Otra de las remarcadas conferencias sobre seguridad informática, OWASP AppSecUSA 2013, fue celebrada en Nueva York del 18 al 21 de noviembre. Para los no privilegiados, aquí tenéis la lista de los vídeos (diapositivas con audio):

• OWASP Zed Attack Proxy - Simon Bennetts
• The Cavalry Is US: Protecting the public good - Josh Corman, Nicholas Percoco
• 2013 AppSec Guide and CISO Survey - Marco Morana, Tobias Gondrom
• Top Ten Proactive Controls - Jim Manico
• Forensic Investigations of Web Exploitations - Ondrej Krehel
• Big Data Intelligence - Ory Segal, Tsvika Klein
• All the network is a stage, and the APKs merely players - Daniel Peck
• BASHing iOS Applications - Jason Haddix, Dawn Isabel
• What You Didn't Know About XML External Entities Attacks - Timothy Morgan
• OWASP Hackademic - Konstantinos Papapanagiotou
• OWASP Periodic Table of Elements - James Landis
• Why is SCADA Security an Uphill Battle? - Amol Sarwate
• Making the Future Secure with Java - Milton Smith
• Tagging Your Code with a Useful Assurance Label - Robert Martin
• HTML5: Risky Business or Hidden Security Tool Chest? - Johannes Ullrich
• Thinking Differently About Security - Mary Ann Davidson
• The 2013 OWASP Top 10 - Dave Wichers
• PiOSoned POS - A Case Study in iOS based Mobile Point-of-Sale gone wrong - Mike Park
• Verify your software for security bugs - Simon Roses Femerling
• Insecure Expectations - Matt Konda
• Hacking Web Server Apps for iOS - Bruno Oliveira
• (Audio only) PANEL: Aim-Ready-Fire moderated by Wendy Nather
• AppSec at DevOps Speed and Portfolio Scale - Jeff Williams
• Application Security: Everything we know is wrong - Eoin Keary
• An Introduction to the Newest Addition to the OWASP Top 10 - Ryan Berg, Jeff Williams
• Mobile app analysis with Santoku Linux - Andrew Hoog
• Accidental Abyss: Data Leakage on The Internet - Kelly FitzGerald
• Mantra OS: Because The World is Cruel - Gregory Disney-Leugers
• (Audio only) Wassup MOM? Owning the Message Oriented Middleware - Gursev Singh Kalra
• Case Study: 10 Steps to Agile Development without Compromising Enterprise Security - Yair Rovek
• Contain Yourself: Building Secure Containers for Mobile Devices - Ron Gutierrez
• iOS Application Defense - iMAS - Gregg Ganley
• Pushing CSP to PROD - Brian Holyfield, Erik Larsson
• Leveraging OWASP in Open Source Projects - Aaron Weaver, David Ohsie, Bill Thompson
• HTTP Time Bandit - Vaagn Toukharian, Tigran Gevorgyan
• NIST - Missions and impacts to US industry, economy and citizens - James St. Pierre, Matthew Scholl
• Revenge of the Geeks: Hacking Fantasy Sports Sites - Dan Kuykendall
• Hack.me: a new way to learn web application security - Armando Romeo
• OWASP Broken Web Applications (OWASP BWA): Beyond 1.0 - Chuck Willis
• Can AppSec Training Really Make a Smarter Developer? - John Dickson
• The Perilous Future of Browser Security - Robert Hansen
• (Audio only) PANEL: Women in Information Security - moderated by Joan Goodchild
• (Audio only) Panel: Don't Tell Me Software Security - moderated by Mark Miller

La Øredev Developer Conference es una conferencia orientada al desarrollo de software en general. Ésta se viene celebrando desde al año 2005 y la edición de este año 2013 se celebró del 4 al 8 de noviembre en Suecia. Aquí os dejo la lista de vídeos de las charlas que se dieron:

• Implementing Micro­Service Architectures (Fred George)
• Implementing Programmer Anarchy (Fred George)
• Git secrets (Brent Beer)
• Programming, Only Better (Bodil Stokke)
• Postgres: The Bits You Haven't Found Yet (Peter van Hardenberg)
• Why Kotlin? (Svetlana Isakova)
• Functional Groovy (Andres Almiray)
• Let's Stop Faking It (Michael Larsen)
• Designer, developer communication (Heidi Harman)
• Developer Designer Communication (Heidi Harman)
• Lightning Fast SQL with Proper Indexing (Markus Winand)
• Design for times 10 or times 100: How to handle hundreds of millions played games per day. (Lars Sjödin)
• Discovering Type Providers in F# 3.0 (Rachel Reese)
• The Creativity (R)Evolution (Denise Jacobs)
• Google Glass, an introduction for developers (Mattias Erlö)
• A Live hacking demo that will make you care more about securing your code! (Marcus Murray)
• What's new in Visual Studio 2013 for web developers (Mads Kristensen)
• Azure Mobile Service – The backend for the masses (Dag König)
• F# for trading (Phil Trelford)
• Windows: Having it's ass kicked by puppet and PowerShell since 2012 (Paul Stack)
• Concurrent Applications with F# Agents (Rachel Reese)
• Lean UX: Building products people want (Adrian Howard)
• Aesthetics and the Beauty of an Architecture: Adventures in CQRS and Event Sourcing (Tom Scott)
• Spring 4 on Java 8 (Juergen Hoeller)
• Java Mission Control: Flight Recorder Deep Dive (Marcus Hirt)
• RRRADDD! Ridiculously rapid domain-driven (and restful) apps with Apache Isis (Dan Haywood)
• Refactor your specs! (Cyrille Martraire)
• Windows Phone 8 SDK: Beyond the Basics with Wallet, In-App Purchasing and Maps. (Michael Crump)
• Coding Tips and Tricks I Learned from Making Some of the Biggest Apps Out There (Atley Hunter)
• Symbiotic relationships between testing and analytics (Julian Harty)
• "Do it yourself"...Custom JavaFX Controls (Gerrit Grunwald)
• Cloud Infrastructure as Code (Henrik Lindberg)
• Developers Can't Design (And Other Completely Untrue Design Myths) (Jen Myers)
• Introduction to the Play Framework (James Ward)
• The next version of JavaScript: ES6 on the frontend, in the real world (John K. Paul)
• Effective Node.js Programming and Module Creation (Jed Wood)
• Unconventional promises - using promises for the kitchen sink, and control flow nivana (John K. Paul)
• Breakout - of the tiles (Håkan Reis)
• No Estimates: Let's explore the possibilities (Roy "Woody" Zuill)
• Security Avalanche – understanding today’s modern protocols (Michele Leroux Bustamante)
• Firefox OS - the platform HTML5 deserves (Christian Heilmann)
• Data visualization, infographics and big open data (Steen Lehmann)
• Regression Obsession (Michael Bolton)
• Advanced Android App Architectures + Lifecycles (Bryan Costanich)
• Balancing ATDD, GUI Automation and Exploratory Testing (Michael Larsen)
• An Artistic Science Approach to Analysis and Reporting Performance Data (Scott Barber)
• Practical Tools for Playing Well with Others (J. B. Rainsberger)
• Being Secure on a Mobile Platform (Siren Hofvander)
• Open APIs - risks and rewards (Andreas Krohn)
• Adopting Continuous Delivery (Jez Humble)
• Heuristics of Testability (James Bach)
• Art & code with XKCD (Randall Munroe)
• The Art of Ruby on Rails (Steve Klabnik)
• Gradle for Android and the rest of the world (Luke Daley)
• ZeroMQ – A Whole Bunch of Awesome [C# Edition] (Ashic Mahtab)
• HTML5 Hacks (Jesse Cravens)
• An Open Source Grid-Based Actor Model (Vaughn Vernon)
