We talk about docker, what it is, why it matters, and how it can benefit us. This presentation is an introduction and delivered to local meetup in Indonesia.
This document outlines an agenda for a web security workshop. It introduces the presenter, Satria Ady Pradana, and mentions that Dracos Linux is an open source penetration testing operating system. It then discusses various topics related to web security, penetration testing, and the Dracos Linux operating system, including SQL injection, cross-site scripting, cross-site request forgery, exploit databases, bug bounty programs, system takeovers, and Nmap port scanning. The document provides an overview of the content to be covered in the workshop.
This document outlines an agenda for a web security workshop. It introduces the presenter, Satria Ady Pradana, and mentions that he will discuss the Dracos Linux penetration testing operating system. The workshop will cover installing and using Dracos Linux in a virtual machine, including configuring the network, installing packages, and using its user interface. Attendees will have the opportunity to try SQL injection, cross-site scripting, and cross-site request forgery attacks on a target website.
Training on July 16, 2017.
This training is the compressed version of Malware Engineering & Crafting.
In this training, we will talk about malware as well as crafting the simple working malware. The goal of this session is to understanding malware internal so one can have tactics to combat it.
Hack Attack! An Introduction to Penetration TestingSteve Phillips
This document provides an introduction to penetration testing and ethical hacking. It discusses how hacking can be done ethically through penetration testing with permission. It outlines the stages of a hacker's skills from script kiddie to uberhacker. Popular programming languages for creating hacking tools like C, Python, and Ruby are also mentioned. The document demonstrates some hacking tools in BackTrack Linux like sniffing passwords with Ettercap and bruteforcing FTP passwords with Hydra. It emphasizes how virtualization allows one to practice hacking legally and provides further learning resources.
This document discusses the digital forensic capabilities of the dracOs Linux distribution. It provides an overview of dracOs and its focus on digital forensics. It describes the current state of forensic tools integrated in dracOs and plans to develop a live CD for acquisition and analysis and new forensic tools. It also covers key aspects of digital forensics like stages of acquisition, analysis and reporting and categories of forensic techniques like device type, volatility and format type. Specific open source tools supported in dracOs are highlighted for tasks like disk imaging, file carving, file analysis, anti-malware, memory analysis and more. Contributing to dracOs's development is encouraged.
TeelTech - Advancing Mobile Device Forensics (online version)Mike Felch
This document provides an overview of a training on advancing mobile device forensics through reverse engineering and programming techniques. It discusses how traditional forensic tools are becoming less effective at recovering data from newer devices and applications that are designed for privacy. The training will demonstrate extracting artifacts from a raw device image using a hex editor and Python scripts. It also outlines a simulated criminal investigation involving the murder of a victim, and how analyzing the digital evidence from the victim and suspect's mobile phones through these new techniques revealed deleted messages that are relevant to the case.
This document discusses malware analysis collaboration and automation. It describes setting up a virtualized malware analysis environment using QEMU/KVM with light-weight, copy-on-write disk clones for consistency and efficiency. It also covers automating tasks like provisioning new virtual machines, inserting and extracting files from guests, and capturing and replaying virtual machine sessions for collaborative training.
An Abusive Relationship with AngularJS by Mario Heiderich - CODE BLUE 2015CODE BLUE
Some voices claim that "Angular is what HTML would have been if it had been designed for building web applications". While this statement may or may not be true, is certainly accounts as one of the bolder ones a JavaScript web framework can ever issue. And where boldness is glistening like a German Bratwurst sausage in the evening sun, a critical review from a grumpy old security person shouldn’t be too far away. This talk will have a stern, very stern look at AngularJS in particular and shed light on the security aspects of this ever-popular tool. Did the super-hero framework do everything right and follow its own super-heroic principles? Does AngularJS increase or rather decrease the attack surface of a web application? How does AngularJS play along with the Content Security Policy, and was it a good idea to combine this kind of security with futuristic feature creep? And what about AngularJS version 2.0? Beware that we won’t stop at glancing at the code itself, investigating security best practices, and verifying compatibility and other common things that contribute to robust security (or lack thereof). We will cross the moral border and see if the AngularJS team could notice rogue bug tickets. A pivotal question that everyone is wondering about is: Have they successfully kept evil minds like yours truly speaker here from introducing new security bugs into the code base? This talk is a reckoning with a modern JavaScript framework that promises a lot and keeps even more, not necessarily for the best for developers and users. We will conclude in deriving a general lesson learnt and hopefully agree that progress doesn't invariably mean an enhancement.
The document discusses common web application security vulnerabilities and best practices for prevention. It covers topics like cross-site scripting (XSS), SQL injection, insecure direct object references, command injection, cross-site request forgery (CSRF), and improper password storage. The document provides examples of each vulnerability and recommendations for prevention, including input validation, prepared statements, encryption, hashing passwords, and other techniques. The objectives are to create awareness of web security issues and how developers can build more secure applications using secure coding practices.
Automated Malware Analysis and Cyber Security IntelligenceJason Choi
This presentation is an introduction to Cuckoo Sandbox, an automated a malware analysis system, and Intelligence to use this tool, at Department of Scientific Criminal Investigation in SungKyunKwan University in Korea.
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...Andrew Morris
In this talk, I'll be discussing my experience developing intelligence-gathering capabilities to track several different independent groups of threat actors on a very limited budget (read: virtually no budget whatsoever). I'll discuss discovering the groups using open source intelligence gathering and honeypots, monitoring attacks, collecting and analyzing malware artifacts to figure out what their capabilities are, and reverse engineering their malware to develop the capability to track their targets in real time. Finally, I'll chat about defensive strategies and provide recommendations for enterprise security analysts and other security researchers.
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Lane Huff
I'm Cuckoo for Malware provides an introductory overview to Cuckoo Sandbox and Malware Analysis. This talk walks through discussing different types of malware and what they do, to explaining how Cuckoo Sandbox works and how to get the best results from it. The talk will cover how to harden your sandbox against Malware authors attempts to avoid analysis and give ideas for listeners wanting to set up custom environments of their own. The goal of the talk is to allow listeners with enough information so that they can begin analyzing malware in their own Cuckoo-based sandbox environment.
Andrew Morris collected malware samples over the weekend using Dionaea and JBoss honeypots. The Dionaea honeypot captured over 100 Conficker malware samples exploiting Windows SMB vulnerabilities. The JBoss honeypot was infected by the ZECMD worm within 24 hours, exploiting exposed JMX consoles. Both provided real-world malware samples for analysis without risking other systems on Morris' network. He offered to collaborate on further manual analysis of the samples.
This document provides an overview of setting up an iOS penetration testing environment and common techniques for analyzing iOS applications. It discusses jailbreaking a device and installing useful tools. It also covers understanding the iOS file system and Objective-C runtime, using tools like Cycript and class-dump-z to enable runtime analysis and manipulation. The document describes insecure data storage techniques like plist files, NSUserDefaults, and CoreData that store unencrypted data. It also discusses analyzing network traffic and automated testing.
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...grecsl
Knowing how to perform basic malware analysis can go a long way in helping infosec analysts do some basic triage to either crush the mundane or recognize when its time to pass the more serious samples on to the the big boys. This presentation covers several analysis environment options and the three quick steps that allows almost anyone with a general technical background to go from n00b to ninja (;)) in no time. Well … maybe not a "ninja" per se but the closing does address follow-on resources on the cheap for those wanting to dive deeper into the dark world of malware analysis.
