According to a recent infoworld.com article a Non disclosure agreement that was preventing David Maynor from releasing the details of a wireless attack against Apple Computers is now no longer valid. As such David has released a paper on uninformed.org describing the attack in detail.See uninformed.org to read the paper.

CNET writter Chris Soghoian describes how to automate TV show downloads for linux, Mac OSX, and Windows in this little gem on Cnet.comFor more info see http://www.tvrss.net/

The nice folks at Iron geek have done a great tutorial on the use of the opensource file recovery tool PhotoRec.

See:
http://www.irongeek.com/i.php?page=videos/data-carving-with-photorec-to-retrieve-deleted-files-from-formatted-drives-for-forensics-and-disaster-recovery

Or for the direct download:
http://www.cgsecurity.org/

Before following this guide a complete ad-ware and virus scan should be completed to verify the system you plan on using is free from viruses and other malicious software. AVG virus scan is free for personal use and is available directly from AVG here: http://free.grisoft.com/

Ad Aware & Spy-bot search and destroy are both free for personal use and will identify any malicious software that may be running on your windows based computer.
Ad aware can be downloaded here: http://www.lavasoft.de/software/adaware/
Spy-bot Search and Destroy can be downloaded here: http://www.safer-networking.org/en/download/index.html

Instant messaging

Whether you’re using Gaim, aim, Yahoo IM, or MSN there are free encryption tools available that will make it (nearly) impossible for any third party to intercept and read your conversation.

Secway’s SIMP Lite for MSN, Yahoo, and AIM are free for personal use and work transparently with Gaim, Trillian, Yahoo IM, MSN IM, and AOL IM (AIM). Provided both parties are using simp your conversation will be encrypted end to end via AES. Simp is available for download here: http://www.secway.fr/us/products/. Note that SIMP is only available for windows.

For AIM only (5.2+) AimEncrypt.com offers a certificate and instructions on how to install the certificate. The nice thing about using the certificate is that no 3rd party software is required to have a fully encrypted conversation. For more information on AIM encrypt visit http://www.AimEncrypt.com.

GAIM-Encryption For GAIM: Gaim is a cross platform instant messaging client that works with a variety of different IM protocols and services, GAIM-Encryption is a 3rd party open source encryption plugin for GAIM that offers encryption over all gaim supported protocols. Gaim encrypt is available here: http://gaim-encryption.sourceforge.net/install.php

For OSX instant messaging Adium is a GAIM based IM client (open source/free) with built in encryption, note that both parties have to be using Adium for the conversation to be encrypted Adium uses OTR or off the record based encryption more on there here: (http://www.cypherpunks.ca/otr/) for more information or to download Adium visit http://www.adiumx.com/

Email

GPG: For non-commercial based email encryption GPG (GnuPG) an open source and free offshoot of PGP. GPG uses a public key infrastructure so that any one that has your public key can send you signed/encrypted messages. To send encrypted messages you must first generate a public/private key pair, then exchange public keys with another party, once you have another parties public key you can send them encrypted or signed messages. The message can only be decrypted by the corresponding private key. More instructions, information, and downloads on GPG can be found at http://www.gnupg.org/ or http://macgpg.sourceforge.net/ for mac users

File encryption.

TrueCrypt: Most operating systems offer some form of encryption, for windows there’s EFS, for OSX there’s File Vault, for Linux kernel loop encryption. The weakest standalone encryption is windows EFS because the keys/certificates are stored and recoverable from the local windows registry (Corporate Active directory users using a CA is completely different and we won’t get into that). Instead of using EFS a much better option is TrueCrypt available at http://www.truecrypt.org/. Truecrypt uses file container based virtual disks for encryption. This means that any file name/extension can be used. Also, encrypted data contained in the container files contains no obvious markers so a party performing an analysis of your system(s) is not likely to identify the container. Truecrypt also has the ability to nest container files for plausible deniability the first nest actually doesn’t use a file, instead free space is within the first container is used making it very difficult for a 3rd party to determin there is additional encrypted data being stored.

