Copernicus birthday

Nicolaus Copernicus - (19 February 1473 – 24 May 1543) was a Renaissance-era polymath whose theory of the universe placed the Sun rather than Earth at the center of the universe.

Bruce Schneier talks at TED: The security mirage

 

Worth watching Bruce Schneier, one of the security experts I have followed for years.

TED link

If Google stops trusting Windows, can Windows users trust Google?

Alun Jones, Security MVP, makes a good case that the news that Google is ditching MS Windows on security concerns has more to do with them adopting Google Chrome than with real Windows vulnerabilities.

For the details, I refer you to Alun’s article.

Ten key truths

My friend, Alun Jones, MS Security MVP, has a great post on ten cryptographic key truths, followed by ten other key facts about cryptography.

Here are the first five:

1. Your private key has to be private to you. It cannot be created by anyone else.
2. Anyone who has your private key is you, for the purposes to which that key is applied.
3. If you have a private key that was generated by your employer, then that key identifies you as a part of the employer. It cannot be used to uniquely identify you, because the key was generated under your employer's control.
4. Keys associated with expired or revoked certificates are not always useless - you can use them to decrypt a file that they encrypted a long time ago; you can also verify the time-stamped signature of a document, if the certificate was valid at the time of the signature.
5. A key is a number - it cannot expire, it is the associated certificate that expires. Similarly, the certificate, not the key, is what is revoked after exposure.

Read Alun’s article for the rest of the list (I wish more people took these truths to heart).

Phishing at Hotmail, GMail, Yahoo! Mail, etc.

My friend, Alun Jones, Microsoft Security MVP,  posted a nice reminder of the basic rules of dealing with everyday passwords.

 

1. Don’t use the same password everywhere.
   
2. Write down some of your passwords.
   
3. Consider what passwords should be accessible to others.
   
4. Plan to change your passwords.
   
5. Change your passwords often enough, but not too often.

 

For more details on each of these points, read his full article.

Microsoft's Patch Tuesday fixes record number of flaws

By The Register

Microsoft on Tuesday patched a record number of security holes in its Windows operating systems and other software, a haul that included at least one security flaw that was already under attack in the wild.

One of the updates fixed a vulnerability in Windows Media Runtime that allows an attacker to remotely execute malware by tricking a user into playing a booby-trapped audio or video file. A few hours after its release, a Microsoft spokesman said company researchers have "seen limited attacks trying to use the reported vulnerability."

Go patch!

There is more on this on the Microsoft Security Response Center (MSRC) and on SANS.Org

Microsoft Retiring Support for WinXP SP2 in a Year

Microsoft will retire support for Windows XP Service Pack 2 one year from today. This does not mean Microsoft will stop supporting XP! What it means  is that it will not longer support SP2. After Patch Tuesday, July 13, 2010 you will have to have SP3 installed in order to get updates for Windows XP. If a vulnerability is found in SP2 that is not in SP3, it will not be patched.

We have also reached the end of the line for Windows XP service packs: After SP3 no new service packs are planned. Microsoft will not end support for Windows XP itself for almost 4 more years as Extended Support is scheduled to end on April 8, 2014.

Via PCMag

Critical patch for MS vulnerability

I have received notice (Oct 23) of a critical patch released today for Windows 2000, Windows XP, Windows Server 2003, (not critical for Vista and Windows Server 2008 but catalogued as Important there due to the UAC).

This is unusual as it is out of the normal Tuesday patch release cycle. According to Microsoft Security Bulletin MS08-067 this vulnerability in a server service could allow a specially crafted RPC request to run remote code in your server without authentication.

Be aware. Be safe.

InfoWorld: Smartphones 'bigger security risk' than laptops

Inforworld reports on a survey saying that Smartphones carry company information such as emails and attachments and most of the management execs that use them do not have the contents encrypted and many don't even bother to enter a password to access the device.

Nowadays many IT execs have access to company networks with their own smartphones. These devices are easily lost or stolen and are a great risk to enterprise data security

See the article at InfoWorld.

Our government outsources our privacy too now?

I am incensed about the failure of our government to protect our privacy. They say they want to make use safer. Now we found out that the State Department has outside contractors with access to private information. Employees of these contractors have viewed the passport files of Senators Obama, Clinton and McCain. in breach of the Privacy Act of 1974.

Section b) Conditions of disclosure states:

"No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be:
(1) to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties;"
etc.

If I asked the government to see the Senator's passports under the Freedom of Information Act I would be denied because those are private files and I have no business looking into them. And that is how it should be. Who knew that we are now also outsourcing the government?

Where these private contractors snooping just for fun? Or where they hired by a ring of identity thieves? Let's consider the possibility of political gain. What if they steal passport, SSN, and other private info then register a credit card in the name of one of these candidates and make a reservation with the Emperors Club VIP then leak it to the press?

How many thousands of passports have these people been looking into? Yours? Mine? WHat if they are gathering all sorts of private info for the purpose of identity theft? (See: FAQ: The passport breach: What exactly is in those records?).

Secretary Rice has apologized to the candidates. Will she go on a press conference on national TV and apologize to the American public for this breach? I doubt it will happen. An internal investigation has been started by the State Department. What about the Attorney General getting involved? He should do so and prosecute these people, and their employers, to the full extent of the law. Congress should also get into the act. Congressman Henry Waxman has already asked for the names of the companies and persons involved. If our government does not protect our privacy, who does?

Using Google to Crack Hashed Passwords

This interesting article teaches (again) the value of using good passwords. This attack would not need searching for a hash. A dictionary attack would do too with such a lousy password. Will they ever learn?

Note: Also bad on the part of WordPress for not salting their passwords.

(Via Bruce Schneier)

Security experts: NIST encryption standard may have NSA backdoor

From ArsTechnica:

"According to security experts, an algorithm for generating random numbers that is included in an official standard documented by the National Institute of Standards and Technology (NIST) could potentially include a backdoor planted by the NSA."

Interesting article, based on another one by Bruce Schneier.

WW II's Colossus Has Been Rebuilt

WW II's Colossus has been rebuilt. Not surprisingly, a modern PC is faster.

(Via Bruce Schneier)

Trust and the USPS website

Allun Jones, Security expert and MS MVP, wrote a 3-part discourse on security (or lack thereof) on the US Postal Service website. He shows the USPS web service for signing up to have your mail held if you are taking off for vacation and will not be home for a while. He shows us how this service teaches us some lessons in privacy and security.

Can't I trust the Postal Service? Part 1 - the crypto

(note that this page shows a problem with their security certificate, since fixed).

Alun's contention is how many people, when presented with a certificate warning would still click on it and go on. Lesson: if you cannot trust the site's security certificate, you should not continue to the web site.

Part 2 - the certificate, talks about inspecting the security certificate, something you should not do unless you are a security researcher and understand what's going on.

In Part 3 - the service Alun finally talks about the service they are providing. You are requesting your mail to be held. You should be required to provide some form of ID to certify that you in fact have the right to do it. You do this when you go to the Post Office in person, right? Why is this important? Try identity theft.

Good series Alun!