The document discusses the current and future states of automated malware generation and malware defense techniques. It describes how malware distribution networks currently work and trends showing rising malware samples. The future of malware defense is proposed to apply more machine learning and statistical techniques to model malware behaviors and attributes in order to handle growing sample volumes. This would involve training machine learning classifiers on features identified by human experts to classify and cluster malware more effectively.
Malware varies mostly in the visible payloads that they manifest. We can see them infecting files, un-installing antimalware applications, stealing important documents, controlling our computers remotely, and other malicious activities.
What we don’t see is how they are implemented within the malware code. Modern malware uses different techniques to protect themselves from detection, analysis, and eradication. Some malware uses layers to even obfuscate the way they use these protections.Layers in malware are defense mechanisms against deep analysis. Within these layers, different malware tricks are also deployed.
In this presentation, we are going to look into Scieron and Vawtrak. Two different malware that implements layers differently. We will see some video demo on how some of the malware code are executed within the context of a debugger.
Finally, we are going to leverage Volatility, a memory forensic tool, to detect the presence of layers in an infected system.
This document analyzes the "machine.apk" Android malware sample using static and dynamic analysis techniques. The summary includes:
1. Static analysis is performed using tools like apktool, dex2jar, and jd-gui to disassemble the app and examine its AndroidManifest.xml and Java source code. This reveals the malware requests dangerous permissions like location, SMS/calls, and implements tapping and tracking services.
2. Dynamic analysis with CopperDroid and Anubis is able to monitor the app's network traffic and activity timeline. The analysis finds the app extracts the phone number and operator, sends this data to Thailand, can make automatic calls, and tracks the device location.
3.
This document introduces tools and techniques for preliminary malware analysis. It discusses examining malware behavior through static analysis, behavioral tracing, and sandboxing. Specific tools are presented for observing malware snapshots, tracing its behavior, and containing it in a sandbox. Process-based and stealthy malware are discussed, along with vulnerabilities of rootkits and tools for rootkit detection. The goal is to present a model for beginning reverse engineering of malware through observation and experimentation in a contained environment.
This document provides an introduction to red team operations from the perspective of a penetration tester transitioning to become a red teamer. It discusses some of the key differences between penetration testing and red teaming such as scope, reconnaissance required, stealth, and infrastructure setup. The document outlines principles for red team operations including protecting infrastructure, logging everything, managing information, and avoiding detection. It also provides examples of tactics, techniques and procedures used in red team operations as well as considerations for tools like Cobalt Strike to help evade detection.
The document discusses two cyber threats that existed in Morocco:
1. A password info stealer malware that was responsible for 90% of attacks. Intelligence tracking detected around 180GB of leaked data related to Moroccan domains and personal information, and over 320 spammers were identified from the data with connections to Morocco.
2. An ATM dispense malware that was gathered from Moroccan internet service providers. Technical details about the ATM malware were presented, but not summarized.
The document ends by stating that preparations are being made for the "next war", but does not clarify the purpose of the two threats.
From Thousands of Hours to a Couple of Minutes: Automating Exploit Generation...Priyanka Aash
Writing a working exploit for a vulnerability is generally challenging, time-consuming, and labor-intensive. To address this issue, automated exploit generation techniques can be adopted. In practice, existing techniques however exhibit an insufficient ability to craft exploits, particularly for the kernel vulnerabilities. On the one hand, this is because their technical approaches explore exploitability only in the context of a crashing process whereas generating an exploit for a kernel vulnerability typically needs to vary the context of a kernel panic. On the other hand, this is due to the fact that the program analysis techniques used for exploit generation are suitable only for simple programs but not the OS kernel which has higher complexity and scalability.
In this talk, we will introduce and release a new exploitation framework to fully automate the exploitation of kernel vulnerabilities. Technically speaking, our framework utilizes a kernel fuzzing technique to diversify the contexts of a kernel panic and then leverages symbolic execution to explore exploitability under different contexts. We demonstrate that this new exploitation framework facilitates exploit crafting from many aspects.
First, it augments a security analyst with the ability to automate the identification of system calls that he needs to take advantages for vulnerability exploitation. Second, it provides security analysts with the ability to achieve security mitigation bypassing. Third, it allows security analysts to automatically generate exploits with different exploitation objectives (e.g., privilege escalation or data leakage). Last but not least, it equips security analysts with an ability to generate exploits even for those kernel vulnerabilities for which the exploitability has not yet been confirmed or verified.
Along with this talk, we will also release many unpublished working exploits against several kernel vulnerabilities. It should be noted that, the vulnerabilities we experimented cover primarily Use-After-Free and heap overflow. Among all these test cases, more than 50% of them do not have working exploits publicly available. To illustrate this release, I have already disclosed one working exploit at my personal website (http://ww9210.cn/). The exploit released on my site pertains to CVE-2017-15649 for which there has not yet been an exploit publicly available with the demonstration of bypassing SMAP.
Deploying a Shadow Threat Intel Capability at Thotcon on May 6, 2016grecsl
In the presentation that threat intel vendors do not want you to see, open source and internal data meets home grown resources to produce actionable threat intelligence that your organization can leverage to stop the bad guys. This presentation discusses and shows examples of using what your already have to bootstrap this capability using existing data management platforms with open and flexible schemas to ease identification of advanced threats. Specific topics covered include the advantages of using open and flexible platforms that can be molded into a data repository, a case tracking system, an indicator database, and more. By analyzing this data organizations can discovery trends across attacks that help them understand their adversaries. An example nosql schema will be release to help attendees create their own implementations.
- Malware analysis involves both static and dynamic analysis techniques to understand malware behavior and assess potential damage. Static analysis involves disassembling and reviewing malware code and structure without executing it. Dynamic analysis observes malware behavior when executed in an isolated virtual environment.
- Tools for static analysis include file hashing, string extraction, and PE header examination. Dynamic analysis tools monitor the registry, file system, processes, and network traffic created by malware runtime behavior. These include Process Monitor, Wireshark, Process Explorer, and network sniffers.
- To safely conduct malware analysis, one should create an isolated virtual lab separated from production networks, and install behavioral monitoring and code analysis tools like OllyDbg, Process Monitor, and Wiresh
IoT Malware: Comprehensive Survey, Analysis Framework and Case StudiesPriyanka Aash
This document provides an overview of a study on IoT malware. It discusses the challenges of analyzing IoT malware due to platform heterogeneity. It outlines the methodology used, which included collecting malware samples, metadata, and reports. Metadata and surveys of vulnerabilities and malware families are presented. The document describes a sandbox for dynamic analysis of IoT malware and provides example reports. It includes two case studies on the Hydra exploit and issues with metadata. Key takeaways focus on the importance of metadata analysis and improving vulnerability management and defense for IoT security.
This document discusses tools for static analysis of files, including ClamAV and YARA. ClamAV is an open-source antivirus engine that uses signatures to detect malware. Signatures can include strings, hashes, and byte patterns. YARA allows for more flexible identification of malware through rules that can detect strings, regular expressions, and byte patterns. Examples of ClamAV and YARA signatures are provided.
The document discusses several advanced persistent threats (APTs) that have targeted systems in Korea and other countries, including the LuckyCat, Heartbeat, and Flashback malware campaigns. It provides details on the attacks, malware components, command and control infrastructure, and technical analysis of the threats. The document aims to help the digital forensics community in Korea understand these sophisticated cyber espionage activities and improve defenses against similar attacks.
