“El Sibakero”, #2

Material by jim.

Advertisement

“El Sibakero”, #1

Introducing infosec.ph’s weekly cartoon strip, “El Sibakero”.

http://www.facebook.com/pages/The-El-Sibakero-Project/151004647367

Draft Philippine Cybercrime Prevention Act

In case you’d like to see the current draft bill being deliberated in Congress, you can find it here.

Articles in the end of May with relation to the Cybercrime bill:
(Newsbreak) Latest sex video scandal highlights need for cyber crime law
(Computerworld Philippines) National ICT Month

Much ado about Conficker

There’s been much hullabaloo about the Conficker worm lately, especially since it’s supposed to phone home to around 500 servers (from a possible 50,000) this coming April 1st. So much so that even the New York Institute of Photography has sent an e-mail warning and telling photographers to back up their files just in case. Microsoft started a group called Conficker Cabal around mid last month that has unfortunately only had partial success, since on March 5th, around a fifth of infected machines updated themselves from variant B to variant C.

I doubt that typical users will get affected by it that much… BUT if you’re an Admin that wasn’t able to patch soon, then you may be in for a long day.

Researchers from the Honeynet Project have released a proof of concept (PoC) to detect the worm by using network scanners. The PoC code can be found at the Computer Science site of the University of Bonn.

Nmap has released 4.85 Beta 5 which contains the Conficker detection logic, and so have Qualys and nCircle.

You can also check out Dan Kaminsky’s personal blog for more info. By the way, his blog has a cool little tool that may detect if your DNS is vulnerable to what he discovered last year (check out this illustrated guide to the vulnerability).

Other Conficker News:
(Computerworld) Researchers exploit Conficker flaw to find infected PCs
(Security Focus) Researchers find way to detect Conficker
(The H Security) German researchers develop network scan for Conficker worm
(SC Magazine UK) Malware expert believes that Conficker author will create a new variant
(SC Magazine US) Conficker detection tool released as D-Day nears

---

Seminars and Conventions
ISACA Manila will be holding their annual conference with the theme, “IT Governance: Solving the Puzzle” this coming April 14 and 15 at the Renaissance Hotel, Makati City. The conference will have a plenary session on IT Governance topics such as IT Management, IT Security, IT Auditing and IT Risk Management. For more info, check out the ISACA Manila Conference Website, call the Secretariat at (+632) 894-2533, (+63919) 288-4410, or email them at secretariat@isaca-manila.org.

---

Comelec challenges hackers

Taken from The Philippine Star (www.philstar.com), 17 March 2009:

Try to hack into automation machines, Comelec challenges hackers
By Sheila Crisostomo

MANILA, Philippines – The Commission on Elections (Comelec) yesterday challenged hackers to try to hack into the voting and counting machines that will be used in next year’s elections, but expressed confidence that they would fail.

Comelec executive director Jose Tolentino said they are very confident the security features of the precinct count optical scan (PCOS) machines would be able to thwart hackers.

“Even in the first level, we can already detect any tampering,” noted Tolentino, who is also the project manager of poll automation.

…

Read full article:

http://www.philstar.com/Article.aspx?articleId=449326&publicationSubCategoryId=63

[ In any aspect of Security, giving out this sort of challenge is usually unwise and inappropriate as it may prove to be dangerous but nevertheless, it’s entertaining. ]

Launching of DefCon Philippines

Soft Launching of Defcon Philippines (DC3662) will be on Dec 20, 2008 with a half day event (1-6PM) at Handuraw, 460 Gorordo Avenue, Cebu City.

For more info, check out www.defconph.org.
There’s also great info in their blog section. They will be sponsored by opononline and Empress of Drac.

A couple of Blogs about this event:

Beyond the norms

cebubloggers

Third Wave

---

Since I posted something about Social Networks and the Philippines probably around a week back, you might want to check out the Pinoy Post Blog by Melvin Calimag over at ZDNetAsia who recently wrote an informative article about the same topic.

Since the author seems to be one of the few writers on IT in the Philippines, I googled him and came upon this interesting article written around the start of this year.

---

Other Info Sec News

Security update for xt:commerce Shop system

Obama’s cell phone records breached

Verizon staff break into Obama’s cell phone account

US Military’s ban of USB thumb drives highlights security risks

Buffer overflow in Vista’s TCP/IP stack

Microsoft to offer free security solution, discontinue OneCare. This is also related to,
Microsoft hopes free security means less malware

Key Logger Spyware ordered off the market

Brief study shows difficulty in detecting malware

Apple plugs a dozen iPhone security holes

Computer virus brings London hospital networks to a standstill

---

New Links:

MASE Consulting – Policies and Procedures
Software Assurance Forum for Excellence in Code