Una de las asignaturas de las que más disfruté en la universidad fue la de sistemas operativos. Es una de esas clases en la que aprendes, en gran medida, los pilares de los sistemas actuales.

Aunque crear un sistema operativo desde cero sea algo intimidante, no quiere decir que tu no puedas o debería intentar crear uno.

Operating System: From 0 to 1, es un libro electrónico (PDF) que te ayudará a crear tu propio sistema operativo. El libro está divido en tres partes. Las dos primeras están completas, a excepción de un capítulo de la primera parte, que está casi completo. La tercera parte aunque aún no está completa, no es esencial para poder crear algo funcional, esta parte está enfocada más en la expansión de la base, la cual está cubierta en las dos primeras partes del libro.

Escena de la película “2001 Una Odisea Del Espacio” donde HAL 9000 lee los labios de los astronautas Frank y Dave. Enlace foto.

Se está hablando mucho de la IA (Inteligencia Artificial) y su aplicación en diversos campos como la conducción automática de vehículos o incluso en medicina identificando células cancerígenas mejor que un humano. Estos avances son realmente espectaculares y definitivamente cambiarán la humanidad  pero creo que no se está hablando lo suficiente del tremendo impacto de la IA dentro del mundo de la seguridad informática.

Si no tienes nada que hacer este fin de semana, aquí tienes lo vídeos de la conferencia RSA USA 2017.

