An Israeli patriot program or a trojan @ Articles -> Link     Jan 08 2009, 00:10 (UTC+0) by Bojan Zdrnja Recently we have been witnessing a rise of politically motivated hacking attacks by supporters both sides involved in military actions in Gaza. This was more or less expected, whenever two sides collide there will be people supporting them, even through various attacks on the Internet. Over the weekend another site popped up, www.help-israel-win.com which is down at the moment. According to what was posted on the site, it was built by "a group of students who are tired of sitting around doing nothing". The site asked visitors supporting Israel to download and install a file from the site (called PatriotInstaller.exe) that will help disrupt their enemy's efforts. continued... read comments (0) / write comment views: 13   printer-friendly version

Contingency Planning @ Articles -> Link     Jan 08 2009, 00:07 (UTC+0) I was a bit shocked to read about Adolf Merckle’s suicide yesterday. You just don’t see this sort of thing coming and I cannot even fathom the reasoning behind it. This has sent tremors through the market and certainly his holding company into dis-array for a while. It also reminded me of other similar events surrounding the last economic downturn, and that was kind of the ‘final straw’ that prompted this post. With many of the same signs and issues occurring as they did in the tech collapse of 2000-2002, few are eager to look at the downside, but it is time to spend a few minutes and verify contingency plans within your organization. continued... read comments (0) / write comment views: 15   printer-friendly version

JW on Test: the Zune Issue @ Articles -> Link     Jan 07 2009, 04:20 (UTC+0) As you can imagine there is a pretty lively debate going on over the Zune date math issue here in the hallways and on our internal mailing lists. There are plenty of places one can find analyses of the bug itself, like here, but I am more interested in the testing implications. continued... read comments (0) / write comment views: 21   printer-friendly version

The Pure Programming Language @ Articles -> Link     Jan 05 2009, 02:15 (UTC+0) Pure is a modern-style functional programming language based on term rewriting. It offers equational definitions with pattern matching, full symbolic rewriting capabilities, dynamic typing, eager and lazy evaluation, lexical closures, built-in list and matrix support and an easy-to-use C interface. The interpreter uses LLVM as a backend to JIT-compile Pure programs to fast native code. continued... read comments (0) / write comment views: 34   printer-friendly version

Maintenance @ Site News     Jan 04 2009, 14:00 (UTC+0) The site is undergoing a minor upgrade. As a result some of the features and functionality of NO might be temporarily unavailable. Thank you for your patience and support. read comments (0) / write comment views: 62   printer-friendly version

You can only sit down if you are a human being @ Articles -> Link     Jan 04 2009, 10:01 (UTC+0) One thing that's been annoying me for the last couple of days is CVE-2008-5499, AKA, 'super secret unknown vulnerability in Flash Player 9/10 for Linux'. Dave (of the Aitel persuasion) wanted to get this stuff into CEU before the year was over. So I finally sneaked in some time and decided the research involved makes for swell infotainment. Let's have a look. continued... read comments (0) / write comment views: 30   printer-friendly version

What's wrong with this Code? [The Zune Bug] @ Articles -> Programming     Jan 03 2009, 01:51 (UTC+0) nabiy writes: Kirt posted about the zune bug a few days ago. here is a code snippet that contains the bug. This should be an easy one but it's fun. See how quickly you spot it. continued... read comments (9) / write comment views: 340   printer-friendly version

Scalable Datasets: Bloom Filters in Ruby @ Articles -> Link     Jan 03 2009, 00:54 (UTC+0) When you're working with large datasets it's always nice to have a few algorithmic tricks up your sleeve, and Bloom Filters are exactly that - often overlooked, but an extremely powerful tool when used in the right context. A Bloom Filter is a probabilistic data structure that is used to test whether an element is a member of a set, or more simply, it's an incredibly space efficient hash table that is often used as a first line of defense in high performance caches. Database queries too expensive? Then a Bloom Filter might help. As an example, Google's Bigtable uses a bloom filter as first lookup to avoid unnecessary disk accesses. continued... read comments (2) / write comment views: 59   printer-friendly version

Information regarding MD5 collisions problem @ Articles -> Link     Jan 03 2009, 00:51 (UTC+0) Today Microsoft released a security advisory (961509) regarding collisions in MD5 hashes on certificates. This specific problem affects the entire industry and is not a Microsoft specific vulnerability. Serious weaknesses in MD5 have been known for many years now; it is because of these weaknesses that MD5 is banned in new code under the Microsoft Security Development Lifecycle (SDL). Software developers are urged to migrate away from using MD4, MD5 and even SHA1 and use SHA-256 and later instead for hashing, signatures and message authentication codes.. continued... read comments (0) / write comment views: 58   printer-friendly version

Creating a rogue CA certificate @ Articles -> Link     Dec 31 2008, 00:04 (UTC+0) We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This certificate allows us to impersonate any website on the Internet, including banking and e-commerce sites secured using the HTTPS protocol. continued... read comments (2) / write comment views: 122   printer-friendly version

Guide to Encrypted Dynamic Covert Channels @ Articles -> Link     Dec 30 2008, 16:06 (UTC+0) by Tyler Borland Covert channels in TCP/IP communications are dying from the public and security field's eye. When I talk about covert channels, several security professionals/researchers ask me what it is or say something along the lines of, "Like Stegonagraphy?". Publicly available, mass used, and not fully understood by implementer(s) intrusion detection systems (and their rulesets) and stateful firewalls could be why little is known anymore about this subject. With great tools that setup an encrypted tunnel (cryptcat, VPN software, etc.) publicly available and rather simple to use, the publics eye will be on these for a while. Which means that I can have my fun with my new covert channel without much risk! continued... read comments (1) / write comment views: 110   printer-friendly version

