Wednesday, July 25, 2007

Black Hat Researchers: Forensics software can be hacked

It is a big war in court, with every side trying to attack the tools of the other side. Therefore, individual expertise is very important. You can not just say "the flawless program gave these results" if no program is flawless, but you have to prove your opinion, and in simple terms!
The software that police and enterprise security teams use to investigate wrongdoing on computers is not as secure as it should be, according to researchers with Isec Partners Inc.

The San Francisco security company has spent the past six months investigating two forensic investigation programs, Guidance Software Inc.'s EnCase, and an open-source product called The Sleuth Kit. They have discovered about a dozen bugs that could be used to crash the programs or possibly even install unauthorized software on an investigator's machine, according to Alex Stamos, a researcher and founding partner with Isec Partners.
 blog it


"The big risk is for someone to execute arbitrary code," he said "If there's a risk that the evidence has been compromised or if something has been planted by a third party... then you can call into question the accuracy of the software and possibly get it thrown out."

Butterworth, who has been grilled many times by defense lawyers, agreed. "I wouldn't put anything past a defense attorney ," he said.
Posted by at No comments:

Tuesday, July 24, 2007

Free security tool ferrets out unpatched software

useful stuff, not clear how to use it for business
A Danish security vendor is offering a free tool designed to inform users when their applications need patching.

Secunia APS has made the beta version of its Personal Software Inspector available for download.

A client program, Personal Software Inspector periodically checks to see if new updates have been issued for some 4,200 applications.
Once it is installed on a user's PC, it inventories the computer's software and versions and classifies programs as "insecure," "end-of-life" or "up-to-date." When a patch is issued for a program on a user's computer, Personal Software Inspector displays a pop-up window in the lower right-hand corner of the screen, said Thomas Kristensen, Secunia's chief technology officer. Another panel provides a download link for the patch.
 blog it
Posted by at No comments:

Thursday, July 19, 2007

FTester - Firewall Tester and IDS Testing tool

clipped from www.darknet.org.uk

The Firewall Tester (FTester) is a tool designed for testing firewalls filtering policies and Intrusion Detection System (IDS) capabilities.

The tool consists of two perl scripts, a packet injector (ftest) and the listening sniffer (ftestd). The first script injects custom packets, defined in ftest.conf, with a signature in the data part while the sniffer listens for such marked packets.
 blog it
Posted by at No comments:

Tuesday, June 26, 2007

Security start-up Untangle goes open-source

One can add this to the portfolio of security services
clipped from news.zdnet.com
Untangle, a start-up that sells software for network security equipment, is making its core product open-source on Tuesday.


The company already uses a variety of open-source software projects, including the SpamAssassin spam-screening software, the Snort software that detects some network intruders and the ClamAV software that can help block "phishing" attacks that direct users to bogus Web sites. Now Untangle is adding its own framework to the mix, software that handles chores such as network management, software updates, security policy settings and processing of network traffic.

 blog it
Posted by at No comments:

Thursday, June 21, 2007

Forensics in Houston (litsupport)

Forensic Data Retrieval in Houston

Posted by: "enordstr" ecnordstrom@gmail.com enordstr

Wed Jun 20, 2007 5:43 pm (PST)

Does anyone have a recommendation of a good electronic discovery /
forensic data retrieval outfit in Houston?

3b.

Re: Forensic Data Retrieval in Houston

Posted by: "Omar Cherry" omartyre@yahoo.com omartyre

Wed Jun 20, 2007 8:39 pm (PST)

SysInformation Inc.
2620 Fountain View Dr, Suite 440
Houston, TX 77057
Phone: 281.914.4199
Fax: 832.242.2588

Great Company!



Omar Tyre Cherry
Technology Project Manager
Keystone Document Discoverey
www.keystonedd.com



enordstr <ecnordstrom@gmail.com> wrote: Does anyone have a recommendation of a good electronic discovery /
forensic data retrieval outfit in Houston?

---------------------------------
Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV.

[Non-text portions of this message have been removed]

3c.

Re: Forensic Data Retrieval in Houston

Posted by: "Capolupo, Mark" mcapolupo@UHY-US.COM mcapolupo_uhy

Wed Jun 20, 2007 9:27 pm (PST)

UHY Advisors, Houston HQ, please call 646-746-1200

Mark

----- Original Message -----
From: litsupport@yahoogroups.com < litsupport@yahoogroups.com>
To: litsupport@yahoogroups.com < litsupport@yahoogroups.com>
Sent: Wed Jun 20 15:56:07 2007
Subject: [litsupport] Forensic Data Retrieval in Houston

Does anyone have a recommendation of a good electronic discovery /
forensic data retrieval outfit in Houston?

Confidentiality and Circular 230 Notices

IMPORTANT: If this communication contains statements concerning taxation, those statements are provided for information purposes only, are not intended to constitute tax advice which may be relied upon to avoid penalties under any federal, state, local or other tax statutes or regulations, and do not resolve any tax issues in your favor. Upon request, we can provide you with express written tax advice after necessary factual development and subject to such conditions and qualifications as we may deem appropriate in the circumstances.

