uncompiled.com

There are a wide variety of logging functions and services on UNIX. Some of these, such as the Solaris audit facility, are limited to a particular variety of UNIX. It is important that the digital forensics analyst become familiar with the logging deployed on the UNIX system that they are reviewing. In particular, have a look at the syslog configuration file, the “/var/log” and “/var/run” directories and check if there are any remote log servers. Syslog is a network service that is most commonly run locally. This allows for the capability of sharing logs to a remote system.

Source

Young U.S. Internet users are not receiving enough education about being safe online, according to a new poll by the National Cyber Security Alliance (NCSA) and supported by Microsoft.

More than three quarters of teachers have spent fewer than six hours on education related to cyberethics, cybersafety, and cybersecurity in the last 12 months; more than 50% of teachers reported their school districts do not require these subjects as curriculum; and only 35% taught proper online conduct.

Key highlights of the survey include:

*More than 90% of technology coordinators school administrators and teachers support teaching cyberethics, cybersafety and cybersecurity in schools. However, only 35% of teachers and just over half of school administrators report that their school districts require cyberethics, cybersafety, and cybersecurity in their curriculum.

*Low levels of integration of key cyberethics, cybersecurity, and cybersafety topics into everyday instructional activities. For example, only 27% of teachers taught about the safe use of social networks, only 18% taught about scams, fraud and social engineering, and only 19% taught about safe passwords in the past 12 months. Additionally, 32% of teachers indicated they had not taught cyberethics, and 44% of teachers had not taught cybersafety or cybersecurity.

*Differing opinions between teachers and administrators as to who is or should be responsible (parents vs. teachers) for educating students about cyberethics, cybersafety, and cybersecurity. For example, while 72% of teachers indicated that parents bear the primary responsibility for teaching these topics, 51% of school administrators indicate that teachers are responsible.

“The study illuminates that there is no cohesive effort to provide young people the education they need to safely and securely navigate the digital age and prepare them as digital citizens and employees,” said Michael Kaiser, Executive Director of the National Cyber Security Alliance. “Unfortunately, we are not meeting the needs of schools, teachers, or students.

The survey also found schools rely on shielding students instead of teaching behaviors for safe and secure Internet use. More than 90 percent of schools have built up digital defenses, such as filtering and blocking social networking sites, to protect children on school networks. Those measures may help reduce the online risks children face at school, they do not prepare students to act more safely when accessing the Internet at home or on mobile devices.

Source

For almost a year now, the idea of “NoSQL” has been spreading due to the demand for relational database alternatives. Maybe the biggest motivation behind NoSQL is scalability. Relational databases don’t lend themselves well to the kind of horizontal scalability that’s required for large-scale social networking or cloud applications, and ORMs can abstract away impedance mismatch only so much. In other cases, companies just don’t need as many of the complex features and rigid schemas provided by relational databases. Most people are not suggesting that we all ditch the RDBMS, in fact, many companies don’t really need to switch. Relational databases will probably be necessary for many applications years and years from now. In essence, NoSQL is a movement that aims to reexamine the way we structure data and draw attention to innovation in hopes of finding the solution to the next generation’s data persistence problems.

Check the source for details on various types of NoSQL.

Source

Many CSOs view ShmooCon as an event of small importance. You don’t see the suits and ties that are on display at RSA. In fact, to those who haven’t attended, this conference is just a place where twenty-something hackers come to get drunk and throw TVs out hotel windows. Another crazy Black Hat/Defcon-caliber conference, more than one high-level security exec has told me in the past.

As with any security event, things can get rough around the edges. The security podcasters’ meet-up on Saturday night was more like a Motley Crue concert than anything else. The podcasters on stage resembled the head table at a Klingon wedding. But drunken antics conference-wide were minimal, and some decent food for thought came out of the podcasting event despite the rowdiness.

The larger reality is that a lot of important talks happen here that have implications up and down the IT security food chain. It’s also important to note that a lot of the young ruffians who come here are the very people who find the security holes so they can be fixed. They also build a lot of the technology CSOs lobby their upper management to invest in.

