Site uses cookies to provide basic functionality.
Javascript rendering is set to off by default when visiting the site via .onion and .i2p domains. It can be enabled back again in user's settings section. Javascript rendering set to off means, that you can disable javascript in your browser now and the site will remain functional.
There is also IRC server now available via native IRC clients or non javascript web based one.
Fonts can be adjusted in user's settings section as well.
Check FAQ for more.

OK

Networks
Languages
1 2 3 5 8 11 17 25 37 54 79 116 171 250 366 535 536 786 899 1149 1150 1319 1435 1514 1569 1606 1631 1648 1660 1665 1666 1667 1668 1669 1674 1677 1680 1682 1683 1684 1685 ▲ ▼
I am planning to see if I can do some more work on test automation. I have discovered that I am pretty good at going into existing code bases and adding tests now. In order to practice, and to have something to demonstrate, I would like to find a deserving open source project that I could add some unit tests to. The design of the project doesn’t have to be good.
My newest computer is a Dell XPS thing. It’s a huge monster of a laptop (really a gaming laptop, good for the performance). It comes with external LED lights on the top, sides and bottom. These lights are normally only configurable though a custom program. Since I got the PC, I have been dying to find a way to control these LEDs from a script. Finally, today, I found out how.
Writing my previous post got be thinking about code comments. I have seen a lot of bad comments in my years, and I’d like it to stop! Here are a few examples from the horror cabinet of the world of code comments. Stating the bloody obvious Never, ever, say in comments what the code already says. Ever: class Bar { /** gets the foo of the bar */ public String getFoo() {.
Recently, there has been a discussion about code comments on the pragmatic programmer mailing list: “Should you comment or not? What should be commented?” The one point I haven’t seen expressed succinctly is the following: Given a finite amount of time and a codebase with some … issues (which codebase doesn’t have issues?) what is the most useful thing you could do with your time? How often is the answer “comment more”?
In the book Software for Your Head, Jim McCarthy introduces The Core Protocols (pdf). Even though the book occasionally give off a new-agey feeling with ritualistic interaction, I think the Protocols have a lot of merit. I especially like “the decider protocol” As I see it, the Decider protocol is a basic tool for consensus-based decisions. I think consensus as a tools in misunderstood and underutilized. It is easy to assume that basing dec..
David Heinemeier Hansen’¨s talk at OSCon is available at IT Conversations. For those who don’t know, DHH is the man behind the big rising star of 2005: Ruby on Rails. Favorite quote: “Too many technologies are chasing flexibility as thus it was free. It is not. Your exchanging flexibility for velocity in development, for a delay in changing you mind, and it is really a bad notion! … In other terms, constaints are liberating”
OK - so Apple released the new Intel Macs this month and shocked everyone with their amazing speed improvements. But what I noticed is that Apple didn’t create a whole new look for them - essentially, the new line is in the same beautiful package as the iMac G5 and PowerBook. These designs must be very good if Apple is going to stick with them, and as a result, are key turning points in Mac evolution. Does evolutionary theory apply to co..
OK - so Apple released the new Intel Macs this month and shocked everyone with their amazing speed improvements. But what I noticed is that Apple didn’t create a whole new look for them - essentially, the new line is in the same beautiful package as the iMac G5 and PowerBook. These designs must be very good if Apple is going to stick with them, and as a result, are key turning points in Mac evolution. Does evolutionary theory apply to co..
One of the most profound ideas in lambda calculus, is the Y-operator. I’ve learned the Y-operator at least three times, and every time, I found it extremely hard to understand. This blog is therefore an example of a quixotic undertaking: I want to see whether it is possible for me to explain the Y-operator so that you, gentle reader, can understand it with minimal background. In this case, “minimal background” means at least a few years of ..
I have been working as a Software Architect for several years now, but I still find myself unable to answer the question “what is software architecture?” However, I think I can point to some of the factors that can make the architectural work successful. First: Architecture is about vision, communication and governance. The vision bit is relatively simple: Any company has huge inefficiencies in how it operates. I think the very nature of bu..
