News

Outlook Calendar Printing Assistant

The Microsoft Outlook Team released a standalone tool for printing calendars from Outlook 2007 - The Outlook Calendar Printing Assistant

It has a variety of useful templates that have nice layouts. Useful for making wall calendars, or conference room schedules and much more.

Download it here

WPA Vulnerability

Numerous articles have been circulating about an annoucement made by researchers claiming to be able to break WPA in 12 minutes. While the paper seems to be valid, it is not exactly as has been reported. Erik Tews and Martin Beck found a way of breaking the TKIP component of WPA, which was known to be imperfect.

  • They were able to read the traffic being sent from the router to the client, not the other direction as of yet.
  • It only affects networks using TKIP, not those using AES.
  • WPA2 is not a guaranteed fix. Many vendors implemented TKIP in WPA2, and many operated in a mixed TKIP/AES mode by default.
  • All WPA networks are not broken. Many vendors optionally implemented AES in WPA.
  • Enterprise networks that use EAP/PEAP/LEAP are not relying on TKIP and not at risk from this vulnerability.

More in depth information from Errata Security and Schneier on Security.

Securing Your Web Browser

Came across an excellent article in my reading today detailing how to secure the three most common browsers in use. This is rather important reading for both individuals and IT professionals, as proper precautions are in order for anyone voyaging the tubes of the Internet.
 
 
Nowadays, simply viewing a web site is enough to have your machine compromised and enlisted for nefarious use in some miscreant's botnet. For example the Kraken Botnet is now double the size of the previous  title holder - Storm and it is believed the method used to infect victims is by way of a false image file.  Similarly, another common technique  used by malware distributors is to purchase banner advertisements from brokers that sell placement on well known, and apparently legitimate, websites. No longer is it safe to stick to reputable and well-known sites.
 
Protect your browser, practice safe computing.
 
Thanks to ts/sci security, and be sure to check out their article, as well as their previous posts on the topic.
 
Threat References:

Browser Color Coding For Security

The IE7 development team has introduced a new browser concept based on color coding the address bar that should enable users to better protect themselves on the net. Currently most users are used to the idea of looking for the padlock icon on the status bar to know if they have a secure connection and some browsers out there also change the address bar to a different color (yellow in FireFox) to show SSL status. The next evolution of this idea is to have several color codes to represent different security levels (green for newer "high-assurance" SSL certificates, yellow for suspected phishing site, red for known fishing sites). Another improvement to go along with this idea is to show the organization name alternating with the certificate authority from the certificate on the address bar at the same time. I believe that this will ultimately result in users having a much better understanding of what it means to use a secure connection, expect this more often, and the implications of different certifying authorities. IE will also always show the address bar when new windows are opened so that the user can always see this information (and preventing sites from hiding their location from you with menu-less windows).

Since this was previewed on the IEBlog, there has been discussion between the various browser developers out there to coordinate and standardize this behavior - an excellent example of when competition & cooperation come together for the benefit of the consumer.

Read more at IEBlog

VMWare Installation Tutorial

Network Physics has created a nice straightforward turorial on installing VMWare Server on Windows XP. Complete with copious screenshots from downloading & registering for a serial number all the way through configuring networking. If you haven't used VMWare Server before, or other virtualization products, some of the pieces can be a little confusing. This will get you up an running, ready for your first virtual machine.
 

Hash Function Competition

In the past couple of years a number of researchers have been slowly (but at an increasing pace) finding weaknesses in both MD5 & SHA-1 families of hash functions. While the current state of these attacks doesn't pose a major threat today, it does make it clear we need to develop new hash algorithms quickly. NIST (keepers of the FIPS) have initiated a competition for replacement (in the same fashion as the competition that resulted in the AES standard). In the meantime they have stated that the SHA-2 family (SHA-224/256/384/512) may be used by federal agencies, and that they should stop using SHA-1. After 2010, the use of SHA-2 is mandated.

Related Articles:

NIST Announcement and Recommendations:
Wikipedia Refs:

License Updated

Creative Commons released a new revision of their licenses this week. Overall just a minor maintenance upgrade. Detail items include a explicit clarification that when you use a CC licensed work, the Attribution to the original author doesn't mean an endorsement by them. Other changes include creating a separate generic license not specifically tied to US jurisdiction and finally the ability to re-mix and then release CC works under a non, but CC-compatible license.

User's and Their Passwords

Since you have put in so much effort on protecting and securing you network, here's a quick read over at Schneier's blog on how far the user's value your efforts.
 

MS Updates for December

Microsoft has released their patch bundle for December, comprised of two patches. Included in the IE patch (MS05-054) is a fix to the previously mentioned JavaScript flaw, as well as several others rated as critical. Additionally if you have been following the Sony DRM fiasco, the fix released by Sony left a security hole behind that allows websites to install software (and is being used in the wild), the IE patch specifically addresses this issue also.

MS05-055 fixes a local kernel exploit that allowed a locally logged on user to elevate their priviledges.

Zero Day IE Exploit

Sample exploit code was published that takes advantage of a known JavaScript hole in Internet Explorer. It allows for arbitrary execution on the host machine by simply viewing a webpage. I does not require any interaction from the user. The sample code demonstrates the exploit, but simply opens calc.exe. Understand that the hole allows for pretty much any code to be executed, including downloading remote control apps, keyloggers and worms. Complete compromise by viewing a web page!

Syndicate content