Infosec Events

Week 29 in Review – 2010

glenn — Mon, 26 Jul 2010 04:33:59 +0000

Events Related:

(Def) #ConSurvival – h-i-r.net
Some practical tips on how to get through DefCon
BlackHat and DefCon Tips: 2010/N00b Edition – it.toolbox.com
More things to remember on your next Vegas security event
BlackHat Track Schedule – uktek.com
A full schedule of the when and where certain talks are going to be held.

Tools:

Ubitack 0.2 – code.google.com/p/ubitack/
This tool automates some of the tasks you might need on a (wireless) penetration test or while you are on the go.
SIPVicious 0.2.6 Available – voipsecurityblog.typepad.com
SIPVicious was written in python and can be used on Linux, Windows, FreeBSD 6.2 and Mac OS X.
Open source GSM cracker released
I have named this beast Kraken, after a Norse mythological creature capable of eating many things for breakfast. Kraken feeds of an exclusive diet of A5/1 encrypted data.
- New ‘Kraken’ GSM-Cracking Software is Released – cio.com
- The call of Kraken – reflextor.com
- GSM Cracking Tool. Yes it’s open source – marcoramilli.blogspot.com
Sagan – Real-time System & Event Log (syslog) Monitoring System – darknet.org.uk
Sagan can alert you when events are occurring in your syslogs that need your attention right away, in real time!
PlugBot – theplugbot.com
PlugBot is a research project led by Jeremiah Talamantes, a penetration tester and security researcher for RedTeam Security.
WATOBO – THE Web Application Toolbox – sourceforge.net/apps/mediawiki/watobo/
We are convinced that the semi-automated approach is the best way to perform an accurate audit and to identify most of the vulnerabilities.
WebEnum 0.1 – code.google.com/p/webenum/
WebEnum is a tool to enumerate http responses to dynamically generated queries.
dic – code.google.com/p/dic/
“Download Indexed Cache” is a Proof of Concept (PoC) which implements the Google SOAP Search API to retrieve content indexed within the Google Cache to support the “Search Engine Reconnaissance” section of the OWASP Testing Guide v3

Techniques:

Shell of the Future – Reverse Web Shell Handler for XSS Exploitation – andlabs.org
In pentests XSS is usually considered as a dead-end vulnerability – you discover it, take a screenshot and move on to something else.
Identifying Suspicious URLs – threatpost.com
In the Google TechTalk, Justin Ma, a PhD candidate at UC San Diego, discusses a novel method for determining which URLs are malicious by applying large-scale online learning techniques.
Stuxnet and .lnk related studies
- CPLINK Shortcut mitigation and certificate revocation – sophos.com
- Windows ‘LNK’ Exploit Demonstration – attackvector.org
- Mitigating .LNK Exploitation With SRP – didierstevens.com
- Details for the LNK issue along with a live sample – @hdmoore
- Stuxnet Memory Analysis and IOC creation – mandiant.com
- File Server LNK/stuxnet Protection – attackvector.org
- Distilling the W32.Stuxnet Components – symantec.com
Weaponizing the Nokia N900 – Part 1 – voipsa.org
Broadly speaking, the objective of this series of blog posts is to introduce folks to the tools available and the potential for this phone as a security testing platform.
Fun with Metasploit payload generation – happypacket.net
My goal was to figure out how to add the msfencode functionality into the generate_simple function that is used by both XMLRPC and the console so that you can encode payloads and all that fun stuff from within Metasploit.
iSEC is releasing this pre-advisory for Kerberos flaws to be discussed at BH. Must read for AD Admins. – @alexstamos

Vulnerabilities:

