Pinboard (citizenk)

Mozilla: Intent to deprecate: Insecure HTTP | Lobsters

citizenk — 2015-04-14T08:00:09+00:00

RT @LobsterNews: Mozilla: Intent to deprecate: Insecure HTTP #browsers #security

Google Groups

citizenk — 2015-04-14T08:00:09+00:00

RT @LobsterNews: Mozilla: Intent to deprecate: Insecure HTTP #browsers #security

Microsoft releases 64 fixes on April's bumper Patch Tuesday

citizenk — 2011-04-08T04:10:35+00:00

WordPress 3.1.1

citizenk — 2011-04-05T15:10:11+00:00

InfoQ: Will HTML5 be Secure Enough?

citizenk — 2010-08-24T10:15:54+00:00

RT @PierreTran: Will HTML5 be Secure Enough? | InfoQ #html5 #security

Tabnabbing: A New Type of Phishing Attack « Aza on Design

citizenk — 2010-05-25T12:48:56+00:00

Tabnabbing - a new kind of phishing attack: #security #clever

Windows 7 Sins — The case against Microsoft and proprietary software

citizenk — 2010-02-05T15:07:53+00:00

Gmail Making Secure Https Connections a Default - Gmail - Lifehacker

citizenk — 2010-01-13T15:59:00+00:00

What took so long? - Gmail Making Secure Https Connections a Default #security #gmail

How to obtain and install an SSL/TSL certificate, for free

citizenk — 2009-12-21T14:51:39+00:00

Gmail and Google Apps Account Hacked But Restored Soon After

citizenk — 2009-12-19T17:00:51+00:00

You Deleted Your Cookies? Think Again | Epicenter | Wired.com

citizenk — 2009-08-11T14:53:28+00:00

Surveillance Self-Defense International | Electronic Frontier Foundation

citizenk — 2009-07-22T14:33:55+00:00

12 Essential Security Tips and Hacks for WordPress

citizenk — 2009-07-14T14:22:19+00:00

12 Useful FireFox Plugins For Safe Browsing | Smashing Downloads

citizenk — 2009-07-14T14:17:44+00:00

Lifehacker - How to Crack a Wi-Fi Network's WEP Password with BackTrack - wep

citizenk — 2009-07-02T07:30:27+00:00

How to Create an SPF Record for your Domain. | eHow.com

citizenk — 2009-04-29T14:22:31+00:00

Freeware Tools and Utilities for Windows

citizenk — 2009-03-23T15:27:54+00:00

10 Privacy Settings Every Facebook User Should Know

citizenk — 2009-03-02T10:34:01+00:00

My Lockbox - Files and Folders Password Protection - Hide Folder, Lock Folder, Password Protect Folder - FSPro Labs

citizenk — 2008-01-30T21:09:47+00:00

Bruce Schneier Blazes Through Your Questions - Freakonomics - Opinion - New York Times Blog

citizenk — 2008-01-30T14:32:07+00:00

Schneier on Security: How to Secure Your Computer, Disks, and Portable Drives

citizenk — 2008-01-30T14:27:19+00:00

Schneier on Security: Security in Ten Years

citizenk — 2008-01-30T14:23:19+00:00

Bugtraq: [linux-security] Things NOT to put in root's crontab

citizenk — 2008-01-09T07:19:17+00:00

oddities of JAPAN

citizenk — 2007-12-13T12:03:23+00:00

OpenID » Blog Archive » OpenID 2.0…Final(ly)!

citizenk — 2007-12-06T10:32:16+00:00

Guarding Your Social Security Number - TIME

citizenk — 2007-12-05T22:06:34+00:00

PHP Login script

citizenk — 2007-12-05T21:05:49+00:00

Wireless keyboards easily cracked - Hack a Day

citizenk — 2007-12-04T06:45:42+00:00

Infected Seagate Hard Drives - Chinese subcontractors blamed for trojan horses

citizenk — 2007-12-03T09:58:45+00:00

The wonderful horrible life of Facebook users and their data (or, "data hogs get slaughtered")

citizenk — 2007-11-26T17:38:02+00:00

Facebook is pushing themselves into a position of being viewed as ungrateful data hogs: amassing tons of information, selling it under false pretense, and not sharing it with the folks who gave it to them.

