There's an interesting program over at sourceforge, ICMP-Chatwhich gives allows you to communicate with someone purely over ICMP (you can choose which type of ICMP message is used).
This provides a good illustration of the dangers in security of assuming that a system or protocol will only be used for its intended, or well known, purpose.
In this example this program could probably be used to bypass firewall infrastructure in some companies, as many people allow ICMP through for troubleshooting purposes, where all TCP and UDP connections will be locked down.
That brings me on to another point, which is the futility of disallowing protocols based on the fact that they can be used for file-transfer. In some setups I've seen people will block incoming FTP but not HTTP. Now that doesn't make a lot of sense when you realise that HTTP is a generic content transfer protocol and can be used for a wide variety of things like file transfer and, of course, remote control.
You don't see many companies allowing inbound connections for protocols like PC-Anywhere, but with HTTP allowed, services like GoToMyPC allow very similar functionality.
An mitigation for this kind of risk is to apply more application level controls over all protcols allowed through security perimiters, as at the application layer there is a better understanding of what the purpose of the communication is...

well I think ive finally found the right handheld computer for me... A sharp Zaurus c860. Its linux based, has lots of good security software available, can take SD and CF cards, has an excellent 640x480 display and isnt too bulky or heavy.
also the keyboard is fairly good... as Im writing this entry using it.....

ATAC: Abusable Technologies Awareness Center: Used Hard Disks Packed with Confidential Information
Interesting information about the types and quantity of sensitive information that is available on old hard disks....

There's a good bluesnarfing story over at Slashdot

Martin McKeay's Network Security Blog: Scary uses for Google
Found a link to an interesting story at seccurityfocus about using google for looking for things like passwords that the owners of the pages probably don't realise are public.
Also got another blog for my blogroll :o)

Eweek are carrying a story covering some forrester research comparing vulnerability levels and response times across a range of vendors.
The thing that always strikes me about this kind of research is whether they are comparing like with like. For example if they are comparing ALL vulnerabilities on Microsoft software with ALL vulnerabilities in software in a given Linux Distrabution, then thats really a bit meaningless in the real world. I mean who's going to have all that software installed in a given environment.
A far more meaningful way of presenting the information would be to establish typical usage profiles, for example "corporate desktop" or "web server" state what packages those would contain and then measure the vendors based on the vulnerability levels present.
My gut feeling, although I could be wrong, is that Microsoft would probably come out worst in that kind of analysis, as many of the vulnerabilities they have had recently have been in core parts of their system (ASN.1 being a good example) which would appear in every loadset, and of course the fact that they're overall strategy seems to involve a lot of integration of systems, leading to a larger overall attack surface.

NewsForge | Open Source Vulnerability Database Goes Live
There's a story over at newsforge covering a new Open Source Vulnerability database. It's not too clear to me at the moment how this differs from things like CERT?

This Story over at Zone-H.org makes an interesting point about Eeye's outstanding vulnerabities which they've reported to Microsoft.
One point of view that you could take from this is that Microsoft is pretty famous for the amount of integration in its products, and as the number of products and the amount of code in those products increases, the cost and time required to fix a vulnerability will also increase. On the Eeye page you can see that they've got vulnerabilites that they reported to Microsoft 200+ days agot which they regard as critical and which have not been patched.
Given Eeye's approach of non-disclosure this isn't too serious a problem, however if we assume that Microsoft has been working hard to patch these problems (and we've no reason to assume that's not the case), what would happen if they got an equally serious vulnerability from a source who believed in publishing after only say 10 days of notification or even worse one who decided to post expkoit code first and ask questions later!
If it takes 200+ days to patch the problem, that would leave a pretty large window of exploitation and potentially a lot of damage to systems around the world.

ISS slammed for 'selling' security patches - ZDNet UK News
This story over at ZDnet is covering ISS's insistance that only customers with maintenance contracts will get patches for the vulnerability in their products caused by the witty worm...
I really hope this isn't a continuing theme amoungst software vendors as the only result will be an increasing number of machines that will never be patched against malicious code.
Also I've got to say that I'm really suprised to see this stance from a vendor of security products, as you would think that they of all people would understand the consequences of leaving people with faulty firewall software!

<a title="Security links, tietoturvalinkkej