Security Projects - Page 41 - Results from #800

Discover Security Projects News

Detecting "Off Port" Services

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Anyone who has used Linux long enough will look at numbers such as 22 and 80 in a totally different light than everyone else. Default port numbers are expected to be hammered with tons of packets day to day, from legitimate user requests to probes sent by nmap scans. Changing services such as SSH and FTP to non-default numbers are not only a tactic for securing your server - they're a tactic for malicious users to hide these services as backdoors once a system is compromised. Read on to see how scanning tools such as Passive Vulnerability Scanner and Nessus can be used to scan for these "off port" services.

LinuxSecurity.com Team
Jul 10, 2007

Virtual Hosting With vsftpd And MySQL On Debian Etch

Layers upon layers of security should make anyone feel warm and fuzzy about their secured application. I like the fact that if anyone is going to root me, they're going to have to WORK for it. FTP was always an area where I felt it could use a little more work in locking down its defenses. Enter Vsftpd along with a tag team partner of virtualization, and you've got a how-to of sandboxing your FTP server into a virtual environment.

LinuxSecurity.com Team
Jun 26, 2007

Pixy - An Open-Source Vulnerability Scanner for PHP Applications

In the months following the PHP "Month of Bugs", we have seen all sorts of exploits developed and publicized ranging from the obscure to warnings of vulnerable WordPress-based blogs. How do you know if your PHP applications are not affected by a bug, or worse yet, already compromised? Bring in a new tool from Secure Systems Lab - Pixy, an open source vulnerability scanner for PHP applications. Get this before they get you!

LinuxSecurity.com Team
Jun 21, 2007

Web Application Attack and Audit Framework

w3af, is a Web Application Attack and Audit Framework. It is extended using plugins; the framework and the plugins are fully written in python. Each plugin will add a functionality like xss detection or sql injection exploitation.

LinuxSecurity.com Team
Jun 13, 2007

With RHEL 5, Red Hat goes to bat for SELinux

IT managers that want to secure their Linux environments and keep things running smoothly have a very powerful tool at their disposal: Security Enhanced Linux, or SELinux, an implementation of mandatory access controls originally developed by the National Security Agency (NSA) and integrated in to most mainstream Linux distributions.

LinuxSecurity.com Team
Jun 06, 2007

Open Source Vulnerability Reporting Solution Launched

Palamida announced that it has extended the reach of its extensive compliance library and launched a new service, the Vulnerability Reporting Solution (VRS). VRS works seamlessly with Palamida's code audit compliance solution, IP Amplifier, to identify, prioritize, and report known vulnerabilities within open source code used in customers' projects.

LinuxSecurity.com Team
Apr 27, 2007

What's FireGPG?

FireGPG is a Firefox extension which brings an interface to crypt, decrypt, sign or verify the signature of a text in any web page, using GPG. It will support some webmails. Right now, only GMail1 is supported, some useful buttons are added in the interface of this webmail.

LinuxSecurity.com Team
Apr 04, 2007

OSSEC v1.1 Available

OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, time-based alerting and active response. This new version comes with numerous new features, including support for Microsoft IIS 6, Cisco VPN concentrator, Cisco PIX VPN AAA, Cisco FWSM and Solaris 10

LinuxSecurity.com Team
Mar 13, 2007

Startup Launches Breakout Testing Tool

Renowned researcher HD Moore and startup BreakingPoint Systems's "baby" has finally arrived -- the company is launching its new all-in-one network and security testing appliance that Moore helped build.

LinuxSecurity.com Team
Mar 07, 2007

Getting to Know the Enemy Better

MARCH 1, 2007 | ARLINGTON, Va. -- Black Hat DC -- Experts agree: The best way to secure applications is to build security in during the development phase. The problem is that there are few standards or templates for doing it. But that situation is about to change, according to speakers at the Black Hat conference here today. In fact, draft guidelines for specifying common security weaknesses and common attack patterns could be just weeks away.

LinuxSecurity.com Team
Mar 02, 2007

OSSEC v1.0 available

OSSEC HIDS is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, Windows registry monitoring, rootkit detection, time-based alerting and active response. It runs on most operating systems, including Linux, *BSD, Windows and Mac. This version comes with numerous new features and bug fixes, including support for registry monitoring on Windows, dynamic/nat'ed IP addresses in the server/agent communication, ASL (Apple system log), Lotus domino , Symantec AV, Windows RAR.

