As always malware and mass infections is a numbers game so the bad guys will always target the most popular and prolific operating systems to increase their chances of widespread infections.

For me personally UAC in Windows Vista was simply a pain in the ass, so much so I just turned it off completely as did most people rendering it completely ineffective. They seem to have toned it down in Windows 7 to make it less invasive and perhaps as a byproduct have made it less effective.

A researcher at Sophos reports putting Windows 7’s User Account Control feature to the test and finding the technology failed to block numerous pieces of malware. Microsoft, however, stresses that UAC is only one part of Windows 7’s security.

A researcher at Sophos called the UAC feature in Windows 7 ineffective after numerous pieces of malware snuck by the technology in a test.

Microsoft first introduced User Account Control in Windows Vista to improve security. After some users complained the number of alerts it generated were annoying, the company pledged to cut down on the number of prompts in Windows 7. The move however has raised concerns in the security community, and Sophos Senior Security Adviser Chester Wisniewski said his test proves Microsoft took it a step too far.

Wisniewski wrote on his blog Nov. 3 that seven of the 10 pieces of malware he tested ran with the default AUC enabled in Windows 7 without generating any prompts. As part of the test, no antivirus software was installed on the system. Two of the malware samples did not work in Windows 7; of the remaining eight, only one generated a prompt, and that one still would have been installed had the user clicked yes, Wisniewski told eWEEK.

I’d imagine it only throws an alert if the software being installed tries to modify system files or place itself in system directories (c:/windows etc).

That would make sense to me, and yes it would make it ineffective against malware and even more ineffective when the bad guys work out how it functions and adapt to that.

Nothing much new here though is it, run anything on Windows XP and you’ll get no warnings..so just be vigilant. I’d rather Microsoft try an educate people on good security practice rather than trying to implement half-arsed technical measures to protect against wetware ignorance.

When asked about the test, Microsoft officials pointed to the other features of Windows 7 that have improved security.

“Windows 7 is built upon the security platform of Windows Vista, which included a defense-in-depth approach to help protect customers from malware; this includes features like Security Development Lifecycle (SDL), User Account Control (UAC), Kernel Patch Protection, Windows Service Hardening, Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP),” a spokesperson said.

“Windows 7 retains all of the development processes, including going through the Security Development Lifecycle, and technologies that made Windows Vista the most secure Windows operating system ever released,” the spokesperson added. “Coupled with Internet Explorer 8—which includes added malware protection with its SmartScreen Filter—and Microsoft Security Essentials, Windows 7 provides flexible security protection against malware and intrusions.”.

All the above technologies are great and they do help a LOT when it comes to exploitation of vulnerabilities and trying to execute shell-code. But that’s not the biggest threat, the biggest threat is idiot users installing malware ‘by accident‘ on their own computers.

So yes, however obvious it may seem to us – you still need to install Anti-virus software on Windows 7.

Source: eWeek

RATS scanning tool provides a security analyst with a list of potential trouble spots on which to focus, along with describing the problem, and potentially suggest remedies. It also provides a relative assessment of the potential severity of each problem, to better help an auditor prioritize. This tool also performs some basic analysis to try to rule out conditions that are obviously not problems.

As its name implies, the tool performs only a rough analysis of source code. It will not find every error and will also find things that are not errors. Manual inspection of your code is still necessary, but greatly aided with this tool.

Requirements

RATS requires expat to be installed in order to build and run. Expat is often installed in /usr/local/lib and /usr/local/include. On some systems, you will need to specify –with-expat-lib and –with-expat-include options to configure so that it can find your installation of the library and header. Expat can be found here.

You can download RATS here:

Source Code: rats-2.3.tar.gz
Windows Binary: rats-2.3-win32.zip

Or read more here.

I hope a new project can spawn from this, it has many interesting applications. I think it’d be a good addition to Wireshark and IDS projects like Snort.

http://opendpi.org/

Deep packet inspection (DPI) hardware can identify an astonishing array of protocols passing across the Internet—up to and including protocols that are rare even to us in the Orbiting HQ (Gadu-Gadu? Manolito? Feidian?). But if you’ve ever wondered just how this can be done, and done at wire speed, wonder no more: Europe’s leading DPI vendor has open-sourced a version of its traffic detection engine.

