Dissecting The Hack

An Information Security Community

February 2011 Blog Posts (10)

The new Cyber Security Strategy for Germany

The German Department of the Interior has recently published its new Cyber Security Strategy for Germany (german version here).

Whether it's good or not that a government is…

Continue

Added by d3tm4r on February 26, 2011 at 2:30pm — 1 Comment

RTFOSSTMM!

this is partly a re-post of my blog at kamerazukleber.tumblr.com:

I am following many discussions on pentesting, including that one in @pauldotcom EP225. About how customers order pentests for the wrong reason (compliance checkboxing), how the word “pentest” has lost it’s original meaning and the question what we should call it instead, what penetration testing shall concentrate on, how the results shall be presented, about…

Continue

Added by d3tm4r on February 23, 2011 at 11:19am — 1 Comment

Closing the loop

…

Continue

Added by Leon van der Eijk on February 21, 2011 at 8:23am — 5 Comments

Interesting Registry Keys with FakeAV Infection

So there I was (don't you love it when a story starts like that?), arriving at work recently when I was asked to look at a co-workers laptop that was infected with a fake antivirus program. Another co-worker had already done what I would have done, in that he ran MalwareBytes (MBAM) on the machine. However, I was surprised that MBAM hadn't even detected the infection. Neither had the installed real antivirus, Microsoft Security Essentials.…

Continue

Added by Ken Pryor on February 17, 2011 at 7:41pm — 1 Comment

Intrusion Detection Mindmap Version 0.4

I just added Judy Novak to the "IDS hall of fame" of my Intrusion Detection Mindmap.

She definitely deserves a place in anybody's IDS hall of fame. ;-)

The mindmap can be downloaded here.

Just save it as IDS.mm and open it in the mindmapping tool of your choice. I personally prefer Freeplane.

If you have valuable…

Continue

Added by d3tm4r on February 17, 2011 at 3:14pm — No Comments

Don't think you are! Know you are!

This is what Morpheus said to Neo in the movie "The Matrix". And it's so very true regarding information security.

Intruders don't care about what you're thinking about your network security. They just peek and poke until they find a hole that you would not have thought existed.

Check! Your! Facts! Know your network. If you're not sure - just check, don't speculate!

It's the same for general troubleshooting problems and for information security. I am seeing…

Continue

Added by d3tm4r on February 15, 2011 at 4:00pm — 3 Comments

Reputation or "Cloud" Based Protection - when good Ideas go bad

Since I seem to be moving from tumblr to DTH permanently, here is a re-post of an older article on a topic which I think is still important for folks to be aware of.

Reputation Based Protection is a good idea to complement classic signature based and heuristic malware detection.

Some antivirus vendors have already added cloud based reputation services to their antivirus products.

How do those services…

Continue

Added by d3tm4r on February 13, 2011 at 10:14am — No Comments

About using 0days in pentests

The folks of Pauldotcom Security Weekly podcast inspired me to write something about using 0day exploits for pentesting.

The question was, whether or not it's a good idea or fair to use those in a pentest.

My take on this is like "hell yeah!". But there are some more aspects to that topic of course, otherwise I wouldn't have considered writing a blogpost on it.

So first off, let's discuss what the intention of using 0days in pentesting might be. For me…

Continue

Added by d3tm4r on February 13, 2011 at 9:00am — 2 Comments

Oh, a computer virus! Let’s just delete it…

From my experience, people just recognize those security breaches that are kind of “in your face” or get big press.

“Oh, a worm just took down all of our servers. We’ve got a problem!”

“Oh, a virus has infected all of our PCs. Let’s quickly delete it!”

“Oh, chinese hackers have pwns0red several companies. But we are fine because we’ve got IDS, IPS, Antivirus, Anti-Spam, DLP and ‘til now…

Continue

Added by d3tm4r on February 12, 2011 at 12:30pm — No Comments