It's time for this week's research papers, tools and services worth going through. Catch up with last week's content, stay informed, and keep in mind that the most prolific threat of them all is the lack of a decent situational awareness.Papers and Publications :
Presentations and White Papers from Black Hat 2007
"The entire collection of presentations and white papers per researcher from this year's Black Hat Con."
Netcat for the Masses
"Having had numerous people recently ask me about the various uses for Netcat I decided to put together a document showing a few handy uses for good ol' Netcat. Netcat has been described as telnet on steroids or a Swiss army knife, both excellent descriptions for this versatile little tool."
Spam Report May 2007
"In May, spam accounted for 70% - 80% of all email traffic on the Russian Internet. No major fluctuations were observed. Spam reached a high of 86% of all email traffic on May 28th, and hit a low of 65.4% on May 21."
How To Harden PHP5 With Suhosin On Fedora 7
"Suhosin is an advanced protection system for PHP installations that was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against bufferoverflows or format string vulnerabilities and the second part is a powerful PHP extension that implements all the other protections."
Microsoft UK Events Website Hacked
"A detailed analysis how the website was hacked and how it could have been avoided."
Implementing Effective Vulnerability Remediation Strategies Within the Web Application Development Lifecycle
"Once you've completed a security assessment as a part of your web application development, it's time to go down the path of remediating all of the security problems you uncovered. At this point, your developers, quality assurance testers, auditors, and your security managers should all be collaborating closely to incorporate security into the current processes of your software development lifecycle in order to eliminate application vulnerabilities."
Defend Your Code with Top Ten Security Tips Every Developer Must Know
"There are many ways to get into trouble when it comes to security. You can trust all code that runs on your network, give any user access to important files, and never bother to check that code on your machine has not changed. You can run without virus protection software, not build security into your own code, and give too many privileges to too many accounts. You can even use a number of built-in functions carelessly enough to allow break-ins, and you can leave server ports open and unmonitored. Obviously, the list continues to grow."
Security Testing Enterprise Messaging Systems
"This paper discusses potential security weaknesses that may be present in messaging systems either as a result of software flaws, application design or the misconfigurations of services. It focuses on TIBCO Rendezvous, as an example of a commonly used enterprise messaging system. Recommendations are then presented which mitigate these security issues."
How to Cheat at Configuring Open Source Security Tools - book excerpt
"The perfect book and companion Web site for multi-tasked security professionals and IT managers responsible for securing corporate networks using the 10 most popular tools including: Snort, Nessus, Wireshark, Nmap, and Kismet on Windows, Linux, or Max OS X."
Controlling Website Account Information
"When creating a website that requires authentication, the designer must keep in mind that passwords should be stored in an encrypted format. There must also be a password policy set before launching the site; this could include the password requirements as well as how the website and webmaster should control user passwords. The last decision to be made is how access will be granted to the users; this includes how they will provide credentials, how their credentials will be authenticated, and how to track the user’s authentication from one page to another."
Security Data Visualization - book excerpt
"In Security Data Visualization, the author creates graphical windows into the world of computer security data, revealing fascinating and useful insights into networking, cryptography, and file structures. After learning how to graph and display their data correctly, readers will be able to understand complex data sets at a glance."
US-CERT Quarterly Trends and Analysis Report, Vol. 2, Issue 2
"This report summarizes and provides analysis of incident reports submitted to US-CERT during the U.S. Government fiscal year, 2007 second quarter (FY07 Q2)."
Security Tools :
BotHunter
"BotHunter is a passive traffic monitoring system, which ties together the dialog trail of inbound intrusion alarms with those outbound communication patterns that are highly indicative of successful local host infection. When a sequence of in and outbound dialog warnings are found to match BotHunter's infection dialog model, a consolidated report is produced to capture all of the relevant events and event sources that played a role during the infection process."
PDFassassin
"PDFassassin is a module for SpamAssassin that allows for the scanning of PDF files in email message attachments. Email bodies are scanned upon connection and checked for PDF attachments. Text is extracted from the PDF via pdftotext and scanned by SpamAssassin. Should the PDF contain images, the gocr program is called to extract the text content."
Advanced CheckSum Verifier (ACSV) v1.5.0
"The Advanced CheckSum Verifier is an handy and fast windows utility for verifying integrity of files by using the CRC32 or MD5 checksum calculation algorithms for Windows users. It will allow you to verify the accuracy of your data after you burn a CD or transfer a files over a network. Adding an little checksum file to your data files will allow in further easily to verify their integrity at any time."