[en] .htaccess Editor

citizenk — 2007-11-16T21:07:44+00:00

Light Blue Touchpaper » Blog Archive » Google as a password cracker

citizenk — 2007-11-16T20:45:59+00:00

Five must-have security/privacy extensions for Firefox | Tech news blog - CNET News.com

citizenk — 2007-11-14T21:16:19+00:00

Why blurring sensitive information is a bad idea - dheera.net: Dheera Venkatraman's web site

citizenk — 2007-11-13T16:36:04+00:00

Remember, you want to leave your visitors with NO information, not blurred information.

Michael's Mac - Create a Custom Environment for Leopard's New Guest User

citizenk — 2007-11-11T16:21:07+00:00

Blocking Unwanted Parasites with a Hosts File

citizenk — 2007-11-10T18:06:34+00:00

TechDune » Amazing XP Tools to Arm your PC from Hackers

citizenk — 2007-10-10T05:20:12+00:00

Stealth Windows update prevents XP repair - WindowsSecrets.com

citizenk — 2007-09-27T15:19:39+00:00

after using the repair option from an XP CD-ROM, Windows Update now downloads and installs the new 7.0.600.381 executable files. Some WU executables aren't registered with the operating system, preventing Windows Update from working as intended. This, in

Virtual Private Sushi!?

citizenk — 2007-08-29T09:48:04+00:00

“wirelesspacket” (quickly becoming one of my favorite chat regulars) sent this suggestion on virtual private networks for individuals. I was reading your post about Tor or VPN.. Have you ever tried Hamachi? (hamachi.cc) Hamachi is an alternative to VPN. It was highly recommended by Steve Gibson in his Security Now podcast episode 18. aolradio.podcast.aol.com/sn/SN-018.mp3 Hamachi uses AES 256bit encryption creating an Ad-hoch local area network (LAN) using the 5 dot IP address range. (5.xxx.xxx.xxx range) It is also multi platform, running on Windows, Linux and OSX. Hamachi does not send any traffic from your network to there servers. Just your initial login, all connections from there on in are client to client. Fully Secure.. Here is how you get started… First, you need to visit the Hamachi website and download there free software. (Spyware free) Second, install the software. The Hamachi software installs a GUI client with a virtual network adaptor that will allow you to connect to the Hamachi servers and clients. Third, Create a unique Hamachi network name. You have the ability to use wildcard card characters within your network name. Making it virtually impossible for anyone to guess what network name you have decided to use. Forth, Use a strong 64 key password. This can be generated at www.grc.com/passwords.htm . Copy and past your network password into the field provided. Fifth, Download and Install the Hamachi software onto other clients. Have those clients join your Hamachi network. Do this by copying and pasting your network name and password. You have just now created a Hamachi network. (Doesn’t it feel great!) Simple and efficient. You now have the ability to use Windows file sharing, FTP, Remote Desktop Connection, VNC, play games and even VPN. All through the ad-hoc LAN network you have just created. (This is Sparta!) You can now run a VPN server from the privacy of your own home or office without port forwarding. Start your VPN server and Install Hamachi onto that machine. On a machine that has Hamachi already configured. Open the VPN client you wish to use. Input the IP address of the VPN server on your Hamachi network into the client. The address entered should start with 5.xxx.xxx.xxx. You are now connecting to a VPN server over Hamachi. Double the security and encryption. All done without touching any of the settings on your firewall. The only problem is, OS X support is shaky. I may have to keep looking, I guess.

