Securing LAMP video

Stumbled accross this screencast I made for my buddies at Firehost a couple of months back. Was my first screencast and didn't go so terrible :)

Goes over some of the basics for setting up a secure Ubuntu+Apache+PHP server...

American Airlines now has in flight Wifi

American now has Wifi access on select planes, including 747 and MD-80's. Fees are $9.95 US for an all day pass and are currently running a free promotion for first time users.

The free promo requires registering an account using only an email address and code which they provide, no credit card is required. This means you can probably sign up using multiple email accounts and username for as long as the promo lasts.

When you sign up it assures you that the system is very secure and tested thoroughly by the FAA, the captive portal authentication is SSL based but after authenticating you are still vulnerable to any standard wireless man in the middle attack as there is no WEP, WPA or VPN protection.

Setting my radio to monitor mode quickly showed everyone's traffic on the flight, so security is non-existent at best.

Speeds were very good, similar to DSL connection but lots of intermittent latency made video streaming from Hulu unwatchable.

Here is a screen grab of an in-flight speed test.

9 Percent Of Enterprise Machines Infected With Malware

New study released from 3 months of botnet research found that up to 9% of large enterprise organizations are infected and active bot nodes.

This is not surprising and shows the importance of having both internal IDS sensors such as Snort IDS (with Emerging Threats Signature set) and a consolidated logging and event management product (SIEM tools) such as Arcsight.

A large client can leverage SIM to monitor windows event logs, host based ID(P)S and or anti-virus software. With the combined information, companies can leverage strong correlation reports matching those events with the internal IDS sensors. This seems to be a best practice approach at containing sprawling infections such as Conficker, Koobface and even the nasty Zeus (keylogging) malware.

Original article @ Dark Reading:
http://www.darkreading.com/insiderthreat/security/client/showArticle.jhtml?articleID=220200118

Texas Stadium powered by Microsoft

Note to embedded systems and product developers: Avoid Windows.

Apple's secret security updates

So with the release of OSX Snow Leopard on Friday Apple has included several new and almost lackluster features such as full 64bit applications, better multi-core support and the OpenCL library which will give CUDA like GPU access to applications. One of the most interesting new features which was slipped in secretly was transparent malware scanning.

This new OSX service scans all new files, emails and links that are processed for malcode using binary pattern matching signatures. This is interesting and great new feature for security but why is it a secret? Apparently Apple doesn't want to tarnish the reputation of running a Mac is a worry free utopia with no exploits, worms or trojans. While we do know that's not entirely true it's great they are integrating new security features to maintain that status.

Just odd that they didn't tell anyone.

Network Solutions hacked, 500,000 card numbers compromised

Another major data breach this time Network Solutions which offers security products such as SSL certificates is the latest to be compromised at the tune of 500,000+ credit/debit cards.

This attack seemed to be very sophisticated and the company claims the had maintained PCI compliance during the time of the hack. This is a huge one for the industry as it will spark a huge PCI works/doesn't work debate and it's perfectly timed as industry conferences BlackHat and Defcon start in Las Vegas this week.

References:

Washington Post

Finextra
SC Magazine

New MS 0-day ActiveX (MSVidCtl dll exploit)

This was just announced this morning and was found in the wild on several Chinese forums. Apparently this has been rampant for almost a month undetected.

This is a client side (browser) exploit, so visiting a malicious site will result in infection.

There is one known hotfix and that is to set a "kill bit" in the registry for the ActiveX component.

* Create a registry key called:

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}]

Then, create a dword value named "Compatibility Flags" and give it a value of 400.

Here are the current Snort IDS/IPS signatures for this exploit:


alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"MSVidCtl 0-day"; flow: to_server, established; uricontent:"/aa/go.jpg"; nocase; classtype: attempted-admin; reference:URL,isc.sans.org/diary.html?storyid=6733; sid: 3000305; rev: 2;)


alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET
CURRENT_EVENTS Likely MSVIDCTL.dll exploit in transit";
flow:to_client,established; content:"|00 03 00 00 11 20 34|";
content:"|ff ff ff ff 0c 0c 0c 0c 00|"; within:70;
classtype:trojan-activity; sid:2009493; rev:1;)

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET
CURRENT_EVENTS Vulnerable Microsoft DirectShow ActiveX Load";
flow:to_client,established; content:"clsid"; nocase;
content:"0955AC62-BF2E-4CBA-A2B9-A63F772D46CF"; nocase;
reference:url,csis.dk/dk/nyheder/nyheder.asp?tekstID=799
classtype:web-application-attack; sid:2009xxx; rev:0;)

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET
CURRENT_EVENTS Microsoft DirectShow ActiveX Exploit Attempt";
flow:to_client,established; content:"clsid"; nocase;
content:"0955AC62-BF2E-4CBA-A2B9-A63F772D46CF"; nocase; content:"omybro";
nocase; content:"logo.gif"; nocase;
reference:url,csis.dk/dk/nyheder/nyheder.asp?tekstID=799
classtype:web-application-attack; sid:2009xxx; rev:0;)