Abusing Adobe Reader’s JavaScript APIs by Abdul-Aziz Hariri & Brian Gorenc - ...CODE BLUE
Adobe Reader’s JavaScript APIs offer a rich set of functionality for document authors. These APIs allow for processing forms, controlling multimedia events, and communicating with databases, all of which provide end-users the ability to create complex documents. This complexity provides a perfect avenue for attackers to take advantage of weaknesses that exist in Reader’s JavaScript APIs.
In this talk, we will provide insight into both the documented and undocumented APIs available in Adobe Reader. Several code auditing techniques will be shared to aid in vulnerability discovery, along with numerous proofs-of-concept which highlight real-world examples. We’ll detail out how to chain several unique issues to obtain execution in a privileged context. Finally, we’ll describe how to construct an exploit that achieves remote code execution without the need for memory corruption.
Docker is a system for running applications securely isolated in a container to provide a consistent deployment environment. The document introduces Docker, discusses the challenges of deploying applications ("the matrix from hell"), and how Docker addresses these challenges by allowing applications and their dependencies to be packaged into lightweight executable containers that can run on any infrastructure. It also summarizes key Docker tools like Docker Compose for defining and running multi-container apps, Docker Machine for provisioning remote Docker hosts in various clouds, and Docker Swarm for clustering Docker hosts.
The document discusses common web application security vulnerabilities and best practices for prevention. It covers topics like cross-site scripting (XSS), SQL injection, insecure direct object references, command injection, cross-site request forgery (CSRF), and improper password storage. The document provides examples of each vulnerability and recommendations for prevention, including input validation, prepared statements, encryption, hashing passwords, and other techniques. The objectives are to create awareness of web security issues and how developers can build more secure applications using secure coding practices.
Automated Malware Analysis and Cyber Security IntelligenceJason Choi
This presentation is an introduction to Cuckoo Sandbox, an automated a malware analysis system, and Intelligence to use this tool, at Department of Scientific Criminal Investigation in SungKyunKwan University in Korea.
ShmooCon 2015: No Budget Threat Intelligence - Tracking Malware Campaigns on ...Andrew Morris
In this talk, I'll be discussing my experience developing intelligence-gathering capabilities to track several different independent groups of threat actors on a very limited budget (read: virtually no budget whatsoever). I'll discuss discovering the groups using open source intelligence gathering and honeypots, monitoring attacks, collecting and analyzing malware artifacts to figure out what their capabilities are, and reverse engineering their malware to develop the capability to track their targets in real time. Finally, I'll chat about defensive strategies and provide recommendations for enterprise security analysts and other security researchers.
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Lane Huff
I'm Cuckoo for Malware provides an introductory overview to Cuckoo Sandbox and Malware Analysis. This talk walks through discussing different types of malware and what they do, to explaining how Cuckoo Sandbox works and how to get the best results from it. The talk will cover how to harden your sandbox against Malware authors attempts to avoid analysis and give ideas for listeners wanting to set up custom environments of their own. The goal of the talk is to allow listeners with enough information so that they can begin analyzing malware in their own Cuckoo-based sandbox environment.
Andrew Morris collected malware samples over the weekend using Dionaea and JBoss honeypots. The Dionaea honeypot captured over 100 Conficker malware samples exploiting Windows SMB vulnerabilities. The JBoss honeypot was infected by the ZECMD worm within 24 hours, exploiting exposed JMX consoles. Both provided real-world malware samples for analysis without risking other systems on Morris' network. He offered to collaborate on further manual analysis of the samples.
This document provides an overview of setting up an iOS penetration testing environment and common techniques for analyzing iOS applications. It discusses jailbreaking a device and installing useful tools. It also covers understanding the iOS file system and Objective-C runtime, using tools like Cycript and class-dump-z to enable runtime analysis and manipulation. The document describes insecure data storage techniques like plist files, NSUserDefaults, and CoreData that store unencrypted data. It also discusses analyzing network traffic and automated testing.
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...grecsl
Knowing how to perform basic malware analysis can go a long way in helping infosec analysts do some basic triage to either crush the mundane or recognize when its time to pass the more serious samples on to the the big boys. This presentation covers several analysis environment options and the three quick steps that allows almost anyone with a general technical background to go from n00b to ninja (;)) in no time. Well … maybe not a "ninja" per se but the closing does address follow-on resources on the cheap for those wanting to dive deeper into the dark world of malware analysis.
The document discusses the current and future states of automated malware generation and malware defense techniques. It describes how malware distribution networks currently work and trends showing rising malware samples. The future of malware defense is proposed to apply more machine learning and statistical techniques to model malware behaviors and attributes in order to handle growing sample volumes. This would involve training machine learning classifiers on features identified by human experts to classify and cluster malware more effectively.
Malware varies mostly in the visible payloads that they manifest. We can see them infecting files, un-installing antimalware applications, stealing important documents, controlling our computers remotely, and other malicious activities.
What we don’t see is how they are implemented within the malware code. Modern malware uses different techniques to protect themselves from detection, analysis, and eradication. Some malware uses layers to even obfuscate the way they use these protections.Layers in malware are defense mechanisms against deep analysis. Within these layers, different malware tricks are also deployed.
In this presentation, we are going to look into Scieron and Vawtrak. Two different malware that implements layers differently. We will see some video demo on how some of the malware code are executed within the context of a debugger.
Finally, we are going to leverage Volatility, a memory forensic tool, to detect the presence of layers in an infected system.
This document analyzes the "machine.apk" Android malware sample using static and dynamic analysis techniques. The summary includes:
1. Static analysis is performed using tools like apktool, dex2jar, and jd-gui to disassemble the app and examine its AndroidManifest.xml and Java source code. This reveals the malware requests dangerous permissions like location, SMS/calls, and implements tapping and tracking services.
2. Dynamic analysis with CopperDroid and Anubis is able to monitor the app's network traffic and activity timeline. The analysis finds the app extracts the phone number and operator, sends this data to Thailand, can make automatic calls, and tracks the device location.
3.
This document introduces tools and techniques for preliminary malware analysis. It discusses examining malware behavior through static analysis, behavioral tracing, and sandboxing. Specific tools are presented for observing malware snapshots, tracing its behavior, and containing it in a sandbox. Process-based and stealthy malware are discussed, along with vulnerabilities of rootkits and tools for rootkit detection. The goal is to present a model for beginning reverse engineering of malware through observation and experimentation in a contained environment.
This document provides an introduction to red team operations from the perspective of a penetration tester transitioning to become a red teamer. It discusses some of the key differences between penetration testing and red teaming such as scope, reconnaissance required, stealth, and infrastructure setup. The document outlines principles for red team operations including protecting infrastructure, logging everything, managing information, and avoiding detection. It also provides examples of tactics, techniques and procedures used in red team operations as well as considerations for tools like Cobalt Strike to help evade detection.
The document discusses two cyber threats that existed in Morocco:
1. A password info stealer malware that was responsible for 90% of attacks. Intelligence tracking detected around 180GB of leaked data related to Moroccan domains and personal information, and over 320 spammers were identified from the data with connections to Morocco.
2. An ATM dispense malware that was gathered from Moroccan internet service providers. Technical details about the ATM malware were presented, but not summarized.
The document ends by stating that preparations are being made for the "next war", but does not clarify the purpose of the two threats.
