Apps for Security Geeks

Apps for Security Geeks

The proliferation of “Apps” is probably a good thing overal. One of my favorite Apps is “AroundMe”, which does what is says, finds stuf around me when I am out and about. But thats not the subject of this post.

Security apps for the mobile devices is starting to get more sophisiticated. There are a number of Apps available for the different platforms. Since I have an iPhone, I will just mention a few that have come across my path,

I will take the lazy way out and get you the brief description from ITunes of several Apps.

1) Portscan - Security Scanner By Tommy Kammerer
Description: Finally Portscan, the essential network utility is now available for the iPhone and iPod Touch. Portscan allows you to search a network host for open ports/running services. This app uses TCP connect() to scan, because everything else would require root privilege.

2) iPortScan Pro by Whiteside Solutions
Description: It does not feature any network discovery however this tool is useful for sysadmins checking what services are listening on a known system.

3) Nessus App for iPhone
Description: The Nessus App for iPhone is a great way to keep tabs on running Nessus scans, initiate new scans, and quickly review vulnerability scanning results. The app is available for free in the iTunes store and works with Nessus server versions 4.2 or later and the Nessus PerimeterService.

4) Net Pro by Mesh Software
Description: Net Pro is deigned to be the complete mobile solution for all your essential networking utilities.

5) IP Scanner by 10base-T interactive
Description: IP Scanner for iOS uses a suite of probes and scans to ascertain the identities of devices on yoru wireless network.

6) SNMPMon by TTrix Software Design
Description: SNMPmon allows you to monitor SNMP-capable devices. Simple Network Management Protocol (SNMP) is used in network management systems to monitor network-attached devices. SNMP is one of the most widely used, if not the most widely-used network management protocol. Several routers, WiFi access points, switches, printers, ip cameras, ip phones support SNMP. Computers running Windows, MacOSX, Aix, Solaris, HP-UX, Linux, VMware ESX also support SNMP but usually the service needs to be configured and enabled.

7) Snap by 9Bit Labs
Description: Do you ever wonder what else is on the network with your iPhone? Now you can easily find out with Snap! Snap quickly scans the network around your phone and discovers nearby servers, routers, even other iPhones! When Snap finds a device, it shows you the manufacturer of the device, any name information it could discover from the device, as well as the device’s MAC and IP addresses. For each device that Snap finds, you can also scan it for common services such as HTTP, remote login, AppleTalk, Microsoft networking, and many others. It even links directly to Safari for any HTTP services it finds, enabling you to easily explore devices on the network around you.

8. ) Wfi Network Scanner by Goonbee
Ever wondered who was using your home wifi network? Was maybe someone stealing it? Ever needed to know the IP address of a machine on it? Or perhaps the MAC address? Or maybe you were just curious whose computer in your house was swiched on? Perhaps you wanted to test the connection latency to each machine to diagnose network problems? Well wonder no more and get Wifi Scanner.

9) iNetwork Mapper By Foo-Bang Chan
Description: A simple yet comprehensive and sophisticated network security, administration and analysis tools that assist you (system or network administrator, security professional or security penetration tester and security passion engineer) in discovering,fingerprinting, analysing and assess systems surrounding your networks.

10) WPA Tester by Paolo Arduin
Description: WPA Tester is a useful application that allows you to test the security of your home Wi-Fi. If you left the default settings on your private line, WPA Tester will test the actual security, creating the possible default passwords. If your default password is one of those found by the application, you should get into the router settings and enter a personal password in order to prevent attackers can abuse your internet connection!

Of course there are many more out there. This initial list might be a bit to easy and simple, but… If you use Cyndia http://cydia.saurik.com/ and Jailbreak, you can get more complex tools. Some others you can look into include WLAN Audit, Wfi Analyzer, Pirni and iWep Pro. This is an interesting start to the toolkit.