OpenDPI.org is the new home for ipoque’s open source project; anyone interested can take a look at the code or contribute patches. The goal in this case, though, isn’t so much about crowdsourcing product development but about easing consumer fears about DPI technology.

Klaus Mochalski, CEO of ipoque, explains that “transparency was important for us from the beginning. The lack of transparency from the vendors’ side is widespread in the DPI business. Our thoughts are a bit different and that is why we decided to push this project.”

It can identify a whole range of weird and wonderful protocols including those you’ve never heard of.

The free version is basically a watered down of the commercial product, it’s slow, doesn’t come bundled with some fancy supercomputer grade hardware and can’t handle encrypted transmissions.

I think it will be useful too for people building open source router systems to manage traffic, do traffic shaping and general QoS with much more accuracy (rather than relying on port classification).

The OpenDPI engine, released under the LGPL license, differs from ipoque’s commercial scanning engine in its high-priced DPI hardware. The open-source version is much slower and (more importantly) doesn’t reveal ipoque’s methods for identifying encrypted transmissions. DPI vendors all claim high levels of success at identifying such traffic based on the flow patterns and handshake signatures common to protocols like BitTorrent and Skype, even if they cannot crack the encryption and examine the content of those transmissions.

ipoque apparently wants to convince people that its detection code doesn’t store or examine the actual content being transmitted. The company made the same point in a white paper released last week. “DPI as such has no negative impact on online privacy,” it says. “It is, again, only the applications that may have this impact. Prohibiting DPI as a technology would be just as naive as prohibiting automatic speech recognition because it can be used to eavesdrop on conversations based on content.

Although DPI can be used as a base technology to look at and evaluate the actual content of a network communication, this goes beyond what we understand as DPI as it is used by Internet bandwidth management—the classification of network protocols and applications.”

I hope they keep developing the project, or some other folks in the Open Source community step up and turn it into a full blown development fork.

That would be great, harness the existing technology and improve on it.

Because let’s face it, any commercial company releasing an Open Source branch of their software has no incentive to make it that great lest it get better than the stuff they are selling.

Source: Ars Technica

If you asked any techie back in 2002 which AV should you use, the answer would invariably be AVG free (or perhaps Panda).

After that AVG just got bloated, slow and their signature files became very weak missing a lot of nasty infections, I had to fix so many PCs running AVG that were infected up the ass with all kind of malware.

People starting recommending other like Avast!, Avira and BitDefender which also offer free use versions for home use.

AVG is putting an emphasis on increased speed with a revamp of its free and paid for security suites.

The latest revamp – AVG 9.0 – boasts 50 per cent faster speed and increased ease of use. Improvements in speed have been achieved by skipping the scan of files already marked as safe in future scans unless the file structure changes. The approach also offers claimed improvements of ten to 15 per cent for boot times and memory usage, respectively.

The firewall module in AVG 9.0 has also been redesigned to be less intrusive (ie fewer ‘Do you want to allow this application online’ questions) alongside tighter integration with the anti-malware scanner that forms the core of the product. This anti-malware scanner makes greater use of behaviour-based, cloud-based and white-listing technologies.

I haven’t tested AVG 9.0 yet as the free version isn’t being released until later this month, but if it stands up to their claims it could be a good product.

Speed and bloat is definitely something they need to work on along with a more accurate scanning engine and complete signature files.

Let’s hope it’s not all just hype.

AVG Free 9.0 will be available mid-October. Details of the features are being held back until then, but expect to see a cut-down product based on the same engine but without a firewall and other bells and whistles. Based on past form, AVG free will offer an anti-malware scanner alongside LinkScanner safe search technology.

AVG’s business model relies on selling into small business and getting a percentage of consumer users of its free product (perhaps around two per cent) to upgrade. The consumer end of this equation is severely threatened by Microsoft Security Essentials launch.