Widgets (or Gadgets) are small applications, which usually provide some kind of visual information or access to a frequently used function. Because widgets are in fact applications, they too can include malicious code. Furthermore, due to the simplicity of legitimate widgets, such as calculators and clocks, they are developed without security in mind. In this presentation, we will explain the three different types of widgets in detail....
Ofir Arkin: kNAC! - www.defcon.org - 20 years ago - eng
Network admission control (NAC), network access protection (NAP), network access control (NAC), and many other acronyms refer to a technology which aim to provide with access control verification before (and after) allowing an element to access the network. Unfortunately due to the lack of standardization, and the diversity of solutions, many (if not must) NAC solutions suffer form a multitude of weaknesses impacting the deployment, i....
Get the latest information about how the law is racing to catch up with technological change from staffers at the Electronic Frontier Foundation, the nation's premiere digital civil liberties group fighting for freedom and privacy in the computer age. This session will include updates on current EFF issues such as NSA wiretapping (with newly released technical information), using the Freedom of Information Act to dumpster dive with the law,....
Sometimes even the top dudes need a refresher course. Remedial Heap Overflows is not so much a lesson to the lame, but a refresher for the leet. One day the speaker was approached (in a subway, of course) by a top-notch dude (who has his own posse) and asked how they work. Clearly not even the best of the best always know everything. atlas, a disciple of the illustrious Skodo, has a history in programming, systems support, telec..
RDS-TMC is a standard based on RDS (Radio Data System) for communicating over FM radio Traffic Information for Satellite Navigation Systems. All modern in-car Satellite Navigation systems sold in Europe use RDS-TMC to receive broadcasts containing up to date information about traffic conditions such as queues and accidents and provide detours in case they affect the plotted course. The system is increasingly being used around Europe a....
If you're responsible for the burglar alarm at your facility, do you understand how it's being monitored by the "Data Monitoring Group" flunkees? Are all those alarm conditions real? The Completion Backward Principle covers issues arising from Internet-enabled monitoring of burglar alarm systems, and possible mitigations. Spot The Fed will most assuredly be played at this talk. For the past seventeen years, geoffrey has been a Fac..
The recent case of Julie Amero has cast a bright spotlight on the difference in understanding between the worlds of technology and the law. We will examine adoption of technology within the legal profession, trial court decisions, as well as legislative and appellate decisions which may be inconsistent with generally accepted security measures. John Benson is the co-chair of the Kansas City Metropolitan Bar Association Computer Law and..
The presentation details the process whereby journalists select, discard, research and ultimately publish security related articles. It outlines the credibility necessary for security researchers to be taken seriously in the presentation of their findings and examines the "blowback" that criminal and kiddie hackers have on the security industry from a journalists perspective. This talk also looks at the current practices of legitimate ....
Intrusion Analysis has been primarily reserved for network junkies and bit biters. However, due to the advances in network systems automation we now have time to pay more attention to subtle observations left by attackers at the scene of the incident. Century old sciences have enabled criminal investigators the ability attribute attacks to specific individuals or groups. Sean M. Bodmer is an active developer and deployer of intrusion ..
Last semester I taught a new course in "Ethical Hacking and Network Defense" at City College San Francisco. I had legal, ethical, and practical concerns about this class, so I took several precautions to prevent the students from one another, and others from them. The course was a success--it was full and popular, and there were no security problems (at least none that I found out about). We have built hacking into our Computer Netwo..
I will show how entropy, a measure of information content defined by Shannon in 1948, can provide useful ways of organizing and analyzing log data. In particular, we use entropy and mutual information heuristics to group syslog records and packet captures in such a way as to bring out anomalies and summarize the overall structure in each particular data set. I will show a modification of Ethereal that is based on these heuristics,....
