Heartbleed Will Linger "For Many Months to Come"

<div dir="ltr" style="text-align: left;" trbidi="on"><h3 class="post-title entry-title" itemprop="name" style="background-color: white; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 18px; font-weight: normal; margin: 0px; position: relative;"><div class="featured-image" style="font-size: 16px; line-height: 22.17599868774414px;"><img alt="heartbleed" height="227" itemprop="image" src="http://res.cloudinary.com/hacksurfer/image/upload/t_HeaderImage4/v1397946543/s5h8ahi2tikbrejcrrjd.jpg" title="heartbleed" width="640" /></div><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">It’s been nearly two weeks since the Heartbleed bug was made public -- two weeks of massive coverage from news outlets across the globe as the security of online services used my much of the world was called into question. </span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">Now things are beginning to settle down. Most of the major players have announced that they’ve shored up the vulnerability that left them open to leaking sensitive data. The first arrest has been made in connection with Heartbleed, a 19-year-old London, Ont. man accused of the </span><a href="http://business.financialpost.com/2014/04/16/rcmp-heartbleed-charges-hacker-cra/?__lsa=5bdc-10b7" style="color: black; font-size: 16px; line-height: 22.17599868774414px; text-decoration: none;">theft of 900 social insurance numbers</a><span style="font-size: 16px; line-height: 22.17599868774414px;"> from the Canada Revenue Agency’s Website, and users across the world have received a slew of “please reset your password” emails.</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><img alt="Heartbleed" src="http://res.cloudinary.com/hacksurfer/image/upload/v1397946655/dlaj7zfr4d4mcvvuf6hl.jpg" style="float: right; font-size: 16px; line-height: 22.17599868774414px; margin: 0px 0px 10px 10px;" title="" /><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">But there’s a long way to go, and it may be awhile before one of the biggest bugs in recent memory is truly “fixed.”</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">“I think things are going to be lingering for many months to come, just because that’s the nature of the way patches get implemented and holes get fixed,” said Marc Gaffan, co-founder of Incapsula. “I would imagine if we did a survey three or six months from today we’d find astonishing results in terms of how many organizations have not patched [the Heartbleed OpenSSL vulnerability].”</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">The big players have patched things up by now, but OpenSSL is widely used, the figure most often being quoted a massive two-thirds of web servers.</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">“As you start moving away from that nucleus, you get more and more organizations that are less up to date, less able, less willing to patch their systems,” Gaffan said, describing the way a typical vulnerability is addressed. Heartbleed is certainly major, but that isn’t going to change the nature of the way people react.</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">And we haven’t even touched on the billions of users, many who may not follow through on their end due to ignorance or laziness or simply because they just don’t care. That’s exactly what Justin Balthrop argued on Medium when discussing a </span><a href="https://medium.com/cyber-security/9ed56d483eb" style="color: black; font-size: 16px; line-height: 22.17599868774414px; text-decoration: none;">huge problem that’s at the core of this Heartbleed mess -- passwords</a><span style="font-size: 16px; line-height: 22.17599868774414px;">:</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><blockquote style="font-size: 16px; line-height: 22.17599868774414px;">I have 268 passwords on 268 different websites. At least that’s what my password manager says. I actually stopped saving new passwords a while back, so the real number of passwords I should change now that Heartbleed has been revealed is even higher than that. How many of those passwords do you think I’m going to change? It took me 10 minutes just to find the change password form for my bank! What about the average computer user who uses the same password for every website and doesn’t understand the details of the exploit? How many passwords will they change?<br /><br />Not very many.</blockquote></h3><h3 style="background-color: white; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; margin: 0px; position: relative;">A Look at Heartbleed's Popularity</h3><h3 class="post-title entry-title" itemprop="name" style="background-color: white; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 18px; font-weight: normal; margin: 0px; position: relative;"><span style="font-size: 16px; line-height: 22.17599868774414px;">We thought it would be interesting to use our HackSurfer data to conduct a little sociological experiment. Which of the two major cybersecurity moments of the past five months is garnering more discussion: the Heartbleed bug or the Target breach?</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><br style="font-size: 16px; line-height: 22.17599868774414px;" /><img alt="Target v Heartbleed.png" height="399px;" src="https://lh6.googleusercontent.com/kBam_ydQAquiARpzLMLSkGherUhWoEKjvdJfIC2SU3FFhY5IxhDXcIoh3WgAPTWmjeaqeYVmWPq8eSy574ukccy-Hg3QVFzbPyGkcc6PGK17CNvtj20SRxmXvXUF7BQgFg" style="-webkit-transform: rotate(0rad); border-style: none; font-size: 16px; line-height: 22.17599868774414px;" title="" width="598px;" /><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">As you can see, they both took up a massive chunk of the discussion, but Heartbleed is even more “popular” than Target over it’s respective period. This may reflect how far reaching the vulnerability is, which is hardly surprising given the amount of posts and articles we’ve seen here at HackSurfer regarding the bug.</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">“I don’t think that this has been overplayed [in the media],” Gaffan said. “Given the ubiquitousness of OpenSSL plus the potential damage that this vulnerability can create, it does create a pretty big hole out there.”</span></h3><h3 style="background-color: white; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; margin: 0px; position: relative;">Who Left the Curtains Open?</h3><h3 class="post-title entry-title" itemprop="name" style="background-color: white; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 18px; font-weight: normal; margin: 0px; position: relative;"><span style="font-size: 16px; line-height: 22.17599868774414px;">So what is Heartbleed?