Architecture of Privacy @ Articles -> Link     Dec 29 2008, 15:43 (UTC+0) IEEE Security & Privacy January/February 2009 The Internet isn't really for us. We're here at the beginning, stumbling around, just figuring out what it's good for and how to use it. The Internet is for those born into it, those who have woven it into their lives from the beginning. The Internet is the greatest generation gap since rock and roll, and only our children can hope to understand it. continued... read comments (0) / write comment views: 114   printer-friendly version

Patterns and string processing in shell scripts @ Articles -> Link     Dec 28 2008, 23:32 (UTC+0) Shell programming is heavily dependent on string processing. The term string is used generically to refer to any sequence of characters; typical examples of strings might be a line of input or a single argument to a command. Users enter responses to prompts, file names are generated, and commands produce output. Recurring throughout this is the need to determine whether a given string conforms to a given pattern; this process is called pattern matching. The shell has a fair amount of built-in pattern matching functionality. This article is excerpted from the newly published book Beginning Portable Shell Scripting. continued... read comments (0) / write comment views: 113   printer-friendly version

Splashtop: boot into Linux in just five seconds @ Articles -> Link     Dec 28 2008, 23:30 (UTC+0) I have a quad-core CPU, super-fast hard disks and heaps of RAM – Linux is already pretty darn nippy if you ask me! Perhaps. But, let's face it: if it takes more than 30 seconds to get from pressing the power button to you reading your email, that's 30 seconds you could have spent chatting to the pretty lady in the cubicle next to you, reading the latest XKCD comic or – most importantly of all – basking in the glow of the most recent issue of Linux Format magazine. continued... read comments (0) / write comment views: 141   printer-friendly version

Episode 41 - Scam Hot Ladies at the Bar (Part 2)! @ Articles -> Link     Dec 28 2008, 23:26 (UTC+0) A while back, we taught you the importance of using easy, beatable puzzles to keep girls talking to you at the bar. Our Holiday gift to you is another set of "getting the girl" routines! continued... read comments (0) / write comment views: 139   printer-friendly version

Deliberately Insecure Web Applications For Learning Web App Security @ Articles -> Link     Dec 28 2008, 23:24 (UTC+0) What I needed were deliberately insecure web application designed for learning. With a little Googling I found quite a few. I plan to update this page as I have more time to test them, and I'd be glad to hear your comments and suggestions for additions to the list. While there may not be a deliberately insecure web application for your specific development environment, most common application vulnerabilities show a lot of platform overlap so they should still be useful in teaching you what to avoid when you code your applications. continued... read comments (0) / write comment views: 116   printer-friendly version

Security Trends of 2008 and Predictions for 2009 @ Articles -> Link     Dec 28 2008, 23:22 (UTC+0) As a new year approaches we must prepare for new Internet security threats. Every year, new and innovative ways of attacking computer users emerge and continue to increase in volume and severity. To know where we are going it is helpful to look at where we have been. Finding trends in Internet security has become a valuable, if not necessary, action for companies developing software to protect computer users. continued... read comments (0) / write comment views: 105   printer-friendly version

Tech Description of Qemu and KVM VNC server remote DoS @ Articles -> Link     Dec 28 2008, 23:13 (UTC+0) Bugtraq ID: 32910 CVE Name: CVE-2008-2382 The VNC server of Qemu and KVM virtualization solutions are vulnerable to a remote DoS, when specially crafted packets are received by the host VNC server causing an infinite loop. Successful exploitation causes the host server to enter an infinite loop and cease to function. The vulnerability can be triggered remotely by external hosts or virtualized guests. No special privileges are required to perform the Denial of Service. POC available. continued... read comments (0) / write comment views: 107   printer-friendly version

10 programming languages worth checking out @ Articles -> Link     Dec 28 2008, 06:04 (UTC+0) If you program for fun or profit, chances are that you know C, C++, Java, PHP, Perl, Python or Ruby. These programming languages are all widely known, and, to a different degree, used in commercial applications. At least some of them can safely be considered mainstream, even if that word has become so overused and misused that has almost lost its original meaning, if it ever had one. If you are earning your living by coding, it’s often one of these languages that pays the bills. Nevertheless, true hackers frequently meander in other directions, exploring and discovering different paradigms and methodologies, sometimes to the most esoteric extremes. continued... read comments (2) / write comment views: 149   printer-friendly version

the older posts:

Tor Development Roadmap: 2008-2011	26 Dec 2008
One Hacker's Audacious Plan to Rule the Black Market in Stolen Credit Cards	26 Dec 2008
Bjarne Stroustrup on Educating Software Developers	25 Dec 2008
Hacking: The Art of Exploitation 2nd Edition	22 Dec 2008
11 ways to create a successful Linux distro	22 Dec 2008
A Discussion of Virtual Machines Related to Forensics Analysis	22 Dec 2008
Top 10 Ways to Lock Down Your Data	21 Dec 2008
Installing a PPPoE server under Linux Debian	21 Dec 2008
Changes, mergers and forums	20 Dec 2008
Implementing a Better DNS Dead Drop	20 Dec 2008

even older posts...

Top of page