Insecurity-In-Security version.2 (2011)

Apr 29, 20130 likes771 views

Abhishek Kumar

Presentation (version.2) from 2011 describing how Security mechanisms placed to secure us are insecure themselves.

““Hacker's WorkHacker's Work
isis a Form Ofa Form Of
ParticipationParticipation
in the Work ofin the Work of
God in CreationGod in Creation.”.”
-by,-by,
Father Antonio Sapadaro (Vatican)Father Antonio Sapadaro (Vatican)
Recent
New
s

Do You?Do You?
+ O.S. User Accounts
+ Browse Web
+ Use Web Services
+ Use Computer Networks Any Way
+ Have Any Form Of Binary Data

You Are Not Secure If You Don't...You Are Not Secure If You Don't...
+ Use Strong Passwords 'n Keep Them Safe
+ Browse Web In Safe Browsers
+ Use SSL-ified Web Services
+ Use Patched Name Servers
+ Keep Your Data Protected

You Are InSecure Even If You Did...You Are InSecure Even If You Did...

IInnSSecurityecurity
SSecurityecurity
IInn
Security is just maintained... it's never achieved.

First Some history from VersionFirst Some history from Version 11

Bypass Account ProtectionBypass Account Protection

Browsing <Unknown> WWWBrowsing <Unknown> WWW
[+] SMBEnum
|=+ using 'file ://', 'res ://', 'resource ://'
Say, if it gains success accessing
'file:///c:/oracle/ora81/bin/orclcontainer.bmp'
[+] ResTiming Attack
|=+ using 'res ://', 'resource ://' to execute
So, gains timing for different binaries &
Identify which exists

Defeating SSLDefeating SSL
[] “Signing Authority” field in Digital Certificates
[] Tricking SSL Libraries with NULL Mod Certificates
[] Online Certificate Revocation Policy {ResponseStatus=3, ResponseBytes='' || SSL}

Basis Of All NetworksBasis Of All Networks

DNSSEC ain't all GOODDNSSEC ain't all GOOD
[] Provides 'Origin Auth', 'Integrity
Protection', PKI & even Auth. Denial of Data
Existence
[] Still No 'Confidentiality' {basics of security}
AND CPU-flooding is possible due to exhaustive
cryptography
[] Variation of DNS Rebinding Attack
presented at BH2010 still affected network

Data Forensic HackersData Forensic Hackers
[] Data Carving (Imaging RAM, Dig O.S.)
[] Dig Information from Files
[] Timestomp, Zipbomb
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
[] Mining Network Traffic for Files/Sessions

Now Some Mystery for VersionNow Some Mystery for Version 22

Hash-Crack on SteroidsHash-Crack on Steroids
http://hashcat.net/oclhashcat/

'RSA' Theft & Threat'RSA' Theft & Threat
http://www.schneier.com/blog/archives/2011/03/rsa_security_in.html

Comodo Pwn3d CertSComodo Pwn3d CertS
Janam
Fadaye
Rahbar
http://www.wired.com/threatlevel/2011/03/comodo_hack/

OpenBSD 'n BackdoorsOpenBSD 'n Backdoors
[]10yrs back FBI consulted NETSEC, CTO Perry
[]Lotz of code commit by NETSEC developers
[]Few daz back, Perry's NDA expired with FBI
[]Alleged backdoors in IPSEC Stack
[]FreeBSD inherited lotz code from OpenBSD
http://marc.info/?l=openbsd-tech&m=129236621626462&w=2

Samsung Key-loG ConflictSamsung Key-loG Conflict
http://arstechnica.com/hardware/news/2011/03/samsung-laptop-keylogger-
almost-certainly-a-false-positive.ars

Who Is This Guy?Who Is This Guy?
Family Named: AbhishekKr
Friends Call: ABK
g33k Handle: aBionic {@Twitter, @LinkedIn, @Facebook}
Itweet : http://www.twitter.com/aBionic
iBlog: http://abhishekkr.wordpress.com
Security Enthusiast; Working for ThoughtWorks Inc.; OpenSource Lover
My Crime Is That Of CurosityMy Crime Is That Of Curosity
ANY QUESTIONS?ANY QUESTIONS?

How vulnerable are your systems after the first line of defense? Do attackers get a stronger foothold after each compromise? How valuable is the data your systems can leak? “Death Star” security describes a system that relies entirely on an outermost security layer and fails catastrophically when breached. As services multiply, they shouldn’t all run in a single, trusted virtual private cloud. Sharing secrets doesn’t scale either, as systems multiply and partners integrate with your product and users. David Strauss explores security methods strong enough to cross the public Internet, flexible enough to allow new services without altering existing systems, and robust enough to avoid single points of failure. David covers the basics of public key infrastructure (PKI), explaining how PKI uniquely supports security and high availability, and demonstrates how to deploy mutual authentication and encryption across a heterogeneous infrastructure, use capability-based security, and use federated identity to provide a uniform frontend experience while still avoiding monolithic backends. David also explores JSON Web Tokens as a solution to session woes, distributing user data and trust without sharing backend persistence. A good written summary of the key talking points: https://www.infoq.com/news/2016/04/oreilysacon-day-one

Security Basics For Developers KnowledgeSiva Sankar

Defense in Depth: Lessons Learned Securing 200,000 SitesPantheon

Have you ever heard: "HTTPS will slow down your site"? How about: "I'm too small of a website, no one will want to hack me."? All too often security misconceptions lead to security apathy. Join us as we debunk these security myths and more! We’ll start at the 10,000-foot level, reviewing common myths about secure development, then zoom in closer for a look at security best practices, concluding with a deep-dive into a few of the most effective attack mitigation strategies. With the battlescars to backup the information, our presenters will leave you with strategies to handle securing your project with confidence.