</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">It’s a small bug that’s been in existence for the past two years and affects many websites that collect personal and financial information. That little padlock icon you see along with “https” on most browsers is meant to assure users that everything is safe. Heartbleed discovered that’s not necessarily been the case. </span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">Michael Hamlin, an X-Force security architect with IBM, explained the problem with Heartbleed using the typical household analogy on a </span><a href="http://ibm.biz/heartbleed" style="color: black; font-size: 16px; line-height: 22.17599868774414px; text-decoration: none;">recent IBM podcast</a><span style="font-size: 16px; line-height: 22.17599868774414px;">.</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">Imagine all of your usernames, passwords and other data is written on a big stack of paper sitting on your desk.</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">“They’re in your house. They’re locked up. They’re secure,” Hamlin said. “We think about SSL that way. We trust the servers' encrypting our sessions, and we provide our usernames and passwords. They’re encrypted. But if a burglar walks up and looks through the window and there's a stack of papers on the desk now, it can read the first page, whatever is exposed on the top page, and that's kind of how this vulnerability works. It was like not drawing the curtains shut. It left that chunk of memory open to anybody that requested it.”</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">Perhaps most importantly, they discovered that </span><a href="http://www.bloomberg.com/news/2014-04-14/heartbleed-hackers-steal-encryption-keys-in-threat-test.html" style="color: black; font-size: 16px; line-height: 22.17599868774414px; text-decoration: none;">private encryption keys could be stolen</a><span style="font-size: 16px; line-height: 22.17599868774414px;"> through the vulnerability.</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">As Codenomicon, the security firm that discovered the flaw (Google engineer Neel Mehta discovered it independently as well), described, “These are the crown jewels, the encryption keys themselves. Leaked secret keys allow the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will.”</span></h3><h3 style="background-color: white; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; margin: 0px; position: relative;">What Should I Do? What Will Hackers Do?</h3><h3 class="post-title entry-title" itemprop="name" style="background-color: white; font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: 18px; font-weight: normal; margin: 0px; position: relative;"><span style="font-size: 16px; line-height: 22.17599868774414px;">There are three main things a website owner should do, whether they’re tiny or a huge SAAS platform, said Gaffan:</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><ol style="font-size: 16px; line-height: 22.17599868774414px;"><li style="margin: 0px 0px 0.25em; padding: 0px;">Patch your infrastructure; make sure that you’ve implemented the fix to the Heartbleed vulnerability.</li><li style="margin: 0px 0px 0.25em; padding: 0px;">Reissue certificates with a new private key, just in case it was stolen when the vulnerability existed.</li><li style="margin: 0px 0px 0.25em; padding: 0px;">Websites that run with persistent cookies (if you’re constantly logged in to social media for example) leave users vulnerable if that cookie information is stolen; log out of all them and log back in; “Given that the vulnerability is now fixed with most of the bigger providers, that means that those credentials will be no longer snatchable.”</li></ol><span style="font-size: 16px; line-height: 22.17599868774414px;">One problem: many smaller businesses still operate with the mentality that they’re a small target and therefore can operate without being on cybercriminals’ radar.</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">“What people don’t actually realize is that in this era of automation, smaller and smaller websites are being hacked today just because they’re out there on the internet,” Gaffan said. “There are scanners that are available already today that can tell you if a website is vulnerable to Heartbleed or not. If I’m a bad guy, what I would do is start scanning a couple of million websites each day and compiling a list of who I need to go after. Once I’d compiled that list, I’d build another automated tool that all it does is hit Heartbleed vulnerable servers and try to pull out usernames and passwords. That’s something that is going on all the time with other vulnerabilities.”</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">If you’re a user, how do you know the websites you’re visiting are safe? There’s several options. Use a tool just like criminals are: scanners. Many companies are offering the ability to check for Heartbleed (like</span><a href="http://safeweb.norton.com/heartbleed" style="color: black; font-size: 16px; line-height: 22.17599868774414px; text-decoration: none;">Norton</a><span style="font-size: 16px; line-height: 22.17599868774414px;">, for example). There are dozens of apps springing up, and there’s even </span><a href="http://arstechnica.com/security/2014/04/now-theres-an-easy-way-to-flag-sites-vulnerable-to-heartbleed/" style="color: black; font-size: 16px; line-height: 22.17599868774414px; text-decoration: none;">browser extensions</a><span style="font-size: 16px; line-height: 22.17599868774414px;"> that can make confirming a site is safe simple and easy.</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><span style="font-size: 16px; line-height: 22.17599868774414px;">Except, there’s one big problem with all of that. As The Guardian reported last week, researchers are claiming that most popular </span><a href="http://www.theguardian.com/technology/2014/apr/16/heartbleed-bug-detection-tools-flawed" style="color: black; font-size: 16px; line-height: 22.17599868774414px; text-decoration: none;">Heartbleed detection tools are flawed</a><span style="font-size: 16px; line-height: 22.17599868774414px;">:</span><br style="font-size: 16px; line-height: 22.17599868774414px;" /><blockquote style="font-size: 16px; line-height: 22.17599868774414px;">A deluge of tools then hit the internet promising to help people determine whether the web services they were using or hosting were affected. But 95% of the most popular ones are not reliable, according to London-based security consultancy and penetration testing firm Hut3.<br /><br />“A lot of companies out there will be saying they've run the free web tool and they're fine, when they're not,” Hut3’s Edd Hardy told the Guardian. “There's absolute panic. We're getting calls late at night going 'can you test everything'.”</blockquote><span style="font-size: 16px; line-height: 22.17599868774414px;">Unfortunately, that means you may have to make sure the tool you’re using to stay safe is providing safe and accurate results.</span></h3></div>