Microsoft Baseline Security Analyzer Automation

citizenk — 2007-07-12T17:24:07+00:00

Introduction One of the topics that an Exchange administrator needs to care about is the level of security of the Exchange servers regarding the patching level from the Security Update. In wide IT environment, Security Updates are most of the time in charge of a dedicated administrator responsible for security updates deployment using application such like Microsoft Windows Server Update Services (WSUS). In some scenario, this means that the Exchange admin depends on the WSUS admin to have a global report of the fixes applied or not on a bunch of servers. One of the main consequences in that case is that some delay may occur to get the information. We here propose to provide an easy and automate way to get the information on demand from a single workstation using command lines based on: Microsoft Baseline Security Analyzer (MBSA) v.2.0.1 (available for download here) MBSA 2.0 Scripting Samples (available for download here) The purpose of the batch will be to run MBSA against several identified remote servers, and then parse all MBSA reports produced into a single XML file to get a global overview of all servers security update version. Also, some corporate networks are protected from the Internet by a proxy and/or a firewall. The provided solution will help to not perform scanning against the Microsoft Update website, but using the offline security update cabinet file (WSUSScn2.cab) As always, some requirements need to be fulfilled... ...On the workstation and the remote computers It is imperative that all remote computers needed to be scan have been updated with the latest version of the Windows Update Agent (WUA) (available here). In some case, the latest Windows Installer program should also be installed (available here). ...On the workstation only Since security updates are released on the regular basis, it is mandatory to update frequently the offline security update cabinet file WSUSScn2.cab. This cabinet is available in direct download using the following link http://go.microsoft.com/fwlink/?LinkId=76054. Download the cabinet on the workstation, and move it in a directory ease of access. (ex: C:\Temp) If you wish to include the download of the cabinet within the automation job, you will have to create the proper script. If you use a proxy authentication to get access to the Internet, the script should include code to provide the necessary credentials. If you are not that involved with scripting, there are command line tools available on the Internet which permit downloading a file from a URL. Some tools even include parameters to perform an authentication against the proxy server. Microsoft Baseline Security Analyzer (MBSA) v.2.0.1 If you are already familiar with MBSA, then you know that the GUI version allow you to generate report of remote servers from a workstation. But did you know that MBSA also includes a command line tool allowing you to perform the same type of tasks and even more: MBSACli.exe. When you need to scan several computers, you can only specify an IP range using MBSA GUI, while with MBSACli you are able to specify a list of the computers to be scanned. For all command line parameters, type "mbsacli.exe /?" from a command prompt. We here proposed to run MBSACli.exe using the following parameters: mbsacli.exe /nd /nai /nvc /wi /catalog \wsusscn2.cab /listfile \servers.txt /nd: To avoid any download from the Internet /nai: To avoid WUA updates on the workstation that run MBSA, but also on remote servers. /nvc: To avoid check for new version of MBSA /wi: Permit to display all updates, even ones rejected by the WSUS server. Particularly useful for Exchange admin not allowed binding against SUS server. /catalog:\wsusscn2.cabPermit to point MBSA to the local update cabinet. In our scenario, the cabinet is located on the workstation running MBSA. Though, we are here by-passing the use of an Internet connection. /listfile \servers.txtThe servers.txt file contains NetBIOS name or FQDN name list in column of all servers to be scanned. MBSA 2.0 Scripting Samples After MBSACli.exe has run, we now have as many of MBSA report generated as number of servers to scan in the "servers.txt" file. By default, all MBSA report uses the .mbsa file extension and are located within the following path on the workstation: "C:\Documents and Settings\\SecurityScans" The setup of MBSA 2.0 Scripting Samples is in fact an uncompressed installation. The default setup process proposes you to extract the files wherever you want. Once you've performed the setup process, locate the rollup.js script file within the unzipped folder. This script will allow parsing all MBSA reports into one single xml report as showed below: With such report, we are able to have a global overview of all fixes installed or not on remote servers. To perform such task, run the following command: cscript /nologo rollup.js -b>c:\XMLReportName.xml With this command line, all MBSA reports will be compiling within the XMLReportName.xml file. The XML file can be opened in Internet Explorer for reading. In order to transmit the XML report to another person, you will need to attach the rollup.xslt to the XML due to file dependencies. Also, there is no need to have MBSA installed to read the XML report. You will notice that MBSA reports names or folder path isn't mentioned in the command line. This means that by default, the command line will run against ALL reports located within the MBSA "SecurityScans" default path. Consequence is that prior any automation, you would need to perform a cleanup (deletion or archiving) of the "SecurityScans" directory content, using for example, the following command line: Del %Userprofile%\SecurityScans\*.* /Q Note: Another use of the rollup.js script would be to run against all MBSA report to provide information only regarding a specific bunch of security updates. To do so, run the following command: cscript /nologo rollup.js –b MS06-019 MS06-029>c:\XMLReportName.xml Such command line can be useful following a maintenance period on the environment to check that identified security updates have been properly installed on identified servers. Conclusion We are now able to compile all seen command lines into a single batch file as follow: 1. Clean all previous MBSA report Del %Userprofile%\SecurityScans\*.* /Q 2. Download latest WSusscn2.cab (using a script or other appropriate solution) 3. Perform new bundle of MBSA reports mbsacli.exe /nd /nai /nvc /wi /catalog \wsusscn2.cab /listfile \servers.txt 4. Parse all MBSA reports into a single XML file cscript /nologo rollup.js -b>c:\XMLReportName.xml With this solution, Exchange Administrators are able to have a global overview on periodic basis of the current state of the Exchange servers regarding Security Fixes. References Windows Installer 3.1 v2 (3.1.4000.2435) is availablehttp://support.microsoft.com/kb/893803 A new version of the Windows Update offline scan file is availablehttp://support.microsoft.com/kb/926464 MBSA 2.0 Scripting Sampleshttp://www.microsoft.com/downloads/details.aspx?FamilyId=3B64AC19-3C9E-480E-B0B3-6B87F2EE9042&displaylang=en Microsoft Baseline Security Analyzer v2.0.1 (for IT Professionals) http://www.microsoft.com/downloads/details.aspx?FamilyId=4B4ABA06-B5F9-4DAD-BE9D-7B51EC2E5AC9&displaylang=en - Jeremy Gagne