Some examples:
# Tyler Shields of the Veracode Research Lab gave a talk about those BlackBerry phones security execs can no longer live without. His message: The BlackBerry is full of weaknesses an attacker can exploit to target the larger enterprise network.
# Many CSOs have become equally dependent on their iPhones, and they are increasingly being used to conduct business. Guess what? Those devices are equally at risk, according to Trevor Hawthorn, founder and managing principal at Stratum Security. He gave a presentation on how the bad guys can attack through your iPhone apps and tap into your GPS to track your whereabouts.
# Presenters also offered new insight into how attackers are targeting the P2P and social networking platforms your employees use all the time on company-owned computers. [See Inside FarmVille's Sinister Underbelly and P2P Snoopers Know What's In Your Wallet]
# Another running theme this year was about the failure of security spending; where companies spend millions to acquire all the best-of-breed security technology they can find in the rush to check off all the boxes on a compliance checklist but install it all so haphazardly that they actually increase their risk.

While most of the talks were tech-heavy, a lot of the discussion in the presentations and in the hallways were about the language disconnect that often exists between IT and upper management and how best to close the gap.

Source

What is believed to be the country’s biggest hacker training site has been shut down by police in Central China’s Hubei province. Three people were also arrested, local media reported yesterday.

The three, who ran Black Hawk Safety Net, are suspected of offering others online attacking programs and software, a crime recently added to the Criminal Law. A total of 1.7 million yuan ($249,000) in assets were also frozen.

According to the provincial public security department of Hubei, the closure of the website had its roots in a previous Web attack and virus dissemination case in the city of Macheng in 2007, when police found some of the suspects caught were members of Black Hawk Safety Net.

Hubei province named Black Hawk Safety Net as the largest hacker training site in China, which openly recruited members and disseminated hacker techniques through lessons, trojan software and online forum communications.

Since it was established in 2005, the site had recruited more than 12,000 VIP members and collected more than 7 million yuan in membership fees. More than 170,000 people registered for free membership.

Police said more than 50 officers had been investigating the case.

They seized nine Web servers, five computers and one car, and shut down all the sites involved in the case, according to the provincial public security department.

“I could download trojan programs from the site which allowed me to control other people’s computers. I did this just for fun but I also know that many other members could make a fortune by attacking other people’s accounts,” said a 23-year-old member of Black Hawk Safety Net in Nanjing of East China’s Jiangsu province, who asked to remain anonymous.

“It is not very difficult to do simple hacker tasks. Some hacker members are teenagers who dropped out of school and make money by stealing accounts,” he said.

A 20-year-old college student who registered with three different hacker training sites said a hacker training course costs from 100 to 2,000 yuan.

“Basically students were told how to steal accounts and use trojan programs. Sometimes trainers show us how to write programs,” he said.

“But now it’s very difficult to become a registered member. Some well-known hacker training sites have not been accessible since November,” he said.

According to a report released by the National Computer Network Emergency Response Coordination Center of China, the hacker industry in China caused losses of 7.6 billion yuan in 2009.

Source

Three notebook computers were stolen two weeks ago from an office at the Columbia College, containing personal information, including social security numbers, of 1,400 of current and prospective students, alumni, and past and present employees.

Columbia Spectator reports that the fact was revealed only this Friday, some 11 days after the security breach. The University offered to everyone who was affected a two-year subscription to a credit monitoring system (free of charge, of course) and are advising them to activate fraud alerts. They also said that up to that moment, there was no evidence of misuse of that information.

There is a high probability it never will be, since the computers were most likely stolen just to be sold as physical items. But low risk is not no risk, and the victims are not that easily satisfied with the results of the investigation, although they must know that once lost, this information will always present danger and that cannot be helped now. The only thing left to do is to check their credit report for suspicious transactions or the opening of a new credit card they haven’t performed themselves.

The University has promised to step up security. “We have already strengthened the physical security of the office in question and are in the process of increasing our laptop security through the installation of high level encryption programs. We also are taking a more aggressive approach to scanning computer equipment for potential security threats,” the Dean of Columbia College, Michele Moody-Adams, wrote in the letter to the victims.

Source

Local school districts across the United States have emerged as a prime target for cybercriminals. In the fall of 2009, districts in Colorado, Illinois, Oklahoma and Pennsylvania all reported thefts of tens of thousands of dollars.

The threat continues: on January 5, 2010, the Duanesburg, New York Central School District disclosed an attempted theft of $3.8 million, about a quarter of the district’s operating budget.

