InfoSec News

F5 Networks announced two new storage virtualization appliances that are designed for entry-level and midrange businesses.
 
PMC-Sierra today released two new entry-level RAID controllers for SATA and SAS hardware that sport 6Gbit/sec throughput.
 
Mozilla plans to update Firefox for the Mac to deal with a bug affecting the browser in Apple's soon-to-be-released Lion operating system.
 

FPT to co-operate with Nigerian business
VietNamNet Bridge
CMC Information Security Corporation (CMC InfoSec) yesterday launched CMC Mobile Security, a free anti- virus software on mobile phones. The software will be applied for the Android operating system with simple, user-friendly interface. ...

 
Three days ago a new version (v3)of Jailbreakme (aka jbme3.0), the website used to jailbreak Applie iOSdevices (such as iPhone, iPod Touch and iPad), was released. The site takes advantage of userland-based exploits to take full control of these devices by simply visiting a web page. This v3 version makes use of a 0-day PDFvulnerability on a first stage, and a iOS kernel vulnerability to elevate privileges on a second stage.
These vulnerabilities affects multiple Apple devices and versions, up to iPad2 and iOS4.3.3.
As far as we know, Apple has not released an official update yet against these vulnerabilities (although it's working on it), so all devices are at risk. If you have a jailbroken device, it is recommended to install PDF Patcher 2 from Cydia to eliminate this risk (any firmware version). More details on the Dev Team blog:http://blog.iphone-dev.org.
The common but not very realistic recommendation applies:do not open malicious PDFfiles or visit untrusted websites (using Mobile Safari)!Ialways wonder how end users can determine if a PDF or web page is malicious before opening it... probably those that contain the word malicious on its name or domain name :)
----

Raul Siles

Founder and Senior Security Analyst with Taddong

www.taddong.com (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
During the last few months we have talked about improvements on your SSL/TLS(HTTPS)implementation, for example through the usage of newly supported HTTPheaders, such as Strict-Transport-Security (available since Firefox 4). Besides that, and due to the fact there have been several serious CA incidents, the general public has been more aware of the weaknesses of the current Internet PKIthe digital commerce is based on.
Leaving apart the current Internet PKIand weak trust CAmodel, Iwant to mention a tool we released a few weeks back called TLSSLed. Today, version 1.1 has been released. Its goal is helping organizations to test their SSL/TLS (HTTPS) implementation for common flaws and misconfigurations on web servers /applications.
The current (version 1.1)tests include verifications to check if the target website supports the SSLv2 protocol, the NULL cipher, weak ciphers based on their key length (40 or 56 bits), the availability of strong ciphers (like AES), if the digital certificate is MD5 signed, if secure SSL/TLS renegotiation capabilities are available, details about the certificate public key length, the certificate subject and issuer (CA), as well as the validity period, plus tests for the existence of HTTP secure headers, such as Strict-Transport-Security and cookies with and without the secure flag set.
The tool can be downloaded from Taddong's labs page.
The tool is just a Linux shell script, so Iencourage you to inspect it, and contribute improvements and new tests (you can simple send me an e-mail or add comments below). Future versions will incorporate them.
Time to improve your web sever / application SSL/TLS(HTTPS)implementation!
----

Raul Siles

Founder and Senior Security Analyst with Taddong

www.taddong.com (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Internet Storm Center Infocon Status