Caribou and Cardkey Door Control Systems

Caribou is a proof of concept exploit application that targets cardkey systems like the prox cards that you're likely familiar with from parking lots, apartment complexes, and possibly your entry access system at your employer.

Per the site and demo:

"By providing Caribou only with the IP address of the target cardkey device, a single-button "Unlock" will access the cardkey system, unlock all available doors in sequence, allow 30 seconds for entry, and then re-lock all those same doors. Caribou has the capability of performing a brute-force of any customized security PIN used with the system."

While the proof of concept code isn't provided, the speed with which is unlocks the door indicates that the keyspace for the pin is likely relatively small, and the author provides a series of tips on securing HOA and other common spaces that use devices of this type. The most important item is the common sense (but often ignored) need to place the entry access system on a private network so that it can't be brute forced via open wireless or wired networks.

Android Malware in the Android Marketplace - the dangers of free

Android Police today reports that 21 applications (which have since been pulled) in the Android market, with between 50,000 and 200,000 downloads included malware, with capabilities including the rageagainstthecage or exploid root exploits, and that they upload data including "product ID, model, partner (provider?), language, country, and userI". Worse, their analysis shows the ability to self update.

Most of these apps appear to have been copies of existing apps, made available for free. This points out both the danger of the relatively open Android Market, and of uncontrolled app downloads for your users.

The original article is worth a read, and includes a list of the malware laden apps.

Free Mac Antivirus from Sophos

I often recommend AVG to Windows users looking for a free antivirus product, but I haven't had a good recommendation for Mac users - until now.

Sophos makes their Mac Home Edition antivirus software available for free at http://www.sophos.com/products/free-tools/free-mac-anti-virus/

Sophos has impressed me in the past, and this looks like a very nice solution for Mac users.

Mac OSX 10.7 to include full disk encryption

Apple's recent developer preview announcement for 10.7 notes that it will include:

"the all new FileVault, that provides high performance full disk encryption for local and external drives, and the ability to wipe data from your Mac instantaneously"

This means that both Windows (BitLocker) and MacOS (FileVault) will have free, OS integrated full disk encryption.

How the President's Security Motorcade Works

Jalopnik links to The Atlantic's Marc Ambinder's great article on how the Secret Service handles a significant event, including details of how the motorcade is organized and run. For those who think about physical security, this is an interesting read including a diagram of each vehicle and its role.

Google Cache Prowling and Useful Firefox Security Plugins

I find that I often check Google's cache of sites that have been taken down, either as part of an incident investigation or to verify that data has been removed. One of the nicer ways to do this is using a tool like Jeffrey To's Google Cache Continue script.

This joins my toolbox of existing Firefox plugins such as:

• NoScript - script blocking
• URLParams - website get/post parameters
• Firebug - editing of pages, including Javascript variables
• FoxyProxy - a Firefox based proxy switcher that works very well with web app testing tools.
  
• IETab - to pop an IE tab into a Firefox testing session
• Leet Key - for Base64, Hex, BIN, and other transforms
• ShowIP - shows the current site's actual IP address, as well as enabling a number of other useful host lookup tools.
  

You can find a whole relation mapped list of Firefox plugins in the FireCAT listing - enjoy!

Security Humor: DMC-Eh?

A recent take-down notice (which was of course sent to the wrong address) contained what has to be one of the best typos I've ever seen in such a missive:

"Hereby we inform you that the material listed hereunder are of Phonographic nature and are deemed harmful to minors by many governments and non-governmental organizations."

We all knew the Internet was full of phonographic material, right?

Flickr Creative Commons attribution licensed image courtesy cristinabe