Recommendations from tech savvy friends were one of the main reasons consumers latched onto AVG in the first place. AVG lost a lot of goodwill in this area with the traffic-spewing fiasco that attached to version 8.0 of its security scanner.

Secondly, irrespective of the technical merits of its product, AVG is facing off against Redmond’s marketing muscle while at the same time hunting for a new chief executive.

Microsoft Security Essentials is definitely a huge entry barrier for them and they will need to push hard to gain back a decent market share. There are some extremely good AV products out there now and a lot more choice for consumers.

Plus of course the big fat behemoths are still out there bundling their software with OEMs (Symantec, McAfee etc).

We shall see if it stands up to the tests of real world use.

Source: The Register

Samhain has always been one of my favourites, before that of course I was using Tripwire like everyone else.

The Samhain open source host-based intrusion detection system (HIDS) provides file integrity checking and logfile monitoring/analysis, as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes.

It has been designed to monitor multiple hosts with potentially different operating systems, providing centralized logging and maintenance, although it can also be used as standalone application on a single host.

Samhain is a multiplatform application for POSIX systems (Unix, Linux, Cygwin/Windows).

Features

• PCI DSS Compliance
• File integrity checks
• Host integrity monitoring
• Logfile monitoring/analysis
• Log facilities
• Integration with other systems / Active response

You can download Samhain here:

samhain-current.tar.gz

Or read more here.

Usage

Graudit supports several options and tries to follow good shell practices. For a list of the options you can run graudit -h or see below. The simplest way to use graudit is;

graudit /path/to/scan

You can download Graudit v1.1 here:

graudit-1.1.tar.bz2

Or read more here.

Features

• Injection of packets with bogus data and with randomly selected bad TCP cksum or bad TCP sequences
• Userland binary(tsctrl) for controlling trafscrambler NKE
• SYN decoy – sends out number of SYN pkts before the original SYN pkt
• TCP reset attack – sends out RST/FIN pkt with bad sequence
• Pre-connection SYN – sends out SYN with wrong TCP-checksum
• Post-connection SYN – sends out fake SYN after connection establishment
• Zero Window – send out pkt with “0” window set.

You can download Trafscrambler 0.2 here:

trafscrambler-0.2.tgz

Or read more here.

Especially internal Windows LAN setups with a domain, for Linux I always felt there were better choices – but as far as Windows went LANguard was my choice.

Fairly recently GFI released version 9 of their scanner (overview here) with improvements to the scanning engine and the interface (including the monitoring dashboard which gives you a good heads-up of the scan results).

One of the big positives for me with LANguard was the ability to detect patch levels and automatically roll out patches over the network. This makes it a very comprehensive solution, the recent versions also include checks to ensure 3rd party software such as Anti-virus solutions are also up to date (full features here).

It’s as easy to install and get up and running as ever, if you do have any issues the Installation Guide is here [PDF].

Getting started with a scan is as easy as clicking 1 button, the interface has been simplified from what I remember and it’s a lot more attractive than it used to be. In fact it’s simple enough that non-security IT folks could use it without much problem.

After a scan is complete you have a choice to Analyze or Remediate. The Analysis section will give you fairly detailed instructions on any vulnerabilities found (including a vulnerability level) and full system information including shares, patch levels and so on.

The Remediate section will inform you of missing patches and allow you to apply these. Other than the standard MS patches and service packs you can also deploy 3rd party applications and uninstall rogue software.

Most things in the scanner can be scheduled too so for example if you want to scan outside of office ours or roll out software/patches at the weekend you can set LANguard to do that.

The dashboard is a nice addition which gives you an overview of the network security and the changes in vulnerabilities over time.

It also comes with the generic network utilities like Whois, DNS Lookup, Traceroute & SNMP Walk.

All in all I think it’s a great tool, especially for those managing Windows based networks. It makes your life a LOT easiest and it makes it easier to manage patches and software across the Domain.

