The SecurityOrb Show – An Interview with Sean-Philip Oriyano, CEO of Oriyano Media, Author, Trainer and Speaker – 6/18/2015
Listen to what Sean has to say here:
Sean is a 20 year veteran of the IT field who has worked with a wide variety of clients delivering unique and innovative solutions. During his career he has spent his time in the field performing many of the roles in IT from support to training and management functions.
In addition to writing and consulting Sean also is a guest host on IT Pro TV (www.itpro.tv) where he specializes in Information Security and related topics.
The SecurityOrb Show listeners can use the code “ORIYANOCEH50” which is good for 50% off of the normal subscription price on IT Pro TV (www.itpro.tv) for as long as they keep their subscription active. It will take the monthly subscription price down to just under $29 a month or $290 or so a year (based on a $57 a month or $570 a year).
Sean’s book titles can be located here:
http://www.amazon.com/Sean-Philip-Oriyano/e/B004U03RX8
A Record Number Attended the ISSA-LA 7th Annual Information Security Summit on Cybercrime and Solutions at the Los Angeles Convention Center
A Record Number Attended the ISSA-LA 7th Annual Information Security Summit on Cybercrime and Solutions at the Los Angeles Convention Center
World Renowned Cybercrime Experts Spoke at the Largest Cybersecurity Conference of its Kind on West Coast
Los Angeles, CA –June 11, 2014 – Nearly 1,000 cybercrime experts, information security professionals, law enforcement investigators and C-Suite business executives attended the Los Angeles Chapter of the Information Systems Security Association (ISSA-LA)7th Annual Information Security Summit, The Growing Cyber Threat: Protect Your Business.
This diverse group of attendees reflected the new reality that cybercrime impacts the financial stability of all organizations and industries such as business, nonprofits, government agencies, schools, healthcare and financial services. The F.B.I. now ranks cybercrime as one of its top law enforcement activities. The Summit advances ISSA-LA’s core belief that ‘It takes the village to secure the village’ SM, which means that individuals, organizations and law enforcement need to work together to prevent cybercrime.
“Devastating cyber attacks on large corporations like Target, on major healthcare insurers like Anthem, on entertainment conglomerates like Sony, and on the U.S. Government are headlined almost daily,” said ISSA-LA President Stan Stahl, PhD. “Just last week a massive cyber attack affected the personal information of 4 million current and former federal employees. These information security breaches are the reasons for our annual summit. Each year we increase our attendance by information security professionals and C-Suite executives because of this ongoing crisis. Our summit attracts some of the most renowned cybercrime experts from private industry, governmental agencies and law enforcement to share their knowledge.”
Among this year’s more than 30 presenters were Bruce Schneier, internationally renowned security technologist, blogger and author of 12 books, who has been called a “security guru” by The Economist; David Kennedy, founder and CEO of TrustedSec, LLC, author and much sought after media resource; Assistant District Attorney Joseph Esposito and Ira Winkler, former President of ISSA International.
The Summit highlighted balancing privacy, law enforcement and defense strategies; online bank fraud and small business; healthcare HITECH/HIPAA privacy, security, and enforcement rules; executive forum for c-suite executives such as CEOs and CFOs; and women in security.
The ISSA-LA Summit is the only educational forum in Los Angeles specifically designed to encourage participation and interaction in finding solutions to cybercrime. The Summit is part of ISSA-LA’s important community outreach program. The goal of the program is to help the community stay safe from cybercrime by enabling the necessary collaboration between business, nonprofit and community leaders, technical IT professionals, law enforcement and the information security community.
About ISSA-LA
The Los Angeles Chapter of the Information Systems Security Association (ISSA-LA) is the premier catalyst and information source in Los Angeles for improving the practice of information security. The Chapter provides educational programs for information security and IT professionals. The Chapter also conducts outreach programs to businesses, financial institutions, nonprofits, governmental agencies, and consumers. ISSA-LA is the founding Chapter of the Information Systems Security Association, an international not-for-profit organization of information security professionals and practitioners. Please follow the Chapter on Twitter at @ISSALA as well as LinkedIn, YouTube and Facebook.
Mozilla Firefox Multiple Vulnerabilities-01 May15 (Mac OS X)
| Vulnerability | Severity
|
Host | Location | Actions | ||||||||||||||
|
Mozilla Firefox Multiple Vulnerabilities-01 May15 (Mac OS X) |
192.168.1.106 | general/tcp |
  |
|||||||||||||||
|
SummaryThis host is installed with Mozilla Firefox and is prone to multiple vulnerabilities.
Vulnerability Detection Result
Installed version: 35.0.1 Fixed version: 38.0 ImpactSuccessful exploitation will allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code, bypass security restrictions, bypass origin restrictions, gain knowledge of sensitive information, run custom code, cause the server to crash and gain privileged access.
