http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2016-04-26 21:37:30 - Security Bloggers Network : Setting the benchmark Beating thirty other products in threat detection and response capabilities Outstanding achievement in product leadership, technological innovation, customer service, and product development Superior capabilities for best addressing customer needs Wow While we certainly don t do what we do here for such accolades we do it to help our The post Setting the Benchmark in the Network Security Forensics Industry appeared first on Speaking of Security - The RSA Blog and Podcast http://www.secuobs.com/revue/news/604756.shtmlhttp://www.secuobs.com/revue/news/604756.shtml 2016-04-26 08:56:04 - Help Net Security : Who will be the victim of the next major breach Nearly all enterprises and organizations are sitting ducks for a targeted network attack Maybe it s time to take some significant steps and be able to proclaim We won t get breached again Preventative security cannot prevent a network intruder from penetrating a network 100pourcents of the time The best pen testers even guarantee that they can get into a network within two days Prevention is still More http://www.secuobs.com/revue/news/604689.shtmlhttp://www.secuobs.com/revue/news/604689.shtml 2016-04-25 16:26:32 - Global Security Mag Online : Juniper Networks annonce l'ajout de plusieurs solutions innovantes à son offre de services virtualisés et cloud, dans le cadre de son activité SDSN Software-Defined Secure Networks - réseaux dont la sécurité est définie par logiciel Les nouveautés incluent un pare-feu virtuel compact et containerisé baptisé Juniper Networks cSRX Il s'agit d'un pare-feu de nouvelle génération, fournissant des services de sécurité pour les réseaux SDN Autre nouveauté une version multi-cœur du Juniper Networks vSRX, - Produits http://www.secuobs.com/revue/news/604629.shtmlhttp://www.secuobs.com/revue/news/604629.shtml 2016-04-25 14:46:52 - SecurityTube.Net : TROOPERSCON - Keynote Ethics in Networked Systems Research For More Information Please Visit - https wwwtroopersde http://www.secuobs.com/revue/news/604593.shtmlhttp://www.secuobs.com/revue/news/604593.shtml 2016-04-25 14:46:52 - SecurityTube.Net : In many countries you can enjoy free wifi access to the internet nearly everywhere Also in most industrialized countries you have mobile data contracts with a lot of data volume available this is a story for another talk but still important in our context In Germany we have neither of those The wifi problem is mostly due to a law called Störerhaftung which makes it nearly impossible to share your internet connection without expecting to get very expansive legal problems because you can be hold liable for what other people use the connection for This leads to a great market for the big ISPs and smaller companies, taking a lot of money from the users and the persons who want to provide the internet access only to protect them from a stupid law This is one of the problems where Freifunk comes into play Freifunk is a free and open wireless radio network community, a little bit like open source for networks and internet connections We try to build our own non-profit network on the basis of wifi connections and internet uplinks that people that share free of charge The idea behind Freifunk is an open, unlimited, anomymous to use and decentralized network built by the people living in a region But there is more to it than that We also try to teach the people how networks work and how to build and expand them on their own We try to bring the people in contact so a social community raises around Freifunk And of course, we also want to give the users back some power over the networks they use every day to release them from the bounds of big centralized commercial providers Sounds like a great idea This talk will be about how Freifunk works, from which real world problems it raised, what we already archived and what we try to archive in the future BEN OSWALD Ben is a Student at the University of Applied Sciences in Worms and currently writing his bachelor thesis in Applied Informatics He is the founder and head of Freifunk Rhein-Neckar and co-organizer of the MRMCD IT sec conference Beside these projects he is doing a lot of networking, software development and linux stuff For More Information Please Visit - https wwwtroopersde http://www.secuobs.com/revue/news/604590.shtmlhttp://www.secuobs.com/revue/news/604590.shtml 2016-04-25 14:46:52 - SecurityTube.Net : This talk focuses on the peculiarities which must be taken into account when building a wireless LAN with IPv6 support based on practical experience deploying IPv6 in the Troopers15 WiFi Network This includes, but is not limited to the handling of link-local multicast in Cisco based WiFi controller environments as well as IPv6 First Hop Security mechanisms on the WLC and the underlying wired infrastructure itself Furthermore we will try to provide statistics of the IPv4 IPv6 ratio for the Troopers15 WiFi Network eg how many clients are dual-stacked as well as the ratio of IPv4 and IPv6 traffic going to the Internet CHRISTOPHER WERNY Christopher has been involved with IPv6 since 2005 and has performed a number of IPv6 planning, implementation and troubleshooting projects tasks since then He leads the network security team at ERNW For More Information Please Visit - https wwwtroopersde http://www.secuobs.com/revue/news/604584.shtmlhttp://www.secuobs.com/revue/news/604584.shtml 2016-04-25 14:46:52 - SecurityTube.Net : A lot has happened in the area of IPv6 Network Reconnaissance in the last few years For starters, the myth of IPv6 scanning attacks being infeasible has been dismantled, and a number of tools have sparked in an attempt leverage both IPv6 address scans and other IPv6 network reconnaissance techniques This presentation will cover the latest tools and features for IPv6 network reconnaissance and, more importantly will release a brand-new tool for comprehensive IPv6 network reconnaissance A must-see must-attend for security practitioners in the need of finding juicy IPv6 nodes, whether for good or not FERNANDO GONT Fernando Gont specializes in the field of communications protocols security, working for private and governmental organizations around the world Gont has worked on a number of projects for the UK National Infrastructure Security Co-ordination Centre NISCC and the UK Centre for the Protection of National Infrastructure CPNI in the field of communications protocols security As part of his work for these organizations, he has written a series of documents with recommendations for network engineers and implementers of the TCP IP protocol suite, and has performed the first thorough security assessment of the IPv6 protocol suite Gont is currently working as a security consultant and researcher for SI6 Networks Additionally, he is a member of the Centro de Estudios de Informatica CEDI at Universidad Tecnológica Nacional Facultad Regional Haedo UTN FRH of Argentina, where he works in the field of Internet engineering As part of his work, he is active in several working groups of the Internet Engineering Task Force IETF , and has published more than twenty IETF RFCs Request For Comments and more than a dozen IETF Internet-Drafts Gont has also produced the SI6 Network's IPv6 Toolkit -- a portable and comprehensive security assessment and troubleshooting toolkit for the IPv6 protocol suite Furthermore he has been a speaker at a number of conferences and technical meetings about information security, operating systems, and Internet engineering, including CanSecWest 2005, FIRST Technical Colloquium 2005, Kernel Conference Australia 2009, HACKLU 2011, DEEPSEC 2011, Hackito Ergo Sum 2012, Hack In Paris 2013, German IPv6 Kongress 2014, IPv6 Security Summit 2014, and H2HC 2014 Additionally, he is a regular attendee of the Internet Engineering Task Force IETF meetings More information about Fernando Gont is available at his personal web site For More Information Please Visit - https wwwtroopersde http://www.secuobs.com/revue/news/604580.shtmlhttp://www.secuobs.com/revue/news/604580.shtml 2016-04-25 09:31:42 - Help Net Security : For its latest report, Vectra analyzed data from 120 customer networks comprised of more than 13 million hosts over the first quarter of 2016 All organizations showed signs of targeted attacks including internal reconnaissance, lateral movement or data exfiltration Of the 120 participating organizations, 117 detected at least one of these behaviors during each month of the study Despite that nearly 98 percent of organizations detected at least one behavior per month during the three-month More http://www.secuobs.com/revue/news/604536.shtmlhttp://www.secuobs.com/revue/news/604536.shtml 2016-04-23 22:54:07 - Slashdot Your Rights Online : An anonymous reader writes Dutch police have seized and shut down Ennetcom, an encrypted communications network with 19,000 users, according to Reuters The network's 36-year-old owner, Danny Manupassa, has also been arrested, and faces charges of money laundering and illegal weapons possession, while the information obtained in the seizure may also be used for other criminal prosecutions Police and prosecutors believe that they have captured the largest encrypted network used by organized crime in the Netherlands, prosecutors said in a statement Although using encrypted communications is legal, Reuters reports, many of the network's users are believed to have been engaged in 'serious criminal activity,' said spokesman Wim de Bruin of the national prosecutor's office, which noted that the company's modified phones have repeatedly turned up in cases involving drugs, criminal motorcycle gangs, and gangland killings A spokesman for the National Prosecutor's office declined to comment on whether and how police would be able to decrypt information kept on the servers IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/604492.shtmlhttp://www.secuobs.com/revue/news/604492.shtml 2016-04-22 15:42:17 - Help Net Security : The Dutch police has announced on Tuesday that they have pulled a system of encrypted communications used by Dutch and possible foreign criminals off the air, and that they have arrested a 36-year-old man from Nijmegen on suspicion of money laundering After much speculation, the name of the company that created the system and offered it as a service has been confirmed as Ennetcom If you visit the company s website, the following announcement is shown More http://www.secuobs.com/revue/news/604443.shtmlhttp://www.secuobs.com/revue/news/604443.shtml 2016-04-22 15:07:40 - Security Bloggers Network : Two-factor authentication 2FA is to be added to the PlayStation Network, offering members even greater security The post Two-factor authentication coming to PlayStation Network appeared first on We Live Security http://www.secuobs.com/revue/news/604438.shtmlhttp://www.secuobs.com/revue/news/604438.shtml 2016-04-21 15:22:16 - SecurityTube.Net : Michael Iedema - DakotaCon 2015 at Dakota State University, Madison SD For More Information Please Visit - http dakotaconorg http://www.secuobs.com/revue/news/604332.shtmlhttp://www.secuobs.com/revue/news/604332.shtml 2016-04-20 10:56:38 - Global Security Mag Online : Stormshield annonce le lancement de Stormshield Network for Cloud Provider Cette offre Cloud de sécurisation réseau en mode pay-as-you-go a été développée pour répondre aux problématiques de sécurité des professionnels du Cloud et de leurs clients Aujourd'hui, les responsables IT doivent faire davantage avec moins Il leur devient difficile voire impossible de déployer des infrastructures et logiciels en les payant d'avance, comme cela est souvent la règle Ainsi la migration vers le Cloud et les - Produits http://www.secuobs.com/revue/news/604204.shtmlhttp://www.secuobs.com/revue/news/604204.shtml 2016-04-20 09:12:29 - Global Security Mag Online : Palo Alto Networks , société spécialisée dans les services de sécurité a découvert une nouvelle famille de logiciels malveillants nommée PWOBot Ceux-ci sont assez uniques car ils sont entièrement écrits en Python, et compilés par PyInstaller pour générer un exécutable Microsoft Windows Ce type de malware a déjà touché un certain nombre d'organisations et de sociétés basées en Europe, en particulier en Pologne, au Danemark et en France En outre, le malware se répand via un service Web de partage de fichiers - Malwares http://www.secuobs.com/revue/news/604196.shtmlhttp://www.secuobs.com/revue/news/604196.shtml 2016-04-19 03:26:25 - New RFCs : 92KB DOI http://www.secuobs.com/revue/news/604062.shtmlhttp://www.secuobs.com/revue/news/604062.shtml 2016-04-18 16:02:40 - Information Security Today Essential Information for Managing the Security of a Modern Evolving En : This chapter from Analyzing and Securing Social Networks sets the stage to discuss both social media analytics and security It discusses various applications of social media analytics Then it considers applying various data mining techniques for social network analysis SNA , before discussing security and privacy aspects http://www.secuobs.com/revue/news/604028.shtmlhttp://www.secuobs.com/revue/news/604028.shtml 2016-04-18 15:23:13 - Global Security Mag Online : La Grande Loge de France a récemment porté plainte pour le piratage de plus de 6 000 documents sur un service Cloud http blogslexpressfr lumiere-fr Le pirate aurait utilisé un logiciel espion pour commettre son forfait Pour Joël Mollo, Vice Président EMEA de Skyhigh Networks Si l'on dispose pour l'instant de peu de détails concernant cette affaire et le type de service Cloud qui a été piraté, cela montre que la sécurité de ces services et leur implémentation sont encore largement - Malwares http://www.secuobs.com/revue/news/604022.shtmlhttp://www.secuobs.com/revue/news/604022.shtml 2016-04-18 11:00:02 - Global Security Mag Online : Emerson Network Power annonce la disponibilité du rack Knürr Miracel 2 en Europe, au Moyen-Orient et en Afrique EMEA Le Knürr Miracel 2 s'appuie sur toutes les caractéristiques distinctives du modèle original et a été conçu pour conserver une longueur d'avance sur les exigences du marché ainsi que sur les besoins des clients, en constante évolution Emerson Network Power annonce également le lancement de la version 19'' du PDU rack intelligent MPH2 qui vient compléter son offre de bandeaux de prises - Produits http://www.secuobs.com/revue/news/603994.shtmlhttp://www.secuobs.com/revue/news/603994.shtml 2016-04-18 08:49:37 - Help Net Security : Spring is here, which means many people will be cleaning their workspace and getting rid of the clutter on their desks If you re in charge of your organization s security, we hope you ve been keeping your network clean all year Nonetheless, there are some quick wins you can take to remediate infections on your network and mitigate cyber risk Below are a few spring cleaning tips organizations can apply towards their network security and encourage More http://www.secuobs.com/revue/news/603988.shtmlhttp://www.secuobs.com/revue/news/603988.shtml 2016-04-15 16:46:35 - Global Security Mag Online : La commission européenne vient d'annoncer l'adoption par le Parlement Européen du nouveau règlement européen relatif à la protection des données également appelé GDPR General Data Protection Régulation Je vous propose ci-dessous, le commentaire de Joël Mollo Directeur Europe du Sud Middle East de Skyhigh Networks sur cette actualité May the 4th be with UE - les entreprises européennes ont jusqu'au Star Wars day de 2018 pour se conformer à la réglementation européenne en matière de protection - Points de Vue http://www.secuobs.com/revue/news/603865.shtmlhttp://www.secuobs.com/revue/news/603865.shtml 2016-04-14 09:37:27 - Global Security Mag Online : Une nouvelle étude de Barracuda Networks publiée aujourd'hui a mis en évidence des opportunités considérables pour le réseau des distributeurs en ce qui concerne le nombre croissant de clients qui choisissent de migrer vers Microsoft Office 365 Des taux d'adoption d'Office 365, bien au-delà des prévisions Les prévisions pour la plateforme phare de Microsoft suggéraient un taux d'adoption d'environ 40 pourcents d'ici 2017 Toutefois, l'étude de Barracuda suggère que l'adoption a actuellement devancé ces - Points de Vue http://www.secuobs.com/revue/news/603724.shtmlhttp://www.secuobs.com/revue/news/603724.shtml 2016-04-13 15:54:11 - Global Security Mag Online : Emerson annonce la soumission d'une déclaration initiale d'inscription sur formulaire 10 auprès de la SEC Securities and Exchange Commission des États-Unis, en relation avec le projet de spinoff précédemment annoncé de sa division Network Power La nouvelle société se nommera Vertiv La soumission, qui détaille le projet d'Emerson de céder 100 pour cent des actions ordinaires en circulation de Vertiv par une distribution non imposable aux actionnaires, est une étape importante d'un processus qui - Business http://www.secuobs.com/revue/news/603641.shtmlhttp://www.secuobs.com/revue/news/603641.shtml 2016-04-13 09:17:14 - Help Net Security : Attacks on industrial control systems ICSs are increasing in frequency and have become a reality we can no longer ignore Securing these networks poses unique challenges, primarily because ICS networks are unlike traditional IT networks They use different technologies and perform discrete functions In order to protect them we first need to understand how they operate ICS networks are different Until recently, industrial networks were separated from the rest of the world by Air More http://www.secuobs.com/revue/news/603581.shtmlhttp://www.secuobs.com/revue/news/603581.shtml 2016-04-11 17:09:51 - Global Security Mag Online : Juniper Networks annonce l'acquisition de BTI Systems, fournisseur de solutions réseaux Cloud et métropolitains, visant à développer les capacités optiques au sein de ses solutions de commutation et de routage pour mieux répondre aux besoins des fournisseurs de services et cloud à une échelle mondiale L'association des deux sociétés permettra d'offrir une gamme complète de solutions robustes reposant sur une gestion unifiée de l'architecture et ainsi de répondre au besoin croissant du marché en termes - Business http://www.secuobs.com/revue/news/603437.shtmlhttp://www.secuobs.com/revue/news/603437.shtml 2016-04-08 14:11:43 - SecurityTube.Net : Bio Oliver Schuermann is a 12-year veteran of Juniper Networks came to Juniper as a security engineer via the NetScreen acquisition in 2004 Since then he has held multiple technical leadership positions within the company In the past, Oliver had the role of Technical Business Development Director for our Civilian Government and Education practice, as well as is a field advocate for automation Most recently, Oliver has taken the role of Sr Systems Engineering Director for Juniper US Commercial and Partner business In Oliver s almost 20-year industry experience he has held positions in Software Integration, Systems Engineering, and Technical Leadership in both the Enterprise, as well as the Service Provider space Prior companies include large service providers such as CenturyLink and McLeodUSA For More Information Please Visit - http wwwcentralohioissaorg http wwwirongeekcom iphp page videos centralohioinfosec2016 mainlist http://www.secuobs.com/revue/news/603232.shtmlhttp://www.secuobs.com/revue/news/603232.shtml 2016-04-08 02:22:37 - Office of Inadequate Security : Justin Heinze reports Einstein Healthcare Network may have suffered a data breach, they announced Thursday, and they are http://www.secuobs.com/revue/news/603168.shtmlhttp://www.secuobs.com/revue/news/603168.shtml 2016-04-07 13:37:07 - Security Bloggers Network : Safe Browsing Alerts for Network Administrators is being upgraded with useful information for IT specialists http://www.secuobs.com/revue/news/603092.shtmlhttp://www.secuobs.com/revue/news/603092.shtml 2016-04-07 12:17:51 - Security Bloggers Network : We've all seen the recent headlines of the sheer destruction that ransomware can bring upon your network, but we haven't seen many tips on defending against it With many companies paying the ransom to criminals after being infected, it's only promotin http://www.secuobs.com/revue/news/603080.shtmlhttp://www.secuobs.com/revue/news/603080.shtml 2016-04-07 11:21:59 - Global Security Mag Online : Emerson Network Power, une division d'Emerson a élargi ses plateformes de produits Trinergy Cube et Liebert 80-eXL suite à ses recherches intensives menées avec des clients clés dans ses Customer Experience Centers L'onduleur ASI Trinergy Cube jouit désormais de nouvelles capacités, notamment avec des modules de 200 kW et 400 kW De la même manière, la famille de produits Liebert 80-eXL va voir sa gamme plus que doubler au cours des prochains mois, et une version 1200 kW