Security related posts I wanted to share...

• Chris over at Carnal0wnage has a great post on "Metasploit at WMAP"
  


• Larry over at Pauldotcom has a good post on "Creating Custom Wordlists For Password Brute Forcing"
  


• Engadget has a post on "IEEE 1667 pledges secure portable storage for all"


• DVLabs has a post on "MindshaRE: Utilizing PyDbg Within IDA"


• Kees Leune on "Tips for getting started in information security"

Keeping 3rd party apps up-to-date on Windows.

Today version 1.0 of Secunia Personal Software Inspector was released. You can download it free for personal use here. I have been using PSI since RC1 and I?ve blogged about it on my other website. If you are running Windows and have installed more applications then Microsoft Office you want PSI. PSI pickups up where Windows Update leaves off. Once you install PSI it will scan your system for applications including MS Office and Windows Patches. When it has a list of the applications installed it will tell you which, it any have updates are available. It even makes it easy to download and install them.

We all know that Windows has its security problems but the majority of Windows attacks are through 3^rd party software not typically the host OS. So you can have a secured Windows install but your system can still be exploited if you?re running a vulnerable version of Yahoo! Messenger or other 3^rd party application.

Now PSI doesn?t track every application but it covers most of them. Again with security it?s all about mitigating risk. If PSI helps you to update one application on your system, then you have just eliminated one more attack vector. PSI is free for personal use so please give it a shot I?m sure you will like it. I would suggest that you run it only when needed. The program can run as a services and monitor your applications real-time but that can be a waste of system resources. I usually run a scan of my system whenever I get a Windows Update alert or install new software which is about bi-weekly.

If you have a business and would like to install PSI on all your clients they have a solution called NSI 2.0 which is the same thing as PSI but in an agent form so that you can manage multiple machines from one host. This version does cost ?20.00 per computer.

If your using PSI or NSI I would like to get your feedback in the comments.

Off the AVG bandwagan.

I was a fan of AVG for a few years. I'm not really into all the "signature" based security stuff but I don't want to be infected by some old virus and have it killed my box. My happy medium was that I would use the best "free" anti-virus I could and leave it at that. Well I decided to give an end-point security solution a try. More on that in another post but before I removed AVG I did an update and ran the full scan of my C: drive for grins. The next morning I checked the results and no problems found. So I uninstall AVG and installed one of the two end-point solutions I've wanted to trial. After installing the first, I downloaded all the updates and started a full scan of my C: drive again with the end-point solution. Later that day I came back to find over a 16 viruses, and 4 spyware programs on my system. Most were false positives, being that I installed them (security research) but a few were the real deal. After cleaning my system I tried to think about what this result could mean.

• AVG isn't as good as I thought?


• AVG "restores" some of the viruses it removes after you uninstall it? I doubt it but...


• The new "Genetic Heuristic" technology works better then I thought?


• My system is totally screw with or without Anti-Virus? Highly probable.

After the latest issues in the news with AVG removing "critical" files from Windows host forcing a recover/re-install. I was happy I jumped off that wagon when I did. I'm still trialing the first security suite for another 4 days. After the first trial is over I'll start the next trail before giving my review. So my question is do you really get what you pay for? If I pay for the full version of AVG would that have found all the viruses it missed in the free version? Also do you use any anti-virus or end-point security and if so how do you like it. Please post in the comments your feedback.

Thanks for your continued support!

I wanted to take a moment to thank all of the supporters of Nicholson Security.  All the revenue generated (Adsense & Amazon) by this site goes back into the site and pays for the hosting and bandwidth needed to make this site available.  The site is still very young and very much a work in-progress.  I have a lot of plans for the site in the future.  More plans then it seems time but I do what I can.  I do want to let you know your support is appreciated and it also helps to keep me motivated. 

I have been contacted by some asking if they can make donations (both equipment and money).  I am looking into what the legal ramifications are of that now.  I am also looking into setting up a PayPal "donations" button.  For those that are interested in me consulting, I am looking into that as well and will post the details when I have them worked out.

Thanks for your continued support!