More news about the Stuxnet Flaw
The said malware exploits a newly-discovered vulnerability in shortcut files, which allows random code to be executed on the user’s system.
- Microsoft Has No Plans To Patch New Flaw – slashdot.org
- The Microsoft LNK / USB worm / rootkit ‘issue’ will kill WIN XP SP2 and WIN2000 earlier… – eddywillems.blogspot.com
- Shortcut zero-day attack code goes public – sophos.com
- Stuxnet Saga Evolves With New Digitally Signed Binaries – threatpost.com
- Tool Blunts Threat from Windows Shortcut Flaw – krebsonsecurity.com
- Stuxnet-A View From an Energy Perspective – mcafee.com
Twitter XSS Bug – xs-sniper.com
99% of XSS bugs are fairly straightforward and this bug was no exception.
IE and Safari lets attackers steal user names and addresses – theregister.co.uk
Jeremiah Grossman, CTO of White Hat Security, plans to detail critical weaknesses that are enabled by default in the browsers, which are the four biggest by market share.
Old Wireless Security Flaws Still Haunting Networks – threatpost.com
The attack is specifically designed to work against the Cisco Aironet 1200 Series access points and is a twist on existing attacks that have shown WEP to be an eminently defeatable protocol.
SAP GUI: command execution via wadmxhtml – vigilance.fr
An attacker can use the wadmxhtml.dll ActiveX of SAP GUI, in order to execute code on computers of victims displaying a malicious HTML page.
WPA2 vulnerability found – networkworld.com
Hole 196 lends itself to man-in-the-middle-style exploits, whereby an internal, authorized Wi-Fi user can decrypt, over the air, the private data of others, inject malicious traffic into the network and compromise other authorized devices using open source software, according to AirTight.

Vendor/Software Patches:

Adobe to use sandboxing to mitigate onslaught of Reader-focused attacks
The next major version of Adobe’s PDF Reader will feature new sandboxing technology aimed at curbing a surge in malicious hacker attacks against the widely deployed software.
- Adobe adding ’sandbox’ to PDF Reader to ward off hacker attacks – zdnet.com
- Adobe: ‘Sandbox’ Will Stave Off Reader Attacks – krebsonsecurity.com

Other News:

New plug-in tester mimics Mozilla’s – cnet.com
Qualys’ BrowserCheck helpfully targets out-of-date plug-ins, and provides links to download updates.
VeriSign adds malware scanning to SSL services – cnet.com
VeriSign is adding malware scanning to its authentication services for Web site operators, the company announced on Monday.
Siemens SCADA comes with hard-coded password, doesn’t recommend changing it.
A sophisticated new piece of malware that targets command-and-control software installed in critical infrastructures uses a known default password that the software maker hard-coded into its system.
- SCADA System’s Hard-Coded Password Circulated Online for Years – wired.com
- Yes, there’s malware. But don’t change your SCADA password, advises Siemens – sophos.com
Dell KACE Secure Browser Sandboxes Your Browsing – lifehacker.com
Secure Browser is designed so even if you find yourself on a site that could harm your computer, the harmful effects are contained within the browser sandbox.
Skimmers Siphoning Card Data at the Pump – krebsonsecurity.com
Forced to re-issue an unusually high number of bank cards due to fraudulent charges on the accounts, a regional bank serving Colorado and surrounding states recently began searching for commonalities among the victimized accounts.
Google Ups the Bug Bounty Ante to $3133.7 – threatpost.com
The maximum reward for a single bug has been increased to $3,133.7. We will most likely use this amount for SecSeverity-Critical bugs in Chromium.
PC giant warns of hardware trojan – newscientist.com
Further information posted on Dell’s community forum reveals that the trojan in the affected motherboards is stored in onboard flash memory rather than firmware ROMs.
Certified uncertainty – sophos.com
Second, this particular component of the threat was signed on January 25th, 2010. This implies the perpetrators of this attack have been planning their strategy for quite some time.
How Mass SQL Injection Attacks Became an Epidemic – threatpost.com
Mass compromises of legitimate sites really began in earnest in 2007, and the volume and severity of the attacks has increased significantly since then.
Why Steal Digital Certificates? – eset.com
In theory the digital signature also tells you who signed the file, and who issued the digital certificate so you can decide if you trust the person or company who signed the file and if you trust the organization who issued the certificate.
Forget Walmart. Hackers Conference Badges Show The Future of RFID Tracking – gizmodo.com
This year, HOPE’s Attendee Meta-Data or AMD badge reached new heights, and suggested more about what you could do with RFID attached to people—both good and bad.
Backtrack vs Windows – youtube.com
Spoof of evo vs iphone with an influence in security .. DEFCON 18

Washington, DC Security Community

glenn — Fri, 23 Jul 2010 12:40:25 +0000

Each week, we’ll highlight a major city in the US and cover the places and events you can go to in that area to get your security information fix. This post is part of the information security communities.

