End of Truecrypt !!! - A new Mystery

The Official site has the following message

WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues

This page exists only to help migrate existing data encrypted by TrueCrypt.

The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform.

It is unfortunate to see my favorite free tool disappear

Below given are a few links that discuss this issue

http://steve.grc.com/2014/05/28/whither-truecrypt/

http://www.pcworld.com/article/2241300/truecrypt-now-encouraging-users-to-use-microsofts-bitlocker.html

http://www.reddit.com/r/sysadmin/comments/26pxol/truecrypt_is_dead/

http://www.reddit.com/r/Bitcoin/comments/26px9v/truecrypt_shutting_down_development_of_truecrypt/

If You Are Doing Incident Response, You Are Doing It Wrong

Short but an excellent article that emphasizes on Incident Management 

According to the article:-

By managing incidents rather than responding to them, you:

• Reduce the severity of the incidents that do occur.
• Reduce the number of incidents that do occur.
• Shift from responding to incidents to managing incidents as part of your normal operations
• Reduce unforeseen expenses related to incident investigations
• Increase your visibility within the business, and thus the support for your organization
• Strengthen security posture (Thank you to Corey)
• Reduce stress on your staff and increase their job satisfaction (unless they are adrenalin junkies)

An incident management mindset depends on accepting a truism:

Compromise Is Inevitable – Something truly malicious has been in, is in, and will be in your environment.

The link below has more information:-

http://integriography.wordpress.com/2014/05/06/if-you-are-doing-incident-response-you-are-doing-it-wrong/

Metrics - Related to Security

All Security products provide dashboards but combining this information from multiple produces and sources and converting them to useful metrics is the biggest challenge.


Here is an article that provides some useful tips.

http://brianpennington.co.uk/2014/05/05/tracking-how-fast-a-security-incident-is-discovered-and-contained-is-the-most-important-metric-but-not-often-used/

Strange and very bad - Adobe Shockwave provides its own version of the Flash runtime that is more than 15 months behind on security updates (according to Krebs}

According to the article:-

Dormann said, the current version of Shockwave for both Windows and Mac systems lacks any of the Flash security fixes released since January 2013. By my count, Adobe has issued nearly 20 separate security updates for Flash since then, including fixes for several dangerous zero-day vulnerabilities.

Dormann said it may actually be easier for attackers to exploit Flash vulnerabilities via Shockwave than it is to exploit them directly against the standalone Flash plugin itself. That’s because Shockwave has several modules that don’t opt in to trivial exploit mitigation techniques built into Microsoft Windows, such as SafeSEH.

The link below has more information:-

http://krebsonsecurity.com/2014/05/why-you-should-ditch-adobe-shockwave/

Hook Analyzer - Free app for both static and dynamic analysis of suspicious applications

Features/Functionality

• Spawn and Hook to Application – Enables you to spawn an application, and hook into it
• Hook to a specific running process – Allows you to hook to a running (active) process
• Static Malware Analysis – Scans PE/Windows executables to identify potential malware traces
• Application crash analysis – Allows you to analyse memory content when an application crashes
• Exe extractor – This module essentially extracts executables from running process/s

Product Page
http://hookanalyser.blogspot.com/

ebay - Change your passwords ASAP

eBay Inc. (Nasdaq: EBAY) said beginning later today it will be asking eBay users to change their passwords because of a cyberattack that compromised a database containing encrypted passwords and other non-financial data. 

According to the article:-

Cyberattackers compromised a small number of employee log-in credentials, allowing unauthorized access to eBay's corporate network, the company said. Working with law enforcement and leading security experts, the company is aggressively investigating the matter and applying the best forensics tools and practices to protect customers.

The database, which was compromised between late February and early March, included eBay customers’ name, encrypted password, email address, physical address, phone number and date of birth. However, the database did not contain financial information or other confidential personal information. The company said that the compromised employee log-in credentials were first detected about two weeks ago. Extensive forensics subsequently identified the compromised eBay database, resulting in the company’s announcement today.

The link below has more information:-

http://www.ebayinc.com/in_the_news/story/ebay-inc-ask-ebay-users-change-passwords

Credit cards with "CHIP and PIN" are better but they may still be vulnerable

A chain is only as strong as its weakest link

Apparently the weak link here is the Random Number Generator.

According to the article:-

Our new paper shows that it is possible to create clone chip cards which normal bank procedures will not be able to distinguish from the real card.

