Re: [Full-disclosure] New Laptop Polices
I was always under the impression that BIOS security features could always be circumvented. See further comments below... -r - Original Message - From: J. Oquendo [mailto:[EMAIL PROTECTED] To: Bob Radvanovsky [mailto:[EMAIL PROTECTED] Cc: "Cullen, Michael" [mailto:[EMAIL PROTECTED], full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] New Laptop Polices > Bob Radvanovsky wrote: > > You mean the fact that you are *erquired* now to *check* your laptop along > with your baggage? Take into account that most laptops aren't easy to > remove the hard disk drives, and that most laptops of corporate and/or > government executives contain either sensitive or classified information, I > don't seriously think that the UK government, nor its corporations, have > taken into consideration all of the consequences involved. Take for example > the ongoing issues of laptops mysteriously disappearing (esp. the Veteran's > Administration...I lost count, how many has it been, 5 times?) that contains > spreadsheets and/or databases that contains *private* information. > > > > You're confusing two things here. What one corporation and their > policies concerning securing information have to do with his initial > question is obsolete. I'm under the impression of his message he didn't > mean the safety of his data. But in case he did then he needs a lot of > reading to do going back in time to days of the rainbow series books. You may be right, but I was confused as to what his objectives were here, of which, one of the more important aspects should be "data security", so this raises a *whole* can 'o worms. > > The UK needs to consider the implications about *how* they will cover the > loss of financial, sensitive or classified information... > > > > > I don't believe (again) this was his initial question, whether or not > the officials in the airline industry give a rats rear of whether or not > corporate/private data is secure. True, a moot point. > > Just my 2 cents worth, which by today's standards doesn't even get you a > piece of gum any more...sad, isn't it? > > > > -r > > > > P.S. I think that corporations now need to state that corporate > executives should NOT have corporate data on their hard disk drives; further > locking down corporate assets. I think that they should make it easier for > the removal of hard disk drives to be removed so they aren't stolen. > > > > > And you hope to accomplish this how? I can agree that data needs to be > minimized but there are plenty of options available to completely lock > down any laptop from the BIOS on up so I fail to see what you were truly > hoping to state. Actually, wasn't there a mention about a self-destructing DVD just recently? This would be worthwhile to investigate into, or the other idea about imaging the laptop in case it's stolen or damaged during transport. > > > J. Oquendo > http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 > GPG Key ID 0x1383A743 > Fingerprint: > 7B02 28CF 24D3 ACA7 9907 789A 8772 7736 1383 A743 > 26:0608031813:J. Oquendo::fNaE6zH/HDTggYKS:005zLMj > > sil . infiltrated @ net > http://www.infiltrated.net > > > The happiness of society is the end of government. > John Adams > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] New Laptop Polices
You mean the fact that you are *erquired* now to *check* your laptop along with your baggage? Take into account that most laptops aren't easy to remove the hard disk drives, and that most laptops of corporate and/or government executives contain either sensitive or classified information, I don't seriously think that the UK government, nor its corporations, have taken into consideration all of the consequences involved. Take for example the ongoing issues of laptops mysteriously disappearing (esp. the Veteran's Administration...I lost count, how many has it been, 5 times?) that contains spreadsheets and/or databases that contains *private* information. The UK needs to consider the implications about *how* they will cover the loss of financial, sensitive or classified information... Just my 2 cents worth, which by today's standards doesn't even get you a piece of gum any more...sad, isn't it? -r P.S. I think that corporations now need to state that corporate executives should NOT have corporate data on their hard disk drives; further locking down corporate assets. I think that they should make it easier for the removal of hard disk drives to be removed so they aren't stolen. - Original Message - From: "Cullen, Michael" [mailto:[EMAIL PROTECTED] To: full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] New Laptop Polices > Greetings all, > > > > Given the new threats and the change in policy with the airlines and > traveling in and around the UK, has anyone changed their laptop and > portable computing device policy? We are being questioned about the > safety of executives traveling with their laptops. > > > > > > Thank You, > > > > Michael Cullen > > Global Security, Universal Music Group > > 818 286-5473 (w) | 818 919-6974 (c) > > UMG GSO Michael (aim) | UMG.GSO.Michael (gtalk) | > [EMAIL PROTECTED] (msn) > > The information contained in this message may be privileged and > confidential and protected from disclosure. If the reader of this > message is not the intended recipient, or an employee or agent > responsible for delivering this message to the intended recipient, you > are hereby notified that it is strictly prohibited (a) to disseminate, > distribute or copy this communication or any of the information > contained in it, or (b) to take any action based on the information in > it. If you have received this communication in error, please notify us > immediately by replying to the message and deleting it from your > computer. > > > > > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Free "Microsoft" USB FOB!!!
