July 25, 2008

DNS attack reminder

Ladies and Gentleman managing DNS servers.

Please, remind to review your DNS and firewall configurations in order to ensure random source ports!

I've seen several "patched" DNS servers going to the internet with fixed source ports, something that more or less nulls the patches released by the vendors.

Why not to test your DNS today? (tip by Rubens Kuhl Jr.)

https://www.dns-oarc.net/oarc/services/dnsentropy

November 01, 2006

Aladdin Day: Tel Aviv

I could never imagine that I would ever hear the expression "two factor authentication" so many times. :-)

IMS Security

In my article, Voice over IP: New Telephony and Security, I've made a quick comment regarding the IP Multimedia Subsystem however no details or explanations were provided. Recently Emmanuel Gadaix, a great person and amazing professional, made a introductory presentation regarding IMS Security. The PPT file can be found here.

The picture get clearer every day: It's not only a convergence of technologies but also a convergence of problems.

October 28, 2006

The quest for the Holy Grail

Ross Anderson posted a comment regarding an idea that the British banking system is studying as a solution to eliminate phishing attacks. Anderson's comments are greatly precise but I got myself thinking:

Is the search for an ideal strong authentication a quest for a new holy grail?

October 27, 2006

It’s a wild world

Recently Pedro Dória, a journalist friend of mine posted some interesting results about this new toy, Google Trends. I was doing some tests when I got surprised by one of the query results.

Bellow we can se the results for volume of search of three different queries: exploit, windows exploit and linux exploit.


exploit



linux exploit



windows exploit


Although I tend to agree that Google is not the best reference for exploit distribution, this drop of queries is at least an interesting phenomenon. Any guess? Would this an evidence of the change of the electronic crime profile from the teenager non motivated cracker to the electronic criminal groups?

October 25, 2006

Laptop seizure, a reality not so distant from you

Not a long time ago, Bruce Schneier posted on his blog a note regarding Laptop seizures by the Sudanese government and mentioned rumors about this practice in Israel. After few days he edited the post observing that currently this is a legal practice within USA borders. Let's say it was a quite funny repercussion.

Now, circa one month after the International Herald Tribune published an article about this issue. The article mentions that "an informal survey by the Association [of Corporate Travel Executives], which has about 2,500 members worldwide, indicated that almost 90 percent of its members were not aware that customs officials have the authority to scrutinize the contents of travelers' laptops and even confiscate laptops for a period of time, without giving a reason".

Still, according to the article, "the law is clear. They don't need probable cause to perform these searches under the current law. They can do it without suspicion or without really revealing their motivations."

Sounds like a great reason to use and encrypted flash disk to carry private or sensitive information!

September 25, 2006

Where is my shawarma (or, Identity Theft, israeli style)

As some of you know, I was born in Brazil and I had been living in Israel since may 2006. This is my second time in the country. First time was last year when I came here to work. I liked the place so much that I decided to come back and enjoy the Mediterranean life.

Life in this country is quite nice but a little bit peculiar. Firstly because of the fact that most people don't have a single clue about what is living in here, specially on what regards to secret Israeli food like Shawarma and the Sabich. Secondly, because this country is full of weird surprises like the one that I'm trying to write about.

One of the basic steps to become a local is to get new documents specially because in Israel it is obligatory to carry an identification document with you. That may sound a little bit awkward for USA and UK citizens however if you consider that in Brazil every identified citizen has his fingerprints collected, Israel is not so bad. :-)

As far as my current knowledge allows me to say, the Israeli main identification document is called Teudat Zehut that is a very cool and big ID card... With a lot of information, like your parents name, your Jewish birthday date and if you consider the appendix it will have even your home address. In other words it has a lot of stuff that you don't want to care about. So in order to make things easier a lot of citizens choose to carry only their driving license that has enough information and has the size of a credit card. So did I. After passing on the exams, here I was anxious to have my local driving license.

Well, after few weeks waiting I was happy to receive it by mail, however, I'm quite shocked with the lack of precautions that some local government agencies are dealing with the Teudat Zehut number. As what it seems as a normal behavior, my ID number could be easily read on the envelope containing my new document, exactly as it happened when my Israeli Passport was delivered at home. The main difference is that while my passport required a signature, which means that it wouldn't be left in my mailbox, the driving license was lonely in my mailbox. In fact considering that I received it during a holyday, it seems like my driving license was either delivered on someone else mailbox or was took by someone "for a walk".

May sound too paranoid? Maybe... I'm still discovering what can be done just with the number of my Teudat Zehut, still, this is not a very safe behavior. Sounds like the obvious is true: Identity theft is not the country main concern.


September 20, 2006

Becker and Posner on Identity Theft

The 1992 Nobel Prize in Economic Sciences, Gary Becker and his fellow Professor, Judge Richard Posner posted on Deterring Identity Theft.

Becker

&

Posner


As an information security professional and frequent reader of their posts all I can say is that I will keep reading their blog despite those weird posts. :-)