An introduction to the Katsuni theorem and its application to sandboxing and software emulation. Jonathan Brossard (Toucan System)
|
|
|
- Jason Booker
- 5 years ago
- Views:
Transcription
1 An introduction to the Katsuni theorem and its application to sandboxing and software emulation Jonathan Brossard (Toucan System) 25/09/2013
2 Who am I? - Security researcher, publishing since Past research : vulnerabilities in BIOSes, Microsoft Bitlocker, Truecrypt, McAfee Endpoint (Defcon 2008), PMCMA debugger (Blackhat USA 2011), «Rakshasa» supply chain backdoor PoC (Blackhat 2012), 2 SAP notes (2013). - Speaker/trainer at HITB, CCC, Ruxcon... - Co-founder of the Hackito Ergo Sum and NoSuchCon research conferences (France).
3 What's hot in the AV industry in 2013?
4 AV industry : 2013 trends - Desktop AV is essentially a thing of the past - Focus moves technologies hopefully able to «detect 0days»[1] like sandboxing. => The new cool thing is emulation and sandboxing. [1] Don't laugh yet.
5 How it all started...
6 CVE (Adobe Sandbox bypass) Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before , and 11.x before allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.
7 CVE (Adobe Sandbox bypass)
8 Their «analysis» : Here is the sequence of the ROP shellcode: msvcr100!fsopen() msvcr100!write() mvvcr100!fclose() kernel32!loadlibrarya() kernel32!sleep() Upon loading the malicious library, it will enter a long sleep and ensure that the thread has not crashed because the whole stack in the thread is already manipulated for creating a ROP chain.
9 Their «analysis» : Here is the sequence of the ROP shellcode: msvcr100!fsopen() msvcr100!write() mvvcr100!fclose() kernel32!loadlibrarya() kernel32!sleep() Upon loading the malicious library, it will enter a long sleep and ensure that the thread has not crashed because the whole stack in the thread is already manipulated for creating a ROP chain.
10 Their «analysis» : Here is the sequence of the ROP shellcode: msvcr100!fsopen() msvcr100!write() mvvcr100!fclose() kernel32!loadlibrarya() kernel32!sleep() Upon loading the malicious library, it will enter a long sleep and ensure that the thread has not crashed because the whole stack in the thread is already manipulated for creating a ROP chain. => In trivial english, this is called bullshitting. They clearly have no idea what the exploit is trying to do here.
11 What I believe really happens in this case (wild guess) Sleep 5 minutes to attempt bypass sanboxing detection :) After all, it's a hardened exploit, found in the wild and the first of its kind to bypass Adobe sandboxing technology...
12 Limits of such technologies (imho) - Good at finding artefacts (it's still «something»). -Pretty bad at understanding what is actually happening inside the exploit.
13 That being said...
14 The raise of sandboxes...
15 The raise of sandboxes...
16 The raise of sandboxes...
17 The raise of sandboxes...
18 I don't find quite reasonable to add to your corporate network something nobody really understands.
19 Note : lack of third party assessment
20 Note : lack of third party assessment
21 Note : lack of third party assessment
22 Note : lack of third party assessment The whole concept of sandboxing vendors is to not have the perceived enemy take a look at the technology. Ok, agreed.
23 Note : lack of third party assessment It also means no third party assessment has been done by the security community... In real life, having software due dilligence done by the community has proved to be a good thing for the quality of the said software. See similar requests from Tavis Ormandi and Pipacs to have a look at Bromium's technology... Note : well, they're not Bromium clients, so we have a problem... as an industry, really.
24
25 Room for problems (research leads)
26 After all... Current «genious» idea : - Correlate/share more data to create information asymetry. - To do that, most (all I've seen allow it, at least in non default mode) solutions now allow a malware to connect back to the internet[*]. [*] Idea being to correlate DNS/binary checksum informations over «campaigns» of attacks in the time.
27 A few facts on this... - The whole corporate strategy over the past 15 years has been to segregate LANS, DMZs and the internet. - Now you give a temporary shell to the attacker at network perimeter (proxies, mail gateways, wherever such sandboxing solutions exist)... - and what happens to your DNS?