Being in the know" is key to supporting or violating a security infrastructure. Whether you're taking over the Taco Bell drive through or listening in during a presidential visit, being armed with the right information could drastically affect your outcome and ultimately lead to your success. This talk will focus on modern radio systems and the challenges of listening to them. We will provide information on several utilities and resources t....
Cross Site Scripting has received much attention over the last several years, although some of its more ominous implications have not received much attention. Anti-DNS pinning is a relatively new threat that, while not well understood by most security professionals, is far from theoretical. This presentation will focus on a live demonstration of anti-DNS pinning techniques. A victim web browser will be used to execute arbitrary, interactive....
Have you tried to firewall a machine from itself? Have you ever tried to protect a machine with a multi-personality disorder? These questions are brought to us by the wonderful technology of virtualization. Though the technology is clearly sexy, security has clearly been an afterthought. While every product claims isolation, it seems that's only when you don't have an attacker involved. Despite what the press releases say, it's not ..
Social engineering has traditionally been more of an art than a science, we try different things, and if they work, we continue to use them over and over again. Some of the best social engineers have developed excellent technique even without understanding why what they're doing works. Mike & Anton are skilled communicators trained in NLP, hypnosis, FACS and other sciences of influence, and will present (and demonstrate) some of the cutting....
This presentation reviews the important prosecutions, precedents and legal opinions of the last year that affect internet and computer security. We will discuss the differences between legal decisions from criminal cases and civil lawsuits and what that means to the security professional. Additionally, we look at topics such as: email retention and discovery; active response; use of CFAA as non-competition methods; identity theft and notifi....
Satellite imagery was once restricted to organizations like CTU, but now it is freely available to us all via powerful free online tools and commercial services. In this talk we will look at commercial collection platforms and capabilities, orbital mechanics and a variety of imagery analysis techniques. We will analyze examples from interesting places around the world and explore issues surrounding the future of satellite surveillance. ..
The core of the security problem is that most software contains latent bugs, and many of these bug can be exploited by attackers to cause the software to do something undesirable to the victim's computer. To block this threat, one can either use only perfect software (of which there is a shortage :) or use a security system to control what software may and may not do. The problem is that such systems are historically very difficult to use....
Careers in information security are often difficult to navigate, with the industry changing more and more radically every year. We're going to talk about the important skills, traits and knowledge that a security pro needs, not just the usual stuff (like "go get a CISSP"), we're going to come from the perspective of two people who spend much of their time talking to hiring managers and companies looking for security stars, as well as talkin....
Ever wanted to hijack a connection between machines on a LAN, deny service between a host you're attacking and a log server or intrusion detection system, or maybe wanted to sniff traffic on a switched network? Now you can! Er, wait... You already could with the ARP attacks we all know and love. While these network attacks are quite effective, they do have their weaknesses, as well as security controls to help prevent them. In this ....
Hacking Social Lives: MySpace.com. This presentation will discuss how to hack MySpace.com using web application hacking methods implementing minimal tools outside of the internet, a text editor, and a cookie editor. How to find exploits will be discussed, as well as what to do with the exploits. Multiple exploits will be revealed and broken down. MySpace XSS filter evasion will be discussed. Session hijacking using cookies provided f....
Security researchers around the world have been SLAPPed (strategic lawsuits against public participation) across the face by vulnerable software vendors. Bogus legal threats intended to intimidate and prevent public exposure of vulnerabilities are becoming increasingly common. If the software industry succeeds at silencing these researchers the public, governments, global industries, and end user customers are ill served and increasingly....
What would you do if you had a massive collection of malware? What secrets could you uncover? This rapid fire presentation seeks to reveal some of these secrets based on the analysis of Offensive Computing's large malware collection. (Over 100,000 samples) What are malware author's commonly using to pack their binaries? What are the rarest packers, and could this indicated a targeted attack? How do Anti-Virus companies generally perform on ....
Runtime code coverage analysis is feasible and useful when application source code is not available. An evolutionary test tool receiving such statistics can use that information as fitness for pools of sessions to actively learn the interface protocol. We call this activity grey-box fuzzing. We intend to show that, when applicable, grey-box fuzzing is more effective at finding bugs than RFC compliant or capture-replay mutation black-box ....