From Thousands of Hours to a Couple of Minutes: Automating Exploit Generation...Priyanka Aash
Writing a working exploit for a vulnerability is generally challenging, time-consuming, and labor-intensive. To address this issue, automated exploit generation techniques can be adopted. In practice, existing techniques however exhibit an insufficient ability to craft exploits, particularly for the kernel vulnerabilities. On the one hand, this is because their technical approaches explore exploitability only in the context of a crashing process whereas generating an exploit for a kernel vulnerability typically needs to vary the context of a kernel panic. On the other hand, this is due to the fact that the program analysis techniques used for exploit generation are suitable only for simple programs but not the OS kernel which has higher complexity and scalability.
In this talk, we will introduce and release a new exploitation framework to fully automate the exploitation of kernel vulnerabilities. Technically speaking, our framework utilizes a kernel fuzzing technique to diversify the contexts of a kernel panic and then leverages symbolic execution to explore exploitability under different contexts. We demonstrate that this new exploitation framework facilitates exploit crafting from many aspects.
First, it augments a security analyst with the ability to automate the identification of system calls that he needs to take advantages for vulnerability exploitation. Second, it provides security analysts with the ability to achieve security mitigation bypassing. Third, it allows security analysts to automatically generate exploits with different exploitation objectives (e.g., privilege escalation or data leakage). Last but not least, it equips security analysts with an ability to generate exploits even for those kernel vulnerabilities for which the exploitability has not yet been confirmed or verified.
Along with this talk, we will also release many unpublished working exploits against several kernel vulnerabilities. It should be noted that, the vulnerabilities we experimented cover primarily Use-After-Free and heap overflow. Among all these test cases, more than 50% of them do not have working exploits publicly available. To illustrate this release, I have already disclosed one working exploit at my personal website (http://ww9210.cn/). The exploit released on my site pertains to CVE-2017-15649 for which there has not yet been an exploit publicly available with the demonstration of bypassing SMAP.
Deploying a Shadow Threat Intel Capability at Thotcon on May 6, 2016grecsl
In the presentation that threat intel vendors do not want you to see, open source and internal data meets home grown resources to produce actionable threat intelligence that your organization can leverage to stop the bad guys. This presentation discusses and shows examples of using what your already have to bootstrap this capability using existing data management platforms with open and flexible schemas to ease identification of advanced threats. Specific topics covered include the advantages of using open and flexible platforms that can be molded into a data repository, a case tracking system, an indicator database, and more. By analyzing this data organizations can discovery trends across attacks that help them understand their adversaries. An example nosql schema will be release to help attendees create their own implementations.
- Malware analysis involves both static and dynamic analysis techniques to understand malware behavior and assess potential damage. Static analysis involves disassembling and reviewing malware code and structure without executing it. Dynamic analysis observes malware behavior when executed in an isolated virtual environment.
- Tools for static analysis include file hashing, string extraction, and PE header examination. Dynamic analysis tools monitor the registry, file system, processes, and network traffic created by malware runtime behavior. These include Process Monitor, Wireshark, Process Explorer, and network sniffers.
- To safely conduct malware analysis, one should create an isolated virtual lab separated from production networks, and install behavioral monitoring and code analysis tools like OllyDbg, Process Monitor, and Wiresh
IoT Malware: Comprehensive Survey, Analysis Framework and Case StudiesPriyanka Aash
This document provides an overview of a study on IoT malware. It discusses the challenges of analyzing IoT malware due to platform heterogeneity. It outlines the methodology used, which included collecting malware samples, metadata, and reports. Metadata and surveys of vulnerabilities and malware families are presented. The document describes a sandbox for dynamic analysis of IoT malware and provides example reports. It includes two case studies on the Hydra exploit and issues with metadata. Key takeaways focus on the importance of metadata analysis and improving vulnerability management and defense for IoT security.
This document discusses tools for static analysis of files, including ClamAV and YARA. ClamAV is an open-source antivirus engine that uses signatures to detect malware. Signatures can include strings, hashes, and byte patterns. YARA allows for more flexible identification of malware through rules that can detect strings, regular expressions, and byte patterns. Examples of ClamAV and YARA signatures are provided.
The document discusses several advanced persistent threats (APTs) that have targeted systems in Korea and other countries, including the LuckyCat, Heartbeat, and Flashback malware campaigns. It provides details on the attacks, malware components, command and control infrastructure, and technical analysis of the threats. The document aims to help the digital forensics community in Korea understand these sophisticated cyber espionage activities and improve defenses against similar attacks.
Abusing Adobe Reader’s JavaScript APIs by Abdul-Aziz Hariri & Brian Gorenc - ...CODE BLUE
Adobe Reader’s JavaScript APIs offer a rich set of functionality for document authors. These APIs allow for processing forms, controlling multimedia events, and communicating with databases, all of which provide end-users the ability to create complex documents. This complexity provides a perfect avenue for attackers to take advantage of weaknesses that exist in Reader’s JavaScript APIs.
In this talk, we will provide insight into both the documented and undocumented APIs available in Adobe Reader. Several code auditing techniques will be shared to aid in vulnerability discovery, along with numerous proofs-of-concept which highlight real-world examples. We’ll detail out how to chain several unique issues to obtain execution in a privileged context. Finally, we’ll describe how to construct an exploit that achieves remote code execution without the need for memory corruption.
Docker is a system for running applications securely isolated in a container to provide a consistent deployment environment. The document introduces Docker, discusses the challenges of deploying applications ("the matrix from hell"), and how Docker addresses these challenges by allowing applications and their dependencies to be packaged into lightweight executable containers that can run on any infrastructure. It also summarizes key Docker tools like Docker Compose for defining and running multi-container apps, Docker Machine for provisioning remote Docker hosts in various clouds, and Docker Swarm for clustering Docker hosts.
Docker is a system for running applications in lightweight containers that can be deployed across machines. It allows developers to package applications with all dependencies into standardized units for software development. Docker eliminates inconsistencies in environments and allows applications to be easily deployed on virtual machines, physical servers, public clouds, private clouds, and developer laptops through the use of containers.
The document provides an introduction to Docker, containers, and the problems they aim to solve. It discusses:
- Why Docker was created - to address the "matrix from hell" of developing and deploying applications across different environments and platforms.
- How Docker works at a high level, using lightweight containers that package code and dependencies to run consistently on any infrastructure.
- Some key Docker concepts like images, containers, the Dockerfile for building images, and common Docker commands.
- Benefits of Docker for developers and operations in simplifying deployment, reducing inconsistencies, and improving portability of applications.
This document provides an introduction to Docker, including why it was created, how it works, and its growing ecosystem. Docker allows applications to be packaged with all their dependencies and run consistently across any Linux server by using lightweight virtual containers rather than full virtual machines. It solves the problem of differences between development, testing, and production environments. The document outlines the technical details and advantages of Docker, examples of how companies are using it, and the growing support in tools and platforms.
This document provides an agenda and overview for a hands-on workshop on container and Docker technologies. It begins with a brief introduction to containers and Docker, then covers installing and managing Docker containers using tools like Portainer and OpenShift Origin. It also discusses building simple Docker applications and has sections on container and Docker concepts like images, containers, registries, advantages, and the Docker ecosystem. The document aims to explain containers and Docker for both developers and IT administrators.
