Category: Information Security

Mikrotik RouterOS Dynamic Update Script for OpenDNS

There is a need to provide some level of parent control and kids safe Internet access at home. Using OpenDNS is a easy and cost free solution.

To customize the web security filtering policies for your own case, you need to update home Internet public IP to OpenDNS so that the customized your policy will be applied. In a dynamic IP situation, it is essential to keep telling OpenDNS the latest correct Internet IP. Instead of install OpenDNS updater client on MAC/WIN/LINUX, we can use Mikrotik RouterOS scripts to update the IP directly.

Continue reading “Mikrotik RouterOS Dynamic Update Script for OpenDNS”

Mikrotik RouterOS work with Cisco Aironet AP

Background:

I have a spare Cisco Aironet 3702i but I do not have Cisco Wireless Controller to manage it. But I do like its wireless capability and I want it to replace ASUS RT-AC68U as home main wireless access point.

I also have a Mikrotik hex POE 960PGS router to provide both connectivity and power to surveillance camera.

I want to fully utilize the gears I have and just use a cost effective solution to achieve secure home wireless network.

Target:

  • Multiple SSIDs with different VLANs, different encryption and authentication methods
  • Each SSID network needs to be segregated with others
  • One SSID needs to be in the same subnet of local wired network

Continue reading “Mikrotik RouterOS work with Cisco Aironet AP”

Some Cyber Security tips

Trust Is Tops

  • Only use trusted apps or software.Download apps directly from trusted app stores such as iTunes and software from well-known sites. Be especially careful of apps or software you’ve never heard of or malware posing as legitimate apps. If you’re unsure if an app is legitimate, check the ratings and reviews in the app store. If it’s a major retailer and it only has one review or a low rating, it might be a copycat.
  • Don’t trust every search result.Just because you get dozens of search results for “free golf handicap spreadsheet calculator” doesn’t mean you should download each one to try them all.
  • Office documents and spreadsheets are notorious for hosting malware within embedded macros. If you frequent forums or communities of interest, ask what software others have used.
  • Beware of extras when installing software.Even legitimate software or browser add-ons can be accompanied by malware. Remember that every new app or software you install is a new potential entry point for cybercriminals. Be sure to uncheck extra software options unless you really need them.

Don’t Click That

  • Beware of unexpected emails. IBM X-Force has observed scammers using fraudulent package tracking emails, for example, to spread malware such as Locky ransomware. Be cautious and wary of unsolicited emails.
  • Double-check links. Scrutinise links in emails and social media posts. Hover over the URL to make sure a link directs to a legitimate website before clicking it.

Protect Your Passwords

  • Don’t save your info. Yes, it’s a pain to retype your info every time you want to order something online, but you should never save your password or credit card information in retail or bill payment sites, especially those you don’t frequent.
  • Use a special shopping email address and password. Have a separate email address just for retail websites and create unique passwords for each account. Use a password wallet to store your login credentials.
  • Get creative with password reset questions.When filling out account information, opt for the password reset question that doesn’t involve public information. For example, don’t use your high school mascot, since that could be found online. Instead, pick a subjective question (favourite dessert, favourite song, etc.) and enter answers that only you would know.
  • You can also create unique answers to each question and store them securely in a password wallet.

Control Your Credit Cards

  • Opt for credit over debit cards. Use credit cards instead of debit cards whenever possible. Credit card providers offer protection if your card is compromised and won’t dock your checking account if there’s an issue.
  • Use one-time credit cards. You may want to consider a one-time credit card when buying from a nontrusted or entirely new retailer. That way, you can avoid putting your personal card data at risk.

Some Security Links

SSL / TLS / HTTPS

  1. Is TLS fast yet – A great site debunking the myths of SSL/TLS speed cost
  2. Firesheep – A watershed moment for SSL by demonstrating the ease with which unprotected traffic can be intercepted and sessions hijacked
  3. Qualys SSL Labs – Tests a variety of attributes of the SSL implementation by pointing it at any URL
  4. CloudFlare – Get SSL for free on any website
  5. Let’s Encrypt – It’s coming, and it promises to fix the current mess that is CAs and configuring certs
  6. Betsy’s free wifi – Shows a young girl standing up a rogue wifi hot spot
  7. Chromium HSTS preload list – All the sites submitted for HTTP strict transport security preload (a depressingly small number of them)
  8. HTTP Shaming – Sensitive data sent insecurely? Name and shame!