Washington, D.C. is not just about politics. The nation’s capital also is home to various groups dedicated to information security. Many of the brightest minds in the US gather here, from military security advisors to civilian and corporate IT professionals. Here are a few of local professional groups based here.

Washington DC OWASP Chapter – Originally, the DC chapter of OWASP had members from nearby Virginia and Delaware but those areas have since grown to host their own chapters. This chapter hosted the national OWASP conference last 2009. Meetings are free and open to all people interested in web security and if you would like to present something, you are most welcome to do so. Follow them in Twitter or sign up for the mailing list.
ISSA National Capital Chapter – The national chapter regularly holds open meetings that anyone can be a part of. Membership is likewise open to active security professionals. Some of the notable presentations given are “Becoming a Better Cyber-Warrior: Finding Advanced Persistent Threats Using Real-Time Situational Awareness” and “The Case for Network Forensics”
ISACA National Capital Area Chapter (NCAC) – The NCAC is one of the oldest security groups around and was founded in 1974. The chapter regularly holds monthly conferences (except during summer), exam reviews and networking events. You can grab the newsletter here or monitor chapter news feeds. Some interesting presentations from the group are “Innovation in Federal IT – Enabling an open and transparent government” and “Myths & Realities of Data Security & Compliance: A Risk-based Approach to Data Protection”
National Information Security Group – Washington, DC Chapter – Membership to this group is open to the public. A couple of presentations to come out of the group is “InfoGraphX” and “Defending Against Cybercrime in 2010″.
InfraGard Nations Capital Members Alliance – This group is a public-private entity with close ties to the federal government through the FBI. It boasts over 1000 members both civilian and federal employees. Join Infragard here.

Of course, there are also smaller, less-structured get-togethers that happen in DC. Here are some local meetings that might interest you.

DC2600 – Covering Northern Virginia and Maryland as well as the DC metro area, the group meets regularly at Champps Pentagon. You can drop by a meet or follow their Twitter feed.
DC Organization of Hackers (DoH) – While their webpage might not be updated, ask around and you might stumble upon a member or two.
CapSecDC – Another down homepage but their Twitter feed is very much alive. Follow them here.

If you would rather smash transistors instead of code, there are also a few hackerspaces in DC.

HacDC – From disassembling computers to tinkering with microcontrollers, you can expect a lot of hacking action in this place. The organization started in 2008 and has been featured in The Washington Post. Some of their upcoming events are HacDC Narg and Disassembly Dienstag. Join them here.
Dorkbot DC – This group is dedicated to putting a cultural spin on electronics projects. Subscribe to their events mailing list or attend their free sessions.

Lastly, the capital is host to many security events where you can network and even learn a new thing or two.

USENIX Security Symposium – The upcoming 3-day program will be held on August 11 – 13 so mark your calendars. On top of the keynotes and discussions, USENIX will also be offering workshops prior to the main event.
SANS Whatworks – SANS comes to the capital with an event that focuses on virtualization and cloud computing. It’s going to be held at Fairmont on August 19. There is also going to be another event on December, this time focusing on incident detection.
CSI 2010 – Technically, this isn’t going to be in DC but as the largest security event on the East Coast, it’s one that you shouldn’t miss. From forensic workshops to medical device security, this two-day event will keep you pretty busy.
AppSec DC – OWASP is back in DC with a slew of training sessions and talks. Some of the notable talks are “Transparent Proxy Abuse” and “Unicode Transformations: Finding Elusive Vulnerabilities“.

There you have it, hope you got your security fix with the links we gave. If you need help or want to reach out to the DC community, just contact us.

