Tag Info

Hot answers tagged

22

In a formal review of an application's security, all libraries should be vetted for security defects. However, this is not the point of OWASP-2013 A9. The core of OWASP-2013 A9 is about having a policies in place to ensure that an application isn't compromised due to negligence. OWASP states the following: Identify all components and the versions you ...


18

Auditd is an extraordinarily powerful monitoring tool. As anyone who has ever looked at it can attest, usability is the primary weakness. Setting up something like auditd requires a lot of pretty in-depth thought about exactly what it is that needs auditing on the specific system in question. In the question you decided on a web server as our example ...


17

DNS test - many packet sniffing tools perform IP address to name lookups to provide DNS names in place of IP addresses. To test this, you must place your network card into promiscuous mode and sends packets out onto the network aimed to bogus hosts. If any name lookups from the bogus hosts are seen, a sniffer might be in action on the host performing the ...


17

VP01 gave the theory, I will give some tools. For use in linux systems: SniffDet: This one employs 4 different tests: ICMP test, ARP test; DNS test and also a LATENCY test (which VP01 didn't mention). The tool is recently updated and I recommend it. Also: NMAP : There is an NSE script for nmap called sniffer-detect.nse which does just that. NAST: - it ...


16

There's a couple of ways that I've seen this done, each has it's pros and cons. As noted by @RoryAlsop below a common point for both approaches is that the executive summary should, as much as possible, be written for a business audience (assuming that it's a test you're doing for a 3rd party or the report will be passed to management). Reporting by ...


15

Generally one has to know what TPMs and TXT and all these technologies are aimed to protect from, because there are misunderstandings. TPMs, generally, enable 5 distinct processes, and only those: Integrity measurement – computation of a cryptographic hash of a platform component Authenticated boot – a process by which a platform's state (the sum of its ...


14

Testing for ECB / CBC / OFB / CTR mode is fairly straightforward. It's also straightforward to see if the mode has authenticated encryption like EAX / GCM (though it isn't straightforward to see which mode of AE). ECB: have a file with many similar blocks in the plaintext. Do you see identical blocks in the ciphertext? (Yes this is similar to Dan's ...


12

This is a much bigger question than I think you realise - for a start, the major IT audit firms have a very large amount of Intellectual Property in this area, so while you will be able to find high level documentation, you may have trouble finding full detailed documents. From my time in a Big-4 audit firm, I probably saw over 300 workplans for audit of ...


11

It is certainly possible. See this presentation for example: http://www.coresecurity.com/files/attachments/Persistent_BIOS_Infection_CanSecWest09.pdf One way to achieve protection is by requiring a flash bios password that some implementations support. Another way is by using a TPM which does almost exactly what you are suggesting: It creates a SHA-1 hash ...


11

This an incident you need to handle and I am guessing that a standard response has not been detailed in your documentation. Realize that your system is malfunctioning. It is not operating the the way it was intended to. Isolate your system [meaning your network(s) and physical facility if possible] to prevent the data from leaving your system. Take care ...


11

I think you seek the use of a packet generator and a corresponding number of systems generating packets to match the load you seek. Use random valid IP addresses for the packet source addresses and you should find yourself quite annoyed when it comes time to filter. You can do all of that without ever sending a bit across your ISP's link. If you get DDOS'd ...


10

Both answers above are bang on the money, but I'd just like to add the following caveat. I run a regulatory services company and I got us certified to ISO 27001. The one thing I would communicate to anybody thinking of becoming certified is to remember that being certified to a standard is not like acquiring a magic talisman that wards off all evil (and ...


10

I used to work IT at an Airforce Base for a while and we actually had a couple of incidents like this happen. First and foremost, make sure you notify the appropriate authorities of the incident. They will be able to instruct you further based on their current security policies. You need to isolate access to the laptop. Shut it down completely, boot ...