• Hello False Flags! The Art of Deception in Targeted Attack Attribution
• The Blockchain Identity Crisis
• From Boot-to-Root: A Method for Successful Security Training
• CISO as Change Agent: Getting to Yes
• Deconstructing Identity Analytics for Higher Risk Awareness
• IoT: End of Shorter Days
• Workplace Violence and IT Sabotage: Two Sides of the Same Coin?
• Radical Innovation: Revolutionizing the Future of Cybersecurity
• Cloud Security Assessments: You're Doing It Wrong!
• Encryption and Back Doors: The Line between Privacy and National Security
• Open Security Controller: Security Orchestration for OpenStack
• Security Policy, Behavior and Analytics for Emerging Architectures
• The Seven Most Dangerous New Attack Techniques, and What's Coming Next
• Break the Risk Paradigms: Overhauling Your Risk Program
• The State of Digital Supplier Risk Management: In Partners We Trust
• War Stories: Corporate Cyberespionage Tales from the Trenches
• Delivering Effective Security Outcomes
• Cybersecurity Roadmap: Global Healthcare Security Architecture
• Cyberwar in 2020
• Delivering Secure, Client-Side Technology to Billions of Users
• Cyber-Apocalypse and the New Cyberwarfare
• The Dridex Swiss Army Knife: Big Data Dissolves the APT and Crime Grey Area
• The Coming Disruption in Security
• Adventures in Underland: What System Stores on the Disk Without Telling You
• Beyond Stuxnet: State of the Art in Cyberwarfare and Weapons
• Eggs and Beacon--Scrambling IoT Beacon Indoor Proximity Systems
• Find Map, Get Treasure, Avoid Pirates--Data Security and Privacy Best Practice
• Hacker's Perspective on Your Windows Infrastructure: Mandatory Check List
• Resurrecting Privacy in the Cloud: A Privacy Engineering Implementation
• Security Leadership Lessons from the Dark Side
• Why Cyber-Training Is Key, and How to Do It Right
• Catching Ghosts: Smart Strategies for Successful Recruitment
• Securing What You Don’t Own or Control: The Current State of Wi-Fi Security
• An Aflac Case Study: Moving a Security Program from Defense to Offense
• Applied Machine Learning: Defeating Modern Malicious Documents
• Crown Jewels Risk Assessment: Cost-Effective Risk Identification
• Auditors in the Cloud: Audit Risk and SaaS Applications
• Planning for Chaos
• RSA Conference 2017 Excellence Awards
• Mobile Authentication at Different Levels of Assurance
• Protecting and Defending against Cyberthreats in Uncertain Times
• Sweating the Small Stuff on a Global Scale
• Briefing the Board: Lessons Learned from CISOs and Directors
• The War in Cyberspace: Why We Are Losing--and How to Fight Back
• EU Data Privacy: What US Orgs Need to Do Now to Prepare for GDPR
• Culture Hacker: How to Herd CATTs and Inspire Rebels to Change the World!
• RSAC TV: Interview with Michael Dell
• Check out RSAC 2017 Expo Halls
• The Cryptographers' Panel
• How to Improve Phishing Awareness by 300 Percent in 18 Months
• Hacking Blockchain
• Hands-On Perspectives: Deploying FIDO-Based Modern Authentication Solutions
• Building a Healthy Organization: The Last Great Competitive Advantage
• STRONG: Leading Security into the Future
• What's Next in Cyber-Policy
• RSAC TV: Oliver Friedrichs Interview
• IoT Ecosystems: An Adversary's Perspective
• A Field Guide to Insider Threat Helps Manage the Risk
• The Five Secrets of High-Performing CISOs
• Global Approaches to Protecting Critical National Infrastructure
• The Human Exploitation Kill Chain
• Regulating the Internet of Things
• What Is Needed in the Next Generation Cloud Trusted Platform?
• What CISOs Wish They Could Say Out Loud
• Tidal Forces: The Changes Ripping Apart Security as We Know It
• Cyber-Insurance--I Do Not Think That Word Means What You Think It Means
• Saving Security: Real Change Starts with You, Me and Everyone
• Hot Topics in Privacy: A Conversation with Google, Microsoft and Cisco
• Help Wanted: Security Heroes and Heroines Only Need Apply
• A Virtual and Software-Defined Security Architecture Workshop
• All Children Left Behind
• Who is Who During a Cyber Incident Response Investigation
• How Google Protects Its Corporate Security Perimeter without Firewalls
• Building a Strategic Plan for Your Security Awareness Program
• Congressional Oversight in the Wake of Russian Hacking
• Changing Face/Fate of Identity
• High-Performance Computing Will Make or Break Cybersecurity
• Advances in Cloud-Scale Machine Learning for Cyber-Defense
• The Future of Ransomware on the Internet of Things
• Security Implications of Non-Financial Uses of Blockchain Technology
• RSAC TV: Phyllis Schneck Interview
• How to Do Security WITH Your Organization, Not TO It
• From Vision to Reality: Delivering Emerging Cyber-Technologies Effectively
• Effective Application Security Testing for DevOps
• The Adversary's New Game Plan
• Three Keys to CISO Success
• Innovation Sandbox 2017: Cato
• RSAC TV: Jennifer Minella Interview
• RSAC TV: Mischel Kwon Interview
• A New Approach for Cybersafety Rules and the “Tech Talk” with Kids
• How to Break the Internet
• NERC: A Comprehensive Approach to Managing Grid Security Risks
• Innovation Sandbox 2017: RedLock
• Innovation Sandbox 2017: Enveil
• Innovation Sandbox 2017: Claroty
• Innovation Sandbox 2017: Contrast
• Innovation Sandbox 2017: Veriflow
• Innovation Sandbox 2017: UnifyID
• Threat Intelligence and Data Analytics Jujutsu
• Innovation Sandbox 2017: GreatHorn
• Innovation Sandbox 2017: UpLevel
• Data Plays the Victim: What Ransomware Has Taken from the Kidnapping and Ransom Industry
• RSAC Innovation Sandbox 2017 - Highlights
• RSAC TV: Gidi Cohen Interview
• Innovation Sandbox 2017: Baffle
• From Hello Barbie to Pokemon Go: The New World of Online Safety
• RSAC TV: Jessy Irwin Interview
• RSAC TV: Chenxi Wang Interview
• Security for Real People: A Case Study
• Quick Look: Hashes for the Masses
• Quick Look: Crowdsourced Security at the Government Level: It Takes a Nation (of Hackers)
• Virtual Session: Know Before You Go, Your RSAC Attack Plan
• Quick Look: Hacking Exposed NextGen
• Quick Look: Diagnosis SOC-Atrophy: What to Do When Your SOC Is Sick
• Quick Look: Charting the Course to GDPR: Setting Sail
• Quick Look: Find Map, Get Treasure, Avoid Pirates--Data Security and Privacy Best Practice
• Quick Look: Opening the Door to DoD Perspectives on Cyberthreat Intelligence
• Quick Look: Drive Revenue by Protecting Customer Privacy: Progress and 2017 Predictions
• Quick Look: IoT End of Days
• Quick Look: Hacker's Perspective on Your Windows Infrastructure: Mandatory Check List
• Quick Look: Psychology of an Eastern European Cybercriminal: Mindset Drives Behavior
• Quick Look: Securing Serverless Applications in the Cloud
• Quick Look: Tracking Darknet: A Window into Attackers' Motives, Methods and Targets
• Quick Look: CISO as Change Agent: Getting to Yes
• Quick Look: One-Hit Wonders: Dealing with Millions of Anomalies
• Quick Look: Meaningful Use or Meltdown: Is Your Electronic Health Record System Secure?
• Quick Look: Measuring Authentication: NIST 800-63 and Vectors of Trust
• HOW TO: Reserve Your Seat for A Session at RSA Conference
• Virtual Session: The Six Most Dangerous New Cyberattack Techniques