The paper analyses the EMV protocol, the leading smart card payment system with 1.62 billion cards in circulation, and known as “Chip and PIN” in English-speaking countries.

When a Chip and PIN transaction is performed, the terminal requests that the card produces an authentication code for the transaction. Part of this transaction is a number that is supposed to be random, so as to stop an authentication code being generated in advance. However, there are two ways in which the protection can by bypassed: the first requires that the Chip and PIN terminal has a poorly designed random generation (which we have observed in the wild); the second requires that the Chip and PIN terminal or its communications back to the bank can be tampered with (which again, we have observed in the wild).

To carry out the attack, the criminal arranges that the targeted terminal will generate a particular “random” number in the future (either by predicting which number will be generated by a poorly designed random number generator, by tampering with the random number generator, or by tampering with the random number sent to the bank). Then the criminal gains temporary access to the card (for example by tampering with a Chip and PIN terminal) and requests authentication codes corresponding to the “random” number(s) that will later occur. Finally, the attacker loads the authentication codes on to the clone card, and uses this card in the targeted terminal. Because the authentication codes that the clone card provides match those which the real card would have provided, the bank cannot distinguish between the clone card and the real one.

Because the transactions look legitimate, banks may refuse to refund victims of fraud.

The link below has more information:-

http://www.lightbluetouchpaper.org/2014/05/19/the-pre-play-vulnerability-in-chip-and-pin/

IR (Incident Response) - A few good thoughts

Nice thoughts and a few good comments

From the Article:

• First, prevention and preventative security controls will fail. Prevention fails on a daily basis at many organizations; it will suffice to look at antivirus tools and contrast their 99%-plus deployment rates with widespread ongoing malware infection rates."
• "Second, detection also fails on a frequent basis. A copy of Verizon Data Breach Investigations Report reveals plentiful evidence of that."
• "What remains of the entire realm of information security. Only incident response."

"Thus, IR simply has to be there because this is where the security of an organization will fall after all else fails - and it will."

The link below has more information:

http://journeyintoir.blogspot.com/2014/04/holding-line.html

Watchout - hackers and government agencies can now compromise the security of the TOR network

How?

Bob Tarzey, an analyst and director with the Quocirca research house, said that, as the IT industry has seen with Open SSL, the term `free' can mean that rigorous testing is not the same as you would expect with commercial software.

(Again, we are forced to presume that Commercial software are "TESTED RIGOURSLY". Security is based on (Tust but) VERIFY model. The above statement is only talking about "TRUST" so, I would say it is true about free software but I won't take the part related to the Commercial software part).

According to the article:-

he security of the TOR network, he went on to say, can be compromised in a number of ways, including monitoring two of the server streams. At this point, he says, it becomes possible to deduce the origin points – and other information - of the data stream. 

This technique was documented in 2012 by a team of researchers from the University of California, who named their approach LAST or, and explained that the compromise - though complex - was entirely achievable. 

Wood, meanwhile, said that man-in-the-middle attacks can be spotted by users when they realise the certificate for the session is not valid.

"The problem here is that users on a smartphone or mobile device might not see the certificate owing to the limited real estate on the screen of these devices," he said. 

James Lyne, the EMEA director of the SANS Institute, said that there have been a series of challenges with the security of TOR, but - frankly - more broadly crypto underpinning trust and Internet privacy plus security have been through something of a rough patch lately. 

The link below has more information:-

http://www.pcauthority.com.au/News/385779,tor-security-compromised-by-nsa-according-to-microsoft.aspx

BLACKSHADE (RAT - Remote Access Trojan) - Multiple arrests in multiple countries in relation to this

Just in case you missed it.

Here is one good work by FBI

According to the article:-

The coordinated crackdown involved 18 countries, including Australia, Canada and the UK. According to the US Federal Bureau of Investigation (FBI), over 90 arrests were made and 300 searches undertaken globally. Subsequent reports indicate that more than 100 people have been charged in the crackdown.

Known as a remote access trojan or remote administration tool (RAT), Blackshades was created by an organisation of the same name and has been sold since 2010 in underground online hacking marketplaces in over 100 countries for US$40 to US$100 a pop.

The tool gives customers a method to obtain unrestricted access to another computer without the owner's knowledge, and the ability to steal passwords and banking credentials, record keystrokes, obtain files, and activate and control webcams.

