I saw this post on Hexesec the other day that made me think about all the skill’s that when you put them together could make one kick ass penetration testing team. Note that this is a pretty large list of skills that would be difficult if not impossible for one person to master. However, it […]
Building the pentest team skillset Read More »
Looks like the exploit code has been released by HD Moore as a Metasploit module. Hope everyone took the DNS patching requests seriously since we all know Metasploit is really easy to use (yes, especially for script kiddies!). If you haven’t patched your DNS yet…do it now! Check here for more information and here to
Exploit in the wild for the Kaminsky DNS vulnerability Read More »
Perhaps someone has figured it out or just decided to announce it but the big DNS vulnerability that Dan Kaminsky told the world about may have been revealed. Apparently a reverse engineer named Halver Flake was pretty close to figuring out how the vulnerability works. Then someone at Matasano apparently posted the details and then
Has the DNS vulnerability been revealed? Read More »
This is just a classic case of one administrator who managed to get all the “keys to the kingdom”. From the San Francisco Chronicle: “Terry Childs, a 43-year-old computer network administrator who lives in Pittsburg, has been charged with four counts of computer tampering and is scheduled to be arraigned today. Prosecutors say Childs, who
San Francisco’s network held hostage by network admin Read More »
Yes, it’s true. Presidential candidate John McCain is just now learning to use a computer. He also has said that he doesn’t use email (he has staff and consultants to do that for him). So what does this say about him and how he would handle technology issues? In particular, security issues related to technology
McCain is a technology n00b Read More »
I saw this news article tonight and had to laugh… “We all recognize that the Web site is important to the community,” Mayor Roy Robinson said. “We’ve tried to save money to build our own Web site. We should be designating a certain amount of money to maintain and protect it in a professional manner.”
How’s the security of your local city web site? Read More »
I won’t ramble on about the DNS vulnerability discovered by Dan Kaminsky this week…plenty of other blogs and news sites are covering it. Yes…it’s important, groundbreaking and all that jazz. However, if you want the real scoop especially if you need to convince your employer that this needs to be addressed quickly…then I point you
Wow…I’m really on this banking kick as of late… So I was watching TV tonight and saw a commercial for WaMu (Washington Mutual Bank) advertising their “Online Banking Guarantee“. What I found interesting was the whole scenario that played out in the commercial… Woman: “Hey, I’m using WaMu Online Banking…” Man: “Online Banking?? That’s not
What’s behind online banking guarantee’s? Read More »
Lots of buzz on the net about Blizzard (creators of World of Warcraft) offering a $6.50 two-factor authentication token for customers that want an extra layer of protection for their account. Yes, if you didn’t know account theft in WoW is on the rise! I commend Blizzard for taking this extra step to help protect
Blizzard offers two-factor authentication, why doesn’t your bank? Read More »
Last week GNUCITIZEN posted an article entitled “Tiger Team Operations vs. Penetration Testing”. I personally feel this is a spot on article and is a must read for anyone involved in either tiger team operations or penetration testing. The article focused on three areas in regards to these two types of assessments: quality, pricing and
The Evolution of Penetration Testing Read More »