Hackathon Evolution

Published by Adminkraa2 on November 7th, 2011 - in Could Computing, Hacking, Hacking News

The original meaning of hacker was positive. When IT staff and programmers were working with mainframe computers and the first programming languages, they had to “hack” the current systems to make them work better. Both software and hardware hacks were necessary.  But anything can be taken to the nth degree.  Hackers evolved into the attackers and nefarious types.

But what has been interesting over the past several years is the continuing evolution of hackers. Take for example the “Anonymous” group. Some would say they are Hacktivists doing some social justice but if you ask Sony or Mastercard, they would say “Anonymous” was a group of attackers put to destroy the corporate world. The same can be said for Wikileaks. The companies and governments who lost data to Wikileaks would call Julian Asange a bad guy but there was talk of him up for the Nobel Peace Prize  (http://abcnews.go.com/Politics/wikileaks-julian-assange-nominated-nobel-peace-prize/story?id=12825383)

The continuing evolution of Hacker has started to back to a positive reference. We are seeing a lot of Hackathons that are geared at positive results, creating new tools and software and changing the way the world works.  This week at TechCruch Disrupt (http://techcrunch.com/disrupt/),  the Hackathon brings together people worldwide to create something new.

Another positive force is the Hackathon for Occupy Wall Street,  (http://mashable.com/2011/10/19/occupy-wall-street-hackathons-2/) As the article says “Groups of programmers gathered in three cities this weekend to build digital tools for the Occupy Wall Street movement. Several of those tools have already launched, and in many cases they’re being maintained by activists who’ve never held a sign in a park.”

I hope this type of hacking continues and we see changes for the better out of these types of Hackathons.

Gary Bahadur

KRAA Security

www.kraasecurity.com

 



Convergence of Mobile and Social with Google acquisition of Motorola Mobility

Published by Adminkraa2 on August 15th, 2011 - in App Security, Mobile Security, Mobility

On Monday Goolgle came out with another acquisition, but not in the social media sphere this time. Google is acquiring the smartphone maker Motorola Mobility for $12.5 billion in cash. That’s a 64% premium over the stock price. That’s a lot of valuable minutes! See the article here http://www.huffingtonpost.com/2011/08/15/google-motorola-mobility_n_926923.html  A key part of their press release was “The acquisition of Motorola Mobility, a dedicated Android partner, will enable Google to supercharge the Android ecosystem and will enhance competition in mobile computing. Motorola Mobility will remain a licensee of Android and Android will remain open. Google will run Motorola Mobility as a separate business.” This greatly expands the patent portfolio of Google as well, Motorola Mobility holds approximately 14,600 granted patents and 6,700 pending patent applications.

The next step in the evolution of the social web really is on the mobile device. It seems as if every company that has a web application and website is now porting everything to the mobile device. With the apps for iOS, Andriod and WebOS, they availability is use apps covers just about everyone. With this purchase of Motorola Mobility, Google is setting up more vertical integration of the app development process. As they say, they will keep the Andriod platform open, and we should be able to count on that from Google. As Andy Rubin, Senior Vice President of Mobile at Google, said, “We expect that this combination will enable us to break new ground for the Android ecosystem. However, our vision for Android is unchanged and Google remains firmly committed to Android as an open platform and a vibrant open source community. We will continue to work with all of our valued Android partners to develop and distribute innovative Android-powered devices.”

As companies move into the mobile space, there a number of threats that they will probably never have seen before. Are they prepared for a different threat landscape that is not the traditional things like virus’, malware and worms? Make no mistake, these traditional threats are occurring in mobile, but the new ones will be just as great. A key part of the new risk model for mobile is the data being ported between the social web applications and your phone. The Motorola Mobility platform if going to more integrated with Google we can expect, but this may just open your data to hackers through a different platform that does not have a 20 year history of address security threats.