Web security at Meteor (Pivotal Labs)Emily Stark

The document discusses security in modern JavaScript applications and frameworks like Meteor. It outlines several security tools in Meteor including: 1) Separating code that runs on the client vs server, 2) Locking down client access to databases, 3) Using remote procedure calls (RPCs), 4) Validating user input to prevent MongoDB injections, and 5) Configuring browser security policies using the browser-policy package. The talk concludes that Meteor provides tools to help secure modern JavaScript apps by locking down client code, preventing database attacks, and configuring new browser security features.

Webinar: Securing your data - Mitigating the risks with MongoDBMongoDB

Meteor Meets MalloryEmily Stark

This document outlines Meteor's security model and best practices for securing Meteor apps. It discusses Meteor's principles of separating data and code and authenticating stateful connections. It warns about risks like cross-site scripting (XSS) and MongoDB injections. It recommends sanitizing untrusted URLs, CSS, and user input. It also suggests using the check package to validate method arguments and audit-argument-checks to detect issues.

Integrity protection for third-party JavaScriptFrancois Marier

Modern web applications depend on a lot of auxiliary scripts which are often hosted on third-party CDNs. Should an attacker be able to tamper with the files hosted on such a CDN, millions of sites could be compromised. Web developers need a way to guarantee the integrity of scripts hosted elsewhere. This is the motivation behind a new addition to the web platform being introduced by the W3C: sub-resource integrity (http://www.w3.org/TR/SRI/). Both Firefox and Chrome have initial implementations of this new specification and a few early adopters such as Github are currently evaluating this feature.

rsa_usa_2019_paula_januszkiewiczZuzannaKornecka

This document discusses credential security and storing identity. It defines credentials and describes where passwords and hashes are stored on Windows systems, such as the SAM database, LSA secrets, and cached credentials. It warns that credentials relying on keys stored in the registry are only as secure as offline access. The document demonstrates how to extract credentials from these locations and services like IIS. It recommends using a domain controller, gMSA, or MSA to avoid using administrative accounts when possible for more secure credential storage.

Architecting Secure and Compliant Applications with MongoDB MongoDB

High profile security breaches have become embarrassingly common, but ultimately avoidable. Now more than ever, database security is a critical component of any production application. In this talk we'll learn to secure your deployment in accordance with best practices and compliance regulations. We'll explore the MongoDB Enterprise features which ensure HIPAA and PCI compliance, and protect you against attack, data exposure and a damaged reputation.

NoSql InjectionNSConclave

This document summarizes a presentation on NoSQL injection given by Husseni Muzkkir. The presentation covered the differences between SQL and NoSQL databases, what NoSQL injection is and how it can be used to expose unauthorized information or modify data. It also described a NoSQL lab that was created with possible attack scenarios like authentication bypass, enumeration, data manipulation, and MongoDB injection. The presentation provided examples of insecure coding that could enable these attacks and discussed secure coding practices and a related CVE vulnerability.

Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...RootedCON

Los procedimientos relacionados con Respuesta a Incidentes y Análisis Forense son diferentes en la nube respecto a cuando se realizan en entornos tradicionales, locales. Veremos las diferencias entre el análisis forense digital tradicional y el relacionado con sistemas en la nube de AWS, Azure o Google Compute Platform. Cuando se trata de la nube y nos movemos en un entorno totalmente virtual nos enfrentamos a desafíos que son diferentes al mundo tradicional. Lo que antes era hardware, ahora es software. Con los proveedores de infraestructura en la nube trabajamos con APIs, creamos, eliminamos o modificamos cualquier recurso con una llamada a su API. Disponemos de balanceadores, servidores, routers, firewalls, bases de datos, WAFs, sistemas de cifrado y muchos recursos más a sin abrir una caja y sin tocar un cable. A golpe de comando. Es lo que conocemos como Infraestructura como código. Si lo puedes programar, lo puedes automatizar. ¿Como podemos aprovecharnos de ello desde el punto de vista de la respuesta a incidentes, análisis forense o incluso hardening automatizado?

Yihan Lian & Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]RootedCON

Peach is a smart and widely used fuzzer, which has lots of advantages like cross-platform, aware of file format, extend easily and so on. But when AFL fuzzer has appeared, peach seems to be out of date, since it doesn't have coverage feedback and run slowly. Due to peach is a flexible fuzzer framework and AFL is not, I extended peach with AFL advantages, making it more smarter.Just like AFL, I use LLVM Pass to add coverage feedback, with that I can see which mutation is interesting viz. explores new paths. The resultant effect is that the modified version is more effective.

MongoDB Security Introduction - PresentationHabileLabs

Container Security via Monitoring and Orchestration - Container Security SummitDavid Timothy Strauss

Security is a basic requirement of modern applications, and developers are increasingly using containers in their development work. In this presentation, we explore the basic components of secure design (preparation, detection, and containment), how containers facilitate that work today (verification), and how container orchestration ought to support models of the future, especially ones that are hard to roll manually (PKI).

May The Data Stay with U! Network Data Exfiltration Techniques - Brucon 2017.Leszek Mi?