Week 28 in Review – 2010

glenn — Mon, 19 Jul 2010 09:56:17 +0000

Events Related:

RECON 2010: The best conference ever in the worst hotel ever – ncircle.com
It was held in Montreal from July 9th to the 11th at a supposedly posh hotel where the air-conditioning wasn’t working at all building-wide during a heat wave.
SOUPS Keynote & Slides – emergentchaos.com
In “Engineers Are People, Too” Adam Shostack will address an often invisible link in the chain between research on usable security and privacy and delivering that usability: the engineer.
Photos: The Next HOPE (Hackers On Planet Earth) – laughingsquid.com
Pictures from the the Hotel Pennsylvania event.
Assange is a no-show
A Wikileaks editor, deciding not to risk a confrontation with federal agents, skipped a high-profile speaking engagement at a hacker conference here on Saturday.
- HOPE: scheduled keynote by Julian Assange of Wikileaks – boingboing.net
- Wikileaks editor skips NYC hacker event – cnet.com

Resources:

Python tools for penetration testers – dirk-loss.de
If you are involved in vulnerability research, reverse engineering or penetration testing, I suggest to try out the Python programming language.
See 20 Minute Video Presentation on How to Choose an IPS – icsalabs.com
Considering which network IPS is the best fit for your enterprise or SMB?

Tools:

Belch v1.0 – Burp external channel manipulator – invalid-packet.blogspot.com
Belch is a plug-in for burp suite designed to aid protocol analysis and manipulation, it is fairly simple.
ScanPW – pke.nu/scan
ScanPW it’s a free web application that let’s you, in a fast and secure way, analize a webpage source code.
Metasploit Framework 3.4.1 Released! – metasploit.com
This release sees the first official non-Windows Meterpreter payload, in PHP as discussed last month.
Facetime on Iphone 4: Vanilla unencrypted STUN and SIP – roychowdhury.org
No hacking needed – just an on the wire black box inspection – its just plain SIP and STUN for firewall discovery.
Kismet – kismetwireless.net
Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic.
Crypto tool predicts password cracking time – h-online.com
Instead of indicating password quality via coloured bars, the Windows crypto tool Thor’s Godly Privacy (TGP) informs users about the estimated time required for a successful brute-force attack on the chosen password.
PEScrambler – code.google.com/p/pescrambler/
PEScrambler is a tool to obfuscate win32 binaries automatically. It can relocate portions of code and protect them with anti-disassembly code.
SIFT Workstation out now
A new version of SIFT Workstation is out, here the new features: VMware Appliance, ready to tackle forensics, and cross compatibility between Linux and Windows among others.
- SANS Investigative Forensic Toolkit – marcoramilli.blogspot.com
- SANS Investigative Forensic Toolkit (SIFT) Workstation: Version 2.0* – sans.org
skipfish v 1.51 – code.google.com/p/skipfish
A fully automated, active web application security reconnaissance tool.
NMAP 5.35DC1 released – nmap.org
Nmap and Zenmap (the graphical front end) are available in several versions and formats.
Binary Auditor – binary-auditing.com
Educate yourself in the field of Binary Auditing and Reverse Code Engineering for FREE!

Techniques:

Metasploit Basics Series
- Metasploit Basics – Part 3: Pivoting and Interfaces – digitalbond.com
- Metasploit Basics – Part 4: Exploit and Attack Example – digitalbond.com
Cisco Industrial Ethernet 3000 Series switches have hardcoded SNMP community strings – cert.org
Successful exploitation of the vulnerability could result in an attacker obtaining full control of the device.
Metasploit New GUI – darkoperator.com
A new GUI for Metasploit was added yesterday by ScriptJunkie to the Metasploit SVN Repository, this is the first version of a development version as part of the Framework that is going to be improved and worked one as time progress.
Malware Persistence without the Windows Registry – mandiant.com
The malware needs to be installed persistently, meaning that it will remain active in the event of a reboot.
Mitigating .LNK Exploitation With Ariad – didierstevens.com
When you load the CD-ROM with the PoC (I use an ISO file inside a VM) and take a look at DbgView’s output, you’ll notice that payload gets executed.

