Ed Smiley’s Blog

These are my links for June 5th through June 22nd:

• Security Onion – The Security Onion LiveCD is a bootable CD that contains software used for installing, configuring, and testing Intrusion Detection Systems.
• YouTube – Episode 4: Visualization of Crime – In the fourth episode of Team Cymru's 'The Who and Why Show', Marcel van den Berg takes us through a few animations charting our unique global insight into the Underground Economy.
• Social Engineering: 5 Security Holes at the Office (Includes Video) – CSO Online – Security and Risk – We poked around a secure building with social engineering expert Chris Nickerson and found several ways a criminal could get inside and access sensitive data
• Pretty-Bad-Proxy: An Overlooked Adversary in Browsers’ HTTPS Deployments – Microsoft Research – HTTPS is designed to provide secure web communications over insecure networks. The protocol itself has been rigorously designed and evaluated by assuming the network as an adversary. This paper is motivated by our curiosity about whether such an adversary has been carefully examined when HTTPS is integrated into the browser/web systems. We focus on a specific adversary named “Pretty-Bad-Proxy” (PBP). PBP is a malicious proxy targeting browsers’ rendering modules above the HTTP/HTTPS layer. It attempts to break the end-to-end security guarantees of HTTPS without breaking any cryptographic scheme. We discovered a set of vulnerabilities exploitable by a PBP: in many realistic network environments where attackers can sniff the browser traffic, they can steal sensitive data from an HTTPS server, fake an HTTPS page and impersonate an authenticated user to access an HTTPS server. These vulnerabilities reflect the neglects in the design of modern browsers – they affect all major browsers…
• SandCat | PenTestIT – SandCat has two versions – free & pro. Both these versions are programmed with the Open Web Application Security Project (OWASP) and the SANS Institute vulnerabilities in mind. You can also scan for the latest buzz word in the security market: WebDav with this tool. Basically, SandCat is a remote web application security assessment scanner. You can scan for almost all web application flaws. Sandcat remotely injects data in the web applications and analyzes the application response. This helps it to determine if the application code is vulnerable to specific attacks such as SQL Injection, XSS, and many other web application vulnerability flaws.
• Greg Miller’s Guide to Lock Picking for Beginners –
• The Ultimate Lock Picker Hacks Pentagon, Beats Corporate Security for Fun and Profit – Tobias is laughing. And laughing. The effect is disconcerting. It's a bwa-ha-ha kind of evil mastermind laugh—appropriate if you've just sacked Constantinople, checkmated Deep Blue, or handed Superman a Dixie cup of kryptonite Kool-Aid, but downright scary in a midtown Manhattan restaurant during the early-bird special.
• Security Musings » Blog Archive » How does SSL work anyway? – We talk a lot about how SSL is useful, but how exactly does it work? Most systems today use SSL v3/TLS v1 rather than “SSL”, and the nitty gritty details are found in RFC 2246.
• MIR-ROR – Home – MIR-ROR: Motile Incident Response – Respond Objectively, Remediate MIR-ROR is a security incident response specialized, command-line script that calls specific Windows Sysinternals tools, as well as some other useful tools, to provide live capture data for investigation.

  You can easily enhance MIR-ROR to your liking with whatever command line tools you find useful.
  For incident response resource, we’ve found it indispensable.
  Windows Systinternals licensing prevents us from bundling the tools in a distribution package; you’ll have to retrieve them.

• Nine out of ten work PCs fail on basic security | Graham Cluley’s blog – Ninety percent of corporate PCs are a security risk because they are not fully patched, or do not have basic security such as anti-virus software and firewalls properly installed.

These are my links for May 1st through May 14th:

• Lifehacker – TiltShift Makes Your Photos Look Like Miniatures – Tilt-Shift Photography – Web site and Adobe AIR application TiltShift gives your photos a tilt-shift photography effect that normally requires expensive special lenses or Photoshop chops.
• Advanced Malware Cleaning –
• Main Page – Netkit Wiki – Understanding computer networks without performing practical experiments is really difficult, not to say it is almost impossible. Unfortunately, setting up a networking lab can be very expensive.

  Netkit has been conceived as an environment for setting up and performing networking experiments at low cost and with little effort. It allows to "create" several virtual network devices (full-fledged routers, switches, computers, etc.) that can be easily interconnected in order to form a network on a single PC. Networking equipments are virtual but feature many of the characteristics of the real ones, including the configuration interface.

• Grand Stream Dreams: Microsoft XP Mode link-dump – Windows 7 XPM links and Comments
• A Step-by-Step introduction to using the AUTOPSY Forensic Browser « SANS Computer Forensics, Investigation, and Response – This is a brief tutorial on how to use the Autopsy Forensic Browser as a front end for the Sleuthkit. This tool is an essential for Linux forensics investigations and can be used to analyze Windows images.
• Helix Imaging PC – Building a dedicated Helix Imaging PC
• Forensic Focus – Computer Forensics – Digital Forensics, Computer Forensic Training, eDiscovery
• E-Evidence Information Center – What’s New – April 2009 – The Electronic Evidence Information Center
• Taking over the Torpig botnet – Paper on UCSB Security lab taking over botnet
• Tenable Network Security: Using Nmap Results With Nessus Batch Scanning – Tenable has supported Nmap usage within Nessus for several years. Nmap and Nessus have different types of scanning philosophies and understanding how they work can help you achieve success with your network scanning efforts.

These are my links for April 13th through April 23rd:

• SecurityFocus – Infocus: Incidents – Various topics of incidents with complete a run through.
• JADsoftware – IEF home page – Internet Evidence Finder (IEF) searches the selected drive or memory dump file (or pagefile.sys / hiberfil.sys file) for Internet artifacts. It can currently find Facebook® live chat messages and page fragments, MSN® chat, and Yahoo!® chat.
• Computer Security Jump Bag – A Jump Bag is the term used to describe the bag or container holding all of the tools you need to appropriately respond to a computer security incident.

  SANS Incident Handling Course covers the topic of Incident Handling in-depth.

• Entering the Networked World – Reference for getting started in computer forensics – Great post of references for getting started in computer forensics
• NirBlog: Saved Password Locations – a list of password storage locations for popular applications

These are my links for March 26th through April 13th:

• Podnutz Episode 29: Hard Drives and Data Recovery w/Scott Moulton | Podnutz – Tech Podcast Network – Here we attempt to cover all there is to know about hard drives, from the physical parts to the data they contain. We of course couldn't fit this all into one show so we'll have to get Scott back for another!
• DIY Forensics & Incident Response Lab – Evil Bytes Blog – Dark Reading – Continuing with the do-it-yourself lab theme, let's turn to the areas of incident response (IR) and forensics, and how they can benefit from an in-house security training lab.
• Virtual appliances for the security professional | tssci security –
• The Ethical Hacker Network – Video Tutorial: Pass-The-Hash Toolkit – Ryan Linn is back with another video for your learning pleasure. This time he gives a video tutorial of an existing toolset, the Pass-The-Hash Toolkit by Core Security. Core describes it as, "The Pass-The-Hash Toolkit contains utilities to manipulate the Windows Logon Sessions mantained by the LSA (Local Security Authority) component.
• Downloads: MinTTY Gives Cygwin a Native Windows Interface – If you need your Unix command line on a Windows PC, chances are you use a terminal emulator like Cygwin—and if you do, you want to check out MinTTY.