facebook rss twitter

Infosec 2008 round-up

by Scott Bicheno on 24 April 2008, 17:28

Quick Link: HEXUS.net/qamu3

Add to My Vault: x

Software and piracy

On the software side we spoke to Application Security Inc, which specialises in protecting corporate databases from cyber-foulness.

Toby Weiss, the CEO, told HEXUS.channel: ‘The attack vector has shifted. Hackers have realised that the real money is in targeting databases.’ As you can imagine, these are apparently a rich source of information to assist ID theft, money laundering, etc.

The product is called DV Protect and customers include Visa and Carphone Warehouse. It’s an American company and they’re over here to expand their European business, all of which is done through the channel.

There was one comical moment when they showed us a PowerPoint presentation and we asked if we could have a copy. They said yes and we offered them our flash drive. They pointed out that they had no idea what kind of cyber-filth it might contain and thus they would be mad to just stick it into their laptop. An amusing school-boy error on our part, considering the setting.

We also sought out Verisign to find out a bit more about Extended Validation SSL, having recently written about it on HEXUS.channel.

Our chat essentially boiled down to the fact that consumer confidence in ecommerce has been eroded and better security for online financial transactions is needed. In the case of EV SSL, this takes the form of the browser address bar going green when it is in effect.

Lastly, here’s a stand with part of a rudimentary pirate ship sticking out of it.



HEXUS Forums :: 1 Comment

Login with Forum Account

Don't have an account? Register today!
I don’t think Hexus committed a schoolboy error by offering an unknown USB stick. If his laptop was running a fully patched and secure OS, then Toby Weiss (CEO of Application Security Inc) could have inserted and USB device into it with impunity. (Unless you had put superglue on it or suchlike).

Of course any flavour of windows cannot be considered a secure OS for USB devices, because if you plug a USB device into windows which it does not recognise, then windows will ask the USB device if it has windows drivers, and if it does it will install them without prompting the user. There is a well know hack where someone builds a USB device that looks like an ordinary thumb drive but is not. When the victim plugs it into a windows PC it offers a trojaned device driver and the PC is 0wned. Usually it will then present a filing system with some files so as not to arouse suspicion. Needless to say Linux and MacOS computers are not vulnerable.