personal “stuff” but also for professional “stuff”....
>>[READ MORE]

GPU Password Cracking

#45 - Posted on 27 June 2011 - Author: SM - Category: Hacking

Brute force password cracking has been around for a while but in the last few years a new way to use your brand new graphic card has emerged which brings high performance attacks against passwords much cheaper and easier.

This is because the “brain” of those graphical card, The Graphical Processing Unit or GPU, is designed to handle mathematical and repetitive tasks very efficiently.

There is a very good article about this topic on the ERRATA SECURITY blog with some interesting facts:

– Although GPU are now found in most electronic devices (i.e.: phones), dedicated PC cards are obviously better

– Radeon is better than GeForce

– Although you can use more than one GPU, the benefits are not exponential and most people only need 1 or 2 GPU.

– This is because past 8 Characters, a password become near impossible to brute force....
>>[READ MORE]

Worrying trends with Dropbox

#44 - Posted on 22 June 2011 - Author: SM - Category: Security

Dropbox is a very convenient way to synchronise data across locations and devices, it is one of the leader for in the cloud storage solutions. However, it has lately gathered some attention for the wrong reasons.

There has been a recent upset about the false claims (or incorrect depending where you stand on this) that no-one could decrypt your data on their data centre, including their staff. Well, it turned out it was no-one *excluding* their staff.

As explained in this article on TECHREPUBLIC

That’s fair enough, so as long as they have the right processes and due diligence in place your data should be safe into their hands, you can trust their staff.

Or can you?

Today, it appeared that while updating their backend code, anyone could connect to >>[READ MORE]

Turning point for Apple Products Security

#43 - Posted on 14 June 2011 - Author: SM - Category: Security

There has recently been an increase in blackhat attention to Apple products.
It would seem that what has been predicted for some time is about to be tested:
that one of the main reason for Mac/OSX to be more secure than windows is because it did not get the same attention from hackers.

This had to happen, and I believe that the time is right.
Indeed, Apple products are gaining more and more market shares and their hippy/cool image is being eroded by both their very strict view of the world and exponantial user base growth.
(On a non security related note, one could wonder how long can Apple be seen as different/cool if everyone has their product!)

This gives every reasons for hackers to take their attention to Mac OSX and iOS.
Recently a fake anti virus software for MAC was discussed on the excellent Intego blog and many other >>[READ MORE]

Free Forensic Resources

#42 - Posted on 13 June 2011 - Author: SM - Category: Security

Below are two interesting Forensic resources I got from Jess Garcia

– Some great free Forensic windows tools, i.e.: to convert time format
http://www.mikesforensictools.co.uk/index.html

– Zero Wine Malware; A promessing virtual environment to analyse malware behaviour and impact
Zero Wine 2.0

...
>>[READ MORE]

Extreme Pen Testing

#41 - Posted on 13 June 2011 - Author: SM - Category: Security

Here is an amuzing story where prisoners in a maximum security prison managed to hack their lockdown computers.
Their computer seems to be more like a dumb terminal than a full featured one, and what they can do and where they can go is very limited (i.e.: watch television and receive call).
However, the prisoners found out that by opening 200+ windows explorer they could cause a buffer overflow which then allowed them more access!

http://gcn.com/articles/2011/05/30/colorado-prison-sidebar.aspx

and to go with this story here is a photo I came accross on the internet and that summerize the security state of many companies!

...
>>[READ MORE]

Mobile device security questions

#40 - Posted on 19 May 2011 - Author: SM - Category: Security

The security of mobile devices is receiving an increasing level of attention and many security vendors are now offering a Mobile Device Management solution. What seems to be leading the market is a secured container approach, which although providing a high level of security could potentially be flawed because it does not take into account what is driving users to buy smartphones and tablets.

A container approach is a very secured one with a strong legal aspect, however, the same way the consumerisation of devices is driving unapproved devices in companies today, there is a risk that users want a full consumer experience where different users will have different preferred apps to do a similar task. A container approach does not provide this full consumer experience and locks the user to the functionalities the secured container apps provides.
Therefore a secured container approach may be flawed through another layer of consumerisation, the apps consumerisation where user...
>>[READ MORE]

Hot Random Numbers!

#39 - Posted on 26 April 2011 - Author: SM - Category: Cryptography

The LavaRND project is a very interesting take on providing a cryptography strong random generator framework.

Both in terms of plans for physical devices to software library.

If only I had more time I would love to try building one of their device, nevertheless, I highly recommend this website as it is full of very interesting information related to randomness and they even have some interesting demo using their random framework. You do not require an interest in cryptography to appreciate the work done.

Next time I need a strong random generator algorithm, I will know where to look :)

http://www.lavarnd.org

...
>>[READ MORE]

SANS Ondemand Training course: A few Tips

#38 - Posted on 21 April 2011 - Author: SM - Category: Conferences, Guides

I went to a SANS Forensic course (508) last year and a few weeks ago I decided to try something new… to stay at home and dedicate 5 days to do their Ethical Wireless Hacking training course (617).

Let me first say that the 617 training course was really good, the author of the course and the recordings were made by Joshua Wright who runs the http://www.willhackforsushi.com blog. He is very knowledgeable and his enthusiasm was even contagious through audio only. In fact this is a huge understatement! I was truly amazed by his skills, stories and training delivery!
So much that for 7 days I was up at 9am and worked until 2am each day on the different content material covered by the course.

As I almost lost my sanity and started dreaming of ToDS/FromDS bits and fuzzing I thought I would share a few tips on this type of training course.

– Check the last time the course was updated, and if there is an upco...
>>[READ MORE]