Security Basics

RE: Home wireless free hotspot

Fri, 19 Mar 2010 23:29:29 GMT

Posted by BECKY MACDONALD on Mar 19

Interesting....

Certainly supports the concept of securing the end-node and not the network. I think he makes several valid points
throughout and I too like the idea of sharing Internet connections from both the user and provider standpoints. However
the security professional in me says I should secure all points of access (layer security is always best) and keep all
unauthorized access of my network. The security side of me wins this one :)...

RE: Home wireless free hotspot

Fri, 19 Mar 2010 19:19:42 GMT

Posted by BECKY MACDONALD on Mar 19

Re: Home wireless free hotspot

Fri, 19 Mar 2010 19:06:49 GMT

Posted by Adam Mooz on Mar 19

Larry,

If you have the public AP infront of the private AP then, if someone
is able to subvert the router itself (not a difficult task) then they
have complete control of your traffic. The private AP should be in
front of the public AP in this case (although this is not the rule.)

----------------------------------------------------------
Adam Mooz
Blog: http://www.adammooz.com
LinkedIn: http://www.linkedin.com/ln/adammooz...

Change to SANS GIAC recert process

Fri, 19 Mar 2010 18:56:49 GMT

Posted by Eggleston, Mark on Mar 19

Hello Folks,

As a SANS GIAC alum, I didn't get anything in my email but I'm excited
about the change in the recert process:

"On March 1st, 2010, GIAC will begin to offer expanded certification
maintenance options. Besides the existing method of retaking the
standard certification exam, we will offer two main additional options.
One alternative is for you to submit a published technical research
paper, such as a GIAC Gold Paper. Another...

Re: Skype / Vsee

Fri, 19 Mar 2010 17:32:35 GMT

Posted by M.D.Mufambisi on Mar 19

The risk around such applications really is the easy leakage of
corporate information. Chat applicatios present a great risk around
this. Corporate documents can be easily transmitted out the network.
Another issue is that individuals do not normally know where to draw
the line between occasional "chatting" and wasting company time.
Viruses and malware could also be transmitted this way. Chat traffic
is encrypted and as such, these...

Re: Palevo Worm Infection

Fri, 19 Mar 2010 16:30:52 GMT

Posted by Albert R. Campa on Mar 19

check out the 3 CVEs linked on this site. Some old MS vulnerabilities.

http://www.symantec.com/security_response/writeup.jsp?docid=2009-072313-3630-99

__________________________________
Albert R. Campa

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL...

RE: Home wireless free hotspot

Fri, 19 Mar 2010 16:28:55 GMT

Posted by Lauren Twele on Mar 19

You also have to consider audit logs, policy management and provisioning. An identity management solution sounds like
the way to go here

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Channel, Lawrence F CTR
USAF ACC ACC/A8ZX
Sent: Wednesday, March 17, 2010 9:59 AM
To: security-basics () securityfocus com
Cc: John Lightfoot
Subject: RE: Home wireless free hotspot

John,...

RE: Home wireless free hotspot

Fri, 19 Mar 2010 16:20:08 GMT

Posted by Lauren Twele on Mar 19

IF you want to block all employee access to web mail (e.g., Gmail,
Hotmail, Yahoo, etc) from within your corporate network:
-->THEN you should set up firewall rules as suggested by the attached
-->email (SinglePoint not needed)

IF you want to control access by allowing only SOME employee access to
web mail...:
--> THEN you should license SinglePoint from Symplified

IF you want to audit access to web mail...:
--> THEN you should...

Re: Home wireless free hotspot

Fri, 19 Mar 2010 16:11:59 GMT

Posted by Johnathan on Mar 19

Signing a contract is not a legal agreement? There isn't any service provider that I am aware of that will just take
your word for agreeing to their terms of services, terms and conditions and/or terms of use.

I never said anything about breaking the law, the term legal does not always imply "breaking the law". Not fullfiling
your end of a signed agreement may not be breaking the law, but in the states, many situations can be...

Access 2003 MDE bypass.

Fri, 19 Mar 2010 16:05:11 GMT

Posted by Rivest, Philippe on Mar 19

Hi

i'm looking for a way to get access to the code once a mdb file has been
converted to a mde file.
Its my own code & application (Access 2003),i already have access to the
code but i want to ensure that if publish in a mde format no one will have
access to my code.

Also, are you aware if theres a way to remove a signature from an mde code
(signature is based on a certificate).

Thanks

<http://logo.transforce.org/ligneg.gif>...

Re: Reporting SSH abuse

Fri, 19 Mar 2010 15:52:48 GMT

Posted by mgk on Mar 19

Hi

We take reports like this seriously when we receive them and take them
up with customers. Theres no harm in sending a report with some logs.
Wording such as, it seems as though this is the situation is less
confrontational than, Attacks are coming from your network, sort it out.

Here are a few we have had:-

Looks like your custommer with IP xxxxxxxxx is doing ssh attacks to my
server.
Please take care about
Best Regards

and

Hi,...

RE: Home wireless free hotspot

Fri, 19 Mar 2010 15:46:28 GMT

Posted by Murda on Mar 19

I am fascinated by the implications of this thread and by what it is the OP wishes to do and its potential
ramifications. It seems to me that the whole privacy and anonymity aspects of this situation and similar will become
more of a battleground over the next few years in most western countries; Australia is already gearing up for a net
filter that will curtail the kind of content that can be accessed. How it will work is anyone's guess and...

Re: Skype / Vsee

Fri, 19 Mar 2010 15:26:46 GMT

Posted by Shawn Merdinger on Mar 19

Hi WW,

While dated (December, 2006) Skype's giude for network admis might be helpful

http://www.skype.com/security/network-admin-guide-version2.2.pdf

Cheers,
--scm

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how
it benefits your company and...

Check if root is allowed on SSH server - remotely?

Fri, 19 Mar 2010 15:22:47 GMT

Posted by savekov on Mar 19

Hi guys ,

is there any special way I could check remotely if the ROOT login is allowed
or not in SSH server?
I dont have any account on this server to login to the server and check the
config files.
Im just curious is there any way I could remotely find out if the root is
allowed or not allowed?

Thanks ...guys

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In...

Palevo Worm Infection

Fri, 19 Mar 2010 15:16:58 GMT

Posted by martin on Mar 19

Hi All

We've just had some clients get infected with the above worm. The
worm has definitely spread via removeable drives, but it appears to
have also spread directly between networked PC's within the same
broadcast domain. None of our users however had admin rights on any
PC, so I'm curious what vulnerability the virus is using to spread
itself amongst our machines.

According to the link below, it's spreading via "known software...