Elamb Cybersecurity

Category: Main Digg

  • How To Completely Clean Your Hacked WordPress Installation

    An excellent step by step guide helping you to completely clean out and restore a WordPress installation that has been hacked.

    Getting hacked sucks, plain and simple. It can affect your rankings, cause your readership to be exposed to virus and trojan attacks, make you an unwilling promoter to subject material you may not actually endorse, and in many cases cause the loss of valuable content. However, once it happens it is usually best to not procrastinate on the clean up process, since a speedy restore will most times minimize the damage that was caused.

    While almost all sources will recommend that you upgrade your WordPress to the latest version, what the majority neglect to tell you is that in most cases simply doing so will not prevent the attackers from getting back in, even if there are no known exploits with the latest version. The hackers may have left a back door file hidden in a directory where it wouldn’t get overwritten with an upgrade, or inserted code into your theme, or simply created an account that they then granted admin privileges to. Any one of those would allow them back in, even after you patched what was wrong the first time. Therefore I am providing this step by step process on how to completely clean out and restore a WordPress installation that has been hacked.

    read more | digg story

  • The Value of a (Ethical Hacker) Certification

    Ok, I admit it. I have totally slacked off on getting that CEH certification. I’ve had the boot camp, I’ve amassed lots of great books and resources, I’ve even talked to some people who have passed it, but I still haven’t been consistent about studying. For a while I was pretty consistent. I read the Official Study Guide and started working on an Unofficial one.

    Why don’t I have that cert yet? I suppose I just don’t feel I have a reason to have it. It would just be for show because I don’t really do pen testing. ’d like to, but in my job, I don’t usually have the opportunity to do it or reason to do it. I’ve already got the CISSP so I don’t need the CEH for some kind of prestige. Many hackers piss on certifications they are not impressed with them and are willing hurt anyone who flashes the credentials. The CISSP trumps most certification. The only real benefit for me getting it is that it would force me to get more familiar with tools like netcat and Snort which I don’t use enough. I am interested in cyber kung fu. Lately, I have been more drawn to the scientific and mathematical side of technology.. the side where the innovation are born, not just mastered. I’ve been sharpening up my math skills and plan on getting into Computer Science, Electrical Engineering or physics.

    I haven’t decided whether I want to take the CEH because I want to do something that has more depth. I suppose I could complete the CEH, go through Computer Science and specialize in security/crypto/info assurance and follow in the foot steps of Bruce Schneier and Steve Gibson. In the beginning, certifications were definitely a step up, but I’m in a place now where they are just ornaments, flashy bobbles I could decorate my name with when I need an ego boost. If my wife and kids are giving me lip I can say, “don’t you know I am a CISSP, A+, B, C, D, E, F, G. You MUST respect my awesome test taking ability!”

    I’ve said it before, I think certifications can be of great value. If you work for the Department of Defense in IT you pretty much MUST have one (per DoD 8570). Certifications can give you that extra edge against competing employees in the private sector. Problem arise when the IT certifications value is taken out of context. Like the 8570 which makes it mandatory to have a certain certification regardless of your experience and/or degrees. That is a bit much. Not everyone who passes the CISSP can configure a firewall properly. But perhaps thats the reason the DoD wants system specific certification.

  • New Trojan Leverages Unpatched Mac Flaw

    A tool for exploiting an unpatched security hole in Mac OS X systems has been developed and until earlier today was being distributed through an online forum that caters to Mac hackers, Security Fix has learned.

    I agree with digg user, powerofthor:
    I would never wish a virus on anyone, but I have gotten pretty tired of Mac users bragging about the invulnerability of Macs to infiltration. The thing about it is, Macs until recently have simply not had the market share to justify an attack. Yes, their virus defense is also strong, but it seems relatively untested.

    read more | digg story

  • The rise of “intelligent” CCTV

    I think its great that we have better technology in security. What is disconcerting are laws like the Patriot Act and FISA bill which take right from citizens for the sake of more security. With this increased technological power in security, there needs to be more balance, but it seems the rights of citizens (particularly privacy and civil liberties) are taking a back seat to all manor of political will. All this powered by the fear of terrorism after 9/11.

    I’m not saying we should not be more cautious or more aware. I’m not saying that more security is not necessary. What I am saying is that Taking away liberties is not necessary. And even if you feel it is necessary to spy on all citizens indefinitely to “catch terrorist” shouldn’t there be checks and balances on the watchers. Who will watch the watchers? How will we ensure that their powers are not abused.

