December, 2011

Out of band Microsoft patch

You know it's bad when they do this. Every other article I have seen says it's a DOS but the bulletin here says that it's escalation of privilege. Bad. http://technet.microsoft.com/en-us/security/bulletin/ms11-100 Test and deploy.

Next certification

I am currently undecided on the next course I am going to be taking. I would really like to take the Reverse-Engineering Malware: Malware Analysis Tools and Techniques FOR610 this is an area I would like to improve on. The other choice is the Computer Forensic Investigations - Windows In-Depth...

Domains to block

I have yet to encounter these domains, but it's still a good idea to block them before they are a problem. http://isc.sans.edu/diary.html?storyid=12280

WPS brute force

I have been on vacation for a bit, I just noticed this. http://isc.sans.org/diary/Wi-Fi+Protected+Setup+WPS+PIN+Brute+Force+Vulnerability/12292 The linked white paper is well done. I have never enabled this service on the home setups I have done, but if you know someone that does time to...

Cobit passed

I passed my Cobit exam! I found it ok, it was not too difficult but they do like to play with words.

Can you crack it (Part 8)

There is a few things we are going to need to get this to work;

• The perl Data::Dumper module.
• Need to brush off some bitwise operation stuff (http://www.cs.cf.ac.uk/Dave/PERL/node36.html)
• That handy...

Can you crack it (Part 7)

Here is the contents of the JS file.  The file explains exactly what we need to do.  Lets dig out some perl and see if we can write something to run this.

//--------------------------------------------------------------------------------------------------
//
// stage 2 of 3
//
//...
			

Can you crack it (Part 6)

This would be the point where I would go get a cohort to do the debugging of the application for me, but since I don't have one and none of the tools I have been trying for the last couple days seem to be working.  We are going to link to one that is working. http://pastebin.com/bsHXs4PG Dr....

Can you crack it (Part 5)

We now have our unicode.

QkJCQjIAAACR2PFtcCA6q2eaC8SR+8dmD/zNzLQC+td3tFQ4qx8O447TDeuZw5P+0SsbEcYR.78jKLw==

#!/usr/bin/perl
use Compress::Zlib;

use MIME::Base64;

$new =...
			

Can you crack it (Part 4)

I tried running the file.exe created, it does not appear to do anything.  It's important but I don't know what to do with it just yet. The thing I find odd was the hex was given in a png, that's worth checking out. I have both sets of files on my SIFT Workstation.  I will start with my...