28 The Katsuni-Kaminsky attack (having it both ways) - Attacker can run a malware inside a sandbox. - Sandbox allows attacker to connect back to the internet. - Corporate DNS server is used as a recursive DNS server. - Attacker has it both ways and can synchronize arbitrary spoofed packets emission from both inside and outside the network. => That's gonna be very «safe» for sure...
29 Not to mention... - What happens if the malware, from inside the sandbox manages to attack other networks (say crowdstrike!)? - What happens if the malware can send back a modified copy of itself to the same network (smtp?) for more analysis, and more sandbox cpu time? => It's all about implementation details really.
30 Turning lame bugs into sandbox Oracles
31 The problem - Many online malware scanning engines run qemu (+ some various instrumentation and automation custom software) - User doesn't get to see anything from the scanning process. - Now, what if an attacker has a qemu DoS?
32 Turning lame bugs into sandbox Oracles (aka : hacking online malware analysis tools... hrm)
33 Such bugs do happen...
34
35 Qemu internals
36 Qemu goals - (Fast) binary translation - Binary code is translated into an IR, which is then executed by a virtual cpu, independently of host OS/arch. - Super generic, super fast, super portable, super cool. Truely impressive. - Super secure for the purpose of malware analysis though?
37 Qemu supports two modes - System (full) virtualization - Kernel emulation (wine/windows, linux). While most of current implementations are likely to be using the first flavour, we'll focus on the later one, which promises great speed enhancements, and a much greater attack surface... ;)
38 Qemu architecture
39 Understanding binary translation & memory sharing
40 Party time!!
41 Qemu regression tests...
42 Demos
43 Conclusion Interresting technologies. Cool hacking tools. There is room for massive security problems, the devil being in the details. No such a thing as third party assessment afaict. From a strict game theory pov, your best interrest is probably to have others use that, but stay away from such technologies...
44 The Katsuni-Grothendieck theorem applied to silver bullet 0day sandboxing : «You can't have it both ways!»
45 Thanks for inviting me. Questions?
General Pr0ken File System
General Pr0ken File System Hacking IBM s GPFS Felix Wilhelm & Florian Grunow 11/2/2015 GPFS Felix Wilhelm && Florian Grunow #2 Agenda Technology Overview Digging in the Guts of GPFS Remote View Getting
Adon'tbe an Adobe victim
Adon'tbe an Adobe victim An overview of how recent Adobe-related flaws affect your web application Joshua Stabiner EY Agenda Introductions Background Cross-site scripting (PDF) Overview Exploit Mitigation
10 FOCUS AREAS FOR BREACH PREVENTION
10 FOCUS AREAS FOR BREACH PREVENTION Keith Turpin Chief Information Security Officer Universal Weather and Aviation Why It Matters Loss of Personally Identifiable Information (PII) Loss of Intellectual
Internet infrastructure
Internet infrastructure Prof. dr. ir. André Mariën (c) A. Mariën 04/03/2014 1 Topic Vulnerability and patch management (c) A. Mariën 04/03/2014 2 Requirements Security principle: Everything can and will
Reversed Buffer Overflow Cross Stack Attacks. Kris Kaspersky Endeavor Security, Inc.
Reversed Buffer Overflow Cross Stack Attacks Kris Kaspersky Endeavor Security, Inc. Who am I? journalist, reversing as a hobby; currently working for: XAKEP magazine (www.xakep.ru) Endeavor Security, Inc
Malware
reloaded Malware Research Team @ @xabiugarte Motivation Design principles / architecture Features Use cases Future work Dynamic Binary Instrumentation Techniques to trace the execution of a binary (or
Survey of Cyber Moving Targets. Presented By Sharani Sankaran
Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber moving target technique refers to any technique that attempts to defend a system and increase the complexity of
Is Exploitation Over? Bypassing Memory Protections in Windows 7
Is Exploitation Over? Bypassing Memory Protections in Windows 7 Alexander Sotirov alex@sotirov.net About me Exploit development since 1999 Published research into reliable exploitation techniques: Heap
Token Kidnapping. Cesar Cerrudo Argeniss
Token Kidnapping Cesar Cerrudo Argeniss Who am I? Argeniss Founder and CEO I have been working on security for 7 years I have found and helped to fix hundreds of vulnerabilities in software such as MS
Qiang Li && Zhibin Hu/Qihoo 360 Gear Team Ruxcon 2016
Qiang Li && Zhibin Hu/Qihoo 360 Gear Team Ruxcon 2016 Who are we Security researcher in Qihoo 360 Inc(Gear Team) Vulnerability discovery and analysis Specialize in QEMU currently 50+ security issues, 33
SharkFest 17 Europe. #35 Sneaking in The Backdoor. Hacking the Non-Standard Layers. Phill Sherlock Shade. Merlion s Keep Consulting.
