SecurityFeed.info » Robert Hensing's Blog

Feeds

29336 items (29336 unread) in 97 feeds

• Aviv Raff On .NET (22 unread)
• Bugtraq (bugtraq) Mailing List (712 unread)
• CGISecurity.com: Your Web Site and Application Security Resource (135 unread)
• christian's weblog (25 unread)
• Irongeek's Security Site (160 unread)
• Jeremiah Grossman (85 unread)
• Heorot.net (13 unread)
• milw0rm.com (530 unread)
• Nmap Hackers (nmap-hackers) Mailing List (9 unread)
• Packet Storm Security Advisories (450 unread)
• Packet Storm Security Exploits (551 unread)
• Packet Storm Security Headlines (460 unread)
• Packet Storm Security Last 100 (2596 unread)
• Packet Storm Security Last 20 (1013 unread)
• Packet Storm Security Last 50 (1853 unread)
• Packet Storm Security Last Files (634 unread)
• Packet Storm Security Miscellaneous Files (172 unread)
• Packet Storm Security Tools (184 unread)
• Rootsecure.net (839 unread)
• SecuriTeam.com (273 unread)
• Security Vulnerability Research & Defense (48 unread)
• SecurityFocus News (179 unread)
• SecurityFocus Vulnerabilities (876 unread)
• Securityvulns news channel (416 unread)
• SecWatch - Latest Exploit Alerts (10 unread)
• Taking Network Security to the Streets (28 unread)
• The One And Only Matt Parnell.com (38 unread)
• The Register - Security (642 unread)
• The Register - Software (713 unread)
• VulnWatch (vulnwatch) Mailing List (19 unread)
• Web App Security (webappsec) Mailing List (121 unread)
• IceСμbeς (15 unread)
• Linmagazine (296 unread)
• ‫netcraft Bytes :) (52 unread)
• Digg (4421 unread)
• Blonde 2.0 (72 unread)
• The Microsoft Security Response Center (MSRC) (62 unread)
• (IN)SECURE Magazine Notifications RSS (18 unread)
• 0x000000 Security (95 unread)
• ----- Anti-Malware ----- Analysis and Defense (16 unread)
• Apple Fun (25 unread)
• Technorati Search for: aviv.raffon.net (264 unread)
• C.I.S.R.T. (10 unread)
• Determina Zero-Day Protection (6 unread)
• Didier Stevens (69 unread)
• eEye Digital Security - Research Blog (10 unread)
• Ryan Naraine's Security Watch (162 unread)
• Security - RSS Feeds (280 unread)
• Exploit Prevention Labs (28 unread)
• Software Vulnerability Exploitation Blog (22 unread)
• F-Secure Antivirus Research Weblog (120 unread)
• Full Disclosure (303 unread)
• George Ou (10 unread)
• GNUCITIZEN Media Portfolio (99 unread)
• ha.ckers.org web application security lab (44 unread)
• heise security (496 unread)
• invisiblethings' blog (35 unread)
• Jeff Jones's blog (12 unread)
• JScript Blog (18 unread)
• Matasano Chargen (43 unread)
• McAfee Avert Labs (97 unread)
• Michael Howard's Web Log (39 unread)
• PandaLabs (55 unread)
• Zero Day (343 unread)
• SANS Internet Storm Center, InfoCON: green (293 unread)
• Latest Secunia Security Watchdog Blog Entries (33 unread)
• SecuriTeam Blogs (85 unread)
• Security Fix (173 unread)
• HP ASC Portal (30 unread)
• Strike Center (12 unread)
• Sunbelt Blog (301 unread)
• Sunnet Beskerming Security Advisories (48 unread)
• Technobabylon
• The Recurity Lablog (33 unread)
• Wired: Threat Level (626 unread)
• TrendLabs | Malware Blog - by Trend Micro (223 unread)
• Uninformed Journal (49 unread)
• WabiSabiLabi's blog (23 unread)
• WatchGuard Wire (61 unread)
• Latest Blog Entires From WebSense Security Labs (71 unread)
• Hackszine.com (226 unread)
• DVLabs: Blogs (81 unread)
• Errata Security (91 unread)
• Robert Hensing's Blog (92 unread)
• PaulDotCom Community Blog (12 unread)
• David LeBlanc's Web Log (25 unread)
• Billy (BK) Rios (25 unread)
• David Litchfield's blog (21 unread)
• Farfromr00tin (23 unread)
• aut disce, aut discede (17 unread)
• pwn* (16 unread)
• hackademix.net (54 unread)
• SecurityDot Vulnerabilities (540 unread)
• Vulnerabilities & Exploits (38 unread)
• Malicious Code (34 unread)
• Security Risks (22 unread)
• Digg / Security / upcoming (4515 unread)