Voice encryption

Skype: For voice based encryption Skype is your best bet as it supports windows, MacOSX and Linux. All information is encrypted end to end using AES and RSA based encryption. While Skype is not open source it is free. More information about sky available here: http://www.skype.com/download/

Zphone: Phil Zimmermann (creator of PGP) has written Zphone which sits in between voip software and the internet acting as an encrypted transport mechanism of sorts. More information about zphone can be found at http://www.philzimmermann.com/EN/zfone/index-start.html

A word about security

It’s important to note that the best encryption can be easily thwarted by a key logger or other attack. Before relying on any of the above mentioned systems, be sure that your system(s) are completely locked down, virus and parasite free, block all inbound connections locally using a local firewall. Ditch Internet Explorer and use firefox or similar, Open source browsers are far less susceptible to attack and don’t rely on activex for component installations. Don’t use wireless networks without a VPN connection. Don’t use the same password for everything, password should be random characters at least 9 characters in length with numbers, letters, and special characters. (8 character passwords can be cracked in a few days with enough resources; a 9 character password can take years to break) For more info on password security see securitystats.com http://www.securitystats.com/tools/password.php

Williamc and Twinvega have created a video introduction on how to use the linux tools DD and Autopsy from the Auditor Security Collection knoppix boot cd.

Check it out at:
http://www.irongeek.com/i.php?page=videos/autopsy1

ScatterChat was released Saturday July 22, 2006 by the hacktivismo arm of the cult of the dead cow at the sixth hope. Simply speaking scatterchat is a branch or fork off of the Gaim instant messaging platform that promises high security though its use of TOR and through its use of hard encryption (ElGamal, AES) (More on the crypto here: http://scatterchat.com/docs/crypto_protocol.txt)
To start I installed Scatterchat. I found the installer to be almost identical to gaim. Next I generated my encryption keys by following the prompts. Scatterchat then used the information already stored on my computer by gaim to automatically sign me in to all the IM networks that I had already been using.

At this point when I opened a new chat window I noticed a button similar in placement to the Gaim encryption plugin that indicated that my conversation was not secure. Chatting with some one else using scatterchat I would undoubtedly be able to carry on a fully encrypted conversation.

To use Tor I found that I had so sign completely off the IM network, at the login screen, under crypto setup, under options, are the options to configure the built in TOR client. Once enabled and configured I was able to sign on once again. Using ethereal to sniff traffic coming from scatterchat I was able to determine that none of my communications were being sent clear text at this point.

Installing scatterchat on multiple machines I found that scatterchat worked well but wasn’t without flaws. To start, scatterchat appears to not open cert information correctly on windows xp until you log off and log back on. When reconfiguring TOR to use a proxy I found that when I typed my proxy password in, not only was it shown on screen as typed (No stars covering password) but that password was also stored clear text in bc_prefs.txt.

Even with the above stated problems I believe Scatterchat can still be a valuable resource although not a physically secure one. According to http://scatterchat.com/contribute.html. Version 2 is in its release candidacy with development soon starting on version 3.

To get your own copy of scatterchat check out http://scatterchat.com

Also see:

http://hacktivismo.com/
http://www.cultdeadcow.com/

Zeroday Secure Solutions has agreed to sponsor Topsight in furthing its goal of providing security insight to the masses.

For more information on ZeroDay Secure Solution see: http://www.zerodayss.com

Irongeek and Glj12 have released a new tool for windows that ranomizes your windows MAC address and host name. This makes a host running this software extremely hard to track.

For more information see : http://www.irongeek.com/i.php?page=security/madmacs-mac-spoofer

From Financial Times:The flaw is a symbolic blow to Microsoft, which has spent five and a half years developing Vista. The software, which was launched two years later than originally planned, is the biggest upgrade to the operating system since the release of Windows 95 and Microsoft focused heavily on improving security.See more at : Ft.com

From askapache.com:A few months back I did some intense testing of all the best vulnerability scanners out there… I had a couple nix boxes hooked up, as well as some dozers, and figured I could add clients to a “once-a-week” scanning contract. So naturally, I wanted to use the scanner that was the best for my purpose.Read more at www.askapache.com