Microsoft is on the marketing warpath to promote legitimate licensing of their operating system, Windows(tm). Fill out the necessary junk, get a free USB flash FOB -- probably 32 MB -- but who cares -- IT'S FREE!!! You'll need a Microsoft Passport account and valid USPS address. Got a Hotmail(tm) account? That should work here, too. ;)) Here's the URL link, along with the questions (and their answers): Free USB drive! It’s probably only 32MB or something stupid, but I though I’d share anyways. Just click on the “Valuable Information” link to the right, and use the answers below. http://www.microsoft.com/mysterysolved/corp Here are the answers to the four questions: Q1. How many ways are there to obtain a full Microsoft® Windows® Desktop license? Answer:: 2 Q2: Volume License Agreements cover Windows Desktop operating system upgrades only. Answer: True Q3: OEM operating system licenses are non-transferable. Answer: True Q4: The most cost-effective way to acquire an initial, full underlying Windows Desktop license is preinstalled. Answer: True Good luck -- and enjoy!!! -rad ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] reduction of brute force log
Yeah...I didn't see that. I thought those were ports. My bad... :(( - Original Message - From: Joachim Schipper [mailto:[EMAIL PROTECTED] To: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] reduction of brute force log > On Tue, Feb 28, 2006 at 10:52:27AM -0600, Bob Radvanovsky wrote: > > I am going to test these rules out -- this looks REALLy good! > > But...I've got just ONE question: why on Earth would you permit > > ICMP??? > > (Outgoing) echo requests and port-unreachable responses (to UDP > packets), just to name a couple. > > Source quench and redirect are both powerful, but also more than a > little dangerous to allow. > > > And what significances are ports 50, 51, 1599, 1600 and 1601? 443 and 80 > are HTTP-S and HTTP (respectively), 123 is NTP -- I realize that, but what > are these others ports used for? > > We are talking about IP *protocols* 50 and 51, which are ESP and AH - > the IPsec protocols. > > The 1599-1601 ports are used to open/close the ssh port, as explained in > the article linked. > > This firewall configuration should work as advertised. Of course, > restricting logins to public key authentication should work, and has the > added advantage that one does not try to login from yet another > keylogger-infected Windows box. > > Joachim > > > -r > > > > *filter > > :INPUT ACCEPT [0:0] > > :FORWARD ACCEPT [0:0] > > :OUTPUT ACCEPT [0:0] > > :RH-Firewall-1-INPUT - [0:0] > > -A INPUT -j RH-Firewall-1-INPUT > > -A FORWARD -j RH-Firewall-1-INPUT > > -A RH-Firewall-1-INPUT -i lo -j ACCEPT > > -A RH-Firewall-1-INPUT -s 10.0.0.0/24 -j ACCEPT > > -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT > > -A RH-Firewall-1-INPUT -p 50 -j ACCEPT > > -A RH-Firewall-1-INPUT -p 51 -j ACCEPT > > -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > > -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m > recent --rcheck --name SSH -j ACCEPT > > -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j > ACCEPT > > -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 123 -j > ACCEPT > > -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j > ACCEPT > > -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1599 -m > recent --name SSH --remove -j DROP > > -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1600 -m > recent --name SSH --set -j DROP > > -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1601 -m > recent --name SSH --remove -j DROP > > -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited > > COMMIT > > > > > > - Original Message - > > From: Matthijs van Otterdijk [mailto:[EMAIL PROTECTED] > > To: full-disclosure@lists.grok.org.uk > > Subject: Re: [Full-disclosure] reduction of brute force login attempts via > SSH through iptables --hashlimit > > > > > > > I haven't tried this myself, and I don't know if it is already > suggested, > > > but this should stop all the pesky scriptkiddies from filling up your > logs. > > > Might prove to be a better solution, who knows: > > > http://aplawrence.com/Security/sshloginattack.html > > > > > > Matthijs > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] reduction of brute force log
I am going to test these rules out -- this looks REALLy good! But...I've got just ONE question: why on Earth would you permit ICMP??? And what significances are ports 50, 51, 1599, 1600 and 1601? 443 and 80 are HTTP-S and HTTP (respectively), 123 is NTP -- I realize that, but what are these others ports used for? -r *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Firewall-1-INPUT - [0:0] -A INPUT -j RH-Firewall-1-INPUT -A FORWARD -j RH-Firewall-1-INPUT -A RH-Firewall-1-INPUT -i lo -j ACCEPT -A RH-Firewall-1-INPUT -s 10.0.0.0/24 -j ACCEPT -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT -A RH-Firewall-1-INPUT -p 50 -j ACCEPT -A RH-Firewall-1-INPUT -p 51 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --name SSH -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 123 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1599 -m recent --name SSH --remove -j DROP -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1600 -m recent --name SSH --set -j DROP -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1601 -m recent --name SSH --remove -j DROP -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT - Original Message - From: Matthijs van Otterdijk [mailto:[EMAIL PROTECTED] To: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] reduction of brute force login attempts via SSH through iptables --hashlimit > I haven't tried this myself, and I don't know if it is already suggested, > but this should stop all the pesky scriptkiddies from filling up your logs. > Might prove to be a better solution, who knows: > http://aplawrence.com/Security/sshloginattack.html > > Matthijs > > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] complaints about the governemnt spying!
See comments below. -rad - Original Message - From: "Dave Horsfall" <[EMAIL PROTECTED]> To: "Full Disclosure List" Sent: Friday, December 30, 2005 3:12 AM Subject: Re: [Full-disclosure] complaints about the governemnt spying! > On Thu, 29 Dec 2005, Stan Bubrouski wrote: > > > > "They that can give up essential liberty to obtain a little temporary > > > safety, deserve neither liberty nor safety." (Jefferson, 1759). > > > > That's actually a Benjamin Franklin quote, which is worded about 1000 > > different ways depending on the source. > > The above is close; the main points are "essential liberty" and "a little > temporary safety". In your example case of aphorisms, you are correct. One is from over 200 years ago, the other less than 40. > In the meantime, perhaps some, umm, US patriot could tell me who authored > these particular aphorisms: > > "The tree of liberty must be refreshed from time to time with the blood of > patriots and tyrants." This was quoted from General Hummel (actor Ed Harris) from the movie, "The Rock", and was a paraphrased quote from Thomas Jefferson (http://www.monticello.org/reports/quotes/liberty.html) > "The Tree of Islam has to be watered with the blood of martyrs." This was quoted from the Ayatollah Khomeini in the late 70's/early 80's, probably just before the uprising within Iran. > I'm having trouble seeing the difference. > > -- Dave, who is not pro-US, so therefore has to be anti-US, according to Shrub > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