Vulnerabilities:

Firefox Add-On Exploited
It was discovered that this add-on contains code that intercepts login data submitted to any website, and sends this data to a remote location.
- Mozilla Sniffer – mozilla.com
- Firefox security test add-on was backdoored – netcraft.com
Rootkit.TmpHider – anti-virus.by
Modules of current malware were first time detected by “VirusBlokAda” company specialists on the 17th of June, 2010 and were added to the anti-virus bases as Trojan-Spy.0485 and Malware-Cryptor.Win32.Inject.gen.2.
USB Shortcuts Introduce New Can Of Worms To Windows Systems
Researchers have discovered a sophisticated new strain of malicious software that piggybacks on USB storage devices and leverages what appears to be a previously unknown security vulnerability in the way Microsoft Windows processes shortcut files.
- Experts Warn of New Windows Shortcut Flaw – krebsonsecurity.com
- Zero-Day vulnerability allows USB malware to run automatically, Sophos reports – sophos.com
- Windows zero-day attack works on all Windows systems – sophos.com
Trojan.Sasfis: A Closer Look – symantec.com
In our recent article on Trojan.Sasfis we focused on the spam angle of the attack and in this piece we will take a deeper look at this somewhat persistent threat which our global sensors indicate is recently on the rise.
Researchers: Authentication crack could affect millions – computerworld.com
A well-known cryptographic attack could be used by hackers to log into Web applications used by millions of users, according to two security experts who plan to discuss the issue at an upcoming security conference.
Malware exploiting x86 machine code redundancy – sophos.com
By definition an emulator will never be exactly like ‘the real thing’, and malware authors continually try to exploit this fact in order to evade detection.

Vendor/Software Patches:

Microsoft’s New Patch Tuesday
As part of our usual monthly update cycle, today Microsoft is releasing four security bulletins to address five vulnerabilities in Windows and Microsoft Office.
- July 2010 Security Bulletin Release – technet.com
- Microsoft Security Bulletin MS10-042 – Critical – microsoft.com
- Microsoft Security Bulletin MS10-043 – Critical – microsoft.com
- Microsoft Security Bulletin MS10-044 – Critical – microsoft.com
- Microsoft Security Bulletin MS10-045 – Important – microsoft.com
- MS10-042: Vulnerability in Help and Support Center – technet.com
- MS10-045: Microsoft Office Outlook Remote Code Execution vulnerability – technet.com
- Microsoft Patch Tuesday – July 2010 – symantec.com
- Express patch for Windows Help Center – h-online.com
Winamp 5.58 eliminates critical FLV vulnerabilities – h-online.com
According to French security services provider VUPEN, the problem is related to integer and buffer overflow issues within the VP6 decoder “vp6.w5s” used by Winamp when opening a specially crafted Flash Video (FLV) file.

Other News:

FBI Raids ‘Electronik Tribulation Army’ Over Witness Intimidation – wired.com
Jesse William McGraw, aka “GhostExodus,” pleaded guilty in May to computer-tampering charges for putting malware on a dozen machines at the Texas hospital where he worked as a security guard.
GFI Software acquires Sunbelt Software – sunbeltblog.blogspot.com
Today, it was announced that Sunbelt Software has been acquired by GFI Software.
Developers just don’t go to security conferences – swreflections.blogspot.com
Developers and managers need to choose carefully where to spend their company’s money and time – or their own.
Secunia Half Year Report for 2010 shows interesting trends – sans.edu
Since 2005, no significant up-, or downward trend in the total number of vulnerabilities in the more than 29,000 products covered by Secunia Vulnerability Intelligence was observed.
Talk on Chinese Cyber Army Pulled From Black Hat – threatpost.com
A talk on China’s state-sponsored offensive security efforts scheduled for the Black Hat conference later this month has been pulled from the conference after concerns were raised by some people within the Chinese and Taiwanese government about the talk’s content.
“Millions” Of Home Routers Vulnerable To Web Hack – forbes.com
The upcoming Black Hat security conference in Las Vegas offers an annual parade of security researchers revealing new ways to break various elements of the Internet.
Mozilla Bumps Bug Bounty to $3,000 – threatpost.com
In an effort to enlist more help finding bugs in its most popular software, such as Firefox, Thunderbird and Firefox Mobile, Mozilla is jacking up the bounty it pays to researchers who report security flaws to $3,000
MS Windows Token Kidnapping Problems Resurface – threatpost.com
Cesar Cerrudo, founder and CEO of Argeniss, a security consultancy firm based in Argentina, first reported the token kidnapping hiccup to Microsoft in 2008 and after waiting in vain for a patch, he released the details during the Month of Kernel Bugs project.
DNS root zone finally signed, but security battle not over – arstechnica.com
This is an important step in the deployment of DNSSEC, the mechanism that will finally secure the DNS against manipulation by malicious third parties.

