- Wayne from Securus Global did us proud at the DefCon Social Engineering CTF Tournament in Las Vegas recently. It picked up a bit of press coverage. Just a couple of examples from ITNews and InfoWorld. Really demonstrates how someone can target an attack and relatively simply (with the right training, know-how and expertise), own a company. Unfortunately, we don’t see many organisations doing this type of assurance and testing – nor have an interest in it. Keen on your thoughts.

- Louis from Securus Global was involved with the French team that blitzed it at the DefCon Hacking CTF. Both Wayne and Louis, along with other Securus Global team members will be doing a few presentations in Melbourne and hopefully Sydney soon on various topics including penetration testing, web application security, social engineering and others. Stay tuned to our website as we kick off again our series of Breakfast Briefs and Technical Sessions in Q4, 2010.

- This is pretty cool. The character in a new novel with a hacker as one of the leads is based upon Dean Carter. Reported here at ZDNet. Who’s going to play Dean in the movie will be interesting.

- Checkout the Australian Information Security Bloggers Directory and see what the local guys are up to.

- Local scene roundup here.

- In numerous links above, you’ll see Securus Global has a new website. It’s a WIP (again). Websites and website development is a pain. Too much information, too little information….can you win? We’re better at testing and breaking them than we are at making our own I reckon but that’s an old story. Would love to hear from people on their thoughts on which security organisation has a good website. Just curious…. :)

- With the election just around the corner, we can safely say that neither major party seems to have a clue about technology; the Internet, eCommerce and everything else related. Few if any issues and questions I have posted here will/are being addressed. I do ask again though, where has the money that Stephen Conroy promised, and has used in his marketing for the Internet Filter, ie; the millions for additional policing for child protection on the Net gone? Almost 3 years of hearing about it. No answers.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.



Release from ANSI. (I’ve included this as an FYI for Australian Information Security people). This link below has the content of the email sent out recently.

Related post regarding recent Australian Government activity here. Coordination? Focus? Lessons?

———————————————————————————————
White House Releases National Strategy for Trusted Identities in Cyberspace
http://www.ansi.org/news_publications/news_story.aspx?menuid=7&articleid=2576

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.



“On Monday 21 June 2010, the Standing Committee on Communications tabled its report on the inquiry into Cyber Crime entitled Hackers, Fraudsters and Botnets: Tackling the Problem of Cyber Crime.” Full details and report here.

We covered the updates to this inquiry last year: October 2009 post, September 2009 post.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.



By Declan Ingram.

Thought provoking read over at the Register: Feds seize $143M worth of bogus networking gear.

While the article is mainly about counterfeit hardware, (Cisco etc), seized in the US, (some of which was used by the US Marines in Iraq), there are two parts that got my attention:

1) The counterfeit gear could have backdoors. (Well yes – and this is not news for many…be surprised if some or most doesn’t).

2) This lovely quote: “In May of 2008, Cisco officials said they had no evidence that any of the counterfeit networking gear contained backdoors” – If these are the same officials that have missed all the other security issues to date (and in the future), then I’m not sure this statement makes me feel any better.

This reminds me of a friend of mine who years ago purchased some pirated operating systems on CD in Malaysia. They had been backdoored and once installed allowed anyone on the Internet to gain full access. I had a giggle, I must say. You really get what you pay for…..and more. (Remote Support?) :)

The (potential) security problems of pirated software have been well documented for some time. Most will have looked at backdoored ‘cracks’ for proprietary software etc, but bogus hardware? Backdoored from day 0? Cisco gear is generally top shelf, so more likely to get noticed, but what about lesser brands or even your generic ’sourced’ components? The flash drive from eBay? The cheap video card you got for your server so you can install the OS? Have a think about it.

Could organised crime use this to offset the cost of components? OK, that could well just be pure FUD……but.. :)

I bet some, (most?) bogus gear comes from the same factory as the legit gear. Stands to reason. If it is backdoored, what assurance do we have that the legit gear isn’t? How would we, (or anyone else) ever know? Few know where to start in assessing the security of their supply chain.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.



