Vorlon's Blog » security

Network Security Breaches at NASA

vorlon — Fri, 05 Dec 2008 13:08:24 +0000

Bruce Schneier points to an article at BusinessWeek about repeated attacks on the NASA networks and successful intrusions. The article also mentions a possible connection of the problem of ROSAT pointing too close to the sun in September 1998 to such attacks.

Serious DNS vulnerabilities – update for bind available

vorlon — Wed, 09 Jul 2008 09:24:28 +0000

In the light of yesterday’s large coordinated release of DNS related updates to various products, I would like to point you to the updated bind packages in the portage tree.

net-dns/bind-9.4.2_p1 is currently being marked stable on all supported architectures
net-dns/bind-9.5.0_p1 has been committed with unstable keywords

Nameservers should be updated quite soon, since this issue should be considered serious.

A GLSA will be published after all security architectures have marked the affected package stable. The progress can be followed in bug #231201.

For more information have a look at the following links and the references therein:

Also note that if you are restricting the used outgoing ports of your nameserver by a firewall for example, this policy should be revisited.

Update 2008-07-11:
GLSA 200807-08 has just been released to address this issue.

Chipkarte der Uni Göttingen unsicher!?

vorlon — Sun, 30 Mar 2008 16:42:39 +0000

Ich hatte noch keine Zeit mir das genauer anzugucken, aber es sieht so aus als wurde die Verschlüsselung eines RFID-Chips geknackt, welcher auch auf den Chipkarten der Uni Göttingen verwendung findet. Diese wiederum wird u.a. zum Bezahlen in der Mensa oder auch als Zutrittsberechtigung in verschiedenen Fakultäten verwendet

via cpunk

UPDATE:

Mehr zum Knacken der Verschlüsselung gibt es auf der Seite von Karsten Nohl und in diesem Vortrag vom 24C3.