The FBI estimates that Blackshades generated sales of more than US$350,000 between September 2010 and April 2014 with more than 6000 customer accounts in over 100 countries.

The link below has more information:-

http://www.zdnet.com/more-than-100-charged-in-blackshades-crackdown-7000029639/#ftag=RSS14dc6a9

Secure Connection + forged = Bad for web

According to the article:-

Computer scientists have uncovered direct evidence that a small but significant percentage of encrypted Web connections are established using forged digital certificates that aren't authorized by the legitimate site owner.

At least one issuer of certificates—IopFailZeroAccessCreate—was generated by a known malware sample that was presented 112 times by users in 45 different countries.

More troubling, of course, was the discovery of forged certificates issued by malware and adware programs for purposes of ferreting log-in credentials out of, and injecting banner ads into, encrypted Web traffic. Because the certificates were installed by software that made administer-level changes to the end-user computers, they likely generated few if any error warnings when they were presented.

The link below has more information:-

http://arstechnica.com/security/2014/05/significant-portion-of-https-web-connections-made-by-forged-certificates/

Continuous Vulnerability Assessment - 4 Part Article.

This is an area where there are only few vendors are offering tools and not all have complete solution.



Here is a 4 part article that provides some good details.


PART - I  -  What is Vulnerability Management?
http://intellavis.com/blog/?p=813

PART - II  - Inadequate Vulnerability Management in Software Security Maturity Models
http://intellavis.com/blog/?p=829

PART - III - Laying the Groundwork for Web Application Vulnerability Management
http://intellavis.com/blog/?p=840

PART - IV  - Scan all the things!
http://intellavis.com/blog/?p=855

Interesting - SQL Truncation Attack

According to the article:-

The SQL Truncation vulnerability is a very interesting flaw in the database. The successful exploitation of this issue leads to user account compromise, as it means an attacker can access any users account with his own password. Sounds interesting!

First we will see why this issue occurs in the database. If the user input value is not validating for its length, then a truncation vulnerability can arise. If the MySQL is running in default mode, Administrator account as admin, the database column is limited to 20 characters.

The link below has a good example:-

http://resources.infosecinstitute.com/sql-truncation-attack

Another incident that reminds that people should use credit cards instead of debit cards.

According to the article:-

Earlier this month, I began hearing from sources in the banking industry about fraudulent debit card activity on cards that were all recently used at self-service stamp vending machines at U.S. Post Offices in at least 13 states and the District of Columbia.

Banking sources said the fraud follows a fairly consistent pattern: The thieves are targeting debit card users and somehow stealing the PINs associated with the cards. Ostensibly, the fraudsters then fabricate new cards and make cash withdrawals at ATMs ranging from $500 to $800 per card.

One way to protect yourself against this type of fraud is to use a credit card in lieu of a debit card whenever possible. With a credit card, your liability is maxed out at $50 in the case of fraudulent transactions. Things get more complicated with debit cards. Although many banks also will observe the $50 limit on debit card fraud, customers could be facing losses of up to $500 if they wait more than two business days after learning about the fraud to report it. 

The link below has more information:-

http://krebsonsecurity.com/2014/05/postal-service-beware-stamp-kiosk-skimmers/

Steganography with a new twist - Using Twitter Messages

Another (new) double-edged sword

According to the article:-

Users need only type the text they want others to see in one field and the hidden message in a separate field. The service, created by New Zealand-based developer Matthew Holloway, then spits out a tweetable message that fuses the two together in a way that's not noticeable to the human eye

Check the following link for the example-

http://arstechnica.com/security/2014/05/how-to-stash-secret-messages-in-tweets-using-point-and-click-steganography/

SOC Analyst - How not to miss alerts (and get blamed)

Normally, you find a lot of unwanted information related to SOC, this article provides some nice advice without all the fluff.

According to the article:-

1. Since many SOC analysts are new to this field, add documentation to signatures so they can fully understand their context and can more easily identify when they should ask for help.
2. Tune out noisy alerts by providing a mechanism for analysts to easily flag them in the course of their daily duties and setting up a regular meeting to review submitted alerts.
3. Let analysts focus on their job of analyzing alerts and not side tasks outside of their normal daily responsibilities.
4. Keep analysts in the know of any incident response activities so they can better understand signature context (even if they weren’t directly involved) and gain a perspective beyond just the alert queue.
5. Motivate analysts by giving them training that enhances their abilities in their current job and prepares them for their next one, offering small challenges to test their skills, and recognizing their successes.

