Ed Smiley’s Blog

These are my links for December 26th through January 15th:

• Investigating Breaches –
• Social Engineering: The Basics – What is social engineering? What are the most common and most current tactics? And how can your organization prevent these scams? A guide on how to stop social engineering.
• Jeremiah Grossman: Top Ten Web Hacking Techniques of 2009 (Official) – Every year the Web security community produces dozens of new hacking techniques documented in white papers, blog posts, magazine articles, mailing list emails, etc. Not to be confused with individual vulnerability instances brandishing CVE numbers, nor intrusions / incidents, but actual new methods of Web attack. Some techniques target websites, others Web browsers, and the rest somewhere in between. Historically much of this research would unfortunately end up in obscure corners of the Web and become long forgotten. Now it its fourth year the Top Ten Web Hacking Techniques list provides a centralized repository for this knowledge and recognize researchers contributing to the advancement of our industry. 2009 produced ~80 new attack techniques
• Various Online Password Crackers | carnal0wnage.attackresearch.com –
• Guerilla Security Leadership – fudsec.com –
• Jack Mannino: Not Educating Your Clients? FAIL – How many of you that have brought in external consultants for some type of security engagement felt like you paid a lot of money for something you really didn't understand? Or better yet, how many of you have brought them in and felt like after they left you had less of an understanding of your environment and what your true risks were? It seems as though its becoming standard practice for a lot of groups to test for a few days (or simply run automated tools), crank out a templated report, and give a short presentation at the end of an engagement without detailed guidance for making the world a better place. Is there any value in this? Maybe, but for what you've likely paid not NEARLY enough.
• Blog :: by Wade Woolwine » Blog Archive » Thoughts on an AppSec program – The Team – Start of a multi-part series on an developing an AppSec Program
• Jeremiah Grossman: Overcoming Objections to an Application Security Program – Today a large percentage of security professionals truly “get” application security. They understand the importance, the best-practices, the value, etc. What inhibits their success the most in building an effective application security program is a lack of buy-in from the business and support from development groups. Justifying the investment remains extremely challenging and many security professionals tend to encounter the same objections.
• The Basic Laws of Human Stupidity –
• 500 Internal Server Error – 500 Internal Server Error

These are my links for September 4th through November 3rd:

• [Positive Technologies] Research Lab: Another fine method to exploit SQL Injection and bypass WAF – A method that I discovered today in MySQL documentation struck me with its simplicity and the fact that I haven’t noticed it before. Let me describe this method of bypassing WAF.
• Cyber Security Awareness Month 2009 – Summary and Links – As requested by many readers, below are links to all 31 of the diaries that we wrote for Cyber Security Awareness Month 2009. In 2007 we covered a large range of subjects based on what our readers submitted as ideas. In 2008 we took a closer look at the six steps of incident handling. This year we examined 31 different ports/services/protocols/applications and discussed some of the major security issues. Many readers submitted comments, tips, and tricks for securing them. If you have additional comments on any of these diaries feel free to add them directly to the bottom of the diary (you have to log in first) or if you want to remain anonymous you can send them to us via our contact form.
• Psychology and Security Resource Page –
• Syn: Bobs Double Penetration Adventure – Part 1 – A couple of days ago a mate at work asked about the security issues surrounding computers that are connected to the company network and also to the Internet via a wifi connection. This question was perfect fodder for a Bob story I thought. So the story goes…….
• 500 Internal Server Error – 500 Internal Server Error
• VRT: How does malware know the difference between the virtual world and the real world? –
• Grep auth log and print ip of attackers | commandlinefu.com –
• DNSpenTest – The DNSpenTest will be a suite of pentest about DNS system. In a near future you will found a set of tool like: a fake DNS server, a DNS packet forger, etc…
• Automating Nessus Scans with AutoNessus Tutorial – AutoNessus automates regular vulnerability scans with Nessus or OpenVAS and provides delta reporting. AutoNessus effectively reduces the analysis time for subsequent scans of the same infrastructure by only reporting delta findings. AutoNessus runs Nessus scans at regular intervals and compares the findings of the last scan with the findings of the previous scan. The delta of this scan is presented in a web GUI when findingscan be easily marked as either real findings or non-issues. Non issues get ignored until they change. This causes a dramatic reduction of the analysis time.
• MalTrap – MalTrap is a research utility that monitors malware behavior by intercepting API calls and logging results. MalTrap can also be used in other reversing contexts.