sera introduite dans la - Business http://www.secuobs.com/revue/news/603072.shtmlhttp://www.secuobs.com/revue/news/603072.shtml 2016-04-06 09:22:54 - Global Security Mag Online : Palo Alto Networks améliore sa plateforme de sécurité Ces améliorations ont pour but d'étendre les capacités de prévention des cyberfailles de la plateforme et de répondre aux besoins de sécurité des entreprises qui travaillent avec des environnements basés sur le cloud et des applications software-as-a-service SaaS La nécessité des entreprises de devenir toujours plus flexibles et compétitives influence la façon dont les applications commerciales sont développées, déployées et adoptées Les charges - Produits http://www.secuobs.com/revue/news/602971.shtmlhttp://www.secuobs.com/revue/news/602971.shtml 2016-04-06 08:44:06 - Global Security Mag Online : Aruba Networks, société du groupe HPE Hewlett Packard Enterprise , fait confiance à TD Azlan, la division à valeur ajoutée de Tech Data, pour distribuer sa gamme complète de solutions sans fil d'entreprise TD Azlan assurera l'ensemble de son accompagnement auprès des partenaires HPE, afin de déployer rapidement ses offres Pour optimiser cette nouvelle collaboration, TD Azlan a créé un panel d'outils éducatifs et marketing pour se familiariser rapidement avec les produits Aruba Cela permettra - Business http://www.secuobs.com/revue/news/602966.shtmlhttp://www.secuobs.com/revue/news/602966.shtml 2016-04-05 14:37:40 - Security Bloggers Network : The risk of sophisticated malware, especially of ransomware, has grown exponentially over the years This means we need to evolve our techniques for mitigation, detection and monitoring of malicious behavior on our assets It s a wise move given the durability of this threat Indeed, the rise of ransomware, which attempts to scare users and organizations Read More The post Creating a Malware Ransomware Defendable Network appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/602881.shtmlhttp://www.secuobs.com/revue/news/602881.shtml 2016-04-05 02:02:04 - Slashdot Your Rights Online : alphadogg quotes a report from Networkworld Browsing through the latest news releases from ITT Technical Institute you'd never think the for-profit school would be capable of the things that Massachusetts Attorney General Maura Healey says the state is suing it for The school, which boasts of over 130 locations in 38 states, touts its efforts for women in STEM, its donation of laptops to public schools in Indiana and its record giving for United Way But AG Healey is suing ITT Tech for engaging in unfair and harassing sales tactics and misleading students about the quality of its Computer Network Systems program, and the success of the program's graduates in finding jobs ITT Educational Services, however, rejected the AG office's claims and lashed out at the office for the manner in which it has brought the suit ITT's statement reads in part The litigation follows the Office's wide-ranging fishing expedition that lasted for more than three years If the state wins, the school could be forced to reimburse students for tuition and fees, though ITT says it will defend itself against the charges IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/602839.shtmlhttp://www.secuobs.com/revue/news/602839.shtml 2016-04-04 10:54:29 - Global Security Mag Online : Arbor Networks Inc annonce de nouvelles options de licence dans le cloud pour sa plate-forme de visibilité réseau Arbor Networks SP Ces nouvelles options engendrent des gains majeurs en termes de performances et d'évolutivité, offrant aux opérateurs, prestataires cloud, hébergeurs, grandes entreprises et autres exploitants de vastes réseaux une capacité d'extension flexible et dynamique de leurs déploiements Arbor Networks SP pour répondre de manière optimale aux besoins spécifiques de leur activité - Business http://www.secuobs.com/revue/news/602787.shtmlhttp://www.secuobs.com/revue/news/602787.shtml 2016-04-02 15:07:21 - Office of Inadequate Security : Joseph Cox reports A hacker has gained access to administrative functions on the porn website Team Skeet and is advertising http://www.secuobs.com/revue/news/602721.shtmlhttp://www.secuobs.com/revue/news/602721.shtml 2016-04-01 06:18:32 - Security Bloggers Network : For those willing to get introduced to the world of complex networks, the three lectures given by Mark Newman, a British physicist, at the Santa Fe Institute on 14,15 and 16 September 2010 are a great way to get to know a little bit about this field http://www.secuobs.com/revue/news/602611.shtmlhttp://www.secuobs.com/revue/news/602611.shtml 2016-03-31 03:43:56 - New RFCs : 25KB DOI http://www.secuobs.com/revue/news/602492.shtmlhttp://www.secuobs.com/revue/news/602492.shtml 2016-03-31 03:43:56 - New RFCs : 15KB DOI http://www.secuobs.com/revue/news/602491.shtmlhttp://www.secuobs.com/revue/news/602491.shtml 2016-03-30 01:41:38 - Risk Assessment Ars Technica : New server-targeting malware hitting healthcare targets with unpatched websites http://www.secuobs.com/revue/news/602376.shtmlhttp://www.secuobs.com/revue/news/602376.shtml 2016-03-29 23:17:58 - Security Bloggers Network : We introduced the concept of resilient cloud networks in the first post We define that as networks using unique features of the cloud to provide both a more secure and higher availability environment for your applications So in this post, let s dig into two different design patterns and show how cloud networking enables a higher degree of resilience Network Segregation by Default ------------------------------ But before we dive into the design patterns, let s make sure we were clear in the first post regarding the use of network segmentation to improve your security posture We understand that segmentation isn t novel, but it s still hard to do in a traditional data center Infrastructure running different applications gets intermingled, just due to the need to efficiently use existing hardware Even when you are operating a totally virtualized data center, it takes a lot of overhead and management to keep all of the applications logically isolated, which means it usually doesn t happen What s the downside of not segmenting properly It gives adversaries a clear path to your most important stuff They can compromise one application and then move deeper into your environment accessing resources not associated with the application stack they compromised So if they bust one application, there is a high likelihood they ll end up with free reign over everything in the data center The cloud is not like that Each server running in a cloud environment is associated with a security group, which defines at a very granular level the other devices each server can communicate with and over what protocols This effectively allows you to contain the ability of the adversary to move within your environment, even after compromising a server or application This concept is commonly known as limiting blast radius So if one part of your cloud environment goes boom, the rest of the infrastructure is not affected This is a key concept in cloud network architecture and will be highlighted in the design patterns described below PaaS Air Gap ------------ To demonstrate a more secure cloud network architecture, let s use an Internet-facing application that has both web server and application server tiers Due to the nature of the application, communications between the two layers can be done through message queues and notifications, so the web servers don t have to communicate directly The application server tier connects to the database running as a Platform as a Service offering from the cloud provider The application server tier also communicates with the traditional data center to access other internal corporate data outside of the cloud environment To be clear, the application must be architected for the get-go to support this kind of design You aren t going to take your 20 year old legacy general ledger application and move it to this design pattern with a significant re-architecture But if you are architecting a new application or have the ability to re-architect existing applications and want total isolation between the environments, this is one way to do it Let s describe the design PaaS Air Gap Network Security Groups The key security control you would typically use in this kind of architecture is a Network Security Group to allow access to the app servers only from the web servers, and only to the specific port and protocol required This is the kind of isolation which limits the blast radius, as described above To be clear, the NSG is applied to every instance, not the subnets This prevents implementing a flat network where access to any of the instances on a subnet would provide peer access to all the others PaaS Services Although in this application, you wouldn t provide access from the web server NSG to the app server NSG because the architecture of the application doesn t require any communication between the web servers and the app servers The cloud provider offers a message queue platform and a notification service that is used to provide the communication asynchronously between the web tier and the application tier So even if the web servers are compromised, the app servers are not accessible due to the application architecture Additionally further isolation happens by using a PaaS database, also offered by the cloud service provider You can restrict requests to the PaaS DB to specific network security groups, as well as application transactions This ensures the right instances are requesting information from the database service and the requests are authorized Connection to the Data Center Since the application may require data that resides in the data center, the app servers go through a VPN device to provide this connection You route all traffic heading to the data center through this inspection point, which gives you control this traffic Typically you don t like to force route cloud traffic through inspection points, but it s not a big deal in this design pattern because the traffic needs to go over a specific egress connection to get the data center, so you may as well inspect there as well For ingress traffic over that connect, you ll want to ensure the traffic can only go to the app server security group This ensures that an adversary that compromised your network won t be able to access the entirety of your cloud networks as well by hopping into your cloud environment Advantages of this design Isolation between Web and App Servers By putting the auto-scaling groups in a network security group, you restrict the ability of those servers to communicate with anything else No Direct Connection But actually in this design pattern, you can block direct traffic to the application servers from anywhere but the VPN Intra-application traffic is sent asynchronously via the message queue and notification service, so the isolation is complete PaaS Service This architecture uses the inherent Platform services PaaS of your cloud provider to provide services with built-in security and resilience Based on our research, the cloud provider takes security and availability pretty seriously since it s their business What s next for this kind of architecture If you wanted to advance this architecture, you could deploy mirrors of the application in different zones within the region to limit the blast radius if one of the devices is compromised and to provide additional resiliency in the event of a failure of one of the zones in the region Additionally, if you use immutable servers within each auto scale group, you can update patch reconfigure the instances automatically by changing the master image used to build the servers and have the auto-scaling capability cycle out the old instances and spin up new ones This controls configuration drift and impact persistence of an adversary Multi-Region Web Site --------------------- This architecture was built to deploy a web-site in multiple regions to provide the availability as close to 100pourcents uptime as possible To be clear, this design is far more expensive than running even in multiple zones within the same region because you ve got to pay to send network traffic between the different regions whereas intra-region traffic is free but if uptime is important to your business, this architecture pushes resiliency beyond Availability Architecture Since this is an externally facing application, you ll run the traffic through a Cloud-based WAF to presumably get rid of the obvious attack traffic The inbound sessions can be routed intelligently to either region via the DNS service So you can based the routing on server utilization, network traffic, geography, or a variety of other criteria This is a great example of software-defined security, in that you are programming how the traffic is distributed within your cloud stacks Network Security Groups In this design pattern, you do implement the network security groups to lock down the traffic into the app servers That isn t depicted specifically within this design pattern because it would greatly complicate the image But implementing network security groups for the web and app servers should be part of this architecture Compute Layer Both the applications and web servers are in an auto-scale group within the region The load balancer distributes the sessions between the regions intelligently as well to ensure the most effective usage of web site Database Layer If this was just a multi-zone deployment, you wouldn t have to worry about DB replication as that s a capability built into the database PaaS services But that s not the case here You are operating in multiple regions, so you ll need to replicate the databases It s like having two separate data centers We re not going to tackle the network architecture to provide DB replication, since that also complicates the architecture We merely wanted to point out that operating in multiple regions adds some complexity you don t have in a single region architecture Static Files Since the web site does have a variety of static files involve as all websites do , you ll need to figure out how to keep the file stores in sync between the regions as well Using Network Security Groups, you can lock down access to the storage buckets to only specific groups or instances That s a good way to make sure that you don t get malware files loaded up onto your website Cross-region replication is a service your cloud provider may offer This isn t something you ll need to build yourself Advantages of this design This architecture was really presented to show how the cloud provides the ability to easily set up an application in multiple regions Similar to what you would do with multiple data centers So what s unique about the cloud You can take the entire stack built in Region A, and copy it to Region B with a few mouse clicks in the cloud console Of course, you ll have some networks to reconfigure, but for the most part the environment is totally the same The auto-scale groups will work off the same images, so the operational overhead of supporting multiple data centers is dramatically less There are also significant availability advantages In the event a region goes down, the DNS service will detect that automatically and route all new incoming sessions to the available region The existing sessions in the region will be lost, so there is some collateral damage, but that happens anytime you lose a data center Those sessions can be re-established with the available region Then when the region recovers, DNS will automatically start sending new sessions to that region This is all transparent to the application and to the user You also provide a central spot for both static files and logs by using the cross-region replication capabilities This is a capability specific to Amazon Web Services at this point , but we expect it to be a critical feature on all cloud infrastructure platforms at some point As with much of the cloud, services that you had to either build or deploy additional products to provision are now just features of the platform you choose That s a good note on which to wrap up this quick series The cloud provides many capabilities that allow you to deploy applications in a significantly more secure and available manner than rolling them out in your own datacenter Of course, there will be resistance to this new way of thinking there always is when new ideas emerge But you can combat this resistance by using information like the stuff we presented in this series and in our other blog posts and reference architectures to make the advantages of these new technologies obvious And obvious they are - Mike Rothman 0 Comments Subscribe to our daily email digest http://www.secuobs.com/revue/news/602357.shtmlhttp://www.secuobs.com/revue/news/602357.shtml 2016-03-29 22:10:24 - Slashdot Your Rights Online : An anonymous reader writes IT staff at multiple hospitals have been forced to stop all routine and net new operations and perform an all hands on deck emergency malware control effort in the last several weeks The latest instance of this can be seen at MedStar Hospital From a ZDNet report, Malware has infected the computer network of MedStar Health, forcing the healthcare provider to shut down large portions of its electronic operations A statement by the health system said that all facilities remain open, and that there was no evidence of compromised information The not-for-profit healthcare system operates ten hospitals across the Washington and Baltimore region, with more than a hundred outpatient health facilities According to the system's website, it has more than 31,000 employees and serves hundreds of thousands of patients annually This outbreak appears to be fairly widespread and not limited to the single story listed A similar story appeared on Slashdot several weeks ago and a quick search on Google provides multiple hits that indicate that this type of incident is much more commonplace than I would have believed Hospitals provide round the clock service to patients and many of these services are critical to the health of the hospital clients Most hospitals invest significant resources into security Vendors may limit local IT staff in terms of how well a turnkey solution is designed to prevent infection In short, hospital IT staff seem to be in the position of having to respond to rather than prevent these types of incidents IT analysts predicted that 2015 would be the year that hospitals became targets for hackers It appears that 2015 was just the first wave of the potential storm coming that is headed directly towards our healthcare IT infrastructure How can hospitals guard themselves against these attacks when perpetrators can adapt almost instantly to new security measures while hospitals are constrained by operating concerns IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/602351.shtmlhttp://www.secuobs.com/revue/news/602351.shtml 2016-03-29 15:08:03 - Security Bloggers Network : Blog Post Upcoming Webinar Network Security and Visibility through NetFlow IMAGE Mar 29, 2016 Turn your network from a security vulnerability into a weapon against cyber-attacks With the rise of disruptive forces such as cloud computing and mobile technology, the enterprise network has become larger and more complex than ever Read more webinar, NetFlow, Threat Detection IMAGE IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/602308.shtmlhttp://www.secuobs.com/revue/news/602308.shtml 2016-03-29 15:08:03 - Security Bloggers Network : Lab 2 Network Recon In this lab, we will examine some popular network recon techniques and practice writing Snort rules for their detection Exercise 1 Network Discovery Nmap is by far one of the Go on to the site to read the full article http://www.secuobs.com/revue/news/602307.shtmlhttp://www.secuobs.com/revue/news/602307.shtml 2016-03-29 14:27:12 - Security Bloggers Network : A strain of ransomware has infected the computer systems of MedStar Health, a healthcare provider operates ten hospitals across the Washington DC and Baltimore region The post Ransomware Forces Hospitals to Shut Down Network, Resort to Paper appeared http://www.secuobs.com/revue/news/602301.shtmlhttp://www.secuobs.com/revue/news/602301.shtml 2016-03-29 14:27:12 - Security Bloggers Network : A strain of ransomware has infected the computer systems of MedStar Health, a healthcare provider that operates ten hospitals across the Washington DC and Baltimore region Read more in my article on the Tripwire State of Security blog http://www.secuobs.com/revue/news/602298.shtmlhttp://www.secuobs.com/revue/news/602298.shtml 2016-03-29 11:20:30 - Global Security Mag Online : March Networks annonce le lancement de sa caméra MegaPX DPoC MicroDome, qui permet de bénéficier de tous les avantages d'une caméra IP HD via un câble coaxial Certifiée IEEE 1901 - un standard compatible avec Homeplug AV - cette caméra est la première du genre à permettre la transmission de signaux IP, sans migration coûteuse de l'infrastructure analogique vers un réseau IP La MegaPX DPoC MicroDome de March Networks est conçue pour les clients qui cherchent à optimiser leur investissement dans les - Produits http://www.secuobs.com/revue/news/602266.shtmlhttp://www.secuobs.com/revue/news/602266.shtml 2016-03-28 23:51:22 - Security Bloggers Network : The health system took down some its computers to prevent the virus from spreading, but it's not clear how many computers -- or hospitals -- are affected http://www.secuobs.com/revue/news/602218.shtmlhttp://www.secuobs.com/revue/news/602218.shtml 2016-03-26 02:17:15 - Security Bloggers Network : As much as we like to believe we ve evolved as a species, many people continue to be scared of things they don t understand Yes, many organizations have embraced the cloud whole hog and are rushing headlong into the cloud age Yet, it s a big world and millions of others remain paralyzed not really understanding cloud computing and taking the general approach that it can t be secure because, well, it just can t Or it s too new Or some other unfounded, incorrect perception Kind of like when folks insisted that the Earth was the center of the universe This blog series builds on our recent Pragmatic Security for Cloud and Hybrid Networks paper to focus on cloud native network architectures that provide security and availability in ways that you can t do in a traditional data center We understand this evolution will happen over the next decade and organizations will need to support hybrid networks for some amount of time But for those ready, willing and able to move to the future today, the cloud is waiting for you to break the traditional rules of how technology is developed, deployed, scaled, and managed We ve been pretty aggressive in proselytizing our belief that the move towards the cloud is the single biggest disruption we ll see in technology for the next few decades Yes, even bigger than the move from mainframes to client server yes, we re old folks In this Resilient Cloud Network Architectures series, we re going to give you the basics of cloud network security and then present a few design patterns to illustrate the concepts We d like to thank Resilient Systems for agreeing to license the content in this paper As always, we ll build the content using our Totally Transparent Research methodology, which means we post everything to the blog first and then allow you our readers to poke holes in it Once it s been sufficiently prodded, we ll publish a paper of the research for your reference Defining Resilient ------------------ If we bust out the old dictionary to define resilient, we get able to become strong, healthy, or successful again after something bad happens able to return to an original shape after being pulled, stretched, pressed, bent, etc In the context of computing, you want to deploy technology that is going to be able to not just become strong again, but be resistant to attack in the first place Recoverability is also key, so if something does happen you want to be able to return service quickly, if an outage happens at all From a network architecture perspective, we always default back to the cloud computing credo Design for failure A resilient network architecture is going to both make it harder to compromise the application, as well as minimize downtime if the event of an issue Key aspects of cloud computing that provide security and availability Network Isolation Using the inherent ability of the cloud to restrict connections via software firewalls security groups, which are described below , you can build a network architecture that fully isolates the different tiers of the application stack That prevents a compromise in one application or database from getting at information stored in another Account Isolation Another aspect of the cloud is the ability to use multiple accounts per application So each of your different environments Dev, Test, Production, Logging, etc you can use different accounts, which also provides isolation since you can t access cloud infrastructure across accounts without explicitly providing authorization Immutability An immutable server is one that is never logged into or changed in production In a cloud-native DevOps environment, servers are deployed in auto-scale groups based on standard images This prevents human error and configuration drift from creating exploitation paths for the application You take a new known-good state, and completely replace what is in production Thus, no more patching and no more logging into servers Regions You could certainly build multiple data centers around the world to provide redundancy Of course, that s not necessarily a cheap option over time To do the same thing in the cloud, you basically just replicate the entire environment in a different region via an API call or a couple of clicks in the cloud console These regions are located all over the world and provide multiple availability zones within each region to further minimize single points of failure You can load balance between zones and regions while leveraging the auto-scaling capabilities to keep your infrastructure working on the same images in real time We ll describe this design pattern in the next post The key takeaway here is that cloud computing provides architectural options that are either not possible or not economically feasible in a traditional data center to provide a higher level of protection and availability Though the rest of the series, we ll describe the fundamentals of cloud networking to provide the context and then dig into the design patterns that provide both security and availability which we ve defined as resilience Understanding Cloud Networks ---------------------------- The key difference between a network that runs in your data center and one that runs in the cloud is that cloud customers never access the real network or hardware Cloud computing uses virtual networks abstracting the networks you see and manage from the underlying physical resources When your server gets IP address 100112, that isn t really an IP address on routing hardware it s a virtual IP address on a virtual network Everything is handled in software Cloud networking varies across cloud providers, but differs from traditional networks in the areas of visibility, management and velocity of change You can t tap into the cloud providers virtual network, so you ll need to think differently about monitoring your networks Additionally the cloud network is typically managed via scripts or programs making application programming interfaces API calls, and not a graphical console or command line That means a developer can do pretty much anything, including standing up networks and reconfiguring them instantaneously via code Finally, cloud networks change much faster than physical networks because cloud environments change faster, spinning up and shutting down servers via automation So your traditional workflows to govern network change won t really map to your cloud network Although it can be confusing because the cloud network looks the same as traditional networks, including routing tables and firewalls But looks can be deceiving and although the constructs seem the same, there are significant differences Cloud Network Architectures --------------------------- You need to understand the types of cloud network architectures and the different technologies that enable them, to fit your needs to the right solution There are two basic types of cloud network architectures Public cloud networks These networks are entirely Internet-facing You connect to your instances servers via the public Internet with no special routing every instance has a public IP address Private cloud networks Also called virtual private clouds or VPCs, these networks look like your internal LANs using private IP addresses You access these networks via some kind of separate connection typically a VPN to access your environment Cloud networks are enabled and supported by the following technologies Internet Gateways An Internet gateway connects your cloud network to the Internet You don t normally manage it directly your cloud provider does it for you since it s their underlying technology that is going to move packets from your internal network to the Internet Internal Gateways These devices are used to connect existing datacenters to your private cloud network You access these networks via a VPN offered by the cloud provider or a direct connection, which looks a lot like a traditional point to point connection from days gone by Virtual Private Networks You can also set up your own overlay network to bridge your private and public cloud networks within your cloud provider This provides a private segment with access for users, developers, and administrators These terms will come into play when we present the design patterns in the next post Network Security Controls ------------------------- Your network is different in the cloud, so your network security controls will be different as well But to provide some comfort, the categories will sound familiar These controls fall generally into five buckets 1 Perimeter security These controls generally provide a course level of protection from very common network-based attacks, including denial of service attacks The cloud provider puts these controls in place and manages them, so you have no visibility or control over them 2 Software firewalls These firewalls are built into the cloud platform called security groups in AWS vernacular and protect cloud assets such as instances, offer basic access control capabilities via ports protocols and sources destinations, and are designed for auto scaling and other cloud-specific uses This capability combines the best of network and host firewalls, allowing you to deploy policies on individual servers or even network interfaces like a host firewall, but you manage them like network firewalls This is going to be your main technique to provide virtual network isolation, as described above 3 Access Control Lists While the software firewall work at a per-instance or per-object level, ACLs restrict communications between subnets in your virtual network Old school networking folks will be familiar with how you use ACLs to control access into and out of the subnets in your virtual cloud network 4 Virtual appliances A number of traditional network security tools, such as IDS IPS, WAF, and NGFW are available in virtual form factors to add expanded features for network security, but require you to route your cloud traffic through the device 5 Host security agents These agents are built into your immutable server images and provide visibility and protection to each server instance in your cloud environment The thing about cloud networking is that you don t need to apply the same controls or even configurations to your entire network, as you do in your own data centers You can make architectural and security control decisions based on the project Perhaps you decide an entirely cloud-based VPC is more appropriate for one application and for another you ll need to build an overlay VPN to connect a totally different VPC to your datacenter to support a hybrid environment You may need to route traffic through an inspection point to prevent data leakage in one application and in another you rely exclusively on security groups to provide full isolation between the different layers of your cloud stack The permutations are infinite, which provides you with flexibility you don t have in your data center These fundamentals should provide the context you ll need to understand the design patterns will present in the next post to illuminate these concepts - Mike Rothman 0 Comments Subscribe to our daily email digest http://www.secuobs.com/revue/news/602096.shtmlhttp://www.secuobs.com/revue/news/602096.shtml 2016-03-25 14:46:17 - Slashdot Your Rights Online : An anonymous reader cites a story on Variety Company says it plans to launch feature to give users control over mobile-video usage in May Netflix has enforced a maximum limit on the quality of video streamed over AT T and Verizon wireless networks for years, the company acknowledged Thursday But Netflix also said it's working on a way to give users control over how much bandwidth they wish to use to access the service The No 1 subscription-streaming service said its default bit rate for viewing over mobile networks has been capped at 600 kilobits per second That's 'in an effort to protect our members from overage charges when they exceed mobile-data caps,' according to a Netflix spokeswoman IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/602069.shtmlhttp://www.secuobs.com/revue/news/602069.shtml 2016-03-25 13:19:47 - SecurityTube.Net : Winn Schwartau Founder of InfowarCon, CEO, The Security Awareness Company Winn is one of the world s top experts on security, privacy, Infowar and cyber-terrorism, authoring more than 12 security books and the recipient of a host of industry recognitions We consider ourselves lucky to be led by such a renowned guy Winn likes to get his hands dirty, so to speak, often getting directly involved with many of our clients projects He writes much of the content used in our e-learning modules, videos and monthly newsletters, all the while traveling the world and sharing his decades of knowledge at conferences IW-I O Modeled on Analogue Network Security A CyberWar Framework This presentation will provide a conceptual model for dynamic environments This approach combines the 2MR, OODA, ICS-like feedback, time based security and out of band communications, as well as hybrid logic, to create a new approach to security This could not come at a more critical time as the need for increased protection of government networks, critical infrastructure, and private sector enterprises is at an all time high Winn will assemble some fascinating concepts and approaches to security that has evolved over the last 20 years For More Information Please Visit - http infowarconcom http://www.secuobs.com/revue/news/602062.shtmlhttp://www.secuobs.com/revue/news/602062.shtml 2016-03-24 17:44:03 - Global Security Mag Online : Avnet, Inc, annonce la signature d'un accord de distribution avec Cumulus Networks, couvrant l'ensemble de la zone EMEA et portant sur la commercialisation, auprès de ses clients et partenaires, du système d'exploitation Linux En vertu de l'accord, Avnet distribuera Cumulus Linux, le système d'exploitation de Cumulus Networks pour les réseaux de datacenter, qui peut s'intégrer avec le matériel de nombreux grands fabricants de commutateurs Avnet est ainsi nommé distributeur de Cumulus Linux en - Business http://www.secuobs.com/revue/news/601981.shtmlhttp://www.secuobs.com/revue/news/601981.shtml 2016-03-24 10:59:03 - Global Security Mag Online : L'opérateur Jaguar Network poursuit son développement et pose les bases de sa stratégie sur les années à venir, afin de répondre toujours mieux aux besoins de ses clients et à l'évolution du marché IT Jaguar Network annonce en ce sens un projet, porté par Kevin Polizzi et Alexandre Bertuzzi, avec trois objectifs conserver son avantage concurrentiel, anticiper les demandes de ses clients et positionner l'innovation au centre de sa stratégie de développement Ainsi, après avoir réussi à bâtir une - Business http://www.secuobs.com/revue/news/601929.shtmlhttp://www.secuobs.com/revue/news/601929.shtml 2016-03-24 09:20:28 - Help Net Security : In my work as a penetration tester for SureCloud, I m often asked to look at unusual, out-of-the-ordinary vulnerabilities This was the case when a major UK financial institution asked us to test for vulnerabilities in its radio frequency RF networks, looking at its WiFi networks, digital mobile radio DMR systems, cordless DECT phones, Bluetooth devices and more These days, a great deal of office networking and comms equipment runs over RF than was previously the More http://www.secuobs.com/revue/news/601917.shtmlhttp://www.secuobs.com/revue/news/601917.shtml 2016-03-23 14:08:57 - SecurityTube.Net : I grew up analogue Analogue engineering and all This talk is about applying analogue thinking to Network Security It s about a different way of approaching our defenses, understanding the attackers and hopefully will inspire others It s about a mélange of concepts, many analogue, that when combined in various ways, I hope will help our industry My goal is to introduce some ideas more conventionally thought of as analogue than digital, then glue them together in various ways to offer different views on how to solve security problems - whether they be in the cyber, physical or human domains Winn Schwartau is one of the world's top experts on security, privacy, infowar, cyber-terrorism, and related topics He is also the president and founder of The Security Awareness Company Winn is gifted at making highly technical security subjects understandable and entertaining In addition to being called The Civilian Architect of Information Warfare, he is one of the country's most sought after experts on information security, infrastructure protection, and electronic privacy He has authored more than 12 security books and has been the recipient of a host of industry recognitions You can read a lot more about Winn's publications and history on his site PhreakNIC is a technology conference held annually in Middle Tennessee PhreakNIC started as an infosec hacker convention but has expanded over the years to include the maker scene, ham radio, DIY engineering, space and science nerds, the skeptics community, electronic and experimental music, gamers, anime, and general geekery For More Information Please Visit - http archivephreaknicinfo pn19 http://www.secuobs.com/revue/news/601815.shtmlhttp://www.secuobs.com/revue/news/601815.shtml 2016-03-23 12:21:13 - The Tor Blog blogs : Today the Open Observatory of Network Interference OONI team is pleased to announce the public beta release of OONI Explorer a global map of more than 85 million network measurements which have been collected across 91 countries around the world over the last 3 years OONI is based on 15 free software tests which are designed to measure the following Blocking of websites Detection of systems responsible for censorship, surveillance and manipulation Reachability of Tor, proxies, VPNs, and sensitive domains These tests have been run across 398 different vantage points by volunteers around the world since 2012 The OONI Explorer announced today provides a location to interact and - dare we say - explore all of the collected measurements Key Findings Some of the highlights in the data 1 Confirmed cases of censorship in 9 countries Multiple HTTP request tests were run around the world and based on our heuristics, we were able to detect block pages in 9 countries Iran, Saudi Arabia, Turkey, Greece, China, Russia, India, Indonesia and Sudan Blocked websites include media, gambling and over-the-counter money exchanges In Greece, for example, all of the tested ISPs employed DNS hijacking to block such websites, with the exception of Vodafone that also used Deep Packet Inspection OONI tests in Turkey illustrate that 62 websites were blocked, including piratebaycom, livescorecom and 4sharedcom, possibly under Law No 5651 on the Regulation of Publications on the Internet and Suppression of Crimes Committed by means of Such Publication Notably, 362 blocked websites were detected as blocked in Iran and 50 in Saudi Arabia, including arabtimescom, mossadgovil and anonymto, a URL shortening service with privacy properties Some of our tests for domains were focused on specific websites which were rumored or reported to be blocked In January 2015, for example, the Government of India ordered the blocking of 32 websites under Section 69A of the Information Technology Act, 2000, and under the Information Technology Procedures and Safeguards for Blocking of Access of Information by Public Rules, 2009 Following these reports, OONI tests run on those websites were able to confirm that 23 of those websites were in fact blocked in the network that was tested, including websites such as pastebincom, dailymotioncom and archiveorg Leading up to the 2016 general elections in Uganda, OONI volunteers ran HTTP request tests in response to reports that Facebook and Twitter were being blocked We did not detect block pages, but we did detect general network anomalies which indicate that it's likely the case that Ugandan ISPs were blocking some requests, but not others It is also possible that Facebook and Twitter were only blocked in specific networks, and not countrywide 2 Network anomalies in 71 countries Out of the 91 countries with reported data, network anomalies were detected in 71 of them Network anomalies and network interferences are broad terms that we use to describe symptoms of censorship through the manipulation of internet traffic These anomalies can take many forms, including connectivity failures, timeouts and unusual slowness, or unexpected error messages Not all HTTP request tests allow us to conclusively know that interference has occurred, because not all interference looks like a clear block page Sometimes, censorship is hidden as connection failures instead To gain confidence in detecting this type of interference, we can look at repeated failures to websites that are known to be operating normally In Cuba, for example, it is interesting to see that while no block pages were detected, HTTP requests to cubafreepressorg failed multiple times Symptoms of traffic manipulation were detected in multiple countries around the world through HTTP invalid request line and HTTP header field manipulation tests, which look for middle boxes network equipment that intercept and sometimes alter the traffic passing through them Multiple HTTP invalid request line tests run in Vietnam from 2013 to 2015 triggered errors and indicate that middle boxes were regularly observing the traffic in the country Similarly, many HTTP invalid request line tests in Pakistan and elsewhere indicate the presence of software which is capable of traffic manipulation 3 Blue Coat, Squid and Privoxy detected in 11 countries Transparent HTTP proxies can be used inside of small and large networks for various purposes to intercept the web traffic of users, to implement caching or to speed up requests for commonly visited websites Through OONI tests we detected 3 different types of proxy technology Blue Coat, Squid and Privoxy Blue Coat Systems is a US security and networking solutions provider which has been called out for selling network appliances capable of filtering, censorship, and surveillance to governments with poor human rights records Its presence, along with Squid and Privoxy, has been reported in the networks of 11 countries USA, Canada, Portugal, Spain, Italy, the Netherlands, Switzerland, Moldova, Iraq, Myanmar and Uganda It remains unclear though whether such middle boxes were actually used for online censorship, surveillance and traffic manipulation, or if they were merely used for caching purposes Furthermore, not all the detected instances of proxy technologies are necessarily deployed country-wide or even on an ISP level, but in some cases they might simply be running inside of the local network of the OONI user It is interesting to note that the use of Blue Coat was first detected in Myanmar in 2012, but when another measurement was run from the same network in 2014 it was no longer detectable in the same way This can either mean that it was removed or that it is no longer detectable Contribute to OONI Explorer OONI Explorer was made possible by the growing community of volunteers around the world who have contributed to the project You can contribute too by Running your own measurements with ooni-probe Note that in some countries collecting measurements could get you into trouble If you're unsure, contact legal ooniio Exploring OONI Explorer's measurements Help us find more highlights Contributing code to the open source software tool Participating in the community and providing feedback https liststorprojectorg cgi-bin mailman listinfo ooni-talk https liststorprojectorg cgi-bin mailman listinfo ooni-dev Happy OONI exploring http://www.secuobs.com/revue/news/601797.shtmlhttp://www.secuobs.com/revue/news/601797.shtml 2016-03-23 08:48:07 - Help Net Security : One hundred and fifty enterprise IT security professionals from a wide range of industries were surveyed by Enterprise Strategy Group ESG to gain a better understanding of their plans for adopting software-defined networking SDN in the near future, as well as their opinions on the increasing level of difficulty in managing heterogeneous network environments The survey indicates a need for greater automation and converged management, command and control capabilities for security operations across physical, virtual More http://www.secuobs.com/revue/news/601782.shtmlhttp://www.secuobs.com/revue/news/601782.shtml 2016-03-22 23:22:20 - Office of Inadequate Security : Abraham J Rein of Post Schell has a nice recap of some of the recurring themes at last week s PHI Protection http://www.secuobs.com/revue/news/601765.shtmlhttp://www.secuobs.com/revue/news/601765.shtml 2016-03-21 09:02:05 - Help Net Security : Many high profile database breaches have resulted from the abuse of legitimate logon credentials Identifying these apparent insider threats requires a new approach Those who were once considered trustworthy may have lost their credentials to an attacker and are now posing an insider threat This is why identifying compromised credentials in real-time has proven elusive until now The situation has changed, and so must the mechanisms to mitigate the risk In this podcast recorded at More http://www.secuobs.com/revue/news/601574.shtmlhttp://www.secuobs.com/revue/news/601574.shtml 2016-03-20 18:17:56 - Hackaday : It s safe to say that the Internet of Things is high on the list of buzzwords du jour It was last seen rapidly ascending towards the Peak of Inflated Expectations on the Gartner Hype Cycle, and it seems that every startup you encounter these days is trying to place an IoT spin on their offering Behind all the hype though lie some interesting wireless technologies for cheaply making very small microprocessors talk to each other and to the wider world Today we d like to draw your attention to another wireless technology that might be of interest to Hackaday readers working read more http://www.secuobs.com/revue/news/601557.shtmlhttp://www.secuobs.com/revue/news/601557.shtml 2016-03-18 22:01:27 - Office of Inadequate Security : Lauren J Young When PA Online, a former internet service provider based in Enola, Pennsylvania, fired its network http://www.secuobs.com/revue/news/601481.shtmlhttp://www.secuobs.com/revue/news/601481.shtml 2016-03-18 15:48:42 - Security Bloggers Network : The traditional PSTN has been replaced by more advanced and efficient VoIP network VoIP has quickly made its place in the corporate and home environment as well there are many advantages of using Go on to the site to read the full article http://www.secuobs.com/revue/news/601441.shtmlhttp://www.secuobs.com/revue/news/601441.shtml 2016-03-17 00:52:11 - New RFCs : 21KB DOI http://www.secuobs.com/revue/news/601254.shtmlhttp://www.secuobs.com/revue/news/601254.shtml 2016-03-16 19:00:27 - Security Bloggers Network : In advanced attacks, lateral spread also known as lateral movement or east-west movement is when cybercriminals try to increase their http://www.secuobs.com/revue/news/601237.shtmlhttp://www.secuobs.com/revue/news/601237.shtml 2016-03-16 14:33:43 - Global Security Mag Online : L'Office des communications ou Ofcom, l'autorité régulatrice des télécommunications au Royaume-Uni fait actuellement face à la plus grande fuite de données de son histoire un ancien employé a offert un énorme volume d'informations potentiellement sensibles concernant les sociétés de télévision à son nouvel employeur, un diffuseur majeur Voici les réactions de trois acteurs de la sécurité informatique Norman Girard, Vice Président et directeur général Europe de Varonis Un grand nombre de vols de - Points de Vue http://www.secuobs.com/revue/news/601186.shtmlhttp://www.secuobs.com/revue/news/601186.shtml 2016-03-15 22:47:18 - Security Bloggers Network : Being able to determine how an intruder evaded security measures is something every organization should be concerned with Companies spend millions of dollars on security, and when there s a breach, they need to determine how it occurred so they can isolate the current risk and use the insights to build additional defenses and improve the The post Improving Forensic Visibility Throughout a Complex Network appeared first on Speaking of Security - The RSA Blog and Podcast http://www.secuobs.com/revue/news/601119.shtmlhttp://www.secuobs.com/revue/news/601119.shtml 2016-03-14 13:05:41 - Blog : IMAGE IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/600973.shtmlhttp://www.secuobs.com/revue/news/600973.shtml 2016-03-14 10:57:56 - Global Security Mag Online : Stormshield annonce avoir mis à disposition sur la plateforme Microsoft Azure une nouvelle solution associant gestion unifiée des menaces et pare-feu à la pointe de la technologie Stormshield Network Security solution for Cloud Un nombre croissant d'entreprises souhaite faire migrer leurs infrastructures technologiques vers le cloud, une décision qui soulève de nouvelles problématiques en matière de sécurité Pour protéger ces environnements, Stormshield propose d'accompagner les entreprises - Produits http://www.secuobs.com/revue/news/600961.shtmlhttp://www.secuobs.com/revue/news/600961.shtml 2016-03-12 15:49:42 - Security Bloggers Network : Most users think of networking as devices to deploy on-premises or as an underpinning for cloud providers infrastructure, but with an increase in workloads deployed in the cloud, it s key to consider the importance of the network interconn http://www.secuobs.com/revue/news/600890.shtmlhttp://www.secuobs.com/revue/news/600890.shtml 2016-03-12 02:40:09 - New RFCs : 20KB DOI http://www.secuobs.com/revue/news/600874.shtmlhttp://www.secuobs.com/revue/news/600874.shtml 2016-03-11 14:50:15 - Office of Inadequate Security : WXYZ reports West Bloomfield School District officials sent an email to parents saying a security breach to their http://www.secuobs.com/revue/news/600832.shtmlhttp://www.secuobs.com/revue/news/600832.shtml 2016-03-11 07:45:33 - Help Net Security : Have you heard about RITA Real Intelligence Threat Analysis is a an open source tool a framework, actually aimed at helping organizations find malicious activity on their network Developed by Black Hills Information Security, RITA does not detect malicious activity through signatures, but mainly through statistical analysis It sifts through network data, logs and so on, and looks for anomalous behaviors beaconing behavior, systems connecting to blacklisted IP addresses, scanning behavior, long duration More http://www.secuobs.com/revue/news/600810.shtmlhttp://www.secuobs.com/revue/news/600810.shtml 2016-03-11 01:24:33 - Risk Assessment Ars Technica : 2013 breach of Rye, NY dam facility part of wider Iranian probing of US networks http://www.secuobs.com/revue/news/600780.shtmlhttp://www.secuobs.com/revue/news/600780.shtml 2016-03-10 07:13:29 - SecurityTube.Net : Being the default authentication protocol for Windows-based networks, the Kerberos protocol is a prime target for attackers, especially for APTs attackers, seeking to steal the user's identity and steal secrets from the enterprise's data center In late 2014 and early 2015, we saw a lot of research on the attacker side, yielding the Golden Ticket, Forged PAC MS14-068 and the Skeleton Key attacks Now it is the time to present the defensive side research We will expose a novel method of detecting and defeating ALL of these attacks and others based solely on network monitoring We continue to show a novel variant of the Golden Ticket attack, the Diamond PAC attack, that is able to evade a naïve network monitoring detection and provide a detection solution for it The talk includes the release of the Kerberos Leash tool - a free tool we developed that implements some of the detection techniques for the benefit of the security community For More Information Please Visit - https wwwblackhatcom indexhtml http://www.secuobs.com/revue/news/600677.shtmlhttp://www.secuobs.com/revue/news/600677.shtml 2016-03-09 22:44:30 - New RFCs : 86KB DOI http://www.secuobs.com/revue/news/600638.shtmlhttp://www.secuobs.com/revue/news/600638.shtml 2016-03-08 14:59:06 - Help Net Security : Dell SecureWorks researchers have developed a tool that allows Windows system administrators to detect network intrusion attempts and pinpoint them to the original source ie a compromised endpoint , and have made it available for everybody In Microsoft Windows networking, a domain is a group of computers that have registered with a central database known as the domain controller Using a Windows component known as Active Directory AD , network administrators can manage all user accounts, processes, More http://www.secuobs.com/revue/news/600467.shtmlhttp://www.secuobs.com/revue/news/600467.shtml 2016-03-08 14:15:08 - Security Bloggers Network : Blog Post Using StealthWatch with Network Segmentation IMAGE Jody Ma Kissling Mar 08, 2016 segmentation Network segmentation is one crucial component to combatting today s advanced threats It is based on the security principle of least privilege , and Read more stealthwatch, network segmentation http://www.secuobs.com/revue/news/600462.shtmlhttp://www.secuobs.com/revue/news/600462.shtml 2016-03-08 13:16:42 - Global Security Mag Online : TeraGo Networks, un des principaux opérateur télécoms pour les professionnels du Canada, a choisi la solutions d'atténuation des attaques Radware pour constituer un des piliers de sa nouvelle suite de sécurité Jusqu'à présent, TeraGo disposait, pour protéger ses infrastructures et ses clients, d'une solution de filtrage RTBH remotely-triggered black hole Après avoir passé en revue les solutions alternatives du marché pendant deux ans, le choix de TeraGo s'est porté sur Radware, récompensant la - Marchés http://www.secuobs.com/revue/news/600453.shtmlhttp://www.secuobs.com/revue/news/600453.shtml 2016-03-08 07:23:17 - Security Bloggers Network : In a world where we must assume our enterprises have already been breached, monitoring the perimeter is too little, too late Continuous monitoring, a la CDM, tells you where you are vulnerable and what to fix, but not where you are already bleeding In my post on why change detection is so important, I talked about Read More The post 5 Tips for Detecting Suspicious Changes in Your Network appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/600425.shtmlhttp://www.secuobs.com/revue/news/600425.shtml 2016-03-07 11:15:23 - SecurityTube.Net : Service accounts are prevalent in Windows networks, but are often mismanaged and ripe for exploitation Too often these accounts are over-privileged, dual-used both by human users and automated processes , and have credentials omnipresent in the network The services that use these accounts are easily discovered, as they are registered as SPNs on the Active Directory, thus presenting a lucrative target for an attackerIn this talk we will discuss how service accounts can be mismanaged and thus exploited, and present new research examining the exposure of service accounts in real-world networksWe will demonstrate exploitation techniques and introduce an open source tool for detecting potentially vulnerable service accounts in Windows networks We will also discuss how targeted behavioral analytics can be employed to detect potential abuse of service accountsArmed with the knowledge and tools from this presentation, you can now go and test your own networks and, perhaps, prevent that sneaky attacker from exploiting your service accounts For More Information Please Visit - https bsidessfcom http wwwirongeekcom iphp page videos bsidessf2016 mainlist http://www.secuobs.com/revue/news/600337.shtmlhttp://www.secuobs.com/revue/news/600337.shtml 2016-03-06 19:28:22 - Hackaday : What do you get when you combine a direct digital synthesis DDS chip, a power detector, and an Arduino Brett Killion did make that combination and wound up with a practical network analyzer The project uses an Analog Devices AD9851 DDS chip clocked at 180 MHz which will output a sine wave at any frequency from 0 Hz and 72 MHz A Butterworth low pass filter processes the DDS signal and then feeds a two-transistor amplifier The circuit will output about 0dBm into 50 ohms The power detector is an Analog Devices AD8307 along with a 50-ohm input load There read more http://www.secuobs.com/revue/news/600289.shtmlhttp://www.secuobs.com/revue/news/600289.shtml 2016-03-05 01:45:00 - Security Bloggers Network : On Monday of this week, Webroot joined Cloudera, the leading provider of modern data management and analytics systems built on Apache Hadoop, in announcing Open Network Insight ONI Project, a database and toolsread more The post Webroot Supports Open Network Insight Project appeared first on Webroot Threat Blog http://www.secuobs.com/revue/news/600232.shtmlhttp://www.secuobs.com/revue/news/600232.shtml 2016-03-04 16:38:22 - Global Security Mag Online : Le protocole SSLv2 est un protocole désormais obsolète qui a montré depuis un certain temps déjà des faiblesses importantes et n'est plus à même de garantir la sécurité des communications au vue des méthodes et algorithmes de chiffrement, hachage utilisés Son successeur le SSLv3 est en train de subir le même sort au profit du protocoleTLS plus récent avec TLS V12 et bientôt TLS V13 Un certain nombre d'applications Web Serveurs conservent toujours le support du protocole SSLv2 afin de garder la - Malwares http://www.secuobs.com/revue/news/600184.shtmlhttp://www.secuobs.com/revue/news/600184.shtml 2016-03-04 13:04:42 - Security Bloggers Network : Cisco has patched another hard-coded, default password problem which gives cyberattackers root access to devices http://www.secuobs.com/revue/news/600166.shtmlhttp://www.secuobs.com/revue/news/600166.shtml 2016-03-03 16:04:25 - Global Security Mag Online : BT et Palo Alto Networks annoncent un accord aux termes duquel la plate-forme de sécurité Palo Alto Networks de nouvelle génération sera intégrée à l'offre internationale de services de sécurité de BT Les clients de BT aux quatre coins du monde bénéficieront des synergies nées du rapprochement entre une plate-forme Palo Alto Networks axée sur la prévention des intrusions, et des services de sécurité BT d'envergure mondiale Dans le cadre de cet accord, le service BT Assure Managed Firewall intègrera la - Produits http://www.secuobs.com/revue/news/600040.shtmlhttp://www.secuobs.com/revue/news/600040.shtml 2016-03-03 09:19:20 - SecurityTube.Net : Air gaps have always been a way of isolating systems At DeepSec 2015 Mordechai Guri and Yisroel Mirsky both of Ben-Gurion University of the Negev held a talk about how to overcome this barrier Air-gapped networks are isolated, separated both logically and physically from public networks Although the feasibility of invading such systems has been demonstrated in recent years, exfiltration of data from air-gapped networks is still a challenging task In this talk we present GSMem, a malware that can exfiltrate data through an air-gap over cellular frequencies Rogue software on an infected target computer modulates and transmits electromagnetic signals at cellular frequencies by invoking specific memory-related instructions and utilizing the multichannel memory architecture to amplify the transmission Furthermore, we show that the transmitted signals can be received and demodulated by a rootkit placed in the baseband firmware of a nearby cellular phone We present crucial design issues such as signal generation and reception, data modulation, and transmission detection We implement a prototype of GSMem consisting of a transmitter and a receiver and evaluate its performance and limitations Our current results demonstrate its efficacy and feasibility, achieving an effective transmission distance of 1-55 meters with a standard mobile phone When using a dedicated, yet affordable hardware receiver, the effective distance reached over 30 meters Mordechai Guri is an accomplished computer scientist and security expert with over 20 years of practical research experience He earned his Bsc and Msc, Suma Cum Laude, from the computer science department at the Hebrew University of Jerusalem Guri is a lead researcher and lab manager at the Ben Gurion Cyber Security Research Center and has been awarded with the prestigious IBM PhD International Fellowship 2015-2016 In the past few years Mordechai has led a number of breakthrough research projects in cyber-security, some of them have been published worldwide His research topics include OS security, advanced malware, Moving Target Defense MTD , mobile security and embedded systems Mordechai is also the Chief Scientific Officer and Co-Founder of Morphisec start-up company Yisroel Mirsky received his BSc in Communication Systems Engineering from the Jerusalem College of Technology in 2013 He is now a PhD student at Ben-Gurion University in the Department of Information Systems Engineering He is doing his PhD under the supervision of Prof Bracha Shapira and Prof Yuval Elovici His research interests include smartphone security, context-aware data leakage prevention, and covert channels He is currently managing a research project at the BGU Cyber Security Research Center For More Information Please Visit - https deepsecnet http://www.secuobs.com/revue/news/599993.shtmlhttp://www.secuobs.com/revue/news/599993.shtml 2016-03-02 10:41:57 - Global Security Mag Online : Barracuda Networks annonce la signature d'un nouveau contrat de distribution avec le grossiste informatique D2B Toutes les solutions de Barracuda Networks sont concernées par cette accord, mais l'accent sera mis sur les solutions Cloud ainsi que l'archivage et la sauvegarde des données Ce nouvel accord vient soutenir les perspectives de croissance liée à l'orientation Cloud entreprise par Barracuda Networks, avec des solutions telles que Essentials pour Office 365 et les solutions de - Business http://www.secuobs.com/revue/news/599883.shtmlhttp://www.secuobs.com/revue/news/599883.shtml 2016-03-02 05:51:57 - SecurityTube.Net : This presentation held at DeepSec 2015 describes the High-speed Onion Routing at the Network Layer research publications We present HORNET, a system that enables high-speed end-to-end anonymous channels by leveraging next generation network architectures HORNET is designed as a low-latency onion routing system that operates at the network layer thus enabling a wide range of applications Our system uses only symmetric cryptography for data forwarding yet requires no per-flow state on intermediate nodes This design enables HORNET nodes to process anonymous traffic at over 93 Gb s HORNET can also scale as required, adding minimal processing overhead per additional anonymous channel We discuss design and implementation details, as well as a performance and security evaluation For More Information Please Visit - https deepsecnet http://www.secuobs.com/revue/news/599870.shtmlhttp://www.secuobs.com/revue/news/599870.shtml 2016-03-02 05:51:57 - SecurityTube.Net : Attackers like to scout out the area first This is why fingerprinting devices is the first step Manfred Kaiser Josef Ressel Zentrum explained at DeepSec 2015 how this can be done by the local web browser s in the locally connected network segment For More Information Please Visit - https deepsecnet http://www.secuobs.com/revue/news/599866.shtmlhttp://www.secuobs.com/revue/news/599866.shtml 2016-03-02 05:51:57 - SecurityTube.Net : Honeypots and honeypot networks help security researchers to get a good look at different attacker techniques across a variety of systems This information can be used to better protect our systems and networks, but it takes a lot of work to sift through the data Installing a network of honeypots to provide useful information should be an easy task, but there just isn't much to tie everything together in a useful manner In this presentation, Josh Pyorre demonstrates how existing honeypot frameworks and applications can be used with personal tools and techniques to process attack-related data, to automate analysis and create actionable intelligence All the code and instructions used in this presentation is available for others to work with Josh held this presentation at DeepSec 2015 For More Information Please Visit - https deepsecnet http://www.secuobs.com/revue/news/599862.shtmlhttp://www.secuobs.com/revue/news/599862.shtml 2016-03-02 05:51:57 - SecurityTube.Net : TOR is an anonymisation network and by design doesn't know anything about its users However, the question about the structure of the user base often arises Some people are just interested in the size of the network while others want details about the diversity of its users and relays Furthermore, TOR is used as a circumvention tool It is interesting to automatically detect censorship events and to see how the number of users changes in those countries TOR's measurement team tries to give answer to those and more questions At DeepSec 2015 Jens Kubieziel explained the collection of different data and how measurement is done inside the network He talked about some of the challenges the measurement team has faced and what results it delivers TOR has currently more than 30 different measurement tools The talk introduces you to some of them and show what you can do to profit from them For More Information Please Visit - https deepsecnet http://www.secuobs.com/revue/news/599860.shtmlhttp://www.secuobs.com/revue/news/599860.shtml 2016-03-01 17:49:33 - 4sysops : Profile photo of Michael PietroforteMVP Michael Pietroforte - 0 comments Michael Pietroforte is the founder and editor of 4sysops He is a Microsoft Most Valuable Professional MVP with more than 30 years of experience in system administration If you are a regular 4sysops reader, you probably have noticed the new layout But that s not all We have introduced new community features that allow you to interact with other IT pros and improve your IT knowledge and skills Copyright 2006-2016, 4sysops, Digital fingerprint 3db371642e7c3f4fe3ee9d5cf7666eb0 http://www.secuobs.com/revue/news/599812.shtmlhttp://www.secuobs.com/revue/news/599812.shtml 2016-02-29 14:55:25 - Slashdot Your Rights Online : Chinese Internet Service Providers ISPs have been caught red-handed for injecting advertisements as well as malware through their network traffic Three Israeli researchers uncovered that the major Chinese-based ISPs named China Telecom and China Unicom, two of Asia's largest network operators, have been engaged in an illegal practice of content injection in network traffic Chinese ISPs had set up many proxy servers to pollute the client's network traffic not only with insignificant advertisements but also malware links, in some cases, inside the websites they visit If an Internet user tries to access a domain that resides under these Chinese ISPs, the forged packet redirects the user's browser to parse the rogue network routes As a result, the client's legitimate traffic will be redirected to malicious sites ads, benefiting the ISPs IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/599654.shtmlhttp://www.secuobs.com/revue/news/599654.shtml 2016-02-29 14:43:36 - SecurityTube.Net : When malware infects a system, often it is only the first step in a chain of events Once on a system, malware can move laterally through a network, infecting other systems, and searching for important data If malware finds data that it has been programmed to search for, or an attacker is using the malware to poke around opportunistically, it can then send copies of that data out to external servers, also known as exfiltration In this talk, I will evaluate the current trends in malware data exfiltration, discuss methods for identifying data breaches, and explore methods for mitigation of data exfiltration We have seen exfiltration used in many attacks where confidential customer information has been leaked to malicious actors Such infections can have disastrous effects on the company's brand, customer loyalty and competitive advantage Not only can a company lose money by the direct loss of revenue, the leaking of customer information can harm consumer confidence in the company in the long term, it can lead to costly litigation, and the leaking of trade secrets can compromise the company's position in the marketplace through a loss of trade secrets In 2006, Operation ShadyRAT targeted 72 different companies over a period of five years, exfiltrating massive amounts of information In 2008, Heartland Payment Services was compromised via SQL injection to install spyware that exfiltrated information on 134 million credit card accounts In the Target case, 40 million credit and debit card accounts were stolen, along with PII data on another 70 million customers Target said its data breach has cost 240 million so far, with further litigation threatening to push that number higher For More Information Please Visit - https wwwvirusbulletincom http://www.secuobs.com/revue/news/599650.shtmlhttp://www.secuobs.com/revue/news/599650.shtml 2016-02-27 02:49:13 - Office of Inadequate Security : A number of school districts are reportedly being hit with DDoS attacks over the past few weeks Is anyone claiming http://www.secuobs.com/revue/news/599537.shtmlhttp://www.secuobs.com/revue/news/599537.shtml 2016-02-26 13:52:58 - Security Bloggers Network : A new paper from Mandiant covers a lot of ground, including data on bulk export of PII Personally Identifiable Information and the exploitation of network devices as well as some interesting data and speculation about ransomware Commentary from Darren Pauli for The Register here David Harley http://www.secuobs.com/revue/news/599483.shtmlhttp://www.secuobs.com/revue/news/599483.shtml 2016-02-26 13:08:37 - SecurityTube.Net : TALK APPLYING MACHINE LEARNING METHODS TO NETWORK MAPPING HUNTING In recent years, network scanning has received an increasing focus from states, companies and individuals As the network capabilities grow, tools evolve to be able to scan much wider ranges Zmap, MassScan and they retrieve more and more information Indeed, nowadays it is achievable to scan a whole country or even 0 Thus the analysis of scanned networks is becoming substantially harder Manually digging into results is even more repetitive, time consuming and analyst-biased But today there are methods and algorithms to let computers work for us Rather than Big Data , we prefer to speak of machine learning ML regarding the analysis of large quantities of data To the best of our knowledge, at the time of writing, there is no related works on the particular subject of applying ML to network scans However, these algorithms already provide interesting results in IP stack recognition, which is a close field Indeed in Nmap, the IPv6 stack identification is done with ML, and gives satisfying results despite a pool of samples way smaller than for IPv4 During our talk, we will start with what information can quickly be retrieved from a scan, and how digging deeper into it can become biased and limited Then, we will introduce machine learning specifics without requiring a deep mathematics background Actually, we will present a computer scientist infosec researcher oriented explanation, the one we would have liked to get when we started At this stage, the talk will focus on results we obtained on a real world example, and on dead ends we encountered These results include, but are not limited to, obtaining more discriminating information regarding our hosts, classifying them by similarities and highlighting anomalies In other words, automatically grouping web servers, printers and finding isolated hosts, goats as we call them think the one from Jurassic Park , which may turn out to be low hanging fruits during a pentest All of this work, including codes and samples, will be available publicly, included in the scan digger framework IVRE, so everyone will be able to reproduce the results for fun and profit Bio Camille MOUGEY Mougey Camille is an infosec engineer at CEA DAM, mainly working on reverse engineering and network mapping topics His previous talks include a presentation on execution trace for disobfuscation at SSTIC 2014 and another one on DRM analysis at ReCON 2014 Xavier MARTIN Martin Xavier is a MSc student at Ensimag, France and a security enthusiast He also has a degree in mathematics, giving him a strong background in such topics The work presented here is a result of its second year internship at the CEA on network mapping issues For More Information Please Visit - http 2015hackitoergosumorg http://www.secuobs.com/revue/news/599468.shtmlhttp://www.secuobs.com/revue/news/599468.shtml 2016-02-26 08:00:56 - Security Bloggers Network : IMAGE Policy Detection Enforcement Start Securing Your Network with a Software Defined Approach --------------------------------------------------------------------- At Juniper, we believe that a successful digital transformation requires a shift moving away from traditional network security to a strategy of securing the network Network security as recognized today is reactive, siloed and utilizes a block and tackle approach to deal with known threats Securing the network, instead, entails being adaptable and improving the accuracy of preventing or stopping threats Reacting and remediating identified threats is not enough for us we want our customers to know who the bad guys are and identify them quicker, and stop them faster --------------------------------------------------------------------- Copyright 1996-2016 Juniper Networks, Inc All rights reserved Update preferences IMAGE IMAGE IMAGE IMAGE submit to reddit IMAGE IMAGE http://www.secuobs.com/revue/news/599449.shtmlhttp://www.secuobs.com/revue/news/599449.shtml 2016-02-26 05:38:59 - Help Net Security : Big news from DB Networks, a provider of database cybersecurity products They partnered with Cyphort to offer customers full spectrum visibility from the desktop and network perimeter to deep in the database, and their Layer 7 Database Sensor has been chosen to power Security On-Demand s Database Threat Protection service Cyphort Cyphort s Advanced Threat Defense platform will leverage event information from DB Networks Layer 7 Database Sensor to help increase fidelity on verdicts of malicious content More http://www.secuobs.com/revue/news/599434.shtmlhttp://www.secuobs.com/revue/news/599434.shtml 2016-02-25 13:25:33 - Global Security Mag Online : INTERXION HOLDING NV annonce ce jour qu'euNetworks, fournisseur de services d'infrastructures de bande passante en Europe de l'Ouest, étend son système de multiplexage en longueur d'onde dense longue distance DWDM au data center d'Interxion à Marseille, France MRS1 Marseille constitue le point d'interconnexion de 12 câbles sous-marins internationaux reliant l'Europe à l'Afrique, au Moyen-Orient et à l'Asie La présence d'euNetworks à Marseille permettra d'accéder à un éventail unique d'actifs fibre - Marchés http://www.secuobs.com/revue/news/599353.shtmlhttp://www.secuobs.com/revue/news/599353.shtml 2016-02-25 11:41:23 - SecurityTube.Net : We are very proud to announce Robert M Lee robertmlee as a speaker to this years 4SICS conference His presentation is called Asset Identification and Network Security Monitoring in ICS Networks In his presentation he will discuss asset identification and network security monitoring, where it is useful in ICS, recommendations on how to get started, and how this approach can be useful in countering threat tactics that the community has seen in cases such as BlackEnergy2 and HAVEX Besides being a presenter at 4SICS Mr has create the wonderful book SCADA and Me a book For Children and Management that works as an excellent and easy to grasp introduction to the topic on what is critical infrastructure and why is it important to protect it In the book the child Bobby have a central role by asking all the sensitive and sensible questions For More Information Please Visit - https 4sicsse http://www.secuobs.com/revue/news/599342.shtmlhttp://www.secuobs.com/revue/news/599342.shtml 2016-02-25 01:55:19 - Security Bloggers Network : This ESG Lab review documents the results of remote hands-on testing of the KEMP LoadMaster Operating System for bare metal with a focus on the solution s cost-effective performance capabilities http://www.secuobs.com/revue/news/599301.shtmlhttp://www.secuobs.com/revue/news/599301.shtml 2016-02-24 13:08:44 - SecurityTube.Net : We are very happy to annouce Chris Sistrunk US of Mandiant as a presenter at this years 4SICS The title of his presentation, which he co-present with Robert Caldwell is Missing the Obvious Network Security Monitoring for ICS The presentation is around the very important topic on Why haven t we seen more ICS-focused attacks Perhaps it s because we re not looking for them The current state of security in Industrial Control Systems is a widely publicized issue, but fixes to ICS security issues are long cycle, with some systems and devices that will unfortunately never have patches available In this environment, visibility into security threats to ICS is critical, and almost all of ICS monitoring has been focused on compliance, rather than looking for indicators evidence of compromise The nonintrusive nature o Network Security Monitoring NSM is a perfect fit for ICS This presentation looks at using free and open source tools for NSM as part of an incident response strategy in ICS, various options for implementing NSM, and some of the capabilities that NSM can bring to an ICS cyber security program Chris Sistrunk Chris is a Senior Consultant at Mandiant FireEye on the ICS SCADA team Before joining Mandiant, Chris was at Entergy for 11 years as an Engineer, with the last 5 as SCADA SME for Transmission Chris is a Sr Member of the IEEE, a registered Professional Engineer, and is a member of the DNP3 Technical Committee He has his BS in Electrical Engineering and MS in Engineering and Technology Management from Louisiana Tech University Chris also founded and organizes BSidesJackson, Mississippi s only security conference, since 2012 He is also an S4 Alumnus, previously speaking about Project Robus with Adam Crain and RTU Risk Scores For More Information Please Visit - https 4sicsse http://www.secuobs.com/revue/news/599245.shtmlhttp://www.secuobs.com/revue/news/599245.shtml 2016-02-24 09:50:23 - Global Security Mag Online : La solution Office 365 a séduit de très nombreuses organisations Depuis quatre ans, 30 millions d'utilisateurs et d'entreprises l'utilisent afin d'améliorer leur productivité, l'accessibilité mais aussi la collaboration tout en conservant une véritable simplicité d'utilisation Les avantages sont considérables pour une entreprise, mais il faut impérativement prévoir la transition de ses serveurs - sur site exchange ou Office traditionnels - vers une plateforme Cloud ou hybride Dans le cas contraire, - Points de Vue http://www.secuobs.com/revue/news/599224.shtmlhttp://www.secuobs.com/revue/news/599224.shtml 2016-02-24 06:30:33 - Security Bloggers Network : There is nothing more frustrating to a customer or client who is unable to access the website of a company, bank or retailer Multiple emails and attempts to check out often lead to the viewpoint of forget them I will just go to another e-retailer to see if they have it in stock Equally frustrating, and Read More The post Defending Your Network Against DDoS Attacks appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/599212.shtmlhttp://www.secuobs.com/revue/news/599212.shtml 2016-02-23 14:31:16 - SecurityTube.Net : Given the prevalence of Microsoft Active Directory domains as the primary means of managing large corporate networks both globally and in South Africa specifically one of the first goals of any internal penetration test is to get Domain Administrator DA level access In demonstration of how common a goal and practise this is, a plethora of tools and techniques exists to assist with this process, from the initial in through to to elevation of privilege and eventually extracting and cracking all domain credentials However, the processes followed is still manual and time consuming This both detracts from potentially more dangerous attacks that may be specific to the organisation under assessment, as well as limits those who know of their vulnerabilities to those willing to pay for an assessment Observing this, we decided to construct a framework for automating such activities This framework orchestrates the industries currently favoured tools to get DA on internal networks The goal for the project is to get Domain Admin rights as quickly as possible, so that analysts can start an internal assessment as a privileged user, rather than finishing as one This will allow analysts to spend time on engagements emulating real life hacking scenarios, such as going after business critical applications, while still comprehensively assessing the internal network Combining the software vulnerabilities, as well as a realistic idea of how people with malicious or criminal intent might reach them, will provide organisations the information they need to actually improve their defensive posture This talk will involve an introduction to owning Microsoft Windows Domains, then cover a method for automating this task, and finally introduce our tool for automating this Speaker Bio Dane Goodwin is an analyst at SensePost Previously, he was a developer that couldn t quite shake the feeling everything everyone was writing could be hacked Since learning the truth of that statement he know hopes to make the world a more secure place For More Information Please Visit - http wwwbsidescapetowncoza irongeekcom http://www.secuobs.com/revue/news/599119.shtmlhttp://www.secuobs.com/revue/news/599119.shtml 2016-02-23 05:40:40 - Security Bloggers Network : EU NIS Directive in a Nutshell The European Union EU achieved a significant milestone in Dec 2015 by reaching agreement on Network Information Security NIS Directive The NIS directive s primary goal is to contain the http://www.secuobs.com/revue/news/599054.shtmlhttp://www.secuobs.com/revue/news/599054.shtml 2016-02-22 11:16:05 - Global Security Mag Online : Les derniers projets en date comprennent un site de commutation au Moyen-Orient, un datacenter en Europe de l'Est et des stations d'atterrissement de câbles transatlantiques au Canada et au Royaume-Uni Emerson Network Power lance deux nouvelles plates-formes de produits pour le marché de l'accès sans fil NetXtend et le NetSure 5100 tous deux disponibles en Europe, au Moyen-Orient et en Afrique NetXtend M Series est disponible en trois tailles standard avec de l' espace pour l'équipement - Produits http://www.secuobs.com/revue/news/598947.shtmlhttp://www.secuobs.com/revue/news/598947.shtml 2016-02-22 08:33:00 - Help Net Security : PacketFence is a fully supported, free and open source network access control NAC solution Its feature set includes a captive-portal for registration and remediation, centralized wired and wireless management, BYOD management options, 8021X support, and layer-2 isolation of problematic devices New features in version 57 DNS-based enforcement A new enforcement method for routed networks allowing to easily deploy PacketFence in combination with a firewall appliance using SSO SAML authentication Captive portal authentication More http://www.secuobs.com/revue/news/598938.shtmlhttp://www.secuobs.com/revue/news/598938.shtml 2016-02-19 21:13:10 - Security Bloggers Network : Adobepng Here s what new in Threat Intelligence Zero-Day Coverage for TippingPoint for the week of February 15, 2016 IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/598835.shtmlhttp://www.secuobs.com/revue/news/598835.shtml 2016-02-19 01:06:46 - New RFCs : 62KB DOI http://www.secuobs.com/revue/news/598732.shtmlhttp://www.secuobs.com/revue/news/598732.shtml 2016-02-19 01:06:46 - New RFCs : 34KB DOI http://www.secuobs.com/revue/news/598731.shtmlhttp://www.secuobs.com/revue/news/598731.shtml 2016-02-19 01:06:46 - New RFCs : 83KB DOI http://www.secuobs.com/revue/news/598730.shtmlhttp://www.secuobs.com/revue/news/598730.shtml 2016-02-18 15:13:28 - Office of Inadequate Security : Has another member of CWA been arrested It sounds like it, but law enforcement hasn t said so definitively Jamie http://www.secuobs.com/revue/news/598659.shtmlhttp://www.secuobs.com/revue/news/598659.shtml 2016-02-18 12:01:44 - Global Security Mag Online : À l'ère de la convergence des usages, les outils numériques sont au cœur de l'activité de l'entreprise et conditionnent son organisation, son fonctionnement et sa pérennité Préserver le système d'information devient un sujet stratégique force est de constater que la notion de Plan de Reprise d'Activité PRA connaît un essor croissant au sein des entreprises et organismes publics, de toutes tailles Avant de mettre en avant un certain nombre de bonnes pratiques pour lancer son projet, abordons une - Points de Vue http://www.secuobs.com/revue/news/598648.shtmlhttp://www.secuobs.com/revue/news/598648.shtml 2016-02-18 07:05:23 - Help Net Security : DB Networks introduced a product that provides OEM partners with real-time deep protocol analysis of database traffic By integrating this technology into their products, security OEMs can offer their customers visibility into data-tier cyber threats With this launch, DB Networks enables OEM partners offering solutions such as Incident Response IR services, Breach Detection Systems BDS , Data Leak Prevention DLP , and Security Incident Event Management SIEM products to integrate its patented database infrastructure security technology More http://www.secuobs.com/revue/news/598613.shtmlhttp://www.secuobs.com/revue/news/598613.shtml 2016-02-18 06:11:28 - Slashdot Your Rights Online : Los Angeles' Presbyterian Medical Center, the target of a successful ransomware attack successful from the thieves' point of view, that is has buckled under to regain control of its network, the hospital has paid a 40-bitcoin ransom about 17,000 to the gang responsible That, at least, is a far cry from the much higher ransom widely reported to have been initially demanded 9,000 bitcoin That would have meant a payment of 36-39 million IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/598612.shtmlhttp://www.secuobs.com/revue/news/598612.shtml 2016-02-18 05:38:45 - New RFCs : 65KB DOI http://www.secuobs.com/revue/news/598607.shtmlhttp://www.secuobs.com/revue/news/598607.shtml 2016-02-17 20:10:00 - Security Bloggers Network : Mike Geller from Cisco s CTO office and Ehud Doron of Radware s CTO office presented at Cisco Live Berlin 2016 the revolutionary concept of Network-as-a-Sensor to fight DDoS attacks There are two approaches to detect against DDoS attacks on-premise also sometimes called in-line and Cloud out of path When a DDoS solution is deployed on-premise, organizations http://www.secuobs.com/revue/news/598569.shtmlhttp://www.secuobs.com/revue/news/598569.shtml 2016-02-17 18:04:42 - Security Bloggers Network : Recently, my computer failed and I had to get it fixed and my data restored It took several days to identify the specific problem in this case, catastrophic hard drive failure and restore access to my applications and data In the meantime, my productivity dropped dramatically and it was hard to work using the alternative http://www.secuobs.com/revue/news/598557.shtmlhttp://www.secuobs.com/revue/news/598557.shtml 2016-02-17 11:10:41 - Global Security Mag Online : La mission de Thomas Desrues consistera à développer, avec le support de l'équipe d'experts français, l'activité de Juniper pour l'ensemble des marchés et des gammes de produits permettant de répondre aux différents besoins des administrations publiques, des entreprises de tous horizons, des fournisseurs de services, ainsi que des opérateurs Cloud et de Télécommunications Dans le cadre de ses fonctions, Thomas Desrues entretiendra et développera également le réseau de distributeurs et de revendeurs - Business http://www.secuobs.com/revue/news/598521.shtmlhttp://www.secuobs.com/revue/news/598521.shtml 2016-02-16 17:41:53 - Global Security Mag Online : La récente attaque ciblant un hôpital du sud de la Californie, le Hollywood Presbyterian Medical Center, est actuellement aux prises avec un ransomware qui affecte son activité http wwwibtimescom hollywood-ho Les pirates qui ont bloqué certaines données demandent le paiement d'une rançon de 3,6 millions de dollars pour débarrasser l'hôpital du programme malveillant Joël Mollo, Directeur Europe du Sud de Skyhigh Networks commente cette actualité Parmi tous les secteurs qui traitent des - Produits http://www.secuobs.com/revue/news/598434.shtmlhttp://www.secuobs.com/revue/news/598434.shtml 2016-02-16 12:30:23 - Global Security Mag Online : Une nouvelle étude de Palo Alto Networks révèle qu'il reste encore beaucoup à faire dans les domaines de la collaboration et du partage de responsabilités pour ce qui est de la prévention des cyberfailles deux démarches pourtant cruciales que doivent adopter les entreprises en France si elles veulent éviter de lourdes pénalités financières et préserver leur réputation Le principal enseignement de cette étude d'envergure européenne est que l'essentiel des responsabilités repose exclusivement sur les - Investigations http://www.secuobs.com/revue/news/598410.shtmlhttp://www.secuobs.com/revue/news/598410.shtml 2016-02-15 16:15:14 - Security Bloggers Network : You install the app on your iPhone It gives you the date you'll be followed via location data, and you get a surveillance photo at the end http://www.secuobs.com/revue/news/598325.shtmlhttp://www.secuobs.com/revue/news/598325.shtml 2016-02-15 15:21:04 - Global Security Mag Online : I-TRACING, entreprise française de conseil et d'ingénierie en sécurité des systèmes d'information et sécurité Internet, annonce son partenariat avec l'éditeur américain Tenable Network Security, leader du monitoring réseau continu, pour réduire les risques de sécurité et assurer la conformité du système d'information de ses clients En assurant la surveillance continue du réseau, il est possible d'identifier les différents types de risques sur le réseau et remédier aux vulnérabilités de conformité et de - Business http://www.secuobs.com/revue/news/598313.shtmlhttp://www.secuobs.com/revue/news/598313.shtml 2016-02-15 10:48:57 - Global Security Mag Online : Arbor Networks Inc lance une nouvelle plate-forme de protection contre les menaces avancées Arbor Networks Spectrum s'adresse spécifiquement aux équipes de sécurité, qu'elles soient chevronnées ou néophytes, pour leur permettre d'explorer l'ensemble du réseau afin d'y découvrir, étudier et prouver l'existence de campagnes d'attaques sophistiquées en l'espace de quelques minutes, au lieu de plusieurs heures voire plusieurs jours En intégrant des workflows intuitifs qui fonctionnent à la vitesse de la - Produits http://www.secuobs.com/revue/news/598301.shtmlhttp://www.secuobs.com/revue/news/598301.shtml 2016-02-15 09:23:57 - Help Net Security : Here s a riddle What s hidden in plain sight Stretches the entire known world Vilified and Adored Born from a secret US Government project Maintains secret societies Requires one to pass through a secret gateway to access Answer It is the infamous Darknet This article will discuss Darknets and what these tools hold for the future of security This discussion will share how to access and navigate the Darknet for those who are ignorant or otherwise More http://www.secuobs.com/revue/news/598297.shtmlhttp://www.secuobs.com/revue/news/598297.shtml 2016-02-14 20:19:52 - Help Net Security : The GSMA Association has published new guidelines designed to promote the secure development and deployment of services in the growing Internet of Things IoT market Separate security guidelines have been offered for the IoT service providers, network operators, and IoT device manufacturers The guidelines have been developed in consultation with the mobile industry and offers IoT service providers and the wider IoT ecosystem practical advice on tackling common cybersecurity threats, as well as data privacy More The post IoT security guidelines for providers, vendors, and network operators appeared first on Help Net Security http://www.secuobs.com/revue/news/598262.shtmlhttp://www.secuobs.com/revue/news/598262.shtml 2016-02-14 20:13:52 - HACKMIAMI : Haxathalon the NoobGrinder will talk about concepts and techniques for spotting anomalous behavior in your network building baselines for what is expected Tools to make it happen This meeting will take place on the 7th Floor of the library in the Creation Station for Business space Location We are meeting in http://www.secuobs.com/revue/news/598255.shtmlhttp://www.secuobs.com/revue/news/598255.shtml 2016-02-12 20:06:32 - Blog : IMAGE IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/598177.shtmlhttp://www.secuobs.com/revue/news/598177.shtml 2016-02-11 20:23:05 - Blog : IMAGE IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/598073.shtmlhttp://www.secuobs.com/revue/news/598073.shtml 2016-02-11 16:14:48 - Forensic Focus : Passware has recently released a new version of its flagship product - Passware Kit Forensic 20161, which supports shared dictionaries What does this mean for corporations and forensic investigators Large custom wordlists and even memory image files can be used by Passware Kit as dictionaries to recover a password Such files are often stored on network-shared drives, while the password recovery process is launched on different workstations Passware customers no longer have to copy large dictionary files to local computers running Passware Kit or Passware Kit Agents The dictionary should be compiled first with Passware Kit into its dic format, and can afterwards be stored on a network drive A customer has to specify the location of the dictionary folder in the Passware Kit settings once the program would import the dictionaries automatically from the location specified For distributed password recovery processes, these dictionaries will also be shared among the Passware Kit Agents http://www.secuobs.com/revue/news/598042.shtmlhttp://www.secuobs.com/revue/news/598042.shtml 2016-02-11 13:39:55 - Help Net Security : The GSMA Association has published new guidelines designed to promote the secure development and deployment of services in the growing Internet of Things IoT market Separate security guidelines http://www.secuobs.com/revue/news/598022.shtmlhttp://www.secuobs.com/revue/news/598022.shtml 2016-02-10 20:55:21 - Secure Thoughts : Last updated January 31st, 2016 What is a VPN VPNs are Virtual Private Networks, and they re a service provided to users, typically for a monthly fee Basically, when you sign up for a service plan, you get a software bundle or an app for your device When you select a The post VPN Review Virtual Private Networks Explained appeared first on Secure Thoughts http://www.secuobs.com/revue/news/597950.shtmlhttp://www.secuobs.com/revue/news/597950.shtml 2016-02-10 19:27:54 - Security Bloggers Network : In Greek mythology, the Titan Prometheus was chained to a rock Every day, an eagle flew down and ate part of his liver The organ regenerated during the night, replenishing the food source The liver is one of the few organs in the human body that can spontaneously regenerate Even more impressive, is the fact http://www.secuobs.com/revue/news/597937.shtmlhttp://www.secuobs.com/revue/news/597937.shtml 2016-02-10 11:52:01 - SecurityTube.Net : FuityWifi can be used to deploy advanced attacks against users and companies by deploying these attacks a common user becomes a trigger to compromise the corporate network For More Information Please Visit - http wwwsteelconinfo http://www.secuobs.com/revue/news/597851.shtmlhttp://www.secuobs.com/revue/news/597851.shtml 2016-02-10 08:52:55 - Help Net Security : NetworkMiner can be used as a passive network sniffer packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc without putting any traffic on the network http://www.secuobs.com/revue/news/597827.shtmlhttp://www.secuobs.com/revue/news/597827.shtml 2016-02-09 16:59:13 - Krebs on Security : If you have ever walked up to an ATM to withdraw cash only to decide against it after noticing a telephone or ethernet cord snaking from behind the machine to a jack in the wall, your paranoia may not have been misplaced ATM maker NCR is warning about skimming attacks that involve keypad overlays, hidden cameras and skimming devices plugged into the ATM network cables to intercept customer card data http://www.secuobs.com/revue/news/597775.shtmlhttp://www.secuobs.com/revue/news/597775.shtml 2016-02-09 11:57:27 - Global Security Mag Online : Du 18 février au 10 mai, le distributeur à haute valeur ajoutée Exclusive Networks accompagne Fortinet dans un tour de France à la rencontre de leurs partenaires revendeurs L'édition 2016 de ce FortiTour se tiendra du 18 février au 10 mai 2016 dans les dix villes suivantes Paris, Strasbourg, Lille, Marseille, Nice, Bordeaux, Toulouse, Nantes, Rennes et Lyon Durant une matinée, les partenaires revendeurs pourront découvrir au travers de présentations les résultats 2015, les perspectives 2016, - Événements http://www.secuobs.com/revue/news/597723.shtmlhttp://www.secuobs.com/revue/news/597723.shtml 2016-02-08 15:34:10 - LinuxSecurity.com Latest News : LinuxSecuritycom Days after a group of concerned professors raised alarm bells over a new network monitoring system installed at the University of California, Berkeley and the other nine campuses of the University of California system, a separate committee of system-wide faculty has now given its blessing http://www.secuobs.com/revue/news/597650.shtmlhttp://www.secuobs.com/revue/news/597650.shtml 2016-02-08 07:50:31 - Security Bloggers Network : Want to move an Azure VM between virtual networks Get ready for some manual work read more http://www.secuobs.com/revue/news/597617.shtmlhttp://www.secuobs.com/revue/news/597617.shtml 2016-02-07 18:29:06 - Security Bloggers Network : Everyone knows that vulnerabilities matter, but many times I feel people focus on servers and applications before giving the network equipment some vulnerability assessment love It's true that these systems don't have as many changes, or even updates http://www.secuobs.com/revue/news/597586.shtmlhttp://www.secuobs.com/revue/news/597586.shtml 2016-02-06 11:30:09 - Security Bloggers Network : beecavebobjpgHere s what new in Threat Intelligence Zero-Day Coverage for TippingPoint for the week of February 1, 2016 IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/597551.shtmlhttp://www.secuobs.com/revue/news/597551.shtml 2016-02-05 19:35:17 - Office of Inadequate Security : I don t get to attend many conferences as I m self-funded, but I ll be attending the 2016 PPN Conference http://www.secuobs.com/revue/news/597517.shtmlhttp://www.secuobs.com/revue/news/597517.shtml 2016-02-05 08:53:59 - Computer Forensics Malware Analysis Digital Investigations : This is an updated EnCase v7 EnScript to parse the WiFi profiles that may exist on Windows 7 8 10 system in the following locations HKEY_LOCAL_MACHINE SOFTWARE Microsoft Windows NT CurrentVersion NetworkList Signatures Unmanaged HKEY_LOCAL_MACHINE SOFTWARE Microsoft Windows NT CurrentVersion NetworkList Profiles Running the EnScript displays a simple message box The EnScript will then search the case for all SOFTWARE registry hives that it can find based on name and location windows system32 config and attempt to parse any WiFi profile keys that may exist All output is to the console in CSV format for quick import into Excel copy and paste The EnScript parses the profile name, DNSSuffix helpful sometimes in identifying owner or location of the network , MAC address of the access point, creation date time of the profile last connection date time to the profile If you have access to the Google geolocation API, you can then possibly geolocate the WiFi access points based on the MAC address, which can tell an interesting story when also lined up by dates times Download Here http://www.secuobs.com/revue/news/597452.shtmlhttp://www.secuobs.com/revue/news/597452.shtml 2016-02-04 19:15:42 - Security Bloggers Network : In June of 2015, Dimensional Research conducted a survey for Tripwire of over 400 energy executives and IT professionals in the energy, oil, gas and utility industries on cybersecurity and compliance initiatives The survey found that 86 percent of energy security personnel believed they could detect a breach on critical systems in less than one Read More The post Survey Only 35pourcents of Energy Orgs Are Capable of Tracking Threats to OT Networks appeared first on The State of Security IMAGE http://www.secuobs.com/revue/news/597405.shtmlhttp://www.secuobs.com/revue/news/597405.shtml 2016-02-04 07:44:07 - SecurityTube.Net : In this presentation, the authors share the workflow and architecture of SC14 examine traffic and user volumes during SC14 and present the analytic questions asked of graphs made of network flow, other data, and techniques applied to these graphs, and outline plans for analytic improvement at SC15 For More Information Please Visit - http wwwseicmuedu http://www.secuobs.com/revue/news/597330.shtmlhttp://www.secuobs.com/revue/news/597330.shtml 2016-02-04 07:44:07 - SecurityTube.Net : In this presentation, Soumyo discusses the distributions of active and idle durations of network hosts using flow data Active periods are defined as those where there has been one or more outward flows in that period Duration of activity is estimated as the sum of the periods over which the host has been continuously active An idle period is similarly defined as one in which there have been no outward flows An idle duration is the sum of the periods over which the host was continuously idle Soumyo estimates these active and idle durations over a time window and consider their distributions The analysis provides a particular perspective on network activity and is important for situational awareness We can develop baselines for characterizing these distributions and see if there are significant changes in the network behavior of hosts in terms of the active and idle durations The distribution of the idle times is important since it can help us estimate the probability of a host still being active after a period of idleness This metric is analogous to survivability in reliability theory The distribution can also be used to estimate the conditional probability of a host being active again within a time horizon given it has been idle for some length of time Soumyo estimates these distributions from some public domain data and suggest ways of interpreting them Soumyo also discusses the implications for situational awareness, security, and network inventory For More Information Please Visit - http wwwseicmuedu http://www.secuobs.com/revue/news/597328.shtmlhttp://www.secuobs.com/revue/news/597328.shtml 2016-02-04 07:44:07 - SecurityTube.Net : The Monitoring Virtual Networks industry is embracing virtualization because it reduces hardware and administration costs, increases scalability, and improves resource allocation However, hypervisors create naturally isolated systems that can thwart traditional network monitoring techniques Examining incidents in these systems is difficult without proper considerations since the incident details are abstracted away to the VM-level To address these drawbacks, we investigated the operational details of, and installed probes onto, three popular virtual network implementations This presentation summarizes the findings of the investigation and addresses optimizing virtual network design for monitoring hypervisor and sensor integration formalizing the art of building and deploying virtual sensors external versus intra-cluster traffic observations Considerations for monitoring virtualized networks are also illustrated with data collected during a six-month sensor deployment in a production environment The discussion concludes with a look at new trends in virtual networking and how they might impact network security monitoring in the future For More Information Please Visit - http wwwseicmuedu http://www.secuobs.com/revue/news/597327.shtmlhttp://www.secuobs.com/revue/news/597327.shtml 2016-02-04 07:44:07 - SecurityTube.Net : Network security increasingly requires combining data from heterogeneous sources such as NetFlow, log files, and raw traffic dumps Effective instrumentation is a complex problem that not only requires collecting and normalizing data, but understanding the interrelationships between different data sources As an example of the difficulty of this problem, consider relating traffic between a firewall and a flow collection system that are adjacent to each other Depending on their relative placement, it is possible that they will record the same events, or it is possible that events recorded by the firewall should never be seen by the flow collection system In this talk, Michael Collins introduces a systematic methodology for analyzing the vantage of sensor systems Vantage is a formal description of the range and type of data that a sensor collects By using a three-axis classification system, we can map out the vantage of the sensors of a network and determine their interactions with each other Vantage analysis provides insight into the coverage and blind spots on the sensor network, and helps predict the impact of sensor failures In this talk, Collins also introduces vantage, provides examples of vantage analysis on different network architectures, and demonstrates a simple tool for conducting vantage analyses For More Information Please Visit - http wwwseicmuedu http://www.secuobs.com/revue/news/597324.shtmlhttp://www.secuobs.com/revue/news/597324.shtml 2016-02-04 07:44:07 - SecurityTube.Net : Analyzing network flow is an arduous process An encounter complex for analyzing network flow is defined and demonstrates how it can be used to reduce the amount of data to be analyzed as well as to highlight anomalous flows A graph similarity measure is then defined to further cluster the network flows For More Information Please Visit - http wwwseicmuedu http://www.secuobs.com/revue/news/597323.shtmlhttp://www.secuobs.com/revue/news/597323.shtml 2016-02-03 17:31:15 - Vigilance vulnérabilités publiques : Un attaquant non authentifié peut envoyer un message malveillant vers EMC NetWorker, afin de mener un déni de service http://www.secuobs.com/revue/news/597278.shtmlhttp://www.secuobs.com/revue/news/597278.shtml 2016-02-03 13:41:15 - SecurityTube.Net : For those tasked with network threat detection and response, network flow records are widely held as a valuable data source Yet many organizations lack the capability to effectively use a complex data source like network flows, which can generate billions of records in a day Deriving insight from network flows requires not only the ability to store and process enormous quantities of data, but also the transformation of the data into forms better suited for data analysis Without compelling visualization of these results, the insight may still remain hidden If the data does not enable the practitioner to tell the story, the insight may never have the impact to effect needed change To increase the insight that network flows could provide, our research team took a path borrowed from scientific investigations of climate and neuroscience A solution for network flows is a solution at scale, and requires deep thinking in minimizing data footprint and speedup from parallel processing This approach required transforming the data into time series and graph structures, then performing both classical scientific data analysis, such as principal component and Fourier analysis, plus more recent methods involving probabilistic graphical models These techniques provided new ways to visualize network flow data and increase the potential for insight The steps in our approach are intended to help the practitioner tell the story in network flow data In this talk and supporting paper, Grant shares some key learnings and outline our approach, largely based in open source software For More Information Please Visit - http wwwseicmuedu http://www.secuobs.com/revue/news/597242.shtmlhttp://www.secuobs.com/revue/news/597242.shtml 2016-02-03 13:41:15 - SecurityTube.Net : Information security strategies may be classified by a functional series of impacts on attempts to violate assurance policies deception, frustration, resistance, recognition-and-recovery A recent book-length treatment of these strategies identified network flow analysis with recognition-and-recovery, but use of network flow data supports the other strategies as well This presentation lays out a series of analytics keyed to the strategies they support traffic baselining to support deception, attack surface estimation to support frustration, anomaly analysis to support resistance, attack profiling to support recognition-and-recovery The presentation concludes with discussions of combinations of these analytics in an integrated security approach For More Information Please Visit - http wwwseicmuedu http://www.secuobs.com/revue/news/597239.shtmlhttp://www.secuobs.com/revue/news/597239.shtml 2016-02-03 13:41:15 - SecurityTube.Net : In this presentation, the authors discuss the proposed standard representation of network flow data, explain why RDF was chosen as the representation language, discuss the benefits of performing network flow analysis in a graph engine using SPARQL, outline real-world applications of network flow analysis using the standard, and solicit feedback from the analytic community For More Information Please Visit - http wwwseicmuedu http://www.secuobs.com/revue/news/597234.shtmlhttp://www.secuobs.com/revue/news/597234.shtml 2016-02-02 23:51:06 - Blog : IMAGE IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/597177.shtmlhttp://www.secuobs.com/revue/news/597177.shtml 2016-02-02 22:28:27 - LinuxSecurity.com Latest News : LinuxSecuritycom There is a big problem brewing in the Internet You may have noticed that big attacks that disrupt networks or servers' ability to deliver traffic, called Distributed Denial of Service DDoS , are showing up in the news more often You may not know that, officially, documented attacks are happening at the scale of several hundred Gigabits per second, and unofficially, have been observed at over a Terabit per second http://www.secuobs.com/revue/news/597173.shtmlhttp://www.secuobs.com/revue/news/597173.shtml 2016-02-02 18:01:20 - Global Security Mag Online : Depuis 1997, IMS Networks conçoit, déploie et opère des réseaux et services de télécommunications de haute criticité Afin de répondre au besoin de sécurité la société a créée en 2012 IMS Networks Security, une Business Unit spécialisée dans la sécurité périmétrique des réseaux A l'occasion du FIC, elle a lancé Cyblex, une offre labellisée France Cybersecurity de protection anti-DDoS en mode SaaS, développée en partenariat avec l'éditeur 6Cure Pour Solenn Eclache, Responsable Marketing d'IMS Networks présente - Interviews affiche http://www.secuobs.com/revue/news/597161.shtmlhttp://www.secuobs.com/revue/news/597161.shtml 2016-02-02 17:24:24 - Global Security Mag Online : Contact Madame Solenn ECLACHE, T 05 63 73 50 13 Année de création 1997 Activités Depuis 1997, IMS Networks conçoit, déploie et opère des réseaux et services de télécommunications de haute criticité La mission d'IMS Networks est d'aider les organisations à renforcer leur indépendance et leur compétitivité en optimisant la performance et la sécurité de leurs infrastructures connectées à Internet Pour cela, la société a créé en 2012 IMS Networks Security, une Business Unit spécialisée dans la - OPERATEURS TELECOMS - MSSP - INFOGERANCE - CLOUD - HEBERGEMENT SECURISE http://www.secuobs.com/revue/news/597159.shtmlhttp://www.secuobs.com/revue/news/597159.shtml 2016-02-01 12:04:55 - SecurityTube.Net : BSides Charleston, SC 2015 Track 2 - Session 1 You spent 20k a throw away email can have full recon on your network Speaker Chris O Rourke - clocno For More Information Please Visit - http wwwbsidescharlestoncom http://www.secuobs.com/revue/news/597022.shtmlhttp://www.secuobs.com/revue/news/597022.shtml 2016-02-01 11:11:50 - Global Security Mag Online : Openhost, acteur français de l'hébergement cloud, engage une nouvelle dynamique en 2016 avec deux partenariats technologiques majeurs l'intégration au programme Cloud Os Network et le statut CSP Niveau 1 de Microsoft Un engagement fort au service de ses solutions d'hébergement de cloud hybride Le programme Cloud Os Network a retenu 11 acteurs de l'IT en France qui répondent à des critères rigoureux concernant l'usage de technologies innovantes liées au Cloud hybride Azure Nous y trouvons - Business http://www.secuobs.com/revue/news/597010.shtmlhttp://www.secuobs.com/revue/news/597010.shtml 2016-02-01 08:38:39 - Global Security Mag Online : Palo Alto Networks annonce avoir publié les résultats d'une étude financée par ses soins portant sur les rouages économiques des cyberattaques Intitulée Flipping the Economics of Attacks, cette étude analyse certains points, comme Le revenu moyen d'un cyberpirate, La durée des attaques en règle générale, et, Les techniques permettant de faire obstacle aux fuites de données en augmentant leur coût Principales conclusions Les cyberpirates sont opportunistes et visent avant tout les cibles - Investigations http://www.secuobs.com/revue/news/596996.shtmlhttp://www.secuobs.com/revue/news/596996.shtml 2016-01-31 20:08:50 - SecTechno : http://www.secuobs.com/revue/news/596986.shtmlhttp://www.secuobs.com/revue/news/596986.shtml 2016-01-29 14:54:36 - Technicalinfo.net Blog : It seems that this last holiday season didn t bring much cheer or goodwill to corporate security teams With the public disclosure of remotely exploitable vulnerabilities and backdoors in the products of several well-known security vendors, many corporate security teams spent a great deal of time yanking cables, adding new firewall rules, and monitoring their networks with extra vigilance It s not the first time that products from major security vendors have been found wanting It feels as though some vendor s host-based security defenses fail on a monthly basis, while network defense appliances fail less frequently maybe twice per year At least that s what a general perusal of press coverage may lead you to believe However, the reality is quite different Most security vendors fix and patch security weaknesses on a monthly basis Generally, the issues are ones that they themselves have identified through internal SDL processes or the use of third-party code reviews and assessment or they are issues identified by customers And, every so often, critical security flaws will be dropped on the vendor by an independent researcher or security company that need to be fixed quickly Two decades ago, the terms bastion host , DMZ, and firewall pretty much summed up the core concepts of network security, and it was a simpler time for most organizations both for vendors and their customers The threat spectrum was relatively narrow, the attacks largely manual, and an organization s online presence consisted of mostly static material Yet, even then, if you picked up a book on network security you were instructed in no short order that you needed to keep your networks separate one for the Internet, one for your backend applications, one for your backups, and a separate one for managing your security technology Since that time, many organizations have either forgotten these basic principles or have intentionally opted for riskier yet cheaper architectures and just hoping that their protection technologies are up to the task Alas, as the events of December 2015 have shown us, every device added to a network introduces a new set of security challenges and weaknesses From a network security perspective, when looking at the architecture of critical defenses, there are four core principles 1 Devices capable of monitoring or manipulating network traffic should never have their management interfaces directly connected to the Internet If these security devices need to be managed over the Internet it is critical that only encrypted protocols be used, multi-factor authentication be employed, and that approved in-bound management IP addresses be whitelisted at a minimum 2 The management and alerting interfaces of security appliances must be on a management network separated from other corporate and public networks It should not be possible for an attacker who may have compromised a security device to leverage the management network to move laterally onto other guest systems or provide a route to the Internet 3 Span ports and network taps that observe Internet and internal corporate traffic should by default only operate in read-only mode A compromised security monitoring appliance should never be capable of modifying network traffic or communicating with the Internet from such an observation port 4 Monitor your security products and their management networks Security products especially networking appliances such as core routers, firewalls, and malware defenses will always be a high-value target to both external and internal attackers These core devices and their management networks must be continuously monitored for anomalies and audited In an age where state-sponsored reverse engineers, security research teams, and online protagonists are actively hunting for flaws and backdoors in the widely deployed products of major security vendors as a means of gaining privileged and secret access to their target s networks, it is beyond prudent to revisit the core tenets of secure network architecture Corporate security teams and network architects should assume not only that new vulnerabilities and backdoors will be disclosed throughout the year, but that those holes may have been accessible and exploited for several months beforehand As such, they should adopt a robust defense-in-depth strategy including watchers watching watchers http://www.secuobs.com/revue/news/596877.shtmlhttp://www.secuobs.com/revue/news/596877.shtml 2016-01-29 12:36:27 - SecurityTube.Net : The Challenges of System Network Segmentation in an Enterprise Oleksiy Vasylyuk The design and implementation of network and system segmentation in medium to large environments can be challenging as there appears to be no common approach for implementation and communication of segmentation to technical and business units This talk will describe the challenges of such implementation and summarize the potential solutions for physical and logical alignment, and its socialization The material presented will be based on recent and ongoing experience with designing, implementing, and communicating network and system segmentation via numerous hands-on table top exercises, and analysis of numerous literature sources For More Information Please Visit - http bsideswpgca http://www.secuobs.com/revue/news/596852.shtmlhttp://www.secuobs.com/revue/news/596852.shtml 2016-01-29 12:36:27 - SecurityTube.Net : Network Configuration Management Zoë Rose Configuration Management is important because any changes made can have a huge impact on your network This talk will be discuss the importance of change management, specifically configuration management of routers and switches The goal is to give more visibility into large networks with automated tasks Zoë has created a script for auditing logins, daily configuration changes, and snapshots For More Information Please Visit - http bsideswpgca http://www.secuobs.com/revue/news/596847.shtmlhttp://www.secuobs.com/revue/news/596847.shtml 2016-01-29 09:56:30 - Help Net Security : Solutionary performed a broad analysis of the threat landscape, which uncovered several key findings One of the most compelling finding links the rapid growth 236 percent in viruses and worms from http://www.secuobs.com/revue/news/596835.shtmlhttp://www.secuobs.com/revue/news/596835.shtml 2016-01-29 09:28:24 - Hak5 : Accessing internal networks without an internal VPN server Learn how to setup a reverse VPN gateway on this episode of Hak5 Support is d http://www.secuobs.com/revue/news/596833.shtmlhttp://www.secuobs.com/revue/news/596833.shtml 2016-01-28 17:42:02 - Global Security Mag Online : March Networks confie à David Attal la Direction du développement l'entreprise en France Il sera en charge d'accroître la notoriété de l'entreprise et de développer ses parts de marché, en étroite collaboration avec le directeur européen des ventes, Stefano Torri Basé en Amérique du Nord, March Networks a mis en place une stratégie ambitieuse pour développer sa présence en France où l'objectif est de tripler la part de marché de l'entreprise David Attal aura pour mission de mettre en place et développer - Business http://www.secuobs.com/revue/news/596769.shtmlhttp://www.secuobs.com/revue/news/596769.shtml 2016-01-27 10:43:11 - Global Security Mag Online : Après plusieurs opérations de croissance externe et l'ouverture de son capital, Jaguar Network, acteur majeur sur le marché européen du Cloud des Télécoms, nomme Alexandre BERTUZZI au poste de Directeur Général CEO , afin d'accélérer le déploiement de ses activités en France comme en Europe et conforter sa croissance 28pourcents en moyenne annuelle depuis 5 ans Alexandre Bertuzzi prend en charge le management opérationnel de Jaguar Network afin d'en faire un opérateur national incontournable, de - Business http://www.secuobs.com/revue/news/596614.shtmlhttp://www.secuobs.com/revue/news/596614.shtml 2016-01-26 16:01:23 - Global Security Mag Online : le paysage implacable des menaces alimente la demande de services de sécurité managés et de réponse aux incidents Arbor Networks Inc, la division sécurité de NETSCOUT NASDAQ NTCT , publie sa 11ème étude annuelle sur la sécurité des infrastructures IP mondiales WISR, Worldwide Infrastructure Security Report Son rapport regroupe les points de vue directs de la communauté internationale de la sécurité opérationnelle sur des aspects aussi divers que la détection des menaces et la réponse aux - français http://www.secuobs.com/revue/news/596527.shtmlhttp://www.secuobs.com/revue/news/596527.shtml 2016-01-26 14:44:26 - Global Security Mag Online : IMS Networks, spécialisé dans la conception et la gestion des réseaux d'entreprise de haute criticité, a présenté lors du FIC une toute nouvelle offre dédiée à la cybersécurité Dans un monde en pleine mutation économique et technologique, où le risque de menace est omniprésent, le principal levier de différenciation pour les entreprises est devenu la maîtrise de l'information La cybercriminalité peut mettre en péril la compétitivité et la santé financière des organisations C'est pour répondre à ces enjeux - Business http://www.secuobs.com/revue/news/596521.shtmlhttp://www.secuobs.com/revue/news/596521.shtml 2016-01-26 14:05:36 - Global Security Mag Online : La chaîne de pharmacies Walgreens Boots Alliance sera l'un des premiers clients à déployer BT Connect Intelligence IWAN BT annonce aujourd'hui le lancement mondial de BT Connect Intelligence IWAN, un service managé innovant qui permet aux entreprises d'optimiser et de router automatiquement leur trafic réseau, mais également d'obtenir plus de visibilité sur les performances de leurs applications sans consommer davantage de bande passante BT Connect Intelligence IWAN intègre la solution Cisco - français http://www.secuobs.com/revue/news/596515.shtmlhttp://www.secuobs.com/revue/news/596515.shtml 2016-01-25 17:31:19 - Rob Fuller's broadcasted articles on Inoreader : WifiHistoryView is a new tool for Windows 10 8 7 Vista that displays the history of connections to wireless networks on your computer For every event that the computer connected to a wireless network or disconnected from it, the following information is displayed The date time that the event occurred, network name SSID , profile name, network adapter name, BSSID of the router Access Point, and more WifiHistoryView can read the wifi history information from a running system or from external event log file of another computer WifiHistoryView WifiHistoryView You can download this new tool from this Web page http://www.secuobs.com/revue/news/596445.shtmlhttp://www.secuobs.com/revue/news/596445.shtml 2016-01-25 12:14:52 - SecurityTube.Net : Andrei is a Computer Science graduate of the Politehnica University of Bucharest where he did his thesis work in Biometrics and Image Processing While starting out his IT-career in the Computer Games industry, he has worked in the Telecom field and also was a senior developer at a specialized firm programming various GSM UMTS GPS sub-systems He is the author of the MiFare Classic Universal toolKit MFCUK , the first publicly available FOSS card-only key cracking tool for the MiFare Classic RFID card family and is known as the printer guy for his Hacking MFPs and Hacking PostScript series of hacks talks at various international conferences Lately, he was spotted security-harassing airplanes with ADS-B hacks though no planes were harmed during the experiments and remotely hacking fireworks demolition pyrotechnic systems though no fireworks show were spoiled and no buildings were demolished He is passionate about security in a holistic fashion Currently Andrei is a PhD candidate with EURECOM in the field of Software security in embedded systems At present, Andrei is mostly busy developing cutting edge security research for embedded systems as part of his FirmwareRE project https wwwlinkedincom in costinandrei http twittercom costinandrei Monitoring of the high-performance computing systems and their components, such as clusters, grids and federations of clusters, is performed using monitoring systems for servers and networks, or Network Monitoring Systems NMS These monitoring tools assist system administrators in assessing and improving the health of their infrastructure On the one hand, a successful attack on the infrastructure monitoring tools grants the attacker elevated power over the monitoring tasks, and eventually over some management functionality of the interface or hosts running those interfaces Additionally, detailed and accurate fingerprinting and reconnaissance of a target infrastructure is possible when such interfaces are publicly exposed A successful reconnaissance allows an attacker to craft a highly efficient second-stage attack, for example targeted, mimicry and blended attacks In this workshop we aim at teaching practical skills for hacking and securing Network Monitoring Systems NMS We will provide a VM machine and exercises that will enable an end-to-end walk through example on Ganglia monitoring system The exercises include a range of activities such as setup, reconnaissance, static and dynamic analysis, vulnerability analysis, proof of concept exploit development, and countermeasures securing steps The attendees will learn step-by-step how to quickly create a PoC exploit for a CVE that is described as having unspecified vectors For More Information Please Visit - http defcamp http://www.secuobs.com/revue/news/596401.shtmlhttp://www.secuobs.com/revue/news/596401.shtml 2016-01-24 12:54:22 - Slashdot Your Rights Online : walterbyrd writes The DOJ as well as Ohio, Illinois, California, and North Carolina say that Dish disregarded federal laws on call etiquette US lawyers are asking for 900 million in civil penalties, and the four states are asking for 235 billion in fines, according to the Denver Post 'Laws against phoning people on do-not-call lists and using recorded messages allow penalties of up to 16,000 per violation,' the Post added IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/596354.shtmlhttp://www.secuobs.com/revue/news/596354.shtml 2016-01-23 13:42:14 - Security Bloggers Network : small-weeklytppngHere s what new in Threat Intelligence Zero-Day Coverage for TippingPoint for the week of January 18, 2016 IMAGE IMAGE IMAGE IMAGE IMAGE http://www.secuobs.com/revue/news/596312.shtmlhttp://www.secuobs.com/revue/news/596312.shtml 2016-01-22 23:41:27 - Reverse Engineering : submitted by http://www.secuobs.com/revue/news/596291.shtmlhttp://www.secuobs.com/revue/news/596291.shtml 2016-01-22 21:02:44 - Reverse Engineering : submitted by kndydk link comment http://www.secuobs.com/revue/news/596283.shtmlhttp://www.secuobs.com/revue/news/596283.shtml 2016-01-22 17:53:49 - Hackaday : If you re a networking professional, there are professional tools for verifying that everything s as it should be on the business end of an Ethernet cable These professional tools often come along with a professional pricetag If you re just trying to wire up a single office, the pro gear can be overkill Unless you make it yourself on the cheap And now you can Kristopher Marciniak designed and built an inexpensive device that verifies the basics Is the link up Is this cable connected Can it get a DHCP address Can it perform a DNS lookup Can it open a webpage read more http://www.secuobs.com/revue/news/596267.shtmlhttp://www.secuobs.com/revue/news/596267.shtml 2016-01-22 15:26:32 - Global Security Mag Online : Palo Alto Networks et Proofpoint ont annoncé la mise en place d'un partenariat visant à proposer aux clients une protection renforcée et des solutions de collecte d'informations relatives aux diverses attaques sophistiquées menées via courrier électronique ou sur les réseaux sociaux , susceptibles d'affecter les utilisateurs et leurs données L'alliance des solutions Proofpoint Targeted Attack Protection TAP et SocialPatrol , avec la plateforme de sécurité Palo Alto Networks nouvelle génération, - Business http://www.secuobs.com/revue/news/596249.shtmlhttp://www.secuobs.com/revue/news/596249.shtml 2016-01-22 05:50:48 - SecurityTube.Net : Paul Coggin is senior principal cybersecurity analyst with Dynetics He is responsible for architecting and securing large complex tactical, critical infrastructure and service provider networks His expertise includes tactical, service provider, and ICS SCADA network infrastructure hacker attacks, and defenses, as well as large complex network design and implementation His experience includes leading network architecture reviews, vulnerability analysis, and penetration testing engagements for critical infrastructure and tactical networks Paul is a Cisco Systems certified Instructor 32230, certified EC-Council instructor, and certified SCADA security architect He has a bachelor s degree in mathematics, a master s in computer information systems, and a master s in information assurance and security He is currently pursuing a master s in system management In addition he holds a wide array of certifications from Cisco, EC Council, ISC 2, and others Defending the Enterprise Against Network Infrastructure Threats Learn about network attack vectors that an adversary can use to control, and influence network traffic flows and exfiltrate data by exploiting network devices and protocols in enterprise or service provider networks Defensive methods and techniques for monitoring and protecting against the outlined attack vectors will be discussed This presentation explores advanced methods and techniques that the CISO, network and security architects and security auditors need to understand about network infrastructure and protocols Understand how routing infrastructure can be compromised to enable sophisticated pivoting and exfiltration of data Know how to analyze often over looked network trust relationships, integration, dependencies and interdependencies in the enterprise and service provider network architecture Review the architecture and operations for border gateway protocol BGP services with references to the recent BGP prefix hijacking attacks The discussion will cover how Multi-protocol Label Switch MPLS networks may be attacked without the Enterprise being aware of the event Strategies for monitoring and securing enterprise networks including BGP and MPLS against the threats vectors presented will be discussed For More Information Please Visit - http defcamp http://www.secuobs.com/revue/news/596198.shtmlhttp://www.secuobs.com/revue/news/596198.shtml 2016-01-22 04:47:17 - SecurityTube.Net : Omer Coskun - Ethical Hacker, Royal Dutch Telecom in Bucharest, Romania on November 19th - 20th 2015 at DefCamp For More Information Please Visit - http defcamp http://www.secuobs.com/revue/news/596169.shtmlhttp://www.secuobs.com/revue/news/596169.shtml 2016-01-21 18:32:40 - Global Security Mag Online : Emerson Network Power, entreprise d'Emerson, annonce de nouvelles capacités et la disponibilité de nouveaux modules pour sa plate-forme Trellis , avec Trellis Thermal System Manager, un module complet de gestion et de surveillance de l'environnement qui assure le suivi du profil thermique du datacenter avec des informations détaillées sur chaque matériel La plate-forme Trellis dotée de ces nouvelles fonctionnalités est disponible dans le monde entier C'est la troisième mise à jour majeure du - Produits http://www.secuobs.com/revue/news/596149.shtmlhttp://www.secuobs.com/revue/news/596149.shtml 2016-01-21 17:09:19 - Global Security Mag Online : Dans un récent article, le Canard Enchainé a révélé que le ministère des Transports, désormais intégré au ministère du Développement durable, serait touché par une série d'attaques au ransomware depuis le mois de décembre Matthieu Dierick, Ingénieur avant-vente chez F5 Networks, commente Le problème des ransomwares se développe à grande vitesse Ces derniers sont de plus en plus utilisés par les hackers car ceux-ci ont besoin de plus en plus d'argent et cela de plus en plus souvent Si ceux-ci ne - Malwares http://www.secuobs.com/revue/news/596140.shtmlhttp://www.secuobs.com/revue/news/596140.shtml 2016-01-21 12:41:43 - Help Net Security : Foxglove Security researcher Stephen Breen has demonstrated that you don't need to exploit a 0-day or even a recently discovered vulnerability to gain the highest level of privilege available on a Win http://www.secuobs.com/revue/news/596121.shtmlhttp://www.secuobs.com/revue/news/596121.shtml 2016-01-21 11:44:04 - Global Security Mag Online : Stéphane Iaïch et Jean-Marc Muselli rejoignent le distributeur de services informatiques à valeur ajoutée Exclusive Networks aux postes respectifs de Directeur Marketing Stratégique et Directeur des Services Ils seront sous la direction de Franck Burtin, Directeur Commercial promu Country Manager France Stéphane IAÏCH Directeur Marketing Stratégique Diplômé en Sciences Physique pour l'Ingénieur et détenteur d'un Master in Management Marketing de la SKEMA Business School, Stéphane Iaïch a - Business http://www.secuobs.com/revue/news/596115.shtmlhttp://www.secuobs.com/revue/news/596115.shtml 2016-01-19 16:25:56 - Slashdot Your Rights Online : prisoninmate writes Fedora contributor and NetworkManager developer Lubomir Rintel explains how your devices are being identified on a network by a unique number that most of us know by the name of MAC address Same goes for mobile networking, as your laptop's or mobile phone's MAC address is, in most cases, broadcasted everywhere you go before you even attempt a connection to a wireless network And that's a problem for your privacy The solution Randomization of the MAC address while scanning for Wi-Fi networks Apple is already using this method on iOS 8 and later mobile operating systems, and so is Microsoft in Windows 10, so Linux users will likely get it in the upcoming NetworkManager 12 release IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/595970.shtmlhttp://www.secuobs.com/revue/news/595970.shtml 2016-01-19 15:37:05 - Security Bloggers Network : Few organizations are well prepared when it comes to cyber-attacks Blending statistical research and front-line experience, and with more than 20 industries represented, Radware s new 2015-2016 Global Application Network Security Report reflects this The report outlines findings and analysis from our 2015 industry survey, reflects our Emergency Response Team s ERT in-the-trenches experiences fighting cyber-attacks, http://www.secuobs.com/revue/news/595962.shtmlhttp://www.secuobs.com/revue/news/595962.shtml 2016-01-19 12:03:06 - Global Security Mag Online : Arbor Networks Inc, la division sécurité de NETSCOUT, annonce l'extension de son accord de distribution avec WestconGroup, distributeur à valeur ajoutée de solutions dans les domaines des communications unifiées, des infrastructures réseaux, des datacenters et de la sécurité Les deux sociétés avaient jusque-là conclu un accord portant sur la commercialisation des solutions DDoS d'Arbor Networks en Amérique latine et au Moyen-Orient Cette extension permet à Arbor Networks de développer davantage sa - Business http://www.secuobs.com/revue/news/595934.shtmlhttp://www.secuobs.com/revue/news/595934.shtml 2016-01-19 11:23:53 - Global Security Mag Online : F5 détecte un nouveau malware, Tinbapore, représentant un risque de plusieurs millions de dollars pour les organismes financiers au niveau mondial Découverte par le SOC Security Operating Center de F5 Networks et détectée par les solutions de sécurité F5 WebSafe en novembre 2015, l'attaque Tinbapore représente un risque de plusieurs millions de dollars L'enquête des experts en sécurité de F5 révèle que Tinbapore est une nouvelle variante du malware Tinba qui avait jusqu'ici ciblé les organismes - Malwares http://www.secuobs.com/revue/news/595932.shtmlhttp://www.secuobs.com/revue/news/595932.shtml 2016-01-19 10:03:59 - Global Security Mag Online : Jaguar Network confirme son dynamisme en annonçant une prise de participation majoritaire au capital de RD Medias, un hébergeur spécialisé en technologies Microsoft basé à Marseille À travers cette annonce, Jaguar Network démontre une nouvelle fois sa capacité à créer de la valeur sur un marché extrêmement concurrentiel avec une stratégie de développement de son écosystème reposant sur de solides expertises et bases industrielles Dans le cadre de cette prise de participation, les équipes techniques de - Business http://www.secuobs.com/revue/news/595923.shtmlhttp://www.secuobs.com/revue/news/595923.shtml 2016-01-18 10:29:09 - Help Net Security : Here's an overview of some of last week's most interesting news and articles Wi-Fi and security are better together for SMBs As a small to midsized business SMB , you may be considering or alr http://www.secuobs.com/revue/news/595844.shtmlhttp://www.secuobs.com/revue/news/595844.shtml 2016-01-18 00:13:43 - Slashdot Your Rights Online : An anonymous reader writes with news that the NYPD charged a local television station 36k to view police body camera footage Ars reports As body cams continue to flourish in police departments across the nation, an ongoing debate has ensued about how much, if any, of that footage should be made public under state open-access laws An overlooked twist to that debate, however, has now become front and center How much should the public have to pay for the footage if the police agree to release it News network NY1, a Time Warner Cable News operation, was billed 36,000 by the NYPD for roughly 190 hours of footage it requested under the state's Freedom of Information Law FOIL Now the network is suing PDF the police department in New York state court, complaining that the price tag is too steep The network said the bill runs 'counter to both the public policy of openness underlying FOIL, as well as the purported transparency supposedly fostered by the BWC body worn camera program itself' IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/595812.shtmlhttp://www.secuobs.com/revue/news/595812.shtml 2016-01-14 17:31:54 - mxlab all about anti virus and anti spam : MX Lab, http wwwmxlabeu, started to intercept a new malware distribution campaign by email with the subject Message from local network scanner This email is send from the spoofed addresses and has no body text The attached file Scann16011310150doc filename may vary is a Word file with malicious macro The malware is detected as HEUR high VBATrojan, Trojan W97M MaliciousMacroGEN or heurmacrodownloadcc http://www.secuobs.com/revue/news/595656.shtmlhttp://www.secuobs.com/revue/news/595656.shtml 2016-01-14 16:07:43 - Help Net Security : They might seems small and relatively insignificant, but cheap wireless web cams deployed in houses and offices and connected to home and office networks might just be the perfect way in for attacke http://www.secuobs.com/revue/news/595641.shtmlhttp://www.secuobs.com/revue/news/595641.shtml 2016-01-13 06:13:32 - SecurityTube.Net : Running your own 3G 35G network OpenBSC reloaded Seven years after presenting running your own GSM network , we are back presenting about how to do the same for 3G UMTS HSPA networks Seven years ago, the now famous running your own GSM network talk was held at 25C3, paving the way for a first step into the then-new field of applied research aka hacking into mobile communications research The result of that talk is what is known as OpenBSC Together with its sister-projects OsmoBTS, OsmoPCU, OsmoNITB, OsmoSGSN and OpenGGSN are commonly used to run GSM GPRS networks as a means to perform security research, offensive as well as defensive Now, the team behind those projects has finally started work on supporting 3G base station hardware, extending the scope from 2G 25G 275G technologies towards UMTS, HSDPA and HSUPA The talk will cover what was is required to implement in terms of the protocol stacks, the current status of this work, how it integrates into the Osmo world, how it is envisioned to be usd in mobile security research Like at 25C3, there will also be a demo, of course For More Information Please Visit - https eventscccde category congress 32c3 http://www.secuobs.com/revue/news/595500.shtmlhttp://www.secuobs.com/revue/news/595500.shtml 2016-01-12 09:48:38 - Global Security Mag Online : inet-logistics, fournisseur mondial de solutions de Gestion des Transports en mode SaaS a choisi l'infrastructure de CDNetworks pour améliorer la performance Web de ses applications Le logiciel de TMS Transportation Management Systems d'inet-logistics prévoit, contrôle et optimise tous les processus de Gestion des Transports Tous les acteurs impliqués dans la chaîne d'approvisionnement sont reliés sur une plateforme Web temps réel La performance Web est primordiale car, si elle est faible, elle - Marchés http://www.secuobs.com/revue/news/595418.shtmlhttp://www.secuobs.com/revue/news/595418.shtml 2016-01-10 16:52:06 - Slashdot Your Rights Online : An anonymous reader writes David Chaum, father of many encryption protocols, has revealed a new anonymity network concept called PrivaTegrity Chaum, on who's work the Onion protocol was based, created a new encryption protocol that works as fast as I2P and the Onion-Tor combo, but also has better encryption The only downside, according to an interview, is that he built a backdoor into the darn thing, just to please governments He says that he's not going to use the backdoor unless to unmask crime on the Dark Web Here's the research paper if you can understand anything of it IMAGE IMAGE Share on Google Read more of this story at Slashdot http://www.secuobs.com/revue/news/595273.shtmlhttp://www.secuobs.com/revue/news/595273.shtml 2016-01-08 09:38:05 - Help Net Security : Check Point researchers have discovered a vulnerability in the EZCast TV streaming stick that enables hackers to take full control of home networks EZCast, which has five million users, is a HDMI http://www.secuobs.com/revue/news/595170.shtmlhttp://www.secuobs.com/revue/news/595170.shtml 2016-01-06 21:13:06 - Security Bloggers Network : IMAGE Juniper Networks EX, MX, PTX and QFX devices complete Common Criteria NIAP Certifications --------------------------------------------------------------------- As part of the continuing commitment by Juniper Networks to the Common Criteria National Information Assurance Partnership NIAP certification program, we are pleased to report that EX, MX, PTX , and QFX devices recently completed Common Criteria Certification against the NIAP Network Device Protection Profile --------------------------------------------------------------------- Copyright 1996-2016 Juniper Networks, Inc All rights reserved Update preferences IMAGE IMAGE IMAGE IMAGE submit to reddit IMAGE IMAGE http://www.secuobs.com/revue/news/595017.shtmlhttp://www.secuobs.com/revue/news/595017.shtml