Presentations

From ClubHack2008

**Presentations @ ClubHack2008**
Speaker	Topic	Presentation
Aditya K Sood	Hacking Client Side Insecurities	Aditya_ClubHack08.pps
Ajit Hatti	Immune IT: Moving from Security to Immunity	Ajit_ClubHack08.pps
Aseem Jakhar	AntiSpam - Understanding the good, the bad and the ugly	Aseem_ClubHack.pps
Atul Alex	Reverse Engineering v/s Secure Coding	Atul_ClubHack08.pps
Chris Goggans	Network Vulnerability Assessments: Lessons Learned	Chris_ClubHack08.pps
Harshad Patil	Economic offenses through Credit Card Frauds Dissected	Harshad_ClubHack08.pps
Jonathan Brossard	Reverse Engineering for exploit writers	Jonathan_ClubHack08.pps
Karmendra Kohli	Insecure Implementation of Security Best Practices: of hashing, CAPTCHA's and Caching	Karmendra_ClubHack.pdf
Kunal Sehgal	Workshop on BackTrack live CD	Kunal_ClubHack08.pps
Nibin Varghese	Reverse Engineering for exploit writers	Nibin_ClubHack08.pps
Rohas Nagpal	State of Cyber Law in India	Rohas_ClubHack08.pps
Sheetal Joseph	Workshop on Wireless Security	Sheetal_ClubHack08.pps

ANNOUNCING THE NEW "OWASP TESTING GUIDE v3

OWASP is announcing the new OWASP Testing Guide v3. The project as part of the OWASP Summer of Code, started on April 2008 reviewing the
version 2, improving it.

The OWASP Testing Guide v3 is a 349 page book; we have split the set of active tests in 9 sub-categories for a total of 66 controls to test
during the Web Application Testing activity.

Each control has an OWASP name, so for example a SQL Injection is called: OWASP-DV-005, meaning that it is the 5th control of the Data
Validation category.

We got a dream team of 21 authors and 4 reviewers: after 6 months of hard work and great team work we realized the v3.

We'd like to ask you to support OWASP to reach the following goals:

*** Continuously improve the guide.
The Guide is a "live" document: we always need your feedback!
Please join our testing mailing list and share your ideas:
http://lists.owasp.org/mailman/listinfo/owasp-testing

*** Promote the Testing Guide.
We would like to have some more media coverage on the guide, so please, if you know somebody in there put them in touch.
If you have the chance, you can write an article about the Testing Guide and the new OWASP Projects.
Also you can pick up the OWASP Testing Guide presentations and talk about it in local conferences and Chapter meetings.
http://www.owasp.org/images/2/2c/OWASP_EU_Summit_2008_OWASP_Testing_Guide_v3.ppt

*** Add 'quotes' to the Guide.
We made a special 'quotes' pages for the Testing Guide.
Here we'd want to add all the comments and references to the Guide.
http://www.owasp.org/index.php/OWASP_Testing_Guide_Quotes

The OWASP Testing Guide includes a "best practice" penetration testing framework which users can implement in their own organizations and a
"low level" penetration testing guide that describes techniques for testing most common web application and web service security issues.

Download the Guide Now:
- http://www.owasp.org/index.php/OWASP_Testing_Project
- http://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf

View the Presentation at the OWASP Summit 08:
- http://www.owasp.org/images/2/2c/OWASP_EU_Summit_2008_OWASP_Testing_Guide_v3.ppt

Join the Project Mailing List:
- http://lists.owasp.org/mailman/listinfo/owasp-testing

Thanks,
Matteo Meucci

--
Matteo Meucci
OWASP-Italy Chair, CISSP, CISA
http://www.owasp.org/index.php/Italy
OWASP Testing Guide lead
http://www.owasp.org/index.php/Testing_Guide
Pick the Right Tool for the Job: Penetration Tests, Vulnerability Assessment and

