The Scrap Value of a Hacked PC, Revisited

Interesting post that explain simply and visually to the sort of computer user who can’t begin to fathom why miscreants would want to hack into his PC. “I don’t bank online, I don’t store sensitive information on my machine! I only use it to check email. What could hackers possibly want with this hunk of junk?,” are all common refrains from this type of user.

http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/

Comparison of MDM Providers

A comparison among the various Mobile Device Management providers.

http://enterpriseios.com/wiki/Comparison_MDM_Providers

Vyatta: open source network operating system

Something I will play with, once I will have some time left...



Copy&paste from their Web site http://www.vyatta.org/:




"The free community Vyatta Core software(VC) is an award-winning open source network operating system providing advanced IPv4 and IPv6 routing, stateful firewalling, IPSec and SSL OpenVPN, and more. When you add Vyatta to a standard x86 hardware system, you can create an enterprise grade network appliance that easily scales from DSL to 10Gbps. Vyatta is also optimized to run in VMware, Citrix XenServer, Xen, KVM, and Hyper V, providing networking and security services to virtual machines and cloud computing environments."

Hotmail and Outlook Cookie Handling Vulnerability

Vulnerability allow attacker to Hijack Hotmail and Outlook accounts...

Read more on http://thehackernews.com/2012/12/hotmail-and-outlook-cookie-handling.html

SELinux Raises the Bar Against Intruders: An Introduction

SELinux: "This series will show what SELinux is and what it offers to each user."

I will watch this site for the next articles as I found the first one pretty interesting.

http://resources.infosecinstitute.com/selinux-bar-against-intruders-intro

Compressing PDF files

Adobe Acrobat allows for managing PDF files but it is a bit expensive if you are not using it on a regular basis.
MAC OS X allows for PDF files creation as well, e.g., via the "Print" menu and "Options" (PDF of course).
So what? Well... The issue is that - very often - a PDF file can be rather big in size when generated from within MAC OS X using the default and provided tools. Once sent via Email, message's size restrictions may apply (usually 10 MB) and your message may be bounced if the file is reaching this limit.
This can be particularly annoying when sending PDF attachments like work certificates, certifications and the like as it would upset the receiver who will have extra work to do to consolidate all the PDF files you sent. Furthermore, sending all the documents in a single email message is easier to fold and - if need be - to retrieve for the receiver.

A solution would be to create a ZIP archive with all the PDF documents and attach it to your email message. So far so good but the sum of all the ZIP'ed documents might well exceed the 10 MB limit, still... So, you must find a workaround and there is one that I like as it can be used not only for fixing this email's size limit but also saving some disk space on your hard drive: I am used to keep documents in PDF format for later reading or references but their resolution is rather high, as their size. Most of these documents will never be printed. I am therefore using this trick for these files.

MAC OS X "Quick Look" can compress PDF files. Lauch Quick Look against a PDF file. From the "File" menu, use "Export" but opt for the "Reduce File Size" Quartz filter option.

It is working but the quality is not that good, and sometime hardly readable.

The solution? Install additional Quartz Filters. An excellent set of free filters created by Jérome Colas http://jed.iconus.ch/wp-content/uploads/2010/01/jcolas_filters.zip (Jérome's filters were previously hosted on idisk but as this service has been closed, some people are offering the same archive for download: jed.iconus.ch is one of them, thanks a lot)

For Snow Leopard and older versions, extract the ZIP archive to the user's Library. Restart Quick Look to enable the new filters.

For Lion and above, extract it to System's Library into the PDF Service folder.


A quick recap of what the library folder is and why you might want to access it. Mac OS X actually has three different Library folders:

1. One located at the root of your hard drive
2. One located in a folder called System at the root of your hard drive
3. One located in every user’s home folder

To access the system's folder.
In the Finder use the "Go" menu  or simply press Command-Shift-G to bring up the Go to Folder dialog. To access the User Library, type in ~/Library and click Go. It is possible to type the path to any folder into this dialog. To access the System Library, type in /Library (without the ~).

Using the new Quartz Filters in Quick Look (Export menu)
Don't hesitate to experiment a bit first with a test PDF file...