    New Technologies:
    Smart CCTV – There are now smart security cameras with pattern recognition that allow them to alarm when some one does something suspicious such as climb a fence, or put down a bag and walk away. That technology has been developed by companies like ObjectVideo Inc. Defense Advanced Research Products Agency (DARPA) hopes to take it a step further by creating systems that can learn everyday patterns and send alarm when things are outside of their known pattern, also known as anomaly detection.

    http://govtsecurity.com/mag/fighting_terror_technology/

    read more | digg story

  • What Privacy Policy?

    Company security and marketing executives differ on how to handle customer data.

    Companies are in the business of selling your personal information. You that little Privacy Statement that your credit card company send to you. If you read the fine print, they are usually telling you that they are about to send your personal information to their “partners” an/or third party organizations unless you send them a written document to opt out.

    I got one from Dexonline once. The law seems to favor these corporations, because it can be difficult to get off of all these lists. Its like a Anti-Privacy Virus. Once one company has your data, they send you information to there third party partners (with your silence as permission) then the third party vendors attempt to sell you an item and do the same thing (with your sheep like compliance) and so on. Pretty soon your personal information is on 10 or 20 revolving marketing lists.

    I’m not opposed to some solicitations, but US law is pretty flimsy on the privacy of individuals. The CAN-SPAM act is just no enough anymore. Consumer should have to sign-up not just opt-out in written form via mail. But what happens is that companies like Comcast, AT&T, Visa, Master Card and many, many others put their right to give out your information right in the USER Agreement (which nobody reads). Since there are few alternatives that protect your privacy, they don’t feel any pressure to side with your privacy. By law, they have to provide a method of opt-out prior to selling your information, but like I said, I don’t think its enough.

    Local government privacy is even worse, I’ve been reluctant to write about it because I fear that I will make it easier to for more bad guys to do bad things just because they can.

    read more | digg story

  • The Most Powerful Computer on Earth

    IBM’s latest supercomputer crunches numbers at enormous speeds–and will soon be put to use for nuclear warfare.

    read more | digg story

  • Why Global Hackers Are Nearly Impossible to Catch

    They’re in our computers, reading our files. The Chinese government, that is, according to two U.S. Congressmen who recently accused Beijing of sending hackers to ferret out secret documents stored on Congressional computers. The Chinese deny any involvement, but if they were lying, would we be able to prove it?

    read more | digg story

  • A Kidnapped AdWords Account

    This is the story of Russell, whose AdWords campaigns fell prey to a phishing scam.
    Seemingly out of the blue, Russell one day noticed how a lot of odd, likely spammy campaigns had been set up in his account though.

    “While the email may look official at first glance to those who don’t know about the concept of phishing – Russell didn’t – those who do know about it will have a symphony of alarm bells ringing by now. In this email, it is not important what the mail claims to be; it claims that it’s an “official notification from Google AdWords that the service(s) listed below will be deactivated” unless the person renews them “immediately.” The email also claims to be sent from the address customersolutions–ysm@google.com. But these things can be faked; what is more important is the URL that shows when you hover over the link in question that will take you to the login form. In this case, Russell tells me the URL reads:

    yms-words.com/adwords/select/Login.htm”

    read more | digg story

  • Podcast: DIY Career in Ethical Hacking

    Remodeling your career for little to no money down with the Editor of The Ethical Hacker Network, a free online magazine for security pros. Podcast and slide deck available with practical exercises, links to free stuff and real-world actions to take right now to advance your career in this new and exciting field.

    read more | digg story

  • Neuromancer

    Physicists, mathematicians, futurists and sci-fi writers are the ne0-prophets of our time. Einstein, Max Plank, William Gibson, Georg Cantor are the new world prophets determining the probable future transfinite realities among absolute infinity.

    Neuromancer is an example of probable futures. It is THE work of fiction by William Gibson that popularized the cyberpunk genre. In the book, Gibson actually coined the phrase cyberspace and the matrix, a multi-diminsional virtual reality that allows users to jack their brain directly into the cyberspace.

    Case is a hacker is hired to do the biggest hack ever. The book is brilliant. Some of my favorite characters are Molly, the assassin, who looks like this:
    Molly, neuromancer
    William Gibson himself

    and Wintermute, the corporation/Artificial intelligence and Maelcum A member of Zion, a Rastafarian space station community.
    Neuromancer the book

    A year here and he still dreamed of cyberspace, hope fading nightly.
    All the speed he took, all the turns he’d taken and the corners
    he’d cut in Night City, and still he’d see the matrix in his
    sleep, bright lattices of logic unfolding across that colorless void. . .

    Its such a brilliant piece of work that I am surprised it hasn’t been made into a movie yet.