Security news Heartbleed Will Linger "For Many Months to Come"

It’s been nearly two weeks since the Heartbleed bug was made public -- two weeks of massive coverage from news outlets across the globe as t...

Read More..

10 Hacking Tools Of Android

<div dir="ltr" style="text-align: left;" trbidi="on"><h3 class="post-title entry-title" itemprop="name" style="background-color: white; font-family: Oswald, Arial; font-size: 22px; font-weight: normal; line-height: 1.4em; margin: 0.25em 0px 0px; padding: 0px 0px 4px;"> </h3><div class="post-header" style="background-color: white; color: #333333; font-family: Arial, serif; font-size: 13px;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" id="post-body-640831227925512578" itemprop="articleBody" style="background-color: white; color: #333333; font-family: Arial, serif; font-size: 13px; line-height: 1.6em; margin: 0px 0px 0.75em;"><span style="font-size: xx-small;"><span style="color: black; font-family: verdana;"><b>1.<a href="https://play.google.com/store/apps/details?id=com.techfond.hackode" style="color: #3366cc; text-decoration: none;" target="_blank">Hackode</a></b><br /><br />Hackode : The hacker's Toolbox is an application for penetration tester, Ethical hackers, IT administrator and Cyber security professional to perform different tasks like reconnaissance, scanning performing exploits etc.<br /><br /><b>2.<a href="https://github.com/DesignativeDave/androrat" style="color: #3366cc; text-decoration: none;" target="_blank">androrat</a></b><br /><br />Remote Administration Tool for Android. Androrat is a client/server application developed in Java Android for the client side and in Java/Swing for the Server.<br /><br /><b>3.<a href="https://github.com/honeynet/apkinspector/" style="color: #3366cc; text-decoration: none;" target="_blank">APKInspector</a></b><br /><br />APKinspector is a powerful GUI tool for analysts to analyse the Android applications. The goal of this project is to aide analysts and reverse engineers to visualise compiled Android packages and their corresponding DEX code.<br /><br /><b>4.<a href="http://code.google.com/p/droidbox/" style="color: #3366cc; text-decoration: none;" target="_blank">DroidBox</a></b><br /><br />DroidBox is developed to offer dynamic analysis of Android applications.<br /><br /><b>5.<a href="http://www.portswigger.net/burp/" style="color: #3366cc; text-decoration: none;" target="_blank">Burp Suite</a></b><br /><br />Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities.<br /><br /><b>6.<a href="http://www.zimperium.com/zanti-mobile-penetration-testing" style="color: #3366cc; text-decoration: none;" target="_blank">zANTI</a></b><br /><br />zANTI is a comprehensive network diagnostics toolkit that enables complex audits and penetration tests at the push of a button. It provides cloud-based reporting that walks you through simple guidelines to ensure network safety.<br /><br /><b>7.<a href="http://droidsheep.de/" style="color: #3366cc; text-decoration: none;" target="_blank">Droid Sheep</a></b><br /><br />DroidSheep can be easily used by anybody who has an Android device and only the provider of the webservice can protect the users. So Anybody can test the security of his account by himself and can decide whether to keep on using the webservice.<br /><br /><b>8.<a href="http://dsploit.net/" style="color: #3366cc; text-decoration: none;" target="_blank">dSploit</a></b><br /><br />dSploit is an Android network analysis and penetration suite which aims to offer to IT security experts/geeks the most complete and advanced professional toolkit to perform network security assesments on a mobile device.<br /><br /><b>9.<a href="https://appsec-labs.com/AppUse" style="color: #3366cc; text-decoration: none;" target="_blank">AppUse – Android Pentest Platform Unified Standalone Environment</a></b><br /><br />AppSec Labs recently developed the AppUse Virtual Machine. This system is a unique, free, platform for mobile application security testing in the android environment, and it includes unique custom-made tools created by AppSec Labs.<br /><br /><b>10.<a href="https://play.google.com/store/apps/details?id=lv.n3o.shark" style="color: #3366cc; text-decoration: none;" target="_blank">Shark for Root</a></b><br /><br />Traffic sniffer, works on 3G and WiFi (works on FroYo tethered mode too). To open dump use WireShark or similar software, for preview dump on phone use Shark Reader. Based on tcpdump.</span></span></div></div>