• Efficient Android Threading (Anders Göransson)
• Windows Phone 100+ Apps In – What I have Learned (Atley Hunter)
• Livin on the edge: Netflix edge architecture (Adrian Cole)
• C# Cross Platform Mobile with Xamarin (Bryan Costanich)
• F# for C# developers (Phil Trelford)
• Hands On with Clojure (Bodil Stokke)
• Windows Phone 8- the advanced session for the creative child at heart (Iris Classon)
• Functional Principles for Object-Oriented Developers (Jessica Kerr)
• Lightning introduction to three NoSQL technologies (Joel Jacobson)
• 30 NuGet Packages in 50 Minutes (Shay Friedman)
• if (BetterConcurrency == BetterPerformance) { ... (Kirk Pepperdine)
• Modern Component Design with Spring (Juergen Hoeller)
• How To Structure Your JavaEE 7 App (Adam Bien)
• Unlocking the Java EE Platform with HTML5 (Geertjan Wielenga)
• Agile Lightning Talks (J. B. Rainsberger)
• So What About Tablets? (Richard Campbell)
• Enterprise git collaboration patterns (Brent Beer)
• Tracking and Improving Software Quality with Sonar (Patroklos Papapetrou)
• Scaling mobile development at Spotify (Per Eckerdal)
• Less is more! - when it comes to art and software (Jimmy Nilsson)
• Code as a crime scene (Adam Petersen Tornhill)
• Managing Asynchronicity with RQ (Douglas Crockford)
• Shakespeare in Dev (Thomas Q Brady)
• The future of Java in the grander scheme of things (Tomas Nilsson)
• Habits of a Responsible Programmer (Anders Janmyr)
• Go To There and Back Again (Douglas Crockford)
• Entity Framework in Core-Business Applications that Leverage DDD (Julie Lerman)
• Building Secure and Social Applications (Michele Leroux Bustamante)
• Distributed teams - a pragmatic way (Björn Granvik)
• Building Reactive Apps with Play Framework, Akka, and Scala (James Ward)
• Layers Considered Harmful (Christian Horsdal)
• Ubuntu, a potent new force in mobile (David Planella)
• Release your creativity - join OpenJDK (Cecilia Borg)
• The Curious Case of JavaScript on the JVM (Attila Szegedi)
• Data @ King - How we are able analyze 100M DAU (Mats-Olov Eriksson)
• Being Lean in the Cloud: Continuous Deployment with Amazon Web Services (Martin Elwin)
• tekhnasthai (Anna Beatrice Scott)
• The Third Wave of Artfulness in Code (Matthew McCullough)
• Does Pair Programming Have to Suck? (Angela Harms)
• Mob Programming, A Whole Team Approach (Roy "Woody" Zuill)
• The Art of Learning and Mentoring (Jutta Eckstein)
• Rebranding Agile: How Marketers are Changing the Way they Work for Real-time World (Frank Days)
• Extreme Personal Finance (J. B. Rainsberger)
• New Frontiers For In-House Legal Practice (Kate Sullivan)
• The Art of Building Tools - A Language Engineering Perspective (Markus Voelter)
• Have You Seen Spring Lately? (Joshua Long)
• Go Beyond "Debug": Wire Tap your App for Knowledge with Hadoop (Oleg Zhurakousky)
• ElasticSearch - Distributed search on BigData made easy (Itamar Syn-Hershko)
• The very near future of a richer, standards based web (Christian Heilmann)
• Taking a PaaS on the Hard Stuff with Cloud Foundry (Joshua Long)
• Building End to End Web App Using TypeScript (Gil Fink)
• Building Web Applications with Ember.js and Ruby On Rails (Jesse Cravens)
• The Art of Ruby (Steve Klabnik)
• What's New in JAX-RS 2 (Reza Rahman)
• What is new in XAML for Windows 8.1 (Tess Ferrandez)
• Android Design: Beyond the Guidelines - Creating character and identity in your applications (Kevin Grant)
• NodeJS: the good parts? A skeptic’s view (Chris Richardson)
• Crafted Technology and Experiences (Petra Sundström)