Some of the key threats to mobile we can expect include:

  1. Social network data theft, leveraging your mobile applications to steal data through poor coding techniques
  2. Trojans applications, pretending to be legitimate applications that can steal data
  3. Man in the middle attacks, using the mobile application to launch further attacks and stay disguised
  4. In-app theft, using installed apps to break into your connected bank accounts or PayPal accounts

We do not know what the future holds for the Motorola Mobility purchase by Google, but I think we can safely assume the Google stock price will rise!

Gary Bahadur

CEO KRAA Security

www.kraasecurity.com


Whats hot in hacking this month?

Hacked websites are popping up everywhere

Its been a pretty exciting month for hacking. We are getting news of some new hacked site every other day. And these are not small inconsequential sites for the most part. Here are a couple you may not have come across.

News: THE CRAZIES Hackers Leaks Server Certificates of Defense Information Systems Agency (DISA)
What happened: HE CRAZIES Hackers steal the Several Certificate revocation lists (CRLs) from Server of Defense Information Systems Agency (DISA) – http://disa.mil/ and leak the Certificates at :

http://www.mediafire.com/?dvli58a9logojld

http://www.mediafire.com/?k8z168aazj6s1k8

Impact: To be determined

News: EC-Council Academy Hacked by GaySec (Malaysian hackers)
What happened: The server hosting the EC-Ccouncil Academy (Not the Ec-Council!) was rooted.
Impact: Not important enough to matter.

News: Pakistani Website Songs.pk Hacked By Indian Hackers In Response To The 2011 Mumbai Bomb Blast
What Happened: The attack seems to be in retaliation for the recent Mumbai bomb blasts.
Impact: No real impact

News: Pentagon Admits 24,000 Files Were Hacked, Declares Cyberspace A Theater Of War
What happened: The Pentagon admits that a “foreign intelligence service” stole 24,000 Defense Department files.
Impact: We will probably never know

News:  Hacking collective redirect Sun website to fake story claiming Rupert Murdoch had been found dead – before redirecting site to the LulzSec Twitter accoun
What Happened: The group LulzSec hacked the website and redirected it to a fake story.
Impact: Rupert Murdoch is not dead.

hacked sun website

News:  School District’s Website Hacked, Conroe Independent School District Investigating Incident
What happened: Hacker broken into the website of the largest school district in Texas. It is unclear of student data was stolen.
Impact: Changed grades?

News:  Lady Gaga website hacked
What happened: The hackers were able to break into the British website wand download names and email addresses.
Impact: Little Monsters will be getting an extra dose of spam.

News:  PBS website hacked for second time in a month
What happened: PBS said the hacked revealed “a very small number” of PBS employees’ user names and encrypted passwords. Well those passwords could not have been that well encrypted.
Impact: Donations for new security tools?

 

Gary Bahadur
www.kraasecurity.com
www.razient.com
Social Media Security
Website Security Testing
Vulnerability Analysis
HIPAA Security Assessment

How to run a Startup company on $5 a day (sort of)

Starting a company is not for the weak kneed. It takes a lot of ambition, hopefully a good idea, maybe a dash of luck and a buyer. Maybe you are launching a new mobile app for the iPhone, IPad, and Android and just about any other mobile platform out there. So your new startup company will sell mobile applications. But what else goes into starting this company? You need a website to promote your application. You need to send out press releases. You need to design a logo. You need to so some social media marketing. And about a hundred other things.

Startup Challenge
The challenge is doing all of this on a budget. You do not even know if you will make money so putting a lot of money into upfront costs might not be feasible. I have faced these same challenges in the several companies I have worked on. But the wonderful thing about this whole “cloud economy” me we are living in is that there is a site that can help you with just about everything you need, and for a reasonable price.

When I someone told me about Fiverr (www.fiverr.com) I thought it was pretty funny idea. What will people do for $5? I thought about what I would do for $5 and the list is probably too long for this post and might scare the faint of heart. My first foray into the site was fun. You can have a guy dance around in gorilla costume for $5.

startup company fiverr

Or you can have a guy scream like a psychopath. I am sure someone will find that valuable.