Robert Hensing's Blog (10 unread)

• November 19, 2008
• 18:17

  Interesting stuff and the end is near (for my blog)

   » ‎ Robert Hensing's Blog

  First off - OneCare is dead - long live . . . OneCare . . . err Morro?
  [news.cnet.com]

  Next up - Zune 3.1 is out - download it - love it.
  [www.engadget.com]
  Also - the flash memory based Zunes are getting price chopped from $10 - $30 in time for Christmas:
  [www.engadget.com]
  
  Things I loved about the 3.1 update are the new games (Checkers, etc.) and the ability to play with other players wirelessly.  My 8 year old kicked my ass in Checkers last night playing wirelessly from his Zune 30.  I was both proud and embarassed at being outsmarted by an 8 year old. :)  I was too scared to try my luck at NLHE against him (yes he already knows how to play Poker - I'm not proud of that b.t.w.)

  Also came across a new commerical I hadn't seen yet for the 360 today: [www.xbox.com]

  Finally - all good things must come to an end - and my blog is no exception. :)
  
  I'll probably be done blogging real soon now . . . security (which unfortunately is one of my favorite topics) is a topic full of blog-landmines . . . only they move around frequently . . . and after stepping on them - they reset so you can step on them again, and again if you have short term memory problems and a learning problem. :)  Not to mention it's time consuming when done properly and I've been busy as hell lately working on work - and overclocking my car (installed a piggyback EMU and self-tuned it a bit, installing some stage 2 cams this weekend - wish me luck - you may find a used overclocked 2001 IS300 on eBay Monday in need of a new engine with a low low reserve!).

  So that said - my farewell post will probably be an explanation of why I have 'El Conquistador' in my display name since it's probably the most frequently asked question I get. :)

  
• November 02, 2008
• 15:43

  This week's Fail Open Goat Award goes to - Credit Card Processing

   » ‎ Robert Hensing's Blog
  [www.veracode.com]
• October 29, 2008
• 18:53

  Microsoft SideSight?

   » ‎ Robert Hensing's Blog
  Looks cool: [www.gearlog.com]
• 18:44

  SmoothHD

   » ‎ Robert Hensing's Blog

  Akamai / IIS7 / SilverLight 2.0 / VC-1 == HD over broadband happiness.  It's sort of cool - the video started off a tad blurry and then got sharper after a few seconds and I didn't have a single glitch. 
  Pretty impressive stuff: [www.smoothhd.com]
  Also see: [www.akamai.com]

  
• October 23, 2008
• 16:20

  Mass SQL Injection : The Chinese Way

   » ‎ Robert Hensing's Blog

  The blog pretty much speaks for itself: [www.circleid.com]

  Client-side browser vulns are of little use without an effective way of spreading them to the victims - unfortunately - it's still relatively easy for the miscreants to spread them around using tools like this.
  Interesting the comment about SQL injection via cookies . . .

  
• 15:28

  Out of band security update planned for today (MS08-067)

   » ‎ Robert Hensing's Blog

  Updated 10/23/2008 @ 1:17pm EST
  We have pushed the update live - here's the direct link to the bulletin:[www.microsoft.com] (if it doesn't work for you - keep trying - it will be live real soon now).
  Also note that the Microsoft Malware Protection Center also has generic detection for the malware dropped in the targeted attacks!
  You can read more about it at the MMPC blog: [blogs.technet.com]
  Finally my team has released a blog post with an interesting .C file linked at the end - for those who like to compile stuff and play around with ACLs: [blogs.technet.com]
  --------------------------------------------- 

  The MSRC, SWI and some Windows product team folks have been working really hard to get a critical security update out the door this week and they just pushed the advanced notification thing live early this morning (EST).

  [blogs.technet.com]

  [www.microsoft.com]

  It's likely that by the time many of you read this - the update will already be available for download via WU/MU/WSUS etc. 
  Be sure to go out and grab it - especially if you are running Windows XP or lower operating systems (as you can tell by the severity ratings in the advance notification thinger - it's critical on that platform).

