Feeds
13620 items (0 unread) in 75 feeds
-
Watchfire Application Security Insider
-
BlogSecurity
-
sirdarckcat
-
Google Online Security Blog
-
CGISecurity.com: Your Web Site and Application Security Resource
-
Switch/Twitch
-
mybeNi websecurity
-
cat slave diary
-
SecuriTeam Blogs
-
Curiouser and Curiouser
-
Alex's Corner
-
Billy (BK) Rios
-
Chris Shiflett
-
christian's weblog
-
funkatron.com
-
GNUCITIZEN
-
The Spanner
-
hackademix.net
-
Ruby on Rails Security Project
-
It's a shampoo world anyway
-
Web Security Blog
-
ha.ckers.org web application security lab
-
Yet Another Infosec Blog
-
PHP Security Blog
-
Security Thoughts
-
Sunnet Beskerming Security Advisories
-
Disenchant's Blog
-
Sylvan von Stuppe
-
Larholm.com
-
The Turkey Curse
-
Jeremiah Grossman
-
Anurag Agarwal - Application Security Evangelist
-
Ivan Ristic
-
deep inside | security & tools
-
omg.wtf.bbq.
-
BlueHat Security Briefings
-
Tactical Web Application Security
-
.:Computer Defense:.
-
tssci security
-
Plynt Penetration Testing Blog
-
Michael Howard's Web Log
-
Security Retentive
-
BindShell.Net
-
Dominic White's .tHE pRODUCT
-
SecurityFocus News
-
Justice League
-
Schneier on Security
-
Rational Survivability
-
terminal23
-
1 Raindrop
-
hiredhacker.com
-
Matasano Chargen
-
-
Michael on Security - Musings on Information Security
-
Fortify blog
-
The Art of Software Security Assessment
-
GDS Security Blog
-
Vodun.org
-
Robert Penz Blog
-
Mark Curphey - SecurityBuddha.com
-
Liminal states
-
Security Ripcord
-
ModSecurity Blog
-
IBM Internet Security Systems Frequency X Blog
-
Suspekt...
-
extern blog SensePost;
-
Zero in a bit
53 items tagged "Events"
Related tags: Current [+], Security [+], 25C3 [+], republica08 [+], Schedule [+], Piratenpartei [+], PHNeutral [+], OWASP [+], Fahrplan [+], Deepsec [+], CCC [+], Bonn [+], Bluehat [+]
CGISecurity.com: Your Web Site and Application Security Resource
-
Quick defcon/blackhat preparation list
Posted: July 28th, 2011, 3:25pm CDT by Robert A.
Tags: Events [edit]
A couple of people had asked me what are some things that you can do prior to attending hacker cons such as Blackhat and Defcon. Kurt Cobain said it best "Just because you're paranoid, doesn't mean they're not after you'. Here's a short list (albeit not complete as I don't plan to...
BindShell.Net
-
0.4.2-alpha Release
Posted: December 14th, 2010, 11:33pm CST
Tags: Events [edit]
The team has released version 0.4.2-alpha. This cut focused on module functionality. It provides a larger API for module developers. Currently, the PHP version still has greater functionality. Download the alpha archives here: http://code.google.com/p/beef/downloads/list Watch one of the skype modules: http://www.youtube.com/watch?v=5SVu6VdLWgs -
Trunk Moved
Posted: November 13th, 2010, 9:31am CST
Tags: Events [edit]
The semi-stable development branch has been moved to the trunk. The branch /branches/RBeEF has been relocated and the location is no longer used for development. Checkout a copy with the following command: svn checkout http://beef.googlecode.com/svn/trunk/ beef-read-only -
0.4.1-alpha Release
Posted: October 9th, 2010, 11:54pm CDT
Tags: Events [edit]
The first cut of the Ruby port is version 0.4.1-alpha. This cut focused on stability, the install process and the UI. Currently, the PHP version still has greater functionality. This release is not entirely production ready. In saying that, it is stable and boasts a new feature - the Requester! Download the alpha archives here: http://code.google.com/p/beef/downloads/list Download the PHP version here: http://www.bindshell.net/tools/beef -
Ruby BeEF Port Development Progress
Posted: October 1st, 2010, 2:49pm CDT
Tags: Events [edit]
The ruby port of BeEF is currently in code freeze. The 0.4.1 alpha version of this port will be available shortly for download. Recent development has focused on the UI and the new install process. You will notice a great difference. All functionality from the PHP version is yet to be fully ported. This and the next few releases will be concerned mainly with stability and building a flexible framework. The porting of all functionality is still a few releases away. To get a copy of the current development version from the svn, run: svn checkout http://beef.googlecode.com/svn/branches/RBeEF beef -
BeEF Key Logging
Posted: March 10th, 2010, 10:28am CST
Tags: Events [edit]
By default, BeEF will log all the keys entered into the Zombie's page. View the Zombie Details and the logged keys will be displayed in the 'Key Logger' section. -
Google Code
Posted: February 25th, 2010, 9:31am CST
Tags: Events [edit]
A new BeEF SVN is being hosted on beef.googlecode.com. It is early days, but if you would like to get involved join, the development mailing list. Checkout a copy with the following command: svn checkout http://beef.googlecode.com/svn/trunk/ beef-read-only -
XSSShell and XSSTunnel is being rolled into BeEF!
