2008's biggest tech crime stories!

As the year 2008 draws to a close, here are some of the biggest IT related crimes which i chanced up on in Network World site.

http://www.networkworld.com/slideshows/2008/121508-year-in-cybercrime.html?ts0hb&story=ts_crime08

OWASP Testing Guide V 3.0 is avilable now!

The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. OWASP team mission is to make application security "visible," so that people and organizations can make informed decisions about application security risks. Everyone is free to participate in OWASP and all of OWASP materials are available under a free and open software license.

To download the latest version (V 3.0) of OWASP testing guide click on the below link:-

http://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf

 

Fix for unpatched internet explorer flow

Fix for my previous blog related to internet explorer has been released

The patch details & download information can be found at :

 http://www.microsoft.com/technet/security/bulletin/MS08-078.mspx

American Express web bug exposes card holders!

XSS: Entrenched since November 2008

A glaring vulnerability on the American Express website has unnecessarily put visitors at risk for more than two weeks and violates industry regulations governing credit card companies, a security researcher says.

Among other things, the cross-site scripting (XSS) error on americanexpress.com allows attackers to steal users' authentication cookies, which are used to validate American Express customers after they enter their login credentials.

For more information related to this XSS attack refer below link:-

http://www.theregister.co.uk/2008/12/16/american_express_website_bug/

Unpatched Internet Explorer Flaw Allows Attacks!!!

A security flaw in all versions of Microsoft's Internet Explorer leaves users wide open for attack, with millions of computers already infected. Microsoft did not say when a patch might be available. Simply opening a Web page in IE can infect an unprotected computer. Proper security protection, not a browser switch, is the best defense.
The exploit doesn't require users to click on links or download software from the Internet. Rather, it infects users when they open a Web page. The goal is to steal passwords, according to security experts, gain access to financial data and otherwise steal the victim's identity.

To know more about this refer:-

http://www.enterprise-security-today.com/story.xhtml?story_id=100003G53BD4

Metasploit Framework 3.2 Released

The Metasploit Project announced today the free, world-wide availability of version 3.2 of their exploit development and attack framework. The latest version is provided under a true open source software license (BSD) and isbacked by a community-based development team.

Metasploit runs on all modern operating systems, including Linux,Windows, Mac OS X, and most flavors of BSD. Metasploit has been used on a wide range of hardware platforms, from massive Unix mainframes to the iPhone. Users can access Metasploit using the tab-completing console interface, the Gtk GUI, the command line scripting interface, or the AJAX-enabled web interface. The Windows version of Metasploit includes all software dependencies and a selection of useful networking tools.

The latest version of the Metasploit Framework, as well as screen shots, video emonstrations, documentation and installation instructions for many platforms, can be found online at :-

http://metasploit.com/framework/

Social Engineering: 8 Common Tactics

Most articles I’ve read on the topic of social engineering begin with some sort of definition like “the art and science of getting people to comply to your wishes”, “an outside hacker’s use of psychological tricks on legitimate users of a computer system, in order to obtain information he needs to gain access to the system”, or “getting needed information (for example, a password) from a person rather than breaking into a system”. In reality, social engineering can be any and all of these things, depending upon where you sit. The one thing that everyone seems to agree upon is that social engineering is generally a hacker’s clever manipulation of the natural human tendency to trust. The hacker’s goal is to obtain information that will allow him/her to gain unauthorized access to a valued system and the information that resides on that system.

Security is all about trust. Trust in protection and authenticity. Generally agreed upon as the weakest link in the security chain, the natural human willingness to accept someone at his or her word leaves many of us vulnerable to attack. Many experienced security experts emphasize this fact. No matter how many articles are published about network holes, patches, and firewalls, we can only reduce the threat so much... and then it’s up to Maggie in accounting or her friend, Will, dialing in from a remote site, to keep the corporate network secured.

I was searching for some information related to social engineering in the net. I found some good interesting social engineering tactics at networkworld.com (A very good site, normally I refer to update myself).Thought of sharing with you guys...

Click on the below link to get an idea of the most prevalent social engineering tricks used by phone, e-mail and Web.

http://www.networkworld.com/news/2008/110608-social-engineering-eight-common.html