<< Previous Next >>
engineering
- Virtualzation
- New vulnerability discovering
--- Application security
- Web application vulnerability research
- Application reverse engineering and related automated tools
- Database security & attacks
- Protocol security & exploitation
- Advanced Trojans, worms and backdoor technique
- Encryption & decryption technique
- Routing device
>> - Routing device
>> - Visualization technique
>>
>> --- Application security
>> - Web application vulnerability research
>> - Application reverse engineering and related automated tools
>> - Database security & attacks
>> - Protocol security & exploitation
>> - Advanced Trojans, worms and backdoor technique
>> - Encryption & decryption technique
>>
- Routing device
- Visualization technique
--- Application security
- Web application vulnerability research
- Application reverse engineering and related automated tools
- Database security & attacks
- Protocol security & exploitation
- Advanced Trojans, worms and backdoor technique
- Encryption & decryption technique
With all the proliferation of phone home for update systems in
even trivial software packages these days, neophyte users
can easily get confused about legitimate upgrades and imposters.
So someone is trying to take advantage of this with an
automated version of an old school social engineering
attack via Skype spam.
Someone/something/.someone's-botnet on skype last night
contacted users who reported it to me. The messages were
formatted to resemble Microsoft update messages or an AV scan
release, which is expected in 2 months' time from now.
. 2011-07-18:
Core considers bad practice to postpone the patch release 2 months until
a new version of the product is available (since it may suffer
engineering delays that have nothing to do with the reported security
issue itself). As a result, Core offers to reschedule the advisory
publication to Aug 9th, providing additional time to the vendor for
developing patches and/or the appropriate mitigation actions, until the
version 8.1 comes to light.
volume includes 6 articles on a variety of topics:
- Covert Communications: Real-time Steganography with RTP
Author: I)ruid
- Engineering in Reverse: PatchGuard Reloaded: A Brief Analysis of
PatchGuard Version 3
Author: Skywing
- Exploitation Technology: Getting out of Jail: Escaping Internet
Explorer Protected Mode
Please visit our updated website for more details about the venue, the
schedule and information about our past conferences:
https://deepsec.net/
The DeepSec offers a mix of different topics and aspects like current
threats and vulnerabilities, social engineering and psychological
aspects as well as security management and philosophy. Our speakers and
trainers traditionally come from the security community, companies,
hacker spaces and academic organisations.
You can submit content for three categories:
disclosure policies should be respected. But you did manage to get some
nice press in CNET, huh?
By the way, I'm sure you actually executed code as POC rather than just
assuming that you could based on the calls you identified by reverse
engineering the binaries, right? I guess I'm also curious how you are
classifying this as "remotely exploitable" when what you describe in
your "detailed description" sounds more like you would have to get a
victim to go to your evil web site first or download your coffee
"recipe" somehow and feed them to the coffee maker, right? Or is the
maker actually listening for connections and the assumption is that
- Virtualization
- New bug digging
--- Application security
- Web application vulnerability research
- Application reverse engineering and related automated tools
- Database security & attacks
- Protocol security & exploitation
- Advanced Trojans, worms and backdoor technique
- Encryption & decryption technique
- Routing device
o Code analysis
o Exploitation techniques
o Network scanning and analysis
o Cryptography
o Malware Analysis
o Reverse engineering
o Forensics and Anti-forensics
o Social engineering
o Web application security
o Database security
o Legal aspects of computer security and surrounding issues
available for FRHACK 2009.
# Selected speakers #
Social Engineering, Hacking brains
- Bruno Kerouanton (Switzerland)
Reverse engineering and cryptographic errors
- Philippe Oechslin (Switzerland)
- Training sessions + conference
- Accepting talk proposals until May 15
+ This year we are offering four technical training sessions
- Binary Literacy: Static Reverse Engineering
- Rolf Rolles
- Binary Vulnerabilities and Exploit Writing
- Gerardo 'gera' Richarte
vulnerability on the event log page resulting from
displaying unsanitized user input received from an invalid
login attempt.
