Welcome to Montebello Partners' security home page. Here we include important current alerts, resources, and announcements. If this is your first visit here, you may want to browse:
- Our introduction to Internet Security,
- Description of our security services
- Monthly email news and updates
- The monthly meetings of the SDForum Internet Security SIG
- The FBI-sponsored bay area Infragard chapter
- Useful security links and tools
- Various presentations given by us.
January, 2005 Update
Hacks
-
A cracker took over some main servers a T-Mobile, allowing him to intercept US Secret Service email, private photos of Hollywood celebrities, and financial information. He was attempting to sell this information, and was fingered by an informant. -
A simple google search (not reproduced here) can provide pages of links to private webcams that are unintentionally available over the Internet.
Holes
-
Microsoft Word and Excel's new "strong" encryption isn't. While using an algorithm and key-length generally thought to be secure (128-bit RC4), a mistake in the implementation (re-use of the "initialization vector") would allow an attacker to recover data by comparing two such documents. -
Cisco IOS, used on virtually every Cisco router, switch, and firewall, has three denial-of-service (DOS) vulnerabilities. -
Microsoft Windows (pre XP-SP2) is vulnerable to DOS by malicious user interface graphics, and a new Internet Explorer cross-site scripting vulnerabilty has been reported. -
Google's GMail was found to allow you to read other people's email.
Upcoming Events
-
The RSA Security Conference will be February 14-18th at Moscone Center in San Francisco. -
The next SDForum Security SIG will be Thursday, Feb 24th.