SharkFest 17 Europe #35 Sneaking in The Backdoor Hacking the Non-Standard Layers 10 November 2017 Phill Sherlock Shade Merlion s Keep Consulting #sf17eu Estoril, Portugal #sf17eu Estoril, Portugal Merlion
COMPARATIVE MALWARE PROTECTION ASSESSMENT
February 2018 COMPARATIVE MALWARE PROTECTION ASSESSMENT 2018.02.28 1 Table of Contents 1 Introduction... 3 1.1 Executive summary... 3 1.1 Test details... 5 1.1.1 Malware protection test... 5 1.1.2 Real-world
Building world-class security response and secure development processes
Building world-class security response and secure development processes David Jorm, Senior Manager of Product Security, IIX Outline Introduction SDN attack surface Recent OpenDaylight vulnerabilities Defensive
McAfee Labs: Combating Aurora
McAfee Labs: Combating Aurora By Rohit Varma, McAfee Labs Contents Overview... 2 McAfee detection names for Aurora... 3 Exploit-Comele... 3 Roarur.dr... 3 Roarur.dll... 3 Symptoms... 5 Characteristics...
MRG Effitas Trapmine Exploit Test
MRG Effitas Trapmine Exploit Test 1 Contents Introduction... 3 Certifications... 3 Tests Applied... 3 Sample sets... 3 Participants... 4 Methodology... 4 Results... 6 Known metasploit samples... 6 In-the-wild
Application Firewalls
Application Moving Up the Stack Advantages Disadvantages Example: Protecting Email Email Threats Inbound Email Different Sublayers Combining Firewall Types Firewalling Email Enforcement Application Distributed
Breaking and Securing Mobile Apps
Breaking and Securing Mobile Apps Aditya Gupta @adi1391 adi@attify.com +91-9538295259 Who Am I? The Mobile Security Guy Attify Security Architecture, Auditing, Trainings etc. Ex Rediff.com Security Lead
Heaps of Heap-based Memory Attacks
Heaps of Heap-based Memory Attacks Kevin Leach kleach2@gmu.edu Center for Secure Information Systems 3 October 2012 K. Leach (CSIS) Heaps of Heap-based Memory Attacks 3 October 2012 1 / 23 Goals During
P1_L3 Operating Systems Security Page 1
P1_L3 Operating Systems Security Page 1 that is done by the operating system. systems. The operating system plays a really critical role in protecting resources in a computer system. Resources such as
Do as I Say not as I Do Stealth Modification of Programmable Logic Controllers I/O by Pin Control Attack
Do as I Say not as I Do Stealth Modification of Programmable Logic Controllers I/O by Pin Control Attack ALI ABBASI SYSSEC GROUP, RUHR UNIVERSITY BOCHUM, GERMANY & SCS GROUP UNIVERSITY OF TWENTE, NETHERLANDS
Protecting binaries. Andrew Griffiths
Protecting binaries Andrew Griffiths andrewg@felinemenace.org Introduction This presentation is meant to be useful for people of all skill levels. Hopefully everyone will get something out of this presentation.
Live Attack Visualization and Analysis. What does a Malware attack look like?
Live Attack Visualization and Analysis What does a Malware attack look like? Introduction Bromium is a virtualization pioneer whose micro-virtualization technology delivers dependable, secure and manageable
Why bother? Default configurations Buffer overflows Authentication mechanisms Reverse engineering Questions?
