dnlongen

So, plugging in a malicious USB storage device can not only execute malicious code, but can do it with elevated privileges.

Can it be done on a locked PC or must a user be actively logged in? I presume the former, as I don't believe the mounting process requires the PC to be unlocked.

When one's profession involves network security, sometimes it helps to capture network communication to analyze. For about $10 in parts, you can easily build a network tap to capture traffic anywhere on your network for analysis or for an IDS.

Step by step instructions for either removing Flash Player, or updating it and setting it to "click to play" (ask you before playing Flash content). Critical in light of the Hacking Team breach and the Flash exploit now being used to spread Cryptolocker malware.

Central Texas suffered a catastrophic flash flood during Memorial Day weekend; this article looks at the disaster response, and draws some lessons that apply to all sorts of incident response, whether cyber, IT infrastructure, or natural disaster.

+1 for a thorough walkthough.

I'm not quite ready to +1 the idea though. It's intriguing, but seems to open a user up to abuse. Unsolicited messages (email, SMS, IM, DM, Facebook, etc.) are a popular way of phishing (tricking individuals into giving away private information). One tip security pros repeat over and over is not to click on unsolicited links.

While you say customers will only provide payment information to a company they trust, what is to keep a crook from impersonating a trusted vendor and tricking a customer into paying them instead of the actual company?

I'm all for convenience when done safely, and perhaps your business model accounts for this - I'm just curious what you have done to prevent SMS-based payments from turning into a source of fraud.

Port-mirroring would work for any traffic that traversed the smart switch ... I actually tried that at one point, but it's somewhat limited:

> If the smart switch is on the LAN side of the router, then I only see traffic from wired devices on the LAN and miss anything from wireless clients.

> If the smart switch is on the WAN side of the router, then I see any traffic destined for the Internet, but now the Pi has to account for NAT (everything coming back from DNS has a destination of my router's WAN interface).

There are a couple of shortcomings in the current approach. I'd welcome suggestions for how to improve this. The problems I see are:

1. The alert tells me the IP address of the offending computer or device, but not the domain name that was requested. I have Snort configured to store each packet that triggered an alert, and can use tcpdump to analyse the packets - but that's a bit of a pain. Do any readers know of a way to include payload fields from a DNS packet in the alert message?

2. I've identified 4 specific "warning page" DNS responses, but OpenDNS owns far more addresses that they may use for other conditions now or in the future. At a minimum, OpenDNS owns the ranges 67.215.64.0/19 and 204.194.232.0/21 -- all told, about 10,000 addresses. Snort supports matching IP ranges in CIDR notation for the source and destination, but my approach currently does a binary match in the payload. Do any readers have an example of a Snort rule that parses DNS packets into their component fields?

Rather encouraging to see mainstream media describe hacking accurately: "...insights about how various systems worked — and in some cases could be made to do things their creators never intended. This is the essence of hacking. It is not inherently good or evil. It can be either, or in some cases a combination of both, depending on the motives of the hackers."