Security Enabled Network

In an earlier article on his blog he discussed using TTL as a security feature. Someone came up with a method of using TTL to prevent someone from poisoning the cache on a server unless the TTL (time-to-live) on a record has expired. Kaminsky states several things wrong about this. One is that the TTL on servers vary and for those servers that have vary high TTL’s it can actual cause of a lot of problems and for those with very low TTL’s, you don’t gain much value from it.

For more on Kaminsky’s take on TTL being used to try and fix DNS, you can read his statements on his blog. It will be interesting to see what people come up with to secure DNS.

A larger concern about the service is the fact that the service does not use SSL security when transferring data from one account to another. The service is an email, contant, and file management service that allows users to collaborate with each other. Account and credential information is encrypted, but not the data that the users send. This is a larger concern due to the fact that users may not be completely aware of this issue and sensitive and confidential data may be transferred over the web and put at risk.

The combination of knowing the users email address and being able to openly view transferred data through the service could allow an attacker to target their attacks knowing direct information about the user.

With that said, Apple is not the only one to blame when it comes to openly displaying usernames in a public webpage format. Many social network sites display a user’s login name on searchable webpages that can then be used to find information on the user. One more lesson on how the internet is an open and public forum.

It runs each new browser tab in a seperate sandbox. Each tab gets its own process and memory space. This means that one tab cannot crash another, so you won’t lose all your sessions if just one of them hangs. This also means that

This ’sandboxing’ technique that it uses Google claims to protect against malicious data from websites. If a website is causing an issue, it is contained within Chrome and simply closing the browser will protect your PC. However, Google admits that installed plugins in the browser bypass this security feature.

It also features a privacy mode. This is similiar to Microsoft’s InPrivate mode. No user information is recorded while in this mode. No usernames, passwords, website history, form data, etc, are recorded or stored while in this mode. This is useful for users using a public PC and can’t guarantee privacy. This does not protect against your data once it leaves the PC however. Once the data leaves the PC it is still vulnerable to attackers sniffing out data over the network.

Similiar to current features in Internet Explorer, Chrome will also download the latest list of known phishing sites to protect and warn users from unknowingly accessing a phishing site.

All these security features however are nothing new with Internet Explorer and Firefox already in the market and claiming their stake in the “high security” web browser market. It will take something new and extraordinary from Google to take market share away from Microsoft and Mozilla.

With a man in the middle attack, an attacker can route all traffic between the

At Carnegie Mellon University, researchers have developed a possible way to ensure that transactions over the internet with unverified servers are secure. The method is called “Perspectives.” It uses a system of notaries that maintains a history of public keys used with the server. The client can use a web interface to verify that the key received is the same key that the server received. In order for the man in the middle attacker to successfully issue the attack, they would need to successfully initiate a man in the middle attack on both the client and the notary. This makes it very difficult to successfully launch the attack.

This method however, is not a replacement for the current PKI system. Perspectives assumes that the man in the middle (MITM) is close in proximity to either client; the client user and the notary. For example, the MITM might be in the same subnet as the client. But, if the MITM is close enough to the server so that both the client and the notary must pass through the MITM to access the server, then the attack may be successful without the Perspectives system being able to detect it.

The Perspectives system also needs to maintain a history of public keys used in order for the system to work. So while the chances are slim, but if a MITM server were to go up at the same time as the notary server, then validity of the notary server is compromised from the start.

For the time being SSL CA’s and PKI is here to stay and is the most efficient and effective way to secure trusted transactions between client and servers. But Perspectives has an intuitive way to verify untrusted certificates and it will be interesting to see if this method takes off in the future.

While this is not a new discovery, the recent demostration helps show how unstable and insecure the core infrastructure of the

For now however, the only solution to any privacy over the internet is to use point-to-point encryption such as a VPN tunnel. Send data over the internet without encryption and you risk compromising it.

Managing endpoint security and control on your network is a key factor in your overall

The best way to combat against blended attacks today is with a blended or multi-layer endpoint security solution. Intrusion prevention systems are a must. They are not just a solution for enterprise business, but also for small and medium sized business, if not even more so. Today small businesses are becoming a large target for attackers. This is due to the fact that many small businesses process credit card information today, but then lack the budget for a quality endpoint security and control infrastructure. This makes them a an easy target for attackers.

Your endpoint security and control infrastructure today contains several features that help protect your network. They typically involve several of the following forms of protection: antimalware, desktop firewall, hardware gateway firewall, intrusion prevent and detection, device control, application monitoring, and network wide event monitoring. All these facets are usually monitored and controlled to provide a comprehensive endpoint security solution. Because each facet can now be broken down into a seperate product in and of itself, it allows for scalability among all business levels.

Some of the flaws of online banking security that were noted were things such as being able to access the site by using insecure HTTP, being redirected to an untrusted site, low security password thresholds, and emailing confidential data to users. These are all flaws that have been found that if a user is unaware of the risks that these designs pose, can lead to confidential data being leaked.

As far as user password information goes, many of the sites involved in the study don’t require password restrictions for users. Having low quality passwords invite themselves to being disclosed by brute-force attacks. But it is also noted that with the introduction of phishing sites and keyloggers, having a strong password doesn’t protect against those and many banks find it to be just an inconvenience for their users to force strong passwords. It is also claimed that by enforcing a ‘three-strikes’ lockout policy when incorrectly typing in a password makes brute-force attacks on low quality passwords unrealistic. But the study finds that even enforcing a lockout policy is not enough if low quality passwords are allowed. Parallel dictionary attacks can be used if a list of usernames are available where a string of authentication requests are run across all the usernames using common passwords.

The study also mentions websites that break the chain of trust. Often times bank websites will redirect to other websites without notice. Regardless of whether these sites are secured by using SSL, many times the certificates used are not affiliated with the bank at all and there is no way for the user to tell if they are still on the banks website or not. This makes it hard for even a knowledgable user to know if they are on a phishing site or not.

As mentioned, other sites present secure login options under insecure webpages. While their site may offer secure logins via SSL and HTTPS, that same webpage may be available insecurely under an HTTP version. While redirection to a secure page may occur, if the user had already entered in credential information under the insecure page, their credentials are at risk of being compromised.

For more information on this online banking security study, you can visit the following page: Analyzing Websites for User-Visible Security Design Flaws