This can be exploited without valid credentials or social
engineering. Access to device administration IP address is
needed and an administrator has to view event log at some point,
however.
Successful attack requires that an administrator visits event
log page, thus enabling the attacker to control the chassis
provide the required security properties. Virtual organizations often
use the Internet to support collaboration. The Internet, operating
systems and distributed environments currently suffer from poor
security support and cannot resist common attacks (spamming, worms,
session hijacking, buffer overflow, denial of service, social
engineering, etc.). Collaborative organizations require better
security properties (strong authentication, efficient encryption,
Mandatory Access Control, integrity, non-repudiation and
availability). Nowadays, collaborative organizations use new
technologies such as mobile devices, smartcards, wireless networks,
high performance networks, grid computing, multi-agent systems,
Exploitation of this vulnerability results in the execution of arbitrary
code with the privileges of the current user. In order to exploit this
vulnerability, a user must load a web page containing a specially
crafted TIFF image. An attacker typically accomplishes this via social
engineering or injecting content into compromised, trusted sites.
Typical social engineering attacks will pass URLs as part of instant
messages or electronic mail.
IV. DETECTION
*NEW* - Penetrating the Epoxy Curtain: Hands-On Silicon Hacking
Instructors: Bunnie & Christopher Tarnovsky
Availability: 9 seats left
I'm really excited about this workshop. It'll involve dissecting a
stored value smart card die and reverse engineering the transistors to
determine what the different parts of the chip do and by the end of
the course be able to circumvent some of the card's hardware access
controls. We're gearing this workshop towards software reverse
engineerers that want to learn more about how the hardware ticks and
get a better understanding for how things are implemented at the even
During a penetration test, RedTeam Pentesting discovered that the emails
sent by the IceWarp WebMail Server when using the "Forgot Password"
function are generated on the client side. Furthermore, the server
expands certain keywords in these emails to users' full names, usernames
and passwords. This allows for advanced social engineering attacks and
the potential disclosure of usernames and passwords.
Details
=======
IE allows you to right-click on a folder (but not on a file or on the
"background") inside a file:// iframe without popping up a security
warning. No idea why but it does.
> 2) You're getting closer with this "Send To" stuff, but you're still
> socially engineering. Definitely better than classic "please download
> and execute this file" though.
I personally think that the "click twice on this web page" exploit
that we released today requires even less social engineering than the
"Send to" one.
Over the past few years, ToorCon has been known for providing hands-on workshops which focus on teaching a wide range of skills in a small classroom environment. The main goal is to teach the basics and provide the audience with the tools to expand on their knowledge on their own after the 2-day workshop is over. We have an exciting list of workshops to choose from this year:
Software Defined Radio Workshop
Instructor: Michael Ossman
Includes: Use of a USRP (If you would like a USRP kit included in your training cost, please contact us)
Software Defined Radio (SDR) techniques are rapidly becoming essential to all areas of wireless security research. Recent attacks on Bluetooth, GSM, wired and wireless keyboards, implantable medical devices, RFID, and more have been made possible by software radio. A combination of lectures, software exercises, and over-the-air projects, this workshop will provide the hands-on background in digital signal processing and radio engineering required to apply software radio techniques to practical hacking of diverse wireless systems. If you have experience developing software but lack experience with radio technology and digital signal processing, this workshop is for you.
Application Security Workshop
Instructor: Jared DeMott
Includes: CD with VMWare images and printed training materials
There are four technical skills required by security researchers, software quality assurance engineers, or developers concerned about security: Source code auditing, fuzzing, reverse engineering, and exploitation. All these skills and more are covered. C/C++ code has been plagued by security errors resulting from memory corruption for a long time. Problematic code is discussed and searched for in lectures and labs, with WebGoat introduced as well. Fuzzing is a topic book author DeMott knows about well. Mutation file fuzzing and framework definition construction (Sulley and Peach) are just some of the lecture and lab topics. When it comes to reversing C/C++ (Java and others are briefly discussed) IDA pro is the tool of choice. Deep usage of this tool is covered in lecture and lab. Exploitation discussions and labs are the exciting final component. You’ll enjoy exploiting BSD local programs to Vista browsers using the latest techniques.