Continue reading “Some Security Links”

警惕Nokia S60V3平台短信息功能假死漏洞

According to this post at
F-Secure’s site (http://www.f-secure.com/weblog/archives/00001569.html), at the 25th Chaos Communication Congress in Berlin, a
presentation titled ‘Security Nightmares 2009′ showed a demonstration
of a ‘Curse of Silence‘ exploit that reportedly affects S60 2nd Edition
phones, and even S60 3rd Edition, up to Feature Pack 1 (Feature Pack 2
phones are reportedly immune, as is S60 5th Edition). The exploit
apparently involves sending a specially formatted SMS to the recipient,
and renders the messaging capabilities of the phone completely useless.

This ‘attack’ cannot be achieved via an application, or over Bluetooth.
Only by receiving an SMS. With the Nokia N95, the attacker must send a
multitude of messages before the critical limit is reached, and the
user is presented with a ‘Not enough memory to receive message(s).
Delete some data first.’ and a blinking envelope in the top corner of
the screen.

If you get attacked with this, you’ll need to hard reset your phone.
You cannot use any backup/restore features, as that will reportedly
only restore the offending messages, recreating the problem.

漏洞利用步骤：
用N95 8G给N73发送一条能激活该漏洞的短信。
发送报告提示“已送达”
N73上却没有任何显示，已经中招。

是的，仅仅这么简单！

这诡异的信息就是
33字符的邮件地址……123*@321*.098
请勿随意找朋友做测试！！！

中招后的现象：

  1. 重新启动中招手机，问题依旧。
  2. S60 2.8/3.1系统的诺基亚手机，在收到十余条该短信时会出现“内存不足，请先删除一些短信”类似提示，并且无法收到新短信。
  3. 其他上述提及系统的诺基亚手机，收到一条该短信后便无法收到新短信，且无任何提示。

临时解决办法：
1.预防：装来电防火墙类的手机软件，拒绝接受未知号码的短消息。推荐信安易安全助手，过滤所有陌生号码，如果可能的话设置关键词过滤（过滤123*@321*.098字段），避免有朋友发这样的短信来开玩笑。
2.临时补丁。下载FortiCleanUp（已签名）

http://cid-d59b37022d2e4714.skydrive.live.com/embedrowdetail.aspx/Public/FortiCleanup|_CurseSMS|_v|_1|_0|_3|_signed.sis

安装后请重新启动手机
然后打开该补丁进行扫描，短信接收既可恢复正常。
如果系统内已装有短信过滤程序，该补丁会自动停止扫描以免造成系统混乱。

3.手动清除办法（仅限于已破解过的手机）：N82受到攻击后(11条短信)出现短信无法接收的问题,提示存储空间不足^ ^攻击成功.接下来就是手动修复，方法很简单，先把短信存储改成E盘，之后关闭权限验证，进入c:private 删除1000484B然后再把短信存储改回C盘。记住，在转存的时候，不要复制原先的内容。(我忘记什么提示，好象是选择2个否)之后重新启动手机，短信功能恢复正常。（转自opda）
4.希望中国移动、联通等运行商可以及时在短信网关处设置同样的关键词过滤，以最大限度的保证Nokia用户的手机安全。

以上内容为网上资料整理及个人安全观点，希望及时告诉您周围使用nokia手机的朋友提高警惕，切勿尝试此类攻击行为。

德国信息安全部警告:网民忌用Google Chrome上网!