Slides from workshop delivered at Brucon 2017 Conference in Gent, Belgium. Data exfiltration is the process of transmitting data from pwned or infected networks back to the attacker while trying to minimize detection. During this workshop (2 hours) we will go through different network exfiltration methods and techniques (DNS, ICMP, TCP, UDP, HTTP, RDP, Cloud-app based and others). I will explain how they work, how to run them and what differences between are. It is a highly interactive workshop (I have dozen short labs already prepared) where you will be guided through the use of a set of open source tools powered by a short-fast theory.

Security Features in MongoDB 2.4MongoDB

The document summarizes Spencer Brody's presentation on securing MongoDB implementations. It covers MongoDB's history of security features, authentication methods including password and external authentication, authorization roles, auditing capabilities, transport encryption using SSL, the MongoDB secure development lifecycle, and plans for future security improvements. Brody emphasized that MongoDB 2.4 provides significantly better security than prior versions through features like authentication, authorization roles, and SSL encryption.

PHP Experience 2016 - [Palestra] Json Web Token (JWT)iMasters

HTTPS, Here and NowPhilippe De Ryck

Apache mod security 3.1Hai Dinh Tuan

The document provides an overview of Apache Mod Security including regular expressions, rules usage, default actions, chained actions, persistent collections, transformation functions, and content validation. It discusses using regular expressions to match strings and define rules. It explains how to set default actions, chain rules together, and use persistent collections to store variables across transactions. Transformation functions and various validation techniques like validating byte ranges, DTDs, schemas, URL encoding, and UTF-8 encoding are also covered.

Adventures in Underland: Is encryption solid as a rock or a handful of dust?Paula Januszkiewicz

How to protect your business from Wannacry RansomwareKaspersky

Kaspersky Lab is teaming up with Comae Technologies to present an emergency webinar for businesses to help them understand and defend against the WannaCry ransomware. The malware has primarily affected business networks, and has claimed victims around the world in a wide range of industries. Juan Andres Guerrero-Saade, senior security researcher in Kaspersky Lab’s Global Research and Analysis Team, will be joined by Matt Suiche from Comae Technologies to present the very latest information on how the ransomware breaches defenses and the subsequent stages of attack. They will independently explain how organizations can determine if they have been infected and the critical actions they need to take to secure networks and endpoints against this threat. Full blog: https://blog.kaspersky.com/wannacry-windows-update/16593/

Real world blockchainsDmitry Meshkov

Top 10 Web Hacks 2013Matt Johansen

This document summarizes the top ten web hacking techniques of 2013 as identified by WhiteHat Security. It provides brief descriptions of each technique, including Mutation XSS, BREACH, Pixel Perfect Timing Attacks with HTML5, Lucky 13, weaknesses in the RC4 encryption algorithm, XML Out of Band Data Retrieval, creating a million browser botnet, large-scale detection of DOM-based XSS, Tor Hidden Service passive decloaking, and HTML5 hard disk filler attacks. The document also provides background on the individuals and organization presenting this information.

VaultJean-Philippe Bélanger

Vault is a tool for securely accessing secrets. It provides encryption of secrets at rest and controls access through authentication, authorization, and auditing. Keys are rotated automatically and secrets have time-to-live limits. Vault can be used for secrets like API keys, passwords, certificates and more. It supports multiple backends for secret storage including Consul, DynamoDB, and filesystem. Vault has built-in authentication methods and is highly available through replication across multiple nodes.

WannaCry / Wannacrypt RansomwareAyoub R.

Webinar Slides: Become a MongoDB DBA (if you’re really a MySQL user)Severalnines

So, maybe you’ve been working with MySQL for a while and are now being asked to also properly maintain one or more MongoDB instances. It is not uncommon that MySQL DBAs, developers, network/system administrators or DevOps folks with general backgrounds, find themselves in this situation at some point in time. In fact, with more organisations operating polyglot environments, it’s starting to become commonplace. With that said, we’d like to introduce a new webinar series: ‘How to Become a MongoDB DBA’ to answer the question: ‘what does a MongoDB DBA do’? In the space of three webinars, we will walk you through the most important tasks a MongoDB DBA routinely goes through and provide you with options on how to best complete these tasks. In this initial webinar of the series, we will go beyond the deployment phase and show you how you can automate tasks, how to monitor a cluster and how to manage MongoDB; whilst also automating and managing your MySQL and/or PostgreSQL installations. Agenda Introduction to becoming a MongoDB DBA Installing & configuring MongoDB What to monitor and how How to perform backups Live Demo Speaker Art van Scheppingen is a Senior Support Engineer at Severalnines. He’s a pragmatic MySQL and Database expert with over 15 years experience in web development. He previously worked at Spil Games as Head of Database Engineering, where he kept a broad vision upon the whole database environment: from MySQL to Couchbase, Vertica to Hadoop and from Sphinx Search to SOLR. He regularly presents his work and projects at various conferences (Percona Live, FOSDEM) and related meetups.

WPNYC: Moving your site to HTTPSPaul Schreiber

Many websites — from Wikipedia to Reddit to the Washington Post — are encrypting all of their web traffic to protect their readers' privacy by using SSL certificates are directing their traffic over HTTPS. Besides the obvious security advantages, webmasters have another reason: Google is using HTTPS as a ranking signal. At this meetup, we'll talk about what this all means (benefits, downsides) and problems encountered moving to HTTPS (and how they solved them).

