Great look at Google Datacenter Security

This is a great video done by Google that shows some of the security measures that are in place protecting their vast datacenter network.

Requested iPhone 5 features

My top hoped for features in an iPhone 5:

1.) Dual Core Processor - The new Android powered Motorola Atrix, and Droid Bionic will both be sporting new dual core processors.  I think an iPhone with a single core, isn't going to fly.
2.) HDMI out
3.) Full Hardware Encryption
4.) MicroSD Card Slot
5.) Tighter Google Voice integration

Facebook SSL Rolling Out

First, I apologize for not posting to this blog in the past year it seams. I have been moving quite a bit of my daily blogging, internet posting, over to Twitter. I have decided to make atleast a monthly entry here covering IT security, virtualization, or some other IT Infrastructure related topic.

Today, I wanted to let folks know that the new HTTPS Security feature in Facebook appears to be rolling out today. At about 2:00pm EST I was able to enable HTTPS browsing for Facebook whenever possible. Why is this important? Well, unless you have been sleeping under a rock you have heard of the released firefox plugin called firesheep. Now, the information gathering that firesheep is now doing, is not new. It is however new that a utility like this can be downloaded and ran by Joe User with very little effort. Through this utility, an average computer user sitting on an unencrypted wifi hotspot, or somewhere upstream of your internet connection can easily sniff and and gain access to your login credentials to various social networking and other non-https sites.

As facebook rolls this option out, it will be available to you under Account - Account Settings - Account Security Settings.

All you have to do is check the box, and click save. This will then force Facebook to use HTTPS where ever possible. Please understand that this may BREAK a few apps that you use within facebook. I would suggest not using those apps going forward, however you can go in and uncheck the box to use those apps, and then simply check the box again to turn it back on. Your information will then be vulnerable once again while the box is unchecked, and you are using these insecure apps.

Good Luck

Snow Leopard - 30 day Review

Well, it's been a few weeks since Snow Leopard was released publicly. I purchased my copy in advance, and had it ready to install on the 28th. There is only one problem. Not many vendors were ready to support their software on it. Normally, i would just take the plunge, and give it a try, but not this time. I utilize PGP's WDE product. It isn't supported under Snow Leopard. Sure, I could just decrypt, and run without it, but in my mind the risks are too great. Without a bootup password on Apple products, WDE is my only defense when it comes to protecting my data in the event it is stolen.

I can't wait much longer :) I am an Entourage user, and totally hate it. It's the worst app by far. I am really looking forward to Apple Mail / Calendar integration with Exchange!

Getting Rid of an old Computer - Tips

So, you just got this spankin fast computer for Christmas, and you are wondering what to do with that old machine. There are tons of options from donation to recycling, but lets take a moment to go through some personal security issues that arise from discarding old machines.

Unless you never used your machine to check your bank account, do a family budget, or put any other kind of any personal information, you can just donate away. But most of us, actually used the machines to assist with the daily tasks of managing personal information, including accessing our banks websites, doing our taxes, etc. These tasks, even when we "delete" files, still leaves quite a bit of obtainable information behind.

For this reason, before you get rid of any computers I always suggest that you run a DBAN on it. DBAN is short for Darren's Boot and Nuke. It basically writes over the drive several times to prevent any data that was previously on the machine from being recoverable. The DBAN utility is available freely for download from the internet.

RIM issues security patch for BES 4.1

For all of you iPhone haters out there, RIM has security issues too.

http://news.cnet.com/8301-1009_3-10141507-83.html?part=rss&subj=news&tag=2547-1_3-0-5

Checkpoint to buy Nokia Security Appliance Business

http://news.cnet.com/8301-1009_3-10127973-83.html?part=rss&subj=news&tag=2547-1_3-0-5

For those of us that have been Checkpoint administrators, or worked with their products on the IPSO platform, this is huge news. It leads me to lots of questions..

1.) What happens to IPSO? Will they keep it around? I for one that that IPSO added quite a bit of value that SecurePlatform (SPLAT) by Checkpoint lacked in a Security Operating System (SoS).
2.) What happens to the Edge devices? I for one would be happy to see them go. They always seemed to be totally underpowered, and management upgrades of the devices was always a dicey proposition.
3.) If IPSO isn't part of the deal... As I believe Nokia uses it on a couple other devices to deliver products like their SSL VPN, Mobile Web Caches, etc, what happens to the folks that are running IPSO / FW-1 clusters today?

Lots of questions, few answers. But I do believe that this is definitely a good thing for Checkpoint. I don't know what Nokia is getting out of the deal other than some badly needed cash.

WPA Cracked? Maybe not as bad as reported!

Just in the past few weeks, the headlines have been going by. Each of them stating in big bold black letters that WPA has been cracked, and that everyone is at risk. So naturally, from that headline it would seem that WPA has gone the way of WEP. This couldn't be any further from the truth. There are probably a couple of reasons for this.

1.) Encryption is a complicated subject, of which maybe 10% of all people actually understand the inner workings.
2.) WPA Cracked, is a much more attention grabbing headline than, hackers can inject very small packets onto your QOS enabled TKIP network.

So my point is, that yes TKIP, the protocol used in the WPA standard has some weaknesses, that have been breached. How big is the breach, well you can decide. Here's a rundown on the attack as I understand it.

1.) The attacker uses the Chop/Chop method of attack to the CRC or ICV portion of the packet. This is very similar to the previous WEP hacks. TKIP was actually born out of WEP, with several improvements bolted on.
2.) This is where it gets complicated. Once you have learned the ICV, your next target in the packet is the MIC portion. Through some MIC spoofing protections built into TKIP, an attacker has to wait 12 whole minutes before they can get a workable MIC.
3.) Through the use of the RC4 cipher, which is the cipher used in TKIP, as opposed to AES128 with CCMP in the WPA2 standard, an attacker can take the good MIC and ICV to inject packets onto the network. There is another TKIP protection that also defends against replay protection. Most routers won't be susceptible to these attacks. The gotcha occurs in routers with QoS enabled. Replay protection is still in affect, however its on a channel by channel basis.

So the bottom line of this hack, is that a hacker could inject very small packets onto your wireless lan. They can not decrypt your payload, yet. Does this mean that TKIP is totally unsafe for corporate or home use, probably not. But what it does mean, is that its days are officially numbered.

Mac OSX Update Today

10.5.4 was released today.  Its about 60 mb or so.  Looks like about 13 security updates, and some other patches.  CNET has a great breakdown of the patches, as well as the Apple Support site.  Still no iPhone 2.0 software, maybe tomorrow!