security Archives - The Silicon Underground

Home » security

How bad is MS08-067?

Dave Farquhar security January 31, 2019January 27, 2019 0 Comment

If you’ve worked in security, or worked with security professionals, chances are you’ve heard about MS08-067. If the discussion was between security and another department, chances are it was a heated discussion. Just how bad is MS08-067? Are the security professionals exaggerating?

MS08-067, a Microsoft patch released on October 23, 2008, fixed the last really reliable remote code execution bug in Windows operating systems. All Windows NT-based operating systems prior to Windows 7 and Windows 2008R2 were susceptible to this vulnerability out of the box. It was an out-of-band release.

What is an Out of Band Network?

Dave Farquhar security January 9, 2019January 5, 2019 0 Comment

I had a discussion with a client last week that brought up the topic of out of band networks. Out of band networks are a good security measure for reducing risk. But what is an out of band network, and what can it do for you?

An out of band network is a separate network, separate from your main network that carries production data. It is a good practice to put management interfaces such as IPMI on an out of band network and require separate authentication to access the network. This allows you to provide access to necessary functionality while reducing the chances of people misusing or abusing it.

Can you listen to cell phone calls with a scanner?

Dave Farquhar security December 12, 2018February 11, 2019 0 Comment

Can you listen to cell phone calls with a scanner? Can someone listen to your cell phone calls with a scanner? Depending on who you are, I have good news and bad news.

It’s always been possible to listen to analog cell phone calls with a cheap police scanner. But since modern cell phones, including smartphones, are digital, you can’t listen to those calls with a scanner. It requires costlier equipment like a Stingray device, or something similar that grabs the digital signal and decrypts it. That limits cell phone snooping to government agencies and other people with huge budgets.

Patch management best practices

Dave Farquhar security October 31, 2018November 19, 2018 0 Comment

If you’re looking for the least popular people in any given company, the people who push patches probably rank high on that list. I pushed patches for a living for nearly a decade, so I know. I was good at it though. Let’s talk about patch management best practices.

Merge CSV files with header in Windows, OS X and Linux

Dave Farquhar security October 15, 2018October 13, 2018 0 Comment

I do a lot of work with CSV files, sometimes very large CSV files, for a living. And sometimes it’s not practical, or possible, to do what I need to do entirely in Excel. Merging files is an example. So here’s how to merge CSV files on various platforms from a command line so you can get it done quickly and efficiently.

Nessus false positives

Dave Farquhar security October 8, 2018September 30, 2018 0 Comment

Dealing with false positives is a fact of life for a vulnerability analyst. So here are some tips for investigating and dealing with Nessus false positives from a system administrator turned vulnerability analyst. Read more

How secure is Chrome?

Dave Farquhar security September 27, 2018September 22, 2018 0 Comment

How secure is Chrome? While IT professionals may be divided on it, most security professionals I know prefer and recommend it. There are a number of good reasons for that.

PIF file type meaning

Dave Farquhar Retro Computing, security September 17, 2018September 15, 2018 0 Comment

When it comes to file types you should never trust, PIF belongs high on the list. PIF used to be an important file type, but it’s largely obsolete today. But if you’re curious, here’s the PIF file type meaning.

Get ready for a trip down computing history lane. But this once-important file format is risky today. In all honesty, it’s largely outlived its usefulness in most instances.

Are PDF files safe to open?

Dave Farquhar security September 12, 2018September 8, 2018 0 Comment

Are PDF files safe to open? It depends. Don’t you hate when security people say things like that?

There are risks involved with PDF files, but you probably also can’t avoid PDFs entirely. So here’s what you can do to work with PDF files safely.

Cyber security and cryptography

Dave Farquhar security September 11, 2018November 27, 2018 0 Comment

Cryptography is one of the more difficult concepts to master when studying for a certification like CISSP. I know from my own experience it’s really easy to let the details overwhelm you. After seeing an acquaintance’s Linkedin post, I thought I’d write about cyber security and cryptography and what you really need to know.

Let me start with one thing. I have never, ever had to encode or decode anything by hand. I’m very confident I can stay employed another 20 years in the cyber security field and never have to do the math myself.

← Previous