Note that the Colorsync application can be used to create your own filters.

CISA quizz engine (for a fresh CISSP)

Just for information and maybe comments or remarks (I kept them open on this post). 

I passed the CISSP exam this year (early August 2012). While preparing for the exam I registered with cccure.org and subscribed to their Quizz engine https://www.freepracticetests.org. 

When registering with this site you are entitled for - of course - the CISSP quizz engine practice tests, but not only: you can train on several other certifications as well, like:

• Security+ SYO-301
• CEH V7
• ISSEP
• CISA
• ECSA/LPT
• HIPAA
• Sarbanes-Oxley 
• SSCP

I did a bunch of CISSP quizzes and it helped me a lot (my point of view).

Incidentally I did connect this site again today (Nov. 2012) as my subscription was still valid and I launched a CISA quizz with difficulty "Pro" (mimic the real exam). Guess what... I performed with more than 80% of good responses without opening any CISA study material (and reading, understanding, remembering... anything else?).

Wow ! It seems that studying for 6 months on the CISSP is paying back. FYI I didn't opt for a bootcamp style approach but rather a more traditional track: reading Shon Harris AOI from cover to cover and taking notes for future references.

I think I am going to register for the CISA exam...

P.S. After all, CISSP seems to be a good certification, isn't it ? 

(please no *troll* like "CEH" or "SANS" is better. CISSP is not to be compared with these ones. Not because CISSP is better or worst but simply because they are not targeted for the same audience. If you cannot understand that then just FOAD).

Addendum: 

For those interested here is a copy&paste from the cccure.org forum post I did after passing the exam...
ref: http://www.cccure.org/ftopict-8824-raskal.html (I guess that you need to be registered to read this original post)

I passed the CBT CISSP August the 6th 2012 in Zurich - Switzerland (1st attempt) and I am pleased to provide some feedback to the community.
This is my point of view, your mileage may vary (and it will).

Materials used:

- Shon Harris - CISSP All-In-One 5th (aka AIO)
- CCCure Quizz tests (paid)
- Did read some CCCure CISSP forums about topics I was not sure of.
- Web contents.

Planning:

1) Almost 5 months on AIO.
I did read the book cover to cover, taking notes in a notepad to review the topics, and that will be useful later on in the course of my daily bread. I also created a Quick Tips electronic document for the concepts and tricky stuff I had pain to memorize, printed it so I could quickly have a glimpse in case of doubt (if you must boot your PC to have a look at it, you are loosing time, patience, and so on). I even had some post-it sticked on the mirror of the bath room, very handy.
- Comments: I felt a bit stressed to have only read the AIO (well, it's a nice 1100 pages book though) while others are diversifying their lectures. See quizz section below for the reason...
My quick tips document is mine and I urge you to create your own. Don't rely on others you can find on the Internet: they can be outdated and for sure incomplete because what was important for the author will not necessarily match with you.

2) Additional readings

- Logical Security documents from their web site (links provided in AIO)
- Wikipedia
- Misc web sites: ISO27001 and 27002, OECD, NIST... and many more
- Materials available from the web, but created by CISSP (Google is your friend).
- Comments: pay attention to the creation/update date of the document... Try to fetch fresh material. Even on CCCure forums, look at the date of the post and cross check with other sources.

3) Last month I did the CCCure quizz

Went through 11 quizzes, 250 questions, difficulty "Pro", relativity "Closely related", timer activated. After 6 or 7 quizzes (can't remember sorry), I asked for questions I never had. I also asked a few times to be presented with questions I failed (I advise you to do this. To my surprise I was doing the exact same wrong answer, until I really got the concept).
For me, a 250 questions was meaning:
- 2:30 to 3h answering questions
- 3 to 5 hours reviewing answers (first: failed ones, then the remaining because I was not that sure I answered correctly). The good point is that very often, detailed explanations with references for additional material are provided. Plan for some long readings... It's part of the learning curve.
- Comments:
CCCure quizz engine is a valuable evaluation tool but you will not find there questions of the real exam (of course). As my only book was the AIO, I stumbled upon stuff that were not very detailed in AIO but in other books (as stated above, the quizz engine will provide you explanations and references to literature when explaining why you failed a question).
It's valuable because it helps you in assessing a "certain" level of readiness but don't feel like a n00b if you are ranking below 70%. I'd advise, though,
a) that you are reaching a fair 75% after a few tests,
b) don't rush on the quizz engine, register only when you are feeling ready to book for the exam. You will be surprised (Oh My! I'm not "that" ready...) and you will for sure dig a little bit more certain concepts or technical stuffs you missed. I even re-read complete AIO chapters... The second read is something I'd recommend because it suddenly becomes clear (you are no more in learning mode but rather feeling like reading a good book: I really enjoyed).

