Catálogo de Atualizações Microsoft
Ferramentas de Segurança para Profissionais
Criado o grupo para todos aqueles que trabalham com produtos da Trend Micro, e já participam ou irão participar de um Technical University Brasil, para se associar basta acessar o link: Technical University Brasil | Google Groups Por favor preencha o motivo do seu interesse em participar deste Grupo. Obrigado.
Phishing is a form of social engineering in which you simply ask someone for a piece of
information that you are missing by making it look as if it is a legitimate request. An e?mail
might look as if it is from a bank and contain some basic information, such as the user’s
name. In the e?mail, it will often state that there is a problem with the person’s account or
access privileges. They will be told to click a link to correct the problem. After they click
the link—which goes to a site other than the bank’s—they are asked for their username,password, account information, and so on. The person instigating the phishing can then
use the values entered there to access the legitimate account
A large private university has over 30,000 students taking online classes. These students
use a variety of systems and network connections. The instructors of this university are
being routinely hit with the Klez32 virus. Klez32 (specifically, in this case, the W32/Klez.
mm virus) is a well-known and documented virus. It uses Outlook or Outlook Express to
spread. It grabs a name randomly from the address book and uses that name in the header.
The worm then uses a mini-mailer and mails the virus to all the people in the address
book. When one of these users opens the file, the worm attempts to disable their antivirus
software and spread to other systems. Doing so opens the system to an attack from other
viruses, which might follow later.
You’ve been appointed to the IT department at this school, and you’ve been directed to
solve this problem. Ponder what you can do about it.
The best solution would be to install antivirus software that scans and blocks all e?mails
that come through the school’s servers. You should also inspect outgoing e-mail and
notify all internal users of the system when they attempt to send a virus-infected document
using the server.
These two steps—installing antivirus scanners on the external and internal connections
and notifying unsuspecting senders—would greatly reduce the likelihood that the virus
could attack either student or instructor computers.
One of the most important measures you can take to proactively combat software
attacks is to know common file extensions and the applications they’re associated with.
For example, the .scr filename extension is used for screensavers, and viruses are often
distributed through the use of these files. No legitimate user should be sending screensavers
via e?mail to your users, and all attachments with the .scr filename extension should be
banned from entering the network.
Table 2.3, while not comprehensive, contains the most common filename extensions for
files that should and should not, as a general rule, be allowed into the network as e?mail
attachments
Table 2.3 Common Filename Extensions for E?mail Attachments
Após instalar o Agent do ARC Server backup for Linux no Centos 5.4, não havia comunicação entre o servidor e o Agent em Linux, então limpei as regras do IPTABLES, assim funcionou perfeitamente mas como não podia deixar meu Firewall todo aberto, adicionei a seguinte linha no meu iptables:
O Iptables trabalhar com uma ordem de regras, para que a minha nova regra funcionasse, passei a seguinte linha para o fim do meu arquivo:
para editar o arquivo digite : nano /etc/sysconfig/iptables
-A RH-Firewall-1-INPUT -j REJECT –reject-with icmp-host-prohibited
Antes desta linha adicionei a seguinte:
-A RH-Firewall-1-INPUT -p udp -m udp –dport 6051 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 6051 -j ACCEPT
Após inserir as linhas reinicie o iptables : /etc/init.d/iptables restart
Edite também o arquivo agent.cfg,descomentando as linhas marcadas de vermelho, que são as portas de comunicação do agent com o servidor.
para editar o arquivo digite: nano /opt/CA/BABcmagt/agent.cfg
[0]
#[LinuxAgent]
NAME LinuxAgent
VERSION 12.5.0
HOME /opt/CA/BABuagent
#ENV CA_ENV_DEBUG_LEVEL=4
ENV BAB_OS_TYPE=CENTOS_I686
ENV UAGENT_HOME=/opt/CA/BABuagent
#ENV LD_ASSUME_KERNEL=2.4.18
ENV LD_LIBRARY_PATH=/opt/CA/BABcmagt:$LD_LIBRARY_PATH:/opt/CA/SharedComponents/lib:/opt/CA/BABuagent/lib
ENV SHLIB_PATH=/opt/CA/BABcmagt:$SHLIB_PATH:/opt/CA/SharedComponents/lib:/opt/CA/BABuagent/lib
ENV LIBPATH=/opt/CA/BABcmagt:$LIBPATH:/opt/CA/SharedComponents/lib:/opt/CA/BABuagent/lib
BROWSER cabr
AGENT uagentd
MERGE umrgd
VERIFY umrgd
[36]
#[BABcmagt]
#NAME BABcmagt
#HOME /opt/CA/BABcmagt
TCP_PORT 6051
UDP_PORT 6051
#UDP_BCAST_PORT 41524
#DOS_MAXITEMS 1000
#DOS_DEFAULTTIMEOUT 30
Reinicie o Agent : uagent stop e uagent start