Hay varias formas con las que nos podemos hacer con una botnet: comprar, alquilar, hacerte con la botnet tú mismo (¿robar?) o hacerte la tuya propia.

Comprar o alquilar, si dispones del dinero y quieres hacer dicha inversión… Hacerte con una botnet existente no es fácil y se requieren ciertos conocimientos técnicos, tiempo y paciencia. Y al hacerte tu propia botnet, pues más de lo mismo, conocimientos muy técnicos para construir la infraestructura y mucho tiempo.

Pues eso, ¿Cuánto sabes de C++11? Si quieres poner a prueba tus conocimientos, en cppquiz.org tienes un buen número de preguntas o quizzes que te pondrán a prueba.

Las preguntas se presentan como pequeños fragmentos de código, en los que tienes averiguar cual es la salida de los mismos o si hay algún tipo de error. Idealmente debes responder de memoria, es decir, sin copiar, compilar y ejecutar el código en tu sistema. Esto te dará una buena idea de la solidez de tus conocimientos.

Este viernes, día después de acción de gracias, es el día de las rebajas (al menos uno de ellos y quizás el más importante) en los EEUU, conocido como Black Friday. Este día se lanzan ofertas de todo tipo, pero las verdaderas gangas se consiguen en la tienda física.

Hoy hablando con mi compañero Cybercaronte, le comentaba sobre la que se lía ese día y como la gente duerme en la calle para hacer cola. Sí, más o menos como en los tiempos de Steve Jobs y el iPhone/iPad, pero con una sutil diferencia, los que hacen cola este viernes van a por todas y algunos incluso van armados y no tienen la menor duda en usar la violencia si hace falta.

Pues eso, más vídeos, estos son los de la pasada Black Hat celebrada en las Vegas:

• Spy-jacking the Booters
• Hacking, Surveiling, and Deceiving Victims on Smart TV
• Tribute to Barnaby Jack
• Stepping p3wns: Adventures in Full Spectrum Embedded Exploitation
• The Factoring Dead: Preparing for Cyptopocalypse
• Mactans: Injecting Malware Into iOS Devices via Malicious Chargers
• Let's Get Physical: Breaking Home Security Systems and Bypassing Building Controls
• Million Browser Botnet
• Evading Deep Inspection for Fun and Shell
• Exploiting Network Surveillance Cameras Like a Hollywood Hacker
• Owning the Routing Table - Part II
• How to Build a SpyPhone
• What's on the Wire? - Physical Layer Tapping with Project Daisho
• Just-In-Time Code Reuse: The More Things Change, the More They Stay the Same
• BIOS Security
• TOR... ALL-THE-THINGS!
• Truncating TLS Connections to Violate Beliefs in Web Applications
• Rooting SIM Cards
• Fully Arbitrary 802.3 Packet Injection: Maximizing Ethernet Attack Surface
• Revealing Embedded Fingerprints: Deriving intelligence from USB stack interactions
• Funderbolt: Adventures in Thunderbolt DMA Attacks
• RFID Hacking: Live Free or RFID Hard
• Home Invasion v2.0 - Attacking Network-Controlled Hardware
• Beyond the Application: Cellular Privacy Regulatory Space
• Legal Considerations for Cellular Research
• A Tale of One Software Bypass of Windows 8 Secure Boot
• I Can Hear You Now: Traffic Interception and Remote Mobile Phone Cloning...
• Buying into the Bias: Why Vulnerability Statistics Suck
• How CVSS is DOSsing Your Patching Policy (and wasting your money)
• Bluetooth Smart: The Good, the Bad, the Ugly, and the Fix!
• UART THOU MAD?
• Press ROOT to Continue: Detecting OSX and Windows Bootkits with RDFU
• SSL, Gone in 30 Seconds - A BREACH beyond CRIME
• Multiplexed Wired Attack Surfaces
• Java Every-Days: Exploiting Software Running on Three Billion Devices
• TLS 'SECRETS'
• Lawful Access Panel
• Clickjacking Revisted: A Perceptual View of UI Security
• OPSEC Failures of Spies
• Hiding @ Depth - Exploring, Subverting, and Breaking NAND Flash Memory
• Honey, I'm Home!! - Hacking Z-Wave Home Automation Systems
• Android: One Root to Own them All
• Abusing Web APIs Through Scripted Android Applications
• Big Data for Web Application Security
• Dissecting CSRF Attacks and Countermeasures
• Above My Pay Grade: Cyber Response at the National Level
• Virtual Deobfuscator - A DARPA Cyber Fast Track Funded Effort
• Teridian SoC Exploitation: Exploration of Harvard Architecture Smart Grid Systems
• New Trends in FastFlux Networks
• CrowdSource: Open Source Crowd Trained Machine Learning Model for Malware Detection
• Denying Service to DDoS Protection Services
• Denial of Service as a Service - Asymmetrical Warfare at its Finest
• Universal DDoS Mitigation Bypass
• Untwining Twine
• Detecting Vulnerabilities in Virtual Devices with Conformance Testing
• Smashing the Font Scaler Engine in Windows Kernel
• The SCADA That Didn't Cry Wolf - Who's Really Attacking Your ICS Devices - 2/2
• Hunting the Shadows: In-Depth Analysis of Escalated APT Attacks
• The Outer Limits: Hacking The Samsung Smart TV
• Out of Control: Demonstrating SCADA Device Exploitation
• Compromising Industrial Facilities from 40 Miles Away
• Hacking Like in the Movies: Visualizing Page Tables for Local Exploitation
• PWNIE AWARDS
• Welcome & Introduction to Black Hat USA 2013
• Mainframes: The Past Will Come to Haunt You
• Black-box Assessment of Pseudorandom Algorithms
• End-to-end Analysis of Domain Generating Algorithm Malware Family
• Javascript Static Security Analysis Made Easy with JSPrime
• The Web IS Vulnerable: XSS Defense on the BattleFront
• Malicious File for Exploiting Forensic Software
• CMX: IEEE Clean File Metadata Exchange
• Mobile Malware: Why the Traditional AV Paradigm is Doomed
• Bochspwn: Identifying 0-Days via System-Wide Memory Access Pattern Analysis
• Using Online Activity as Digital DNA to Create a Better Spear Phisher
• CreepyDOL: Cheap, Distributed Stalking
• OptiROP: The Art of Hunting ROP Gadgets
• BlackberryOS 10 From a Security Perspective
• Shattering Illusions in Lock-Free Worlds: Compiler/Hardware Behaviors in OS and VMs
• Password Hashing: The Future is Now
• Pass the Hash and other credential theft and reuse: Preventing Lateral Movement...
• How to grow a TREE (Taint-Enabled Reverse Engineering Environment) from a CBASS...
• Predicting Susceptibility to Socialbots on Twitter
• Pass-the-Hash 2: The Admin's Revenge
• Energy Fraud and Orchestrated Blackouts: Issues with Wireless Metering Protocols...
• Hot Knives Through Butter: Bypassing Automated Analysis Systems
• Post Eploitation Operations with Cloud Synchronization
• Defending Networks With Incomplete Information: A Machine Learning Approach
• With BIGDATA comes BIG responsibility: Practical exploiting of MDX injections
• Power Analysis Attacks for Cheapskates
• Fact and Fiction: Defending Medical Device
• Maltego Tungsten As a Collaborative Attack Platform
• BinaryPig - Scalable Malware Analytics in Hadoop

Ya están disponibles a través de Youtube los vídeos de la pasada edición de Defcon.

