TPM – Jupiter Broadcasting

Microsoft Corp’s secret internal database for tracking bugs in its own software was broken into by a highly sophisticated hacking group more than four years ago, according to five former employees, in only the second known breach of such a corporate database.
The company did not disclose the extent of the attack to the public or its customers after its discovery in 2013, but the five former employees described it to Reuters in separate interviews. Microsoft declined to discuss the incident.

How I Socially Engineer Myself Into High Security Facilities

A few months ago, a client had hired me to test two of their facilities. A manufacturing plant, plus data center and office building nearby.
I scour profiles of employees who work at these facilities, and cross-reference them to other social media sites.
This is not an advanced investigation. I’m not a private investigator and I don’t have the resources of the NSA. But I can do a lot of damage with simple methods.
X could have saved the company a lot of heartache by simply verifying that I was who I claimed to be.
I’ve been doing this job for a couple years now, and almost every job is a variant of this story. Very rarely do I go through an entire assessment without some sort of social engineering.

Crippling crypto weakness opens millions of smartcards to cloning

Yubico not aware of any security breaches due to this issue

Millions of smartcards in use by banks and large corporations for more than a decade have been found to be vulnerable to a crippling cryptographic attack. That vulnerability allows hackers to bypass a wide range of protections, including data encryption and two-factor authentication.

At this time, we are not aware of any security breaches due to this issue. We are committed to always improving how we protect our customers and continuously invest in making our products even more secure.

Feedback

Workaround for the WPA2 exploit – from Jonathan
SNAPs for… Windows?
Server Layout for Linux System with LXC – There is an interesting project kind of related to this idea called CloudABI – CloudABI for FreeBSD
IT Land before time COMPUTERS THAT NEVER WERE Software Emulator for the Cardboard Illustrative Aid to Computationn

Round Up:

The post Cloudy with a chance of ABI | TechSNAP 342 first appeared on Jupiter Broadcasting.

Tales from the TrueCrypt | TechSNAP 164

chris — Thu, 29 May 2014 20:29:34 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The TrueCrypt project has shut down, and we’ll run down what we think is the most likely answer to this sudden mystery is.

Plus the good news for openSSL, the top 10 Windows configuration mistakes, and big batch of your questions, our answers, and much much more!

Thanks to:

Direct Download:

RSS Feeds:

— Show Notes: —

TrueCrypt shuts down unexpectedly

TrueCrypt is a cross-platform image or whole disk encryption system
The website for TrueCrypt changed yesterday, stating that “it may contain unfixed security issues”
The page states now that Windows XP is EOL and all supported versions of Windows support ‘BitLocker’ disk encryption, TrueCrypt is no longer necessary
The website provides information about transitioning data from TrueCrypt to the OS disk encryption system for various different OSs
The website has been updated with version 7.2 of TrueCrypt, which only allows the user to decrypt their files, not encrypt any new files
This was originally thought to be a hack of the site, or a hoax
The new binary is signed with the correct key, the same as previous versions of TrueCrypt, suggesting that this post is legitimate
While the code is available, the license is restrictive
The developers of TrueCrypt are anonymous
GIST tracking various bits of information and speculating about possible causes
ThreatPost coverage
One of the suspicious things about the announcement is the recommendation to use BitLocker, the authors of TrueCrypt had previously expressed concerns about how BitLocker stores the secret keys in the TPM (Trusted Platform Module), which may also allow the NSA to access the secret key
There is some speculation that this could be a ‘warrant canary’, the authors’ way to telling the public that they were forced to do something to TrueCrypt, or divulge something about TrueCrypt
However, it is more likely that the developers just no longer have an interest in maintaining TrueCrypt
The last major version release was 3 years ago, and the most recent release before the announcement was over a year ago. An actively developed project would likely have had at least some maintenance releases in that time
The code for TrueCrypt was being audited after a crowdfunding effort. The first phase of the audit found no obvious backdoors, but the actual cryptography had not been analyzed yet.
Additional Coverage – Krebs On Security

Core Infrastructure Initiative provides OpenSSL with 2 full time developers and funds a security audit

The CII has announced its Advisory board and the list of projects it is going to support
Advisory Board members include:
longtime Linux kernel developer and open source advocate Alan Cox
Matt Green of Open Crypto Audit Project
Dan Meredith of the Radio Free Asia’s Open Technology Fund
Eben Moglen of Software Freedom Law Center
Bruce Schneier of the Berkman Center for Internet & Society at Harvard Law School
Eric Sears of the MacArthur Foundation
Ted T’so of Google and the Linux kernel community
Projects identified as core infrastructure:
Network Time Protocol
OpenSSH
OpenSSL
Open Crypto Audit Project to conduct security audit of OpenSSL
The security audit will be difficult due to the lack of a consistent style in the code and the maze of ifdef and ifndef segments
the OCAP (Open Crypto Audit Project) team, which includes Johns Hopkins professor and cryptographer Matthew Green and Kenn White, will now have the money to fund an audit of OpenSSL
OCAP was originally created by a crowdfunded project to audit TrueCrypt

The top 10 windows server security misconfigurations

NCCGroup does what it calls ‘Build Surveys’, where they check production environments to ensure they are configured properly
The following is the result of an analysis of their last 50 such surveys:
- Missing Microsoft Patches: 82%
- Insufficient Auditing: 50%
- Third-Party Software Updates: 48%
- Weak Password Policy: 38%
- UAC Disabled for Administrator Account: 34%
- Disabled Host-Based Firewall: 34%
- Clear Text Passwords and Other Sensitive Information: 24%
- Account Lockout Disabled: 20%
- Out-of-Date Virus Definitions: 18%
- No Antivirus Installed: 12%
Conclusions: Everyone makes the same mistakes, over and over
Most of these problems are trivial to fix
Part of the problem is this culture of ‘patch averseness’, partly this is the fault of software vendors often issuing patches that break more things than they fix, but in general Microsoft has actually done a good job of ensuring their patches apply smoothly and do not break things
Part of this is the fact that they only issue updates once a month, and only once they have been tested
In the study, most of the machines that were missing patches, were missing patches that were more than a year old, so it isn’t just conservatism, but just a complete lack of proper patch management

Feedback:

Round-Up:

The post Tales from the TrueCrypt | TechSNAP 164 first appeared on Jupiter Broadcasting.