Andriod Hacking 10 Hacking Tools Of Android

  1. Hackode Hackode : The hacker's Toolbox is an application for penetration tester, Ethical hackers, IT administrator and Cyber securi...

Read More..

WebPwn3r - WebApps Security Scanner

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXPNs4OGI9zbxQ6YUu41YsPeJtZzK6aGxcteoiqTGiRGbEzWI55tC0bK2YQYl9cAlQaCaEjMbvTEy7j3RiZ8DCq1palOiD1stg8Xmn5DyOLrQ-Zg2Ro6TJ38IQ6fuLvs1mGNxpdp3f40k/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="171" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXPNs4OGI9zbxQ6YUu41YsPeJtZzK6aGxcteoiqTGiRGbEzWI55tC0bK2YQYl9cAlQaCaEjMbvTEy7j3RiZ8DCq1palOiD1stg8Xmn5DyOLrQ-Zg2Ro6TJ38IQ6fuLvs1mGNxpdp3f40k/s1600/1.png" width="400" /></a></div><div class="force_dir" len="331" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="318"><span lang="en"><br /></span></span></div><div class="force_dir" len="331" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="318"><span lang="en">Not long ago a group of researchers at computer security reported a RCE (Remote Control Ejecution) vulnerability in a subdomain of Yahoo.com. </span><span lang="en">Good in this occasion I come to present this small tool group use to detect this vulnerability. </span><span lang="en">Well no more to add, comensemos.</span></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT_W1I3NajF1tqMRw_v3-cFPPHQlKzkiLxvAs8JldkASEPlEIEACjDYp-FkAOXMpIkrIFUSupAJSejgnp0PgzMwgfaNR2TEFqZytd4wfuWhkGCUVgnli6wa-jsSis0B_-9m3Pjuv5FEYU/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="53" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT_W1I3NajF1tqMRw_v3-cFPPHQlKzkiLxvAs8JldkASEPlEIEACjDYp-FkAOXMpIkrIFUSupAJSejgnp0PgzMwgfaNR2TEFqZytd4wfuWhkGCUVgnli6wa-jsSis0B_-9m3Pjuv5FEYU/s1600/4.png" width="320" /></a></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="311" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="298"><span lang="en">WebPwn3r is a scanner of vulnerabilities in web applications. </span><span lang="en">This mentioned tool is written in the Python language, and as I mentioned above help researchers to scan multiple links at the same time, in search of CERs or some typical vulnerabilities XSS vulnerability.</span></span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="89" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="76"><span lang="en">WebPwn3r detections. </span><span lang="en">(The public tool only has the options *)</span></span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><div class="force_dir" len="62" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="49">Scan a URL or a particular list of URL's.</span></div><div class="force_dir" len="85" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="72">* Detect and exploit remote code injection vulnerabilities.</span></div><div class="force_dir" len="72" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="59">To detect remote command execution vulnerabilities.</span></div><div class="force_dir" len="73" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="60">* Detect typical vulnerabilities Cross Site Scripting (XSS)</span></div><div class="force_dir" len="36" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="23">Detect WebKnight WAF.</span></div><div class="force_dir" len="88" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="75">It improves the payload for bypass filters seguridad(WAF 's).</span></div><div class="force_dir" len="55" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="42">Notes and print backend technologies.</span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><div class="force_dir" len="20" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="7">Notes:</span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><div class="force_dir" len="209" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="196">1.-This tool can also extract the URL´s of Burp Suite then guardardo in a targets.txt, to finally file that the URL's are finally analyzed by WebPwn3r.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8LFLn0seFoznt-6aGaHR5cQS_ADzywuN0rjRuQV81TCXPkHVlcUbKAPdLXmoG4Xy-X7uONIBWJjeutVlip7eMhkEA_xferwy-eaz-P-qhd-3OfxiYfC0cibJrf3oRTH7clxAgdmmugpI/s1600/proxy_4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8LFLn0seFoznt-6aGaHR5cQS_ADzywuN0rjRuQV81TCXPkHVlcUbKAPdLXmoG4Xy-X7uONIBWJjeutVlip7eMhkEA_xferwy-eaz-P-qhd-3OfxiYfC0cibJrf3oRTH7clxAgdmmugpI/s1600/proxy_4.png" width="400" /></a></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="358" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="345">2. This tool has great potential, since the user could optimize it to create a powerful and effective Crowler who would search all subdomains of a given domain or domains, to then classify them and print them in .txt files, to then be analyzed with a variacon of WebPwn3r.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-4Y83XSVDQQuIADPj0Eg29UBHYKswThpV3e7wd_YllH-n9MgCPNOMhsUqGQEOT8LIOxGnzpKUsh72dspwGGS4c9WAIAFwP2WyYWuIRODqdpvi4-Sr6U1itgk7HpYegaIdHsdB0espnaU/s1600/333.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="225" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-4Y83XSVDQQuIADPj0Eg29UBHYKswThpV3e7wd_YllH-n9MgCPNOMhsUqGQEOT8LIOxGnzpKUsh72dspwGGS4c9WAIAFwP2WyYWuIRODqdpvi4-Sr6U1itgk7HpYegaIdHsdB0espnaU/s1600/333.png" width="320" /></a></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="202" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="189">Well then I do a little test about WebPwn3r skills, for this I will use Windows 7, since I've previously installed packages of python 3.3.</span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><div class="force_dir" len="77" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="64">Our goal for the test will be a subdomain of the Nato.</span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><div class="force_dir" len="54" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="41">Aim: https://transnet.act.nato.int/</span></div><div class="force_dir" len="54" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="41"><br /></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJUCXZT9gPhYB-BGS1wo_jFt5eXahsvIEga0vHgUXDIxVMyyljyEq9SEvKmYVDNb4Is_aw0Tx_xoBsq7ZjYhhsrYEmiNONh6WovLtpEKO2bRhQiLMVpSWAnIe6rtZgY8RI7sPYmQ2Gk0k/s1600/4+(1).png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="76" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJUCXZT9gPhYB-BGS1wo_jFt5eXahsvIEga0vHgUXDIxVMyyljyEq9SEvKmYVDNb4Is_aw0Tx_xoBsq7ZjYhhsrYEmiNONh6WovLtpEKO2bRhQiLMVpSWAnIe6rtZgY8RI7sPYmQ2Gk0k/s1600/4+(1).png" width="400" /></a></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="262" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="249"><span lang="en">We entered option 1 since we are going to do tests on a single URL. </span><span lang="en">Option 2 is for multiple objective analysis and rather than enter a URL, we will enter the name of the file that stores all the URLs that will be analyzed.</span></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeHrWlyIAm81yj7R50aCbdAjY72h1K8AVXd4N7OGOqv-pOGQIe_NV7guySzYxoHwHHoq161DDsR_s2img7nOdWFot7Re-5fhHbBsFqrO_01s3D_0nwJcmCuX6JpMwuWNnjEbLyNLvZmoU/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="203" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeHrWlyIAm81yj7R50aCbdAjY72h1K8AVXd4N7OGOqv-pOGQIe_NV7guySzYxoHwHHoq161DDsR_s2img7nOdWFot7Re-5fhHbBsFqrO_01s3D_0nwJcmCuX6JpMwuWNnjEbLyNLvZmoU/s1600/3.png" width="400" /></a></div><div class="force_dir" len="262" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /></div><div class="force_dir" len="171" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="158">So far, we can see that our goal has no RCE vulnerability, but apparently if you have multiple Cross Site Scripting vulnerabilities.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKKB5_xNE4vDJ-Rfs1pJ-bekcV9haFSSHleYC5chJksKe5s-13MkexDVL11a3-kI1dB3MLSoZWSgxANtXtsK3gdp_X0uF1Yb-dADDroCMwxX4xpCYt9ZYWYspUnoyk2SQt0SDxQelXI-c/s1600/5+(1).png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="87" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKKB5_xNE4vDJ-Rfs1pJ-bekcV9haFSSHleYC5chJksKe5s-13MkexDVL11a3-kI1dB3MLSoZWSgxANtXtsK3gdp_X0uF1Yb-dADDroCMwxX4xpCYt9ZYWYspUnoyk2SQt0SDxQelXI-c/s1600/5+(1).png" width="400" /></a></div><div class="force_dir" len="171" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="158"><br /></span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="307" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="294"><span lang="en">Well according to this tool our goal has 94 Cross Site Scripting vulnerabilities. </span><span lang="en">Interesting but apparently this in error. </span><span lang="en">This large number is because the variables were subjected to different types of scripts, some ordinary and others duly obfuscated attacks.</span></span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="246" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="233">Note: This vulnerability was one of the many vulnerabilities that I could find in the Nato, all vulnerabilities found them with my tool Minerva v.1.4, I have used this objective to simplify the post.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKb3e_18oPJua08yf89Zqx97Yw3MUSC9Djgcpjtx-jKzLjvd4Iy3TTSn7-GjDhlacMdzGzl_-gVqI4Ra6IUt57zSZUV_Gv_7UVAgW9pumkyJWiBKwCMNms1-sFAnYQagcQBB4tcdtL5-Y/s1600/nato+XSS+en+calendario.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="159" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKb3e_18oPJua08yf89Zqx97Yw3MUSC9Djgcpjtx-jKzLjvd4Iy3TTSn7-GjDhlacMdzGzl_-gVqI4Ra6IUt57zSZUV_Gv_7UVAgW9pumkyJWiBKwCMNms1-sFAnYQagcQBB4tcdtL5-Y/s1600/nato+XSS+en+calendario.png" width="320" /></a></div><div class="force_dir" len="246" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="233"><br /></span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="177" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="164"><span lang="en">Well I think that we have reached the end of the post, I hope that this small tool will be useful and serve them in the future. </span><span lang="en">See you and it will be up to the next.</span></span></div><div><span len="164"><span lang="en"><br /></span></span></div></div>