Seattle Security Community

glenn — Fri, 16 Jul 2010 15:37:09 +0000

Each week, we’ll highlight a major city in the US and cover the places and events you can go to in that area to get your security information fix. This post is part of the information security communities project.

Emerald City. It’s best known for its coffee and since caffeine fuels ideas, lots of great security guys flock to this city. Well, that and the great technology community in the area. Let us share a few local professional groups based in Seattle.

OWASP Seattle Chapter – A chaper of the Open Web Application Security Project, this group is made up of volunteers and it is free for anyone to join (RSVPing might be required though). This local group features support from both local university advisors and law enforcement units. A couple of the latest presentations made were “When Tools Are Not Enough – Best Practices for Securing Web Applications” and “When Tools Are Not Enough – Best Practices for Securing Web Applications”. Join their mailing list here.
ISSA, Puget Sound – This non-profit security group meets every third Thursday except on October due to the SecureWorld Expo. Perks of being a member include reduced rates at ISSA events, CPE credits and lots of opportunities to network. Presentations are also welcome.
ISACA – Puget Sound – The main purpose of this chapter of ISACA is “to promote the education of individuals for the improvement and development of their capabilities relating to the auditing of and/or management consulting in the field of information systems audit and control”. They’re currently on break but will resume monthly meetings on September. Meetings are every third Tuesday of each month and everyone is welcome even non-members. Please register in advance.
NAISG Seattle Chapter – The group meets at Bellevue Community College every month and it is free to the general populace. Past presentations include “Duct Tape, Band-Aids and Bubble Gum Shouldn’t Be Used to Build Security” and “How Secure Are You? Keeping Secure in an Interconnected World”. Click here to join.

Local meetings are a great place to meet up with other infosec people in a non-structured way. Chip in for some pizza, beer and the latest security exploits.

DC206 – This group is open to all people “interested in the alternate applications of modern technology.” Monthly meetings are held at The Black Lodge. Join the mailing list and find out more about them.
Wa2600 – Meetings are held every first Friday at the Washington State Convention and Trade Center (and are free too). People here have a passion for technology and like to tinker so bring your

For the folks more into voiding warranties, there are a few hackerspaces in the city as well.

Saturday House – A loose group of people (mostly geeks and their friends) who meet regularly to discuss anything. Currently they are nomadic and have no single space but if you want to keep track of them, go ahead and join their mailing list or follow @saturdayhouse.
Jigsaw Renaissance – No, they don’t assemble jigsaw puzzles (not exclusively anyway). This collective encourages communal learning and all-out tinkering while promoting sustainability.
Hackerbot Labs – You’ve got to love their tag line: “Smoke is how a circuit board expresses love.” This is a private space so get in touch if you want to know more.
Metrix Create – This group holds fee-based monthly workshops from basic electronics to Arduino programming. Some past highlights include vegan deer trophies and life-size yeti sculptures.

Also, take note of a few events and un/conferences in the city. These are not exclusively security-based gatherings but each do carry the spirit of technology sharing (and probably some booze at some point).

SecureWorld Expo – Held each year in October, the SecureWorld Expo is one of the major security events in the region. It features keynotes, training sessions and roundtables. The next event is on October 27 – 28.
Ignite Seattle – An unconference bringing geeks with ideas together four times a year. Speakers get five minutes to strut their stuff on stage.
BarCampSeattle – An open environment where people share and learn. Free flowing technology and fun for everyone!
Seattle Mind Camp – Another unconference. Sessions and schedules are designed by attendees.