4) The exam

I'm based near Geneva (Switzerland) and the nearest Pearson-Vue place was Zurich (at time I was looking for to take the exam). The exam was scheduled for 9am sharp, you have to be there at least 30 minutes in advance. I spent the night in Zurich in order to be sure that I'd be able to make it for 8:30.
Before the exam: have a nice breakfast, a shower. On site: visit the toilets a few times before to be sure not be bothered with such details.
8:30: registration, about 15 minutes: NDA, palm scan, picture, signature, received ear plugs - very useful when someone in the next cubicle is frantically entering IOS CLI commands (a Cisco exam I supposed). I had a small English dictionary (scanned be the exam center rep).
- 9:00 - 12:30: first 150 questions answered, with some marked for reviews (mark for review while you are on the question, not later because you will loose time finding it afterwards).
- 12:30 : short break, cereals bar, water... (you are not allowed to eat or drink in the exam room!). If you are having a break, the counter is still ticking... So be short, but do have breaks: it really helps.
- 12:40 - 13:50: completed remaining questions
- 13:50 - 14:00: break
- 14:00 - 14:50: "marked for review" questions re-evaluation, and stop.
Yes, 10 minutes are missing. I was so exhausted that I felt not able to think properly, so I decided that it was better to stop.
About 10 minutes later, a printout was available with the so expected "Congratulations".
- Comments: I completely missed that 25 questions were test ones. I simply forgot... I think the stress might explain why. When thinking about this, I can say that 2 were obviously test questions. They were rather technical in nature even if the question itself had a "management" tone.
I should have practice reviewing questions during the CCCure quizzes. it needs to be accounted for regarding the duration of the exam.
Otherwise and overall, it was a bit focused on BCP/DRP but I'm not the only one reporting this on the forum, so no big news.

I've read that some people are perceiving the CISSP as management minded (which could triggers the idea that technical knowledges are not that needed to complete the certification).
I won't debate about this. All what I can tell is that if you are not able to master the background techy stuffs then you won't be able to understand the question, thus not able to answer properly. This is true in real life as well.

Fingers crossed for those still studying for the exam. Courage !

CISSP

Today I finally got my CISSP registration after endorsement and audit: No. 428288 

You know what? I'm happy :-) 

Linkedin SPAM

Just got a grossly fake Linkedin email. As I'm registered on this portal it may happen...

A useful hint (I hope):

When accepting new contact's request from unknown people on portals like Linkedin or Xing I'm used to keep track of when I got the request, and when I accepted it.

It may prove useful later on:

- for correlating such spam emails

- for keeping good records of my contacts' list (some people are removing themselves from your contacts' list - it's no different than Facebook). Yesterday you had 300 contacts and today "only" 299. Can you tell at first sight who's missing ? ;-)

I'll be there... :-)

Application Security Forum – Western Switzerland 2012

L’Application Security Forum – Western Switzerland (ASFWS) est une conférence annuelle dédiée à la sécurité logicielle, la protection des données et des identités numériques.

L’ASFWS se déroulera sur 3 jours grâce à un programme partageant formations et conférences.

Cette troisième édition se déroulera les 6, 7 et 8 Novembre 2012 à la technopole Y-PARC (Yverdon-les-Bains à 40 minutes de Genève).

http://2012.appsec-forum.ch/

Way Back Machine

Fancy to glimpse at a web site appearance some years ago?
I mean: how it was looking some months, or years ago?