It’s not a hardcore security tool, which means it also appeals to people more in the Sys Admin & Network areas of the industry. If you have any Windows machines do give it a look, perhaps start with the free version below.

You can download the latest version here:

GFI LANguard 9 Download

Pricing is done on a per-IP basis with prices starting from around $32USD per IP for a 10-24 IP block.

There is also a FREE version available here:

GFI LANguard 9 5-IP Freeware edition

Included are Symantec’s Norton Anti-virus, Kaspersky Anti-Virus 6.0, F-Prot, IBM Proventia and Clam Antivirus.

Once an occasional inconvenience, serious security bugs and vulnerabilities in anti-virus and security suite products are growing into hardy perennials. Once, running Windows anti-virus was like driving down a dual carriageway. These days, it’s more like an unpaved road.

Last week alone bought a confirmed snag with anti-virus products from Kaspersky Lab and a reported oddity with an update Norton anti-virus from Symantec. Elsewhere an allegedly long running flaw in anti-virus scanner from F-Prot was published for the first time. The Kaspersky bug had the potential to result in serious annoyance. The other bugs are less serious and individually don’t amount to much, but collectively, they’re enough to make you reach for an Ubuntu installation CD or start looking on eBay for a Mac.

First up, let’s consider a misfiring definition update for Kaspersky Anti-Virus 6.0 for Windows Workstations, which sent users into pop-up hell. It was issued on 31 March, and it wasn’t resolved until 2 April.

The worst one in my opinion is the Kaspersky problem, because it’s their own fault? How can a company with so many users, pushing out automatic updates have such poor quality control?

Pushing out an update that messes up a users machine and not fixing it for 3 days is enough to stop using a product for me.

Elsewhere reports on Norton’s support forums on Saturday (4 April) suggest a Symantec update killed right click menu on PCs running Windows Vista. We brought the thread to Symantec’s attention earlier this afternoon and wait the security giant response to the odd, not to say bizarre, reported glitch with interest.

Moving on past glitches there’s also straightforward security vulnerabilities to consider. A flaw in F-Prot involving the scanning of Zip files allegedly creates a possible method to circumvent anti-virus protection. Security researcher Thierry Zoller, who discovered the vulnerability, went public with the flaw on 2 April after F-Prot failed to act for a reported four years.

Zoller also published two other advisories last week, each covering problems with enterprise products and scanning archived files. Malicious RAR archives might make their way past IBM Proventia email security appliances, according to Zoller. He published a limited details advisory after not hearing from IBM for a month. IBM is reportedly investigating the issue.

Clam AntiVirus, the open source anti-virus toolkit for UNIX, which is used to scan email on mail gateways for Windows viruses, also had a problem with RAR files. That problem was plugged late last month but only publicised by Zoller with an advisory last week.

Even the popular Linux/UNIX solution Clam Antivirus didn’t escape testing throwing up a bug when scanning RAR files. I’m surprised AV still has such problems with RAR/Zip and compressed files.

We worked out long ago if you made a batch script to make an almost infinite loop of zip files (zip within zip within zip etc) you could bomb out the CPU totally on most AV e-mail gateways.

I hope 10 years later they aren’t still having the same problems.

Source: The Register

This software aims in assisting automated auditing, software patch management, vulnerability and malware scanning of Unix based systems. It can be run without prior installation, so inclusion on read only storage is no problem (USB stick, cd/dvd).

Lynis assists auditors in performing Basel II, GLBA, HIPAA, PCI DSS and SOX (Sarbanes-Oxley) compliance audits.

A lot of new checks and controls have been added in this latest release (Full Changelog). Do note Lynix is not a hardening tool, it won’t make any changes – only suggestions.

Intended audience:
Security specialists, penetration testers, system auditors, system/network managers.

Examples of audit tests:

• Available authentication methods
• Expired SSL certificates
• Outdated software
• User accounts without password
• Incorrect file permissions
• Firewall auditing

You can download Lynix 1.2.6 here:

lynis-1.2.6.tar.gz

Or read more here.