I hope you got your fill from the links above. If you like, you can contact us to help get in touch with a local group or event.

Week 27 in Review – 2010

glenn — Mon, 12 Jul 2010 10:31:21 +0000

Resources:

Welcome to Issue 003 of the HITB Magazine! – hitb.org
In conjunction with our first European event, we have lined up an interview with Dutch master lock picker and founder of The Open Organization of Lock Pickers (TOOOL) Barry Wels.
Various Presentations During HITB Amsterdam 2010 - hitb.org
People Searches - sans.org
During a computer exam for an employee threats case, we found activity on Facebook, Twitter, and two different webmail accounts.

Tools:

REMnux: A Linux Distribution For Reverse-Engineering Malware - darknet.org.uk
REMnux is a lightweight Linux distribution for assisting malware analysts in reverse-engineering malicious software.

Techniques:

Pwning PHP for fun and chocapicz – nibbles.tuxfamily.org
Today, i’m going to talk about the latest PHP vulnerability discovered by Stefan Esser and published on the 25 of June.
Quickpost: Preventing the /Launch Action “cmd.exe” Bypass – didierstevens.com
Adobe has released a new Adobe Reader version that contains functionality to block my /Launch action PoC, but Bkis found a bypass.
Exposing HMS HICP Protocol + 0Day ‘light’ + SCADA_SHODAN - reversemode.com
Today we are going to reverse a simple M2M propietary protocol developed by the Swedish company HMS.
Episode #103: Size Might Matter… But Timing is Everything – commandlinekungfu.com
A recursive directory listing, which includes system and hidden files by using the -Force option, is filtered based on the last access time.
Twitter Miscellany
- rm -rf ~/.cache; ln -s /etc/shadow ~/.cache; ssh localhost (trigger pam_motd by re-logging in and you’ll own /etc/shadow) #tweetsploits
  - jonoberheide
Intro to RailGun: WIN API for Meterpreter – room362.com
Basically what this allows you to do is make Windows API calls from Meterpreter without compiling your own DLL.
How to Own a Database With SQL Injection – threatpost.com
Two common variations of the SQL Injection exist. Both are code injection techniques that exploit security vulnerabilities.
OSX ROP Exploit – EvoCam Case Study – exploit-db.com
The technique used in that tutorial only worked on the previous incarnation of Apple’s OS X operating system known as Leopard (10.5.x).
Index of /ciphers/skype – cryptolib.com
Nothing to see here, just the security ciphers for Skype’s proprietary.
Beyond Fuzzy Hashing - jessekornblum.com
Computers are fantastic at finding identical pieces of data, but terrible at finding similar data. Part of the problem is first defining the term “similar” in any given context.
Updated Web Application Security Testing Collection for Firefox – adammuntner.blogspot.com
This is an advanced method useful for those who want to redistribute the file, such as administrators.
Metasploit Basics – Part 2: Payload - digitalbond.com
In this installment of Metasploit Basics I will discuss the payload modules included in Metasploit.
Wildly successful social engineering – uncommonsensesecurity.com
I am not talking about the “Robin Sage” social media/social engineering case where a lot of people who should know better gave up a lot of information in a lot of different ways.
Launching Web Application Security Scans From The Command Line - websecurify.com
Starting with Websecurify 0.6, you can launch the web application security scanner from the command line.
Hacking FaceTime
A look into the data streamed by the iPhone 4’s new video conference feature.
- Special Look: Face Time (part 1: Introduction) - packetstan.com
- Special Look: Face Time (part 2: SIP and Data Streams) – packetstan.com
- Special Look: Face Time (part 3: Call Connection Initialization) – packetstan.com
Detecting Mobile Browsers - marcoramilli.blogspot.com
This web site does not only recognize if a mobile phone is surfing on it but it provides a great set of open source scripts to detect them.

Vulnerabilities:

YouTube Hit By HTML Injection Vulnerability – slashdot.org
The bug is triggered by placing a