9月8日消息，据国外媒体报道，德国信息安全办公室（BSI）在对谷歌新推的Chrome浏览器进行测试后建议网民：除尝试外，尽量避免使用Chrome测试版。
据悉，BSI对Chrome十分不满，认为Chrome在使用过程中多次想获得用户的信息。目前，BSI已经在《柏林日报》、电视新闻联盟Tagesschau等受众率高的媒体上发出了警告。
据一位Philipp Lensen的博客透露到：BSI的一位发言人在《柏林日报》上称，网民在使用Chrome时要十分小心，最好不要使用Chrome上网。这位发言人指出，谷歌现在覆盖了搜索引擎、电子邮件，现如今又加上浏览器等领域，这样将造成用户数据过多地集中在一家企业，这是十分危险的。

 
另据cnBeta报道

实验:居心叵测的Chrome?

感谢080909的投递
新闻来源:nsnail

最近发现硬盘读写很频繁，用任务管理器仔细检查了一下进程，发现Chrome的磁盘I/O高的惊人，怀疑有什么猫腻，于是专门做了一下测试：
用Chrome和IE分别打开百度，然后放置不动，任务管理器监视大约10分钟后结果如下：
 

Chrome的读写居然都达到了两三百兆字节，这时候仅仅是打开了一个百度静态页，资源和缓存应该都已读写完毕，但I/O还在不断增加，可以确定的是Chrome一定在做与浏览器无关的事情，干什么会占用这么高的I/O使用率呢， 这让人不得不联想到Chorme正在扫描硬盘，分析数据。

那么偷了东西，肯定得想办法运送回家吧。于是立即打开连接管理工具，事实证明了我的猜测是对的。

可以看到除了220.181.37.55为百度的Host，其他几个连接都连到了Google的主机上，尤其可疑的是最下面一个，使用了SSL加密，Google到底想要干什么，只是按照一贯风格收集用户隐私资料，还是另有企图，欢迎大家讨论。

The conflict between Business and Security

The main purpose of business dpt. is to develop business and earn money.

The main purpose of Security dpt. is to secure the core business by spending money.

Every time business hopes low cost and easy use, while the security hopes secure enough no matter how trouble it takes.

Business always breaks rules while the security defines strict rules.

Business is the core of the company which earn money. Security is just the internal supporting which spend endless money without obvious profit.

So the high level managers like business and hate security. Without high level support, security lacks the power to fight with business. Without good security protection, business get affected in several security incidents. Company’s reputation becomes worse and the business goes down. So that less incoming money makes even worse security protection. Security incidents again and again… That’s the bad loop.

It is quite clear, the conflict or the gap can be fixed.

Business should understand the important of security and accept security’s advice.

Security should balance the security requirement VS. cost effect and try to make security methods easy to use.

Update your Adobe Flash Player to 9.0.124 now!!!

Critical vulnerabilities have been identified in Adobe Flash Player
that could allow an attacker who successfully exploits these potential
vulnerabilities to take control of the affected system. A malicious SWF
must be loaded in Flash Player by the user for an attacker to exploit
these potential vulnerabilities. It is recommended users update to the
most current version of Flash Player available for their operating
system.

Affected software versions:

Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier

It has been reported Malicious SMF files found spreading over the malicious websites.

Update the Adobe Flash Player to latest version 9.0.124 now!!!
IE:
http://fpdownload.macromedia.com/get…r_active_x.msi