This electronic mail message and any attached files contain information intended for the exclusive use of the party or parties to whom it is addressed and may contain information that is proprietary, privileged, confidential and/or exempt from disclosure under applicable law. If you are not an intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information may be subject to legal restriction or sanction. Please notify the sender, by electronic mail or telephone, of any unintended recipients and delete the original message without making any copies.

[Non-text portions of this message have been removed]

3d.

Re: Forensic Data Retrieval in Houston

Posted by: "Dave Townsend" dave.townsend@aptaracorp.com eforinc

Wed Jun 20, 2007 9:27 pm (PST)

We can help you out in Houston. How many custodians and what is the
timeframe?

Regards,

Dave Townsend
Director, Computer Forensics & ESI Collections
Aptara Litigation Services


________________________________

From: litsupport@yahoogroups.com [mailto: litsupport@yahoogroups.com] On
Behalf Of enordstr
Sent: Wednesday, June 20, 2007 4:56 PM
To: litsupport@yahoogroups.com
Subject: [litsupport] Forensic Data Retrieval in Houston

Does anyone have a recommendation of a good electronic discovery /
forensic data retrieval outfit in Houston?

[Non-text portions of this message have been removed]

3e.

Re: Forensic Data Retrieval in Houston

Posted by: "Robert Fitzgerald" rfitzgerald@universalmobilit.com universal_rob

Wed Jun 20, 2007 9:28 pm (PST)

Dan Dykes - 281-850-7748 We have used him and been extremely happy.

_____

From: litsupport@yahoogroups.com [mailto: litsupport@yahoogroups.com] On
Behalf Of enordstr
Sent: Wednesday, June 20, 2007 5:56 PM
To: litsupport@yahoogroups.com
Subject: [litsupport] Forensic Data Retrieval in Houston

Does anyone have a recommendation of a good electronic discovery /
forensic data retrieval outfit in Houston?

[Non-text portions of this message have been removed]

3f.

Re: Forensic Data Retrieval in Houston

Posted by: "Charlene Agnew" cagnew@airmail.net charleneagnew

Wed Jun 20, 2007 9:28 pm (PST)

Call Dan Dykes at:

Houston Computer Forensics

(713) 660-8303

I've known him for years and have watched him work. He's excellent.

Charlene

__________________________________________________________

Charlene Agnew

CT Summation Certified Trainer

American Society of Trial Consultants, Member

Trial Director Certified Trainer and Trial Consultant

Sanction Trial Consultant

Advanced Litigation Solutions, Inc.

Houston, Texas

(281) 485-4025

cagnew@airmail.net

_____

From: litsupport@yahoogroups.com [mailto: litsupport@yahoogroups.com] On
Behalf Of enordstr
Sent: Wednesday, June 20, 2007 4:56 PM
To: litsupport@yahoogroups.com
Subject: [litsupport] Forensic Data Retrieval in Houston

Does anyone have a recommendation of a good electronic discovery /
forensic data retrieval outfit in Houston?

[Non-text portions of this message have been removed]

Posted by at No comments:

Wednesday, June 20, 2007

Fake NetBIOS Tool - Simulate Windows Hosts

clipped from www.darknet.org.uk

Some cool free tools made by folks from the French Honeynet Project.

FakeNetBIOS is a family of tools designed to simulate Windows hosts on a LAN. The individual tools are:

  • FakeNetbiosDGM (NetBIOS Datagram)
  • FakeNetbiosNS (NetBIOS Name Service)

    • Each tool can be used as a standalone tool or as a honeyd responder or subsystem.

    FakeNetbiosDGM sends NetBIOS Datagram service packets on port UDP 138 to simulate Windows hosts bradcasts. It sends periodically NetBIOS announces over the network to simulate Windows computers. It fools the Computer Browser services running over the LAN and so on.

    FakeNetbiosNS is a NetBIOS Name Service daemon, listening on port UDP 137. It responds to NetBIOS Name requests like real Windows computers: for example ‘ping -a’, ‘nbtstat -A’ and ‘nbtstat -a’, etc.

    You can download the tools here:

    FakeNetBIOS-0.91.zip

    There are a few others things here:

    http://honeynet.rstack.org/tools.php

    blog it
    Posted by at No comments:

    Wednesday, June 13, 2007

    Hacking video

    if down, get it directly http://www.mediafire.com/?cxpyxwktnfh
    clipped from www.darknet.org.uk

    I was thinking that the darknet authors should create videos when they write about different tools… It should be fun to see presentations… and also would bring darknet more hits…
    I made a video for my previous article, and uploaded it to youtube: stealth techniques - syn

    …for better quality download it: here

     blog it
    Posted by at No comments:
    Subscribe to: Posts (Atom)