PLNOG 5: Eric Ziegast, Zbigniew Jasinski - DNSSECPROIDEA

This document discusses DNSSEC (Domain Name System Security Extensions) and its importance for securing the Domain Name System (DNS) infrastructure. It provides an overview of vulnerabilities like cache poisoning attacks that DNSSEC aims to address. It highlights how attitudes towards DNSSEC deployment have changed rapidly in recent years. The document outlines several cache poisoning attacks like Kaminsky's 2008 attack that exploited vulnerabilities in DNS resolvers and spurred improved security. It provides resources for learning about and testing DNSSEC implementations to help secure domains. Overall, the document makes a case for DNSSEC as a critical long-term solution to DNS security issues.

Dirty Little Secrets They Didn't Teach You In Pentest Class v2Rob Fuller

More Related Content

What's hot (20)

rsa_usa_2019_paula_januszkiewiczZuzannaKornecka

Architecting Secure and Compliant Applications with MongoDB MongoDB

NoSql InjectionNSConclave

Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...RootedCON

Yihan Lian & Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]RootedCON

MongoDB Security Introduction - PresentationHabileLabs

Container Security via Monitoring and Orchestration - Container Security SummitDavid Timothy Strauss

May The Data Stay with U! Network Data Exfiltration Techniques - Brucon 2017.Leszek Mi?

Security Features in MongoDB 2.4MongoDB

PHP Experience 2016 - [Palestra] Json Web Token (JWT)iMasters

HTTPS, Here and NowPhilippe De Ryck

Apache mod security 3.1Hai Dinh Tuan

Adventures in Underland: Is encryption solid as a rock or a handful of dust?Paula Januszkiewicz

How to protect your business from Wannacry RansomwareKaspersky

Real world blockchainsDmitry Meshkov

Top 10 Web Hacks 2013Matt Johansen

VaultJean-Philippe Bélanger

WannaCry / Wannacrypt RansomwareAyoub R.

Webinar Slides: Become a MongoDB DBA (if you’re really a MySQL user)Severalnines

WPNYC: Moving your site to HTTPSPaul Schreiber

rsa_usa_2019_paula_januszkiewiczZuzannaKornecka

Architecting Secure and Compliant Applications with MongoDB MongoDB

NoSql InjectionNSConclave

Toni de la Fuente - Automate or die! How to survive to an attack in the Cloud...RootedCON

Yihan Lian & Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]RootedCON

MongoDB Security Introduction - PresentationHabileLabs

Container Security via Monitoring and Orchestration - Container Security SummitDavid Timothy Strauss

May The Data Stay with U! Network Data Exfiltration Techniques - Brucon 2017.Leszek Mi?

Security Features in MongoDB 2.4MongoDB

PHP Experience 2016 - [Palestra] Json Web Token (JWT)iMasters

HTTPS, Here and NowPhilippe De Ryck

Apache mod security 3.1Hai Dinh Tuan

Adventures in Underland: Is encryption solid as a rock or a handful of dust?Paula Januszkiewicz

How to protect your business from Wannacry RansomwareKaspersky

Real world blockchainsDmitry Meshkov

Top 10 Web Hacks 2013Matt Johansen

VaultJean-Philippe Bélanger

WannaCry / Wannacrypt RansomwareAyoub R.

Webinar Slides: Become a MongoDB DBA (if you’re really a MySQL user)Severalnines

WPNYC: Moving your site to HTTPSPaul Schreiber

Similar to Insecurity-In-Security version.2 (2011) (20)

PLNOG 5: Eric Ziegast, Zbigniew Jasinski - DNSSECPROIDEA

Dirty Little Secrets They Didn't Teach You In Pentest Class v2Rob Fuller

Dirty Little Secrets They Didn't Teach You In Pentest Class v2Chris Gates

Protecting Your organization from WannaCry RansomwareQuick Heal Technologies Ltd.

Protecting Customer Confidential InformationWilliam McBorrough

This document discusses protecting customer confidential information and cybersecurity for small and medium-sized businesses. It outlines common data breaches, regulations around privacy, and strategies for securing data through technical controls and policies for people, including restricting access, encryption, training, and disposal of old data. The presentation emphasizes assessing risks and building security into daily operations, not as an extra task.

Wi-Foo Ninjitsu ExploitationPrathan Phongthiproek

ExpertsLiveEurope The New Era Of Endpoint SecurityAlexander Benoit

Cyber Security & Defense is the emerging topic of the IT industry these days. A secure environment is no longer just a well-maintained firewall or a well-managed network. Rather, it is made up of several layers. However, most companies are „reactive“ instead of „proactive“, or neither, when it comes to securing their IT environments and detecting security breaches. In addition to this, the product portfolio and the security market is changing rapidly, and these changes make our jobs as IT Professionals significantly more difficult. But how can we deal with this challenge? In my session I will take a look into supposed “obvious“ security threats and how the Microsoft Cyber security stack can help to detect attackers and threats that have evaded our defenses.

Enumerating Windows UsersUTD Computer Security Group

This document outlines how to enumerate users on Windows systems by establishing a null SMB session and using tools like sid2user and user2sid. It discusses how newer Windows versions try to prevent this by restricting anonymous access but that vulnerabilities still exist. It recommends blocking ports at the firewall and disabling anonymous SID/name translation and enumeration in the local security policy to prevent user enumeration via these methods.

hackcon2013-Dirty Little Secrets They Didn't Teach You In Pentesting Class v2Chris Gates

This document discusses 10 different ways to execute code remotely on Windows systems, including native Windows tools like Sysinternals PSExec, methods in Metasploit like PSExec and PSExec-MOF, and other techniques like WMI, PowerShell, and RemCom. Each method is briefly outlined with its positives and negatives. For example, PSExec leaves the PSEXESVC service running but never needs updating, while Metasploit PSExec supports pass-the-hash but some antiviruses may flag the service binary. The document provides an overview of common remote code execution options for pentesters and their relative tradeoffs.