Impact Level: System/Application SolutionUpgrade to Mozilla Firefox version 38.0 or later, For updates refer to http://www.mozilla.com/en-US/firefox/all.html
Vulnerability InsightMultiple flaws are due to: – Flaw in WebChannel.jsm module in Mozilla Firefox. – Integer overflow in libstagefright in Mozilla Firefox. – Buffer overflow in the XML parser in Mozilla Firefox. – Race condition in the ‘nsThreadManager::RegisterCurrentThread’ function in Mozilla Firefox. – Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox. – Flaw in Mozilla Firefox so that does not recognize a referrer policy delivered by a referrer META element. – Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox. – Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox. – Flaw in asm.js implementation in Mozilla Firefox. – Flaw in GStreamer in Mozilla Firefox.
Vulnerability Detection MethodGet the installed version with the help of detect NVT and check the version is vulnerable or not.
Details: Mozilla Firefox Multiple Vulnerabilities-01 May15 (Mac OS X) (OID: 1.3.6.1.4.1.25623.1.0.805626) Version used: $Revision: 1271 $ References
|
||||||||||||||||||
Pidgin Multiple Vulnerabilities Feb 2014 (Windows)
| Vulnerability | Severity
|
Host | Location | Actions | ||||||||||||||||
| 192.168.1.10 | general/tcp |
|
||||||||||||||||||
|
SummaryThe host is installed with Pidgin and is prone to multiple vulnerabilities.
Vulnerability Detection ResultVulnerability was detected according to the Vulnerability Detection Method.
ImpactSuccessful exploitation will allow remote attackers to conduct denial of service or execute arbitrary programs or spoof iq traffic.
Impact Level: System/Application SolutionUpgrade to Pidgin version 2.10.8 or later, For updates refer to http://www.pidgin.im/
Vulnerability InsightThe flaws are due to an, – Improper validation of data by the Yahoo protocol plugin. – Improper validation of argument counts by IRC protocol plugin. – Improper validation of input to content-length header. – Integer signedness error in the ‘MXit’ functionality. – Integer overflow in ‘ibpurple/protocols/gg/lib/http.c’ in the ‘Gadu-Gadu’ (gg) parser. – Error due to incomplete fix for earlier flaw. – Integer overflow condition in the ‘process_chunked_data’ function in ‘util.c’. – Error in ‘STUN’ protocol implementation in ‘libpurple’. – Error in the ‘XMPP’ protocol plugin in ‘libpurple’. – Error in the MSN module. – Improper validation of the length field in ‘libpurple/protocols/yahoo/libymsg.c’. – Improper allocation of memory by ‘util.c’ in ‘libpurple’. – Error in the libx11 library. – Multiple integer signedness errors in libpurple.
Vulnerability Detection MethodGet the installed version with the help of detect NVT and check the version is vulnerable or not.
Details: Pidgin Multiple Vulnerabilities Feb 2014 (Windows) (OID: 1.3.6.1.4.1.25623.1.0.804314) Version used: $Revision: 302 $ References
|
||||||||||||||||||||
The SecurityOrb Show – An Interview with Jayson E. Street, InfoSec Ranger at Pwnie Express, Author and Speaker – 6/3/2015
The SecurityOrb Show – An Interview with Jayson E. Street, InfoSec Ranger at Pwnie Express, Author and Speaker – 6/3/2015
Jayson E. Street is the InfoSec Ranger at Pwnie Express … He is also a Senior Partner at Krypton Security and CEO of Stratagem 1 Solutions.
Jayson is the author of “Dissecting the hack: The F0rb1dd3n Network” plus creator of the site http://dissectingthehack.com. He also spoken at DEFCON, DerbyCon, UCON & at several other ‘CONs & colleges on a variety of Information Security subjects.
Listen to what Jayson has to say here:
Apache Web Server ETag Header Information Disclosure Weakness
| Vulnerability | Severity
|
Host | Location | Actions | ||||||||||||||
|
Apache Web Server ETag Header Information Disclosure Weakness |
x.x.x.x | 80/tcp | ||||||||||||||||
|
SummaryA weakness has been discovered in Apache web servers that are configured to use the FileETag directive.
Vulnerability Detection Result
Information that was gathered: Inode: 815822 Size: 177 ImpactExploitation of this issue may provide an attacker with information that may be used to launch further attacks against a target network.
SolutionOpenBSD has released a patch that addresses this issue. Inode numbers returned from the server are now encoded using a private hash to avoid the release of sensitive information.Novell has released TID10090670 to advise users to apply the available workaround of disabling the directive in the configuration file for Apache releases on NetWare. Please see the attached Technical Information Document for further details.
Vulnerability Detection MethodDue to the way in which Apache generates ETag response headers, it may be possible for an attacker to obtain sensitive information regarding server files. Specifically, ETag header fields returned to a client contain the file’s inode number.Details: Apache Web Server ETag Header Information Disclosure Weakness (OID: 1.3.6.1.4.1.25623.1.0.103122)
Version used: $Revision: 1218 $ References
|
||||||||||||||||||
