Much of security relies on randomness - encryption keys should be random and random passwords are more secure than dictionary words or predictable sequences. The problem is, how do we generate a random number? Well, actually, this is a trick question. The answer is that you can't generate random numbers, but you can observe them. Most programming languages give you a random number generator, so why not just use that? Well, it's not actually a random number generator, but a Pseudo-Random Number Generator (PRNG), or more accurately a Pseudo-Random Sequence Generator (PRSG). Given the same seed value, it will produce the same output every time. Try seeding the random number function in your favourite programming language then run your program a few times. You should see the same numbers coming out each time. The reason for this is the function used to produce random numbers is just a mathematical formula that takes an input and gives an output. To have a random number out, ...

Recently I had someone come to me with their laptop saying that they had a new anti-virus program that they didn't remember installing and that 'other things' on their laptop didn't seem to work any more. The same thing happened to a corporate desktop machine I was asked about a couple of weeks later, that was originally running McAfee. Finally, two days ago I saw another corporate machine running McAfee that was saying that it had a hard drive failure. A tool, called HDD Tools, then automatically ran to diagnose the problem and stated that if they purchased the full HDD Tools product then it could fix the problem. Each of these was a piece of malware that had infected the machine and was trying to get the user to enter their credit card details into a website so that money can be taken from their account and maybe their card cloned. These malware programs go along with the fake anti-virus software that the APWG have reported a huge rise in recently. These are a coll...

McAfee have launched a Beta URL shortening service with added security features. As Brett Hardin pointed out they are a little late to the game. However, there are so many abuses of URL shortening services that I commend them for trying. Basically, what their service does is allow you to create short easy URLs (like any other service). However, unlike other services, when you click on the link, it opens a frames page with the content in the bottom frame and the McAfee information in the top frame. This information includes details about the domain you are connecting to, the type of company it's registered to and a big green tick or red cross to tell you whether the site is safe or not. This is decided by their 'Global Threat Intelligence', which will block known bad URLs and phishing sites. That's good, if it works. I said above that I commend them for trying to provide this service. There are some obvious failings in their solution though, that render their prote...

My slides on Network Security and Steganography, presented at the Intensive Programme on Information and Communication Security (IPICS) 2010 can be downloaded below. The topics covered under Network Security are: Access Control Devices, Firewalls, Network Protection, Network Authentication Protocols, TLS, VPNs & Remote Access. The Steganography slides cover examples of: Image, Network, HTTP and Twitter Steganography. A PDF of the Network Security slides can be downloaded from here . A PDF of the Steganography slides can be downloaded from here .

Comodo's Time Machine is a software application that runs on your Windows machine and periodically (either manually or automatically) takes snapshots of your system. You are then able to roll back to any of these snapshots in the future. Indeed you can jump backwards and forwards in the tree and new branches appear as you make changes to the system. The idea behind it is that if you suffer any problems with corrupted software, malware, etc., then you can roll back to a known good state and start again. You can lock snapshots so that they don't get deleted and then clear out the ones that you don't want to keep any more. This is quite important, especially if you take automatic snapshots. You have to remember that every change made to the computer (i.e. every time you run it or change a file) the changes are stored. When a new snapshot is created, if you change a file you will have a new version on your system as well as the old one. Due to this, it requires a fair amount...

I have recently been thinking about Steganography again and various carriers as well as applications. For those of you that don't know what Steganography is, it simply means 'hidden writing' from the Greek. Some examples of steganography are: tatooing the scalps of messengers and then waiting for their hair to grow back; writing a message on the wood of a wax tablet before pouring the wax in; 'invisible inks'; pin pricks above characters in a cover letter; etc. Basically, we have a 'cover', which could be an image, passage of text, etc., that we are happy for anyone to see and a message that we want to hide within it so that it is undetectable. It turns out that this last part is quite hard. Anyway, I thought I'd look at techniques to embed data within Twitter as it is popular now and people are starting to monitor it. Hiding within a crowd, however, is a good technique as it takes quite a lot of resources to monitor all activity on a service like Twit...

I have been talking to a company that provides telephone exchanges and services to companies this week on behalf of a client and it has highlighted a worrying backdoor. It turns out that many of these companies have a way to remotely connect to their exchange for support purposes - they can remotely control, configure and troubleshoot your system to get you back up and running. Exchanges often have additional modems in them to allow for remote connections. This is all very well and good from a managed service point of view, but what about the rest of your network? Can this be exploited to gain entry to your network? Quite possibly in some cases - it certainly needs to be included in your security audit and perimeter testing. Talking about a specific company now, they supply the software to monitor and bill phone calls through the exchange. They remotely install, monitor and manage this software. How do they do that? Well, it turns out that they install LogMeIn on your machine. Now t...

The Care Quality Commission ( CQC ) has decided to put registration of Care Providers online to make everything faster and easier for the providers. At least that's what they said. In practice, care providers had to fill in the online forms addressing standards that won't be published for another 5 months after the registration deadline. Ignoring all the problems, ridiculous re-branding to avoid inconsistencies and money wasted, there was a serious problem/lack of understanding that has lead to this blog post. All care providers and managers have to register online individually and have to agree to particular terms in order to be registered and, therefore, trade. I have no problem with this as these care providers are looking after vulnerable people. However, it became obvious that there are serious problems with their system. First off, it isn't possible to change the owner's name if you make a mistake (they can't change it either apparently). Therefore, if you ...