Linux Security Week - April 16th, 2007

Hash functions are an excellent way to tie together various parts of a protection mechanism. Our first mesh design pattern, hash-and-decrypt, uses a hash function to derive a key that is then used to decrypt the next stage. Since a cryptographic hash (e.g., SHA-1) is sensitive to a change of even a single bit of input, this pattern provides a strong way to insure the next stage (code, data, more checks) is not accessible unless all the input bits are correct.

news/cryptography/mesh-design-pattern-hash-and-decrypt

To maximize the effectiveness of encryption in providing effective security assurance solutions, organizations must deploy it as part of a defense-in-depth security stance. Like any technology, encryption is plagued with pitfalls, mistakes, and traps that could easily provide an organization with a false sense of confidence in its security, while still allowing attackers to easily compromise the organization~Rs data. The common pitfalls, mistakes, and traps that an organization implementing encryption must avoid are:

news/cryptography/the-secrets-of-laptop-encryption

Once in a while I get requests from blog readers for recommendations on security education. I am obviously biased because I offer training independently, in private and public forums. However, I've attended or spoken at just about every mainstream security forum, so I thought I would provide a few brief thoughts on the subject.

PHP bug hunter Stefan Esser says he feels vindicated after his successful Month of PHP Bugs project which ran through March.

The project, which aimed to highlight flaws in the PHP source code, uncovered 44 bugs, although Esser said the real number was 41, because three bugs were not in PHP code itself. These, he said, were a "bonus".

Counter-attack stories come and go, but this time it's supported by the courts. The question was whether the defendant's 4th Amendment rights against unreasonable search and seizure were violated by the campus system administrator logging into his dorm computer without authorization. Campus police and the administrator then followed up by visiting the dorm room and gathering evidence.

Imagine all of your network and security devices working as a unit to enforce security policy. That's the vision of "cooperative policy enforcement," an emerging concept being promoted by Aventail.

Aventail late this summer or early fall will add SOAP-based interfaces to its SSL VPN gateways that will support cooperative policy enforcement among its products and other networking and security tools, Dark Reading has learned.

Securing the data that employees carry around as they go about their daily business is priority No. 1 for businesses today. The stakes are high: Data loss is just the kind of incident that can give a business all kinds of publicity for all the wrong reasons.

Peggy Jones, a business manager for the information-management team at the College of Southern Maryland, was asked recently to help dispose of what she now estimates were about 1,200 old backup tapes and cassettes her IT organization had been storing in a relatively well-fortified walk-in vault.

news/privacy/the-fine-art-of-data-destruction

Despite some improvements, the State Department still falls short in its information security efforts, according to a new report from Inspector General Howard J. Krongard.

Nearly half of the 34 departmental posts and bureaus audited by the inspector general from April to September 2006 displayed shortcomings in IT security, according to the report.

news/government/state-comes-up-short-on-information-security

The Sdbot and Gaobot families are responsible for most botnets worldwide. These two families were responsible for 80 percent of detections related to bots during the first quarter of 2007. Other culprits, although on a much lesser scale, included Oscarbot, IRCbot or RXbot.

news/hackscracks/two-worm-qfamiliesq-make-up-most-botnets

Due to the interactive nature and required access to exploit, local privilege escalation vulnerabilities have traditionally been thought to have a minimal impact on the strategies enterprise IT departments incorporate to protect networks when compared to other code execution vulnerabilities.

news/hackscracks/hot-or-not-local-privilege-escalation-vulnerabilities

Security organizations are tracking what's being described as the largest email attack since last year's Warezov outbreak, and the second onslaught this week to steal a page from the Storm Trojan's playbook.

Adam Swidler, senior manager of solutions marketing for San Carlos, Calif.-based security vendor Postini Inc., said bot herders are using the outbreak to expand their array of zombie machines.

news/hackscracks/malware-outbreak-largest-in-almost-a-year-52308

Cyber criminals will increasingly target smartphone and PDA devices, according to the latest Global Threat Report from security vendor McAfee.

The global smartphone market is expected to exceed $250bn (126.5bn) by 2011, according to research firm In-stat. With more people using such devices to access personal and financial information, there will be more instances of phishing attacks, spyware, and identity theft, according to the report.

news/hackscracks/cyber-criminals-to-increasingly-target-mobile-devices