Un buen conocimiento sobre la línea de comandos es una habilidad esencial que cualquier profesional de la informática (programadores, administradores de sistema, seguridad, etc) debe desarrollar con soltura.

En cmdchallenge.com podemos encontrar, como su nombre indica, varios retos que debemos resolver usando comandos de Bash. Todo lo que necesitas es un navegador con javascript y algo de tiempo. Actualmente contiene 15 retos, pero siempre puedes añadir los tuyos propios. El código fuente del proyecto está disponible en Github, y allí también tienes las instrucciones necesarias para añadir tus propios retos.

Aunque he de reconocer que jugar a vídeo juegos no fue o es una de mis pasiones, recuerdo que uno de los juegos que más simpáticos me caían, de la Playstation 1, era Crash Bandicoot.

Algo que sí me apasionaba hacer, era hacer trampas, vidas infinitas, armas infinitas, inmunidad, etc. Pero no era el hecho de hacer trampas para llegar al final, mi objetivo era el encontrar la forma de hacer trampas, encontrar la zona de la memoria donde almacenaban esos datos y modificarlos. Como amaba mi transtape (versión casera) de mi Spectrum y aún más mi Action Replay de mis Amigas…

INCIBE organiza un nuevo hackathon con el objetivo de desarrollar herramientas, soluciones y/o aplicaciones móviles de código abierto en el ámbito de la ciberseguridad y de la seguridad del Internet de las Cosas (IoT, Internet of Things).

Éste está abierto a estudiantes, profesionales, desarrolladores y/o cualquier persona interesada en el mundo de la seguridad de la información y de las nuevas tecnologías y se celebrará los días 27 y 28 de febrero y 1 de marzo en 4YFN dentro del Mobile World Congress.

Si no tienes nada planeado para este fin de semana, aquí tienes algo de distracción, los vídeos de las charlas de la pasada conferencia sobre seguridad informática celebrada en Buenos Aires, Argentina, Ekoparty 12.

