13620 items (0 unread) in 75 feeds
Watchfire Application Security Insider
sirdarckcat
Google Online Security Blog
Switch/Twitch
mybeNi websecurity
cat slave diary
Alex's Corner
Billy (BK) Rios
Chris Shiflett
christian's weblog
GNUCITIZEN
The Spanner
hackademix.net
Ruby on Rails Security Project
It's a shampoo world anyway
ha.ckers.org web application security lab
Yet Another Infosec Blog
PHP Security Blog
Sunnet Beskerming Security Advisories
Disenchant's Blog
Sylvan von Stuppe
Larholm.com
Jeremiah Grossman
Anurag Agarwal - Application Security Evangelist
Ivan Ristic
omg.wtf.bbq.
Tactical Web Application Security
.:Computer Defense:.
tssci security
Plynt Penetration Testing Blog
Security Retentive
Schneier on Security
Rational Survivability
terminal23
1 Raindrop
hiredhacker.com
Matasano Chargen
Michael on Security - Musings on Information Security
Fortify blog
GDS Security Blog
Vodun.org
Mark Curphey - SecurityBuddha.com
Liminal states
Security Ripcord
IBM Internet Security Systems Frequency X Blog
extern blog SensePost;
Zero in a bit
Today marks the 8th anniversary of my blog, and my official entry into infosec.
This year wasn't quite as eventful as 2010 or "The Year I Got Slashdot'ted", but I think 2011 was the year of my highest quality content, with some long, hard-thought entries. So far the blog has 908 entries, with 872 public and 36 hidden because I got too scared. By comparison, I have vomited 8288 tweets into the ether since 2007.
Thanks to those that read it, and the feedback you give me. Here's to year 9.
I have a long standing bug-bear over the uselessness that security vendors seem to bring to cons in ZA. They respond to requests for "please don't pitch your product" by talking generically about the "outsourced next generation cloud-based firewall industry" as if that was some sort of legitimate field that didn't constitute only their product. They still send sales/pre-sales/product specialists with their EMEA marketing deck, rather than something of actual value. But as long as they're offering money, people take it, no questions asked. You'd think the empty rooms and people walking out of their presentations would send the message, but instead a local distributor finds a new vendor, or the vendor sends a new person, so the lesson is never learned.
That's not why Matt suggested the bingo, but it's one of the main reason's I helped. I want the vendor telling us that their product will block 100% of APTs to walk away feeling dirty and ashamed, and maybe even realise the error of their ways and turn into the next Charlie Miller. Also, I want to help Johnny, and the great work HFC is doing in Uganda (and Kenya).
So, as Matt already said. Find either he or I at the security summit (we'll be wearing I Hack Charities shirts) and give us R50 (or more, it's for a good cause) and we'll give you a security vendor bingo card (feel free to pre-print yours). Fill it out during the talks or on the con floor, optionally with the name of the vendor so we can tally a highscore list, then either return it to us in person, or mail it to the address printed on it, and we'll give you the results. There'll be some sort of prize if we can muster one, one for the person to complete first with the highest score, and one for the person who comes up with the best "other" phrase. Given that you could just tick them all off and give yourself a first high score, this will be a "Don't be a Douche" style contest.
We loved every moment, if only there was more time. Some photos are up courtesy of our photographers. Our informal engagement shoot, and photos from the wedding.
In the meantime, we're off on honeymoon!
While taking my drugs this evening I noticed something interesting; 
. Is this rampant plagiarism? If so, somebody at SensePost better sue the arse off those Schering guys ;)
mh has responded, and it seems these insidious brand copycat'ters have been plotting their attack from as early as 2000, from the response:
We opened doors in 2000, and i was hoping to find proof of these copycats having started like 2 weeks after us.. hmmm..
[snip ...]
Archive.org shows the logo in use at least back in 2000
This is obviously a targeted attack by an extremely capable hacker group. The careful placement of 'evidence' of SP (Schering Plough) existence way back into 1851 indicates infiltration of most of our public institutions and records. This could even be, the Illuminati.
On a different note, one of the army of analysts currenty tracking this attack has suggested that things could be even more nefarious; Sensepost could be a roach baiting front of Schering's designed to sell unsuspecting hackers 'lifestyle' drugs. When was the last time they offered you a drink?
P.S. And just because sometimes there are people out there who really don't get it. This is a joke, the logo's coincidentally similar, and the two companies not in competition in any minor or significant way.
Divine told me that Anna, the "events coordinator" would be phoning me tomorrow morning to give me the address. Does anyone have ideas for what I should say? I'm thinking of accusing her outright and getting a response. Ideally someone with lawyering skillz could tell me what charge to lay and get a case number?
Several other's have blogged about it:
They pointed me to the Our Winners scam site, which is part of the Quality Vacation Club scam (qvc.co.za and. A quick WHOIS shows the following registration which matches the address I am supposed to go to to collect my prize:
registrant: Shackel Validations
registrantpostaladdress: 28 Guildford rd, Carswald Midrand
So, even though the company changes, the address doesn't. If you blog about it please include the address to track their activity across company name changes.
Their phone numbers (likely temporary) are:
Divine - 0878052380
Anna - 0763758026
They also own the domains:
When they phoned, I quickly worked out it was a scam, but decided to go along with it. Two funny bits were when he asked that I come with my wife or partner for the photos. In response, I suggested that I was single but had a boyfriend. He them uncomfortably asked that I try and find a woman. We left it at him "getting back to me" about supplying a model for the photo instead.
The other bit which tipped me off it was a scam was when he asked me to pronounce my surname, given that I have a very pronounceable surname, I asked what he had written down. He then admitted he didn't have my surname, just my firstname, so I lied and gave him a false surname. In retrospect I should have said my surname was "Robert'); DROP TABLE Students;--".
I haven't read the full PDF, but the below diagram gives a breakdown, and since it is a diagram from Forrester, it is now also a fact:
I've always thought infosec people had the nicest bums. Especially if you compare them to network monkey or coder bums, which are usually flabby. Now we have proof!
I did think Yusuf's take via IRC was rather funny:
<cynic> I get the feeling that Forrester, Gartner et al are making it up sometimes.
<cynic> "Heat level" for roles in IT? What is this, TheStyleNetwork? Next we'll be seeing a report that ranks "Most Bodacious Management Skillz" ... sheesh!
<cynic> Moral Of The Story: It doesn't become less stupid if you attach a graph to it.
If you've decided you want to make better coffee, here are my tips for the changes that will yield the biggest results. These aren't comprehensive, just some quick tips for quickly making better coffee.
