<?xml version="1.0" encoding="UTF-8"?>

<rss version="2.0" xmlns:blogChannel="http://backend.userland.com/blogChannelModule">

<channel>
<title>Security forum - dslreports.com community</title>
<link>http://www.dslreports.com/forum/security</link>
<description>Security forum current topics</description>
<language>en</language>
<copyright>Copyright 2007, dslreports.com</copyright>
<pubDate>Sun, 27 Jul 2008 00:51:42 EDT</pubDate>
<lastBuildDate>Sun, 27 Jul 2008 00:51:42 EDT</lastBuildDate>

<image>
<title>dslreports.com</title>
<url>http://i.dslr.net/bbrdisc1.gif</url>
<link>http://www.dslreports.com</link>
<width>19</width>
<height>18</height>
<description>bbr disc</description>
</image>

<item>
<title>NIS/NAV 2009 Beta is out and its blazingly fast !!</title>
<link>http://www.dslreports.com/forum/remark,20794140</link>
<description><![CDATA[I didn't have a whole lot of time to play with it, but it installed in around 30 seconds!

Get it at http://www.symantec.com/norton-beta]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,20794140</guid>
<pubDate>2008-07-15 11:20:43</pubDate>
</item>

<item>
<title>PCFlank tests</title>
<link>http://www.dslreports.com/forum/remark,20854546</link>
<description><![CDATA[Hello all

Anyone know why my all my tests at this site come back with a "Too many connections" error.
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,20854546</guid>
<pubDate>2008-07-26 22:24:39</pubDate>
</item>

<item>
<title>Avoid DNS poisoning?</title>
<link>http://www.dslreports.com/forum/remark,20847361</link>
<description><![CDATA[Since my wife continues to do online banking, and in light of the current DNS bugs, I am wondering if it would be a good idea to create a shortcut that links to her banking site using its IP address, instead of its name.  Would this be an extra layer of protection?

Thanks]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,20847361</guid>
<pubDate>2008-07-25 11:58:59</pubDate>
</item>

<item>
<title>Inconsistent DNS test results with Comcast</title>
<link>http://www.dslreports.com/forum/remark,20851916</link>
<description><![CDATA[I've read that Comcast has been patched for the DNS vulnerability, but when I repeatedly run the test at https://www.dns-oarc.net/oarc/services/dnsentropy it can show 4 or 5 various DNS servers, some of which show up as Poor or Unknown.  

The test at http://www.doxpara.com/ shows the same 4 or 5 DNS servers, and says Your ISP's name server has other protections above and beyond port randomization against the recently discovered DNS flaws.

Is Comcast considered to be OK now?

Thanks]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,20851916</guid>
<pubDate>2008-07-26 11:07:54</pubDate>
</item>

<item>
<title>Avira FP</title>
<link>http://www.dslreports.com/forum/remark,20848430</link>
<description><![CDATA[Hi
With the latest updates (July 25) AVIRA now flags "SPYWAREBLASTER" as having "adspy/Spyblast adware".
This appears to be another FP ... just a warning.
Cheers  :D
--
The Endless]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,20848430</guid>
<pubDate>2008-07-25 15:19:50</pubDate>
</item>

<item>
<title>Using Kazaa P2P and security risks?</title>
<link>http://www.dslreports.com/forum/remark,20845936</link>
<description><![CDATA[Is there any risk in using Kazaa if I have the Kazaa software configured to block others from searching my PC files?]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,20845936</guid>
<pubDate>2008-07-25 01:37:12</pubDate>
</item>

<item>
<title>Banks using insecure practices - from SANS</title>
<link>http://www.dslreports.com/forum/remark,20853760</link>
<description><![CDATA[One pet peeve of mine has been those financial sites that have you log in on a page that isn't SSL. It basically, as the SANS description notes, reinforces bad user practices.

said by SANS newsletter :

 --Study: Banks Use Unsecure Practices on Websites
(July 22, 23 & 24, 2008)
Researchers at the University of Michigan found, in a 2006 study, that 76 percent of US banking websites have design flaws that could put customers at risk for data theft and fraud.  The research did not discover vulnerabilities in the websites, but instead focused on the practices banks use that inure customers to potential online dangers by reinforcing bad security habits.  

The problems lie in the fact that many banks are "condition[ing] customers to ignore potential clues about whether the banking site they're visiting is real" or phony. For example, many banks redirect online customers to third-party sites without informing the customers, place secure login boxes on unsecure pages, or use email addresses or Social Security numbers (SSNs) as default user names. 