I had a meeting with a potential Impacta client the other day and they were inquiring about getting a ‘penetration test’ performed against their network. Upon talking more and more with them, turns out that they needed something much different than a penetration test and I told them this openly.
Sure, I could have sold them a penetration test, but I think this particular industry could do with a little more integrity than what’s currently available. I gave them a copy of my book and explained to them the different types of security assessments. No signed contract came out of the meeting, but at least I was able to help steer them in the right direction.
I think a lot of people can benefit from some of the same information I shared with this potential client, so if you have a copy of my book Assessing Network Security (Microsoft Press, ISBN: 9780735620339) then you’ll want to read up on chapters 1, 3, 4 and 5. If you don’t have a copy of Assessing Network Security (shame on you ;P) then this blog was written especially for you.
Vulnerability Scanning
This is the most basic form of security assessment and usually carried out by some software package. These software packages assess networks and applications for known configuration weaknesses and vulnerabilities. They are useful for enumerating current assets, identifying common security mistakes, searching for computers with known vulnerabilities and testing for exposure to common attacks.
- Benefits: Can be automated, finds known vulnerabilities
- Limitations: Subject to frequent false positives, results depend entirely on the quality of the software, can report only commonly known vulnerabilities
Penetration Testing
Penetration testing differs from vulnerability scanning in that it looks at the security of a network or application as a whole, whereas with vulnerability scanning it is done on a per system basis. Penetration tests also typically begin without administrative rights (that’s the ultimate goal of a penetration test – to get administrative privileges!) whereas most vulnerability scanners require administrative privileges. Penetration tests answer the question of how detected vulnerabilities can be exploited and weaknesses in people and processes.
- Benefits: Exposes weaknesses not possible with vulnerability scanning like social engineering weaknesses, exposes method with which vulnerabilities can be exploited
- Limitations: Requires highly skilled security professionals, results depend on the skill of the penetration tester, may disrupt network services if done recklessly
IT Security Audits
IT security audits are much different from vulnerability scanning and penetration testing. IT security audits focus on people and processes that support, manage and implement security on a network or applications. An IT security audit will help you understand if you have the necessary infrastructure to main a secure computing environment.
- Benefits:Can be used to provide evidence for industry regulations (SOX, HIPAA, etc.), provide a snapshot of the appropriateness of current security policies and procedures
- Limitations: Can be very time consuming
The book has a lot more detail than shown here, but I hope you still found this useful, enjoy! If you have questions, please feel free to email info@impactalabs.com or submit a comment.
–Kevin
See the book on this subject and many others related to testing at: ASSESSING NETWORK SECURITY
See original article and others that are similar at:
http://blog.impactalabs.com/2008/12/15/penetration-test-vulnerability-scanning-it-security-audit/
OWASP Hartford: February 2009 (Open Web Application Security Project)

The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software.
Our mission is to make application security "visible," so that people and organizations can make informed decisions about application security risks.
Everyone is free to participate in OWASP and all of our materials are available under a free and open software license.

This event will be of special interest to software developers and architects within your organization. We will be featuring Ramesh Nagappan of Sun, who is the author of several best selling books on SOA and most recently, the book: Core Security Patterns.
We will also have Mary Ruddy of Project Higgins who will provide guidance on incorporating identity into enterprise applications.

The agenda for this meeting is posted at:
http://www.owasp.org/index.php/Hartford

To receive future invites, please subscribe to our mailing list at:
https://lists.owasp.org/mailman/listinfo/owasp-hartford
Fyodor Nmap Network Scanning Book Released!

NOTE FROM CLEMENT:
Nmap is really the mother of all port scanners. It can help you on the defensive side to identify ports that are currently open, new IP's that have just shown up in your production environment, ports that are either added, deleted, or modified on your hosts. Find what is happening to your servers as soon as changes manifest themselves. This is really a great tool for regular scanning and discovery of port and services that should or should not be on your servers. This book is written by Fyodor the author of Nmap, there is nobody else that knows Nmap better then Fyodor. I highly recommend it to all. See announcement below from Fyodor:
Nmap Hackers:

After promising you a book on Nmap for years, I'm delighted to finally announce the release of Nmap Network Scanning! It contains everything I've learned about network scanning from more than a decade of Nmap development, plus some bad jokes and (over Time Warner's written objections) pictures of Trinity hacking the Matrix :) . Here is the abstract:

Nmap Network Scanning is the official guide to the Nmap Security Scanner, a free and open source utility used by millions of people for network discovery, administration, and security auditing. From explaining port scanning basics for novices to detailing low-level packet crafting methods used by advanced hackers, this book by Nmap's original author suits all levels of security and networking professionals. The reference guide documents every Nmap feature and option, while the remainder demonstrates how to apply them to quickly solve real-world tasks. Examples and diagrams show actual communication on the wire. Topics include subverting firewalls and intrusion detection systems, optimizing Nmap performance, and automating common networking tasks with the Nmap Scripting Engine.

The planned release date was January 1, but Amazon beat the deadline and is now shipping in time for Christmas! Imagine your loved one's surprise when she (or he) finds nearly 500 pages of port scanning
bliss in her stocking!

