InfoSec News

For the second time in two months, Mozilla has rushed out a fix for Firefox to patch a problem with a browser update issued just days before.
 
I've been out of touch the last month or two with special projects and vacation so today was my day to catch up on some old email. One item that caught my interest is an update to one of Mandiant's free tools, Web Historian to version 2.0. If you are an incident responder or forensic investigator Web Historian may be of interest to you.
Web Historian is a great tool for collecting and analyzing web browsing history information. The original version of this software dates back a few years to when Mandiant was still RedCliff and was showing a little rust. The new version is a complete rewrite and redesign of this popular tool. This version of Web Historian has a bunch of new features and supports Firefox 2/3+, Chrome 3+, and Internet Explorer versions 5 through 8.
For more information about Web Historian 2.0 see the Mandiant Blog.
To download and try Web Historian 2.0 go to the download page.

-- Rick Wanner - rwanner at isc dot sans dot org - http://rwanner.blogspot.com/ (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
There is nothing new on the issue of unsecured sensitive data traveling across the network in plain-text. In fact, many popular websites use SSL to crypt information because they became aware of the man in the middle attack, soowners secured their webpages to avoid the attack.
Unfortunately, there are many companies that thinks nothing will happen if they use plain-text to send logon information. You can say there is noproblem with hashed passwords, but they are not enough. Rainbow tables are widely used so if a hash is grabbed from the network, it will be cracked in no time.
Delivering SSL and authenticating both ends might be a cheap and reliable solution for this. Yes, I know SSL is vulnerable to Man-in-the-middlleattacks,but it you authenticate certificates on both ends and pay attention when something like this appears, the risks is adecuately minimized:


How many of us have clicked directly into continue to this website without paying attention on what is the error in the certificate?
I have seen universities where students capture professor's usernames and passwords and start to sell grade changes. I have seen many hijacked e-mail accounts on ISPs that doesn't crypt logon information.
These controls are easy to deploy: IIS hasSSLclient certificate authenticationand Apache also implements it. If you use all the available security functionality you have in your IT infrastructure,you will minimize many information security risks like this one.
-- Manuel Humberto Santander Pelez | http://twitter.com/manuelsantander| http://manuel.santander.name| msantand at isc dot sans dot org (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
-- Rick Wanner - rwanner at isc dot sans dot org - http://rwanner.blogspot.com/ (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
-- Rick Wanner - rwanner at isc dot sans dot org - http://rwanner.blogspot.com/ (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 

Internet Storm Center Infocon Status