Jeroen van Beek 1 Why bother? Default configurations Buffer overflows Authentication mechanisms Reverse engineering Questions? 2 Inadequate OS and application security: Data abuse Stolen information Bandwidth
Our sponsors Zequi V Autopsy of Vulnerabilities
Our sponsors Our sponsors Our sponsors About me Who s me? Ezequiel Zequi Vázquez Backend Developer Sysadmin & DevOps Hacking & Security Speaker since 2013 About me Index 1 Introduction 2 Analysis of Vulnerabilities
Hackveda Training - Ethical Hacking, Networking & Security
Hackveda Training - Ethical Hacking, Networking & Security Day1: Hacking windows 7 / 8 system and security Part1 a.) Windows Login Password Bypass manually without CD / DVD b.) Windows Login Password Bypass
ArcSight Activate Framework
ArcSight Activate Framework Petropoulos #HPProtect 44% Have trouble managing their SIEM eiqnetworks 2013 SIEM Survey #1 challenge Identification of key events SANS 2012 Log Management and Event Management
Application security. Not so obvious vulnerabilities. Nicolas Grégoire / Agarri CERN
Application security Not so obvious vulnerabilities Nicolas Grégoire / Agarri CERN Outline PHP Laxism XML Risks Blacklist Evasion XSLT Madness $ Whoami Nicolas Grégoire / Agarri Founder 13 years of Infosec
Abusing JSONP with. Michele - CVE , CVE Pwnie Awards 2014 Nominated
Abusing JSONP with Michele Spagnuolo @mikispag - https://miki.it Pwnie Awards 2014 Nominated CVE-2014-4671, CVE-2014-5333 Rosetta Flash FWSÏx DADË
WHITE PAPER. AirGap. The Technology That Makes Isla a Powerful Web Malware Isolation System
AirGap The Technology That Makes Isla a Powerful Web Malware Isolation System Introduction Web browsers have become a primary target for cyber attacks on the enterprise. If you think about it, it makes
crush malware that hasn't even been seen before. Alright, so not really like traditional antivirus. Cleans an already infected Mac, 14- day Premium
Malwarebytes 1043 I own a computer company. From many years of experience, this is absolutely the best anti-virus software on the market. Malwarebytes catches the malware that our antivirus misses. Cleanup
Symantec Ransomware Protection
Symantec Ransomware Protection Protection Against Ransomware Defense in depth across all control points is required to stop ransomware @ Email Symantec Email Security.cloud, Symantec Messaging Gateway
I run a Linux server, so we re secure
Silent Signal vsza@silentsignal.hu 18 September 2010 Linux from a security viewpoint we re talking about the kernel, not GNU/Linux distributions Linux from a security viewpoint we re talking about the
Attack Vectors in Computer Security
Attack Vectors in Computer Security Who Am I @WillGoard My first proper hacksoc talk I speak fluent greek Sell more pizzas have more fun Why attack vectors? Didn t know what to do for my dissertation Started
Portable Document Malware, the Office, and You
Portable Document Malware, the Office, and You Get owned with it, can't do business without it! Seth Hardy Senior Malware Analyst Threat Research and Response shardy@messagelabs.com SecTor 2009 October
tostatichtml() for Everyone!
tostatichtml() for Everyone! About DOMPurify, Security in the DOM, and Why We Really Need Both A talk by Dr.-Ing. Mario Heiderich, Cure53 mario@cure53.de @0x6D6172696F 1 of 45 Here is Alice. She wants
The DNS. Application Proxies. Circuit Gateways. Personal and Distributed Firewalls The Problems with Firewalls
Network Security - ISA 656 Application Angelos Stavrou August 20, 2008 Application Distributed Why move up the stack? Apart from the limitations of packet filters discussed last time, firewalls are inherently
Building Advanced Coverage-guided Fuzzer for Program Binaries
Building Advanced Coverage-guided Fuzzer for Program Binaries NGUYEN Anh Quynh WEI Lei 17/11/2017 Zero Nights, Moscow 2017 Self-introduction NGUYEN Anh Quynh, PhD
Reverse Engineering Malware Dynamic Analysis of Binary Malware II
Reverse Engineering Malware Dynamic Analysis of Binary Malware II Jarkko Turkulainen F-Secure Corporation Protecting the irreplaceable f-secure.com Advanced dynamic analysis Debugger scripting Hooking
Why bother? Default configurations Buffer overflows Authentication mechanisms Reverse engineering Questions?