You can find reviews, sample chapters, and a detailed summary at:

http://nmap.org/book/

Or you can pick the book up at Amazon for $33.71:
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
It is available on the International Amazon sites too, as well as other online retailers. Your local book store probably doesn't have it yet, but can likely order it for you.

About half of the content is available free online at http://nmap.org/book/toc.html . Chapters exclusive to the print edition include "Detecting and Subverting Firewalls and Intrusion Detection Systems", "Optimizing Nmap Performance", "Port Scanning Techniques and Algorithms", "Host Discovery (Ping Scanning)", and more.

If you enjoy the book, please help spread the word! While my previous books were published by Addison-Wesley and Syngress, this one was self-published. While that allowed me to post half the book online before it was even released, it also means I lose the marketing budget and clout of a major publisher. So if you like the book, please post a review to your blog/site/Amazon or tell your friends about it!

Apparently there was some pent-up demand for the book, as it is currently the 11th best-selling computer book on Amazon. Maybe it will be even higher by the time you read this:

http://www.amazon.com/gp/bestsellers/books/5/ref=pd_zg_hrsr_b_1_2&tag=secbks-20

I'd like to thank the many people who helped make this book possible by reviewing drafts, contributing stories, brainstorming ideas, etc. In particular, I'd like to thank David Fifield, Raven Alder, Matt Baxter, Saurabh Bhasin, Mark Brewis, Ellen Colombo, Patrick Donnelly, Brandon Enright, Brian Hatch, Loren Heal, Lee "MadHat" Heath, Dan Henage, Tor Houghton, Doug Hoyte, Marius Huse Jacobsen, Kris
Katterjohn, Eric Krosnes, Vlad Alexa Mancini, Michael Naef, Bill Pollock, David Pybus, Tyler Reguly, Chuck Sterling, Anders Thulin, Bennett Todd, Diman Todorov, and Catherine Tornabene!

And most importantly, I want to wish you all happy holidays!

Cheers,

Fyodor
Get your copy now:
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
NASSCOM's Biggest Information Security Summit - Supported by OWASP India

Dear Members,

I just wanted to bring it to your kind notice that a biggest information security summit is being organized by NASSCOM in Hyderabad, India on December 2nd-3rd 2008.
Summit features some of the top-notch information security experts who would be addressing some really painful areas in the security domain. Bruce Schneier will address the keynote session to give insight on how to bring real sense in security management practices under the theme “Information Security: Ten Trends”.

Detailed information about the summit is available here:
www.nasscom.in/infosec2008
NOTE: Registrations are closing very soon. To register for this summit, kindly contact mukesh@nasscom.in.
You can submit your registration fee (in the form of cheque/DD in favour of NASSCOM) at the venue as well (Not Paid Registration Counter).

OWASP INDIA is proud to support this initiative and we look forward to see you at the event.

Many Thanks,
Dhruv Soi

Chair – OWASP India Conferences
Board Member – OWASP Global Conferences
Director – OWASP Delhi Chapter
Exomind framework and console from CoreSecurity

Exomind is an experimental Python console and programmatic framework for building decorated graphs and developing open-source intelligence modules and ideas, centered on social network services, search engines and instant messaging.

BA-Con 2008 slides:
http://corelabs.coresecurity.com/index.php?module=FrontEndMod&action=view&type=publication&name=LeakedOut%3A_the_Social_Networks_You_Get_Caught_In

Project:
http://corelabs.coresecurity.com/index.php?module=FrontEndMod&action=view&type=project&name=Exomind
Additional Information:

The information has been provided by Jose Orlicki
To keep updated with the tool visit the project's homepage at:
http://corelabs.coresecurity.com/index.php?module=FrontEndMod&action=view&type=tool&name=Exomind

EC-Council Members Webinar - November 2008

PRE-RECORDED WEBINAR FOR MEMBERS - NOV 2008
Duration: 60 minutes
Sponsored by Core Security Technologies

For enquiries, kindly email the Editor, EC-Council
editor@eccouncil.org

Zen & the Art of An Internal Penetration Testing Program
(Part I)
Presenter: Mr. Paul Asadoorian

This presentation provides you with fundamental knowledge required to create an internal penetration testing program for your organization. It is the answer to questions like "Why do I need to perform internal penetration testing?" and "What kind of systems and applications should I test?" The presentation covers best practices for your systems and network administration, goals of testing, and defining rules and scopes of engagement. Tips and tricks will be offered, including using Nmap for host identification and enumeration, scripting Nmap using Nmap Scripting Engine (advanced testing), and using Ndiff to compare Nmap scan results.