The link below has more information:-

http://blog.handlerdiaries.com/?p=552

Anti-Virus Dead, What Next ? - EndPoint Protection Protection

I don't remember when  I used the term AV, Endpoint Protection was alwaays the right term. The problem is top AV vendors just renamed their product from AV to EP and did not offer any useful functions related to investigation and recovery.

The link has an interesting view from Securosis on endpoint protection

The link (PDF)below has more information:-

https://securosis.com/assets/library/reports/Securosis_AdvancedEndpointServerProtection_FINAL-multi.pdf

Security Analytics (SA) - New Buzzword from Security Vendors so, a few pointers if you considering it or want to know about it.

If database world is filled with "Bigdata" buzz, Security World is now being filled with SA (Security Analytics).

I am sure everyone knows its benefits , it is shady when it comes to requirements and the cost part.



The following are the three part article (Third one is the best)

http://blog.anitian.com/security-analytics-1-the-game-is-on/

http://blog.anitian.com/security-analytics-2-innovation-explosion/

http://blog.anitian.com/security-analytics-3-selecting-an-analytics-platform/

Looks like the Eradication and Recovery steps in incident management are not going well for HeartBleed issue.

Being Lazy or Not Smart - You will still continue to (Heart)Bleed and make others vulnerable

Sometimes other people's stupidity and laziness affects us. Internet is a good example.

According to Netcraft's survey 

• 43 percent of sites have reissued their certificates since the appearance of Heartbleed. 
• Seven percent of those have reissued them with the same private key. 
• Only 14 percent have revoked and reissued with new keys, which is the full set of tasks necessary to prevent attack.
• Overall, 20 percent have revoked their old certificate, a few without reissuing. Finally, five percent have revoked and reissued, but used the same keys as the earlier certificate.

The link below has more information:-

http://www.zdnet.com/many-sites-reusing-heartbleed-compromised-private-keys-7000029282/

Some never learn - New servers still surfacing with Heartbleed vulnerability

According to the article:-

Pettersen has unearthed two problems. First, many patched servers are still using their old digital certificates. "Given that any server that was patched after April 7 has to be assumed to have had its certificate private key compromised

Second, there's been an alarming rise in the number of new servers that sport Heartbleed, including a sizeable number of F5's BigIP crypto accelerator servers. "In my most recent scan, 20% of the currently vulnerable servers -- as distinguished by IP addresses -- and 32% of the vulnerable BigIP servers were NOT vulnerable when they were scanned previously," he said. "This means that thousands of sites have gone from not having a Heartbleed problem to having a Heartbleed problem."

The link below has more information:-

http://www.darkreading.com/vulnerabilities---threats/accidental-heartbleed-vulnerabilities-undercut-recovery-effort/d/d-id/1251166

7 facts related to OAuth and OpenID flaw

Of which 3 of them relate to development/implementaion and one relates to users (Social Engineering).

NOTE: 

The flaw highlighted by Wang -- which isn't new -- doesn't exist in OAuth 2 or OpenID, but rather in how some businesses have implemented those and other standards

Something I learnt:

Many web applications that rely on third-party authentication use what's called an implicit flow. That involves giving a browser client an access token after the user gives that client access.

he recommends that developers use the more complex "code flow" approach, which involves additional API calls to further verify the authenticity of the client, and which becomes essential for ensuring security when clients maintain any type of server-side state. It also adds the ability to refresh the token and provide offline access.

According to the article:-

1. At risk: open redirects

The primary problem pertains to the use of open redirects, which redirect HTTP requests. "There have been open redirectors for as long as there's been HTML," 

2. Developers, sites, don't follow security recommendations

Many sites and developers don't follow the security mitigations recommended by the standards. Facebook, for example, allows developers to use whitelisting to restrict the range of sites to which incoming open-redirect requests can be redirected, which would block related exploits. But Facebook made it an optional feature.

3. ESPN abuse highlights attack seriousness

Wang demonstrated that precise flaw in a YouTube clip, showing how an open redirector located on the ESPN website -- which allowed users to authenticate using Facebook Connect -- could be abused. Notably, the open redirector redirected to any site specified in a URL parameter, and also passed the query string parameters to the receiving site.

4. Beware social engineering angle

Another way open redirectors can be abused is to send users to malicious sites. If that happened, though, Symantec's Narang said the site would have to trick the user into allowing their third-party credentials -- for example, from Facebook or Google -- to be used to log into the site. "So it involves social engineering -- that part needs to be clear," he pointed out.