Jeroen van Beek 1 Why bother? Default configurations Buffer overflows Authentication mechanisms Reverse engineering Questions? 2 Inadequate OS and application security: Data abuse Stolen information Bandwidth
The Invisible Threat of Modern Malware Lee Gitzes, CISSP Comm Solutions Company
The Invisible Threat of Modern Malware Lee Gitzes, CISSP Comm Solutions Company November 12, 2014 Malware s Evolution Why the change? Hacking is profitable! Breaches and Malware are Projected to Cost $491
Foreword by Katie Moussouris... Acknowledgments... xvii. Introduction...xix. Chapter 1: The Basics of Networking... 1
Brief Contents Foreword by Katie Moussouris.... xv Acknowledgments... xvii Introduction...xix Chapter 1: The Basics of Networking... 1 Chapter 2: Capturing Application Traffic... 11 Chapter 3: Network
Man in the Middle Attacks and Secured Communications
FEBRUARY 2018 Abstract This document will discuss the interplay between Man in The Middle (MiTM/ MITM) attacks and the security technologies that are deployed to prevent them. The discussion will follow
"Secure" Coding Practices Nicholas Weaver
"Secure" Coding Practices based on David Wagner s slides from Sp 2016 1 Administrivia Computer Science 161 Fall 2016 2 3 This is a Remarkably Typical C Problem Computer Science 161 Fall 2016 if ((options
Web Gateway Security Appliances for the Enterprise: Comparison of Malware Blocking Rates
Web Gateway Security Appliances for the Enterprise: Comparison of Malware Blocking Rates A test commissioned by McAfee, Inc. and performed by AV-Test GmbH Date of the report: December 7 th, 2010 (last
Stack Overflow. Faculty Workshop on Cyber Security May 23, 2012
Stack Overflow Faculty Workshop on Cyber Security May 23, 2012 Goals Learn to hack into computer systems using buffer overflow Steal sensitive data Crash computer programs Lay waste to systems throughout
C O N t E N t s I N D E ta I l FORewORd by dr. Jared demott acknowledgments xvii introduction xix PaRT 1 TOOLS OF THe TRade
Foreword by Dr. Jared DeMott xv Acknowledgments xvii Introduction Prerequisites for the Reader...xx A Brief Game Hacking History....xx Why Hack Games?... xxi How This Book Is Organized...xxii About the
Mobile Security Fall 2013
Mobile Security 14-829 Fall 2013 Patrick Tague Class #6 More WiFi Security & Privacy Issues WiFi Security Issues A Scenario Internet Open AP SSID Network X Open OpenAP AP SSID Attacker Network X LaptopLaptop
Creating User-Friendly Exploits
1 Creating User-Friendly Exploits Skylar Rampersaud skylar@immunityinc.com Security Research 2 What is a User-Friendly Exploit? An exploit that causes no distress to the user of the exploited program i.e.,
Next Generation Endpoint Security Confused?
SESSION ID: CEM-W06 Next Generation Endpoint Security Confused? Greg Day VP & Chief Security Officer, EMEA Palo Alto Networks @GreDaySecurity Brief Intro Questions we will answer Do I need a new (NG) endpoint
Figure 1-1. When we finish Part 2, our server will be ready to have workstations join the domain and start sharing files. Now here we go!
1 of 18 9/6/2008 4:05 AM Configuring Windows Server 2003 for a Small Business Network, Part 2 Written by Cortex Wednesday, 16 August 2006 Welcome to Part 2 of the "Configuring Windows Server 2003 for a
The tale of one thousand and one ADSL modems
The tale of one thousand and one ADSL modems Fabio Assolini, Malware Researcher, twitter.com/assolini Virus Bulletin 2012 Dallas, USA PAGE 2 If we can t attack a computer or a server, we ll attack a router
Opening Intranets to attacks by using Internet Explorer
Opening Intranets to attacks by using Internet Explorer Author: Cesar Cerrudo (cesar>.at..dot.