Cocoia Blog » Howto: A more secure OS X before Leopard.

citizenk — 2007-03-13T18:25:08+00:00

Hacktivate » Reversing an ssh connection

citizenk — 2007-03-13T17:11:54+00:00

One of the nice features of VNC is that you can reverse a connection. If you are behind a firewall (or a router doing NAT) that doesn’t allow incoming connections, VNC allows you to connect to a “listening server”. As soon as a connection is establi

Epic Windows 98 Logon (Updated English)

citizenk — 2007-03-10T15:09:26+00:00

import this. » Blog Archive » HOWTO: Secure Firefox and IM with PuTTY

citizenk — 2007-03-07T00:08:27+00:00

Welcome to Errata Security

citizenk — 2007-03-06T22:52:36+00:00

Examples of data seepage is what happens when you power-on your computer. It will broadcast to the world a list the list of WiFi access-points you've got cached on your computer, the previous IP address you used (requested by DHCP), your NetBIOS name, you

GadgetTrak: Track stolen gadgets such as an iPod, PSP, USB Flash drive and digital camera

citizenk — 2007-03-05T21:21:35+00:00

ScrubIT

citizenk — 2007-03-02T09:33:05+00:00

dmiessler.com | study | diffiehellman

citizenk — 2007-03-02T09:31:21+00:00

Spam Reporting Addresses

citizenk — 2007-02-27T13:34:05+00:00

OpenID - What is it, and why everyone is talking about it - CenterNetworks - News, Reviews, Insights and Interviews

citizenk — 2007-02-26T08:49:45+00:00

Melissa's Adventures: Paint at the movies?!

citizenk — 2007-02-26T08:28:41+00:00

OpenID: an actually distributed identity system

citizenk — 2007-02-25T17:53:47+00:00

c't Projekte - Offline-Update

citizenk — 2006-11-24T11:00:36+00:00

Internet Security Tool | Free download protects from adware, phishing, spam, spyware and virus threats

citizenk — 2006-11-22T13:25:13+00:00

CyberDefenderFREE 2.0 - The All-Free Internet Security Suite. Effective against Spyware, Viruses, Malware, Trojan virus, Adware, Phishing scams, Spam, and Backdoors.

