DNSCrypt by OpenDNS; securing the last mile.

     OpenDNS has recently announced what purports to be a game changing innovation; DNSCrypt.  This "new technology" actually applies an old concept to an older protocol.  DNSCrypt acts as a secure wrapper for all DNS traffic between you and the OpenDNS servers; much as SSL acts as a wrapper between you and the secure website you are talking to.
     While it does not use the same encryption standard as SSL (it uses Curve25519) it encompasses the same concept.  There is a client that must be installed to achieve the secure connection and it is still in the development stage.  Also, only a Mac client is currently available though they assure users that a Windows client is in the works.  However, this looks to be a very nice compliment to the DNSSEC standard that will help those without a VPN connection feel much safer browsing at public wifi hotspots; not to mention help keep their ISP from snooping traffic.  Read more about it and get the Mac client at the following link: http://www.opendns.com/technology/dnscrypt?utm_source=n012012&utm_medium=em&utm_campaign=home

MySQL Flaw

While there is little information about what is being patched, Oracle has included MySQL in their monthly CPU (Critical Patch Update).  One of the 27 flaws being fixed is listed as, "Remotely exploitable without authentication."  Definitely patch any web facing MySQL servers and think serious about anything else accessed by users you may not entirely trust.

Zappos Hacked

Zappos was hacked over the weekend exposing user accounts, email addresses, and the last 4 digits of credit card numbers.  The one "good" (if it can be called that) thing about this was that the database server with full credit card numbers were not compromised.  The user passwords were stored cryptographically, but as anyone with knowledge about cryptography knows;  if you know the algorithm, have the ciphertext, and have time you can decrypt it.  So, I applaud them forcing all users to change their passwords and suggesting that, if you use the same default password for other sites as well, that you change that too.

http://redtape.msnbc.msn.com/_news/2012/01/16/10163952-zappos-says-hacker-may-have-accessed-info-on-24-million-customers?ocid=ansmsnbc11

The Beast.....

....is a new toolkit used to exploit a flaw in TLS 1.0.  From what I garner from brief research, it allows someone to decrypt SSL 3.0 / TLS 1.0 transmissions to plaintext without having to insert oneself into the stream; man-in-the-middle attacks.  It is a flaw that was addressed in versions 1.1 and 1.2 of TLS.  However, as standards do, these new revisions have not caught on and leave millions of "secure" transactions a day open to possible exploitation.  Read more in depth analysis in this article at the Register: http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/

WPA Flaw leads to Crack.... in 10 hours (or less)

A new weakness in WPA wireless encryption has lead to the possibility of cracking a WPA secured wifi network (with WPS enabled) in 10 hours or less. http://www.devttys0.com/2011/12/cracking-wpa-in-10-hours-or-less/

17 Patches Coming Your Way

That's right.... 17 .... with 8 of them being critical. Look for them this patch Tuesday (4/12/2011).

Installing Toshiba Copier (with private print and Department Code) on a Mac.....

1.)First, goto Toshiba's Website and grab the pertinent driver: http://copiers.toshiba.com/support/index.jsp

2.)Run the installer package just as you would any standard mac DMG

3.) Go to "System Preferences"

4.) Go to "Printers" and then "Add Printer"

5.) Go to "IP" then enter the IP address for the copier in the "Address:" location

a.) enter a name for the Copier

b.) Select "Select Printer Software...." from the "Print Using" drop down

c.) Select the driver "Toshiba TEC Corp. Toshiba GL-####" where #### is the Controller number that can be obtained from the copier's web administration page

d.) Select the "Installable Options" ***Auto detection does not seem to work

e.) Choose "Continue" and the printer will be added to the list

6.) This is the important "Gotcha" step. The Private Print selection and Department code cannot (as of this writing) be entered into a menu anywhere. You MUST follow these steps:

a.) Launch Safari (last time I tried Firefox would not render the following page properly to get to all the options)

b.) enter the following URL: http://localhost:631 (this is the CUPS printing system that OSX uses behind the scenes)

c.) Click on "Printers" tab at the top-right of the screen

d.) Select the printer in question

e.) under the drop down box currently showing "Administration" select the "Set Default Options" selection

f.) Select "Printing Modes"

g.) Under "Print Mode:" select "Private - Document ID (DIN)"

h.) Choose the "Enable" radial button next to Department Code

i.) Go to "DIN" along the top next to "Printing Modes" and enter your 5 digit release code

j.) Go to "DC" next to "DIN" and enter your department code

k.) Make sure to press "Set Default Options" to save these settings

Your users should now be able to print to the copier and then go release their job with the (DIN) entered above.