Alerts This Week
Warning Icon 1 646
Alerts This Week
Warning Icon 1 646

Security Projects - Page 44

We have thousands of posts on a wide variety of open source and security topics, conveniently organized for searching or just browsing.

Linux admins rarely deal with one fixed system anymore. A single environment may include public-facing web apps, internal services, containers, cloud workloads, code repositories, and third-party packages pulled into production. That mix creates more...

Most of us have pulled something from the AUR because i...

If you’re running Linux systems, you know that Linux ke...

Discover Security Projects News

LS Hmepg 337x500 34 Esm H267

Discover Non-Standard Ports To Detect Compromised Services

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Anyone who has used Linux long enough will look at numbers such as 22 and 80 in a totally different light than everyone else. Default port numbers are expected to be hammered with tons of packets day to day, from legitimate user requests to probes sent by nmap scans. Changing services such as SSH and FTP to non-default numbers are not only a tactic for securing your server - they're a tactic for malicious users to hide these services as backdoors once a system is compromised. Read on to see how scanning tools such as Passive Vulnerability Scanner and Nessus can be used to scan for these "off port" services.

LS Hmepg 337x500 34 Esm H267

Configuring Vsftpd with MySQL: Enhanced FTP Security on Debian

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Layers upon layers of security should make anyone feel warm and fuzzy about their secured application. I like the fact that if anyone is going to root me, they're going to have to WORK for it. FTP was always an area where I felt it could use a little more work in locking down its defenses. Enter Vsftpd along with a tag team partner of virtualization, and you've got a how-to of sandboxing your FTP server into a virtual environment.

LS Hmepg 337x500 34 Esm H267

Discover Pixy: A Tool for XSS and SQL Injection in PHP Applications

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

In the months following the PHP "Month of Bugs", we have seen all sorts of exploits developed and publicized ranging from the obscure to warnings of vulnerable WordPress-based blogs. How do you know if your PHP applications are not affected by a bug, or worse yet, already compromised? Bring in a new tool from Secure Systems Lab - Pixy, an open source vulnerability scanner for PHP applications. Get this before they get you!

LS Hmepg 337x500 34 Esm H267

Red Hat RHEL: Enhancing Security Through SELinux Controls

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

IT managers that want to secure their Linux environments and keep things running smoothly have a very powerful tool at their disposal: Security Enhanced Linux, or SELinux, an implementation of mandatory access controls originally developed by the National Security Agency (NSA) and integrated in to most mainstream Linux distributions.

LS Hmepg 337x500 34 Esm H267

Palamida Launches New Reporting Solution for Open Source Security

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Palamida announced that it has extended the reach of its extensive compliance library and launched a new service, the Vulnerability Reporting Solution (VRS). VRS works seamlessly with Palamida's code audit compliance solution, IP Amplifier, to identify, prioritize, and report known vulnerabilities within open source code used in customers' projects.

LS Hmepg 337x500 34 Esm H267

Explore OSSEC v1.1: New Features in Intrusion Detection System

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, time-based alerting and active response. This new version comes with numerous new features, including support for Microsoft IIS 6, Cisco VPN concentrator, Cisco PIX VPN AAA, Cisco FWSM and Solaris 10

LS Hmepg 337x500 34 Esm H267

CWE and CAPEC Initiatives Boost Application Security Standards

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

MARCH 1, 2007 | ARLINGTON, Va. -- Black Hat DC -- Experts agree: The best way to secure applications is to build security in during the development phase. The problem is that there are few standards or templates for doing it. But that situation is about to change, according to speakers at the Black Hat conference here today. In fact, draft guidelines for specifying common security weaknesses and common attack patterns could be just weeks away.