Posted: February 12th, 2010, 9:11pm CST
Tags: Events [edit]
More great news: XSSShell and XSSTunnel is being rolled into BeEF! In another boost to the BeEF project, Ferruh Mavituna is joining the development team. The author of XSSShell and XSSTunnel will be helping roll his tools into the next version of BeEF. Ferruh's research will increase the functionality and the versatility of the Browser Exploitation Framework. -
Browser Rider being rolled into BeEF
Posted: February 6th, 2010, 11:44pm CST
Tags: Events [edit]
Great news: Browser Rider is being rolled into BeEF! The avid security researcher will no doubt be aware of the Browser Rider project developed by Benjamin Mosse. It is a framework which boasts some great features: Back-end database Obfuscation Polymorphism This tool, along with the involvement of Benjamin, will be a significant boost for the BeEF project. There are some big improvements planned for future versions of BeEF. Stay tuned! -
Browser Rider is being rolled into BeEF
Posted: February 6th, 2010, 11:44pm CST
Tags: Events [edit]
Great news: Browser Rider is being rolled into BeEF! The avid security researcher will no doubt be aware of the Browser Rider project developed by Benjamin Mosse. It is a framework which boasts some great features: Back-end database Obfuscation Polymorphism This tool, along with the involvement of Benjamin, will be a significant boost for the BeEF project. There are some big improvements planned for future versions of BeEF. Stay tuned! -
BeEF Development Mailing List
Posted: February 2nd, 2010, 9:26pm CST
Tags: Events [edit]
A new BeEF mailing list has recently been set up. This list will be focused on discussions around BeEF development. If you would like to get involved in the development or make some suggestions at the code level, subscribe to the development mailing list. Simply send an email to beef-dev-subscribe@bindshell.net.
CGISecurity.com: Your Web Site and Application Security Resource
-
WASC RSA Meet-Up 2010!
Posted: January 28th, 2010, 11:58am CST by Robert A.
Tags: Events [edit]
The Web Application Security Consortium (WASC) is having an official meetup in San Francisco during the RSA conference.If you like to get free food/drinks, shoot pool, and chat appsec with many of the leading researchers in the appsec world this is your chance. WASC RSA 2010 Meet-up Wednesday, March 3, 2010 Lunch...
BindShell.Net
-
BeEF PHP Settings
Posted: December 7th, 2009, 6:42pm CST
Tags: Events [edit]
PHP in Fedora (Fedora 12 at least) has the short_open_tag turned off by default. In this state it will cause an error if you try to use BeEF. Thanks to Steve 'Ashcrow' Milner for pointing this out. To fix this try the following change to the /etc/php.ini file: -short_open_tag = Off +short_open_tag = On
CGISecurity.com: Your Web Site and Application Security Resource
-
Heading out to AppsecDC
Posted: November 10th, 2009, 3:17pm CST by Robert A.
Tags: Events [edit]
I'll be heading out to AppSecDC to present Transparent Proxy Abuse on Thursday, so if you're attending and want to chat about appsec I'll be available after my talk. Here's a teaser of my presentation I'll be presenting a video demonstrating this abuse case against Squid and Mac OS X Parental Control...
