Security Stallions Blog "Musings of all things infosec…"

Daily Digs – 08.03.2009

Welcome to the 3rd production of Daily Digs here at Security Stallions!  It's been a long weekend with a relatively active Monday.  We've got a slew of links for your enjoyment with almost-short-as-a-Twitter-update commentary to go along.

First of all I'd like to say that knowledge sharing is the key to >80% of what I've learned in the security industry.  From the simple cases where I'm tipped off via a quick blurb on Twitter or all out full-disclosure, you just can't beat community sources.  That being said Russ McRee has a great post over on HolisticInfoSe.org about his and Mike Bailey's talk around CSRF.  Although Russ mentions vids in the post he didn't link them, so I did a bit of quick digging and found them - just for you.  Hit up the links for more info.
[CSRF: Yeah, it Still Works]
[Netgear CSRF Attack Video]

UCSniff's authors Jason Ostrom and Arjun Sambamoorthy also presented at DEFCON 17 this year.  The tool, which was previously only available via BackTrack3, has been more recently released as a SourceForge project with some significant new featureset.  Another one for the toolbelt!
[UCSniff - UCS Attack Tool]

There's an article up on Silicon about CEOs needing to be less negligent with regards to security.  Very true, so if you like to chase the rainbow the article can be had below.
[Optimistic CEOs Must Not Neglect IT Security]

Ryan Naraine is one of the first to break the story on ATM skimming at DEFCON this year.  He goes on to tell us how Chris Paget of Google got scammed for $200 when debiting his account.  Note to all: get your cash at a reputable banking institution (i.e. where ATMs are built into the wall of the bank), in a casino, or somewhere else security of money transactions would be extremely high.
[Fake ATM Skimmers Found in Las Vegas Hotels]

Do you know what Ippon means in Japanese?  Well you better -- it's "game over", and it's the name of a new tool for exploiting automatic updates.  Yes, this isn't anything earth shattering in terms of the base exploit, however the methods the tool can "win" at the game of insecure updates are pretty kick ass.  Read more about it over at the following TechRepublic blog post.
[Automated Updates: May Not Be Such a Good Idea]

File this one under the category of "About Damn Time" and you have Mikko Hypponen dropping news of Twitter starting to inspect and reject malicious URLs.  Although the article doesn't mention it Twitter is actually using Google's Safe Browsing API.  It's a (slow) start, but at least it's a start!
[Twitter Now Filtering Malicious URLs]

There's an interesting post by Susan Brenner over at CYB3RCRIM3 about whether or not we should reconsider the notion that companies under attack are prohibited from investigating the attackers and trying to locate them.
[Private Cyber Investigators]

Addonics announced an inline hardware encryption solution for most any SATAI/II type drive system.  What's great about the design is that there's also a removable cipher key to unlock operation of the unit and it is also small enough to be mounted in a 3.5" drive bay. The CCM35MK1 is also NIST and CES certified.
[Versatile Hardware Encryption for any Computer]

Although not directly related to security, but big news none the less, VoloMedia has somehow received a patent for podcasting.  Really?  Who works in the patent offices?  Surprisingly, this hasn't been on many people's radar judging from Twitter activity today.  Slightly odd considering everyone and their brother seems to have a podcast these days!
[Company Receives Patent for Podcasting]

And tonight we'll leave you with what will, from now on, be referenced as the grab bag.  News that's worthy of reading, but we just didn't have time to comment on.

The links for the grab bag tonight are as follows...
[Hacking Surfpoint Terminals]
[DEFCON Air Traffic Control Hack]
[High-Security Locks Defeated]
[Opensourc3 Magazine Publishes First Issue]
[PayPal Suffers Outage]
[5 Tips to Stop Staff Snooping]

As always, thanks for stopping by and comments are always welcome!

--windexh8er