Demystifying Containerization Principles for Data ScientistsDr Ganesh Iyer
Demystifying Containerization Principles for Data Scientists - An introductory tutorial on how Dockers can be used as a development environment for data science projects
Introduction to dockers and kubernetes. Learn how this helps you to build scalable and portable applications with cloud. It introduces the basic concepts of dockers, its differences with virtualization, then explain the need for orchestration and do some hands-on experiments with dockers
Write Once and REALLY Run Anywhere | OpenStack Summit HK 2013dotCloud
The document outlines the agenda for the OpenStack Summit in November 2013. The agenda includes sessions on Docker and its ecosystem, using Docker with OpenStack and Rackspace, and a cross-cloud deployment demo. Docker is presented as a solution for developing and deploying applications across multiple environments by encapsulating code and dependencies in portable containers. It can help eliminate inconsistencies between development, testing, and production environments.
Docker - Demo on PHP Application deployment Arun prasath
Docker is an open-source project to easily create lightweight, portable, self-sufficient containers from any application. The same container that a developer builds and tests on a laptop can run at scale, in production, on VMs, bare metal, OpenStack clusters, public clouds and more.
In this demo, I will show how to build a Apache image from a Dockerfile and deploy a PHP application which is present in an external folder using custom configuration files.
The document outlines the agenda for the OpenStack Summit in November 2013, including presentations on Docker and its ecosystem, how Docker can be used with OpenStack and Rackspace, and a demonstration of cross-cloud application deployment using Docker. Docker is presented as a solution to the "matrix from hell" of running applications across different environments by providing lightweight, portable containers that can run anywhere regardless of the operating system. The summit aims to educate attendees on Docker and showcase its integration with OpenStack for simplified and efficient application deployment and management across multiple clouds.
This document provides an introduction and overview of Docker. It discusses why Docker was created to address issues with managing applications across different environments, and how Docker uses lightweight containers to package and run applications. It also summarizes the growth and adoption of Docker in its first 7 months, and outlines some of its core features and the Docker ecosystem including integration with DevOps tools and public clouds.
This document provides an overview of containers and Docker for automating DevOps processes. It begins with an introduction to containers and Docker, explaining how containers help break down silos between development and operations teams. It then covers Docker concepts like images, containers, and registries. The document discusses advantages of containers like low overhead, environment isolation, quick deployment, and reusability. It explains how containers leverage kernel features like namespaces and cgroups to provide lightweight isolation compared to virtual machines. Finally, it briefly mentions Docker ecosystem tools that integrate with DevOps processes like configuration management and continuous integration/delivery.
In this talk Ben will walk you through running Cassandra in a docker environment to give you a flexible development environment that uses only a very small set of resources, both locally and with your favorite cloud provider. Lessons learned running Cassandra with a very small set of resources are applicable to both your local development environment and larger, less constrained production deployments.
Configuration management tools like Chef, Puppet, and Ansible aim to reduce inconsistencies by imposing and managing consistent configurations across environments. However, they do not fully address issues related to dependencies, isolation, and portability. Docker containers build on these tools by adding standard interfaces and a lightweight virtualization layer that encapsulates code and dependencies, allowing applications and their environments to be packaged together and run consistently on any infrastructure while also providing isolation.
This document provides an introduction to Docker, including:
- Docker allows developers to package applications with all dependencies into standardized units called containers that can run on any infrastructure.
- Docker uses namespaces and control groups to provide isolation and security between containers while allowing for more efficient use of resources than virtual machines.
- The Docker architecture includes images which are templates for creating containers, a Dockerfile to automate image builds, and Docker Hub for sharing images.
- Kubernetes is an open-source platform for automating deployment and management of containerized applications across clusters of hosts.
Docker, Containers, and the Future of Application Delivery document discusses:
- The challenges of running applications across different environments due to variations in stacks and hardware ("N x N" compatibility problem).
- How Docker addresses this by allowing applications and their dependencies to be packaged into standardized software containers that can run consistently across any infrastructure similar to how shipping containers standardized cargo transportation.
- The benefits of Docker for developers in building applications once and running them anywhere without dependency or compatibility issues, and for operations in simplifying configuration management and automation.
Docker-Hanoi @DKT , Presentation about Docker EcosystemVan Phuc
The document provides an overview of Docker Platform and Ecosystem. It begins with introductions and background on Docker, explaining how Docker solves the problem of dependency hell and portability issues by allowing applications to run in isolated containers that package code and dependencies. It then discusses key components of Docker including Engine, Registry, Machine, Swarm, Compose and tools like Toolbox and Cloud. The document concludes with examples of using Docker for continuous integration pipelines and microservices architectures.
This document provides an introduction to Docker, including what Docker is, why it matters, and how it works. Some key points:
- Docker implements lightweight containers that provide process isolation using features of the Linux kernel like cgroups and namespaces. It allows building and shipping applications without dependency and compatibility issues.
- Docker solves the "N times N" compatibility problem that arises when applications need to run in different environments. Its portable containers and standardized operations help automate development and deployment workflows.
- Containers isolate applications from one another and their dependencies without the overhead of virtual machines. This makes them lightweight and efficient while still providing isolation of applications and flexibility to run anywhere.
Docker, Containers and the Future of Application DeliveryDocker, Inc.
Docker containers provide a standardized way to package applications and their dependencies to run consistently regardless of infrastructure. This solves the "N x N" compatibility problem caused by multiple applications, stacks, and environments. Containers allow applications to be built once and run anywhere while isolating components. Docker eliminates inconsistencies between development, testing and production environments and improves automation of processes like continuous integration and delivery.
Slide yang kupresentasikan di Born To Protect Indonesia.
Reversing merupakan bidang yang luas. Ada banyak hal yang bisa dieksplorasi di dalamnya. Di sini aku coba untuk memberikan gambaran apa saja yang mungkin belum diketahui tentang reversing.
The Offensive Python - Practical Python for Penetration TestingSatria Ady Pradana
My slide for roadshow of Cyber Security Marathon in Code Margonda, January 11th 2018.
Why would hackers love python?
It's not hard to know that python is amazing language. But how amazing it could be for cyber security? Let's see by getting our hands dirty, from simple tasks to more challenging action
Seminar on November 4, 2017
Currently many things has its own app on android. Are they secure enough? What if they are not engineered with security in mind? But most importantly, can we do something to them?
Seminar on October 10, 2017
General overview of android security from hacker's perspective. Android security mostly seen as only "exploiting the device with RAT" and some of it. Here, I want to show that there are more than that.
This document discusses using Frida, an open source dynamic instrumentation toolkit, to bypass security checks in applications. It describes how Frida works by injecting JavaScript instrumentation scripts to inspect and modify running processes. Examples are given of using Frida to bypass encryption, PIN checks, root checking, and SSL pinning by hooking functions to log plaintext, force checks to return true, or ignore certificate validation. Alternative dynamic binary instrumentation tools like PIN and DynamoRIO are also mentioned.
(Workshop) Reverse Engineering - Protecting and Breaking the SoftwareSatria Ady Pradana
The document discusses reverse engineering principles and techniques. It introduces reverse engineering as breaking down an existing system to understand its construction and components. The three fundamental principles are comprehension, decomposition, and reconstruction. Common reverse engineering practices are described like resource modification, control flow bypass, and code caving. Hands-on examples are provided using a CrackMe program in C# to demonstrate reverse engineering a .NET binary, including modifying strings, bypassing checks, changing function targets, and injecting custom code.
Reverse Engineering - Protecting and Breaking the SoftwareSatria Ady Pradana
First upload.