Penetration Testing Tools WebPwn3r - WebApps Security Scanner

Not long ago a group of researchers at computer security reported a RCE (Remote Control Ejecution) vulnerability in a subdomain of Yahoo.com...

Read More..

Heartbleed Bug Week Two: Affected Website Testing and 'The Other Shoe'

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;">--</span></div><div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="t6sg3ljc8x" href="http://www.cartoonink.com/wp-content/uploads/2014/04/Heartbleed.jpg" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;"><span style="font-family: Georgia, 'Times New Roman', serif;"><img border="0" height="136" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_QbAEJanxYJ86J5Wck7JA8z_S7ObVddNaURckC5h-YMh3okLDJdCW9w9kfZgGwW3HwFusQxB0uhFWO6aqHUFZJ-9T-IVL4kcr6RpfU6t91EEYYA3Vei6-tf3DZaNyXZs9n3OfIaiATbWB/s1600/Heartbleed.jpg" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="200" /></span></a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span></div><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;">[UPDATED 2014-04-18 ~11:30 AM ET. <b>AgileBits</b> has created a lovely Heartbleed testing page I recommend. It offers advice as well as results. Thanks to my friendly colleague Al Varnell for pointing it out!]</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />[UPDATED 2014-04-17 ~11:00 AM ET. A link to <b>Mashable's</b> list of affected websites was added.]</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />This is week two of the Heartbleed bug and its ramifications. A lot has been learned. A lot is still happening. A lot more problems are still to come.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />I'm extremely disappointed that <i>few</i> websites have directly addressed this problem and kept their customers informed. Apparently, security is still considered a minor inconvenience to website administrators, with a wide variety of responses to the Heartbleed security hole, as you'll see ahead.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>TEST PAGES</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Thankfully, there are now some very good resources for finding out whether specific websites remain affected. Here is a list of six pages I know of where you can <b>test</b> any <b>website</b> against the Heartbleed bug. Try them in the order of usefulness I've provided below. If one test errors out, try the next one.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /></span><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"></span><b style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><a href="http://watchtower.agilebits.com/" style="color: #d6a0b6; text-decoration: none;">http://watchtower.agilebits.com</a></b><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><b style="background-color: white; color: #0d03ee; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"><br /></b><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"></span><b style="background-color: white; color: #0d03ee; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"><span style="font-family: Georgia, 'Times New Roman', serif;"><a href="https://www.ssllabs.com/ssltest/" style="color: #d6a0b6; text-decoration: none;">https://www.ssllabs.com/ssltest/</a></span></b><br /><div style="background-color: white; color: #0d03ee; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span></div><div style="background-color: white; color: #0d03ee; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"><span style="font-family: Georgia, 'Times New Roman', serif;"><span style="text-decoration: underline;"><a href="https://filippo.io/Heartbleed" style="color: #d6a0b6; font-weight: bold; text-decoration: none;"><b>https://filippo.io/Heartbleed</b></a></span><span style="color: black;"><b>/</b></span></span></div><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b><a data-jsb_prepared="olpud0v05b" href="http://www.digicert.com/help/" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">http://www.digicert.com/help/</a></b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><b><br /></b><b><a data-jsb_prepared="5iqb972fqb" href="http://heartbleed.criticalwatch.com/" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">http://heartbleed.criticalwatch.com</a></b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><b><br /></b><a data-jsb_prepared="w5cdbbpkgm" href="https://lastpass.com/heartbleed/" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;"><b>https://lastpass.com/heartbleed/</b></a></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Thanks to <b><a data-jsb_prepared="3kbsowrs8i" href="http://krebsonsecurity.com/2014/04/heartbleed-bug-what-can-you-do/" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">Brian Krebs</a></b> for getting the ball rolling collecting these sites. I'll add more to this list as I find them. Note that using these test pages can be annoying and disconcerting. On some test pages, I ran into errors of various sorts about 50% of the time.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>TEST RESULTS</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Fortunately, lists of <b>FAILed websites</b> are showing up on the net, saving us some time and trouble. Here is one at <b>Github</b>, listing affected websites as of April 8th, 2014, the day after the SSL security hole was made public. Scroll down its page to 'Overview' to see the list:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><a data-jsb_prepared="9b9dteehlh" href="https://github.com/musalbas/heartbleed-masstest" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;"><b>https://github.com/musalbas/heartbleed-masstest</b></a></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />NOTE: Many of the sites on this out-of-date list have now been patched! Yahoo, for example, made a big deal out of patching its website in a hurry.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>Mashable</b> has also provided a listing of affected websites here. Note that it is also out-of-date:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><a data-jsb_prepared="h2g34lpam1" href="http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;"><b>http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/</b></a></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />At the time I wrote this article, many sites had still not been patched. Here's one unhappy example: </span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /></span><br /><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="background-color: #f8f8f8; color: #333233;"><b><span style="font-family: Georgia, 'Times New Roman', serif;">hypovereinsbank.de</span></b></span></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span></div><div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="66vi8vogdu" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNEIMMsUjQmA9K-R8MtFzeNU7x1rDjn0cA52yIsnVAT_zQ08JgzyfgBsF6kgGCX0Jiu693-US8klPHeCp3v7vAv-iJOhqjstTYojoYel8jkx-xetm1545kT8dbY7tcEJZuvktrZkOiqfgK/s1600/Istanbul+Unpatched.png" imageanchor="1" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="font-family: Georgia, 'Times New Roman', serif;"><img border="0" height="178" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNEIMMsUjQmA9K-R8MtFzeNU7x1rDjn0cA52yIsnVAT_zQ08JgzyfgBsF6kgGCX0Jiu693-US8klPHeCp3v7vAv-iJOhqjstTYojoYel8jkx-xetm1545kT8dbY7tcEJZuvktrZkOiqfgK/s1600/Istanbul+Unpatched.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="320" /></span></a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNEIMMsUjQmA9K-R8MtFzeNU7x1rDjn0cA52yIsnVAT_zQ08JgzyfgBsF6kgGCX0Jiu693-US8klPHeCp3v7vAv-iJOhqjstTYojoYel8jkx-xetm1545kT8dbY7tcEJZuvktrZkOiqfgK/s1600/Istanbul+Unpatched.png">Click to enlarge the image for viewing</a></span></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span></div><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;">This bank kindly patched their German website, but NOT their Turkish website! Ouch!</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />And so forth.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>NOW WHAT?</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>So!</b> Are we ready to <b>change our passwords</b> at all the websites that verify as having patched their OpenSSL implementations?</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>Yes! </b>Do it!</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b><span style="font-size: medium;">But!</span></b> There's another problem! Remember how I pointed out last week that phishing is going to result from the Heartbleed bug? The phishing problem may become doubly bad:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><br /><b>THE OTHER SHOE DROPS</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><a data-jsb_prepared="55vqve6im8" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9mJuLM2nrsk-T-rpR4sUdMA_I1dh3iiQcKyEJH7fGOEMCXsJm4353-oo2_Cqnt0hj4_p2H4goXWiKssRZjkjyDhJMH1BI1bscIL2leR0CAR0X8VBrtC8-CWYAYKv7Fz-quWNzA3BkhAwp/s1600/the_other_shoe_drops.png" imageanchor="1" rel="noreferrer" style="background-color: white; clear: right; color: #d6a0b6; float: right; font-family: Georgia, Times, serif; font-size: 13px; font-weight: bold; line-height: 18.200000762939453px; margin-bottom: 1em; margin-left: 1em; text-decoration: none;"><span style="font-family: Georgia, 'Times New Roman', serif;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9mJuLM2nrsk-T-rpR4sUdMA_I1dh3iiQcKyEJH7fGOEMCXsJm4353-oo2_Cqnt0hj4_p2H4goXWiKssRZjkjyDhJMH1BI1bscIL2leR0CAR0X8VBrtC8-CWYAYKv7Fz-quWNzA3BkhAwp/s1600/the_other_shoe_drops.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="185" /></span></a><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Because, as I pointed out last week, Heartbleed can allow the cleartext robbery of website security certificates, ALL security certificates at affected sites MUST BE REVOKED and REPLACED.