Great Article on Cryptowall 3.0 from blogs.cisco.com

Worth a read:

http://blogs.cisco.com/security/talos/cryptowall-3-0

My only question is why would the dropper care whether it's running in a virtual environment?  A bit more digging reveals that the malware author is assuming that if his code ends up running in a VM, it's probably a sandbox and being studied, so the malicious code refuses to co-operate.  Clever.

Here's the analysis of Cryptowall 2.0, from the same blog:

blogs.cisco.com/security/talos/cryptowall-2

SBS 2008 and Third Party AV

Having problems loading the SBS 2008 Console? Keeps crashing a few moments after you open it? The problem might be the way the SBS 2008 console tries to use WMI to enumerate the security status of the various AV products that you have sitting on the servers and PCs on your network. Check out this procedure:

http://blogs.technet.com/sbs/archive/2009/03/12/sbs-console-crashes-when-duplicate-entries-from-av-products-are-written-into-security-center.aspx

Its a bit deep, and requires some concentration and patience, but definitely worth a look.

Embassy Trust Suite -> Whiskey Tango Foxtrot

Seriously:

http://www.google.com/search?hl=en&rls=com.microsoft%3Aen-US&q=dell+embassy+trust+suite+offline+files

What the hell is Dell thinking including this bullshit on their machines? Apparently this started towards the end of 2008, and it causes all kinds of fun problems with Windows server's offline files functionality.

I particularly like this blog post: http://mikedimmick.blogspot.com/2007/12/calling-out-embassy-trust-suite.html. Mike correctly aims his post at Wave Systems (who I refuse to link for you). I still blame Dell for picking them.

Remove this software on sight.

Two Factor

Scalable and inexpensive two-factor authentication for small and medium-sized business. We do it, so can you.

You're doing it wrong

Marcus Ranum - if you've never heard of this guy, you need to check him out. He has a no-nonsense stance towards security and like me, doesn't believe you need to know intricate details about every 0-day exploit to be able to defend a network against intruders. His stance towards security is very "design based", as in you can't skip any steps, and you have to start at the bottom. You can't "add" security on top of an existing gong-show and expect it to be effective. Companies waste money every day with this approach, and security vendors are reaping the benefits.