Security News

Unless you were at Black Hat on Feb. 28, you probably woke up safe in the assumption that if a rootkit hit your system, reimaging would remove it. You probably also thought that the best way to search a PC's volatile memory, or RAM, was by grabbing it with a PCI card or a FireWire bus.

You were wrong.

At the Black Hat Briefings here on Jan. 28, two breakthrough hardware hacks were demonstrated. One shocker was Coseinc Senior Security Researcher Joanna Rutkowska's demonstration of a way to subvert system memory through software—in essence, the shattering of our long-held belief that "going to hardware" to secure incident response is a security failsafe.
Security professionals at the show called it the "attainment of the holy grail," particularly since the only way to fix the system's memory corruption is to reboot—thus erasing all tracks of the subversion.

Security Breach
Auditors rap DOE's computer disposal methods.
The Energy Department’s Inspector General, Gregory H. Friedman, has found fault with the Idaho National Laboratory’s technical procedures for removing restricted nuclear data and confidential data from old computers.
Vendor Censorship
Lawsuits, patent claims silence Black Hat talk.
A planned talk on RFID security by a security researcher has been pulled from this week's Black Hat Federal security conference after secure card maker HID claimed the talk violated the company's patent rights and threatened to take legal action against Chris Paget, the researcher, and IOActive, Paget's employer, if the talk went forward.
Exploits & Alerts

Milkeyway Captive Portal versions 0.1 and 0.1.1 are vulnerable to many SQL injection and XSS vulnerabilities. Detailed POC included.

 vCard 2.x suffers from multiple cross site scripting vulnerabilities.

DMA[2006-0313a] - Apple OSX Mail.app RFC1740 Real Name Buffer Overflow exploit.

Gallery version 2.0.3 and below stepOrder remote command execution exploit.

Coppermine Photo Gallery <= 1.4.3 remote commands execution

 
Programming today is a
race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. 

            ~ Unknown
 

Solutions

Network Penetration Testing
Corporate Governance Auditing
Data Center Engineering
Disaster Recovery Planning
Secure Hosting Solutions
Forensics & Intrusion Recovery
Secure Server Design
Asset Analysis & Data Protection

USDN Press Coverage
 10.26.2006 - Data Centre News - Read News Story

IntruGuard Devices Partners With USDN To Provide Managed Security Services And Channel Sales
IntruGuard Devices, Inc., a leading supplier of distributed denial of service (DDoS) firewall security appliances, has announced a partnership with USDN Network Security, a leading IT infrastructure auditing and managed security provider. This alliance will allow USDN to deploy, configure, and manage IntruGuard’s Intrusion Gateway family of DDoS Firewalls for USDN’s customer base. This combination of the industry’s only dedicated hardware based DDoS Firewall with split-second response to a variety of intrusions and USDN’s expert security services will further offer clients enhanced broad based security.

 12.31.2005 - 2005 CSI/FBI Computer Crime Survey
USDN is pleased to announce the completion of upgrades at our
Las Vegas data center. New redundant layer 3 switches were installed along with all new power distribution units to more than triple our previous hosting capacity. USDN would like to thank all our server hosting customers for making this expansion possible.
 10.05.2005 - USDN Launches it's Secure Server Hosting Service.

USDN is pleased to announce our new colocation service that not only provides you with the very best in physical security but adds to that a menu of other managed security services to protect your hosted data and keep your online presence secure.
Some of the features include: Various space sizes and configurations to meet individual customer's needs with additional features such as redundant connections and active intrusion response systems.