YubiKey – One-time Password and Authentication Device

Saturday, April 26th, 2008

It works seamlessly with any hardware and operating system combination supporting USB keyboards such as Windows, MacOS, Linux and others. The Key generates and sends unique time-variant authentication codes by emulating keystrokes through the standard keyboard interface. The computer to which the Key is attached receives this authentication code character ...

WordPress 2.5 Cookie Forging Explained

Saturday, April 26th, 2008

WordPress 2.5.1 came out recently. It includes a critical security fix for a cookie integrity bug that would allow an attacker to impersonate other users, including WordPress admins, by manipulating the contents of an HTTP cookie. Whenever I read about a vulnerability predicated on the user identity being embedded ...

Wireless Security Gets Boost From New Round of Products

Wednesday, April 16th, 2008

Wireless security vendors used last week's conference here to showcase both the problems and solutions in controlling access to wireless voice and data. AirTight Networks launched SpectraGuard Online, touted as wireless security's first manifestation of the software-as-a-service (SaaS) model that more vendors -- and a few cyber criminals -- are using.  In ...

Why Small and Medium Enterprises don’t use 802.1x

Wednesday, April 16th, 2008

With JJ blogging about 802.1x, I thought it would be timely to talk about why I think small and medium sized enterprises (SMEs) do not and probably never will deploy 802.1x for wired networks. I make a point of meeting with customers whenever I can. Amongst the small and medium ...

sqlninja 0.2.2 Released – SQL Injection Tool

Tuesday, April 15th, 2008

Sqlninja is a tool targeted to exploit SQL Injection vulnerabilities on a web application that uses Microsoft SQL Server as its back-end.  Its main goal is to provide a remote shell on the vulnerable DB server, even in a very hostile environment. It should be used by penetration testers to ...