Feb 17 2010

Facebook and Security again

Category: .securityAmit Bahree @ 11:05 am

Facebook and my views of it in the context of Privacy and Security are well known. This conversation with one of their (anonymous) employees detailing a few internal processes and tools is actually quite scary.

Now, I don’t know if this is true and how much of this is true; but if I was working for Facebook then all of this is quite logical and makes sense. And, technically all the things talked about is very feasible and not too challenging (of course am over simplifying here).

I do have to admit that the perf and scalability challenges are quite interesting and would love to sink my teeth in it – I guess I need to look at PHP first. :)

Share

Tags:


Jan 06 2010

Is it time to relook at Facebook again?

Category: .live and learn,.personal,.securityAmit Bahree @ 11:52 pm

I still don’t get Facebook – despite being on it. If I want to talk to someone I will call them, email them, text them, meet them, have dinner with them – get the picture?

I am quite worried about the security and privacy elements of it – or rather the lack of it. Those who know me well (anyone?) :-) know I was not always this paranoid but after attending a few Security courses – I cannot bury my head in the sand anymore.

The main issue I have is the commercialisation of the information and it will just get more as Facebook heads to compete with Google – it is my information after all and I don’t feel comfortable sharing so much of it – even after locking it down and setting the various privacy settings. It is very easy to exploit. Take the example where Facebook changed the settings where Google by default would be indexing a lot of this information. And it is you and I as users who had to login and explicitly change a setting to stop it from doing that. Furthermore, despite all the security measures that Facebook might have in place (and they don’t mention how internally within the company walls is the information protected) all it takes is one disgruntled employee (or soon-to-be-ex-employee) to take it all and walk out the door!

The secondary issue I have is the fact that more and more of the information, friends, contacts, etc is marketing and spam (a lot of what we see on Twitter as well). I personally am (thankfully) seeing much less spam on emails these days; but on the flip side I see a dramatic uptick of spam on social site. Not sure if this is because our email spam filters are finally smart enough to work, or perhaps the spammers found the social networking sites to be richer pickings?

It is good to know that there are others out there with the same concern and with some sites such as Suicide Machine allow you to “all your energy sucking social-networking profiles, kill your fake virtual friends, and completely do away with your Web2.0 alterego” [sic]. Of course, all has not been peachy for Suicide Machine at the same time. :-)

If you are thinking like me and really giving it a go then suggest you seek some help as well to make it easier.

The irony of all of this however is that I will be posting this it to my Facebook wall and also tweeting it.

Share

Tags: , ,


Nov 27 2009

Cloud computing Risk Assessment

Category: .securityAmit Bahree @ 5:23 pm

ENISA (European Network & Information Security Agency) – phew that is a mouthful have gotten together with a number of industry leaders and released a Risk assessment for Cloud computing. I have not finished reading this and only eyeballed this, but looks good.

Share

Tags:


Nov 27 2009

Implementing malware with VMs – Subvirt

Category: .securityAmit Bahree @ 1:55 pm

Microsoft Research (MSR) along with University of Michigan have an interesting paper that showcases a new type of malware specifically for Virtual Machines and hosts running the VM’s (Hper-V, VMWare Server, etc). This malware installs a monitor underneath the host of the VMs as a Virtual Machine Monitor (VMM). All VMM’s run in Ring 0 (kernel mode).

Essentially this is similar to a rootkit and they call this a VM based rootkit (VMBR). A VMBR looks to get itself installed underneath the host and essentially runs the target OS as guest. It needs to manipulate the boot sequence to load it self before the ‘guest’ OS. This allows them to run silently with the ‘guest’ OS not even aware of their presence. Of course this makes their detection quite difficult (if not impossible) by the ‘guest’ OS.

They go on to implement a couple of prototypes which subvert both XP and Linux. The paper discusses ways to detect and prevent VMBR’s such as such as security software running even below the VMBR in an isolated layer which is not controlled by the VMBR. Another option is to boot up from a ‘safe’ medium like a ROM drive or a secure VMM which won’t stop a VMBR, but can at least help detect it.

Share

Tags:


Nov 12 2008

On Security

Category: .securityAmit Bahree @ 10:27 pm

Security is a Social ConstructionAndrew Martin

Share

Tags:


Jun 16 2006

New Worm (BlackAngel.B) spreading via MSN Messenger

Category: .securityAmit Bahree @ 4:17 am

Interesting new worm based on the likes of the movies such as the ring or feardotcom spreading via MSN. It is quite dangerous as it disables many security and antivirus software running such as antivirus, firewalls and even Windows programs like the Task Manager and RegEdit. It is easy to recognize, as you will get the following instant message – which downloads a avi (only that is an exe), when you run that your system is infected and all your contacts on MSN will be send the same instant message.