• Tyler Curtis - Encryption out of LINE
• Juan Berner - Exploiting A/B Testing for Fun and Profit
• Nahuel Cayetano Riva - Getting fun with Frida
• Rodrigo Cetera y Javier Bassi - #KillTheHashes - El Gran Libro para Colorear Malware
• Ezequiel Fernandez y Sergio Viera - Multiple Vulnerabilities in SE PLC
• Joernchen - Let Me GitHub That For You (2016 Argentinian Edition)
• Martin Gendler - Juegos Online, Sociedad y Privacidad: un recorrido socio-histórico
• Sheila Berta y Claudio Caracciolo - Backdooring CAN Bus for Remote Car Hacking
• Nahuel Sánchez y Sergio Abraham - SAP HANA under the hood
• Enrique Nissim - I Know Where Your Page Lives: De-randomizing the Windows 10 Kernel
• Sebastian Garcia - Stratosphere IPS. The free machine learning malware detection
• Patrick Wardle - Strolling into Ring-0 via I/O Kit Drivers
• Nicolas Economou y Diego Juarez - Abusing GDI for ring0 exploit primitives: Reloaded
• Martin Vigo - Do-it-Yourself Spy Program: Abusing Apple's Call Relay Protocol
• Javier Smaldone y Iván Ariel Barrera Oro - Una mala elección
• Drew Suarez y Daniel Mayer - Don't Be a Dummy: A Crash Course in Automotive Security
• Travis Morrow y Josh Pitts - Genetic Malware: Designing Payloads for Specific Targets
• Andrew Robbins y Rohan Vazarkar - Six Degrees of Domain Admin
• Rolf Rolles - Synesthesia: Automated Generation of Encoding-Restricted Machine...
• Julien Lenoir y Raphaël Rigo - Lost your "secure" HDD PIN? We can help!
• Salvador Mendoza - Samsung Pay: Numeros Tokenizados y sus Fallas
• Entrega de premios y cierre
• Moritz Jodeit - Look Mom, I don't use Shellcode: Browser Exploitation for IE 11

Link

Con el auge de la IA ya sabemos que Skynet está cerca y con ella los famosos Terminator. Como todos sabéis los Terminator están programados con este procesador así que es el momento perfecto para aprender a programar un MOS 6502 y así poder re-programarlo y convertirlo en un Roomba. También nos puede ayudar a programar a nuestro querido Bender de Futurama como podéis ver en la imagen que encabeza este post.

Aunque el congreso sobre hacking/seguridad, Chaos Communication Congress todavía no ha terminado, los vídeos de las charlas que ya se han dado están disponibles. En los momentos de escribir estas líneas, estos son los vídeos disponibles:

• 33C3 Closing Ceremony
• Security Nightmares 0x11
• Surveilling the surveillers
• 33C3 Infrastructure Review
• Virtual Secure Boot
• The Ultimate Game Boy Talk
• Privatisierung der Rechtsdurchsetzung
• Warum in die Ferne schweifen, wenn das Ausland liegt so nah?
• Understanding the Snooper’s Charter
• Rebel Cities
• The Transhumanist Paradox
• Datenschutzgrundverordnung: Rechte für Menschen, Pflichten für Firmen & Chancen für uns
• Genetic Codes and what they tell us – and everyone else
• Retail Surveillance / Retail Countersurveillance
• Lightning Talks Day 4
• The High Priests of the Digital Age
• Beyond Virtual and Augmented Reality
• Community
• The Economic Consequences of Internet Censorship
• Methodisch inkorrekt!
• Ethics in the data society
• Hebocon
• The Zcash anonymous cryptocurrency
• The Universe Is, Like, Seriously Huge
• Edible Soft Robotics
• Eavesdropping on the Dark Cosmos
• PUFs, protection, privacy, PRNGs
• The 12 Networking Truths
• What We Can Learn about Creativity from 3D Printing
• Hacking collective as a laboratory
• Lasers in the sky (with asteroids)
• Irren ist staatlich
• Interplanetary Colonization
• From Server Farm to Data Table
• Saving the World with (Vegan) Science
• The Moon and European Space Exploration
• Von Alpakas, Hasenbären und Einhörnern – Über Anerkennungskultur
• Berechnete Welt
• The woman behind your WiFi
• An Elevator to the Moon (and back)
• Hochsicherheits-Generalschlüssel Marke Eigenbau
• Decoding the LoRa PHY
• No Love for the US Gov.
• Technologien für und wider Digitale Souveränität
• Talking Behind Your Back
• Dissecting HDMI
• A New Dark Age
• Making Technology Inclusive Through Papercraft and Sound
• Building Custom Pinball Machines
• Machine Dreams
• Do as I Say not as I Do: Stealth Modification of Programmable Logic Controllers I/O by…
• Dissecting modern (3G/4G) cellular modems
• Liberté, Égalité, Fraternité... and privacy ?!
• On Smart Cities, Smart Energy, And Dumb Security
• Memory Deduplication: The Curse that Keeps on Giving
• Lightning Talks Day 3
• Corporate surveillance, digital tracking, big data & privacy
• Million Dollar Dissidents and the Rest of Us
• radare demystified
• How do we know our PRNGs work properly?
• Fnord-Jahresrückblick
• Eine kleine Geschichte der Parlamentsschlägerei
• Code BROWN in the Air
• ATMs how to break them to stop the fraud
• Durchmarsch von Rechts
• Shining some light on the Amazon Dash button
• SpinalHDL : An alternative hardware description language
• SpiegelMining – Reverse Engineering von Spiegel-Online
• Intercoms Hacking
• Build your own NSA
• Downgrading iOS: From past to present
• The Untold Story of Edward Snowden’s Escape from Hong Kong
• Stopping law enforcement hacking
• On the Security and Privacy of Modern Single Sign-On in the Web
• A world without blockchain
• Formal Verification of Verilog HDL with Yosys-SMTBMC
• Searchwing - Mit Drohnen leben retten
• Einführung zu Blockchains
• 3 Years After Snowden: Is Germany fighting State Surveillance?
• Die Sprache der Populisten
• Hacking Reality
• Copywrongs 2.0
• No USB? No problem.
• Haft für Whistleblower?
• Von Kaffeeriechern, Abtrittanbietern und Fischbeinreißern
• Recount 2016: An Uninvited Security Audit of the U.S. Presidential Election
• In Search of Evidence-Based IT-Security
• Gone in 60 Milliseconds
• Wheel of Fortune
• Tapping into the core
• Welcome to the Anthropocene?
• Hacking the World
• Lightning Talks Day 2
• The Clash of Digitalizations
• Syrian Archive
• How physicists analyze massive data: LHC + brain + ROOT = Higgs
• Es sind die kleinen Dinge im Leben
• Der 33 Jahrerückblick
• A look into the Mobile Messaging Black Box
• International exchange of tax information
• Nicht öffentlich.
• Woolim – Lifting the Fog on DPRK’s Latest Tablet PC
• Console Hacking 2016
• You can -j REJECT but you can not hide: Global scanning of the IPv6 Internet
• Visiting The Bear Den
• Netzpolitik in Österreich
• Lockpicking in the IoT
• Deploying TLS 1.3: the great, the good and the bad
• Where in the World Is Carmen Sandiego?
• Netzpolitik in der Schweiz 2016
• Nintendo Hacking 2016
• Make Wi-Fi fast again
• Software Defined Emissions
• Dieselgate – A year later
• Keys of Fury
• Bonsai Kitten waren mir lieber - Rechte Falschmeldungen in sozialen Netzwerken
• What's It Doing Now?
• Make the Internet Neutral Again
• Untrusting the CPU
• A Data Point Walks Into a Bar
• Routerzwang und Funkabschottung
• Pegasus internals
• Geolocation methods in mobile networks
• A Story of Discrimination and Unfairness
• Anthropology for kids - What is privacy?
• Shut Up and Take My Money!
• Kampf dem Abmahnunwesen
• Space making/space shaping
• Check Your Police Record!
• Law Enforcement Are Hacking the Planet
• The Nibbletronic
• The DROWN Attack
• Zwischen Technikbegeisterung und kritischer Reflexion: Chaos macht Schule
• Predicting and Abusing WPA2/802.11 Group Keys
• Bootstraping a slightly more secure laptop
• How Do I Crack Satellite and Cable Pay TV?
• Building a high throughput low-latency PCIe based SDR
• The Fight for Encryption in 2016
• Exploiting PHP7 unserialize
• Reverse engineering Outernet
• What could possibly go wrong with ?
• Everything you always wanted to know about Certificate Transparency
• The Global Assassination Grid
• 33C3 Opening Ceremony