Blue Pill Project
"The New Blue Pill is significantly different from the original Blue Pill, not only because of the various features that it implements, but also because of the different architecture it was based on (HVM-like approach, similar to that used by XEN 3)."
PyFault - Python Based Fault Injection in Win32 Based Application
"PyFault is a python library aimed at fault injection scenarios in Win32 based applications. Currently it only implements a DLL injection and ejection mechanism, but we aim to add more functionality to it,and of course all requests are welcome."
Astaro Security Linux 6.311
"Astaro Security Linux is an all-in-one network security gateway that includes a firewall, intrusion protection, virus protection, spam protection, URL filtering, and a VPN gateway. Features include stateful packet inspection, deep packet filtering, intrusion detection and prevention, portscan detection, content filtering, virus detection for email and Web traffic, profile handling, IPSec, SSL, and PPTP VPN tunneling, spam blocking, proxies for HTTP, FTP, POP3, SMTP, DNS, VoIP, SOCKS, and Ident, logging, and reporting."
EasyIDS v0.2
"EasyIDS is an easy-to-install intrusion detection system based upon Snort. EasyIDS is designed for the network security beginner. EasyIDS includes CentOS Linux, Snort, MySQL, BASE, ntop, oinkmaster, and more."
Trace Explorer
"Trace Explorer aggregates traceroutes to many popular websites and makes them searchable, allowing you to discover which web sites are hosted near each other, at a particular ISP, or behind a specific router."
SAGATOR
"SAGATOR is an email antivirus/antispam gateway. It is an interface to any smtpd, which runs an antivirus and/ or spam checker. Its modular architecture can use any combination of antivirus/spam checker according to configuration. It currently supports clamav, nod32d, AVG, sophos, TrendMicro AV, Symantec AV, spamassassin, bogofilter, and quickspamfilter."
Firefox: 10 tips to bolster your privacy
"In this hack, we’re going to highlight 10 tips to bolster your privacy when surfing the Internet with Firefox. You can use any of these tips to add an extra layer of privacy to your browsing at work, on public computers or just on a shared computer at home."
Binary Tools
"reverse: takes the input file, reverses it (first byte becomes last byte, …) and writes it to a new file. middle: extracts a sequence of bytes from the input file and writes it to a new file."
IM-Filter
"IM-Filter is a daemon that runs on a firewall and filters ICQ traffic. The daemon can identify file transfers, handle UIN and word blacklists, manage a list with currently logged in users. and log messages sent via the ICQ protocol."
Jesse's JavaScript compiler/decompiler fuzzer
"This fuzzer constructs random strings with JavaScript statements andexpressions (sometimes with syntax errors), and asks the JavaScript engine totreat them as functions."
50+ Firefox Add-ons For Security and Privacy
"While these issues are best fixed with a soon-to-be-released patch*, we were inspired to look at the wider issue of keeping your Firefox browser secure. We present a plethora of security extensions for Firefox, followed by those that will keep your private data….private."
The Crypto CD
"CryptoCD is a collection of software that provides secure communication through the Internet. The programs cover tasks like email encryption, secure chat, and anonymous Web browsing."
GMER
"GMER is an application that detects and removes rootkits."
RenaissanceCore 0.9.0
"The RenaissanceCore IDS consists of four components: a stateful IDS sensor, a graphical user interface, a database backend, and a two-way interface between the IDS sensors and the database. Each component can run on a separate host."
Sevices & Misc :
The Pwnie Awards
"An annual award ceremony celebrating (or making fun of) the achivements and failures of security researchers and the wider security community."
USB patch released. HALLELUJAH!
"The patch was written for and, therefore, tested on Apple TV software version 1.0. If you have 1.1, the patch might not work. Please let us know if you can get the patch to work on 1.1."
Wordpress ZeroDay Vulnerability Roundhouse Kick and why I nearly wrote the first Blog Worm (updated)
"Much time has passed since I wrote the last Full Disclosure Publication on this Blog, it was about the security vulnerability in Akismet, a Wordpress antispam plugin. This time you will witness something which impacts huge parts of the Blogosphere, I will tell you my story."
The Story of DEFCON - Video
"Jeff Moss, the founder of DEFCON and Black Hat, tells the history of the largest hacker conference and how it all got started. Find out more about the early days of the hacking scene when dial-up was considered fast, how the security space changed around the conference as years went by, and discover some bizarre things that take place at the event."
No comments:
Post a Comment