+ The early registration for the conference is now open.
+ We are offering three training courses this year.
-Advanced Reverse Engineering by Nicolas Brulez
-Binary vulnerabilities and Exploit Writing by Gerardo 'gera' Richarte
-Binary Literacy: Static Reverse Engineering by Rolf Rolles
check http://recon.cx/2008/training.html for more details
Please visit our updated website for more details about the venue, the
schedule and information about our past conferences:
https://deepsec.net/
The DeepSec offers a mix of different topics and aspects like current
threats and vulnerabilities, social engineering and psychological
aspects as well as security management and philosophy. Our speakers and
trainers traditionally come from the security community, companies,
hacker spaces and academic organisations.
You can submit content for three categories:
The RSS gadget runs by default, but does not display any feeds unless a
user subscribes to them. As such, a user must be receiving data from a
malicious feed in order to be attacked.
In the most common scenario, this requires some form of social
engineering to convince a user to subscribe to a malicious feed. There
is no way to add a feed by simply clicking a link. The user must click
the 'Subscribe to this feed' button displayed when visiting a feed in
Internet Explorer. After adding the feed, exploitation will occur once
the gadget attempts to display the feed.
Fourth International Workshop on Secure Software Engineering (SecSE2010)
http://www.sintef.org/secse
In conjunction with ARES 2010
February, 15th - 18th 2010
Andrzej Frycz Modrzewski Cracow College, Krakow, Poland http://www.ares-conference.eu/conf/
Call for Papers
===========================
Submission deadline: September 30th 2009
Aditya K Sood wrote:
> Hi all
>
> This is the reverse Engineering layout of Scvhost Internals.
>
> |Category : Reverse Engineering Analysis.
>
> The paper solely relates to the core internals that build up the
> Windows XP Svchost. The Svchost internals have not been disseminated
> into informative elements yet. I have found only one or two analysis
#########################################################################
#
# web design search engineering Neoteric UK LTD
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
Topics of interest include, but are not limited to:
o Mobile Device Security
o Virtualization, Hypervisor, and Cloud Security
o Malware Analysis
o Reverse Engineering
o Exploitation Techniques
o Rootkit Development
o Code Analysis
o Forensics and Anti-Forensics
o Embedded Device Security
Attack vectors:
///////////////
There are two main attack vector schemes:
- inducing remote user to launch WWW link after obtaining the information about the location of an arbitrary file(s) locations/names in the remote system. After clicking the link the files contents will be unrecoverably destroyed. This attack vector thus requires additional social engineering of the vitim to acquire exact name and location of the potential attack target files.
- inducing remote user to launch WWW link resulting in corruption of vital Operating System files, leaving the system unusable. This attack vector DOESN'T require any additional victim social engineering,
because the system files are always placed in the predictable locations.
Hi all
This is the reverse Engineering layout of Scvhost Internals.
|Category : Reverse Engineering Analysis.
The paper solely relates to the core internals that build up the
Windows XP Svchost. The Svchost internals have not been disseminated
into informative elements yet. I have found only one or two analysis
but that wont satisfy my views regarding XP Svchost. The anatomy of
Topics of interest include, but are not limited to:
* Mobile Device Security
* Virtualisation, Hypervisor and Cloud Security
* Malware Analysis
* Reverse Engineering
* Exploitation Techniques
* Rootkit Development
* Code Analysis
* Forensics and Anti-Forensics
* Embedded Device Security
o Code analysis
o Exploitation techniques
o Network scanning and analysis
o Cryptography
o Malware Analysis
o Reverse engineering
o Forensics and Anti-forensics
o Social engineering
o Web application security
o Database security
o Legal aspects of computer security and surrounding issues
<<Previous Next>>
|
