It broke today that Visa and MasterCard announced that a processor of their credit cards had been breached and allegedly more than 10 million credit card numbers have been stolen. A couple of posts/articles that go into more depth are here:
Brian Krebs' KrebsOnSecurity
ZDNet's Zero Day
Sophos' Naked Security
While I had read the posts/articles earlier this morning, I just got "the call" from my credit card company this evening. This has happened to me before, a long time ago when Egghead Software was breached (that had to be mid-90s, right?) What a pain to have go through the rig-a-ma-roll again.
Allegedly, the processor is Global Payments. It will be interesting to see if they are/were PCI compliant. Further, it will be interesting to see if details of the breach emerge.
Global Payments has an announcement on their website.
What bothers me is that they determined that there was a breach in early March, took steps, yet announced today. I would be interested in hearing what caused the delay.
Friday, March 30, 2012
Friday, March 23, 2012
DISA auditing of a SQL 2005 Express database
On my upcoming trip, I have to audit a SQL 2005 Express database and hold it accountable to the DISA SQL Server 2005 checklist. I know that there are parts of the checklist that will be "Not Applicable" as Express just doesn't have all of the features that Server has. My plan is to run the Microsoft SQL Server SRRs against the database, then connect and check as many of the manual checks as possible.
To connect to the database, I plan on use OSQL. In this case, my command will be:
osql -E - which will connect me to the database (assuming that it is the default.)
osql -E -S\instance name - I'll use this if they have changed the instance name.
Upon connecting, I should be able to run any of the manual sql that is listed in the checklist in order to answer the controls.
(In an unclassified environment, I would bring along QueryExpress.exe and connect to the database that way to run queries.)
To connect to the database, I plan on use OSQL. In this case, my command will be:
osql -E - which will connect me to the database (assuming that it is the default.)
osql -E -S
Upon connecting, I should be able to run any of the manual sql that is listed in the checklist in order to answer the controls.
(In an unclassified environment, I would bring along QueryExpress.exe and connect to the database that way to run queries.)
Thursday, March 22, 2012
A great messenger bag idea
Just recently, I had been thinking of switching from a backpack to a messenger bag for carrying all of my tech gear. Don't get me wrong, my backpack has served me well over the years; in and out of airports, all over the U.S. It's a Swiss Gear Synergy, and I truly love it. However, I'm not afraid to admit, it's a little large; it holds all of my stuff, with quite a bit of room to spare. A couple of weeks ago I saw a neat messenger bag, and it got me to thinking. The bag I saw wasn't too big, yet still seemed to have a lot of space to carry plenty of gear. As I am frequently on a plane, I was looking for something that fits under the seat nicely, something my backpack does occasionally (depends on the plane.)
Yesterday, while reading Phandroid, I saw a review for a Powerbag. While they make backpack and slings, I thought their messenger bag was pretty cool. Here's Phandroid's review. I would like to actually see one of these in a store somewhere so that I can check the size and weight; but it really looks cool. The added bonus is that you can charge the phone, etc.
Yesterday, while reading Phandroid, I saw a review for a Powerbag. While they make backpack and slings, I thought their messenger bag was pretty cool. Here's Phandroid's review. I would like to actually see one of these in a store somewhere so that I can check the size and weight; but it really looks cool. The added bonus is that you can charge the phone, etc.
Text/Character Encoder
I was given this encoder in a class. Recently, I was looking for the link and it took me forever to come up with it. This post is just a bookmark for me.
Character Encloder
Character Encloder
Wednesday, March 14, 2012
DISA Updates - Windows 7 STIG benchmark and a master list of STIGs
While checking DISA for specific guidance today, I noticed two updates. The first update is for the ninth release of the Windows 7 STIG benchmark. The current version is: Version 1, Release 9. This was actually released on 12 March. The second update I noticed is a Master List of STIGs. To me, this is awesome, because sometimes I forget which category a particular STIG is housed. Click here for the master list of STIGs. (Be advised that some STIGs are in the CAC-protected section of DISA.) The master list was released on 8 March.