Researchers plan to present their findings at a conference on Friday, July 25.  The research was conducted on the online websites of 214 US banks of all sizes.

http://www.msnbc.msn.com/id/25819973/
http://www.zdnetasia.com/news/security/0,39044215,62044110,00.htm
http://www.ns.umich.edu/htdocs/releases/story.php?id=6652
http://www.eecs.umich.edu/~laura/webusability/websites.html 
http://cups.cs.cmu.edu/soups/2008/program.html
http://cups.cs.cmu.edu/soups/2008/proceedings/p117Falk.pdf
[Editor's Note (Schultz): The proof is in the pudding, so to speak. Whether or not banks use secure Web site practices should thus be determined by the Web sites' resistance to attacks, not by design flaws found by outsiders.]
 

I'd disagree with editor's note in that the I believe the proof of the pudding is in whether or not user accounts are compromised by site vulnerabilities or as a consequence of designs that encourage users to trust sites without verification of their identity and transaction security before they enter sensitive information like account numbers, passwords and other information. 
--
The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -- Justice Louis D. Brandeis]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,20853760</guid>
<pubDate>2008-07-26 19:24:50</pubDate>
</item>

<item>
<title>Comments? LunarDownloader 1.01.99 (Software Update)</title>
<link>http://www.dslreports.com/forum/remark,20747013</link>
<description><![CDATA[Just noticed this on BetaNews. It's supposed update your security software/definitions. I am not sure if list of software is hardcoded into program or it scans for the software and adds it to the list.

Visit homepage for further info and details: http://lunarsoft.net/

]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,20747013</guid>
<pubDate>2008-07-05 21:10:18</pubDate>
</item>

<item>
<title>Another responsible disclosure issue - locks</title>
<link>http://www.dslreports.com/forum/remark,20852132</link>
<description><![CDATA[What should the security community have to say about disclosure of vulnerabilities of locks? Unlike computer systems, the users can't simply download and install patches and service packs, and some of the vulnerable locks are quite expensive to replace. I think that, in addition to vendor disclosure to users, the lock companies will need to implement exchange/upgrade programs to keep their customers protected. 

IMO, the internet is full of less-than-responsible disclosure "how to" information on locks, including Medeco and other supposedly high security devices.
This summer, hackers from around the world will be teaming up with lock picking and security experts to show the public exactly how insecure their locks are. Recent studies have proven that locks of all varieties (including so-called "high security" locks) can be compromised, some by persons with a minimal skill.
Article here. 
--
The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -- Justice Louis D. Brandeis]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,20852132</guid>
<pubDate>2008-07-26 12:07:05</pubDate>
</item>

<item>
<title>Exploit Code for Kaminsky DNS Bug Goes Wild</title>
<link>http://www.dslreports.com/forum/remark,20843454</link>
<description><![CDATA[From The Register
24th July 2008 -        quote:Security researchers have developed two working exploits that poison vulnerable domain name system servers, allowing attackers to redirect unwitting end users to impostor sites. What's more, the attack code has been added to Metasploit, a penetration testing tool used to test the security of computers and networks. The program, which is maintained by HD Moore, makes it easy for white hats and black hats alike to exploit vulnerable servers.

Some people have complained that Kaminsky's bug has been shamelessly hyped. We disagree. Should there be widespread exploitation of the flaw, the result would be chaos. Attackers could taint the machines relied on by millions of people. When they typed bankofamerica.com into their browser, they'd have no way of knowing whether they were being directed to the real site or one designed to steal their money. Trust on the internet, as flawed as it may be now, would completely break down.

Much of the attack code was written by |)ruid, a researcher from the Computer Academic Underground. According to Moore, it could be used like this:
1. Bad Guy probes the target DNS to see if it's vulnerable (a couple free services can do this)
2. Bad Guy picks a domain they want to hijack for users of that DNS Server
3. Bad Guy runs the bailiwicked_domain module and takes control of that domain in the cache of that server
At this point, anyone who uses that vulnerable DNS server is going to see the wrong DNS server record for the poisoned domain

The exploits are available here and here.

Currently, the exploits work only on caching servers used by ISPs and other large organizations, but Moore said they could be modified to work against client-side resolvers, which are used on desktop machines.

To test if your ISP's nameservers are vulnerable to this type of attack visit:
https://www.dns-oarc.net/oarc/services/dnsentropy
- and -
http://www.doxpara.com/ (click the button that says "check my DNS")]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,20843454</guid>
<pubDate>2008-07-24 16:40:00</pubDate>
</item>

</channel>
</rss>