10

IMPORTANT: This is in noway a full list of the things you should look for, use this answer as an example, a first step in your path and research on your own. I've had a similar task long time ago. I had to security-wise review the code of a Firefox addon, I'm sure you'll easily find Chrome/other browsers' equivalents. Also have in mind the Extensions in ...


9

You can't guarantee that you'll be able to detect it. For example, you can easily make a read-only ethernet cable by looping the TX+ (pin 1) and TX- (pin 2) of the sniffing computer, then set TX+ (pin 1) to RX+ (pin 3 of the sniffer) and TX- (pin 2) to RX- (pin 6 of the sniffer). It will then be impossible for the sniffing computer to affect any data ...


9

The bottom line: You are screwed. If you are concerned that one of the developers deliberately hid a backdoor in that codebase, you have no realistic hope of telling whether a backdoor is present. Life sucks. Comment: Some folks here are suggesting you can check for a backdoor by reviewing the code, or using static analysis tools, or somesuch. Don't ...


9

You're somewhat approaching the question the wrong way. You need to decide what you want to log, and find out how to log that. Generating a bunch of log files is cool and all, but if you never look at them or don't know what you're looking for, it just wastes time and space. When deciding what to log, you need to identify what behavior it is that you care ...


9

You wouldn't get a list of all the passwords. Any company that could or would produce such a thing would fail any reasonable security audit. You might get a list of all the password hashes which could then be run through a tool that attempts to determine what the password is. The ease with which the password hashes can be broken and the types of passwords ...


8

The obvious answer (if we accept your premise) is: routinely port-scan your own machines to see if they are running any unexpected services. I'm not too sure about the premise that the best way to defend against this risk is to try to detect use of IIS Express. I wonder if you have considered an alternative approach, which is not specific to any particular ...


8

Much like recursion, to properly understand audits we must first understand the scope and usage of audits. Audits are used to determine compliance against a benchmark. Without said benchmark, then the auditor has nothing to measure against. In some cases your benchmark may be a deeply technical document describing programming practices or operating system ...


8

The traditional answer to your question is - get a job at an auditing firm. It'll be a junior position, but that's how you learn the trade. You'll get access to the sort of workplans Rory mentioned, but even more importantly, you'll get experience applying them to actual audit situations. I've met good auditors, and I've met poor auditors, and good ...


8

In browser extensions, the impact of a vulnerability highly depend on the context and the requested permissions. Static tools (JSHint, AMO validator) to check code exist, but none of them are 100% reliable, especially for obfuscated code. So, I'm not going to show a magic regular expression which tells you whether some code is vulnerable or not, but give a ...


7

Pentesters / "Auditors" should keep a full packet capture of everything their tools put on the wire and this should be available to you as a client. Use this if something does happen to crash, is identified incorrectly, etc. to pinpoint the (mis)behavior of the systems under test. Also, start basic and manual before assaulting the system with all kinds of ...


7

It sounds like you are confusing your work environment with your target environment. Which OS should you work from? There are far more useful tools in Linux than in Windows. Use Linux (or even a penetration testing distro like Backtrack) as a work environment. If you say that you could roll your own security tools (and why would you when there is a ...


7

Computer Science is just that a Science. It would be very scientific to just hypothesize that you are secure without actually putting it to the test. You can perform source code analysis and other whitebox testing methodologies to find all sorts of interesting and high impact vulnerabilities... but what if no one could actually exploit these issues? You ...


6

Have a look at Major Malfunction's (Adam Laurie) work in this area: http://hackaday.com/2007/03/25/rfidiot-rfid-io-tools/ http://www.youtube.com/watch?v=3vAvesYoHeo and many others - good fun stuff, not too expensive to get started edit: Just spotted this post on Proxclone that you might also be interested in


6

You'll want to look at the Data Protection Act (or its equivalent in your jurisdiction) as it lays out guidelines for the protection of sensitive personal data, which includes medical data. The wording in it, and in similar documents, is quite woolly - using phrases like "appropriate protection" - which isn't helpful, but basically it aims to push ...



Only top voted, non community-wiki answers of a minimum length are eligible