BindShell.Net
-
More BeEF Videos
Posted: September 20th, 2009, 1:55am CDT
Tags: Events [edit]
Ryan Linn's efforts adding XML-RPC to BeEF and Metasploit allow the closer integration between the two tools. If you saw his presentation at DEFCON, you will already be aware of some of the new modules that have been rolled into the latest version of BeEF. He has put up a post and videos demonstrating his work. The videos can be found here: NTLM Challenge Credential Theft with BeEF and Metasploit Executing Browser AutoPWN Through BeEF Upgrading BeEF in Samurai WTF -
BeEF Videos
Posted: September 20th, 2009, 1:04am CDT
Tags: Events [edit]
Jabra (who you will know from his input to various modules) has posted some of his BeEF videos from DEFCON and Black Hat. The videos have been available for a little while and if you haven't checked them out, you should. The videos can be found here: MSF Browser Autopwn (M) Malicious Java Applet Detect Visited URLs Detect Virtual Machine Detect Software -
New Version of BeEF
Posted: September 18th, 2009, 2:24am CDT
Tags: Events [edit]
I have just released BeEF version 0.4. Get it here while it is hot. This version has more modules and a more flexible framework. Enhancements in the latest version include: Integration with Metasploit via XMLRPC Mozilla extension exploitation support New browser functionality detection modules Tiered logging for module actions and results -
Module: Software Detection
Posted: September 17th, 2009, 6:38am CDT
Tags: Events [edit]
RSnake and Jabra presented at DEFCON on various decloaking methods. One technique demonstrated was employing SMB to enumerate software installed on the target machine. The BeEF module seen in the demonstration can be downloaded from here.
CGISecurity.com: Your Web Site and Application Security Resource
-
AppSec DC 2009
Posted: August 24th, 2009, 5:15pm CDT by Robert A.
Tags: Events [edit]
"OWASP Announces International Application Security Conference for 2009 Speaker Agenda Released and Registration Open for 2009's Largest Web Application Security Event Washington DC August 20th, 2009 -- Following in the footsteps of the Open Web Application Security Project's (OWASP, http://www.owasp.org ) immensely successful and popular conferences earlier this year in Australia,...
BindShell.Net
-
Module: Get Internal IP Address
Posted: August 10th, 2009, 6:20am CDT
Tags: Events [edit]
Here is a module (extract to the modules directory) that reveals the internal ip address of the machine running the web browser.
CGISecurity.com: Your Web Site and Application Security Resource
-
Heading out to blackhat/defcon
Posted: July 28th, 2009, 3:59am CDT by Robert A.
Tags: Events [edit]
I'm heading out later today for my yearly Blackhat/Defcon trip and looking to attend the following blackhat talks as of now. Day 1 Veiled - A Browser Based Darknet Practical Windows XP/2003 Heap Exploitation Fighting Russian Cybercrime Mobsters More Tricks for Defeating SSL Enterprise Java Rootkits The Language of Trust State...
BindShell.Net
-
Module: Exploit for vtiger and a general DoS
Posted: July 16th, 2009, 5:38am CDT
Tags: Events [edit]
Thanks Mark for sending over these two modules. The first will exploit the vtiger upload vulnerability. The other is a general DoS module which demonstrates how easy browsers can be rendered non-responsive. To install download vtiger_upload.tar.gz and browser_dos_fun.tar.gz. Then extract them to the modules directory and simply refresh your browser.
CGISecurity.com: Your Web Site and Application Security Resource
-
Researcher barred for demoing ATM security vuln
Posted: June 30th, 2009, 3:29pm CDT by Robert A.
Tags: Events [edit]
"A talk demonstrating security weaknesses in a widely used automatic teller machine has been pulled from next month's Black Hat conference after the machine vendor placed pressure on the speaker's employer. Juniper Networks, a provider of network devices and security services, said it delayed the talk by its employee Barnaby Jack...
BindShell.Net
-
Module: Redirect Page
Posted: June 29th, 2009, 10:25pm CDT
Tags: Events [edit]
Here is a simple module that will redirect the zombies' pages to an arbitrary location. The location is set in the module configuration page BeEF - simply enter the URL, select the target zombies and click send.
The Turkey Curse
-
Piratengrillen in Bonn
Posted: June 24th, 2009, 9:07am CDT by fukami
Tags: Piratenpartei Bonn Events [edit]
Da es in Bonn nicht so ganz einfach ist, geeignete, nicht-kommerzielle Orte zu finden wo man sich zwanglos treffen kann, findet bei schönem Wetter am Montag, den 29. Juni 2009 ab 19 Uhr ein Piratengrillen am Beueler Rheinufer statt. Eingeladen sind alle Leute aus Bonn und Umgebung, die sich für die Piraten und deren Ziele interessieren. Willkommen sind selbstverständlich auch Nicht-Mitglied der Piratenpartei. Grillgut und Getränke sind selbst mitzubringen.