LinuxSecurity.com Team
Jan 15, 2007

Free bug scan offered for Java apps

Code auditing firm Fortify Software announced on Monday that the company is teaming up with quality-testing project FindBugs to offer a free scanning service to any Java programmer aimed at automatically detecting quality defects and security bugs. The project, dubbed Java Open Review, will allow any project written in Java to be submitted by a contributor to be scanned using both Fortify's auditing tool and the FindBugs engine. The two organizations have already scanned ten open-source projects written in Java, including the Azureus Bittorrent application, the Zimbra Web e-mail server, and the Apache Tomcat Java server.

LinuxSecurity.com Team
Dec 13, 2006

Computers, Networks and Theft

Cybercrime has evolved considerably over the past few years with new technologies being created and applied. As a result, cybercrime is no longer committed by individual amateurs; it

LinuxSecurity.com Team
Oct 23, 2006

OSSEC HIDS v0.9-3 Available

OSSEC HIDS is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, rootkit detection, time-based alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, Solaris and Windows. This new release comes with multiple features, including support for Modsecurity logs, MS exchange, MS FTPD and Windows firewall logs. It also includes a port to HP-UX and numerous bug fixes and new features.

LinuxSecurity.com Team
Oct 20, 2006

Scalable anonymity with I2P

The Invisible Internet Project (I2P) is a work in progress whose aim is to provide a secure version of the IP protocol that addresses threats common to the standard TCP/IP networking infrastructure -- most importantly, the effortless identification and tracking of participating peers. In I2P, each participating peer keeps a secret pool of inbound, or data-receiving, and outbound, or data-transmitting, tunnels it chooses itself. A tunnel consists of a configurable number of routers in sequence, where longer tunnels mean more anonymity, at the expense of performance.

LinuxSecurity.com Team
Sep 18, 2006

Red Hat, NIST Plan Software Vulnerability Database

Red Hat is developing a new software vulnerability database with the National Institute of Standards and Technology (NIST). The database will give vendors of both open source and proprietary software a place to post official statements and security related information pertaining to their own projects and products.

LinuxSecurity.com Team
Sep 08, 2006

Machine learning used to block SQL injection hacks

UK company Secerno has devised an innovative way to detect when a database is being attacked using the SQL (Structured Query Language) injection hacking technique.

LinuxSecurity.com Team
Aug 29, 2006

Password Safe

Password Safe is an Open Source (free) tool that allows you to have a different password for all the different programs and websites that you deal with, without actually having to remember all those usernames and passwords. Password Safe runs on PCs under Windows (95/98/NT/2000/XP). An older (but fully functional) version is available for PocketPC. Linux/Unix clones that use the same database format have also been written. Originally created by Bruce Schneier's Counterpane Labs, Password Safe has opened it's source. Currently, the PasswordSafe Open Source project is being administered by Rony Shapiro (GPG key FA175557 fingerprint FF77 379D D46D DAA6 6182 B452 1D79 5A91 FA17 5557). The first maintainer of the Open Source versions of PasswordSafe was Jim Russell. Learn about the dangers of reusing passwords in an informative guide.

LinuxSecurity.com Team
Aug 22, 2006

Whitebox Security Testing Using Code Scanning

Whitebox testing is notoriously difficult to do. Without automatic code scanning tools, scanning the source code requires a keen eye, concentration and an enormous amount of time to scan each line for security vulnerabilities. As intruders become more sophisticated at finding security vulnerabilities and writing exploitative code, it becomes more necessary to take every precaution before shipping software.These precautions can range from security training throughout the security development lifecycle (SDLC) to using tools such as source code scanners and vulnerability scanners.

LinuxSecurity.com Team
Aug 16, 2006

Dynamic linking in Linux and Windows, part one

This article discusses the shared libraries concept in both Windows and Linux, and offers a walk-through through various data structures to explain how dynamic linking is done in these operating systems. The paper will be useful for developers interested in the security implications and the relative speed of dynamic linking, and assumes some prior cursory knowledge with dynamic linking. Part one introduces the concepts for both Linux and Windows, but will focus primarily on Linux. Next time in part two, we'll discuss how it works in Windows and then continue to compare the two environments.

LinuxSecurity.com Team
Aug 15, 2006

Security Projects - Page 41

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12

Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins

Deck the Halls with Enhanced Security: Linux Kernel 6.13's Top Features & Improvements