These crimes have been driven by malicious software infecting central office PC’s containing the district’s electronic banking details. These details were subsequently used by cybercriminals to access the district’s online bank account and illegally transfer money out of the account to money-mules, who subsequently transfer the funds to the criminal ringleaders.

Comodo CEO Melih Abdulhayoglu points out the soft-target characteristics of school districts and similar organizations including local governments, not-for-profit-organizations, and small businesses that make them attractive to cybercriminals. Abdulhayoglu further points out the need for much stronger “Default Deny” PC endpoint security to be deployed by organizations that will always appear to be soft targets relative to larger organizations with the personnel and financial resources to mount stronger cyber-defenses.

Source

Computer security used to be regarded as a boring and less important field of computer science, but with the proliferation of computer threats (from malware to active attacks) it has become one whose experts are in great demand and has gained quite an aura of “coolness”.

At the moment, there is a serious lack of cybersecurity experts in the U.S., so if your knowledge is up to speed, you are practically guaranteed a job.

Case in point: of the eight students from California State Polytechnic University, Pomona, that beat five other university teams in a challenge that had them defending a business computer network from cyber threats, six seniors got job offers from Boeing.

According to the New York Times, the demand is for experts is great, but luckily, schools and universities have noticed it and have rushed to open programs: the N.Y.U. Polytechnic, Carnegie Mellon, Purdue and George Mason are just some of the universities offering a master’s degree in cybersecurity. Georgia Tech is planning to start an online degree in information security later this year.

Businesses and the military have faith in the fact that the new generations are so familiar with what the online world has to offer, that they will be challenged by the notion of solving security problems and, therefore, interested in a career in cybersecurity. Another thing that they might find attractive is the pay. Professor Naris Memon of N.Y.U. Poly says that a starting pay for someone with a master’s degree in the field ranges from $60,000 to $80,000.

Source

Cryptographers have moved closer to their goal of eavesdropping on cellphone conversations after cracking the secret code used to prevent the interception of radio signals as they travel between handsets and mobile operators’ base stations.

The code is designed to prevent the interception of phone calls by forcing mobile phones and base stations to rapidly change radio frequencies over a spectrum of 80 channels. Without knowing the precise sequence, would-be eavesdroppers can assemble only tiny fragments of a conversation.

At a hacker conference in Berlin that runs through Wednesday, the cryptographers said they’ve cracked the algorithm that determines the random channel hopping and have devised a practical means to capture entire calls using equipment that costs about $4,000. At the heart of the crack is open-source software for computer-controlled radios that makes the frequency changes at precisely the same time, and in the same order, that the cellphone and base station do.

“We now know this is possible,” said Karsten Nohl, a 28-year-old cryptographer and one of the members of an open-source project out to prove that GSM, the technical standard used by about 80 percent of the mobile market, can’t be counted on to keep calls private. The attack “is practical, and there are real vulnerabilities that people are exploiting.”

A spokeswoman for the GSM Association, which represents 800 operators in 219 countries, said officials hadn’t yet seen the research.

“GSM networks use encryption technology to make it difficult for criminals to intercept and eavesdrop on calls,” she wrote in an email. “Reports of an imminent GSM eavesdropping capability are common.”

Source

With the coolness of a card shark at the final table of the World Series of Poker, Matt Bergin pulls the hood of his brown sweatshirt over his head and concentrates on the task at hand.

The task: hacking into as many target computers as he can and then defending those computers from attacks by other skilled hackers.

Other skilled hackers like Michael Coppola, 17, a high school senior who, at this very moment, is hunched over a keyboard in his Connecticut home.

Or like Chris Benedict, 21, from the tiny town of Nauvoo, Illinois. Chris is sitting silently nearby, one of 15 “All Star” hackers who have taken over this spacious hotel conference room.

At days end, the moderator of this unusual computer challenge declares the best of the best: Benedict is the winner, king of the hacker hill, followed by Bergin and Coppola.

The trio — a job seeker, a grape distributor for a vineyard and a student — are precisely the type of people whom organizers of this event hoped to attract: young techies with perhaps little formal computer education who, nonetheless, could contribute to the defense of the nation’s cybernetworks.

In many cases, organizers of the U.S. Cyber Challenge say, hackers’ skills go unrecognized or unappreciated by those around them and sometimes even by themselves.

“I thought that I would get demolished,” Benedict said. “I didn’t think I would get anything at all.”

Source