Threat Level: green Handler on Duty: Pedro Bueno

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

PDF analysis paper

Published: 2010-09-26
Last Updated: 2010-09-26 18:38:00 UTC
by Daniel Wesemann (Version: 1)
0 comment(s)

Didier Stevens (of pdf-parser.py fame) has published a 23-page paper on how to analyze nasty PDFs. While the content is a bit dated and the attackers have added more insidious exploit obfuscation to their arsenal since, the document explains all the concepts that are still valid and useful whenever you encounter a suspicious PDF today.  If you're into PDF analysis (and even if you aren't :), this is a must-read.  http://blog.didierstevens.com/2010/09/26/free-malicious-pdf-analysis-e-book/

 

 

0 comment(s)

The wireless wiretap

Published: 2010-09-26
Last Updated: 2010-09-26 16:50:40 UTC
by Daniel Wesemann (Version: 1)
4 comment(s)

Corporations and institutions are spending a lot of money to keep their data and voice networks protected against unauthorized access. Surprisingly enough, a lot of them seem to care a whole let less about which wireless head-sets their staff uses. A wireless head-set is, by definition, wireless, which means that anyone else in range of the signal can potentially listen in. The same rules as with WiFi apply: If the signal is not encrypted, or the encryption can be trivially broken, you are basically playing broadcast radio station for your neighborhood. All that's needed for the attacker is a 100$ "Scanner" available at every *mart and *shack.

This is by no means a new problem, but one that is still quite prevalent. And I'm not talking about the baby monitors that broadcast your neighbor's kid's annoyance over its first tooth, even though these can be a serious privacy concern, too. I'm talking about hospital, university, corporate wireless head-sets, bought in the cheap, without any regard to what sort of signal and transmission security these products actually use. If this sounds like your firm or institution, it might be a good idea to spend an hour on Monday to google for the products in use and and to find out for sure if your phone equipment acts as a broadcast radio station.

Keywords: wireless
4 comment(s)

Egosurfing, the corporate way

Published: 2010-09-26
Last Updated: 2010-09-26 15:05:47 UTC
by Daniel Wesemann (Version: 1)
0 comment(s)

Both Egosurfing and Googledorks are nothing new, of course. Large corporations nowadays retain marketing firms to do search engine analysis for them, but these marketing firms focus on, well, marketing and branding issues only. They are unlikely to ever tell you that your web site shares that Excel with the customer names or that student application form with the SSNs.

To make sure, go ego-surfing for your company or organization every now and then. Search for the domain name ("site:mydomain.com") and then narrow down the results by using Google's advanced search operators, like "filetype:xls". GoogleGuide has a good list and description of the search operators that Google supports.

You can also use the basic exclusion technique ("-hay -grass -weeds") to whittle down the haystack until only the needles are left. This approach works particularly well if you don't quite know what you are looking for.

One caveat: Keep at this for long enough, and Google's dork-defense will kick in, and refuse to answer your search queries because they think you are a bad guy out looking for ways to attack your organization. So, just in case, do not perform these searches over an internet access that you share with others, as its IP address might become temporarily blocked by Google.

0 comment(s)
Diary Archives