Security Archives | systemBash

Firesheep Should Be A Call To Arms For System, Network & Web Admins

/

October 25, 2010

Firesheep by Eric Butler has just been released to the world. This Firefox plugin does a few things that have already been fairly easy to do for a while, but rolled up in one easy to use package:

Sniffs data on unencrypted Wireless Networks
Looks for unencrypted login cookies sent to known popular insecure sites
Allows you to login to that account with 'One Click'

So what sites are impacted by default? Amazon.com, Basecamp, bit.ly, Cisco, CNET, Dropbox, Enom, Evernote, Facebook, Flickr, Github, Google, HackerNews, Harvest, Windows Live, NY Times, Pivotal Tracker, Slicehost, tumblr, Twitter, WordPress, Yahoo, and Yelp are among the few. A plugin system allows anyone to add their own sites (and cookie styles) to the plugin. Yikes! It goes without saying that this is a major security problem for anyone who uses unencrypted wireless networks. Includes on this list are many universities and companies such as Starbucks.

Google Adds Two-Factor Authentication To Google Apps (For Real, This Time)

September 20, 2010

I'm not trying to say I had anything to do with Google adding…

Essential FourSquare Anti-Stalking Security Tips

10 Comments

/

February 2, 2010

Currently I am in the Computer Science Master's Program at West Chester University and I am focusing my research on Location Based Updates in Social Media and their societal and security implications. So you can say I think about this topic more than most normal people do. FourSquare is a growing service that allows you to "Check in" to restaurants, grocery stores, museums and just about any place you can imagine. However, I have seen several of my friends checking in to locations which, I must say as a security research student, set off warning bells. Although I am calling out FourSquare specifically, these also apply to just about any other location based software where you broadcast your location to other folks, whether they are your friends or the general public. GoWalla and BrightKite are in the same boat. Without further ado... here is my list of top FourSquare Security Faux Pas (after the break...)