5. Developers: know your state

One way to mitigate related vulnerabilities is to restrict the URLs to which the redirector will redirect. "It's always best, if you can, to do exact URI redirect matching,"

6. After coordinated disclosure, some sites fixed

Wang said he notified all businesses that he's listed as having vulnerable implementations of OAuth 2 or OpenID prior to making his public announcement earlier this month. "I found this vulnerability at the beginning of February and I have reported it to related companies," he said.

7. Fixing insecure implementations will take time

Some affected sites have already put related fixes in place. On March 13, for example -- evidently after receiving Wang's vulnerability report -- LinkedIn told developers they would have one month to register their OAuth 2 redirect URLs. "If you do not take the steps noted above by April 11, 2014, requests to authorize new members or refresh tokens will fail. We will display an error message and not redirect the member to your application," LinkedIn said.

But not every site appears willing to practice that type of tough love. Some are opting for more phased transitions. "Facebook making any type of change, because they have such a large client/developer base, if they turned on maximum security, all the people who wrote clients [that assume] weak security, they're going to break," Bradley said.

The link below has more information:-

http://www.darkreading.com/authentication/oauth-openid-flaw-7-facts/d/d-id/1251127?page_number=1

For Linux Fans - Munich city council migrated 15,000 workers from Windows to Linux.

A small success story for Linux die hard fans


Check this link:
http://www.linuxvoice.com/the-big-switch/

Good reason for NOT watching Porn from Android Phones.- Android-Trojan.Koler

Locks your phone till $300 is paid, claims you viewed illegal porn.

According to the article:-

The malware prevents users from accessing the home screen of their phones, making it impossible to use most other apps installed on the phone. The normal phone functions in some cases can be restored only when the user pays a "fine" of about $300, using untraceable payment mechanisms such as Paysafecard or uKash.

The functions in Koler.A have been obfuscated to slow down the process of analyzing exactly how the malware works. Still, there's no evidence that the malware encrypts any files on a phone's storage.

The malicious Android Package is automatically downloaded when people visit certain pornography sites using an Android phone. The sites then claim that the APK installs a video player used for premium access. To be infected, a user must change Android settings to allow out-of-market apps and then manually install the APK. The social engineering trick has already claimed at least 68 victims in the past six hours—40 in the United Arab Emirates, 12 in the UK, six in Germany, five in the US, and the rest in Italy and Poland.

The link below has more information:-

http://arstechnica.com/security/2014/05/your-android-phone-viewed-illegal-porn-to-unlock-it-pay-a-300-fine/

After OpenSSL now we have OAuth and OpenID flaw

Good time for all organization using OpenSource to contribute for OpenAudit to keep them safe and secure.

According to the article:-

For example, someone clicking on a malicious phishing link will get a popup window in Facebook, asking them to authorize the app. Instead of using a fake domain name that's similar to trick users, the Covert Redirect flaw uses the real site address for authentication.

If a user chooses to authorize the log in, personal data (depending on what is being asked for) will be released to the attacker instead of to the legitimate website. This can range from email addresses, birth dates, contact lists, and possibly even control of the account.

Regardless of whether the victim chooses to authorize the app, he or she will then get redirected to a website of the attacker's choice, which could potentially further compromise the victim.

The link below has more information:-

http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/

Does your organization still use NTLM authentication (I hope not) - Then you should know about Windows folder poisoning Attack

According to the article:-

Endpoint security vendor Imperva, who said they've discovered a way to poison Windows folders and gain the access rights of anyone who browses to that folder. The hack involves exploiting a relaying feature in Microsoft NT LAN Manager (NTLM), which is a widely used Windows challenge-response authentication protocol.

Anyone who can be tricked into clicking on a folder containing such a shortcut icon will launch an NTLM relay, which passes their authentication credentials via the compromised PC to Active Directory and then gives the compromised PC the same access rights

Shulman said similar types of attacks can be launched beyond Windows. Other potential targets include Jive, SharePoint, or other collaboration software, especially if it includes the ability to publish small blurbs of information via feeds, together with small images, as these images can used by attackers to point to remote machines and launch NTLM relay attacks.

The link below has more information:-

http://www.darkreading.com/vulnerabilities---threats/sneaky-windows-folder-poisoning-attack-steals-access-rights/d/d-id/1251025

Antiviirus is dead - says Symantec (why?)

