So, if you haven't seen the details for the DNS flaw you can take a look here: http://www.ri0tnet.net/dns.html
Check out the information leak of the year. Oh, and patch those DNS servers. WWDKD?
This year's Defcon event is well under way. The speakers list has been finalized and I'm already thinking about what talks I want to make it out to.
Here's my hit list so far, which I'm guessing will get totally screwed by the time slots.
Additionally, the EFF and All Your Sploits Are Belong to Us panels might be fun. Oh, and whatever Dan Kaminsky has to talk about will most certainly pack the house.
This weekend I finished the Syngress Publishing book Open Source Fuzzing Tools. The book didn't take long. Part of the reason is that there really isn't a ton of technical information in the book to hold up the reader in lab exercise. It's not completely devoid of detailed fuzzer usage, but it's not wall to wall "let's go break some software" either. Read the rest of this entry »
A new contest is making it's way to Defcon 16 this year. The contest titled "Race to Zero" is challenging reversers and malcode analysts to modify viruses and malware to see if they can't slip it by several scanning engines. The contest's website racetozero.net has tips on creating a proper participant environment for analyzing the beasties.
This looks like a very cool contest for taking a look at how malware is identified by popular scanning engines. I'm already getting stoked.
A recent post to thedailywtf.com details a long running hole in an Oklahoma Department of Corrections web application. It appears that their Sexual and Violent Offender registry was wide open to SQL injection via a specially crafted query string.
Now, SQL injection can get pretty damn creative, but come on, this is 2008. There's no reason to be open to this class of vulnerability. Shouldn't we be past creating dynamic SQL queries? So let's say you're nutso bongo enough to be creating dynamic SQL, these guys aren't even making the attacker interact with the form to discover the hole. It's a security through obscurity thing for sure (and as such just one shade of crap less offensive), but being on the hit list by way of a Google dork is just sad.
Developers don't all have to be security experts, but an understanding of the OWASP top 10 isn't too much to ask. Get out there, parameterize those queries, sanitize input and make sure that data stays data and doesn't suddenly make the jump to code!
InformationWeek's Alexander Wolfe asks that very question. The article goes on to say that podcasting hasn't lived up to the hype and that basically it's headed the way of the buffalo. Wolfe cites his reason based on podcasts not performing as big money makers.
In that regard, he'd probably be correct, but then the question becomes "Is making money indicative of the health of podcasting?" Which it is my opinion, clearly not.
Podcasting will advance along the same lines as other media (books, newspapers, etc.), which is the push for more localized and niche content. Pushing content for the most part isn't going to make a person rich, in fact, most producers would probably be thrilled to get a free beer now and then. That's cool though, that's really not all the reward that gets paid out.
Podcasting isn't even on the ropes really. If there's an issue at all, I think it's one of misguided expectations. Who the hell's fault is that? Read the rest of this entry »
I recently started looking back into programming IA-32 ASM using nasm on Linux and came across a hell of a book written by a former professor at Carleton University in Ontario. What's peculiar about this book is that it spends a good 100 pages banging out hardware nuances to the reader, then as soon as you get going into some of the ASM stuff it provides the reader with a sweet macro file for the day-to-day coding. It's always interesting to see what certain instructors find important.
I've looked at Linux assembly before so a lot of what is contained in the macros isn't all that surprising, but I wonder if using the file from the beginning will make my prior knowledge jell-0 before the day's out. Moreover, I wonder if it's going to hurt me when I start looking at what I care about (deadlistings of malware/sploits/etc.).
At any rate, I figure I'll give the late Prof. Dandamudi's way of learning a try. Check out his sweet macro file and other material here.
The file sharing rockstars at thepiratebay.org have started up a project aimed at overhauling the Bittorrent p2p protocol. The project site, http://securep2p.com, is very much in the early stages, but is starting to show up in the media.
This is very cool for a couple of reasons. First, if anyone in p2p has a following it's thepiratebay. These guys could publish a recipe for chocolate chip cookies and people would download it. Second, this is an ambitious project in an area where we know there are tons of amateur/garage research designs being built. Maybe some really smart ideas will start showing up.
Lets hope this goes somewhere.
I was goofing off today looking at some videocasts and generally killing time. I came across a reality show called "The Next Internet Millionaire". The show brings talented online marketers together and to have them fight it out in a no holds barred battle royale!
Alright, it's really not that good, but it's there if you're bored. Really, really bored.
FollowUp :: If you want some real startup fueled coolness, watch Rockstartup.com
