Category Archive

Do you live in the United Arab Emirates? Are you a hacker? Then this site is made for you! Get the latest hacking news, exploits, links, pod casts and more through this easy to use website.

Feel like you want to contribute to the site? Then drop us a line at: (hackers) at {marwan} dot [com].

http://WWW.UAEHACKERS.COM

From Intel! crack the clues and win!

you could win a fortnight for two in San Francisco (including a trip to Alcatraz), or a host of other great prizes.
As you play, you’ll learn how we’ve boosted PC security at the hardware level with Intel® vPro™ and Intel® Centrino® Pro processor technologies. Now go ahead and flex those security muscles!

http://cracktheclues.mrmpweb.co.uk/game/play.aspx

Read this report on Reuters.

Also, watch this video.

Among the prizes to be awarded to the most thorough beta testers will be three gaming consoles including a Sony Playstation 3, a Microsoft Xbox360 and a Nintendo Wii. Other prizes include a Nokia N90 device, 30 PC games (either World of Warcraft or Command & Conquer 3), as well as free licenses for BitDefender’s 2008 consumer product line.

BitDefender Total Security 2008 Beta will be made available to download for free through BitDefender’s corporate website http://www.BitDefender.com starting June 19, 2007. Registration and further information about the BitDefender Total Security 2008 Beta testing contest can be found online at:
http://beta.bitdefender.com. The contest will end on July 20 and winners will be announced on August 30, 2007.

Preliminary Call for Papers
 The First ACM Conference on Wireless Network Security (WiSec ‘08)
          
When: March 31 - April 2, 2008, Alexandria, Virginia, USA.

WiSec aims at exploring attacks on wireless networks as well as techniques to thwart them.

Topics include:

- Naming and addressing vulnerabilities
- Key management in wireless/mobile environments
- Secure neighbor discovery
- Secure PHY and MAC protocols
- Trust establishment
- Intrusion detection, detection of malicious behavior
- Revocation of malicious parties
- Denial of service
- User privacy, location privacy
- Anonymity, prevention of traffic analysis
- Identity theft and phishing in mobile networks
- Charging
- Cooperation and prevention of non-cooperative behavior
- Economics of wireless security
- Vulnerability and attacker modeling
- Incentive-aware secure protocol design
- Jamming
- Cross-layer design for security
- Monitoring and surveillance
- Computationally efficient cryptographic primitives

The considered wireless networks encompass cellular, metropolitan,
local area, vehicular, ad hoc, satellite, underwater, and sensor
networks as well as RFID.

Important dates:

Paper submissions due: September 15, 2007
Notification of acceptance: December 10, 2007
Camera-ready version due: January 15, 2008
Conference: March 31 - April 2, 2008

WiSec results from the merger of three workshops:
- ESAS (European Workshop on the Security of Ad Hoc and Sensor
 Networks)
- SASN (ACM Workshop on the Security of Ad Hoc and Sensor Networks)
- WiSe (ACM Workshop on Wireless Security)

For more information, go to:

http://discovery.csc.ncsu.edu/WiSec08/

I was glad to hear that aeCERT was announced by TRA. It is a definitely a step in the right direction. Congratulations

For more news on aeCERT go here.

Matt’s Blog is not frequently updated but his site crypto.com is an excelent resource for all kinds of information. Make sure you check it out.

News, exploits, papers, views, and releases from information security enthusiasts. Has links to major hacker related security events as well. http://www.thc.org/

The agent files are installed in the root of a USB mass storage devices, such as a USB flash drives, digital cameras and iPods.  The agent prompts the user to “install USB Device Driver” which is social engineering the thief into running the agent’s IP tracking and sending code! For more details visit their how it works section on:

http://www.gadgettheft.com

Yet another clever use of The pop-up window of USB devices. Best of all, the basic service is currently free

Check it out:
http://www.wireshark.org/

Same developers, same code, different name. Reason: copyright issues I guess!

Venue: Sheraton by the Creek,Dubai, UAE.
Duration: 2-5 April 2007

Details:
Date: 2nd April 2007
Time: 0900 - 1800
Item: 4-tracks Hands-On Technical Training (Day 1)

Date: 3rd April 2007
Time: 0900 - 1800
Item: 4-tracks Hands-On Technical Training (Day 2)

Date: 4th April 2007
Time: 0800 - 1600
Item: Dual Track Security Conference & Capture The Flag ‘Live Hacking’ Competition (Day 1)

Date: 5th April 2007
Time: 0800 - 1600
Item: Dual Track Security Conference & Capture The Flag ‘Live Hacking’ Competition (Day 2)

Hands-On Technical Training
TECH TRAINING 1 - Advanced Web Application & Services Hacking
Trainer: Shreeraj Shah (Director, Net-Square)

TECH TRAINING 2 - Tactical VoIP : Applied VoIPhreaking
Trainer: The Grugq (Independent Network Security Researcher)

TECH TRAINING 3 -Structured Network Threat Analysis and Forensics
Trainer: Meling Mudin (spoonfork) and Lee Chin Shing (geek00l)

TECH TRAINING 4 - Packetmastering the Monkey Way
Trainers: Dr. Jose Nazario (Senior Software Engineer, Arbor Networks)

Keynote Speakers
1.) Mikko Hypponen (Chief Research Officer, F-Secure Corp)
2.) Lance Spitzner (Founder, Honeynet Project.)