Firstly, I will be covering the basics of SCADA networks and give a general overview of the SCADA protocols namely Modbus, DNP3, ICCP and IEC standards. North America mainly uses Modbus, DNP3 and to an extent ICCP, the European countries use the IEC standards. After the basics I will be getting into the finer details of the protocols as to what function code, internal indication flags does what and how that can be used to attack or take dow....
Tor project, an anonymous communication system for the Internet that has been funded by both the US Navy and the Electronic Frontier Foundation. Roger Dingledine is a security and privacy researcher. While at MIT he developed Free Haven, one of the early peer-to-peer systems that emphasized resource management while retaining anonymity for its users. He is best known for leading the Tor project, an anonymous communication system ..
Today there is a lot of hype around some new proof-of-concept technology or around politically motivated trojans, etc. This talk will deliver a reality check, give an idea what kind of malware the McAfee Research organisation is actually seeing to be used in the real world and show how the different trojans work, what the impact is. The material used are internal statistics of the various threats sent to or discovered by us, some more detai....
Ever wonder just what rules law enforcement must follow? When do the police have to read you the Miranda Warnings? Who is subject to a Stop and Frisk? When does Double Jeopardy apply. What does a cop actually have to know before they can legally stop you? What is the effect of an Invalid arrest? Just when can the SWAT team kick your door without knocking first? When must an officer have a search warrant? During the "Ask the Crimi..
I will talk about the evolution and differences of the hacking communities around the world. Why and how this affects the hackers being taken to the corporate life, motivations, or just why is it better to stay totally underground. How companies attract and manage hackers, and how the scare them away. Computers are cool now, like the tshirt says, and small kids already know what ip addresses are, how to use netstat, etc. Is security gonna b....
Kernel vulnerabilities are often deemed unexploitable or at least unlikely to be exploited reliably. Although it's true that kernel-mode exploitation often presents some new challenges for exploit developers, it still all boils down to "creative debugging" and knowledge about the target in question. This talk intends to demystify kernel-mode exploitation by demonstrating the analysis and reliable exploitation of three different kernel....
There is a pervasive dream about a free Internet which is robust, fully decentralized yet efficient, and which ensures privacy for all users. For seven years, the Freenet project has been the most visible embodiment of this vision. This talk will show that the recent 0.7 release of Freenet -- marketed to solve most of the problems -- entirely fails to deliver. Freenet 0.7 promises efficient routing in restricted-ro....
Estonia is one of the most advanced countries in the world, and just now survived what has been referred to as "the first 'real' cyber conflict". What really happened there, and what does it mean to us? Gadi Evron works for the McLean, VA based vulnerability assessment solution vendor Beyond Security as Security Evangelist and is the chief editor of the security portal SecuriTeam. He is a known leader in the world of Internet security..
The thousands of servers in collation centers and hosting farms are irresistible targets for bot-herders in the market for an ideal attack platform. Learn how ISPs are . with varying success . detecting and responding to bot-herders. frequent attempts to take control. Gadi Evron works for the McLean, VA based vulnerability assessment solution vendor Beyond Security as Security Evangelist and is the chief editor of the security portal ..
Matt Fiddler leads a Threat Management Team for a Fortune 100 Organization. Mr. Fiddler's research into lock bypass techniques have resulted in many public and private disclosures of critical lock design flaws. Mr. Fiddler began his career as an Intelligence Analyst with the United States Marine Corps. Since joining the commercial sector in 1992, he has spent the last 15 years enhancing his extensive expertise in the area of Unix and Networ....
1 2 3 5 8 11 17 25 37 54 79 116 171 250 366 535 536 786 899 1149 1150 1319 1435 1514 1569 1606 1631 1648 1660 1665 1666 1667 1668 1669 1674 1677 1680 1682 1683 1684 1685 ▲ ▼
4 visitors online