Raesene's Ramblings

SysWear :: Programming t-shirts
Cool looking line of geek t-shirts... I particularly like this one

Schneier on Security: Attack on the Bluetooth Pairing Process
Here's a note from Bruce Schneier on an interesting new attack on the bluetooth protocol (or more accurately common implementations of the protocol)...
Following this, if there are tools released which implement the attack, it'll really reduce where bluetooth should be used in corporate settings... all those lovely bluetooth headsets that people in the UK have bought...

CyMotion Linux Cherry Keyboard
Link to instructions to get the cool cherry linux keyboard working without using the supplied software (which appears to be Suse only).
Nice keyboard as well as having cute penguins on in :o)

GaryKessler.net Home Page
Excellent list of security Articles/URL's

Ping Tunnel - Send TCP traffic over ICMP
Another great example of why once you allow one protocol/port through your firewall, it's pretty easy to get any other traffic through... This one's interesting, in that it levereges ICMP...

Richard Monson-Haefel: Is Microsoft IIS 6.0 more secure than Apache HTTP Server 2.0?
Interesting posting on the relative security of IIS 6 and Apache 2.0. I'd agree that IIS 6 seems to have a MUCH better record than previous versions in terms both of vulnerability counts and initial configuration.
The only caveat I've got on it is my usual one about MS security, which is that with their products you have to look at the vulnerability of the whole stack as installed because it's so darn difficult to separate out the bits you don't want, unlike the situation with Apache running on something like Linux or BSD...
but I've done that rant before so I shan't do it again...

The Elder Geek on Windows XP

File Selection May Lead to Command Execution
This vulnerability doesn't look tooo bad at first. If you can persuade someone to highlight a file in windows explorer then it executes some abitrary code, which it seems can do most things. However you'd have to get people to download the file anyway for it to work as a virus/word, which isn't too likely (you'd hope, after years of that kind of thing doin the rounds on the 'net).
Then I got to thinking, what about a completely different attack scenario... Joe the disgruntled employee, could go through the corporate file store adding malicious author fields to word files or the like, then as soon as one of his co-workers clicks the file, the javascript runs and actions are taken looking like the person clicking the file has carried them out. (and if joe's got any sense the first one would be change the author field removing any evidence of his modification...)
Hard to catch, unless things like A-V scanners get a signature for this (which might be tough), changes of document metadata don't usually show up in things like security logs, and in many companies people have access to a lot of docs, so it might not be discovered for a long time...
Another interesting point in relation to this vuln. and the unpatched Jet engine one is, how long will it take Microsoft to get a patch out, and will they release it outside the monthly schedule they usually use.....

CacheDump: recovering cached password hashes on Windows
Handy pen testing tool. Can be used to dump the hashes for cached passwords which windows holds so that you can logon to your local machine if the domain controllers not available or you're not on the network (eg, laptops)
One attack using this I've seen suggested is to persuade a network admin to log onto a machine you control then you can use this to get their password (of course you could just use something like this instead.

Where's the Beef - xss / bankofamerica.com.html /
There's an interesting list at this site of XSS vulnerabilities that the authors found...