Wired covers the BBC show Bang Goes The Theory's designs to defeat acoustic weapons like the LRAD and other systems used to help protect cruise ships and for crowd control. As the article points out, simply defending from non-lethal systems may make users more of a target. Does this mean we'll see pirates attacking cruise ships while wearing giant fishbowl sound dampening helmets? Only time will tell...
Details has Albert Talton's story online - he produced over 7 million dollars in counterfeit bills using commodity hardware. An interesting story, and a great lesson about how even the Secret Service can have problems finding counterfeiters, and how easily some of our currency protections can be avoided. Talton's process was ingenious, if flawed - he used the same scan for every bill, making them easier to identify. In the end, a series of mistakes, including those made by those he recruited to help him resulted in his capture.
Creative Commons attribution licensed image courtesy AlexWitherspoon
Many of the usual security sites have picked this story up - ZDNet's Ryan Naraine covers Alfredo Ortega and Anibal Sacco's discovery of vulnerabilities and issues in CompuTrace LoJack for Laptops. The duo, both from Core Security Technologies, explain that the BIOS level theft recovery tool can be exploited allowing a persistent compromise. The fixed strings used in the program for remote connections make it an easier target - and worse, because it is a common security program, compromises of it pose an even greater threat - Naraine notes that it is whitelisted by AV vendors, meaning that in many cases a compromise may go unnoticed.
As a security professional, I now have to ensure that we track whether laptops are shipped with a BIOS level recovery tool, and I need to work with our desktop support staff to make sure that another utility gets patched. Since this ships on many laptops, we may not even be aware of its existence in many cases.
Is it a major threat? Probably not. Is it worth watching and preparing for? Quite probably. For now, I'll check our major vendors default installs so that I can advise the appropriate management members.
The Water Gate turnstile replacement that Yanko Design covers makes an interesting use of human psychology to make a turnstile that allows greater access and better response to emergencies. This looks like something that Bruce Schneier would appreciate. It gives up the ability to lock, preventing easy access, but has its own advantages.
Engadget, via OS News reports that the HardwareUpdaterTool for Apple keyboards can be used to make them into a keylogger. The video is a simple demonstration, but I know that most environments I'm in don't check their keyboard firmware versions and checksums. As our input devices become smarter, we may have to think about how we can keep their firmware and memory safe too.
McAfee's ePO central AV management tool can be quite useful. Today, however, it threw me for a bit of a loop when I logged in to find this:
Note the current DAT I have, and the DAT that ePO claims is current. The good news? If I can keep this up, I can really stay ahead of those pesky viruses.