LS Hmepg 337x500 34 Esm H267

OSSEC HIDS v1.0 Launch: New Features For Improved Monitoring

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

OSSEC HIDS is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, Windows registry monitoring, rootkit detection, time-based alerting and active response. It runs on most operating systems, including Linux, *BSD, Windows and Mac. This version comes with numerous new features and bug fixes, including support for registry monitoring on Windows, dynamic/nat'ed IP addresses in the server/agent communication, ASL (Apple system log), Lotus domino , Symantec AV, Windows RAR.

LS Hmepg 337x500 34 Esm H267

Free Java Application Bug Scan Offered by Fortify and FindBugs

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Code auditing firm Fortify Software announced on Monday that the company is teaming up with quality-testing project FindBugs to offer a free scanning service to any Java programmer aimed at automatically detecting quality defects and security bugs. The project, dubbed Java Open Review, will allow any project written in Java to be submitted by a contributor to be scanned using both Fortify's auditing tool and the FindBugs engine. The two organizations have already scanned ten open-source projects written in Java, including the Azureus Bittorrent application, the Zimbra Web e-mail server, and the Apache Tomcat Java server.

LS Hmepg 337x500 34 Esm H267

New Features in OSSEC HIDS v0.9-3 for Enhanced Security Monitoring

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

OSSEC HIDS is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, rootkit detection, time-based alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, Solaris and Windows. This new release comes with multiple features, including support for Modsecurity logs, MS exchange, MS FTPD and Windows firewall logs. It also includes a port to HP-UX and numerous bug fixes and new features.

LS Hmepg 337x500 34 Esm H267

I2P: Garlic and Onion Routing Techniques for Enhanced Security

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

The Invisible Internet Project (I2P) is a work in progress whose aim is to provide a secure version of the IP protocol that addresses threats common to the standard TCP/IP networking infrastructure -- most importantly, the effortless identification and tracking of participating peers. In I2P, each participating peer keeps a secret pool of inbound, or data-receiving, and outbound, or data-transmitting, tunnels it chooses itself. A tunnel consists of a configurable number of routers in sequence, where longer tunnels mean more anonymity, at the expense of performance.

LS Hmepg 337x500 34 Esm H267

Efficiently Manage Your Passwords with the Password Safe Tool

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Password Safe is an Open Source (free) tool that allows you to have a different password for all the different programs and websites that you deal with, without actually having to remember all those usernames and passwords. Password Safe runs on PCs under Windows (95/98/NT/2000/XP). An older (but fully functional) version is available for PocketPC. Linux/Unix clones that use the same database format have also been written. Originally created by Bruce Schneier's Counterpane Labs, Password Safe has opened it's source. Currently, the PasswordSafe Open Source project is being administered by Rony Shapiro (GPG key FA175557 fingerprint FF77 379D D46D DAA6 6182 B452 1D79 5A91 FA17 5557). The first maintainer of the Open Source versions of PasswordSafe was Jim Russell. Learn about the dangers of reusing passwords in an informative guide.

LS Hmepg 337x500 34 Esm H267

Whitebox Security Testing Using Code Scanning For Software Safety

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Whitebox testing is notoriously difficult to do. Without automatic code scanning tools, scanning the source code requires a keen eye, concentration and an enormous amount of time to scan each line for security vulnerabilities. As intruders become more sophisticated at finding security vulnerabilities and writing exploitative code, it becomes more necessary to take every precaution before shipping software.These precautions can range from security training throughout the security development lifecycle (SDLC) to using tools such as source code scanners and vulnerability scanners.

LS Hmepg 337x500 34 Esm H267

Dynamic Linking and Shared Libraries: Security and Development in Linux

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

This article discusses the shared libraries concept in both Windows and Linux, and offers a walk-through through various data structures to explain how dynamic linking is done in these operating systems. The paper will be useful for developers interested in the security implications and the relative speed of dynamic linking, and assumes some prior cursory knowledge with dynamic linking. Part one introduces the concepts for both Linux and Windows, but will focus primarily on Linux. Next time in part two, we'll discuss how it works in Windows and then continue to compare the two environments.

Your message here