 

startup company fiverr

startup company with fiverr

 

 

But as you delve into www.Fiverr.com there are a lot of great services for $5. (Btw, I have no other interest in Fiverr other than I think it’s a great service.)  You can have some write your press release and have someone else distribute it to 10 press release sites for $5 each. It would take at least 30 minutes to write a good press release and another 30 to distribute it to multiple sites. So $10 for an hour of work is probably not a bad deal.

Fiverr press release distribution

You can find some very valuable services in just about every area you need to build your business. For a limited budget, its a pretty good start.

There are some other great sites you can use to get your company off the ground including Odesk (www.odesk.com), Elance (www.elance.com), Guru (www.guru.com) and TenBux (www.tenbux.com) among others. Save your money where you can when starting a company and good luck!

Gary Bahadur

www.kraasecurity.com

www.razient.com

Social Media Security

Website Security Testing

Vulnerability Analysis

HIPAA Security Assessment

 

Enhanced by Zemanta


Citibank Data Security Breach

Recently Citibank announced that they were hacked, a typical data breach. See the International Business Times article here, http://www.ibtimes.com/articles/160376/20110609/hacking-citibank-citibank-hacked-citi-hacked-citibank-hack-2011-citibank-online.htm. Were they not conducting vulnerability tests on their own system to see if they were vulnerabile? The comes on the heels of Sega, Sony, Lockheed Martin amongst others. So far they only report that 360,000 cards were compromised. We can assume that those customers, if they actually know which accounts were compromised will get 2 years of credit monitoring. But what happens when you actually get false charges? You now have to go spend time to resolve the problems and most likely you might take a hit to your credit score.

Its amazing that this continues to happen and there isn’t a stronger tie between the credit reporting agencies and the hacked banks to help consumer manage their credit and not be responsible to follow up on a data loss. The consumer is the one who has to bear all the burden. And the banks will probably just add another fee to cover their costs to managing the security breach.

These banks should really be more proactive in conducting vulnerability scans daily, conducting website security testing and implement intrusion detection and prevention systems. We do not know if Citibank had a IDS system in ploace but you would think that with a good prevention system in place, this hack should have been immediately identified and stoped before the data breach could occur?

Gary Bahadur

www.kraasecurity.com

Social Media Security

Website Security Testing

Security Policy Development

 

Enhanced by Zemanta

Google Me on the Web, is it any good?

Google has a new feature in their dashboard, “Me on the Web“. The pitch is that it will help your protect your identity.  The Huffington Post did a write up of it here, http://www.huffingtonpost.com/2011/06/16/google-me-on-the-web_n_877996.html Google ‘Me On The Web’ Tool Promises To Help You Manage Your Online Identity. “Your online identity is determined not only by what you post, but also by what others post about you — whether a mention in a blog post, a photo tag or a reply to a public status update,” Google explained in a blog post. But what is it really all about?

At first glance it seems to be just an interface to Google Alerts (www.google.com/alerts).  I use google alerts for all kinds of key word searches, (my name included). In this screen shot you can see what the interface looks like for Me on the Web

Google me on the web

Nothing terrible exciting here. The advice they give you about managing your online reputation is particularly bland. “If you find content online–say, your telephone number or an embarrassing photo of you–that you don’t want to appear online, first determine whether you or someone else controls the content. For example, if the photo you want to hide is part of your Picasa account, you can simply change your photo visibility settings If, however, the unwanted content resides on a site or page you don’t control, you can follow our tips on removing personal information from the web and removing a page from Google’s search results

There really isnt anything proactive or defensive about this “new tool”. But setting up appropriate alerts is definitely a must in the online world.

