Educating the public ... but don't tell them the wrong info

The Belgian media is covering the Wikileaks story like in every other country. One of the things on our national television news website that caught my attention was the spectacular title "IT Security Expert: Cyber war is actually very simple".

You can't hear the question to the IT security specialist but what he basically explains is a DDoS attack. What he explains is correct but I am quite disappointed in the journalist. I personally think that it is a good thing to make the public aware of what is happening in the world and how attacks are carried out but choosing this title was over the top.

Fun with SSL

I am working on a project where mutual authentication with SSL has to be done between a Apache mod_proxy and some proxy server at a third party.

I personally did not designed or built the system and after doing an upgrade of httpd one of the instances did not restart when I told it to. It went down and said SSL is already loaded ... fail.

The idea of this server is to listen to tcp/443 and based on the URI redirect to a virtual host running on a specific port. These virtual hosts do some mod_rewrite magic and inject the SSL certificate and then connect to the third party. According to the project manager this can only be done with mod_proxy and no other proxy would allow you to do this.

I tried to restart the other virtual hosts and they went down and up without any problems. So it was just the httpd listening on port 443 that was not coming up.

Since Google is your friend when you got an error message that basically just tells you "sorry, SSL is already in use". I looked at a couple of forum posts and it was pretty clear immediately that it had something to do with the http.conf file.

In the httpd.conf file there was an include directive to load all .conf files from a conf.d directory. So analyzing them one by one I figured out that one of them contained the instructions to load the mod_ssl.so and of course there was the mod_ssl configuration file which loads mod_ssl.so as well.

Once I commented out the lines in the other file everything was back up and running.

The RedHat Network

This week I was asked to upgrade RedHat Enterprise server for a customer. I personally use Ubuntu, and not being part of my company's linux group, it was totally new to me. The reason I blog about this is not because it was technically challenging but it took me quite some effort to figure out how it worked.

When you order a license at RedHat, you need to provide an e-mail address. In my case this was the one of the CIO of my customer. The next thing that happens is that the reseller (my company) receives an e-mail with the confirmation of the purchase and the customer receives an email with a link.

It is very important that the customer clicks this link and fills out the form. During this registration he must choose a customer name and password. Once the account is created you have to run the rhn_register command as root.

This takes you through a script where your server connects to the RHN asks for your customer name and password and gathers information about your system. Once your system is registered you can use the yum package manager to actually upgrade the system.

Bleachbit

Today I discovered the existance of bleachbit. Bleachbit is a nifty little tool that helps you clean up personal info in linux.

BruCon2010

This weekend it was BruCon again :) and just like last year it was a very nice con.

The first talk I went to see was the keynote "Memoirs of a Data Security Street Fighter" by Mikko Hypponen. I saw Mikko presenting at OWASP this year and I was not so happy about that presentation but this one was much better.

Next talk I went to see was "You Spent All That Money And You Still Got Owned..." by Joseph McCray. I went to see this talk before and it was worth watching it for a second time. Joe explains the things in a very comprehensive way. The talk was a little different and I personally liked it, not that it was better, but it was just a slightly different angle to explain it. But bottom line is still to quote him "fix your shit".

I went to a workshop by Didier Stevens. It was of course about pdf and he took us at a very nice tempo through a bunch of pdf's he prepared on a BackTrack4 VM. Bit by bit we learned to analyze them with the tools (pdfid and pdf-parser) he wrote. If you like to read about this, after BruCon he published a document about this on his blog.

In the afternoon I went to see Cyber[Crime|War] by Ian Amit. It was not a technical talk but it made you think, and I liked it.

Then it was Paul Asadoorian aka Paul from Pauldotcom his turn. I was eager to see his talk about Embedded System Hacking and his plot to take over the world. I've been listening to the Pauldotcom podcast from the very beginning and even in his presentation the world famous 'Bob' stories where present :). The content of the presentation was not that new if you listen to the podcast but still it was cool. Besides giving this presentation Paul also gave a nice presentation during the powerpoint karaoke (a game where you present a random deck of slides you have never seen before in you life).

There was a second workshop I took and that was Damn Vulnerable Web App by Ryan Dewhurst and ethicalhack3r. A nice way to get you in touch with all security problems of a web app. Personally, I think that it should become part of any school training where you make a website.

The last talk I went to see is Chris Nickerson's "top 5 ways to steal the company". I knew Chris from the Pauldotcom podcast. Chris is absolutely correct that companies don't care about how you can own their boxes. Management doesn't understand our technical mumbo-jambo and unless we are not changing our ways of presenting them what it means they will never listen to you.

The best lightning talk I saw was the one by Wicked Clown. Not only just for his cool leather jacket (with the image of a wicked clown on it), but also the RDP vulnerability he demonstrated.

Chris John Riley's totally pimped up his presentation about a tool he wrote in Python called UA-tester. Although his 5 minutes where up, it was amazing to see the difference in results switching between user agents. Something to definitely play around with.

Thanks to everybody involved, it was great.

Google Safebrowsing Webtest

Ever wondered how to check if a website has a record for being infected? Well Google can help you. When they scan the Internet for websites they scan also for malware. When you type in your browser:

http://google.com/safebrowsing/diagnostic?site=/

You will get a page back with how many pages where scanned and how much malware it found.

For facebook.com I got these results:

Of the 131,557 pages we have in the past 90 days on the site have been tested, have 31 page (s) without user consent malicious software downloaded and installed. The last time Google visited this site was on 08/08/2010. The last time suspicious content was found on this site was on 08/08/2010. Malicious software includes 132 scripting exploit (s), 3 trojan (s), 2 exploit (s)

It also mentions a bunch of domains like abeermahmoud.jeeran.com, albetaqa.jeeran.com, imageshack.us, rmooosh.net, textstream.co.za, freedesignlogo.com, and a bunch of URLs like facebook.com/dogswxeunck, facebook.com/pages/samra-iraq/imam-medhi-/85996831974/, and pdashmedia.com

I personally think it might be a good idea to have a look at which domains your users are going to, look it up and use this information to filter out the bad stuff.

Get a website as a pdf

http://pdfmyurl.com/ turns your url into a pdf.