FireGPG is a Firefox extension which brings an interface to crypt, decrypt, sign or verify the signature of a text in any web page, using GPG. It will support some webmails. Right now, only GMail1 is supported, some useful buttons are added in the interface of this webmail.
OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, time-based alerting and active response.
This new version comes with numerous new features, including support for Microsoft IIS 6, Cisco VPN concentrator, Cisco PIX VPN AAA, Cisco FWSM and Solaris 10 “su” logs. We also added more granular e-mail alerting options, a new Windows agent installer, more advanced log analysis rules options and much more.
Source: Dark Reading - Posted by Eckie Silapaswang
Renowned researcher HD Moore and startup BreakingPoint Systems's "baby" has finally arrived -- the company is launching its new all-in-one network and security testing appliance that Moore helped build.
MARCH 1, 2007 | ARLINGTON, Va. -- Black Hat DC -- Experts agree: The best way to secure applications is to build security in during the development phase. The problem is that there are few standards or templates for doing it.
But that situation is about to change, according to speakers at the Black Hat conference here today. In fact, draft guidelines for specifying common security weaknesses and common attack patterns could be just weeks away.
While there're lots of pros and cons to consider when it comes to automated source code scanning, Fortify's pricey automated source code analysis tool has the potential to prevent the most common vulnerabilities while the software's still in the development phrase. Recently, they've added 34 new categories of vulnerabilities to their product:
OSSEC HIDS is an Open Source Host-based Intrusion Detection System.
It performs log analysis, file integrity checking, Windows registry monitoring, rootkit detection, time-based alerting and active response. It runs on most operating systems, including Linux, *BSD, Windows and Mac.
This version comes with numerous new features and bug fixes, including support for registry monitoring on Windows, dynamic/nat'ed IP addresses in the server/agent communication, ASL (Apple system log), Lotus domino
, Symantec AV, Windows RAR.
Code auditing firm Fortify Software announced on Monday that the company is teaming up with quality-testing project FindBugs to offer a free scanning service to any Java programmer aimed at automatically detecting quality defects and security bugs. The project, dubbed Java Open Review, will allow any project written in Java to be submitted by a contributor to be scanned using both Fortify's auditing tool and the FindBugs engine. The two organizations have already scanned ten open-source projects written in Java, including the Azureus Bittorrent application, the Zimbra Web e-mail server, and the Apache Tomcat Java server.
Source: Net-Security.org - LogError - Posted by Benjamin D. Thomas
Cybercrime has evolved considerably over the past few years with new technologies being created and applied. As a result, cybercrime is no longer committed by individual amateurs; it’s become a lucrative business run by highly organized groups. This article includes an analysis of what kind of virtual property is attractive to cyber criminals and what methods are used to obtain user data.
OSSEC HIDS is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, rootkit detection, time-based alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, Solaris and Windows.
This new release comes with multiple features, including support for
Modsecurity logs, MS exchange, MS FTPD and Windows firewall logs. It
also includes a port to HP-UX and numerous bug fixes and new
features.
When an application error occurs, whether due to user input or an internal function, we as conscientious developers want to present an error message that will help the end user correct the problem. However, it is possible to be too helpful with your error handling approach. By providing overly detailed application error messages to your users, you can actually be opening your site to hackers. Hackers spend the majority of their time performing reconnaissance on a site, slowly gathering multiple pieces of information to determine how a site is vulnerable. Sometimes, it is a seemingly innocuous piece of information in an application error message that provides an attacker with the last piece of the puzzle necessary for him to launch a devastating attack.