Introduction to reverse engineering. The focus of this presentation is software or code, emphasizing on common practice in reverse engineering of software
This document discusses memory forensics and summarizes a presentation about investigating memory artifacts. It introduces dracOs, an open-source Linux distribution for security research. It describes the current and planned forensics tools being integrated into dracOs. It then explains the basics of memory forensics, including why it is important, how memory is organized, common memory acquisition formats, and analysis tools like Volatility and Rekall. The presentation aims to provide knowledge about digital forensic analysis of memory dumps.
Presentation on STMIK Nusa Mandiri.
This talk is an insight about hacking and cyber security in general. Giving the audience the sense of security and fundamental concept of this field.
Dokumen ini membahas proposal untuk platform otomatis analisis dan repositori malware yang akan menyediakan statistik realtime dan akurat serta dapat terhubung dengan berbagai penyedia untuk analisis dinamis otomatis. Platform ini bertujuan menjadi seperti VirusTotal untuk hal yang lebih besar dengan mendukung berbagai platform seperti Windows, Linux, Android, dan iOS.
The document discusses the path of cyber security and how to become a hacker or security professional. It outlines the typical steps of penetration testing: reconnaissance and analysis, vulnerability mapping, gaining access, privilege escalation, maintaining access, and covering tracks. It recommends starting with networking and programming skills, focusing on an area of expertise like web security, participating in competitions and creating a practice lab to learn. The presenter gives demonstrations on vulnerable VMs and recommends courses, CTF competitions, and building your own lab to advance your skills in security research, tool development, and operations.
Tugas Akhir 13510030 - Analisis Keamanan Dalam Pengembangan Sistem Transaksi ...Satria Ady Pradana
Sistem ini mengusulkan penggunaan otentikasi biometri berbasis pembuluh darah telapak tangan untuk menggantikan otentikasi berbasis PIN pada sistem transaksi ATM. Hal ini dimaksudkan untuk meningkatkan keamanan dengan cara yang lebih nyaman bagi nasabah. Rangkaian perubahan yang diusulkan meliputi penambahan sensor biometrik pada ATM, protokol komunikasi dan perlindungan pesan yang lebih aman, serta penyimpanan dan pemrosesan template biome
AI and Data Privacy in 2025: Global TrendsInData Labs
In this infographic, we explore how businesses can implement effective governance frameworks to address AI data privacy. Understanding it is crucial for developing effective strategies that ensure compliance, safeguard customer trust, and leverage AI responsibly. Equip yourself with insights that can drive informed decision-making and position your organization for success in the future of data privacy.
This infographic contains:
-AI and data privacy: Key findings
-Statistics on AI data privacy in the today’s world
-Tips on how to overcome data privacy challenges
-Benefits of AI data security investments.
Keep up-to-date on how AI is reshaping privacy standards and what this entails for both individuals and organizations.
DevOpsDays Atlanta 2025 - Building 10x Development Organizations.pptxJustin Reock
Building 10x Organizations with Modern Productivity Metrics
10x developers may be a myth, but 10x organizations are very real, as proven by the influential study performed in the 1980s, ‘The Coding War Games.’
Right now, here in early 2025, we seem to be experiencing YAPP (Yet Another Productivity Philosophy), and that philosophy is converging on developer experience. It seems that with every new method we invent for the delivery of products, whether physical or virtual, we reinvent productivity philosophies to go alongside them.
But which of these approaches actually work? DORA? SPACE? DevEx? What should we invest in and create urgency behind today, so that we don’t find ourselves having the same discussion again in a decade?
Linux Support for SMARC: How Toradex Empowers Embedded DevelopersToradex
Toradex brings robust Linux support to SMARC (Smart Mobility Architecture), ensuring high performance and long-term reliability for embedded applications. Here’s how:
• Optimized Torizon OS & Yocto Support – Toradex provides Torizon OS, a Debian-based easy-to-use platform, and Yocto BSPs for customized Linux images on SMARC modules.
• Seamless Integration with i.MX 8M Plus and i.MX 95 – Toradex SMARC solutions leverage NXP’s i.MX 8 M Plus and i.MX 95 SoCs, delivering power efficiency and AI-ready performance.
• Secure and Reliable – With Secure Boot, over-the-air (OTA) updates, and LTS kernel support, Toradex ensures industrial-grade security and longevity.
• Containerized Workflows for AI & IoT – Support for Docker, ROS, and real-time Linux enables scalable AI, ML, and IoT applications.
• Strong Ecosystem & Developer Support – Toradex offers comprehensive documentation, developer tools, and dedicated support, accelerating time-to-market.
With Toradex’s Linux support for SMARC, developers get a scalable, secure, and high-performance solution for industrial, medical, and AI-driven applications.
Do you have a specific project or application in mind where you're considering SMARC? We can help with Free Compatibility Check and help you with quick time-to-market
For more information: https://www.toradex.com/computer-on-modules/smarc-arm-family
The Evolution of Meme Coins A New Era for Digital Currency ppt.pdfAbi john
Analyze the growth of meme coins from mere online jokes to potential assets in the digital economy. Explore the community, culture, and utility as they elevate themselves to a new era in cryptocurrency.
Dev Dives: Automate and orchestrate your processes with UiPath MaestroUiPathCommunity
This session is designed to equip developers with the skills needed to build mission-critical, end-to-end processes that seamlessly orchestrate agents, people, and robots.
📕 Here's what you can expect:
- Modeling: Build end-to-end processes using BPMN.
- Implementing: Integrate agentic tasks, RPA, APIs, and advanced decisioning into processes.
- Operating: Control process instances with rewind, replay, pause, and stop functions.
- Monitoring: Use dashboards and embedded analytics for real-time insights into process instances.
This webinar is a must-attend for developers looking to enhance their agentic automation skills and orchestrate robust, mission-critical processes.
👨🏫 Speaker:
Andrei Vintila, Principal Product Manager @UiPath
This session streamed live on April 29, 2025, 16:00 CET.
Check out all our upcoming Dev Dives sessions at https://community.uipath.com/dev-dives-automation-developer-2025/.
Technology Trends in 2025: AI and Big Data AnalyticsInData Labs
At InData Labs, we have been keeping an ear to the ground, looking out for AI-enabled digital transformation trends coming our way in 2025. Our report will provide a look into the technology landscape of the future, including:
-Artificial Intelligence Market Overview
-Strategies for AI Adoption in 2025
-Anticipated drivers of AI adoption and transformative technologies
-Benefits of AI and Big data for your business
-Tips on how to prepare your business for innovation
-AI and data privacy: Strategies for securing data privacy in AI models, etc.
Download your free copy nowand implement the key findings to improve your business.
Spark is a powerhouse for large datasets, but when it comes to smaller data workloads, its overhead can sometimes slow things down. What if you could achieve high performance and efficiency without the need for Spark?
At S&P Global Commodity Insights, having a complete view of global energy and commodities markets enables customers to make data-driven decisions with confidence and create long-term, sustainable value. 🌍
Explore delta-rs + CDC and how these open-source innovations power lightweight, high-performance data applications beyond Spark! 🚀
Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...Aqusag Technologies
In late April 2025, a significant portion of Europe, particularly Spain, Portugal, and parts of southern France, experienced widespread, rolling power outages that continue to affect millions of residents, businesses, and infrastructure systems.