All Things Marked » HOWTO: Securely open TrueCrypt volumes in one click (Redux)

citizenk — 2006-10-04T15:19:21+00:00

In the past, I wrote an article about a very easy way to mount and explore a TrueCrypt volume in one step. Some security issues came up about keeping the volume password in the batch file used to mount. This new article take that into account.

Weak security in our daily lives@Everything2.com

citizenk — 2006-09-21T07:18:47+00:00

a sequence of minimal length that, when you enter it into a car's numeric keypad, is guaranteed to unlock the doors of said car. It is exactly 3129 keypresses long, which should take you around 20 minutes to go through.

Schneier on Security: Renew Your Passport Now!

citizenk — 2006-09-19T11:08:25+00:00

http://www.youareadopted.com/wga/wga-bypass.html

citizenk — 2006-09-18T12:16:07+00:00

Bruce Schneier - The ID Chip You Don't Want in Your Passport - washingtonpost.com

citizenk — 2006-09-17T16:33:41+00:00

RFID chips don't have to be plugged in to a reader to operate. Like the chips used for automatic toll collection on roads or automatic fare collection on subways, these chips operate via proximity. The risk to you is the possibility of surreptitious acces

BBC NEWS | UK | England | Somerset | Wearing helmets 'more dangerous'

citizenk — 2006-09-12T12:16:53+00:00

The study found drivers tend to pass closer when overtaking cyclists wearing helmets than those who are bare-headed.

Seek and Ye Shall Be Found

citizenk — 2006-09-07T12:15:50+00:00

The only way to remove this threat is for search companies to voluntarily delete the information from their search logs, foregoing whatever future revenue or marketing advantage they might be able to get from exploiting the data. If the companies persist

FairUse4WM - a WM/DRM removal program - Doom9's Forum

citizenk — 2006-08-28T18:46:47+00:00

FairUse4WM is a GUI version of drmdbg that supports individualization version .3930 and some WM11 versions.

FrSIRT - Microsoft Windows WMF Handling Remote Code Execution Vulnerability / Exploit

citizenk — 2006-01-01T18:09:08+00:00

B&TW: IE Priv-Sec

citizenk — 2005-12-31T12:55:50+00:00

This page provides a guided tour of most of the major privacy and security settings within Internet Explorer. We'll cover the following aspects of privacy and security in Internet Explorer:

The Ethical Hacker Network - Essential Wireless Hacking Tools

citizenk — 2005-12-20T10:20:43+00:00

Anyone interested in gaining a deeper knowledge of wireless security and exploiting vulnerabilities will need a good set of base tools with which to work. Fortunately, there are an abundance of free tools available on the Internet. This list is not meant

gHacks » How to Secure your Wireless Network

citizenk — 2005-12-15T15:47:44+00:00

Google Safe Browsing for Firefox

citizenk — 2005-12-15T15:27:35+00:00

Google Safe Browsing is an extension to Firefox that alerts you if a web page that you visit appears to be asking for your personal or financial information under false pretences.

Email Address Spoofing at FrankDzedzy.com

citizenk — 2005-12-15T15:02:53+00:00

Spoofed email is email that appears to come from one source, when it actually does not. Because of the simplicity of Simple Mail Transfer Protocol (SMTP), email spoofing is extremely easy to do.

Gmail Bug - www.elhacker.net

citizenk — 2005-11-16T06:56:27+00:00

Or better said, exploit - Patched by Google since

[untitled]

citizenk — 2005-07-26T17:42:08+00:00

The authentication process was optional until Monday. From now on, it will be required for all software updates except security patches