  As always we apologize in advance if this ruins anyone's weekend plans - I personally blame the miscreants. :)

  P.S.  Keep an eye on my team's blog later today for more technical information: [blogs.technet.com]

  
• October 22, 2008
• 22:28

  Flash 10 & IE8b2 Per Site ActiveX

   » ‎ Robert Hensing's Blog

  So I've got IE8b2 installed on all of my machines and I've noticed that since installing Flash 10 that all web sites now prompt me before running Flash 10!  The new gold bar experience users will see when they install Flash 10 on IE8 is described here (thanks to Eric Lawrence for the URL: [blogs.msdn.com]).

  Some people may hate this - I actually like that I can now selectively control which sites get to use Flash and that it defaults to OFF for all web sites.  As long as you don't select to allow ALL web sites to run the ActiveX control - it will continue to be blocked behind a gold bar for every web site that wants to instantiate the control.  You'll find that within hours of installing Flash 10 on IE8b2 that pretty much EVERY site on the entire Interwebs wants to instantiate Flash (mostly for supporting annoying ads) and you'll also find that having it blocked behind a gold bar really isn't so annoying.  I personally plan on leaving the Flash 10 AX configured to run on a per-site basis (i.e. I won't be configure it to run on all web sites) since this makes me feel a bit more warm and fuzzy only allowing certain sites to run the control.  I imagine the vast majority of users will choose to allow all web sites to run the control and that's fine with me - as long as *I* don't have to allow all web sites to run the control - I'm a happy camper.

   

   

  
• October 18, 2008
• 2:50

  Flash 10 is out - install it like . . . yesterday.

   » ‎ Robert Hensing's Blog

  If I were a bad guy and I wanted to pwn lots of people via the web - I'd probably focus my efforts on ubiquitous software guaranteed to give me a lot of bang for my buck (like Flash and Acrobat).  Software like Flash would seem like a good target given that it's installed on just about everything these days.  Adobe released Flash 10 recently and I'm just guessing it's got some security bug fixes in it that would probably be good to have.  I'd install it ASAP.

  Oh and has anyone else noticed that Acrobat 9 still:

  1. Opens PDFs by default in a browser *without prompting* the user
  2. Runs JavaScript by default (I'm sure it's 'sandboxed' - whatever - i still disable this by default on all my boxes).

  And does this remind anyone of Office circa 2000 when we let VBA macros run by default and didn't prompt users before opening documents via the web?  How is it possible that in 2008 this still happens with our competitors?

  
• October 14, 2008
• 23:59

  Win7 to officially be called . . . Win7?

   » ‎ Robert Hensing's Blog

  I actually for once - LOVE that we are keeping the name of the OS simple and leaving it at Win7.  I will admit - I was somewhat disappointed when XP's name was announced internally (internally it was known as Whistler) and I was downright horrified when we decided to call Longhorn "Vista" (my friends call it "Veesta").  Longhorn sounds cool . . . manly . . . Vista is pretty much the exact opposite in my mind . . . it sounds serene and 'pretty'.

  Anyhoo - we seem to be doing all the right things with Win7 (you'll know why I'm saying that soon enough <G>): [windowsvistablog.com]

  Wish I could tell you more about it - but I can't.  All I can say is that it freaking rocks.  I already use it as my daily driver OS at work and can't wait until it's out in the public for testing (which it will be very soon at PDC / WinHec next week).

  
• 23:28

  MAPP + Exploitability Index == Protected Customers, Better Security Update Prioritization

   » ‎ Robert Hensing's Blog

  Today we officially launched our MAPP program ([www.microsoft.com]) and at the same time we also started providing exploitability information about our vulnerabilities to the world.  These two things are pretty huge.  The idea behind the exploitability index is to help customers understand which updates they should deploy immediately vs. which ones we don't think are as likely to be epxloited or exploited reliably (trivia:  Did you know that only about 30% of all of our vulns ever have exploit code written for them?). 

  You can see the exploitability index for the October release here: [www.microsoft.com]

  Here's the breakout of the numbering system used for the exploitability index - it uses 3 numbers - simple - like me: [technet.microsoft.com]

  Code monkey very simple man.