Skill 1: Multiplying Polynomials
CS103 Spring 2018 Mathematical Prerequisites Although CS103 is primarily a math class, this course does not require any higher math as a prerequisite. The most advanced level of mathematics you'll need
Formal Methods of Software Design, Eric Hehner, segment 24 page 1 out of 5
Formal Methods of Software Design, Eric Hehner, segment 24 page 1 out of 5 [talking head] This lecture we study theory design and implementation. Programmers have two roles to play here. In one role, they
PC SECURITY LABS COMPARATIVE TEST. Microsoft Office. Flash. August Remote code execution exploit. mitigations for popular applications
August 2014 PC SECURITY LABS COMPARATIVE TEST Remote code execution exploit mitigations for popular applications Microsoft Office Flash Silverlight QuickTime Internet Explorer Java Adobe Content 1. BACKGROUND...2
Anti-Virus Comparative. Factsheet Business Test (August-September 2018) Last revision: 11 th October
Anti-Virus Comparative Factsheet Business Test Language: English August-September 2018 Last revision: 11 th October 2018 https:// - 1 - Introduction This is a short fact sheet for our Business Main-Test
Tutorial Install Windows 8 Pdf Microsoft Office 2010 Won't
Tutorial Install Windows 8 Pdf Microsoft Office 2010 Won't Word 2010 for dummies / microsoft office word 2010 product key / install microsoft 2010 free / microsoft office word 2010 free download for windows
Hacking Blind BROP. Presented by: Brooke Stinnett. Article written by: Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazie`res, Dan Boneh
Hacking Blind BROP Presented by: Brooke Stinnett Article written by: Andrea Bittau, Adam Belay, Ali Mashtizadeh, David Mazie`res, Dan Boneh Overview Objectives Introduction to BROP ROP recap BROP key phases
mid=81#15143
Posted by joehillen - 06 Aug 2012 22:10 I'm having a terrible time trying to find the Lightworks source code. I was under the impression that Lightworks was open source. Usually that means that it's possible
DOWNLOAD OR READ : OS X EXPLOITS AND DEFENSE OWN IT JUST LIKE WINDOWS OR LINUX PDF EBOOK EPUB MOBI
DOWNLOAD OR READ : OS X EXPLOITS AND DEFENSE OWN IT JUST LIKE WINDOWS OR LINUX PDF EBOOK EPUB MOBI Page 1 Page 2 os x exploits and defense own it just like windows or linux os x exploits and pdf os x exploits
Video Game Security. Carter Jones
Video Game Security Carter Jones Overview Industry overview Risks Business Technical Attack & Defense Thick client Network Industry comparisons Conclusion whoami Senior security consultant @ Cigital Previously
Let's cyber: hacking, 0days and vulnerability research. PATROKLOS ARGYROUDIS CENSUS S.A.
Let's cyber: hacking, 0days and vulnerability research PATROKLOS ARGYROUDIS CENSUS S.A. argp@census-labs.com www.census-labs.com Who am I Researcher at CENSUS S.A. - Vulnerability research, reverse engineering,
Uninstall Mcafee Agent Cannot Be Removed
Uninstall Mcafee Agent Cannot Be Removed Because Other Products Are Still Using It We haven't come across this in other customers until now. Using add/remove programs doesn't work, as the uninstall process
A novel runtime technique for identifying malicious applications
HUNTING ANDROID MALWARE A novel runtime technique for identifying malicious applications WHOAMI @brompwnie THANK YOU SensePost Heroku OUTLINE The... Problem Question Idea PoC Results Conclusion THE PROBLEM
Playing God With Format String Attacks. Bsides Jax 2016 Travis Phillips 10/22/2016
Playing God With Format String Attacks Bsides Jax 2016 Travis Phillips 10/22/2016 So Why This Talk? Been experimenting with them over the last year Found them simple in theory; difficult in practice. Found
PRACTICAL NETWORK DEFENSE VERSION 1
PRACTICAL NETWORK DEFENSE VERSION 1 The world s premiere online practical network defense course elearnsecurity has been chosen by students in over 140 countries in the world and by leading organizations
Matthieu Suiche Founder, MoonSols SARL
Matthieu Suiche Founder, MoonSols SARL msuiche@moonsols.com Founder of MoonSols SARL, based in France Various security services, Forensics Products, Trainings, Kernel code consulting Co-Organizer of Hackito
EasyHook: Down & Dirty with Microsoft Windows
EasyHook: Down & Dirty with Microsoft Windows By Aaron Grothe/NEbraskaCERT 03/17/2010 LibSafe Has anybody heard of it? Very interesting little library for Linux written by Avaya Did function call interceptions
PND at a glance: The World s Premier Online Practical Network Defense course. Self-paced, online, flexible access