Then head to http://archive.org and enter the web site to play with into the address bar,

click on the "Take Me Back" button. You will then be presented with a timeline on the upper part of the window, and a calendar below.

On the timeline, every vertical bar means that a snapshot has been taken. Click on a year, then chose which date you want to get back to.

On the displayed page, there is an area near the top of the window that you can use to scroll between snapshots.

Not only the first page (the home page) is archived, but all the site's content, except "attached" files (e.g.,  a PDf document that the visitor had to manually download).

Funny to flight back in the past and seeing how a site improved its design over time.

FreeBSD Ports and Packages Tips & Tricks

Listing installed ports

pkg_info

pkg_info | grep -i foo

What files are installed by a given port

pkg_info -L foo.1.1 | less

Show me duplicate ports or packages

pkg_info | sort | sed -e 's/-[0-9].*$//' | uniq -c | grep -v '^[[:space:]]*1 

Corrupted ports DB

Sometimes, the ports DB can be corrupted. It may happen following an upgrade to RELEASE-pxx and a kernel recompilation (make buildinstall and so on).
Everything is looking fine but after the last mergmaster and reboot to multi-user mode it's now time to recompile all installed ports. To do so, it usually mean that you have first to upgrade portupgrade ( portversion | grep 'needs updating' ).

portupgrade -R -r -O portupgrade

And suddenly comes troubles; even portversion is fucked up!

portversion -l '<'
[Updating the pkgdb <format:bdb_btree> in /var/db/pkg ... /var/db/pkg/pkgdb.db: unexpected file type or format -- Invalid argument; rebuild needed] [Rebuilding the pkgdb <format:bdb_btree> in /var/db/pkg ... [Updating the pkgdb <format:bdb_btree> in /var/db/pkg ... /var/db/pkg/pkgdb.db: unexpected file type or format -- Invalid argument; rebuild needed] [Rebuilding the pkgdb <format:bdb_btree> in /var/db/pkg ... /var/db/pkg/pkgdb.db: unexpected file type or format -- Invalid argument: Cannot update the pkgdb!]: Cannot update the pkgdb!]

Command failed [exit code 1]: /usr/local/sbin/pkgdb -aFQ 

Trying to repair with portsdb will not make it

portsdb -uU 

 Updating the ports index ... Generating INDEX.tmp - please wait..Warning: Duplicate INDEX entry: mod_rpaf-0.5 Done. done [Updating the portsdb <format:bdb_btree> in /usr/ports ... - 16318 port entries found portsdb:

/usr/ports/INDEX-6.db: unexpected file type or format -- Invalid argument: Cannot update the portsdb! (/usr/ports/INDEX-6.db)]

The solution is to rebuild the DB

mv /var/db/pkg/pkgdb.db /var/db/pkg/pkgdb.db_Corrupted

portsdb -ufU 

Updating the ports index ... Generating INDEX.tmp - please wait..Warning: Duplicate INDEX entry: mod_rpaf-0.5 Done. done [Updating the portsdb <format:bdb_btree> in /usr/ports ... - 16318 port entries found

.........1000.........2000.........3000.........4000.........5000.........6000.........7000.........8000...... ...9000.........10000.........11000.........12000.........13000.........14000.........15000.........16000... ..... done]

pkgdb -u && pkgdb -F

It should now be fixed.

Disregard (accept the default [no] by pressing ENTER) for linux-base, if any such message is displayed during the process.

Linux: Short on Virtual Memory?

If your Linux box is short on RAM, you can create additional swap space on the fly without even rebooting.

Within one of your partition (assuming enough hard disk space), e.g., into /var, create a new file of the desired swap space size - here: 100MB

You ought better be logged in as root in order to perform such manipulation.
Mind that such a partition will be less effective (read: swift) than a real swap partition as accessing the file system induces a latency.

dd if=/dev/zero of=/var/swap bs=1025k count=1000
mkswap /var/swap
swapon /var/swap

That's it! 

For a more permanent change, amend /etc/fstab

/var/swap   none   swap   sw 0 0

SEC4INTERNET

As IT Security practitioner, I am interested in Network & Security, Systems hardening, Audits & Compliance, and many more...