• Proliferation
• Torturing Open Government Systems for Fun, Profit and Time Travel
• Backdoors, Government Hacking and The Next Crypto Wars
• ACL Steganography - Permissions to Hide Your Porn
• Protecting Data with Short-Lived Encryption Keys and Hardware Root of Trust
• Google TV or: How I Learned to Stop Worrying and Exploit Secure Boot
• A Password is Not Enough: Why Disk Encryption is Broken and How We Might Fix It
• From Nukes to Cyber— Alternative Approaches for Proactive Defense and Mission Assurance
• The Politics of Privacy and Technology: Fighting an Uphill Battle
• Defeating Internet Censorship with Dust, the Polymorphic Protocol Engine
• Privacy In DSRC Connected Vehicles
• Phantom Network Surveillance UAV / Drone
• Safety of Tor Network Look at Network Diversity, Relay Operators & Malicious Relays
• De-Anonymizing Alt.Anonymous. Messages
• The DEF CON 21 Badge
• The Growing Irrelevance of US Government Cybersecurity Intelligence Information
• The Dirty South - Getting Justified with Technology
• Prowling Peer-to-Peer Botnets After Dark
• Evil DoS Attacks and Strong Defenses
• Kill 'em All— DDoS Protection Total Annihilation!
• VoIP Wars: Return of the SIP
• Unexpected Stories - From a Hacker Who Made It Inside the Government
• Dude, WTF in my car?
• The Road Less Surreptitiously Traveled
• Home Invasion 2.0 - Attacking Network-Controlled Consumer Devices
• RFID Hacking: Live Free or RFID Hard
• Stalking a City for Fun and Frivolity
• Hacking Wireless Networks of the Future: Security in Cognitive Radio Networks
• BYO-Disaster and Why Corporate Wireless Security Still Sucks
• The Cavalry Isn't Coming: Starting the Revolution to Fsck it All!
• The Dark Arts of OSINT
• EMET 4.0 PKI Mitigation
• Stepping P3wns: Adventures in Full Spectrum Embedded Exploitation (and defense!)
• EDS: Exploitation Detection System
• Conducting Massive Attacks with Open Source Distributed Computing
• Revealing Embedded Fingerprints: Deriving Intelligence from USB Stack Interactions
• Traffic Interception and Remote Mobile Phone Cloning with a Compromised CDMA Femtocell
• The Secret Life of SIM Cards
• DragonLady: An Investigation of SMS Fraud Operations in Russia
• Offensive Forensics: CSI for the Bad Guy
• Pwn'ing Your® Cyber Offenders
• MITM All The IPv6 Things
• HTTP Time Bandit
• How to use CSP to Stop XSS
• So You think Your Domain Controller is Secure?
• Getting The Goods With smbexec
• Abusing NoSQL Databases
• Examining the Bitsquatting Attack Surface
• Please Insert Inject More Coins
• Do-It-Yourself Cellular IDS
• BoutiqueKit: Playing WarGames with Expensive Rootkits and Malware
• Android WebLogin: Google's Skeleton Key
• Building an Android IDS on Network Level
• Defeating SEAndroid
• Doing Bad Things to "Good" Security Appliances
• Electromechanical PIN Cracking with Robotic Reconfigurable Button Basher (and C3BO)
• Data Evaporation from SSDs
• GoPro or GTFO: A Tale of Reversing an Embedded System
• JTAGulator: Assisted Discovery of On-Chip Debug Interfaces
• gitDigger: Creating useful wordlists from public GitHub repositories
• Made Open: Hacking Capitalism
• The Dawn of Web 3.0: Website Mapping and Vulnerability Scanning in 3D
• Combatting Mac OSX/iOS Malware with Data Visualization
• A Thorny Piece of Malware (And Me): The Nastiness of SHE, VFTables & Multi-Threading
• Transcending Cloud Limitations by Obtaining Inner Piece
• Utilizing Popular Websites for Malicious Purposes Using RDI