The World s Premier Online Practical Network Defense course PND at a glance: Self-paced, online, flexible access 1500+ interactive slides (PDF, HTML5 and Flash) 5+ hours of video material 10 virtual labs
Home/Network Computing
Home/Network Computing How to avoid becoming road kill on the Internet (Information Superhighway) Home Computing not as simple as it used to be almost all computers need to have sys-admin disk drives will
It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to
1 2 It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to keep putting garbage characters into the command
SYMANTEC ENTERPRISE SECURITY. Symantec Internet Security Threat Report September 2005 Power and Energy Industry Data Sheet
SYMANTEC ENTERPRISE SECURITY Symantec Internet Security Threat Report September 00 Power and Energy Industry Data Sheet An important note about these statistics The statistics discussed in this document
ANZTB SIGIST May 2011 Perth OWASP How minor vulnerabilities can do very bad things. OWASP Wednesday 25 th May The OWASP Foundation
ANZTB SIGIST May 2011 Perth OWASP How minor vulnerabilities can do very bad things Christian Frichot / David Taylor (Some of) Perth OWASP s Chapter Leads OWASP Wednesday 25 th May 2011 Copyright The OWASP
Exploring CVE , a Skeleton key in DNS. Jaime Cochran, Marek Vavrusa
Exploring CVE-2015-7547, a Skeleton key in DNS Jaime Cochran, Marek Vavrusa What is this about? Vulnerability in glibc DNS clients Similar to CVE-2015-0235 GHOST 2015-07-13 reported 2016-02-16 disclosed
Securing Dynamic Data Centers. Muhammad Wajahat Rajab, Pre-Sales Consultant Trend Micro, Pakistan &
Securing Dynamic Data Centers Muhammad Wajahat Rajab, Pre-Sales Consultant Trend Micro, Pakistan & Afghanistan @WajahatRajab Modern Challenges By 2020, 60% of Digital Businesses will suffer Major Service
MITOCW watch?v=4dj1oguwtem
MITOCW watch?v=4dj1oguwtem PROFESSOR: So it's time to examine uncountable sets. And that's what we're going to do in this segment. So Cantor's question was, are all sets the same size? And he gives a definitive
Beyond the F.U.D. How to start securing your DCS network today.
Beyond the F.U.D. (Fear, Uncertainty, and Doubt) Process Systems How to start securing your DCS network today. Securing Your Process Control Network You work in the Process Control industry, so I m sure
The Stack, Free Store, and Global Namespace
Pointers This tutorial is my attempt at clarifying pointers for anyone still confused about them. Pointers are notoriously hard to grasp, so I thought I'd take a shot at explaining them. The more information
Latest version of google chrome for windows
Latest version of google chrome for windows What makes a browser different from other similar ones are its features. Just have a glance at the brilliant features of this browser: Difficulty to install
Malware and Vulnerability Check Point. 1. Find Problems 2. Tell Vendors 3. Share with Community
Malware and Vulnerability Research @ Check Point 1. Find Problems 2. Tell Vendors 3. Share with Community TR-069 quick tour / DEF CON recap Motivation The TR-069 Census 2014 Research Highlights Mass Pwnage
Linked Lists. What is a Linked List?
Linked Lists Along with arrays, linked lists form the basis for pretty much every other data stucture out there. This makes learning and understand linked lists very important. They are also usually the
How To Set User Account Password In Windows 7 From Guest
How To Set User Account Password In Windows 7 From Guest To change the password of a specific user in windows 7 or 8.1, without knowing How to change or set Windows 7 default font settings to bold, italic?
MITOCW watch?v=i0psvvky-44
MITOCW watch?v=i0psvvky-44 The following content is provided under a Creative Commons license. Your support will help MIT OpenCourseWare continue to offer high quality educational resources for free. To
Chapter 9. Firewalls
Chapter 9 Firewalls The Need For Firewalls Internet connectivity is essential Effective means of protecting LANs Inserted between the premises network and the Internet to establish a controlled link however
Network Defenses 21 JANUARY KAMI VANIEA 1
Network Defenses KAMI VANIEA 21 JANUARY KAMI VANIEA 1 Similar statements are found in most content hosting website privacy policies. What is it about how the internet works that makes this statement necessary
Microsoft Remote Desktop Connection Client For Mac Os X
Microsoft Remote Desktop Connection Client For Mac Os X 10.8.5 MS RDP client disconnect on Mac 10.8.5 While Apple's move to having Mac OS X updates be entirely done through the App Store is very streamlined.