Starwest 2008Caleb Sima

Caleb Sima is the founder and CTO of SPI Dynamics, a security company. He has over 11 years of experience in security and is a frequent speaker on topics like exploiting web security vulnerabilities and hacking web applications. The document discusses various web application vulnerabilities like SQL injection, cross-site scripting, and session hijacking, and provides examples of exploiting these vulnerabilities on real websites.

SSL/TLS for Mortals (JAX DE 2018)Maarten Mulders

Using SSL/TLS the right way is often a big hurdle for developers. We prefer to have that one colleague perform "something with certificates", because he/she knows how that works. But what if "that one colleague" is enjoying vacation and something goes wrong with the certificates? In this session we’ll take a close look at secure communication at the transport level. Starting with what exactly SSL and TLS is, we’ll dive into public/private keys, and signing. We’ll also learn what all this has to do with an unfortunate Dutch notary. Of course, there’ll be plenty of practical tips and tricks as well as demos. Attend this session to become "that one colleague"!

Automate or die! Rootedcon 2017Toni de la Fuente

Jon McCoy - AppSec-USA-2014 Hacking C#(.NET) Applications:Defend by Designjonmccoy

Da APK al Golden TicketGiuseppe Trotta

Kali Linux - FalconerTony Godfrey

Tony Godfrey gave a presentation on Kali Linux at the Ohio HTCIA 2014 Spring Conference. Kali Linux is a Debian-derived Linux distribution designed for digital forensics and penetration testing. It contains many security tools for information gathering, vulnerability analysis, password attacks, wireless attacks, exploitation tools, and more. The presentation demonstrated how to use various command line tools in Kali Linux like nmap, nmap, rlogin, and showed how to use Metasploit within msfconsole.

Breaking the cyber kill chain!Nahidul Kibria

SSL/TLS for Mortals (Devoxx FR 2018)Maarten Mulders

Using SSL/TLS the right way is often a big hurdle for developers. We prefer to have that one colleague perform "something with certificates", because he/she knows how that works. But what if "that one colleague" is enjoying vacation and something goes wrong with the certificates? In this session we'll take a close look at secure communication at the transport level. Starting with what exactly SSL and TLS is, we'll dive into public/private keys, and signing. We'll also learn what all this has to do with an unfortunate Dutch notary. Of course, there'll be plenty of practical tips & trics, as well as demo's. Attend this session to become "that one colleague"!

Secure Gate / Reverse Proxy - WAF 1ere génération / DatelecSylvain Maret

Secure Gate is a web-based solution that provides secure remote access to internal resources using strong encryption and authentication over the internet. It acts as a reverse proxy, sitting within the firewall, to allow authenticated and encrypted access to internal servers from any internet browser without requiring custom client software. It supports SSL/TLS to encrypt communications and offers authentication methods like basic authentication, external authentication via RADIUS/LDAP, and client-side certificate authentication for high security requirements.

(In) Security graph database in real world Miguel Hernández Boza

Graph databases are an "emerging" technology useful in the field of cybersecurity, especially in the detection of new threats based on the correlation of diverse sources of information. However, insufficient attention has been spent in terms of its security. In this talk, it will be reviewed the state of art of this kind of databases and its desing security problems, specially for Neo4J and OrientDB. We will release a hacking tool for testing and detecting graph databases and will show several examples of information leak in the real world. Tool: https://github.com/grafscan/GraFScaN

Django cryptographyErik LaBianca

The document discusses best practices for securely implementing cryptography and discusses common cryptography algorithms and implementations such as hashing, symmetric encryption, asymmetric encryption, and password hashing. It emphasizes using proven implementations like those in Django and OpenSSL and enabling HTTPS to securely transmit data. The document also cautions that securely managing cryptographic keys is critical for encryption to provide security.

PLNOG 5: Eric Ziegast, Zbigniew Jasinski - DNSSECPROIDEA

Dirty Little Secrets They Didn't Teach You In Pentest Class v2Rob Fuller

Dirty Little Secrets They Didn't Teach You In Pentest Class v2Chris Gates

Protecting Your organization from WannaCry RansomwareQuick Heal Technologies Ltd.

Protecting Customer Confidential InformationWilliam McBorrough

Wi-Foo Ninjitsu ExploitationPrathan Phongthiproek

ExpertsLiveEurope The New Era Of Endpoint SecurityAlexander Benoit

Enumerating Windows UsersUTD Computer Security Group

hackcon2013-Dirty Little Secrets They Didn't Teach You In Pentesting Class v2Chris Gates

Starwest 2008Caleb Sima

SSL/TLS for Mortals (JAX DE 2018)Maarten Mulders

Automate or die! Rootedcon 2017Toni de la Fuente

Jon McCoy - AppSec-USA-2014 Hacking C#(.NET) Applications:Defend by Designjonmccoy

Da APK al Golden TicketGiuseppe Trotta

Kali Linux - FalconerTony Godfrey

Breaking the cyber kill chain!Nahidul Kibria

SSL/TLS for Mortals (Devoxx FR 2018)Maarten Mulders

Secure Gate / Reverse Proxy - WAF 1ere génération / DatelecSylvain Maret

(In) Security graph database in real world Miguel Hernández Boza

Django cryptographyErik LaBianca

More from Abhishek Kumar (16)