Generative Artificial Intelligence (GenAI) in BusinessDr. Tathagat Varma
My talk for the Indian School of Business (ISB) Emerging Leaders Program Cohort 9. In this talk, I discussed key issues around adoption of GenAI in business - benefits, opportunities and limitations. I also discussed how my research on Theory of Cognitive Chasms helps address some of these issues
HCL Nomad Web – Best Practices und Verwaltung von Multiuser-Umgebungenpanagenda
Webinar Recording: https://www.panagenda.com/webinars/hcl-nomad-web-best-practices-und-verwaltung-von-multiuser-umgebungen/
HCL Nomad Web wird als die nächste Generation des HCL Notes-Clients gefeiert und bietet zahlreiche Vorteile, wie die Beseitigung des Bedarfs an Paketierung, Verteilung und Installation. Nomad Web-Client-Updates werden “automatisch” im Hintergrund installiert, was den administrativen Aufwand im Vergleich zu traditionellen HCL Notes-Clients erheblich reduziert. Allerdings stellt die Fehlerbehebung in Nomad Web im Vergleich zum Notes-Client einzigartige Herausforderungen dar.
Begleiten Sie Christoph und Marc, während sie demonstrieren, wie der Fehlerbehebungsprozess in HCL Nomad Web vereinfacht werden kann, um eine reibungslose und effiziente Benutzererfahrung zu gewährleisten.
In diesem Webinar werden wir effektive Strategien zur Diagnose und Lösung häufiger Probleme in HCL Nomad Web untersuchen, einschließlich
- Zugriff auf die Konsole
- Auffinden und Interpretieren von Protokolldateien
- Zugriff auf den Datenordner im Cache des Browsers (unter Verwendung von OPFS)
- Verständnis der Unterschiede zwischen Einzel- und Mehrbenutzerszenarien
- Nutzung der Client Clocking-Funktion
How Can I use the AI Hype in my Business Context?Daniel Lehner
𝙄𝙨 𝘼𝙄 𝙟𝙪𝙨𝙩 𝙝𝙮𝙥𝙚? 𝙊𝙧 𝙞𝙨 𝙞𝙩 𝙩𝙝𝙚 𝙜𝙖𝙢𝙚 𝙘𝙝𝙖𝙣𝙜𝙚𝙧 𝙮𝙤𝙪𝙧 𝙗𝙪𝙨𝙞𝙣𝙚𝙨𝙨 𝙣𝙚𝙚𝙙𝙨?
Everyone’s talking about AI but is anyone really using it to create real value?
Most companies want to leverage AI. Few know 𝗵𝗼𝘄.
✅ What exactly should you ask to find real AI opportunities?
✅ Which AI techniques actually fit your business?
✅ Is your data even ready for AI?
If you’re not sure, you’re not alone. This is a condensed version of the slides I presented at a Linkedin webinar for Tecnovy on 28.04.2025.
Noah Loul Shares 5 Steps to Implement AI Agents for Maximum Business Efficien...Noah Loul
Artificial intelligence is changing how businesses operate. Companies are using AI agents to automate tasks, reduce time spent on repetitive work, and focus more on high-value activities. Noah Loul, an AI strategist and entrepreneur, has helped dozens of companies streamline their operations using smart automation. He believes AI agents aren't just tools—they're workers that take on repeatable tasks so your human team can focus on what matters. If you want to reduce time waste and increase output, AI agents are the next move.
#StandardsGoals for 2025: Standards & certification roundup - Tech Forum 2025BookNet Canada
Book industry standards are evolving rapidly. In the first part of this session, we’ll share an overview of key developments from 2024 and the early months of 2025. Then, BookNet’s resident standards expert, Tom Richardson, and CEO, Lauren Stewart, have a forward-looking conversation about what’s next.
Link to recording, transcript, and accompanying resource: https://bnctechforum.ca/sessions/standardsgoals-for-2025-standards-certification-roundup/
Presented by BookNet Canada on May 6, 2025 with support from the Department of Canadian Heritage.
AI EngineHost Review: Revolutionary USA Datacenter-Based Hosting with NVIDIA ...SOFTTECHHUB
I started my online journey with several hosting services before stumbling upon Ai EngineHost. At first, the idea of paying one fee and getting lifetime access seemed too good to pass up. The platform is built on reliable US-based servers, ensuring your projects run at high speeds and remain safe. Let me take you step by step through its benefits and features as I explain why this hosting solution is a perfect fit for digital entrepreneurs.
6. Why is Docker Awesome?
◉It’s like a Virtual Machine, but much
lightweight.
◉Can up and run in few seconds.
◉Easy deploy, easy remove.
◉Clear separation of concerns.
◉Scale more easily
◉Get higher density and run more workloads
9. Virtual Machine
Impractical to store and
transfer.
If you want to replicate a VM
which used as a service,
you need full VM for each of
instance.
1 GB space for 1 instance =
1 TB for 1000 instance.
Some notes
Container
Share a bulk of space to
hundred or thousands of
containers, thanks to union
file system.
VMs are very large, which makes.
10. Virtual Machine
Full virtualized system
means allocate resource to
specific VM.
Heavier!
Some notes
Container
No need to create virtual
device. All container share
host, running on top op
same kernel but isolated.
Resource utilization
17. and spawned an Intermodal Shipping Container
Ecosystem
• 90% of all cargo now shipped in a standard container
• Order of magnitude reduction in cost and time to load and unload ships
• Massive reduction in losses due to theft or damage
• Huge reduction in freight cost as percent of final goods (from >25% to
<3%)
massive globalizations
• 5000 ships deliver 200M containers per year
18. Did you figure it out?
◉It’s like our code and environment to run the
code.
◉A problem in development and deployment.
19. Static website
Web frontend
User DB
Queue Analytics DB
Background workers
API endpoint
nginx 1.5 + modsecurity + openssl +
bootstrap 2
postgresql + pgv8 + v8
hadoop + hive + thrift + OpenJDK
Ruby + Rails + sass + Unicorn
Redis + redis-sentinel
Python 3.0 + celery + pyredis + libcurl + ffmpeg +
libopencv + nodejs + phantomjs
Python 2.7 + Flask + pyredis + celery + psycopg +
postgresql-client
Development VM
QA server
Public Cloud
Disaster recovery
Contributor’s laptop
Production Servers
Meet Code and EnvironmentMultiplicityofStacks
Multiplicityof
hardware
environments
Production Cluster
Customer Data Center
Doservicesandapps
interact
appropriately?
CanImigrate
smoothlyand
quickly?
20. Static website Web frontendUser DB Queue Analytics DB
Developm
ent VM
QA server Public Cloud Contributor’
s laptop
We need a shipping container
system for code
MultiplicityofStacks
Multiplicityof
hardware
environments
Production
Cluster
Customer
Data Center
Doservicesandapps
interact
appropriately?
CanImigrate
smoothlyandquickly
…that can be
manipulated using
standard operations and
run consistently on
virtually any hardware
platform
An engine that
enables any payload
to be encapsulated
as a lightweight,
portable, self-
sufficient
container…
21. Why containers matter?
Physical Containers Docker
Content Agnostic The same container can hold
almost any type of cargo
Can encapsulate any payload
and its dependencies
Hardware Agnostic Standard shape and interface
allow same container to
move from ship to train to
semi-truck to warehouse to
crane without being
modified or opened
Using operating system
primitives (e.g. LXC) can run
consistently on virtually any
hardware—VMs, bare metal,
openstack, public IAAS, etc.—
without modification
Content Isolation
and Interaction
No worry about anvils
crushing bananas.
Containers can be stacked
and shipped together
Resource, network, and
content isolation. Avoids
dependency hell
Automation Standard interfaces make it
easy to automate loading,
unloading, moving, etc.