Wednesday, February 29, 2012
Blackberry and General Mobile Device STIGs released
A couple of new STIGs and guides have been released over the last couple of days:
- IAVM to CVE Mapping Spreadsheet - Updated February 24, 2012
- Windows 7 STIG Benchmark Version 1, Release 8 - Updated February 22, 2012
- IAVM 2011 Benchmarks - Updated February 22, 2012
- IAVM 2012 Benchmarks - Updated February 22, 2012
- BlackBerry STIG - Version 2, Release 1 - Updated February 20, 2012
- IAVM to CVE Mapping Spreadsheet - Updated February 17, 2012
- General Mobile Device (Non-Enterprise Activated) STIG Version 1, Release 1 - Updated February 16, 2012
Thursday, February 23, 2012
Is Firefoxforensics.com down? Missing? Replaced? Upgraded?
An anonymous commenter on this post mentioned that Firefoxforensics.com was down. I've checked over the last couple of days, and the site can not be found by various browsers. Whois says the domain is still good. Has anyone heard if it is down for good? Or, since Firefox is up to version 10, are there new tools replacing F3E? I may have missed an announcement, if so, feel free to clue me in.
Monday, February 20, 2012
Life Update
I know I haven't posted in a while.....
Firstly, I've been gettingupset frustrated with DoD auditing in support of DIACAP, or whatever it is going to be called in the future. After doing this auditing for close to four years, I see numerous problems with no clear-cut solution. But, that is a post for another day. I'll still post DoD IA posts, but expect to see more incident response / digital forensics posts.
While I started my post-college career in software development, specifically COBOL, I figured it was time to learn a scripting language. Currently, I write many of my auditing tools using vbscript, however, it is not portable across multiple platforms. After thinking about it for a while, I've decided to teach myself Python; so there could be some Python posts in the future. Many of the open source DFIR tools that I've seen/used are either written in either Perl or Python, so it's high-time I learned one of those languages.
Finally, if there are (larger than normal) gaps in posting, it is because I am studying for my SANS GCIH re-certification. Without realizing it, I took my GCFA class outside of the window where I could have used it for my GCIH re-certification credits. Fortunately, I really like the material in the GCIH, and I put much of it into practice. It's been fun to read the updated manuals and go through the DVD with new and updated software.
Firstly, I've been getting
While I started my post-college career in software development, specifically COBOL, I figured it was time to learn a scripting language. Currently, I write many of my auditing tools using vbscript, however, it is not portable across multiple platforms. After thinking about it for a while, I've decided to teach myself Python; so there could be some Python posts in the future. Many of the open source DFIR tools that I've seen/used are either written in either Perl or Python, so it's high-time I learned one of those languages.
Finally, if there are (larger than normal) gaps in posting, it is because I am studying for my SANS GCIH re-certification. Without realizing it, I took my GCFA class outside of the window where I could have used it for my GCIH re-certification credits. Fortunately, I really like the material in the GCIH, and I put much of it into practice. It's been fun to read the updated manuals and go through the DVD with new and updated software.
Thursday, February 9, 2012
Ovaldi error message: missing MSVCP100.dll
I downloaded the new version of Ovaldi.exe the other day, version 5.10.1.1. After ensuring that I had the correct definition file, I kicked off a scan on a Windows 7 machine. Rather quickly, I received the following error message:
I would love to hear any ideas to solve this. I don't see the DLL in the zipped up package, and I don't know if this is a DLL typical to Windows 7 machines. Googling the DLL did not yield any obvious solutions. For the time being, I rolled back to the 5.9.1 schema, but I would like to use a newer version.
February DISA and Mitre updates
I received an email the other day that DISA has released a draft of the Internet Explorer 9 STIG. Comments need to be submitted by 21 February.
Further, while updating my Oval definitions today, I noticed two definition files I had not seen before: XP Media Center Edition and XP Tablet PC edition. They might have been there a while, but it is the first time I have seen them. (And in reality, I have not come across those editions in the DoD world, yet.)
Further, while updating my Oval definitions today, I noticed two definition files I had not seen before: XP Media Center Edition and XP Tablet PC edition. They might have been there a while, but it is the first time I have seen them. (And in reality, I have not come across those editions in the DoD world, yet.)
Subscribe to:
Posts (Atom)