DevOps?!@Abhishek Kumar

xml-motor ~ What,Why,HowAbhishek Kumar

XML-MotorAbhishek Kumar

DevOps with Sec-opsAbhishek Kumar

Syslog Centralization Logging with Windows ~ A techXpress GuideAbhishek Kumar

Squid for Load-Balancing & Cache-Proxy ~ A techXpress GuideAbhishek Kumar

Ethernet Bonding for Multiple NICs on Linux ~ A techXpress GuideAbhishek Kumar

Solaris Zones (native & lxbranded) ~ A techXpress GuideAbhishek Kumar

An Express Guide ~ "dummynet" for tweaking network latencies & bandwidthAbhishek Kumar

An Express Guide ~ Zabbix for IT Monitoring Abhishek Kumar

Zabbix is an open source infrastructure monitoring solution. It has two main parts - the Zabbix server and client. The document provides step-by-step instructions to install and configure Zabbix on a Linux server. This includes installing prerequisites like NTP, PHP, MySQL, compiling and installing the Zabbix server and client, configuring the database, web interface, and more. Finally, it discusses initial configuration steps after installation like securing login credentials.

An Express Guide ~ Cacti for IT Infrastructure Monitoring & GraphingAbhishek Kumar

An Express Guide ~ SNMP for Secure Rremote Resource MonitoringAbhishek Kumar

Presentation on "XSS Defeating Concept in (secure)SiteHoster" : 'nullcon-2011'Abhishek Kumar

XSS Defeating Concept - Part 2Abhishek Kumar

XSS Defeating Trick ~=ABK=~ WhitePaperAbhishek Kumar

This document proposes a technique to prevent XSS attacks by modifying how browsers render <script> tags inserted into the <body> of an HTML document. The technique involves the web server transforming the page generated by the application server by wrapping the <body> contents in a <script> tag. This causes any <script> tags in the original <body> to not execute while preserving those in the <head>. The goal is to enable security without requiring input validation by web developers. A proof-of-concept implementation demonstrates how this modification disables injected malicious scripts.

FreeSWITCH on RedHat, Fedora, CentOSAbhishek Kumar

DevOps?!@Abhishek Kumar

xml-motor ~ What,Why,HowAbhishek Kumar

XML-MotorAbhishek Kumar

DevOps with Sec-opsAbhishek Kumar

Syslog Centralization Logging with Windows ~ A techXpress GuideAbhishek Kumar

Squid for Load-Balancing & Cache-Proxy ~ A techXpress GuideAbhishek Kumar

Ethernet Bonding for Multiple NICs on Linux ~ A techXpress GuideAbhishek Kumar

Solaris Zones (native & lxbranded) ~ A techXpress GuideAbhishek Kumar

An Express Guide ~ "dummynet" for tweaking network latencies & bandwidthAbhishek Kumar

An Express Guide ~ Zabbix for IT Monitoring Abhishek Kumar

An Express Guide ~ Cacti for IT Infrastructure Monitoring & GraphingAbhishek Kumar

An Express Guide ~ SNMP for Secure Rremote Resource MonitoringAbhishek Kumar

Presentation on "XSS Defeating Concept in (secure)SiteHoster" : 'nullcon-2011'Abhishek Kumar

XSS Defeating Concept - Part 2Abhishek Kumar

XSS Defeating Trick ~=ABK=~ WhitePaperAbhishek Kumar

FreeSWITCH on RedHat, Fedora, CentOSAbhishek Kumar

Recently uploaded (20)

Manifest Pre-Seed Update | A Humanoid OEM Deeptech In Francechb3

Generative Artificial Intelligence (GenAI) in BusinessDr. Tathagat Varma

Increasing Retail Store Efficiency How can Planograms Save Time and Money.pptxAnoop Ashok

UiPath Community Berlin: Orchestrator API, Swagger, and Test Manager APIUiPathCommunity

Join this UiPath Community Berlin meetup to explore the Orchestrator API, Swagger interface, and the Test Manager API. Learn how to leverage these tools to streamline automation, enhance testing, and integrate more efficiently with UiPath. Perfect for developers, testers, and automation enthusiasts! 📕 Agenda Welcome & Introductions Orchestrator API Overview Exploring the Swagger Interface Test Manager API Highlights Streamlining Automation & Testing with APIs (Demo) Q&A and Open Discussion Perfect for developers, testers, and automation enthusiasts! 👉 Join our UiPath Community Berlin chapter: https://community.uipath.com/berlin/ This session streamed live on April 29, 2025, 18:00 CET. Check out all our upcoming UiPath Community sessions at https://community.uipath.com/events/.

Mobile App Development Company in Saudi ArabiaSteve Jonas

EmizenTech is a globally recognized software development company, proudly serving businesses since 2013. With over 11+ years of industry experience and a team of 200+ skilled professionals, we have successfully delivered 1200+ projects across various sectors. As a leading Mobile App Development Company In Saudi Arabia we offer end-to-end solutions for iOS, Android, and cross-platform applications. Our apps are known for their user-friendly interfaces, scalability, high performance, and strong security features. We tailor each mobile application to meet the unique needs of different industries, ensuring a seamless user experience. EmizenTech is committed to turning your vision into a powerful digital product that drives growth, innovation, and long-term success in the competitive mobile landscape of Saudi Arabia.