Download the webinar now and listen to what our guest speaker, Paul Asadoorian, Founder and CEO of PaulDotCom, has got to share on this.

CLICK HERE TO REGISTER!

Presenter

Mr Paul Asadoorian
Founder & CEO, PaulDotCom

This Webinar is sponsored by Core Security Technologies .
Core Security Technologies is the leader in comprehensive security testing software solutions that IT executives rely on to expose vulnerabilities, measure operational risk, and assure security effectiveness. The company's CORE IMPACT product family offers a comprehensive approach to assessing the security of network systems, endpoint systems, email users and web applications against complex threats. All CORE IMPACT security testing solutions are backed by trusted vulnerability research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups.

Get yourself updated with the latest!
Hackers are here. Where are you?

# # #

Are keystroke recorders legal? District Court Halts Sales of Keylogger Software

Posted on Tuesday, November 25, 2008 at 12:33 am by Andrew Ungberg FTC v. CyberSpy Software
District Court Halts Sales of Keylogger Software
By Jim Milkey - Edited by Nicola Carah
FTC v. CyberSpy Software, LLC, November 6, 2008, 6:08-cv-1872
Court Documents
Following a hearing on Novemer 17, Judge Gregory Presnell of the United States District Court for the Middle District of Florida upheld his November 6th decision to grant the Federal Trade Commission’s request for a temporary restraining order prohibiting the sale of CyberSpy Software’s RemoteSpy keylogger software.
The order prohibits CyberSpy from marketing, selling, and providing support for its RemoteSpy software. RemoteSpy is designed to remotely monitor a host computer and record information such as keystrokes, visited websites, and opened documents. According to the FTC’s press release, CyberSpy allegedly violated Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), which prohibits unfair or deceptive trade practices. Specifically, the FTC alleges that CyberSpy violated the Act by marketing and selling “software that could be: (1) deployed remotely by someone other than the owner or authorized user of a computer; (2) installed without the knowledge and consent of the owner or authorized user; and (3) used to surreptitiously collect and disclose personal information.” The complaint also alleges that CyberSpy unfairly disclosed the collected information to its clients. Both CyberSpy and its CEO, Tracer Spence, are listed as defendants in the complaint.
Both the complaint filed by the FCC and the TRO are available at the FTC website.
Ryan Singel of Wired notes that this case marks the first time that the FTC has targeted the amateur spyware market. He speculates that the case will likely turn on evidence that CyberSpy marketed its product to be used in situations where the victim was unaware of potential monitoring. Joel Hruska of Ars technica notes that “numerous tutorials and ‘how-to’s’ were included with RemoteSpy, including information on disguising the payload in order to maximize the chance of infection.” The same article goes on to suggest that the FTC should have been more responsive in filing the complaint, since RemoteSpy has been available to consumers since August 2005.
Graham Cluley points out that keylogger software such as RemoteSpy can be used for a wide variety of purposes, from protective child monitoring to identity theft, and that the final outcome of the CyberSpy case could have serious implications for sellers of “legitimate” spyware.
In granting the TRO, the court issued findings that CyberSpy provided its customers “with instructions and examples for how to disguise the software as an innocuous file in order to send the software to another computer and trick the owner or authorized user of the computer into installing the software,” and that “[o]nce installed on a computer, the owner or authorized user of the computer [could not] readily locate or uninstall RemoteSpy on his own.” Further, it found that the operation of RemoteSpy would likely cause substantial harm, including “financial harm (including identity theft) and endangering the health and safety of consumers.” Finally, it determined that there was substantial likelihood that the FTC would succeed in proving that CyberSpy had violated the FTC Act.
In addition to prohibiting CyberSpy from selling or distributing any keylogger, the TRO also enjoined any person from collecting information from already deployed keyloggers, or from misrepresenting keyloggers as innocuous files. Further, the court enjoined the Defendants from sharing the information collected through its products to others outside of law enforcement. Finally, the Defendants were ordered to shut down their web site.
FreeRainbowTables.com news

FreeRainbowTables.com has recently moved to the BOINC platform for generation of rainbow tables.

We are happy to share the news with our users, and we hope you will continue to help us generate more rainbow tables.

It is easy to htlp us in the generation of high quality rainbow tables. Simply visit our download page ( http://www.freerainbowtables.com/en/download/ ) and follow the instructions.

Thanks

/JA

[Voltar]