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Why? Because with a stolen SSL security certificate, a hacker can pretend to 'officially' BE the website from which the certificate was stolen! That's VERY bad and will lead to lots of troubles. It's also <i>ignorant, lazy</i> and <i>cheapskate</i> of the website's administrators.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />It turns out that remarkably <i>few</i> websites have so far revoked their potentially stolen security certificates! Welcome to our modern world of bad biznizz. :-P Insert your favorite expletives here: [_____]</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>Let's use an example!</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><b><br /></b><b>HAPPY RESULTS</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Use a GOOD web browser that actually CHECKS Internet security certificates for credibility. One such browser is good old Apple<b>Safari!</b> Bravo Apple! Each time you visit a website, Safari checks the security certificate for that website against a number of factors. One of them is whether that certificate is on a<b>Certificate Revocation List</b> (CRL). </span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><a data-jsb_prepared="m0fx1krsdv" href="http://en.wikipedia.org/wiki/Revocation_list" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;"><b>http://en.wikipedia.org/wiki/Revocation_list</b></a></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />When you visit a website that has had its security certificate revoked, you get a message in Safari!</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />This past week, mentor <b>Steve Gibson</b> very kindly set up the perfect place to show what it looks like when you run into a revoked security certificate. Travel here to see Steve's demonstration:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><a data-jsb_prepared="121iob7hil" href="https://www.grc.com/revocation.htm" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;"><b>https://www.grc.com/revocation.htm</b></a></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />In a box, slightly down the page, you'll see his test page link. Click on it:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b><a data-jsb_prepared="mv9l0x6dzv" href="https://revoked.grc.com/" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">https://revoked.grc.com</a></b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />What you'll see in Safari is:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /></span><br /><div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="egy5v4a81u" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY1FYH6r_Rr4lpqOARFjjOoDJB_QjpFAcR-8wAL_8NDsilJKMU-6_wLj-vg_ZZ6ejE_iCTBJRG_qLj0bbFSZOH0eLxiCfluZbapFPiulhPxIHkA3viuuij9b9CI720XWZGZXr06nuXMtMt/s1600/INVALID.png" imageanchor="1" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="font-family: Georgia, 'Times New Roman', serif;"><img border="0" height="211" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY1FYH6r_Rr4lpqOARFjjOoDJB_QjpFAcR-8wAL_8NDsilJKMU-6_wLj-vg_ZZ6ejE_iCTBJRG_qLj0bbFSZOH0eLxiCfluZbapFPiulhPxIHkA3viuuij9b9CI720XWZGZXr06nuXMtMt/s1600/INVALID.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="320" /></span></a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY1FYH6r_Rr4lpqOARFjjOoDJB_QjpFAcR-8wAL_8NDsilJKMU-6_wLj-vg_ZZ6ejE_iCTBJRG_qLj0bbFSZOH0eLxiCfluZbapFPiulhPxIHkA3viuuij9b9CI720XWZGZXr06nuXMtMt/s1600/INVALID.png">Click to enlarge the image for viewing</a></span></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span></div><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;">"Invalid"</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />If you then click on the '<b>Show Certificate</b>' button, you will see this:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /></span><br /><div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="96c2g1ws8y" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh62BXKZPBXbhiQRvyQO9Swza_KZXd8DZx4pGEWoVCsmebJAJuT74Wa8PUsr-gZcJqz3iKXRcY9G1y0eWK51vm6tGqOrgI3eHpXYQqhyL1r_8jjWWaXFHb8bnRPw4tPwqcyTk7HznT1EwPs/s1600/REVOKED.png" imageanchor="1" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="font-family: Georgia, 'Times New Roman', serif;"><img border="0" height="221" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh62BXKZPBXbhiQRvyQO9Swza_KZXd8DZx4pGEWoVCsmebJAJuT74Wa8PUsr-gZcJqz3iKXRcY9G1y0eWK51vm6tGqOrgI3eHpXYQqhyL1r_8jjWWaXFHb8bnRPw4tPwqcyTk7HznT1EwPs/s1600/REVOKED.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="320" /></span></a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh62BXKZPBXbhiQRvyQO9Swza_KZXd8DZx4pGEWoVCsmebJAJuT74Wa8PUsr-gZcJqz3iKXRcY9G1y0eWK51vm6tGqOrgI3eHpXYQqhyL1r_8jjWWaXFHb8bnRPw4tPwqcyTk7HznT1EwPs/s1600/REVOKED.png">Click to enlarge the image for viewing</a></span></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span></div><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;">"Revoked"</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Therefore, you hit the 'Cancel' button and leave the site. There's something profoundly wrong with it, danger, danger. Do not go there. Thank you Safari!</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /></span><a data-jsb_prepared="yrgb7s5n7o" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTHuMotWKzC9fHV4mOWj4TE9REk1-_koaZ4xslzUkGOUUM8y2Xvy-l4WCQCTXeAZB9F0rzdg0eeRorgJtFXLX0DbVaVW8PV_jSGZlMYonEqeAzZso8-0MODQI1dCZSjyPHWfME8LcqCSyn/s1600/this_house_has_rats.png" imageanchor="1" rel="noreferrer" style="background-color: white; clear: right; color: #d6a0b6; float: right; font-family: Georgia, Times, serif; font-size: 13px; font-weight: bold; line-height: 18.200000762939453px; margin-bottom: 1em; margin-left: 1em; text-decoration: none;"><span style="font-family: Georgia, 'Times New Roman', serif;"><img border="0" height="131" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTHuMotWKzC9fHV4mOWj4TE9REk1-_koaZ4xslzUkGOUUM8y2Xvy-l4WCQCTXeAZB9F0rzdg0eeRorgJtFXLX0DbVaVW8PV_jSGZlMYonEqeAzZso8-0MODQI1dCZSjyPHWfME8LcqCSyn/s1600/this_house_has_rats.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="200" /></span></a><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><b>SAD RESULTS</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Let's say we live in Turkey and get an email we believe is from the Istanbul branch of  HypoVereinsbank, where we have all our life savings stored. The email message says something like:</span><br /><blockquote class="tr_bq" style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"><span style="font-family: Georgia, 'Times New Roman', serif;">Dear Valued Customer, </span><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span><span style="font-family: Georgia, 'Times New Roman', serif;">We are offering a new 5% back on purchases feature to select account holders. To sign up for this new perk, please log into your<a data-jsb_prepared="flbdoanxf7" href="http://192.168.0.254/" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;">HypoVereinsbank.co.tr</a> account and click the 'Join the 5% Back Club' button on the  page.</span><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span><span style="font-family: Georgia, 'Times New Roman', serif;">Hurry now! Limited time offer! Don't let this deal pass you by! Prices do not include shipping and handling.</span></blockquote><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;">Great! A deal! They offered up the link to their website within the message! How convenient.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />[If you check out the actual web address behind 'HypoVereinsbank account', you'll find that I've faked a different IP address that is NOT HypoVereinsbank! In reality, I've provided a LAN IP link that goes nowhere on the Internet, making in innocuous. But I could put anything there. Note that I am NOT picking on HypoVereinsbank in Turkey. I'm only using them as a valid example of a bank that had not patched the Heartbleed bug at the time of this writing.]</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />So we click the link to HypoVereinsbank.co.tr. We're sent to the FAKE website for the bank. We're presented with everything looking just perfect and fine. Safari sees NO problems! The stolen, unrevoked certificate is presented to Safari, all his happy.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />UH OH.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Then we log in, our ID and password are stolen, we possibly get asked a bunch of other personal identity questions in order to sign up for the FAKE 5% Back Club offer. We have been PWNed.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />THEREFORE:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />It's important that ALL Heartbleed bug affected websites revoke their old security certificates and get new certificates. ALL.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Enough of that nightmare for today.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><br /><b>CONCLUSION</b>, for now:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>1)</b> Check out what websites have been affected by the Heartbleed bug.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>2)</b> Check out whether those websites are NOW patched.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>3) Change your password</b> there ASAP.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>4)</b> Keep an eye out for potential phishing scams using stolen security certificates.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><br /><b>THE FUTURE</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Hopefully we'll see forced revocation of security certificates via certificate authorities against all websites that have been affected by the Heartbleed bug. That move would save we Internet users a lot of grief.</span></div>