For some really intersting tracking of online activity, check out SocialMention.com

Gary Bahadur

CEO KRAA Security

www.kraasecurity.com

Social Media Security

Network Risk Assessment

New book coming soon “Securing the Clicks: Network Security in the age of Social Media” http://www.amazon.com/Securing-Clicks-Network-Security-Social/dp/0071769056/ref=sr_1_1?ie=UTF8&s=books&qid=1308343778&sr=8-1

 

Enhanced by Zemanta


Ignorance is far from bliss with a Global Supply Chain

In this time of global financial insecurity, large scale companies are stretching further and further across the planet in order to reduce costs and remain competitive. But this strategy brings with it risks. The pressure on a global company’s supply chain is simply immense, with operations stretching across whole continents and handfuls of countries, variables are introduced that can be incredibly hard to track. A company need a global supply chain risk management process.

With supply chain infrastructures running the length of the planet, how is it possible for a company to know what is happening at any given time and at any given point within its chain? A supply chain is only as strong as its weakest link, and in this fragile economic state, global operations rely on their supply chain management to bring together all the disparate elements into a smooth churning synergy. But how does a company’s supply chain cope with all the challenges that these variables produce?

Global companies face challenges on all fronts regarding the pressures of supply chain on an international scale. With head offices say in New York, and a production arm in China or Pakistan, the most obvious challenge faced by a global company is one of distance. But what specific challenges does this kind of distance throw up?

Like a fog, distance can cloud vision, and block out or at the least delay information – and to a supply chain, information is money. A global company, with its head offices in the West, is going to be unaware, at least for a time, of the state of its supply chain in the event of localised flooding or civil unrest. The supply chain may not even be aware that the issue even exists until severe damage has been caused. Even if the factory was untouched by such a disaster, what about the infrastructure – roads, airports and harbours? Large scale emergencies create questions and uncertainty for those on the ground, never mind those in large corner offices in Manhattan.

The problem is not just limited to natural disasters or weather systems. Civil and political unrest can cause chaos to even a healthy supply chain. Then there are epidemics and pandemics, such as the H1N1 flu, which have the potential to grind a whole economy to a sudden and shuddering halt. These situations can cause utter chaos to those present, but the real danger to a global companies supply chain is more subtle than this chaos… it is ignorance.

Ignorance to a crisis is the arch enemy to a supply chain. It may be a cliché but it is true – knowledge is power, or in this case, money – and even the most solid supply chain can crumble through nothing more than a little ignorance. Even if contingency plans were made, the delay in being aware enough of the crisis to implement the contingency can cause severe flow problems.

To an extent, these challenges can all be overcome or circumvented by good planning and a world class supply chain management system but only if they are aware of the crisis. It is this knowledge gap – between the event happening, and feedback working its way all the way across the planet to head office, that can make or break a company’s financial position. It is not the event itself, cataclysmic as it may be, but it is ignorance to the event that is the killer for supply chain. How can you overcome a challenge that you are blind to?

The secondary challenge faced by a global operations supply chain management is one of local knowledge and experience. Civil and political unrest, for example, can seem to strike as suddenly and as unexpectedly as forked lightening to the outsider. Yet to those who live on the inside of that country, the sense of radical change or shift in power can almost be sensed. There is something about being on the inside that gives one the ability to more accurately predict, and therefore to prepare for this kind of change.

It is this preparation that is key to the success of any supply chain. Sensing and predicting the event or crisis, allows for contingency plans to be drawn up and/or implemented. These are essential for the reduction of downtime, and for shipping dates to be met. Contingency plans, if acted upon swiftly enough, can really protect the integrity of the supply chain. The key to this swift acting, once again, is information. Factories in neighbouring countries can be actively tooling up as the sense of political unrest grows in another, with one factory primed to take over as soon as trouble rears its ugly head.

Of course, not everything can be predicted, and some events, such as the recent volcanic ash cloud over Europe, can catch everyone by surprise. But the majority of incidents, problems and challenges faced by the supply chain of any global company can be pre-empted, predicted and planned for. But a contingency plan is only as strong and useful as the information that brings about its implementation. It is this information that will determine the success of a supply chain management system when disaster strikes, as it surely will, given enough time.

