Biometrics: Identity & Authentication

Almost everywhere today, you would come across a two-factor authentication, where a user is required to enter a User ID and a Password to access a system.

However, now biometrics is gaining popularity pretty quickly, which combines both the Identity and Authentication into one. This definitely helps the user because now s/he does not need to memorize the username or the password, but is this really the best way forward?

Take a look at this article written by Steve Riley.

How a Denial-of-Service Attack Works

A very interesting artical, in layman's language, on how a DoS attack works:

http://www.cio-today.com/story.xhtml?story_id=67628

PDF Vulnerability

A very serious pdf vulnerability is out in the open and is doing rounds in the news. The interesting part of this vulnerability is that a victim could get effected, even without opening the infected pdf file..!!

Here is one of the most comprehensive articles I have come across. The author demos three methods to trigger the vulnerability:

1. When the user just selects the infected pdf doc with a single click
2. If the user changes his Windows Explorer's view to Thumbnails View
3. If the victim hovers his mouse's cursor over the document

Is Open Source More Secure?

Someone very recently asked me if Open Source Softwares were better and more secure, compared to their proprietary (read: Microsoft) counterparts.

Today I came across a blog from Jack Danahy, and he talks about this same topic is some serious depth. He also goes on to explain how companies use and misuse these misconceptions to make their own sales pitch.

Net conclusion: All software has some amount of vulnerability within them. Users should always remember to trust reputed software vendors and should always keep up with the latest security patches.

Recover Windows Passwords

For some serious physical hacking, or if (in the unlikely scenario that) you honestly lost your Windows login password and would like to either retrieve it or reset it, I would recommend Ophcrack.

Ophcrack is a open source live CD, that you would need to download and burn, and then use it to boot up the PC, that requires its password reset/recovered.

Works with XP and Vista and can crack both LM, as well as NTLM passwords.

Retrieving Microsoft Product Keys

This is not by any means a new software, but I still wanted to put this on my blog, just for general awareness.

Magical Jelly Bean KeyFinder is a very handy tool to extract the Windows XP, Vista and MS Office product key from any PC. May come in useful to dig out a forgotten or lost key. Could also be misused to steal someone else's key, if you can manage to get access to a victim's machine.

Defect vs Vulnerability

Defect vs Vulnerability

What do you think should be more critical to the business? Should we be spending more resources on managing Quality Defects or should we give Security Vulnerabilities a higher priority?

As Info Security professionals, we blindly tend to think that a vulnerability is more serious than a defect and hence must be tackled asap. However, HP has a very interesting article that talks about this philosophy, that just shattered my misconception..!!