Standard operations to run,
start, stop, commit, search,
etc. Perfect for devops: CI, CD,
autoscaling, hybrid clouds
22. Physical Containers Docker
Highly efficient No opening or modification,
quick to move between
waypoints
Lightweight, virtually no perf
or start-up penalty, quick to
move and manipulate
Separation of duties Shipper worries about inside
of box, carrier worries about
outside of box
Developer worries about code.
Ops worries about
infrastructure.
Physical Containers Docker
Highly efficient No opening or modification,
quick to move between
waypoints
Lightweight, virtually no perf
or start-up penalty, quick to
move and manipulate
Separation of duties Shipper worries about inside
of box, carrier worries about
outside of box
Developer worries about
code. Ops worries about
infrastructure.
24. For Developers
• Build once…run anywhere
• A clean, safe, hygienic and portable runtime environment for
your app.
• No worries about missing dependencies, packages and other
pain points during subsequent deployments.
• Run each app in its own isolated container, so you can run
various versions of libraries and other dependencies for each
app without worrying
• Automate testing, integration, packaging…anything you can
script
• Reduce/eliminate concerns about compatibility on different
platforms, either your own or your customers.
• Cheap, zero-penalty containers to deploy services? A VM
without the overhead of a VM? Instant replay and reset of image
snapshots? That’s the power of Docker
25. For Ops / Devops
• Configure once…run anything
• Make the entire lifecycle more efficient, consistent, and
repeatable
• Increase the quality of code produced by developers.
• Eliminate inconsistencies between development, test,
production, and customer environments
• Support segregation of duties
• Significantly improves the speed and reliability of continuous
deployment and continuous integration systems
• Because the containers are so lightweight, address significant
performance, costs, deployment, and portability issues normally
associated with VMs
29. Terminology
Image
Read only layer used to
build a container. They do
not change.
Container
Self contained runtime
environment using one or
more images. You can
commit your changes to a
container and create an
image.
Hub / Registry
Public or private servers
which act as repository
where pople can upload
images and share what
they made.
29
30. First Interaction
• xathrya@bluewyvern$ docker run -ti
ubuntu:12.04 /bin/bash
• $ cat /etc/issue
Ubuntu 12.04
We are running a container, open it in
interactive mode, and running a command
31. What docker really do?
• Downloaded the image from Hub / Registry
• Generated a new container
• Created a new file system
• Mounted a read/write layer
• Allocated network interface
• Setup IP
• Setup NAT
• Executed bash shell in container
33. Let’s Try An App
• $ docker run -d -P training/webapp python
app.py
• $ docker ps
You must see something like: 0.0.0.0:32768-
>5000/tcp
Go to web browser and enter url:
localhost:32768
Docker exposed port 5000 (default Python Flask
port) to our host in port 32768
• $ docker run –d –p 8080:5000 training/webapp
36. Actually two ways
◉Update container created from an image and
commit the results to a new image
◉Create Dockerfile
If you having experience with Vagrant, it’s
similar concept.
Dockerfile is a file to create and configure a
new image so it can be instanced as container.
44. Specially-designated directory within one or
more containers that bypasses the Union File
System. Useful for persistent or shared data.
• Initialized when container is created.
• Can be shared and reused among containers
• Changes to data volume will not be included
when you update image.
• Data volume persist even if container is
deleted.
45. • $ docker run -d -P --name web -v /webapp
training/webapp python app.py
mapped automagically chosen by docker engine
• $ docker run -d -P --name web -v
/src/webapp:/opt/webapp training/webapp
python.py
map /src/webapp (host) to /opt/webapp
(container)
49. Like Playing Lego
• Add container you need, like a component, by
their function.
• Every container has similar and uniform concept.
• Stack the container, to create complex
system.
• No need to worry about detail, focus and what you
need.
• Need to change a component? Just change it
• Upgrade version?
• Rollback?
50. Stack: MySQL
• $ docker run -p 3900:3306 --name mysql –e
MYSQL_ROOT_PASSWORD=toorsql -d
mysql:latest
• $ mysql -u root -p -h 127.0.0.1 –p 3900
• mysql> CREATE USER ‘php’@’%’ IDENTIFIED BY
‘pass’;
• mysql> GRANT ALL PRIVILEGES ON *.* TO
‘php’@’%’ WITH GRANT OPTION;
• mysql> FLUSH PRIVILEGES;
51. Stack: Apache (Dockerfile)
FROM ubuntu:12.04
RUN apt-get update
RUN apt-get install -y apache2
RUN apt-get install -y php5 php5-common php5-
cli php5-mysqli php5-curl
EXPOSE 80
CMD [“/usr/sbin/apache2ctl”, “-D”,
“FOREGROUND”]
55. DevOps and Modern
Day in Software
Engineering
Neet Dave the developer and Oscar the Operations
4
56. DevOps is
• Development + Operations
• Culture, movement, or practice that
emphasizes the collaboration and
communication of both software developers
and other IT professionals while automating
the process of software delivery and
infrastructure changes.
• Environment where building, testing, and
releasing software can happen rapidly,
frequently, and more reliably
57. Set of Toolchains
• Code – code development and review, continuous
integration tools
• Build – version control tools, code merging, build
status
• Test – test and results determine performance
• Package – artifact repository, application pre-
deployment staging
• Release – change management, release approvals,
release automation
• Configure – infrastructure configuration and
management
• Monitor – application performance monitoring
58. To name a few
• Docker (containerization)
• Jenkins (continuous integration)
• Puppet (infrastructure as code)
• Vagrant (virtualization platform)
59. Effectiveness
To practice DevOps effectively, software
application have to meet set of Architecture
Significant Requirements (ASRs)
• Deployability
• Modifiability
• Testability
• Monitorability
Most of time, microservice architectural style is
becoming standard for building continuous
deployed systems.
60. Three Ways Principle
• Systems Thinking
• Amplify Feedback Loops
• Culture of Continual Experimentation and
Learning
62. Continuous Integration
• Practice of Agile Development
• Developer or Team of Developer is given sub
task
• For large project it might have multiple teams
developing different tasks.
• At the end, all tasks must be integrated to
build whole application.
• CI force devs to integrate individual work with
each other as early as possible.
63. Continuous Delivery
• Step after integrating, deliver to next stage of
application delivery lifecycle.
• The goal is to get the new features that devs
created as soon as possible to QA and to
production.
• Not all integration should come to QA, only
good one at a time.
• In terms of functionality, stability, and other
NFSs
• In essence: practice of regularly delivering
application to QA and operations for
validation and potential release to customers.
64. Continuous Testing
• Process of executing automated tests
• Scope of testing:
• Validating bottom-up requirements
• Validating user stories to assessing system
requirement associated with overarching business
goals
• Object is provided by previous phase
• Give (fast) feedback to development
regarding the level of business risk in latest
build.
65. Continuous Monitoring
• Detect compliance and risk issues associated
with organization financial and operational
environment.
• Correct or replace weak or poorly designed
controls
67. Continuous Integration setup consists of
• Running unit test
• Compiling service
• Build Docker image that we run and deploy
• Pushing final image to Docker registry
Docker registry might be local repository.
https://docs.docker.com/registry/deploying/
68. Deployment might depends on infrastructure or
cloud provider. Few cloud providers support
Docker image:
• Amazon EC2 Container Service
• Digital Ocean
• Giant Swarm