These are my links for June 5th through June 22nd:

• Security Onion – The Security Onion LiveCD is a bootable CD that contains software used for installing, configuring, and testing Intrusion Detection Systems.
• YouTube – Episode 4: Visualization of Crime – In the fourth episode of Team Cymru's 'The Who and Why Show', Marcel van den Berg takes us through a few animations charting our unique global insight into the Underground Economy.
• Social Engineering: 5 Security Holes at the Office (Includes Video) – CSO Online – Security and Risk – We poked around a secure building with social engineering expert Chris Nickerson and found several ways a criminal could get inside and access sensitive data
• Pretty-Bad-Proxy: An Overlooked Adversary in Browsers’ HTTPS Deployments – Microsoft Research – HTTPS is designed to provide secure web communications over insecure networks. The protocol itself has been rigorously designed and evaluated by assuming the network as an adversary. This paper is motivated by our curiosity about whether such an adversary has been carefully examined when HTTPS is integrated into the browser/web systems. We focus on a specific adversary named “Pretty-Bad-Proxy” (PBP). PBP is a malicious proxy targeting browsers’ rendering modules above the HTTP/HTTPS layer. It attempts to break the end-to-end security guarantees of HTTPS without breaking any cryptographic scheme. We discovered a set of vulnerabilities exploitable by a PBP: in many realistic network environments where attackers can sniff the browser traffic, they can steal sensitive data from an HTTPS server, fake an HTTPS page and impersonate an authenticated user to access an HTTPS server. These vulnerabilities reflect the neglects in the design of modern browsers – they affect all major browsers…
• SandCat | PenTestIT – SandCat has two versions – free & pro. Both these versions are programmed with the Open Web Application Security Project (OWASP) and the SANS Institute vulnerabilities in mind. You can also scan for the latest buzz word in the security market: WebDav with this tool. Basically, SandCat is a remote web application security assessment scanner. You can scan for almost all web application flaws. Sandcat remotely injects data in the web applications and analyzes the application response. This helps it to determine if the application code is vulnerable to specific attacks such as SQL Injection, XSS, and many other web application vulnerability flaws.
• Greg Miller’s Guide to Lock Picking for Beginners –
• The Ultimate Lock Picker Hacks Pentagon, Beats Corporate Security for Fun and Profit – Tobias is laughing. And laughing. The effect is disconcerting. It's a bwa-ha-ha kind of evil mastermind laugh—appropriate if you've just sacked Constantinople, checkmated Deep Blue, or handed Superman a Dixie cup of kryptonite Kool-Aid, but downright scary in a midtown Manhattan restaurant during the early-bird special.
• Security Musings » Blog Archive » How does SSL work anyway? – We talk a lot about how SSL is useful, but how exactly does it work? Most systems today use SSL v3/TLS v1 rather than “SSL”, and the nitty gritty details are found in RFC 2246.
• MIR-ROR – Home – MIR-ROR: Motile Incident Response – Respond Objectively, Remediate MIR-ROR is a security incident response specialized, command-line script that calls specific Windows Sysinternals tools, as well as some other useful tools, to provide live capture data for investigation.

  You can easily enhance MIR-ROR to your liking with whatever command line tools you find useful.
  For incident response resource, we’ve found it indispensable.
  Windows Systinternals licensing prevents us from bundling the tools in a distribution package; you’ll have to retrieve them.

• Nine out of ten work PCs fail on basic security | Graham Cluley’s blog – Ninety percent of corporate PCs are a security risk because they are not fully patched, or do not have basic security such as anti-virus software and firewalls properly installed.

These are my links for May 1st through May 14th:

• Lifehacker – TiltShift Makes Your Photos Look Like Miniatures – Tilt-Shift Photography – Web site and Adobe AIR application TiltShift gives your photos a tilt-shift photography effect that normally requires expensive special lenses or Photoshop chops.
• Advanced Malware Cleaning –
• Main Page – Netkit Wiki – Understanding computer networks without performing practical experiments is really difficult, not to say it is almost impossible. Unfortunately, setting up a networking lab can be very expensive.

  Netkit has been conceived as an environment for setting up and performing networking experiments at low cost and with little effort. It allows to "create" several virtual network devices (full-fledged routers, switches, computers, etc.) that can be easily interconnected in order to form a network on a single PC. Networking equipments are virtual but feature many of the characteristics of the real ones, including the configuration interface.

• Grand Stream Dreams: Microsoft XP Mode link-dump – Windows 7 XPM links and Comments
• A Step-by-Step introduction to using the AUTOPSY Forensic Browser « SANS Computer Forensics, Investigation, and Response – This is a brief tutorial on how to use the Autopsy Forensic Browser as a front end for the Sleuthkit. This tool is an essential for Linux forensics investigations and can be used to analyze Windows images.
• Helix Imaging PC – Building a dedicated Helix Imaging PC
• Forensic Focus – Computer Forensics – Digital Forensics, Computer Forensic Training, eDiscovery
• E-Evidence Information Center – What’s New – April 2009 – The Electronic Evidence Information Center
• Taking over the Torpig botnet – Paper on UCSB Security lab taking over botnet
• Tenable Network Security: Using Nmap Results With Nessus Batch Scanning – Tenable has supported Nmap usage within Nessus for several years. Nmap and Nessus have different types of scanning philosophies and understanding how they work can help you achieve success with your network scanning efforts.