Semantic Cultivators : The Critical Future Role to Enable AIartmondano

Splunk Security Update | Public Sector Summit Germany 2025Splunk

TrsLabs - Fintech Product & Business ConsultingTrs Labs

Hybrid Growth Mandate Model with TrsLabs Strategic Investments, Inorganic Growth, Business Model Pivoting are critical activities that business don't do/change everyday. In cases like this, it may benefit your business to choose a temporary external consultant. An unbiased plan driven by clearcut deliverables, market dynamics and without the influence of your internal office equations empower business leaders to make right choices. Getting things done within a budget within a timeframe is key to Growing Business - No matter whether you are a start-up or a big company Talk to us & Unlock the competitive advantage

The Evolution of Meme Coins A New Era for Digital Currency ppt.pdfAbi john

#StandardsGoals for 2025: Standards & certification roundup - Tech Forum 2025BookNet Canada

Book industry standards are evolving rapidly. In the first part of this session, we’ll share an overview of key developments from 2024 and the early months of 2025. Then, BookNet’s resident standards expert, Tom Richardson, and CEO, Lauren Stewart, have a forward-looking conversation about what’s next. Link to recording, transcript, and accompanying resource: https://bnctechforum.ca/sessions/standardsgoals-for-2025-standards-certification-roundup/ Presented by BookNet Canada on May 6, 2025 with support from the Department of Canadian Heritage.

SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdfPrecisely

2025-05-Q4-2024-Investor-Presentation.pptxSamuele Fogagnolo

Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...Aqusag Technologies

Dev Dives: Automate and orchestrate your processes with UiPath MaestroUiPathCommunity

This session is designed to equip developers with the skills needed to build mission-critical, end-to-end processes that seamlessly orchestrate agents, people, and robots. 📕 Here's what you can expect: - Modeling: Build end-to-end processes using BPMN. - Implementing: Integrate agentic tasks, RPA, APIs, and advanced decisioning into processes. - Operating: Control process instances with rewind, replay, pause, and stop functions. - Monitoring: Use dashboards and embedded analytics for real-time insights into process instances. This webinar is a must-attend for developers looking to enhance their agentic automation skills and orchestrate robust, mission-critical processes. 👨‍🏫 Speaker: Andrei Vintila, Principal Product Manager @UiPath This session streamed live on April 29, 2025, 16:00 CET. Check out all our upcoming Dev Dives sessions at https://community.uipath.com/dev-dives-automation-developer-2025/.

tecnologias de las primeras civilizaciones.pdffjgm517

Rusty Waters: Elevating Lakehouses Beyond Sparkcarlyakerly1

Spark is a powerhouse for large datasets, but when it comes to smaller data workloads, its overhead can sometimes slow things down. What if you could achieve high performance and efficiency without the need for Spark? At S&P Global Commodity Insights, having a complete view of global energy and commodities markets enables customers to make data-driven decisions with confidence and create long-term, sustainable value. 🌍 Explore delta-rs + CDC and how these open-source innovations power lightweight, high-performance data applications beyond Spark! 🚀

Noah Loul Shares 5 Steps to Implement AI Agents for Maximum Business Efficien...Noah Loul

Artificial intelligence is changing how businesses operate. Companies are using AI agents to automate tasks, reduce time spent on repetitive work, and focus more on high-value activities. Noah Loul, an AI strategist and entrepreneur, has helped dozens of companies streamline their operations using smart automation. He believes AI agents aren't just tools—they're workers that take on repeatable tasks so your human team can focus on what matters. If you want to reduce time waste and increase output, AI agents are the next move.

Build Your Own Copilot & Agents For DevsBrian McKeiver

AI and Data Privacy in 2025: Global TrendsInData Labs

In this infographic, we explore how businesses can implement effective governance frameworks to address AI data privacy. Understanding it is crucial for developing effective strategies that ensure compliance, safeguard customer trust, and leverage AI responsibly. Equip yourself with insights that can drive informed decision-making and position your organization for success in the future of data privacy. This infographic contains: -AI and data privacy: Key findings -Statistics on AI data privacy in the today’s world -Tips on how to overcome data privacy challenges -Benefits of AI data security investments. Keep up-to-date on how AI is reshaping privacy standards and what this entails for both individuals and organizations.

Quantum Computing Quick Research Guide by Arthur MorganArthur Morgan

This is a Quick Research Guide (QRG). QRGs include the following: - A brief, high-level overview of the QRG topic. - A milestone timeline for the QRG topic. - Links to various free online resource materials to provide a deeper dive into the QRG topic. - Conclusion and a recommendation for at least two books available in the SJPL system on the QRG topic. QRGs planned for the series: - Artificial Intelligence QRG - Quantum Computing QRG - Big Data Analytics QRG - Spacecraft Guidance, Navigation & Control QRG (coming 2026) - UK Home Computing & The Birth of ARM QRG (coming 2027) Any questions or comments? - Please contact Arthur Morgan at [email protected]. 100% human made.

