Posts Tagged ‘Microsoft’

Defcon 18 – photos and followup

Monday, August 2nd, 2010

Another year, another Defcon has passed. This year I went with CarbonLifeForm (who helped out with this post) and we attended talks, mingled with fellow enthusiasts, spread the psych0tik word, and enjoyed general debauchery. I was asked to take some photos for some friends who couldn’t attend this year, so I’ve pulled those together with some comments and added them to this post.

This year was quite busy, with far more people than have attended Defcon before. Unfortunately, that meant needing to wait in lines during other talks, so I’ll be looking forward to getting the video and being able to watch some of the ones I missed. A large number of attendees also made for a shortage of badges. This shortage resulted in a the “Lamer skybox party” Friday night for all those who didn’t get a proper badge. For a last minute party, the guys who put it together did a great job. I’ll be looking forward to hitting it up again next year.

Of the talks I saw, I particularly enjoyed the nmap scripting engine talk by Fyodor and the Razorback[2] debut by the Sourcefire guys. As always, Fyodor has been scanning the internet and this time he aimed nmap and a few nmap smb scripts at Microsoft’s net-blocks and showed us the results.

Razorback is Sourcefire’s new open source project, that’s built to correlate and process security events. It allows ambiguous data types and provides a framework for events to be dissected and analyzed by modules. Each piece of data is passed around to the various “Nuggets” for processing. It’s a neat system and I’ll be looking at writing some Nuggets to add to the farm.

In support of Gregory Evans and Ligatt, I wore a HackerGearOnline shirt on Friday. I was happy to see the con shirts labeled “Worlds #1 Hacker (conference)”, also paying due tribute to Mr. Evans. I didn’t manage to pick up one of the shirts, so I don’t have a picture of it.

Outside of being a bit over-populated, this year’s con was great. We enjoyed a number of interesting and entertaining talks and of course participated in the Defcon/Vegas shenanigans. Our flights were early and we missed closing ceremonies, but the announcement was made that Defcon would be moving from the Riviera to the Rio for Defcon 19[3].

MEDIA

This year’s badge was much more interactive than in years past. Including a mini-USB port and multiple challenges[1]

The following are a few shots of vintage hardware. This room (and a good bit of the hallway outside the room) had that “data center” smell. Directly below is a picture of the PDP-11[4].

A shot of the wall-o-sheep, as always, lots of great pwnage.

Hackbus – enough said.

Here’s a picture from Fyodor’s talk. If you can’t tell, this is nmap output for a Microsoft IP address.

Rocking my HackerGearOnline (order #19!) t-shirt. Thanks Greg!

As much as I try to keep this blog away from advertising, I’ve got to give it to IOActive for throwing a great party Saturday night.

A (now) empty bottle that ended up covered in Defcon18 stickers. The official booze of Defcon?

This one turned out to be off topic. I found this sticker on the dresser in my hotel room. I figured it was something con-related, but getting home and looking it up, it turns out to be a punk rock band. A bit of promotion for them too I suppose

REFERENCES

[1]Defcon 18 Badge – Ninja access bruteforcer

[2]Sourcefire VRT Labs – Razorback project

[3]Wikipedia – List of Defcon Venues

[4]Wikipedia – PDP-11

3rd party MSN problems: Update!

Saturday, January 31st, 2009

In my previous post 3rd party MSN problems, I discussed how to update pidgin to use MSN-Pecan, rather than Libpurple. After doing some research, the problem was found to be the implementation of MSNP15. Official MSN clients, as well as a few 3rd party clients, seem to fall back on older protocols. As MSN-Pecan uses MSNP12, it will work.

This morning, I accidentally signed in under MSN, rather than the WLM account on pidgin and lo-and-behold it worked! The pidgin folks have pushed out a fix to the MSNP15 problem and pidgin should function correctly now.

If you’d like to follow the bug report, it can be found here.

3rd party MSN problems

Monday, January 12th, 2009

Yesterday I attempted to connect to my MSN account with pidgin and received the error “Unable to retrieve MSN Address Book.“  After a bit of research I found that Microsoft has prevaricated parts of the MSN protocol in turn for the WLM protocol.

In order to fix this issue, you must switch your protocol to WLM from MSN. If you don’t have the WLM option in the ‘add account’ dialog box install the X11 plugin for msn-pecan. (Under Gentoo this is: x11-plugins/pidgin-msn-pecan)

After this install, a restart of pidgin, and creating a WLM pidgin account I was able to resume chatting happily.

Utilities for backing up client-side website data

Friday, May 16th, 2008

I was looking into various methods for backing up websites on my localhost and have come up with 3 options. I’m sure there are more, but these require tools you already have.

Internet Explorer 6 (I don’t have IE7 installed yet, so I did it with IE6)

Internet explorer 6 offers the ability to “work offline” which downloads all data to your localhost and allows you to act as tho you are viewing the live site. In order to enable this, you bookmark the page and select “make available offline.” If you want more than just that one page, goto customize and you are prompted for getting pages it links too also. What is nice is that you can specify how deep you want IE6 to go. If you select 2, for example, all links on the page will be followed and downloaded. All links on these pages will be treated similarly and the process stops. You are then prompted for how you want to synchronize these local copies. You have 2 options: manually synchronizing and scheduling. Scheduling will do it at a specified time every n number of days. Since IE6 is “working offline” paths don’t need to be modified.