Security flaws Heartbleed Bug Week Two: Affected Website Testing and 'The Other Shoe'

-- [UPDATED 2014-04-18 ~11:30 AM ET.  AgileBits  has created a lovely Heartbleed testing page I recommend. It offers advice as well as resul...

Read More..

Apple's OS SSL Certificate Verification Bypass Flaw

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;">--</span></div><div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="q6rrljaxhe" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhf9YeU_XOMUQaAaEu08PjV8uHSnrhk7KFthnRPfhd9wuLhKsVEpbK2yDRzBzPX80k7PKhsA7EbXr1ONK0xIhkVvHa63K2rIv4qF4ok43yB-YEsPsxo7fLokZqRtvmh9V8yOF0U5JhViRvV/s1600/ssl-layers.gif" imageanchor="1" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; margin-left: 1em; margin-right: 1em; text-decoration: none;"><span style="font-family: Georgia, 'Times New Roman', serif;"><img border="0" height="173" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhf9YeU_XOMUQaAaEu08PjV8uHSnrhk7KFthnRPfhd9wuLhKsVEpbK2yDRzBzPX80k7PKhsA7EbXr1ONK0xIhkVvHa63K2rIv4qF4ok43yB-YEsPsxo7fLokZqRtvmh9V8yOF0U5JhViRvV/s1600/ssl-layers.gif" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="320" /></span></a></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span></div><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;">[Addendum and additional information added 2014-02-25 ~11:00 AM]</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /></span><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"></span><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;">At the moment, there is a lot of swirling information about a security vulnerability in Apple software that allows hackers to surveil users on the Internet, among other things. It is a form of '<b>Man In The Middle</b>' hack. It involves bypassing SSL certificate verification, allowing hackers to fake an SSL connection between the user, themselves, and the user's intended Internet connection. There is a lot of misinformation and outright nonsense out on the Internet, making this a very muddy topic. I'm waiting for a shoe or two to drop regarding this situation before commenting about it further.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Therefore, I'll be writing up a Part II regarding the problem as the mud settles.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />In the meantime, Apple has provided <b>three fixes</b> so far for this problem. Each of the updates in the list are linked to their Apple security notes:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>1) <a data-jsb_prepared="bfkqfs7iv8" href="http://support.apple.com/kb/HT6147" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;" target="_blank">iOS 7.0.6 Update</a>.</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>2) <a data-jsb_prepared="7nt2k5r6r9" href="http://support.apple.com/kb/HT6146" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;" target="_blank">iOS 6.1.6 Update</a>.</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>3) <a data-jsb_prepared="qhq4hrfloe" href="http://support.apple.com/kb/HT6148" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;" target="_blank">Apple TV 6.0.2 Update</a>.</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />Common to all three updates is the following:</span><br /><blockquote class="tr_bq" style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"><span style="font-family: Georgia, 'Times New Roman', serif;">Impact: An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS</span><br /><span style="font-family: Georgia, 'Times New Roman', serif;"><br />Description: Secure Transport failed to validate the authenticity of the connection. This issue was addressed by restoring missing validation steps.</span><br /><span style="font-family: Georgia, 'Times New Roman', serif;"><br />CVE-ID</span><br /><span style="font-family: Georgia, 'Times New Roman', serif;"><br />CVE-2014-1266 </span></blockquote><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;">To reiterate, that's <b>three updates</b>. For reasons I cannot comprehend, only one or two of these updates are being reported in the news, which is part of the reason I don't trust many reports regarding this situation. I have an extremely low opinion of technology journalism these days. Quite a lot of it is outright abysmal.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />There are a couple purported <b>tests</b> available for OS X Safari to verify whether it also has this SSL security flaw. The ImperialViolet website, linked below, provides one of them. From reports, as well as my personal experience, <b>Safari 6.x does NOT have the SSL flaw</b>. However, <b>Safari 7 </b><b>DOES have the SSL flaw. </b>Note that Safari 7 is exclusive to OS X 10.9 Mavericks. Apple has acknowledged that the problem exists. There is a report that an Apple internally distributed beta of the fix is being tested. I'm expecting a public beta this week, if not the entire fix. We shall see.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /></span><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"></span><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><b>*</b> [<b>New information:</b> The flaw is in OS X 10.9 itself, not any particular application. Any applications that access Apple's system level Security.Framework are potentially <i>all</i> affected. For more information, see the <b>Addendum</b> below.]</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />There has already been some chatter about this SSL flaw being a method of NSA surveillance of Apple users. I currently believe that is not the case, specifically because the flaw is so <i>recent.</i> It is not found in versions of Safari on iOS, OS X, or the equivalent software on Apple TV that are more than a year old, to use a simple round number. Therefore, I've set my paranoia switch to 'simmer' regarding this hypothesis.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><b><br /></b><b>Two further things: </b></span><br /><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; min-height: 19px;"><span style="font-family: Georgia, 'Times New Roman', serif;"><br /></span></div><div style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"><span style="font-family: Georgia, 'Times New Roman', serif;">- Please do NOT confuse this situation with the simple use of<b>unsecured Wi-Fi hotspots</b> whereby anyone's granny can sniff your Internet connection via Wireshark, or other hacker tools. It is NOT the same thing. This SSL flaw requires <i>a lot</i> more sophistication and can take place even on secured Wi-Fi hotspot connections or other SSL connections, including at home.</span><br /><span style="font-family: Georgia, 'Times New Roman', serif;"><br />- Using a '<b>reverse firewall</b>', such as Little Snitch or Intego's Net Barrier, will catch any bogus port call outs from Safari that are common with this SSL flaw. Just remember to <i>not</i> approve them when they pop up. This can help prevent an SSL hacker from exploiting your machine.</span></div><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br />When Apple's SSL fix for OS X is released, I'll be writing more about the subject.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b>Meanwhile:</b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;">Here are some <b>reading links</b> to assist in understanding the background of the problem:</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b><a data-jsb_prepared="dbw9a1we76" href="https://en.wikipedia.org/wiki/Secure_Sockets_Layer" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">https://en.wikipedia.org/wiki/Secure_Sockets_Layer</a></b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b><a data-jsb_prepared="ecjw2ocdff" href="https://en.wikipedia.org/wiki/Ssl_certificate" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">https://en.wikipedia.org/wiki/Ssl_certificate</a></b></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><a data-jsb_prepared="64gmwdq7z7" href="https://www.imperialviolet.org/2014/02/22/applebug.html" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; text-decoration: none;"><b>https://www.imperialviolet.org/2014/02/22/applebug.html</b></a></span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, 'Times New Roman', serif; font-size: 13px; line-height: 18.200000762939453px;"><br /><b><a data-jsb_prepared="b6k0l97p19" href="http://www.macworld.com/article/2099987/what-you-need-to-know-about-apples-ssl-bug.html" rel="noreferrer" style="color: #d6a0b6; text-decoration: none;">http://www.macworld.com/article/2099987/what-you-need-to-know-about-apples-ssl-bug.html</a></b></span><br /><div class="tr_bq" style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><div class="separator" style="clear: both;"><a data-jsb_prepared="vg91p3u59j" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjodwhT6Vr7CyK83B0ZXBskUJu6De5ZQ9NToTp9WNAVy7jt8yx-lFDmEIucL1NCstxzfCyJJMgt3OnoXegatflpfICzCH7PWr_Dc9WgME-x9eLlP0t8x4oInfcLMln_n2i-6jPT5PNHDlr7/s1600/band-aid-heart-2.png" imageanchor="1" rel="noreferrer" style="color: #d6a0b6; font-weight: bold; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="177" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjodwhT6Vr7CyK83B0ZXBskUJu6De5ZQ9NToTp9WNAVy7jt8yx-lFDmEIucL1NCstxzfCyJJMgt3OnoXegatflpfICzCH7PWr_Dc9WgME-x9eLlP0t8x4oInfcLMln_n2i-6jPT5PNHDlr7/s1600/band-aid-heart-2.png" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="200" /></a></div></div><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">…And… The Fix Is Out!</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">Apple has provided four security updates today, one of which is OS X </span><b style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">10.9.2</b><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"> update. I'll </span><i style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">skip</i><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"> </span><span style="background-color: white; color: #474b4e; font-family: Georgia; font-size: 14px;"><b>Security Update </b></span><span style="background-color: white; color: #474b4e; font-family: Georgia; font-size: 14px;"><b>2014-001</b>,</span><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"> </span><b style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">Safari 6.1.2 </b><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">update and </span><b style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">Safari 7.0.3</b><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"> update for the moment as they are </span><i style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">not</i><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"> directly applicable to the SSL security flaw.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">What have we here, among the several security updates in</span><b style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">10.9.2</b><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">?</span><br /><blockquote style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;"><b>Data Security</b><br /><br /><b>Available for</b>:  OS X Mavericks 10.9 and 10.9.1<br /><br /><b>Impact</b>:  An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS<br /><br /><b>Description</b>:  Secure Transport failed to validate the authenticity of the connection. This issue was addressed by <i>restoring missing </i><i>validation steps.</i><br /><br />CVE-ID<br /><b>CVE-2014-1266</b></blockquote><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">√ That's the fix for the SSL flaw, aka CVE-2014-1266.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">I'm glad that's over!</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">Update ASAP please! I'm off to do it myself right now.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><span style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;">I'll chatter about the other security updates, as well as the other security fixes in 10.9.2, a bit later.</span><br style="background-color: white; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px;" /><br /><div class="separator" style="background-color: white; clear: both; color: #474b4e; font-family: Georgia, Times, serif; font-size: 13px; line-height: 18.200000762939453px; text-align: center;"><a data-jsb_prepared="7vglc1pjv6" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZummx-6S9e6pEmzLiZWY4OD-yuGeOcgEsg4tyywKW0My7P6E4PHc2p9Sy6ukd3A25YNYesAqQBBGiID-AUlVmw9FEM1KVu49YmvK8stNKzwqd8BHxiE4nvXlhfK0zWn5thLfoCVNolkk-/s1600/Mavericks+logo.jpg" imageanchor="1" rel="noreferrer" style="color: #fd0570; font-weight: bold; margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZummx-6S9e6pEmzLiZWY4OD-yuGeOcgEsg4tyywKW0My7P6E4PHc2p9Sy6ukd3A25YNYesAqQBBGiID-AUlVmw9FEM1KVu49YmvK8stNKzwqd8BHxiE4nvXlhfK0zWn5thLfoCVNolkk-/s1600/Mavericks+logo.jpg" style="border: 1px solid rgb(227, 228, 228); margin: 0px; padding: 2px;" width="200" /></a></div><div><br /></div></div>

