post of the week

• Virus Bulletin : News - Almost half of users think virus-writing contests are a good idea
  the great thing about this is that the industry (who are in large part responsible for the public's perception of malware) gets to see how far off track the public's perception has gone... will that motivate them to get their act together? who knows...
• Top 5 Abused/Misused/Miscontrued Terms in Information Security « Amrit Williams Blog
  some perspective on some familiar phrases, including an admission from the av is dead camp that that idea is largely hyperbole...
• Fenomen(al) False Positives - Panda Research Blog
  interesting caveat about automated malware processing...

posts of the week

• TaoSecurity: Mutually Assured DDoS
  good take on how retarded the idea of military botnets are... the only thing missing is the conclusion that col. williamson isn't qualified to hold his current post...
• New international group to become the CDC of cyber security
  seems like a breath of fresh air next to the utterly incompetent idea of military botnets...
• The commercial HTML packer dilemma - McAfee Avert Labs Blog
  it's the conclusion here that i really like... i fail to see any legitimate value in obfuscation (whether it's for javascript or more traditional executables) and think maybe we should just start flagging obfuscation itself as suspicious...
• 72% of companies and 23% of home users with an up-to-date security solution installed are infected - NanoScan Blog
  now there's a positive turn - not only is panda admitting that scanning alone isn't enough, they're using the opportunity turn it into a competitive advantage for their next generation technology...
• The Daily Incite - May 12, 2008 | Security Incite: Analysis on Information Security
  mike demonstrates that "total protection" isn't the only piece of snake oil out of mcafee... "the secure internet", it's good for what ails ya...

posts of the week

• MoMusings: EICAR 2008 Conference Paper Now Available
  going beyond simple scanning to find out the true state of a suspect system... definitely a timely topic...
• Communicating about risk - part 1 | RiskAnalys.is
  i'll be honest, i liked this because i feel like i learned something useful and i didn't have to work too hard to do so...

only 2 that really caught my eye... been a quiet week this week i guess... good thing too - my wrists needed a break...

posts of the week

• hype-free: Race to Zero
  this one really stuck in my head... ostensibly it's about race to zero but in the process cdman rightly places the blame for the growing anti-av revolt squarely on the av vendors themselves for letting their marketroids run amok...
• Viruslist.com - Analyst's Diary - More thoughts on drawing the line
  an interesting look at the asymmetry between obfuscation and deobfuscation as it pertains to the race to zero contest...
• Security Myths - McAfee Avert Labs Blog
  if i had found more time i would have written this post (or one very much like it) myself... seriously, it was on my list of things to do, and now i don't have to do it...
• PDF, Let Me Count the Ways… « Didier Stevens
  at first i thought PDF canonicalization would be better suited for heuristics but then i realized seeing through this kind of obfuscation can be as beneficial for known-malware scanning as seeing through packer-based obfuscation or really anything that's 'added on' to the base malware...
• Emergent Chaos: Quantum Uncertainty
  so much for the superiority of quantum computers - or so it would seem for now...
• Microsoft botnet-hunting tool helps bust hackers - Network World
  interesting to hear details of how botnet busts go down, and obviously microsoft is in an excellent position to help this happen if they've got intelligence gathering tools on hundreds of millions of enterprise and end user machines...

posts of the week

i'm going to try something a little different... it hasn't escaped my attention that this blog can often be a little on the negative side... i'm not particularly comfortable writing up blog posts that do nothing but agree with other blog posts - it makes me feel like a yes man (something i have a deep-seated aversion to)...

but there are good posts out there that genuinely deserve acknowledgment, and this blog could stand to have a little bit of positive energy injected into it so i'm going to take a page out of the blogging playbook of some of the bloggers i read and post some links to articles i thought stood out... i'm thinking once a week should be adequate, though i'm a little on the late side with this first one (these will be posts from last week)...

(update: crap, i should have known linkrolls and feeds wouldn't mix)

• “Only X Out of 32 Antivirus Products Detect This!” « Didier Stevens
  a refreshingly sane look at the use of virustotal, and a must-read for anyone looking to prove a point or grind an axe in the malware field
• A Shifting Definition of 'Severity' - Security Fix
  it's interesting to learn where microsoft's severity ratings come from and what recent changes at NIST mean for them
• Jeremiah Grossman: CSRF DDoS, skeleton in the closet
  wait, people actually think xss and/or csrf aren't cracking? they must not value what gets put into the cloud (cc#'s, bank credentials, ppi, etc)
• CNN.Com, Politically Motivated DDoS, and Asymmetric Warfare · Security to the Core | Arbor Networks Security
  i love these types of strategic analyses

oh, and while we're on the subject of change, i've replaced the 'posts of interest' (which were basically posts i thought people ought to read) with a widget from aiderss that calculates post quality/popularity/whatever (you know that saying about leading a horse to water)... i've also added a tagroll as a navigational alternative to the date-based archive (and the ever present search)... now i just have to work on that audio format alternative i keep meaning to do...