Category Archives: InfoSec

Hotmail Passwords Leaked Online – Good password policy practice, change it.

Hotmail passwords leaked online.

I am sure most of you have seen this already, but just incase here it is.

It appears the Windows Live system was hacked and as a result someone kindly posted the details of accounts on pastebin.com.

I have not seen the information myself, but apparently over 10,000 accounts from A – B where posted. So if you do fall into this category or even not it might be a good idea to change your password if your not doing this on a regular basis already.

Update : It is now believed that Google Mail, AOL, and Yahoo have also been subjected to this breach.

Microsoft Security Essentials Available to All

As previously blogged I took the opportunity to get involved in the Beta of MSE and it was a good result.

Microsoft have now moved this product out of testing and making it available for everyone to enjoy. I have tried the product on Vista and W7 32 and 64bit machines, all with positive results. So if your looking for a free AV alternative, that does what it says on the tin then this is certainly worth consideration.

I just wish they did a version for WHS 🙂

Microsoft Security Essentials provides real-time protection for your home PC that guards against viruses, spyware, and other malicious software.

Microsoft Security Essentials is a free* download from Microsoft that is simple to install, easy to use, and always kept up to date so you can be assured your PC is protected by the latest technology. It’s easy to tell if your PC is secure — when you’re green, you’re good. It’s that simple.

Microsoft Security Essentials runs quietly and efficiently in the background so that you are free to use your Windows-based PC the way you want—without interruptions or long computer wait times.

Check out the Microsoft Security Essentials Web Site to learn more,.

Security Bloggers Meet Up 09 in London are proud to have Qualys as a confirmed sponsor.

As you are all more than aware in just 3 weeks time on the 20th October 2009 at the Fountains Abbey in London the RSA Security Bloggers Meet Up will be occurring. This event would not be a success without our sponsors, and we are proud to have Qualys as a confirmed sponsor.

If for some reason your not familiar with Qualys, here is some information on what they are about, and what they have to offer.

Qualys

Qualys® provides the technology that organizations of all sizes need to cost-effectively ensure that their business-technology systems and applications remain highly secure and within regulatory compliance. In recent years, the demands on companies and government agencies to keep their networks and applications secure from attacker exploits that threaten the security of their proprietary information—and the information they hold about their customers—have skyrocketed. Not only has the dependence on IT systems increased for nearly every business, but so have the financial motivations of criminals to breach those systems and applications.

The result is an increase in the sophistication of attacks that jeopardize the confidentiality, integrity, and availability of applications, data, and critical business networks. At the same time, the demands of regulatory compliance have risen dramatically, affecting nearly every organization—from small Internet merchants to multinational corporations.

Through its Software-as-a-Service (SaaS) IT security risk and compliance management solutions, Qualys makes it possible for organizations to strengthen the security of their networks and conduct automated security audits that ensure regulatory compliance and adherence to internal security policies. Qualys is the only security company that delivers these solutions through a single SaaS platform that it pioneered back in 1999—QualysGuard®.  All of Qualys’ SaaS solutions can be deployed on demand within hours anywhere around the globe, providing customers an immediate view of their security and compliance posture. As a result, QualysGuard is the most widely deployed security on demand solution in the world, performing more that 200 million audits per year.

Qualys attributes it phenomenal growth over the past 10 years to its customers, who have recognized the benefits of the SaaS model and have embraced it at the heart of their IT security and compliance efforts.

QualysGuard Security and Compliance SaaS Suite

The QualysGuard Security and Compliance Suite is comprised of the following products, all of which are delivered as a service with no new software to deploy or infrastructure to maintain:

–         QualysGuard Vulnerability Management—Qualys’ full lifecycle solution for discovering all devices and applications across the network, while identifying and mitigating vulnerabilities that make network attacks possible.

–         QualysGuard Policy Compliance—Qualys’ IT compliance solution helps organizations automate the collection of compliance data from systems and applications and tie it to corporate security policies, laws and regulations, enabling them to satisfy the requirements of internal and external auditors.

–         QualysGuard Web Application Scanning (WAS)—Qualys’ WAS provides automated crawling and testing for custom web applications to identify and remediate cross-site scripting and SQL injection vulnerabilities. The automated nature of the service enables regular testing that produces consistent results, reduces false positives and easily scales for large numbers of web sites.