As reported in ITNews and syndicated sites:

“The Federal Government has announced plans to sign an international treaty designed to facilitate the identification, extradition and conviction of cybercriminals around the world.”

In principle, the thinking and premise behind this is what you would expect in terms of technology issues/practices trying to align with “traditional” laws. But is this happening to mirror “traditional/current” laws in the member countries? What impact such a treaty owned and driven out of the EU for “other members” such as Australia? While 99% of this may be acceptable and most already a practice accepted here, care must be taken that we don’t jump into something without a full understanding of the impacts to our country and it’s citizens.

Are we prepared to fully jump into something like this (albeit, we do formally and in-formally undertake and work against most of these principles now), without other foundation legislation in place that would strengthen our abilities to really make this work on all levels?

The Government(s) in Australia have not really instilled us with much confidence for a while that they truly get IT, IT Security, eCommerce etc. Hopefully this is not another case of kicking something off and then having it come back to haunt them later….and there’s quite a bit of that.

I’m no expert in this field but find it an interesting topic. Am keen on your thoughts.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.



(Also posted this as a question on Twitter; @ddrazic).

Does anyone know a website that documents and posts links to all the more well known Annual Security Surveys and Reports? So many come out, it’s hard to keep track of them all these days.

While I take most with a grain of salt, some do have some decent substance in there. Which ones do you read and which ones do you brush aside? Keen on your thoughts.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.



A bit quiet lately. Sometimes I wonder if there’s more to say that I haven’t covered in the 500+ posts in Beast or Buddha. (The really interesting stuff, you can’t write about for obvious reasons). What do you do? Continue to rehash the old stuff? Sometimes!….which brings me to an interesting discussion.

We were asked to do a presentation recently on “emerging threats” at a business forum for IT Security and Risk Management professionals. Seems straightforward enough but when looking back over previous such presentations we’ve been doing over the years, nothing much was changing – in particular our recommendations on how organisations should be dealing with “emerging threats”. We could have almost just pulled out “Emerging Threats” presentation, (circa 2002) and done it word for word, (with only a few very minor wording and definition changes, eg; “Cloud”, “APT” etc :) ).

Should we be calling these presentations; “Emerging Responses”? It’s the response part that is in most cases yet to “emerge” effectively! The “threats” (most of them), emerged a long time ago. In many cases, we just call them different things now because we’ve failed to deal with them properly at the time, so it’s easier to rename something – makes it all seem that little bit new, and covers up to a degree for failures in the past.

Am I being unfair? Keen on your thoughts.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.



Symantec Press Release 22 February, 2010: Symantec 2010 State of Enterprise Security Study……

(Time to pump out another piece of marketing to get people thinking about buying Symantec. Here’s the report if you are interested in wasting a few minutes).

Just reading this now…….wooo…..hang on……what I don’t see anywhere in this report is a proud statement that Symantec customers are the lucky few that are safe from malicious attacks that other businesses are facing.

Why is this not in there Symantec? Surely you should be beating your own drums given you so proudly told us all some time ago that your product(s), and I quote; will provide “…proactive protection against unknown and zero-day threats”. It’s the Symantec Guarantee!

As such, surely Symantec customers do not have the same concerns as those poor businesses you mention in your study. Let us know if this was just an error on your part, or Symantec just not wanting to show off here because, surely you would not use bullshit marketing in the past?! :)

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.



Classic Chaser work:

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

Posted in: Too cool, cyber crime


Random thoughts: News?, OMG really?….nah!, Awesome marketing move Google!, Using the Net for spying…you naughty boys China…you’re the only ones and need to be punished :) , Hang on, he who controls the pipes…controls it all? It’s okay as long as it’s not someone other than us doing it!, yawn…..news?, Great marketing….I’m pulling out of China too! Write it up journos, I need more business!

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.



Older Posts »