Rückmeldungen per Twitter oder in den Kommentaren wären schön, um abschätzen zu können, mit wie viel Leuten ungefähr zu rechnen ist.
Tags: Piratenpartei, Bonn
BindShell.Net
-
Browser Caching Attacks
Posted: June 12th, 2009, 12:46am CDT
Tags: Events [edit]
RSnake has a writeup of his technique for exploiting web browser caching to attack RFC1918 networks. The attack uses persistent JavaScript backdoors, long-term browser caching and RFC1918 collisions.
Curiouser and Curiouser
-
YouTube - 1989 Tiananmen Square Protests
Posted: June 3rd, 2009, 11:45am CDT
Tags: Current Events [edit]
video of the Tank Man.
--
Link (Direct) - Link (Reputation Tracking) - Discuss [1] - Reply - Recommend
BindShell.Net
-
Module: Firefox Keygen DoS PoC
Posted: June 3rd, 2009, 2:43am CDT
Tags: Events [edit]
Download the latest BeEF module that will demonstrate kengen DoS in Firefox. Decompress the module into the 'module/symmetric' directory and the option in the menu will become available. -
Module: Chrome "throw exception" Memory Exhaustion DoS PoC
Posted: May 2nd, 2009, 12:50am CDT
Tags: Events [edit]
The Google chrome browser is vulnerable to a memory exhaustion based denial of service. Here is a proof of concept ported to a BeEF module. Note that BeEF currently displays Google Chrome as Safari due its useragent string. -
Module: IE Unsafe ActiveX Control Detection
Posted: April 26th, 2009, 4:04am CDT
Tags: Events [edit]
Remote detection through IE (of the availability) of unsafe ActiveX controls is achievable. A script can attempt to access an unsafe control and then check if it succeeds. That is exactly what this new BeEF module does. -
Module: IE VM Detection
Posted: April 19th, 2009, 6:19am CDT
Tags: Events [edit]
Under some circumstances in Internet Explorer, JavaScript can determine if the browser is in a virtual machine. Scripting can do this by checking the MAC address. For a successful detection (and worse) the configuration option "Initialize and script ActiveX controls not marked as safe for scripting" must be enabled. When enabled, Internet Explorer will alert the user of the insecure configuration. So this is not exactly stealthy. I have a BeEF module that will do the detection. Just decompress it and put the module into the 'module/symmetric' directory. The menu option will automatically be displayed in the modules menu. -
Module: Mozilla Firefox XSL Parsing Remote Memory Corruption PoC
Posted: March 29th, 2009, 2:35pm CDT
Tags: Events [edit]
I have just created a BeEF module for the Mozilla Firefox XSL Parsing Remote Memory Corruption Proof of Concept. When executed it will crash the Firefox zombie. So don't expect to see the zombie in BeEF afterward. -
Module: Quicktime Detect
Posted: March 17th, 2009, 3:35am CDT
Tags: Events [edit]
This module checks if QuickTime is available in the browser. Like the other modules, to update BeEF, just copy it to the modules/symmetric directory and match the permissions. -
Module: Autorun JS Module
Posted: March 6th, 2009, 8:44pm CST
Tags: Events [edit]
The autorun modules execute immediately upon a zombie connecting to the BeEF server. This JavaScript Autorun Module is a lot more flexible than the current ones included in the framework. It provides two configurable options. The first is a regexp that will be compared against the zombie's useragent and, if it evaluates to true, the second (standard JavaScript) is executed. -
Module: Internet Explorer XP SP2 Exploit
Posted: February 21st, 2009, 6:55am CST
Tags: Events [edit]
Download the xplt_cve_2009_0075.tar.gz module and, like the other new modules, copy it to the 'module/symmetric' on your BeEF server. This module will exploit (CVE-2009-0075) Internet Explorer on Windows XP SP2. It is self explanatory - just select the module from the menu, click 'exploit' and you're away. -
Module: Detect Flash
Posted: February 20th, 2009, 5:06am CST
Tags: Events [edit]
The new detect flash module does what it says on the tin. It detects whether flash is enabled in the BeEF zombie browser. To install, simply download it and extract to your module directory (and set permission appropriately).