–         QualysGuard PCI Compliance— Qualys’ PCI compliance application dramatically streamlines the PCI compliance process. QualysGuard PCI provides small and medium-sized businesses with enterprise-level scanning and reporting, while enabling large corporations to facilitate PCI compliance on a global scale.

The Pioneer in SaaS Security Solutions

Qualys was founded at the height of the technology bubble, in 1999, when network security was just beginning to appear on the agendas of executive management meetings around the globe. The company launched QualysGuard in December 2000, making Qualys among the first entrants in the vulnerability management market. QualysGuard moved to market with a powerful combination of its highly accurate and easy-to-use scanning technology and a revolutionary new approach to delivering security applications, which now is called “Software-as-a-Service.”

Early skeptics of Qualys’ SaaS delivery of security applications now embrace the on demand power and flexibility of SaaS and credit it with changing the economics of security while also helping to drive further consolidation among large, legacy software vendors. Cloud computing and SaaS are entering mainstream with security vendors of all sizes flocking to adopt this new disruptive model as it provides superior technical capabilities and significant economic advantages over enterprise software solutions.

Philippe Courtot, CEO and Chairman of Qualys, is one of the few entrepreneurs who believed in the SaaS model and pioneered at Qualys for delivering enterprise security applications. In his keynote at RSA Europe 2009, Courtot will discuss the impact of cloud computing on the IT industry and the changes it brings to the enterprise security landscape and to the security professionals.

RSA Security Bloggers Meet Up 09 – 3 Weeks Away

RSASBM09

The RSA Security Bloggers Meet Up is only 3 weeks away, so if your a security blogger, reporter or media type and want to attend don’t forget to email bloggermeetup[at]securityactive.co.uk to register your attendance, there are only 50 spaces.

The venue for this even is The Fountains Abbey in London just down the road from the Hilton Metropole where the conference is happening. We will be there from 7:30 PM onwards in the upstairs meeting room, on the 20th October 2009.
FountainsAbbey

If your looking to sponsor the event there is still a short amount of time remaining to get involved (payments need to be received by the 14th October 2009), get in touch at the above email address if your interested.

See you there it should be fun.

We are proud and grateful to have the following organisations sponsoring  this event:

Qualys

IronKey

ISACA

Chris Gates – Open Source Information Gathering – BruCon 2009

This is the second of my 3 videos recorded at BruCon 2009.
This is the excellent presentation from Chris Gates on Open Source Information Gathering.

Abstract: This talk is about using the current open source tools to generate a detailed target footprint for a blackbox penetration test. Suppose for our penetration test we are given nothing but a domain name. Client-side and Social Engineering attacks are in scope, but we’re on our own to come up with all the information needed to execute those attacks (just like a real attacker would be required to do). The days of running Sam Spade or simply querying a whois server for the totality of your information gathering are dead. We need to leverage all the information freely available to us on the net to build both our network attack list as well as our client attack list. This information includes network ranges, hidden company affiliations, hostnames, dns information, public documents with their metadata and email addresses for client side attacks.

Also to learn more about Chris and what hes up to check out his website.

Chris Gates – Open Source Information Gathering – BruCon 2009 from Dale Pearson on Vimeo.

Presentation Slides – Click Here

:: Please do not copy this video without written permission of Security Active or Chris Gates | Linking to is fine ::

Jayson E. Street – Dispelling the myths and discussing the facts of Global Cyber-Warfare – BruCon 2009

This is the first of my 3 videos recorded at BruCon 2009.
This is the excellent presentation from Jayson E. Street on Dispelling the myths and discussing the facts of Global Cyber-Warefare.

Abstract: There is a war being raged right now. It is being fought in your living room, in your dorm room even in your board room. The weapons are your network and computers and even though it is bytes not bullets whizzing by that does not make the casualties less real. We will follow the time line of Informational Warfare and its impact today. We will go deeper past the media hype and common misconceptions to the true facts of whats happening on the Internet landscape. You will learn how the war is fought and who is fighting and who is waiting on the sidelines for the dust to settle before they attack.

Jayson has an excellent book coming out called “Dissecting the Hack: The Forbidden Network

Also to learn more about Jayson and where he is talking check out his website.

Jayson E. Street – Dispelling the myths and discussing the facts of Global Cyber-Warfare – BruCon 2009 from Dale Pearson on Vimeo.

Presentation Slides – Click Here

:: Please do not copy this video without written permission of Security Active or Jayson E. Street | Linking to is fine ::