This is a post with post format of type Link
Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massa. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem. Nulla consequat massa quis enim.
Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massa. Cum sociis natoque penatibus.
Security Risk of Shortened URLs and How to Expand Them
Shortened URLs are a fixture in the social networking world. They are the cryptic URLs you normally see on your Twitter feed as well as on Facebook.
The problem lies with being able to see if the link is authentic are not. Just by observing the link, you cannot tell and hackers are using that deficiency to their benefit.
The sensible thing is to review the shortened URLs before you access it.
With the popular “TinyURL” service, if you add “preview.” before the “tinyurl.com” portion of the URL it will show the actual link.
For example, you can change:
http://tinyurl.com/6p2b88o into http://preview.tinyurl.com/6p2b88o
It will take you to a site where you can observe the URL. In this case, the site was trying to give away coupons, but it could have just as well been a malicious site.
You can also configure your browser to take you to the preview page whenever you click on a tinyurl.com shortcut. If you go to http://tinyurl.com/preview.php you can set a cookie (Good One) for it to occur.
Most other URL shortened services allows you to place a “+” to preview a shortenedURL, for example:
http://bit.ly/z4m953 to http://bit.ly/z4m953+ will take you to an interview Mario Armstrong conducted at CES 2012.
They are also web-based URL expanding services available. Here are a few we tested which allowed us to expand shortened URLs. These services are completely free with no need to sign-up or buy anything.
Lastly, a Firefox extension called “LongURL” allows you to preview the full URL when you put your cursor over a shortened URL. This is much more convenient than some of the manual processes since it saves a lot of time.
LongURL currently supports more than 180 known URL-shortening services and it can be retrieved as a standard Firefox add-on or as a Greasemonkey script.
If you don’t use Firefox, you can go to LongURL.org and paste any shortened URL to see the expanded URL.
Effective password testing using Metasploit
This is from a Rapid7 email:
Effective password testing using Metasploit
Software vulnerabilities receive most of the limelight in network security, but weak, shared, and mismanaged passwords are often the biggest threat to most organizations.
Assessing password issues can be difficult; many problems are not visible to standard security tools and few if any organizations include extensive password testing, outside of offline cracking, into their assessment process.
In this technical webinar for IT and security engineers, HD Moore shows participants how to test their network for common password mistakes, using a combination of open source and commercial tools. This webinar will include a special section highlighting recent research into SSH public key issues.
When: Thursday, January 19th, 2 pm -3 pm EST
Presenter: HD Moore, CSO at Rapid7 and Chief Architect, Metasploit
HD is Chief Security Officer at Rapid7 and Chief Architect of Metasploit, the leading open-source penetration testing platform. HD founded the Metasploit Project in the summer of 2003 with the goal of becoming a public resource for exploit code research and development. Prior to joining Rapid7 and continuing his work on the Metasploit Framework, HD was the Director of Security Research at BreakingPoint Systems, where he focused on the content and security testing features of the BreakingPoint product line. Prior to BreakingPoint, HD spent seven years providing vulnerability assessments, leading penetration tests, and developing exploit code.
Oracle Critical Patch Update (CPU) for Tues Jan 17th 2012
FYI for those running Oracle products such as OracleDB, Glassfish, MySQL, Solaris, etc. The following links will provide additional information to assist you.
Oracle Critical Patch Update (CPU) Pre-Release Announcement – January 2012
http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
Oracle Plans 78 Security Fixes for Upcoming Critical Update
https://threatpost.com/en_us/blogs/oracle-plans-78-security-fixes-upcoming-critical-update-011412
Critical Patch Updates are the primary means of releasing security fixes for Oracle products to customers with valid support contracts. They are released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:
- 17 January 2012
- 17 April 2012
- 17 July 2012
- 16 October 2012
For Oracle Java SE Critical Patch Updates, the next three dates are:
- 14 February 2012
- 12 June 2012
- 16 October 2012
A pre-release announcement will be published on the Thursday preceding each CPU release.
This is a standard post format with preview Picture
Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massa. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus.
Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem. Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate eget, arcu. In enim justo, rhoncus ut, imperdiet a, venenatis vitae, justo. Nullam dictum felis eu pede mollis pretium. Integer tincidunt. Cras dapibus. Vivamus elementum semper nisi.
SANS Mobile Device Security Summit 2012: The Growing and Constantly Changing Challenge
Summit: March 12-13, 2012
Post-Summit Course: March 14-15, 2012
Event Link: http://www.sans.org/info/96671
Mobile Devices continue to evolve, and with each development there are becoming more efficient tools employees increasingly rely on to conduct both their corporate and personal business. Portable applications that allow the user to access sensitive corporate data are prime targets for hackers and provide them a wide range of access port to data. Controlling security breaches of mobile devices is complex due to the varying software and device types. Additionally, many organizations have no restrictions on the use of personal devices.
Mobile device security experts and practitioners will discuss the best approaches to this new and evolving challenge. Organizations who have developed successful mobile device security programs will share how they developed and gained management support for their plans.
*** Save $150 off your registration by using discount code: Refer_SecOrb ***