CGISecurity.com: Your Web Site and Application Security Resource
-
Practical Example of csSQLi Using (Google) Gears Via XSS
Posted: February 19th, 2009, 5:51pm CST by Robert A.
Tags: Events [edit]
"Yesterday, at the Blackhat DC security conference, I spoke about the dangers of persistent web browser storage. Part of the talk focused on how emerging web browser storage solutions such as Gears (formerly Google Gears) and the Database Storage functionality included in the emerging HTML 5 specification, could be attacked on...
BindShell.Net
-
Module: Safari File Snatch
Posted: February 16th, 2009, 3:41am CST
Tags: Events [edit]
This new module will snatch files from a safari zombie browser. It will work both on Windows and Mac. The vulnerability this module exploits is CVE-2009-0137. Also, don't forget to install the latest patch for Safari to ensure the BeEF zombie continues polling. -
Safari Patch
Posted: February 15th, 2009, 10:51am CST
Tags: Events [edit]
The beefmagic.js.php file has been updated to work with safari caching. There was an issue with safari zombies. To update BeEF, just copy it over the existing one and match the permissions. -
Module: Detect Java
Posted: February 12th, 2009, 4:15am CST
Tags: Events [edit]
Here is the first of a series of new and improved BeEF modules that will be published in the near future. This module is pretty simple. It will detect whether java is enabled in the zombie browser.
Curiouser and Curiouser
-
6 Myths About GM, Ford, and Chrysler
Posted: December 19th, 2008, 8:54am CST
Tags: Current Events [edit]
I much enjoyed this article.
--
Link (Direct) - Link (Reputation Tracking) - Discuss [8] - Reply - Recommend
The Turkey Curse
-
25C3: Schedule online
Posted: November 24th, 2008, 5:20pm CST by fukami
Tags: Events CCC 25C3 Schedule Fahrplan [edit]
-
Deepsec, 25C3, CGNSec and everything else
Posted: November 6th, 2008, 3:48am CST by fukami
Tags: Events Security Deepsec OWASP 25C3 [edit]
Next week I will stay in Vienna to join Deepsec. Last year the conference was just amazing and I’m also looking forward to visit Metalab, one of my favorite hacker spaces. BeF and me will have a talk about ActionScript 3 obfuscation/de-obfuscation and other fun stuff with byte code. BeF released a new version of erlswf which is capable of disassembling AS3 and returning this disassembly as JSON. If you are interesting in those things you should check it out. BeF will hopefully blog about erlswf in detail (hinthint :)
During the last weeks I was one of the persons who looked through all the submissions (nearly 300!) for the 25C3. I was also involved into the decisions what talks will take place. I won’t tell much, but I think it will be interesting and much more focussed on technical topics rather than meta-blabla like the last years. BeF and me are going to speak about Flash stuff at 25C3 as well and we will also release a paper for the conference proceedings.
In November I will be at OWASP Germany 2008 in Frankfurt and talk about RIA security. I’m still not 100% sure what I will exactly talk about, but I think I will focus on difficulties one has to face when auditing complex RIA applications. Most people already know that I’m not a big fan of OWASP since it’s much to much vendor centric in my point of view (but, well, I don’t like to start a big rant here right now). Anyways, I’m looking forward to meet Alexios from n.runs and Martin at the conference.
Last month Stefan and me founded CGNSec. The idea is to meet security people and researchers from the Cologne/Bonn area to talk about unfinished ideas and projects as well as having some beers. Yesterday there was the second meeting and it was real fun. There were even some EZB guys from Frankfurt and we had some interesting conversations. I hope we will have some presentations from time to time, since there are quite some people with interesting stuff. I also hope that the MWCollect guys from Bonn are joining us next time.
Some personal notes: I got engaged with my girlfriend. Since she’ll go to Hamburg beginning of next year to join Henri Nannen Journalist School I will probably leave the Rhineland in between the next two years (well, not before she will finish). I really feel sad somehow, since I feel home here. But after her studies she will probably not coming back, so I will follow her sooner or later.
I joined a carnival society some months ago called “Beueler Stadtsoldaten”. The Rhenish Carneval is starting in a couple of days and I will have quite a couple of events where I will do some dancing (nothing to complicate really) - and I’m thinking about starting a blog or Soup where I like write about some experiences, post some photos and tell about all the dirty little things happen there. I will probably announce it using my Twitter account.