Firefox and Opera:
http://fpdownload.macromedia.com/get…yer_plugin.msi

上个网真不容易啊

昨天发现新大陆一样研究了一下google的apps服务(http://www.google.com/a)，有点类似微软的domains服务，但是功能更丰富。如果你有自己的域名，就可以在google apps上建立属于你的个人空间。google apps的好处就在于整合了google旗下的多个服务，包括强大的gmail，docs在线文件编辑，calendar日程同步，gtalk以及个人主页。这样，你就可以利用google提供的免费资源建立属于自己域名的各项服务。
赶紧把原本指向windows live domains的邮件服务取消，改用gmail的服务，并把DNS解析服务商中的各条记录一一改正，并按照google apps上的提示建立CNAME记录，比如新建CNAME记录www.xfelix.com/mail.xfelix.com等都指向ghs.google.com。这样就可以使用我自己的好记的域名来访问google apps上的一些长域名站点的服务了。白天好不容易简单的编辑出了一个webpage，也算是自己的个人首页了。测试一切通过，各项功能都正常。可是让妹妹试试访问我的域名，让别的朋友访问，都说无法打开。这下真让我觉得奇怪，判断估计是DNS记录更新不同步的原因，估计再等一天就会好的，但是我总觉得他们无法访问有可能是GFW造成的。
于是回家就试着访问我自己的域名，长时间无法打开，然后就被reset了，典型的被GFW阻挡的迹象。用爬墙工具试试，一切正常。再分析分析DNS的解析，发现不查不要紧，一查还真发现许多奇妙的问题。发现我白天建立的CNAME记录的域名全部解析到218.83.175.154或者218.83.175.155.这是什么地址啊！可是直接ping我的域名却又可以解析成正确的目的地址，但是无法ping通。再一想，原来218.83.175.154，155就是著名的中国电信互联星空114号码百事通地址啊，DNS劫持！就是这么无耻！所有的nslookup域名解析都被电信在当中插一脚，碰到无法正常解析的就往这个地址丢，出现电信的广告页面。
被中国电信劫持一下也就算了，谁叫上网服务是他们提供的，忍着吧。但是再google一下，才发现，原来ghs.google.com的所有ip以及alias都被伟大的GFW被屏蔽掉了。这就是为什么我辛辛苦苦做的这些设置在国内访问都无效了。真想不明白政府到底怕什么，这么一个正常的站点都不让我们访问。幸好google提供的这些服务的原始域名还是可以访问的，国家不让我用CNAME，我就用url转发吧。有效率高的不让用，就只能退而求其次咯。
在国内上网真的不容易，还得整天乞求GFW别管的那么宽，还得盼各类国际会议，国际活动多在国内开开，这样GFW就能网开一面。

互联网时代特别要注意个人隐私保护

陈冠希事件轰动整个华人圈，人们在欣赏曾经自己偶像的私密照同时，又在那里惊叹互联网的强大。都或多或少的担心自己的隐私会不会也同样被通过互联网曝光。互联网的传播速度和力量真的是无法预计的。但作为普通人，我们不会像名星那样收到关注。话虽如此，普通人同样有隐私需要保护。
俗话说，好事不出门，坏事传千里。大家行的正，做的端又何怕人家来曝你的隐私呢。古话又说，若要人不知，除非己莫为。陈冠希爽都爽了，还要拍这些东西下来，这又能怪谁。我们普通人可不会有如此隐私嗜好需要保护吧。
在互联网上，搜索引擎输入你自己的名字，往往会有你意想不到的结果。个人的证件号码啦，手机号码啦，什么时候说的话写的文章，以及一些隐私内容就这样呈现在你面前了。你不免会问，他们是怎么会知道的。
其实这些信息不是人家偷了去的，而是你自己不知不觉泄露出去的。
闲话少说，希望大家都能够保护好自己的隐私，做到以下几点，可以最大限度的防止个人隐私泄露在互联网上。
1.不在互联网上存放个人隐私照片及隐私文件，如需存放请使用强密码加密保护
2.不轻易向非政府组织提供个人的社会身份信息，诸如身份证号，社保号，公积金号等
3.不在互联网上使用真实姓名，注册论坛等请使用无明显身份识别信息的免费邮箱
4.不为蝇头小利而去缺乏隐私保护申明的网站填写个人信息表格参加所谓的抽奖
5.少在论坛、blog，同学录等处过多的泄露个人的信息
6.不同的网站、论坛、邮箱，请按照重要程度和信任程度使用不同的用户名密码组合
其他的隐私保护需要存有你个人信息的这些机构组织的保护和支持。比如像某些不守信用的招聘网站卖你的个人简历，或者有些金融机构把你的个人信息卖给保险公司，那我们普通人也是无能为力的，这需要全社会以及司法部门的介入和加强。
愿大家在新的一年，上网安全！