Security Blog 


2.15.2005

Ghostbuster
Schneier loves this idea from MS, I don't see what the big deal is. Sounds like a modified version of an integrity checker to me.

Here's how it works: The user has the GhostBuster program on a CD. He sticks the CD in the drive, and from within the (possibly corrupted) OS, the checker program runs: stopping all other user programs, flushing the caches, and then doing a complete checksum of all files on the disk and a scan of any registry keys that could autostart the system, writing out the results to a file on the hard drive.

Then the user is instructed to press the reset button, the CD boots its own OS, and the scan is repeated. Any differences indicate a rootkit or other stealth software, without the need for knowing what particular rootkits are or the proper checksums for the programs installed on disk.




NSA role expanding
Link.

The Bush administration is considering making the National Security Agency - famous for eavesdropping and code breaking - its "traffic cop" for ambitious plans to share homeland security information across government computer networks, a senior NSA official says.

Such a decision would expand NSA's responsibility to help defend the complex network of data pipelines carrying warnings and other sensitive information. It would also require significantly more money for the ultra-secret spy agency.



2.14.2005

Industrial espionage
Snippet from Time:

But instead of assigning one well-trained agent to pursue a target, "the Chinese are very good at putting a lot of people on just a little piece and getting a massive amount of stuff home," says a U.S. intelligence official. The number of Chinese snoops is staggering, if only because average civilians are enlisted in the effort. FBI officials say state security agents in China debrief many visitors to the U.S. before and after their trips, asking what they saw and sometimes telling them what to get.