Last but not least a little advertising: End of November the book of Mario Heiderich, Christian Matthies, Johannes Dahse and me will be published by Galileo Press. It’s in German and it calls “Sichere Webanwendungen” (secure web applications). I was only responsible for everything related to Flash, so most of the work was done by the others. The nice thing is that it will be published only using my nick, not my real name :)
Tags: Events, Security, Deepsec, OWASP, 25C3, CGNSec, Beuel, Stadtsoldaten
CGISecurity.com: Your Web Site and Application Security Resource
-
My Trip To Microsoft's Bluehat Conference
Posted: October 21st, 2008, 1:19am CDT by Robert
Tags: Events [edit]
Last week I attended Microsoft's Bluehat conference for the first time and found the experience to be pretty positive. Here are a few highlights New Tools Announced- Microsoft Threat Modeling tool v3.1 RC2 (Public release date: unknown)- CSSH is a CSS history theft tool combining a crawler to enumerate the links...
Curiouser and Curiouser
-
The Bailout Round II: Adult Version?
Posted: September 30th, 2008, 11:40pm CDT
Tags: Current Events [edit]
Watching Dean Baker on CSPAN at the moment, visited his think tank's site, lots of interesting talking point memos.
With much of this equity now eliminated by the collapse of the bubble, many families can no longer sustain their levels of consumption. The main reason that banks won't lend to these families is that they no longer have home equity to serve as collateral. It wouldn't matter how much money the banks had, they are not going to make mortgage loans to people who have no equity.
And house prices are not going to come back. This is like Pets.com. We are not going to get the price of $200,000 homes in central California back up to $500,000.
...
How do we go about getting the banks in order? Almost every economist I know rejects the Paulson approach and argues instead for directly injecting capital into the banks. The taxpayers give them the money and then we own some, or all, of the bank. (That's what Warren Buffet did with Goldman Sachs.)
This isn't about begging for a sliver of equity as a concession for a $700 billion bailout, this is about constructing a bank rescue the way that business people would do it. We have an interest in a well-operating financial system. There is zero public interest in giving away taxpayer dollars to the Wall Street banks and their executives.
--
Link (Direct) - Link (Reputation Tracking) - Discuss [3] - Reply - Recommend -
Speaking at BlackHat 2008:
Posted: May 16th, 2008, 8:13am CDT
Tags: Current Events [edit]
Circumventing Automated JavaScript Analysis Tools
Billy Hoffman[snip]
Next we explore multiple new techniques to circumvent the current generation of automated analysis tools by detecting their presence from inside malicious JavaScript. (JSPill? hmmmm) These methods include HTTP/browser fingerprinting, DOM testing and encrypting, Doman and Network testing, Execution environment testing, and cross plugin communication testing. We will demonstrate malicious JavaScript detecting analysis tools using these methods and refusing to give up its secrets until its running in the web browser of choice. We’ll demonstrate encrypting JavaScript to only run in particular browsers or environments. We’ll also demonstrate a couple other tricks, such as encoding malicious JavaScript as nothing but white space, and function clobbering for fun and profit.
Time to kick CaffineMonkey in the ass. Sorry Ben, I owe you a beer.
And, as is often the case, this technology has no legitimate use.
--
Link (Direct) - Link (Reputation Tracking) - Discuss [1] - Reply - Recommend
The Turkey Curse
-
re:publica, Bluehat and PH-Neutral
Posted: March 26th, 2008, 5:50am CDT by fukami
Tags: Events Security republica08 Bluehat PHNeutral [edit]
The next couple of weeks I’m going to speak at some interesting and completely different events. Next week I will be at re:publica in Berlin doing a tunneling workshop. Last year there was a screen at the entrance of re:publica showing the output of dnsniff. Some people got very pissed because of their passwords turning up in full HD quality. So Markus had the idea of this workshop and asked to do that in order to give the attendees a possibility to protect themself. The re:publica is going to be very big this year (800 attendees all together as far as I know) and a lot of old friends will show up I haven’t seen in a while.
The next event I’m going to visit is Bluehat v7 in Seattle. I’ve never been to the States before, so I’m really excited going there - especially because Microsoft is the reason which I still find very weird. I’ll give a presentation together with Manuel Caballero about Silverlight and how it compares to Adobe Flash security-wise. Only a few of the speakers of Bluehat are already known to me. Beside Lieutenant Dan and kuza55 I’m looking forward to got to know Sowhat. We tried to invite him to one of the past Chaos Communication Congresses but it was far more complicate than we thought because of problems with the visa. I’m also looking forward to got to know Billy Rios. I guess he and Nitesh will talk about Phishing.
