Posts

Firesheep Should Be A Call To Arms For System, Network & Web Admins

/
Firesheep by Eric Butler has just been released to the world. This Firefox plugin does a few things that have already been fairly easy to do for a while, but rolled up in one easy to use package:
  1. Sniffs data on unencrypted Wireless Networks
  2. Looks for unencrypted login cookies sent to known popular insecure sites
  3. Allows you to login to that account with 'One Click'
So what sites are impacted by default? Amazon.com, Basecamp, bit.ly, Cisco, CNET, Dropbox, Enom, Evernote, Facebook, Flickr, Github, Google, HackerNews, Harvest, Windows Live, NY Times, Pivotal Tracker, Slicehost, tumblr, Twitter, WordPress, Yahoo, and Yelp are among the few. A plugin system allows anyone to add their own sites (and cookie styles) to the plugin. Yikes! It goes without saying that this is a major security problem for anyone who uses unencrypted wireless networks. Includes on this list are many universities and companies such as Starbucks.

Google Adds Two-Factor Authentication To Google Apps (For Real, This Time)

I'm not trying to say I had anything to do with Google adding…

Essential FourSquare Anti-Stalking Security Tips

/
Currently I am in the Computer Science Master's Program at West Chester University and I am focusing my research on Location Based Updates in Social Media and their societal and security implications. So you can say I think about this topic more than most normal people do. FourSquare is a growing service that allows you to "Check in" to restaurants, grocery stores, museums and just about any place you can imagine. However, I have seen several of my friends checking in to locations which, I must say as a security research student, set off warning bells. Although I am calling out FourSquare specifically, these also apply to just about any other location based software where you broadcast your location to other folks, whether they are your friends or the general public. GoWalla and BrightKite are in the same boat. Without further ado... here is my list of top FourSquare Security Faux Pas (after the break...)

Social Media and the Downfall of the Password Reset Question

/
There have been a number of high profile account compromises…

Command Line Packet Sniff Existing Running Process in Linux

Have you ever come across a server that is doing a lot of traffic?…

Presentation on Hybrid Stealthy Networks - Wireless Ad Hoc Networks

/
I presented this paper to my class on March 17th, 2009. Hybrid…

Remote Desktop from Windows XP to Windows Server 2008 or Windows Vista

/
The Remote Desktop connection settings for Windows Server 2008,…