 

Enhanced by Zemanta

Pleasant Grove man sentenced to 6 years in federal prison for role in prescription fraud case

The Birmingham news (http://blog.al.com/spotnews/2011/05/pleasant_grove_man_sentenced_t.html)  reported that a Pleasant Grove man received six years in prison for HIPAA violations. Included in his crimes was aggravated identity theft and disclosures. These violate the HIPAA regulations.

Identity theft with regards to healthcare information is on the rise. There is a lot of value in stealing an identity to get healthcare. If you could do that for someone under 18, then you might have several years before they actually notice. Kids generally do not need to check their credit ratings until they get that first credit card in college. BY then the thief could have racked up a lot of charges on that identity.

Using healthcare access can allow the thief access to drugs which are then resold. In this case the thief used the stolen identity to cause the prescription drug plan to pay for $72,746 in drugs.

The Obama Administration announced a cyber security plan recently. Does it take into account the rise in identity theft? Are government agencies actively trying to find solutions? So far the answer seems to be No.

Regards

Gary Bahadur

www.kraasecurity.com

blog.kraasecrity.com

Enhanced by Zemanta

Whitehouse has released a cybersecurity plan

Seal of the United States Department of Homela...

Image via Wikipedia

The Whitehouse has release a cybersecurity plan.  “White House Cybersecurity Plan: What You Need To Know” (http://www.huffingtonpost.com/2011/05/12/white-houses-cybersecurity-plan_n_861382.html). Perhaps the administration is finally waking up to the need.

According to the press release they say  “Our critical infrastructure – such as the electricity grid, financial sector, and transportation networks that sustain our way of life – have suffered repeated cyber intrusions, and cyber crime has increased dramatically over the last decade. The President has thus made cybersecurity an Administration priority. When the President released his Cyberspace Policy Review almost two years ago, he declared that the “cyber threat is one of the most serious economic and national security challenges we face as a nation.” The Administration has since taken significant steps to better protect America against cyber threats. As part of that work, it has become clear that our Nation cannot fully defend against these threats unless certain parts of cybersecurity law are updated.”

There are a couple of key elements to the proposed legislation:

Protecting the American People

  1. National Data Breach Reporting. Proposal to help businesses by simplifying and standardizing the existing patchwork of 47 state laws that contain these requirements. (I personally do not think we will have 1 national privacy policy anytime soon. States rights!!)
  2. Penalties for Computer Criminals. Clarifies the penalties for computer crimes, synchronizes them with other crimes, and sets mandatory minimums for cyber intrusions into critical infrastructure

Protecting our Nation’s Critical Infrastructure

  1. Voluntary Government Assistance to Industry, States, and Local Government. Proposal to enable DHS to quickly help a private-sector company, state, or local government in a breach
  2. Voluntary Information Sharing with Industry, States, and Local Government.  Proposal to help entities share information. ( Sure ATT will share information with Sprint and Bank of America will share information with the government)
  3. Critical Infrastructure Cybersecurity Plans. Proposal to enable transparency to help market forces ensure that critical-infrastructure operators are accountable for their cybersecurity.(Thats way to vague)

Protecting Federal Government Computers and Networks

  1. Management. Update the Federal Information Security Management Act (FISMA) and formalize DHS’ current role in managing cybersecurity for the Federal Government’s civilian computers and networks. (They definitely need this now!).
  2. Personnel. Recruit and retain highly-qualified cybersecurity professionals. (With reduced funding for education, we will probably have to recruit from China)
  3. Intrusion Prevention Systems. Implement better IDS systems. (Imagine having to read all the log files from all the government agencies, need to outsource this effort)
  4. Data Centers. Embrace Cloud Computing. (if you use cloud computing, you will rely on Facebook for your security requirements?)

New Framework to Protect Individuals’ Privacy and Civil Liberties

The Administration does propose protecting civil liberties. Can the plan be any worse that everyone giving away all their information anyway on Facebook, Twitter, LinkedIn etc?

Enhanced by Zemanta

© 2011 KRAA Security LLC