Category Archives: Constant Alertness

We are putting millions of dollars of library materials into the hands of people trained to believe that MP3s and everything else should be free. We give them all the late hours unsupervised. What is wrong with this picture?

Krack’d WPA2…and now, ROCA

KRACK Wifi bug logoWPA2 is the most common protocol used for protecting WiFi signals from being used by nefarious people for horrible things. As of 16 October, WPA – and all  its variants of WPA1, WPA2, personal and enterprise, including with TKIP, AES and GCMP – is officially broken. Until repairs are made to all equipment involved in a WiFi network – that means, equipment providing the signal and equipment using the signal – it is no longer a valuable security tool. The force is called KRACK = Key Reinstallation Attacks

[……]

Read more

Krack’d WPA2…and now, ROCA

KRACK Wifi bug logoWPA2 is the most common protocol used for protecting WiFi signals from being used by nefarious people for horrible things. As of 16 October, WPA – and all  its variants of WPA1, WPA2, personal and enterprise, including with TKIP, AES and GCMP – is officially broken. Until repairs are made to all equipment involved in a WiFi network – that means, equipment providing the signal and equipment using the signal – it is no longer a valuable security tool. The force is called KRACK = Key Reinstallation Attacks

[……]

Read more

Remote Access VPN Appliances Buyer’s Guide

Enterprise Network Planet has a nice write up by Lisa Phifer of Core Competence on the nuance of VPN appliances for your network. Read the entire article at: Remote Access VPN Appliances Buyer’s Guide: – www.enterprisenetworkingplanet.com

There is a nice summary that follows after the fold, but read the two page document when your staff is giving you solutions, to compare reality with hope for your DCinema network.

 

[……]

Read more

Russian Scriptor Targeting Macs?

Krebs on Security has made contact with crimeware kit developers and salespeople who say that they have a Firefox and Chrome for Mac OSX webkit. ‘Weyland-Yutani’ Crime Kit Targets Macs for Bots

So, yet again we wonder if our Macs need protection. At best most of us are careful about social engineering scams. At worst these are very clever attackers who can take advantage of users who feel too secure. 

 

[……]

Read more

Update Everything Month~! Software Vulnerability Records

October 2010 has had record numbers of updates in core programs from Windows to OSX, in Adobe Products and in Java (now owned and managed by Oracle.) Firefox, Opera, RealPlayer, you name it, Security Vulnerabilities is the new black…now white.

Security Vulnerabilities was a code word, of course. It was a nice way of saying, “A bad guy could create an object in the code of a site that would tickle a hole in the software on your computer, and make it – your computer – do one or more things.”
[……]

Read more

Current Security Updates – 09/09

Charles Flynn Reports: Security Updates Abound

Please let us know if you see updates that we should inform the community about. This is what we have had recently:

Let’s take a look at those patches in Firefox 3.5.3, since 3.5 was released:

Security Advisories for Firefox 3.5

Impact key: [The circles and arrows looks prettier on the original site – link above – Ed]

[……]

Read more

Deadly pings for Cisco routers and switches

[caption id="attachment_155" align="alignleft" width=""]H Security LogoNo No; Not my Cisco?~!!![/caption]22 August 2009 | A bug in the Firewall Services Module (FWSM) software allows Cisco routers and switches to be disabled by a series of crafted ICMP packets. Catalyst 6500 series switches and Cisco 7600 series routers equipped with a Firewall Services Module are affected. All FWSM software versions 2.x, 3.x and 4.x without the specific fix for this bug are vulnerable. In a security advisory, Cisco states that processing ICMP packets can lead a processor to use all available execution threads, with the result that the system will not forward any further packets. The FSWM itself is then no longer available remotely and, if configured for failover operation, the failover may also fail.

[……]

Read more