• Open Public Sensors, Trend Monitoring and Data Fusion
• Collaborative Penetration Testing With Lair
• PowerPwning: Post-Exploiting By Overpowering PowerShell
• Evolving Exploits Through Genetic Algorithms
• Adventures in Automotive Networks and Control Units
• Hacking Driverless Vehicles
• 10000 Yen into the Sea
• Business Logic Flaws In Mobile Operators Services
• Meet the VCs
• The ACLU Presents: NSA Surveillance and More
• The Government and UFOs: A Historical Analysis
• How my Botnet Purchased Millions of Dollars in Cars and Defeated the Russian Hackers
• Fear the Evil FOCA: IPv6 attacks in Internet Connections
• Legal Aspects of Full Spectrum Computer Network (Active) Defense
• We are Legion: Pentesting with an Army of Low-power Low-cost Devices
• Pwn The Pwn Plug: Analyzing and Counter-Attacking Attacker-Implanted Devices
• DC Awards
• PowerPreter: Post Exploitation Like a Boss
• DNS May Be Hazardous to Your Health
• Exploiting Music Streaming with JavaScript
• Java Every-Days: Exploiting Software Running on 3 Billion Devices
• HiveMind: Distributed File Storage Using JavaScript Bonets
• Defending Networks with Incomplete Information: A Machine Learning Approach
• Blucat: Netcat For Bluetooth
• BYOD PEAP Show
• Closing Ceremonies
• All Your RFz Are Belong to Me - Hacking the Wireless World with Software Defined Radio
• Making Of The DEF CON Documentary
• Ask the EFF: The Year in Digital Civil Liberties
• Decapping Chips The Strike Easy Hard Way
• Insecurity - A Failure of Imagination
• Key Decoding and Duplication Attacks for the Schlage Primus High-Security Lock
• DEF CON Comedy Jam Part VI, Return of the Fail
• Hardware Hacking with Microcontrollers: A Panel Discussion
• An Open Letter The White Hat's Dilemma
• Suicide Risk Assessment and Intervention Tactics
• OTP, It won't save you from free rides!
• How to Disclose or Sell an Exploit Without Getting in Trouble
• Defense by numbers: Making Problems for Script Kiddies and Scanner Monkeys
• Social Engineering: The Gentleman Thief
• This Presentation Will Self-Destruct in 45 Minutes
• Fast Forensics Using Simple Statistics and Cool Tools
• Forensic Fails - Shift + Delete Won't Help You Here
• C.R.E.A.M. Cache Rules Evidently Ambiguous, Misunderstood

Desde securityxploded.com podemos acceder al meterial de dos clases sobre ingeniería inversa y análisis de malware. La primera es de iniciación y la segunda sobre temas más avanzados.

En el material de las mismas podrás encontrar vídeos, diapositivas, referencias a libros, herramientas, etc. La clase de iniciación está completa y te puedes descargar todo el material desde aquí. En la avanzada, como podemos ver más abajo, faltan algunas de las sesiones, que supongo publicarán en un futuro. Mientras tantos hay material para entretenerse un rato.

Spotify & GrooveShark

Perfecta para un día de invierno …

Ólafur Arnalds

Si la criptografía ya es complicada entenderla de por sí, aún más complicado es explicarla. Por lo que cuantos más herramientas de “uso común” podamos usar para su estudio mejor que mejor.

Nayuki Minase, usando una hoja de cálculo ha sido capaz de implementar el algoritmo de cifrado AES.

Dicha implementación soporta claves de 128, 192 y 256 bit. En la hoja de cálculo podemos ver los cálculos realizados en cada pasada (fases). Modificando las celdas de la cadena y clave, vemos como la hoja se actualiza mostrando el resultado final, así como los valores en cada fase.