WATCH OUT - If you (still) an AOL subscriber

Remember the Queen song, Another one bites the dust.....

According to the article:-

Monday AOL's security team, said in a security update that third-party digital forensic investigators hired by the company found "unauthorized access to information regarding a significant number of user accounts." The information accessed by attackers "included AOL users' email addresses, postal addresses, address book contact information, encrypted passwords, and encrypted answers to security questions that we ask when a user resets his or her password, as well as certain employee information."

The breach is a further reminder that people should never reuse the same password on multiple sites. In the wake of the AOL breach, accordingly, "if you were using the same password for any other online account -- which is, as we have discussed many times before, very bad practice -- then you need to change those passwords too,"

The link below has more information:-

http://www.darkreading.com/attacks-breaches/aol-subscriber-data-stolen-youve-got-pwned/d/d-id/1234927

HeartBleed - How to extract the private Key?

The author provides details.



The link below has more information:-

http://arstechnica.com/security/2014/04/how-i-used-heartbleed-to-steal-a-sites-private-crypto-key/

Little obscurity in Security might actually be a good thing

I kind of agree as long as 

• It is an additional layer
• One does not rely on the obscurity factor fully
• the cost benefit ration is in favor of Obscurity

According to the article:-

Supplementary defenses include

1. Changing a server’s default port 
2. Server header masquerading
3. Use non-standard naming conventions

The link below has more information:-

http://www.darkreading.com/risk/how-a-little-obscurity-can-bolster-security/d/d-id/1204452

Free Web Assessment Tool - RAWR

RAWR – Rapid Assessment of Web Resources

It does have a few pre-reqs


The link below has more information:-
http://www.darknet.org.uk/2014/04/rawr-rapid-assessment-of-web-resources/

Jail broken iPhones have a new app "UNFLOD" - A Malware that steals Apple passwords.

According to the article:-

readers reported their jailbroken iOS devices recently started experiencing repeated crashes, often after installing jailbroken-specific customizations known as tweaks that were not a part of the official Cydia market, which acts as an alternative to Apple's App Store.

security researcher Stefan Esser has performed what's called a static analysis on the binary code that the reddit users isolated on compromised devices. In a blog post reporting the results, he said unflod hooks into the SSLWrite function of an infected device's security framework. It then scans it for strings accompanying the Apple ID and password that's transmitted to Apple servers. When the credentials are found, they're transmitted to attacker-controlled servers.

reddit readers said unflod infections can be detected by opening the SSH/Terminal and searching the folder /Library/MobileSubstrate/DynamicLibraries for the presence of the Unflod.dylib file. Compromised devices may possibly be disinfected by deleting the dynamic library, but since no one so far has been able to figure out how the malicious file is installed in the first place, there's no guarantee it won't somehow subsequently reappear.

The link below has more information:-

http://arstechnica.com/security/2014/04/active-malware-campaign-steals-apple-passwords-from-jailbroken-iphones/

Apparently, even the most secure cloud storage may not be so secure

Isn't that  common sense?

If possible/practical the simplest solution is to encrypt it before uploading to cloud

According to the article:-

Whenever data is shared with another recipient through the cloud storage service, the providers are able to access their customers' files and other data,

It's like discovering that your neighbors left their door unlocked. Maybe no one has stolen anything from the house yet, but don't you think they'd like to know that it would be simple for thieves to get inside?

The link below has more information:-

http://www.pcadvisor.co.uk/news/security/3512712/even-the-most-secure-cloud-storage-may-not-be-so-secure-study-finds/

SQL Injection attack - Still successful according to Ponemon Institute.

I guess , it does not matter if  Injection attack is #1 in OWASP top 10.

According to the article:-

52% of respondents said that their organizations don’t even test or validate third-party software they use to see if it’s vulnerable to SQL injection.

Other findings in the study include:

1. Nearly half (46 percent) were familiar with the term “WAF Bypass” 56 percent agreed or strongly agreed that determining the root cause of SQL injection is becoming more difficult because of the trend for employees to use their personally owned mobile devices in the workplace (BYOD)
2. 52 percent of respondents indicated that they don’t test or validate any third party software to ensure it’s not vulnerable to SQL injection
3. 44 percent utilize professional penetration testers to identify vulnerabilities in their IT systems; but only a third (35 percent) of those penetration tests included testing for SQL injection vulnerabilities
4. 88 percent of respondents had a favorable or very favorable opinion of the use of behavioral analysis technology for detecting SQL injection attacks
5. 52 percent indicated they either had begun replacing or would be replacing their signature-based IT security systems with behavioral analysis based IT security systems within the next 24 months
6. 49 percent said they would be using behavioral analysis based systems specifically for database transaction security

The link below has more information:-

http://www.tripwire.com/state-of-security/top-security-stories/organizations-remain-vulnerable-to-sql-injection-attacks/