Privacy, Security Archive

Design flaws account for 50% of security problems. You can’t find design defects by staring at code—a higher-level understanding is required. That’s why architectural risk analysis plays an essential role in any solid software security program. Find out more about architectural risk analysis in this sample chapter. Also, Matthew Heusser and Sean McMillan are convinced that it takes smart people to develop good software that makes money. Where do you find smart people? You don't find them; you make them! Matt and Sean provide some fundamental rules for doing just that.

"In this HowTo I will show how to install and configure DenyHosts. DenyHosts is a tool that observes login attempts to SSH, and if it finds failed login attempts again and again from the same IP address, DenyHosts blocks further login attempts from that IP address by putting it into /etc/hosts.deny. DenyHosts can be run by cron or as a daemon. In this tutorial I will run DenyHosts as a daemon."

After two years of work, since the 3.50 release, Fyodor announced the Nmap Security Scanner version 4.00. Changes since version 3.50 include a rewritten (for speed and memory efficiency) port scanning engine, ARP scanning, a brand new man page and install guide, runtime interaction, massive version detection improvements, MAC address spoofing, increased Windows performance, 500 new OS detection fingerprints, and completion time estimates. Dozens of other important changes - and future plans for Nmap - are listed in the release announcement. Fyodor also gave an interview on 4.00.

"This tutorial describes how to install and configure OpenSSH so that it will allow chrooted sessions for users. With this setup, you can give your users shell access without having to fear that they can see your whole system. Your users will be jailed in a specific directory which they will not be able to break out of."

"The United States Computer Emergency Readiness Team released its year-end summary of computer vulnerabilities. While Windows is regarded as the most insecure operating system, the US-CERT found four times as many vulnerabilities specifically related to Unix and Linux. Of 5198 reported flaws, 812 were for the Windows, 2328 for Unix and Linux, and 2058 more affected more than one operating system. Notably missing from the list of Windows vulnerabilities is the recently discovered Windows Metafile issue. No vulnerabilities were listed for Apple's Mac OS X, however several had been disclosed during the year. Also, since OS X is based on Unix, it is vulnerable to some of the flaws associated with its core operating system." Note: The link is fixed. I have no idea what happened there, sorry guys!

BentUser takes a look at OS-level DRM in upcoming operating systems, particularly Windows Vista. Protected video path, PVP-UAB and PVP-OPM, have the potential to be really obnoxious, eclipsing any annoyances one experiences with current DRM technologies.

You know how insecure 802.11x wireless networks are. In this article we'll create an OpenBSD-based secure wireless access point that prevents unauthorized access and encrypts every packet using a VPN tunnel. OpenBSD is one of the most secure operating systems available, is easy to use, and includes almost everything you need for this project in the base installation.

Every security savvy professional lives with the daily fear of the "never expiring password" being exposed. It's the unspoken taboo, the wide open back door in every corporate network. But no-one ever acknowledges it or discusses it. All applications have got pre-defined passwords that never change. Which means developers, privileged users and hosting third party service providers will all have access to these passwords.

How are users supposed to learn if they never fall down? For many users, being faced with "safety" features just creates more workaround. Confirming, clarifying, and checking every operation, as most applications these days do, is intended to protect users from accidents. The result is similar to what many people find after putting training wheels on a child's bicycle: the vehicle is more cumbersome and the child never learns to ride it properly.

Here is an interview with Ron Gula, to get a glimpse of Tenable's free Nessus 3 vulnerability scanner. The interview discusses license changes, community involvement, daemon security, GPL open-source versus free, and more.

"Whether you're a buyer or a seller of a product, the essential goal of standardization is to make interoperability possible, allowing communication with anyone else using the same protocol and media. In some cases though, vendors have specific reasons for not being compatible - and those vendors have developed a standard for incompatibility, digital rights management. The goal of DRM is to limit compatibility because things which are compatible can be copied and distributed freely. In this article, Peter Seebach looks at a potential oxymoron - standards designed to subvert and prevent interoperability."

When Mark Russinovich was testing his company's security software last week, he came across a disturbing find: a Sony BMG CD he purchased from Amazon had secretly installed DRM software on his PC and used "rootkit" cloaking methods to hide it. With the story sweeping across the Net, Sony is attempting to clean up its mess.

"When choosing an operating system for use in your enterprise, you need to look beyond the security capabilities 'on the box' and think about how the OS really affects you over the long haul. You need to be prepared for the patching, upgrading, and maintenance issues each OS has and understand how these activities affect your security and availability."

Ever since networking came out, one important issue, to a various extent over the time, has been how to give the legitimate users the right access - authentication, which is one of the three basic elements in security: authentication, authorization and access control.