OS X As A Pentesting OS

Just added the above entry on the SecuriTeam site, so go and check it out and give me your feedback. http://blogs.securiteam.com/index.php/archives/246

SecuriTeam Blog

Hey All, Well this blog may not be getting updated with any new security articles, as they will all be getting posted on Securiteam's site located at http://blogs.securiteam.com from now on. This one will still have daily rants, and most OS X related stuff though. xyberpix

New Email worm doing the rounds rather rapidly.

Just got this off of the F-Secure blog, so c'mon people time to update those virus defs. "The worm, named as Email-Worm.Win32.VB.bi seems to be spreading quite aggressively, it is already 3rd in our Virus Statistics. It is a simple mass-mailer written in Visual Basic. Please see the virus description for more details. We detect the worm with FSAV update version 2006-01-18_02." Summary Email-Worm.Win32.VB.bi is a mass-mailing worm that also tries to spread using remote shares. It also tries to disable security-related software. Detailed Description

Installation to system Email-Worm.Win32.VB.bi is written in Visual Basic and compiled as p-code. The size of the main executable is about 95 kilobytes. When executed, it first copies itself to several locations: %Windows%\rundll16.exe %System%\scanregw.exe %System%\Update.exe %System%\Winzip.exe where '%Windows%' presents the system Windows folder. In Windows XP systems, it is usually C:\WINDOWS. '%System%' is the system32 folder. The worm installs the following registry key for ensuring it will be started on system startup: [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "ScanRegistry" = "%System%\scanregw.exe" Spreading in e-mails The worm collects e-mail addresses from files with following extensions: .HTM .DBX .EML .MSG .OFT .NWS .VC .MBX .IMH .TXT .MSF And from the files with the following string in name: CONTENT TEMPORARY The worm sends itself as attachment in the infected e-mail. The e-mail subject is one the following: The Best Videoclip Ever School girl fantasies gone bad A Great Video Fuckin Kama Sutra pics Arab sex DSC-00465.jpg give me a kiss *Hot Movie* Fw: Funny :) Fwd: Photo Fwd: image.jpg Fw: Sexy Re: Fw: Part 1 of 6 Video clipe You Must View This Videoclip! Miss Lebanon 2006 Re: Sex Video My photos The message body may be one of the following: Note: forwarded message attached. Hot XXX Yahoo Groups Fuckin Kama Sutra pics ready to be FUCKED ;) Note: forwarded message attached. forwarded message attached. VIDEOS! FREE! (US$ 0,00) i attached the details. Thank you. >> forwarded message ----- forwarded message ----- i just any one see my photos. It's Free :) The worm can attach itself as executable file. It uses one the following names in attachment: 007.pif School.pif 04.pif photo.pif DSC-00465.Pif image04.pif 677.pif New_Document_file.pif eBook.PIF document.pif DSC-00465.pIf Sometimes, the worm MIME-encodes the file. In these cases, the attachment name can be one of the following: Attachments[001].B64 3.92315089702606E02.UUE SeX.mim Original Message.B64 WinZip.BHX eBook.Uu Word_Document.hqx Word_Document.uu The filename inside MIME-encoding is one of the following: Attachments[001].B64 [spaces] .sCR 3.92315089702606E02.UUE [spaces] .sCR SeX,zip [spaces] .sCR WinZip.zip [spaces] .sCR ATT01.zip [spaces] .sCR WinZip.zip [spaces] .sCR Word.zip [spaces] .sCR Word XP.zip [spaces] .sCR Spreading in shared folders The worm searches for remote shared folders and tries to copy itself using one of the following filenames: \Admin$\WINZIP_TMP.exe \c$\WINZIP_TMP.exe \c$\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.exe Other details The worm attempts to disable several security-related programs.

iPod Video 60GB

Well, I got one of these lovely little toys the other day, thankfully it came at just the right time as my Archos Jukebox was on it's last legs, and really wasn't going to last too much longer at all. I went for the white one, and well it really is a lovely little piece of kit. Considering I've never had an iPod before the scroll wheel takes a bit of getting used to, but after that it's such a breeze to use. The fact that it's 60GB in size as well is brilliant! So far I've managed to get all my mp3's, 3 videos and 2 video podcasts on it, as well as sync my address book and calender. The video version also comes with a few games on it, my fav of these has got to be the music game, it plays a few seconds of a song, and gives you 4 options to pick which song is currently playing. The longer you leave the song playing for, the less points you get. I thought that I really would've known my music a lot better than I do, I'll say that much. I am really paranoid about scratching the screen though, as right now it looks great and I really want to keep it that way, so roll on pay-day so that I can order a case for the thing. Video playback on the iPod video is truely amazing, I never would have thought that the quality would be as high as it is. My Archos Jukebox could play video, which when I got it was really cool, but the quality seriously sucked, and the size of the screen really didn't help matters either. Even though iPods are not the cheapest MP3 players on the market, I really doubt I'll ever buy another MP3 player that's not an iPod. I'm hoping that I never have to, but we'll have to see how technology changes in the coming years. If you're in the market for an MP3 player, head over to somewhere that'll let you play around on the iPod video for a few minutes and see what you think, I doubt you'll be disappointed.

gDisk

Finally, some's developed something that I've missed since the days that I was running Linux. A Gmail drive extension for OS X. What this means is that you can use all that cool space, 2 GB at the moment that Google gives you to store mail, as an external hard drive! Great for those offsite backups as well, you know, all the things that really matter. Fine it's not enough space to upload your iMovie files, but hey, you'd want to keep them private anyway. Well, here's the link to the OS X one gDisk: http://gdisk.sourceforge.net/ Here's the one's for Linux and Windows respectively as well: Linux http://richard.jones.name/google-hacks/gmail-filesystem/gmail-filesystem.html Windows http://www.viksoe.dk/code/gmail.htm Have fun!

Technorati Tags: Security, UK

How To Install Apple's Front Row on any Mac running OS X 10.4.3 or later.

I was trying to figure out a way to do this after watching Steve Jobb's latest keynote, and seeing the shiny new iMac's. Well, after a little bit of Googling, someone's already figured out how to do this, and it runs perfectly on my 15" Powerbook. For info on how to get it running head over to http://www.andrewescobar.com/frontrow , and follow the directions. Have fun.