Black Hat USA 2013 Showcases NAND, Windows 8 Secure Boot Hacking Talks
A posting from Dark Reading in there Authentication Section: As July’s Black Hat US in Las Vegas nears, organizers have confirmed another trio of highlighted Briefings from the show, which all focus, in some way or other, on getting under the skin of key systems. Here’s the official rundown:
– Technologies don’t get much more ubiquitous than NAND memory, which is used in just about every gadget going. But ubiquity rarely equals safety, as Josh “m0nk” Thomas will demonstrate in “Hiding @ Depth: Exploring, Subverting, and Breaking NAND Flash Memory.” Thomas will show how NAND hardware can be subverted to hide persisting files, opening the door to everything from basic malwares to full-on device bricking. He’ll release two open-source Android tools to both hide and reveal these hidden files, and explore the security implications of NAND’s striking vulnerabilities. Think there’s an easy fix? Unlikely. Come to the session for the full appraisal.
— Windows 8’s Secure Boot, based on UEFI 2.3.1’s Secure Boot, marks a needed, long-in-coming step toward securing boot sequences against malware. But as ever, the devil is in the minute details, and it turns out that platform vendors are making certain mistakes that can completely undermine Secure Boot’s intended protections. Join Intel’s Yuriy Bulygin for “A Tale of One Software Bypass of Windows 8 Secure Boot,” in which he’ll demo a full software bypass of Windows 8 Secure Boot and explain how these breaches could HAve been avoided had the hardware vendors done things differently.
To read more click here:
Bad SSH Key Management Leaves Databases At Risk
A posting from Dark reading in there Database Security Section:
A “gaping hole” in the way enterprises govern the use of one of IT’s least sexy but most used access control and encryption protocols is leaving many sensitive database servers and other network devices at serious risk.
Secure Shell (SSH)–a Swiss army knife in the arsenal of many an IT department–is best known for aiding in the creation of encrypted tunnels to secure remote access and file transfers, but has gradually gained even more acceptance as a way to secure machine-to-machine connections to help enterprises move large amounts of valuable and sensitive data.
But experts say that enterprises do such a poor job managing the public/private key pairs upon which the protocol depends that they’re putting many of their most sensitive data assets at risk, including database servers that use SSH to connect with applications that tap into them.
According to Charles Kolodgy, analyst for IDC, at most enterprises the internal means by which organizations manage their SSH keys are “often clumsy and decentralized.” What’s more, when organizations do take steps to secure use of keys by central access by only a few privileged administrators, they often don’t monitor those privileged insiders for policy violations, creation of rogue keys or other suspicious behavior that could put the security of SSH communications in jeopardy.
To real more click here:
‘Activation lock’ to tighten iOS security
A posting from Cnet News in there Security and Privacy section; Apple may not be able to do anything to stop a mugger from stealing your iPhone, but changes in iOS 7 will prevent the thief from trying to sell the phone as new.
At its Worldwide Developers Conference here on Monday, Apple unveiled several security enhancements. Activation Lock is the most interesting. Though the company didn’t go deep into detail on the new feature, Apple’s head of Mac software engineering, Craig Federighi, said the feature prevents unauthorized resetting of an iPhone or iPad.
Basically, if the Find My Phone tracking utility has been deactivated, or if the phone has been wiped, the thief will have to know the owner’s Apple ID and password before the device will work again.
To read more click here:
Microsoft announces five Bulletins for Patch Tuesday, including Office for Mac
A posting from Naked Security:
Midsummer Patch Tuesday (or midwinter, depending on your latitude) takes place on Tuesday 11 June 2013.
As you probably already know, Microsoft publishes an official Advance Notification each month to give you early warning of what’s coming.
These early notifications generally don’t give any details, summarising only the basics, such as:
- The number of Bulletins (read: security patches) you’ll get.
- The severity levels (read: urgency) of the patches.
- The products or components being fixed.
- Whether a reboot is required.
And June’s answers, as briefly as possible, are:
- Five.
- One critical and four important.
- Windows and Office.
- Yes.
So it sounds on the surface like a light month, with only two remote code execution (RCE) vulnerabilies to worry about.
To read more click here:
Facebook forensics? What the feds can learn from your digital crumbs
An interesting article In NBC News in there Technology section:
Bits of you are all over the Internet. If you’ve signed into Google and searched, saved a file in your Dropbox folder, made a phone call using Skype, or just woken up in the morning and checked your email, you’re leaving a trail of digital crumbs. People who have access to this information — companies powering your emails and Web searches, advertisers who are strategically directing ads at you — can build a picture of who you are, what you like, and what you will probably do next. Revelations about government counter-terrorism programs such as PRISM indicate that federal agents and other operatives may use this data, too.
“Google knows what kinds of porn everyone in the world likes,” Bruce Schneier, a security and cryptography expert told NBC News. Not only are companies tracking what you are doing, they are correlating it, he said.
To read more click here:
12 Endpoint Security Myths Dispelled
A posting from Dark Reading in there Endpoint Security section:
It’s been years now since the security pundits have taken up the mantle to dispel the myth that AV alone is enough to protect the typical endpoint. And while that misconception does hang on in certain quarters, to a large degree it has been discussed ad nauseum. And that’s too bad, because there are plenty of other misapprehensions and delusions out there about endpoint security that are ignored in the process.
Dark Reading recently talked to a spate of security experts to get them to weigh in on some of the other myths that get in the way of smart endpoint protection strategies. Here is the dirty dozen.
TO read more click here:
