A friend sent me this about E-mail Security

The true state of security 🙂

So a friend sent this to me awhile ago. I figured it would be great for the New Year

They say a picture is worth a thousand words.

Advertisement

A non-deceptive SE event

Ok, So listening to the latest Social Engineer Podcast   http://www.social-engineer.org  I realized I needed/forgot to write in about a non-deceptive SE event.

 I had won some license plate holders at Ohio Linuxfest a many years ago. So I went to put them on and the screw broke. I went to a local dealer asked if they could put them on. They, like all good dealers said “Sure! $30 each plate.” $60 total is a lot so I started thinking. I ask the manger if he was really going to charge me $60 to remove the advertizing of a competitor? His answer was “Would you like a car wash with this complimentary service?”

The data they collected is at http://www.social-engineer.org/polls/social-engineering-and-deception-whats-the-truth/

Why Phish? Just invite!

Garage Sale on Craigslist

 

So I love garage sales as much or maybe more than the next person but this scares me. “We’ll be taking cash or Paypal. (To use Paypal you have to pay on site using my laptop and the transaction would have to clear before you leave. This means no E-check transactions.)” I don’t think the person is planning anything bad but, what if their computer is infected? Now everyone’s usernames and passwords have been exposed. Or what if an evil garage sale shopper has a USB Hacksaw with them and infects the computer? 

I have to run grarge sales are waiting…. 

http://cleveland.craigslist.org/gms/1764370329.html

AlmondJoy Cheesecake

Hi,
I know this isn’t what you’d expect me to Post but, here it is:

Almond Joy Cheesecake (TM I’m pretty sure.)
Special Thanks to Steven Soto.

(2)  8 oz cream cheese
½ cup  of sugar
(2) eggs
½ teaspoon of almond extract
1 cup  of shredded coconut
1 cup  of chocolate chips
1 Already  prepared  graham cracker pie . Or Chocolate pie crust.
Ice cream Magic chocolate shell .

Pre-heat oven to  350.

First blend the cream cheese, sugar, eggs and extract Till smooth. Next add the coconut and  chocolate chips.

Then pour into  the pie crust. And bake for 40 mins. 
Then let cool. pour the magic shell over and chill in the fridge.

Enjoy

Shmoocon Paper Accepted

I’m speaking at Shmoocon. 

Check out Version 1 launcher video’s at : http://www.youtube.com/user/securidave

 

http://www.shmoocon.org/presentations-all.html

 (Mad Props to Larry. I never would have done if he didn’t ask me or write cfp.)

Building the 2008 and 2009 ShmooBall Launchers

Larry Pesce and David Lauer

Its a series of tubes! Pneumatic tubes!

This talk will describe the infamous 2008 and new 2009 ShmooBall Launchers built by Larry, and introduce Dave’s 2009 design. This talk will include all of the steps behind the planning and building process for our launchers, as well as the history, and backgrounds for the design. We’ll talk about the methods of building, safety considerations for the operator, target and environment, selection of building materials, design considerations and testing. We’ll also discuss some of the construction issues, failures and reasons for what may be considered design flaws. Discussion will also be had about improvements made, and how we can improve for next year.

Larry Pesce (Chief Research Officer, PaulDotCom Enterprises) – In the last 13 years in the computer industry, Larry has become a jack of all trades, most recently focused on the computer security field. In addition to his industry experience, Larry is also a Security Evangelist and co-host for the PaulDotCom Security Weekly podcast at http://www.pauldotcom.com. Larry is also Co-Author of “Linksys WRT54G Ultimate Hacking” and Contributing author of “Using Wireshark and Ethereal” and “How to cheat at configuring Open Source Security Tools”, all from Syngress publishing.

David Lauer has been involved in the computer industry since 1990. His broad background covers a large part of the IT industry. He began his career in programming and database development before he found his calling in networking and security (where his professional strengths and personal preferences mesh seamlessly). He has found that this knowledge of software development and database design often gives him a unique perspective on day-to-day issues. David is also a Co-Host of the SecurityJustice Podcast.

My BlackBerry Storm Review

Well I’ve had my Blackberry Storm for a few weeks now and I have a few tips to make it work better. I said “Better.”

1. Install the Blackberry Update that they released about a week after they started selling the Storm. This makes the phone act more like a Beta version.

2. Under the Options menu, Keyboard/screen set the font size to 10. This increases the size of the menus and other buttons. So if you have big hands/paws like me it’s easier to select the button you really want.

3. Remove the Blackberry Messenger. You need to uninstall it. This is one of the apps that Blackberry always keeps open for you so you have faster access to it. 

4. Close the apps your not using. A real pain, I know.

5. Don’t forget about rebooting the unit every now and then. I mean pull the battery for a good minute.

So even with these changes I still get it to crash and burn. (Just use the camera, video and playback.)

BlackBerry Storm Crashed again, and again.

Physical Security in MDF,IDF, and Phone rooms

Physical Security in MDF,IDF, and Phone rooms

All the companies that I’ve worked for have had the policy of “Never leave unauthorized people alone in the MDF’s, IDF’s , and the phone room’s. “ That being said, over the past year or so I’ve been talking to Phone Guy’s/Gal’s and such that have come to do work in these “sensitive areas.”

I asked them “How many companies require someone be with them? The answer is about half. That doesn’t seem very good. So then I start asking about the people that hang out with them. It seems that again only about half are computer and/or phone people. It seems odd that you would put a guard on the worker that doesn’t know anything about phones and computers.

Stupidity in strange places

I just took my car in for repair at the dealer for some warranty work. My dealership does a lot of on-line stuff. They even have an open wireless network and workstations to use while waiting for car work to be done. So I received the following E-mail from them:

Customer No. #######
Your vehicle is complete and ready for pick up. Please look over the
attached invoice and call with any questions. If the invoice is correct,
you can reply with a credit card number and expiration date. I will run
the credit card number to help speed up the delivery process.
Thank You for Your Business. Jane Doe ###-###-#### ext ###

The biggest issue is the word “Reply” there is no link in the E-mail to go to a secure payment page. Have you ever looked over a dealership invoice? There is a lot of personal information on it about you and your car.

So I went to the dealership and talked to the manager. I was very happy that he listened to me and sent out some e-mails. The first was to stop using above text on invoices. The second was to ask his internal people if I was correct and what is PCI. Does anyone know if this would break PCI compliance?

Yahoo Spam?

I’ve been wondering why is Yahoo Spam so much worse than Google’s Spam. I mean worse in the quantity of E-mails not their content. So this morning I think I figured it out. It’s all about the cash.

From their site:

Mail Plus
Get personalized spam filtering with SpamGuard Plus, 20MB message size, no graphical ads, POP access and forwarding, and more great features for just $19.99/year – that’s less than $2/month.

I feel better knowing that the it is not the poor choice of spam blocking software that Yahoo choose to implement but rather that they want to earn money.

Updates, Updates, Updates, What about your PDA?

This last week everyone has been running around saying “Patch this, update that!” But what about your PDA? I’ve been having issues with my PDA so I updated the OS and then went and found all the apps I had installed to re-install. (I know I could have backed them up but I wasn’t sure if the problem wasn’t caused but an app. ) I was amazed at home many updates where made to each of apps.

The moral is to remember the little machines need updates too.

P.S My dad updated his router and made his Internet connection slower so careful with what you update.