Everyone knew that but the the true reason for this statement lies in the 2nd sentence.

“We don't think of anti-virus as a money maker in any way," Brian Dye told the Wall Street Journal.

What this means is that "we have been selling CRAP for a long time and customers have started to realized it. Moreover, with all the malware and cyber threats, we cam make better money by selling different CRAP"

The link below has more information:-

http://www.pcr-online.biz/news/read/anti-virus-is-dead-says-symantec-reveals-new-partner-programme/033901

Finally good news for Dropbox users

According to the article:-
Previously, Dropbox users can share links to any file or folder in their Dropbox. Files shared via links are only accessible to people who have the link.

However, shared links to documents can be inadvertently disclosed to unintended recipients when a shared link to a third-party website is disclosed by the referer header.

Dropbox has now disabled access to links that have been previously shared and implemented a patch to prevent shared links from being exposed from now on.

The link below has more information:-
http://www.computerweekly.com/news/2240220216/Dropbox-finally-fixes-security-vulnerability

Amazon blamed (by security vendor) for unpatched OS , which resulted in Malware infection.

(Beauty of the Cloud)

According to the article:-

Bkav claims that AWS, a division of e-retailer Amazon, initially handed the customer a version of Windows Server 2003 that had not been patched since October 2009.

Hackers continuously scan the Internet for vulnerabilities in servers, so it is possible they found the unpatched OS and infected it with malware as soon as it was turned on, Anh said.

Bkav tested the cloud-computing services of Microsoft, Hewlett-Packard and GoGrid and claims to have found that Microsoft Azure was the only one consistently running updated versions of Windows. HP Public Cloud had some versions eight months out of data, while GoGrid had versions that had not been patched since April 2012

The link below has more information:-

http://www.csoonline.com/article/2147661/application-security/security-vendor-blames-amazon-for-customer-malware.html

Mitigating IE - zero day vulnerabiltiy - By Steve Gibson

If you are using an old version IE


Check out this link
http://steve.grc.com/2014/04/28/a-quick-mitigation-for-internet-explorers-new-0-day-vulnerability/

Defense in depth not good enough - states Bromium

Well, it is sales pitch combined with facts.

Defense in depth not good enough - states Bromium 

I agree on "The security chain is only as strong as its weakest link" statement (I am sure all do)

I disagree on "Adding additional layers to your existing “Layers on Layers” (LOL) of end point protection – just like any Defense in Depth (DID) strategy – is a game of diminishing returns:"

If  you  understand,  what you are trying to protect, your attack surface and choose the right layers of security then DID will be valuable. However I am afraid that the above statement might be true for many organizations.

According to the article:-

In his research, Wojtczuk used the public exploit for the so-called “EPATHOBJ” Windows kernel vulnerability it to bypass application sandboxes, AV, HIPS, rootkit detectors, Microsoft EMET and SMEP – even when all of these solutions are layered one upon the other. Modifications to the exploit allowed us to bypass all of these technologies.

This highlights the fact that “defense in depth” – based on simultaneous deployment of multiple solutions that share the same weakness – does not advance security posture. In this case the entire chain of protective measures shares a common vulnerability – the Windows kernel, which unfortunately is the component with the most rapidly growing set of vulnerabilities – over  80+ CVEs in the last year alone. 

Using hardware isolation – courtesy of the integrated hardware virtualization features on every CPU – to isolate each untrusted task that executes on the end point, solves the problem of the weakest link:  the security posture of the end point is no longer dependent on the Windows Kernel, but on the hardware isolation capabilities of the CPU.

The link below has more information:-

http://blogs.bromium.com/2014/05/01/why-lol-and-did-cant-stop-a-wtf/

Skype and Data Exfiltration.

A detailed SANS Document (PDF) on everything you wanted to know about Skype

Link to PDF
https://www.sans.org/reading-room/whitepapers/covert/skype-data-exfiltration-34560

Implementing Forgot Password with Email

Nothing great, it just outlines all the necessary steps in one place.



The link below has more information:-
http://appsecnotes.blogspot.com/2014/04/implementing-forgot-password-without.html

BlindElephant - Web Application Fingerprinter

 Attempts to discover the version of a (known) web application by comparing static files at known locations against pre-computed hashes for versions of those files in all all available releases

Follow this link if interested:

http://blindelephant.sourceforge.net/