The Linux Foundation has released a paper with a possible solution:

Scary stuff…  I’m a user with Media Card Encryption enabled.  Do I disable encryption OR permanently solder the media card in place so it can’t be removed?

From Computer World:

“A Russian security company upgraded a phone-password cracking suite with the ability to figure out the master device password for Research in Motion’s BlackBerry devices. Elcomsoft said September 29 that before it developed the product, it was believed there was no way to figure out a device password on a BlackBerry smartphone or PlayBook tablet. BlackBerry smartphones are configured to wipe all data on the phone if a password is typed incorrectly 10 times in a row, the company said. Elcomsoft said it figured a way around the problem using a BlackBerry’s removable media card, but only if a user has configured their smartphone in a certain way. For the software to be successful, a user must have enabled the feature to encrypt data on the media card. The feature is disabled by default, but Elcomsoft said about 30 percent of BlackBerry users have it enabled for extra security. The company’s software can then analyze the encrypted media card and use a brute-force method to figure out a password. Elcomsoft said it can recover a seven-character password in less than an hour if the password is all lower-case or all capital letters. The software does not need access to the actual BlackBerry device but just the encrypted media card. The new feature is wrapped into Elcomsoft’s Phone Password Breaker. The software can also recover plain-text passwords used to access encrypted backup files for Apple’s iPhone, iPad, and iPod Touch devices. To crack those passwords, a user does need to have the Apple device in hand.”

Read the full article here at Computer World.

Target these power levels:

1. Downstream  in the range -15 dBmV to +15 dBmV
2. Upstream transmit within the range +8 to +58 dBmV

Remove unnecessary power distractions i.e.:

Coaxial Splitter

VMWare Fusion Recommends Anti-Virus

It appears as though IBM Rational’s AppScan and W3AF are the winners in the commercial and free/open source categories, respectively.  Read the full analysis here.

Sex, Lies and Cybercrime Surveys

The key highlights from Microsoft’s own Roger Halbheer:

• Industry vulnerability disclosure trends continue an overall trend of moderate declines since 2006. This trend is likely because of better development practices and quality control throughout the industry,which result in more secure software and fewer vulnerabilities.
• Vulnerability disclosures for Microsoft products increased slightly in 2010 but have generally remained stable over the past several periods.

[…]

• The exploitation of Java vulnerabilities sharply increased in the second quarter of 2010 and surpassed every other exploitation category that the MMPC tracks,including generic HTML/scripting exploits,operating system exploits,and document exploits.
• The number of Adobe Acrobat and Adobe Reader exploits dropped by more than half after the first quarter,and remained near this reduced level throughout the remainder of the year.

[…]

• Exploits that affected Adobe Acrobat and Adobe Reader accounted for most document format exploits detected throughout 2010. Almost all of these exploits involved the generic exploit family Win32/Pdfjsc

[…]

• Microsoft Office file format exploits accounted for between 0.5 and 2.8 percent of the document format exploits that were detected each quarter in 2010.

[…]

• As in previous periods,infection rates for more recently released Microsoft operating systems and service packs are consistently lower than older ones,for both client and server platforms. Windows 7 and Windows Server 2008 R2,the most recently released Windows client and server versions,respectively,have the lowest infection rates.
• Infection rates for the 64-bit versions of Windows Vista® and Windows 7 are lower than for the corresponding 32-bit versions of those operating systems. One reason may be that 64-bit versions of Windows still appeal to a more technically savvy audience than their 32-bit counterparts,despite increasing sales of 64-bit Windows versions among the general computing population. Kernel Patch Protection (KPP),a feature of 64-bit versions of Windows that protects the kernel from unauthorized modification,may also contribute to the difference by preventing certain types of malware from operating.

[…]

• In the first half of 2010,phishers showed signs of targeting online gaming sites with increasing frequency,although this push appeared to have dwindled as social networks came under increased attack. Impressions that targeted gaming sites reached a high of 16.7 percent of all impressions in June before dropping to a more typical 2.1 percent in December.
• Phishing sites that target social networks routinely receive the highest number of impressions per active phishing site. The percentage of active phishing sites that targeted social networks increased during the final months of the year,but still only accounted for 4.2 percent of active sites in December,despite receiving 84.5 percent of impressions that month. Nevertheless,the number of active sites targeting gaming sites remained relatively high during the second half of the year,which suggests that more campaigns may be coming.

DEP effectiveness (without ASLR)

Summary: DEP breaks exploitation techniques that attackers have traditionally relied upon, but DEP without ASLR is not robust enough to prevent arbitrary code execution in most cases.

ASLR effectiveness (without DEP)

Summary: ASLR breaks an attacker’s assumptions about where code and data are located in the address space of a process.  ASLR can be bypassed if the attacker can predict, discover, or control the location of certain memory regions (particularly DLL mappings).  The absence of DEP can allow an attacker to use heap spraying to place code at a predictable location in the address space.

DEP+ASLR effectiveness

Summary: DEP+ASLR are most effective when used in combination; however, their combined effectiveness is heavily dominated by the effectiveness of ASLR.  Exploits have been developed that are able to bypass DEP+ASLR in the context of browsers and third-party applications.  Nevertheless, the vast majority of exploits written to date do not attempt to bypass the combination of DEP+ASLR.

Marlinspike has introduced several tools
that help people concerned about privacy avoid giving up personal information.
GoogleSharing, a Firefox add-on, acts as an anonymizing proxy service and is
designed to evade Google analytics and prevent Google from tracking searches. 

GoogleSharing firefox plugin