- jaja look a that http://galeon.<blocked>verti2/fantasma.zip
- mira este video http://galeon.<blocked>verti2/fantasma.zip jaja

So, be on the lookout and please do not click on that link!

More information can be found here.

Share

Tags:


May 22 2006

Amex Trojan – Beware

Category: .securityAmit Bahree @ 1:11 pm

If you use American Express, then beware there is a Trojan going around that asks for secure information when when logged into Amex’s secure site. Amex has provided a screen shot of what it looks like, check it out so you know in case you see it. You can read more on this at eweek here.

Share

Tags:


Jan 07 2006

Microsoft Journal (MSJ) Scam

Category: .securityAmit Bahree @ 12:22 am

Stephen Toub at Microsoft warns about a scam where people have been getting mailings (not emails) offering them MSJ – this a scam as MSJ is not published anymore! Don’t send them your hard earned money.   

Share

Tags:


Dec 21 2005

Santa Instant Message Worm!

Category: .securityAmit Bahree @ 5:29 pm

Beware, there is a new IM worm that promises a picture of Santa, but instead delivers a rootkit! The initial message will appear to come from someone on your IM list and will include “santaclause.aol.com/a?|” DONT click on that link! The worm is called IM.GiftCom.All. Read more here.

Share

Tags:


Dec 20 2005

Combating rootkit with rootkit

Category: .securityAmit Bahree @ 5:51 pm

While I totally agree with the concept of combacting rootkit with rootkit when it comes to the new generation of spyware, etc. (remember Sony’s need for control fiasco), but my concern is there are many lazy programmers (yours truly included) out there and most companies are in a hurry to ship a product out the door without testing as thoroughly as one should, which means when dealing at the Kernel level for most end-users it could be a experience of more BSOD’s.

Share

Tags:


Dec 20 2005

More DOS Pings

Category: .securityAmit Bahree @ 5:40 pm

Here are a few more DOS pings from last night, I think these are poor souls who don’t know they have infected machines (or lets hope so). There is one (218.201.43.148) from China belonging to someone called Ming Chen in Chongqing, might have to drop his/her ISP an email.

inetnum: 218.201.40.1 – 218.201.43.254
netname: CQ-CHONGQINGYIDONG
country: CN
descr: Chong Qing Yi Dong IDC Yong HU
descr: 40-43 Duan Qi Yong

person: ming chen
nic-hdl: MC285-AP
e-mail: chenming@cq.chinamobile.com
address: NO.300, L building, 6th street, keyuan, high-tech, industrial zone, Chongqing,400041
phone: +86-13983247186
fax-no: +86-13594249044
country: cn
changed: weichenguang@chinamobile.com 20040625

Firewall log:
Tue Dec 20 05:27:18 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:27:18 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:27:18 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:33:39 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:33:59 2005 1 Blocked by DoS protection 66.235.167.62
Tue Dec 20 05:36:42 2005 1 Blocked by DoS protection 221.203.145.54
Tue Dec 20 05:40:00 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:46:22 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:46:22 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:46:22 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:46:22 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:47:07 2005 1 Blocked by DoS protection 221.1.204.251
Tue Dec 20 05:51:20 2005 1 Blocked by DoS protection 202.96.87.41
Tue Dec 20 05:52:44 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:52:44 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:52:44 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:52:44 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 05:59:05 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 06:04:25 2005 1 Blocked by DoS protection 58.18.64.162
Tue Dec 20 06:04:25 2005 1 Blocked by DoS protection 58.18.64.162
Tue Dec 20 06:05:28 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 06:05:28 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 06:09:37 2005 1 Blocked by DoS protection 221.203.145.54
Tue Dec 20 06:11:48 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 06:11:48 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 06:18:09 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 06:18:09 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 06:18:09 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 06:18:09 2005 1 Blocked by DoS protection 218.201.43.148
Tue Dec 20 06:19:15 2005 1 Blocked by DoS protection 82.49.110.167
Tue Dec 20 06:28:17 2005 1 Blocked by DoS protection 202.96.87.41
Tue Dec 20 06:30:40 2005 1 Blocked by DoS protection 213.142.181.48

Share

Tags:


Nov 16 2005

Sony Rootkit DRM Saga Gets Messy

Category: .securityAmit Bahree @ 11:16 pm

From PCMag, Sony’s incredible gaffe – creating a DRM applet that loads prior to the operating system – has caused an incredible furor. Sony agreed to suspend the program, but that’s not all. Now the rest of the world is piling on. Microsoft now says it will delete the rootkit directly with its anti-spyware program, and it’ll be included in the December version of the Malicious Software Removal Tool. And it looks like the Macintosh, which is also affected by the rootkit, might still be at risk.

I would be very careful of any of the new CD’s I buy – if they are from Sony/BMG then they might have this!

Share

Tags:


Next Page »
Get Adobe Flash player