In May I’ll be at PH-Neutral and give a presentation together with BeF entitled “SWF and the Malware Tragedy”. The talk is about static analysis of SWF bytecode and we hopefully have some more time to look into less known SWF bytecode obfuscation techniques. BeF and me also wrote a paper with the same title which is mainly about using Erlang programming language based erlswf for SWF bytecode analysis.
Tags: Events, Security, re-publica08, Bluehat, PH-Neutral, Flash, Silverlight, SektionEins, FlashSec
Curiouser and Curiouser
-
Who needs security when you have a robot? | ajc.com
Posted: February 22nd, 2008, 11:44am CST
Tags: Current Events [edit]
Late at night several times a week, Terrill powers up the 4-foot-tall, 300 pound device and reaches for a remote control packed with two joysticks and various knobs and switches. Standing on a nearby corner, he maneuvers the machine down the block, often to a daycare center where it accosts what Terrill says are drug dealers, vagrants and others who shouldn't be there.
He flashes the robot's spotlight and grabs a walkie-talkie, which he uses to boom his disembodied voice over the robot's sound system.
"I tell them they are trespassing, it's private property, and they have to leave," he said. "They throw bottles and cans at it. That's when I shoot the water cannon. They just scatter like roaches."
OMG, I can't believe he actually built it, and I can't believe it actually works.
You now have something more to look forward to at O'Terrill's besides the fish and chips!
--
Link (Direct) - Link (Reputation Tracking) - Discuss [3] - Reply - Recommend -
Taxi to the Dark Side
Posted: February 9th, 2008, 10:30pm CST
Tags: Current Events [edit]
Put people in a crazy situation and people do crazy things
You have no right to a lawyer
you have no right to witnesses
You don't really know what the charges are
And you certainly don't know what the secret evidence is against youIts not about left or right, its about right and wrong
This is playing in Atlanta at The Landmark
--
Link (Direct) - Link (Reputation Tracking) - Discuss [3] - Reply - Recommend -
Defense Minister: How can offensive-forbidden Japan stop UFO Attack
Posted: January 22nd, 2008, 2:42pm CST
Tags: Current Events [edit]
Japan's Defense Minister Shigeru Ishiba is considering how his Self-Defense Forces could respond to an attack by space aliens while adhering to limits on military action under the country's war-renouncing Constitution.
Ishiba said yesterday a Japanese military response, such as those in the Godzilla movie series, would require legal review and said he is studying ways Japan could deal with an attack. Ishiba said his comments represent a ``personal view,'' and not Defense Ministry policy, according to the transcript of the press conference published on the ministry's Web Site.
``There are no grounds for us to deny there are unidentified flying objects and some life-form that controls them,'' Ishiba said. ``Few discussions have been held on what the legal grounds are'' for a military response.
A most interesting problem to have. I suggest building a giant robotic lizard and hiding him in a volcano until the aliens attack.
--
Link (Direct) - Link (Reputation Tracking) - Discuss [5] - Reply - Recommend
BindShell.Net
-
PHP reverse shell
Posted: January 9th, 2008, 12:14am CST
Tags: Events [edit]
Pentestmonkey has a great tool called php-reverse-shell. It is for elevation from web server (PHP) upload access to a reverse bindshell. The script will open an outbound TCP connection from the webserver to a host and port of your choice.
Curiouser and Curiouser
-
Down in it.
Posted: December 19th, 2007, 4:53pm CST
Tags: Current Events [edit]
All the SPI folks are in our new office and all of SPI senior management that used to have offices now has cubes like the rest of us.
I was up above it.
I was up above it.
Now I'm down in it
I was up above it.
I was up above it.
Now I'm down in it
-Nine Inch Nails, Down in it
--
Link (Direct) - Link (Reputation Tracking) - Discuss [1] - Reply - Recommend -
Toothbursh... or Sex Device?
Posted: December 17th, 2007, 3:29pm CST
Tags: Current Events [edit]
Lawyers representing Procter & Gamble send a 66-page cease-and-desist letter to British sex-toy company Love Honey, demanding that it stop using images of its Oral B electric toothbrushes to promote a product called the Brush Bunny - a rabbit-shaped piece of plastic that slips over the top of an Oral B to turn it into a vibrator.
--
Link (Direct) - Link (Reputation Tracking) - Discuss [1] - Reply - Recommend