Device Vulnerabilities in the Connected Home: Uncovering Remote Code Execution and More
TrendLabs Device Vulnerabilities in the Connected Home: Uncovering Remote Code Execution and More Technical Brief TrendLabs Security Intelligence Blog Dove Chiu, Kenney Lu, and Tim Yeh Threats Analysts
Whitepaper. Endpoint Strategy: Debunking Myths about Isolation
Whitepaper Endpoint Strategy: Debunking Myths about Isolation May 2018 Endpoint Strategy: Debunking Myths about Isolation Endpoints are, and have always been, a major cyberattack vector. Attackers, aiming
LINUX VULNERABILITIES, WINDOWS EXPLOITS Escalating Privileges with WSL. Saar Amar Recon brx 2018
LINUX VULNERABILITIES, WINDOWS EXPLOITS Escalating Privileges with WSL Saar Amar Recon brx 2018 WHO AM I? Saar Amar Security Researcher @AmarSaar Pasten CTF team member saaramar OUTLINE World s quickest
ADOBE ACROBAT 9 USER GUIDE
page 1 / 5 page 2 / 5 adobe acrobat 9 user pdf Give your users access to the world s best PDF solution while maintaining the highest levels of security and compliance. With Adobe Acrobat, you get peace
Cyber Moving Targets. Yashar Dehkan Asl
Cyber Moving Targets Yashar Dehkan Asl Introduction An overview of different cyber moving target techniques, their threat models, and their technical details. Cyber moving target technique: Defend a system
COMPUTER NETWORK SECURITY
COMPUTER NETWORK SECURITY Prof. Dr. Hasan Hüseyin BALIK (9 th Week) 9. Firewalls and Intrusion Prevention Systems 9.Outline The Need for Firewalls Firewall Characterictics and Access Policy Type of Firewalls
introduction to Programming in C Department of Computer Science and Engineering Lecture No. #40 Recursion Linear Recursion
introduction to Programming in C Department of Computer Science and Engineering Lecture No. #40 Recursion Linear Recursion Today s video will talk about an important concept in computer science which is
MSRPC Heap Overflow Part II
MSRPC Heap Overflow Part II Dave Aitel So a new approach is needed. As with any heap overflow, you get to chose a where and a what value, subject to certain constraints. If you chose a what value that
ECE 471 Embedded Systems Lecture 22
ECE 471 Embedded Systems Lecture 22 Vince Weaver http://www.eece.maine.edu/~vweaver vincent.weaver@maine.edu 31 October 2018 Don t forget HW#7 Announcements 1 Computer Security and why it matters for embedded
Browser Exploits? Grab em by the Collar! Presented By: Debasish Mandal
Browser Exploits? Grab em by the Collar! Presented By: Debasish Mandal (@debasishm89) About Me Security researcher, currently working in McAfee IPS Vulnerability Research Team. Working in information security
What this talk is about?
On the Current State of Remote Active OS Fingerprinting Tools Ofir Arkin CTO ofir.arkin@insightix.com Defcon 13 1 What this talk is about? This talk examines different aspects of remote active operating
Paranoid Penguin Running Network Services under User-Mode Linux, Part III Mick Bauer Abstract Fine-tune and firewall your UML guest systems. In the last two Paranoid Penguin columns, I walked you through
Gibson: 3D Visualization and Modeling of Real Time Security Events. Dan Klinedinst
Gibson: 3D Visualization and Modeling of Real Time Security Events Dan Klinedinst gibson3d.org @dklinedinst Who Am I? Security Researcher at Carnegie Mellon University Security of enterprise systems Primarily
Security Bugs in Embedded Interpreters
Security Bugs in Embedded Interpreters Haogang Chen, Cody Cutler, Taesoo Kim, Yandong Mao, Xi Wang, Nickolai Zeldovich and M. Frans Kaashoek MIT CSAIL Embedded interpreters Host system Bytecode Input Embedded