apple's Apple's OS SSL Certificate Verification Bypass Flaw

-- [Addendum and additional information added 2014-02-25 ~11:00 AM] At the moment, there is a lot of swirling information about a security v...

Read More..

How to Secure Wireless Network

<div dir="ltr" style="text-align: left;" trbidi="on"><span style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13.333333969116211px; line-height: 18px;">Secure Wireless Network part 2</span><br /><br style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13.333333969116211px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13.333333969116211px; line-height: 18px;">4. Best Practices</span><br /><br style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13.333333969116211px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13.333333969116211px; line-height: 18px;">There are certain best practices explained below which should be followed for enhancing security of wireless Access Point / Routers.</span><br /><br style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13.333333969116211px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13.333333969116211px; line-height: 18px;">i) Restrict the Access</span><br /><br style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13.333333969116211px; line-height: 18px;" /><span style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13.333333969116211px; line-height: 18px;">SSID (Service Set Identifier) is used to identify a wireless network which a user wants to attach. All wireless devices that want to communicate on the WLAN need to have their SSID set to th</span><span class="text_exposed_show" style="background-color: white; color: #333333; display: inline; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13.333333969116211px; line-height: 18px;">e same string as the AP. Even though the attacker can get the SSID simply by sniffing the network it is preferable to change the default SSID. Avoid SSID which shows name or other information. Name the access point such that it can be easily traceable during trouble shooting. Physical security of access point is also important.<br /><br />ii) Disable Management via Wireless<br /><br />It is recommended to disable management of the router via wireless devices associated with the access point. If someone manages to associate with the access point and login to the router , they can change the configuration of the router. Prefer wired interface with AP/Router to configure the device.<br /><br />iii) Disable Remote Management<br /><br />Remote Router Access permits web-based management of the wireless router from external networks such as the Internet. By default this feature opens port 8080/TCP on the external side of the router. This feature provides significant risk to the device, permitting an attack vector and more importantly significant risk to internal network. It should be disabled unless remote management is absolutely required. Universal Plug and Play may also be disabled.<br /><br />iv) Turn off the AP when not in use<br /><br />This is also advisable since it minimizes the risk of unauthorized access.<br /><br />v) Configure Network Mode<br /><br />Select the wireless mode which is depending upon the protocols. The possible options are.<br /><br />_ Disabled – disables AP.<br /><br />_ Mixed – permits both 802.11 b and 802.11g.<br /><br />_ B-Only – 8.2.11 b only.<br /><br />_ G-Only – 8.2.11 g only.<br /><br />vi) Disable SSID Broadcast.<br /><br />This can protect the AP from a naive attacker . By disabling SSID broadcast, the easy availability of SSID can be restricted. But the attacker can still sniff the SSID from frames that devices use when associating with an AP. According to some vendors disabling SSID broadcast may restrict or invite the chance of exploitation.<br /><br />vii) Set Wireless Channel from default<br /><br />Changing the default wireless channel used by the AP is a good practice.It may avoid automatic association of the wireless interface to the network.<br /><br />viii ) Maximize the Beacon Interval<br /><br />Beacon frames are used for connection establishment and management by IEEE 802.11 networks. These frames from AP to wireless clients ,transmitted at regular intervals are used for configuration matching. It is recommended to set the beacon interval to the maximum number. This will reduce the transmission frequency of SSID so that the attacker will get less number of opportunities to sniff the beacons containing SSID. But there is a problem here. The attacker can probe the network using some specific SSID which is known as active scanning.<br /><br />ix) Prefer Static IP instead of DHCP.<br /><br />Since DHCP is automatically assigning IP addresses, an attacker can utilize this feature to get an IP. So it is recommended to use static IP on wireless networks.</span></div>

Security tips How to Secure Wireless Network

Secure Wireless Network part 2 4. Best Practices There are certain best practices explained below which should be followed for enhancing sec...

Read More..