FireFox 2

Firefox 2 offers a similar solution, however; it does not appear to have the synchronization by default. To do this you “save page as” and then have the option of saving as a text file, as the single page, or “complete” which will build up all the files needed for that page. Unlike IE6 you cannot get pages linked to. There is a Firefox add-on that will provided added functionality, but this article’s scope is default functionality. Also, Firefox does not change links to localhost paths.

WGET

The previous options are great for GUI systems, however; if you are a sysadmin or a web developer and need to make a backup of a current live site before replacing it with a new version neither of these options are very good for you. So I provide a command line, no GUI option. running wget with the -r (recursive) option will provide the same functionality as IE6. Simply create a directory, change directory into it, and run:

wget -r site.com

and you have all the client side data. Much eaiser and without GUI.

These options bring up 2 more topics I’d like to cover. First is from the perspective of the site owner. Suppose you don’t want people going around downloading your content. For a dedicated person, this is not preventable, but you can make it more difficult and annoying. IE6 and wget both follow the robots.txt rules, this is not an issue for Firefox 2 since it doesn’t have this functionality by default anyways. In short, other than making it less convenient and data you send to a client (HTML, CSS, Javascript) will be available for backup which is obvious since it is client side data and the web would be useless if it was inaccessible.

The other topic is client side security. Browsers disallow cross site AJAX requests. This is a security feature to stop a malicious individual from putting AJAX calls to other sites on their page and stealing your personal information. Browsers do however allow this behavior from the localhost. So by downloading and viewing this malicious code it will execute. Also, by putting JavaScript code on your local file system you allow malicious individuals to access these files.

Interestingly it seems that Internet Explorer 6 actually beats the default install of Firefox 2 in this test. Seems Microsoft did a good job on this feature. wget doesn’t really enter into that comparison since both are browsers and wget is utility, however; it also tops Firefox 2 by having recursiveness. As backup utilities wget and Internet Explorer 6 are tied since they both preserve pages, links included. Personally, I prefer wget since I’m not a fan of GUI or tools that won’t run under linux.

Windows Vista is less secure than Windows 2000?

Tuesday, May 13th, 2008

In a recent study by PCTools, Windows Vista was found to be far more vulnerable to malware than Windows 2000. These tests were run on both server and client editions of the operating system and the following statistics were provided: Windows Vista was found to allow 639 threats per thousand computers while Windows 2000 only was allowing 586.

Based on these statistics 64% of Vista users are in danger, however; only 59% of Windows 2000 users are in danger. These numbers seem damaging to Microsoft considering that Vista has been marketed as the most secure version of Windows to date. However, after a bit of examination, these statistics are not quite as blunt as they seem.

The 5% difference between the two operating systems is not a large margin. Also Dennis Kudin points out that software such as Internet Explorer 7 will not run on Windows 2000. Internet Explorer 7 provides security that requires newer service packs that Windows 2000 simply cannot run. This provides a whole new target for Vista that Windows 2000 does not have. Windows Vista provides the UAC (User Access Control) system to stop processes from being administrators without permission. Most Windows 2000 users ran under administrator by default, which would allow malware to be more effective.

Microsoft’s director of project management security, Austin Wilson, commented on his blog that Vista was tested fully and stated “We study the malware space very carefully and publish our results twice a year in the Security Intelligence Report. This report is compiled from statistics on malware infections based on over 450 million executions of the Malicious Software Removal Tool (MSRT) every month. Microsoft is a member of AMTSO (Anti Malware Testing Standards Organization) and its charter includes defining test methodology so that there is a minimum quality bar to all testing of this type.

It seems that PC Tools may have been rather hasty in their claim, however; with all the “added security features” and testing that Vista has undergone a 64% infection rate seems to be a bit high. Even with the security provided by UAC and Vista’s built in security, Austin Wilson recommends, and rightfully so, that users still run firewall and anti-virus software.

Sources:

http://www.scmagazineus.com/Report-Vista-…Windows-2000/article/110008/

http://blogs.msdn.com/windowsvist…-vista-windows-2000-and-malware.aspx

http://dkudin.spaces.live.com/…6B73AF165%21135.entry

Reading Raingbow: Episode 2

Monday, April 21st, 2008

I’ve been doing quite a bit of reading lately and have a few great articles for this week. I’ve been reading alot into VoIP and VoIP security so expect a post about that soon.

Vista is annoying… no, really – Turns out the UAC ( User Account Control ) feature of Vista was design purposely to annoy us.

Castle Wars – Ok, I’m not really a gamer, but this game just works for me. It’s akin to Magic: The gathering, if anyone else played that.

Google, Gmail, and Snooping – Here we see more talk about the wondrous privacy issues google brings up. Big Brother? Perhaps…

ActiveX Control found to be source of Windows 0-day – Windows Server 2003 and 2008, XP, and Vista are all affected by this which allows malicious code to be run as LocalSystem giving the exploit code a high level of privileges.

That’s it for this week. I’m working on an article on some fun with VoIP so look for that soon-ish. Also, I’ll be posting about a new project I’m going to be starting. Keep tuned in.