IT security science

How to get beyond mindless blindness - every-day social engineering

Is everybody being deceptive?

When we're not there, we aren't there to know that we're not there.

I recently listened to the 7th episode of the Social Engineering podcast. - That made me take some notes, and I think I remember some quotes.
In short it was simply about using familiar routines - or those routines which should be familiar - in order to successfully blind somebody else's mind into a routine workflow.

Socially pwned

It's the famous data-kraken! He'll get us all.

When I was playing around with Facebook lately to setup an excuse account with my valid eMail address, in case some retard wants to impersonate me, I found out that social networks not only collect member data. Newer (iPhone/i* - stuff) applications for example make users synchronize their phone contacts into these web-services.

Building a cheap home-hacking lab

wishi's Fuzz-Box

A Fuzz-Box for me is a standalone machine. It has to:

host multiple virtual machines at once (max 2 in my case)
effectively manage ~4 GB RAM
be Linux compatible with, stable clean device drivers
energy efficient and ergonomically able to run 24h/day 7d/week...

Scaling Hardware?

You don't want a performance monster. - Or a gaming machine. And you do not want trash, because you're going to spend valuable time with it.

Creating attack-strings, circumventing NX,and just for fun: Ruby

Reach the registers

View at: Practical Cryptography

"Hey, it's easy"

Practical Cryptography by Niels Ferguson and Bruce Schneier is not necessarily scientific. In fact that's where it's making a difference: it's not just theory and addresses modern problems with cryptographic implementations pragmatically. It's for people who audit these kinds of source code; for example.

Using Threat Modeling to analyse entry points

How to think security

by Ivan Ristic, just a part of it

People in application development generally have different perspectives. Developers often focus on getting stuff up and running in an efficient feature-rich way, testers focus on confidentiality, integrity or stability/availability issues... Marketing focuses on getting Outlook to display yesterday's i-Mails with smilies. :) Well, lets forget these people here.

Creating much more interesting fuzzers with MSF

All these protocols are belong to Metasploit

If you want to create a network-fuzzer you have to transport your inputs through a specific protocol. Performance in most cases isn't an issue. While I'd prefer to use ICC or at least efficient C for file-fuzzing or other CPU intensive programs, network fuzzing doesn't have this requirement. The Metasploit framework implemented a nice suite of libraries adaptable for network-fuzzing which helps to create a new fuzzer within minutes. Furthermore within ruby 1.9 there're performance enhancements that soon will be supported officially ;). So let's fuzz faster.

There're certain interesting fragments:

#
# This is just an untested example for a fuzzer auxiliary
# based on the offensive security MSF material

crazylazy.info