Manifest Pre-Seed Update | A Humanoid OEM Deeptech In Francechb3

Generative Artificial Intelligence (GenAI) in BusinessDr. Tathagat Varma

Increasing Retail Store Efficiency How can Planograms Save Time and Money.pptxAnoop Ashok

UiPath Community Berlin: Orchestrator API, Swagger, and Test Manager APIUiPathCommunity

Mobile App Development Company in Saudi ArabiaSteve Jonas

Semantic Cultivators : The Critical Future Role to Enable AIartmondano

Splunk Security Update | Public Sector Summit Germany 2025Splunk

TrsLabs - Fintech Product & Business ConsultingTrs Labs

The Evolution of Meme Coins A New Era for Digital Currency ppt.pdfAbi john

#StandardsGoals for 2025: Standards & certification roundup - Tech Forum 2025BookNet Canada

SAP Modernization: Maximizing the Value of Your SAP S/4HANA Migration.pdfPrecisely

2025-05-Q4-2024-Investor-Presentation.pptxSamuele Fogagnolo

Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...Aqusag Technologies

Dev Dives: Automate and orchestrate your processes with UiPath MaestroUiPathCommunity

tecnologias de las primeras civilizaciones.pdffjgm517

Rusty Waters: Elevating Lakehouses Beyond Sparkcarlyakerly1

Noah Loul Shares 5 Steps to Implement AI Agents for Maximum Business Efficien...Noah Loul

Build Your Own Copilot & Agents For DevsBrian McKeiver

AI and Data Privacy in 2025: Global TrendsInData Labs

Quantum Computing Quick Research Guide by Arthur MorganArthur Morgan

Insecurity-In-Security version.2 (2011)

1. ““Hacker's WorkHacker's Work isis a Form Ofa Form Of ParticipationParticipation in the Work ofin the Work of God in CreationGod in Creation.”.” -by,-by, Father Antonio Sapadaro (Vatican)Father Antonio Sapadaro (Vatican) Recent New s

2. Do You?Do You? + O.S. User Accounts + Browse Web + Use Web Services + Use Computer Networks Any Way + Have Any Form Of Binary Data

3. You Are Not Secure If You Don't...You Are Not Secure If You Don't... + Use Strong Passwords 'n Keep Them Safe + Browse Web In Safe Browsers + Use SSL-ified Web Services + Use Patched Name Servers + Keep Your Data Protected

4. You Are InSecure Even If You Did...You Are InSecure Even If You Did...

5. IInnSSecurityecurity SSecurityecurity IInn Security is just maintained... it's never achieved.

6. First Some history from VersionFirst Some history from Version 11

7. O.S. User AccountsO.S. User Accounts

8. Bypass Account ProtectionBypass Account Protection

9. Vaccinated BrowsersVaccinated Browsers

10. Browsing <Unknown> WWWBrowsing <Unknown> WWW [+] SMBEnum |=+ using 'file ://', 'res ://', 'resource ://' Say, if it gains success accessing 'file:///c:/oracle/ora81/bin/orclcontainer.bmp' [+] ResTiming Attack |=+ using 'res ://', 'resource ://' to execute So, gains timing for different binaries & Identify which exists

11. Protector of AllProtector of All

12. Defeating SSLDefeating SSL [] “Signing Authority” field in Digital Certificates [] Tricking SSL Libraries with NULL Mod Certificates [] Online Certificate Revocation Policy {ResponseStatus=3, ResponseBytes='' || SSL}

13. Basis Of All NetworksBasis Of All Networks

14. DNSSEC ain't all GOODDNSSEC ain't all GOOD [] Provides 'Origin Auth', 'Integrity Protection', PKI & even Auth. Denial of Data Existence [] Still No 'Confidentiality' {basics of security} AND CPU-flooding is possible due to exhaustive cryptography [] Variation of DNS Rebinding Attack presented at BH2010 still affected network

15. Data ForensicsData Forensics

16. Data Forensic HackersData Forensic Hackers [] Data Carving (Imaging RAM, Dig O.S.) [] Dig Information from Files [] Timestomp, Zipbomb -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- [] Mining Network Traffic for Files/Sessions

17. Now Some Mystery for VersionNow Some Mystery for Version 22

18. Hash-Crack on SteroidsHash-Crack on Steroids http://hashcat.net/oclhashcat/

19. 'RSA' Theft & Threat'RSA' Theft & Threat http://www.schneier.com/blog/archives/2011/03/rsa_security_in.html

20. Comodo Pwn3d CertSComodo Pwn3d CertS Janam Fadaye Rahbar http://www.wired.com/threatlevel/2011/03/comodo_hack/

21. OpenBSD 'n BackdoorsOpenBSD 'n Backdoors []10yrs back FBI consulted NETSEC, CTO Perry []Lotz of code commit by NETSEC developers []Few daz back, Perry's NDA expired with FBI []Alleged backdoors in IPSEC Stack []FreeBSD inherited lotz code from OpenBSD http://marc.info/?l=openbsd-tech&m=129236621626462&w=2

22. Samsung Key-loG ConflictSamsung Key-loG Conflict http://arstechnica.com/hardware/news/2011/03/samsung-laptop-keylogger- almost-certainly-a-false-positive.ars

23. Who Is This Guy?Who Is This Guy? Family Named: AbhishekKr Friends Call: ABK g33k Handle: aBionic {@Twitter, @LinkedIn, @Facebook} Itweet : http://www.twitter.com/aBionic iBlog: http://abhishekkr.wordpress.com Security Enthusiast; Working for ThoughtWorks Inc.; OpenSource Lover My Crime Is That Of CurosityMy Crime Is That Of Curosity ANY QUESTIONS?ANY QUESTIONS?

Insecurity-In-Security version.2 (2011)

Recommended

More Related Content

What's hot (20)

Similar to Insecurity-In-Security version.2 (2011) (20)

More from Abhishek Kumar (16)

Recently uploaded (20)

Insecurity-In-Security version.2 (2011)