Invited Speakers (alphabetical order)
1.) Anthony Zboralski (Founder, HERT & PT. Bellua Asia Pacific)
2.) Emmanuel Gadaix (Founder, Telecom Security Task Force, TSTF)
3.) Fabrice Marie (Manager, FMA-RMS Singapore/Malaysia)
4.) Jim Geovedi (Member of HERT & Security Consultant, PT Bellua Asia Pacific)
5.) Dr. Jose Nazario (Senior Software Engineer, Arbor Networks)
6.) Raoul Chiesa (Board of Directors Member@ Mediaservice.net ISECOM Group & TSTF)
7.) Roberto Preatoni (Founder, Zone-H Defacement Mirror)
8.) Shreeraj Shah (Director, Net-Square)
9.) The Grugq (Independent Network Security Researcher)
10.) Window Snyder (Chief Security Something-or-Other, Mozilla Foundation)

Links:
http://conference.hitb.org/hitbsecconf2007dubai/
http://conference.hackinthebox.org/hitbsecconf2007dubai/?p=56
News Links:
http://star-techcentral.com/tech/story.asp?file=/2007/2/5/corpit/20070205183948&sec=corpit
http://www.itp.net/news/details.php?id=23403&category=
Thanks David for the heads up

Takes place 11th-12th December 2006. In Sheikh Rashid Hall, Dubai International Convention Centre, Dubai, UAE.

Visit their website at:  http://www.hackerhalted.ae

Just when you thought mobile phones, USB storage devices, wireless access, and ADSL modems were a threat to your corporate data, here comes a story to make you even more paranoid!

A researcher released a paper describing a way to hide malicious code (rootkits) on graphics and network cards. The paper basically shows how to use Advanced Configuration and Power Interface (ACPI) functions available on almost all motherboards to store and run a rootkit. Sceptical? read the full story and download the PDF here.

As I said before, it’s about time! Now a proof of concept has been released for this DoS attack. Here is the link:
http://www.darknet.org.uk/2006/10/new-firefox-vulnerability-dos-and-remote-code-execution/

To read the bugtrack entry on this issue, go here:
http://seclists.org/bugtraq/2006/Oct/0523.html

CertMag has releaed their latest reveiw of certifications. They rated certifications from 1-10 according to certian criterias. To read the article go here:

http://www.certmag.com/articles/templates/CM_gen_Article_template.asp?articleid=2401&zoneid=1

Thanks again Clement and Nathalie from http://www.cccure.org/ :)

The guide was written by Karen Kent, Suzanne Chevalier, Tim Grance, and Hung Dang.

The guide presents forensics from an IT view, not a law enforcement view. It is written for incident response teams; forensic analysts; system, network, and security administrators; and computer security program managers who are responsible for performing forensics for investigative, incident response, or troubleshooting purposes.

It also has a wide array of resources for further reading.  Highly recommended read and reference for IT professionals.

Download it here:
http://csrc.ncsl.nist.gov/publications/nistpubs/800-86/SP800-86.pdf

Read more about it in here:
http://www.cccure.org/modules.php?name=News&file=article&sid=1023

NIST also released the following four security related guides:

• Guidance for Securing Microsoft Windows XP Home Edition: A NIST Security Configuration Checklist
• Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
• Assessment of Access Control Systems
• Guide to Computer Security Log Management

Read more about them here:
http://www.govtech.net/magazine/channel_story.php/101708

Last but not least, it is worth mentioning that last month, NIST released a document about RFID. Read about it here:
http://www.fcw.com/article96300-10-03-06-Web

Thanks Clement

In August, the IEEE released IEEE.tv, its Internet broadcasting network, which features coverage of IEEE conferences, interviews with IEEE book authors, primers on technology-related careers, and overviews of IEEE products and services.

IEEE.tv comes in two formats: the Member/Basic format, available only to members, can be accessed through the myIEEE members-only portal (www.ieee.org/myieee), while the freely available Public Access format (www.ieee.org/ieeetv) offers information about careers in technology and engineering and offers demonstrations of new technology used in everyday applications. The presence of a padlock-shaped icon in the margin of a program indicates that it’s only for member access.

Link:
http://www.ieee.tv

Here is an interesting concept, a dns service that corrects typos and adds some intelligence to the otherwise dumb dns service. It has a blacklist of bad phishing sites, it also has a big cache and a good network, at least its cache is probably bigger than your existing dns server. Give it a try, it is free.

http://www.opendns.com

Here are some interesting Japanese security blogs for your reading enjoyment:

http://d.hatena.ne.jp/tessy/

http://a.hatena.ne.jp/kawakoya/

Also look at:
CertMag’s 2005 Salary Survey

Australian IT Salary Survey

Or maybe you should consider a career change, perhaps mining related:
http://mycareer.com.au/advice-research/revenge-nerds.html

Foundstone Hacme Casino™ is a learning platform for secure software development and is targeted at software developers, application penetration testers, software architects, and anyone with an interest in application security. This extensible online casino platform is written using Ruby on Rails and demonstrates the security problems that can potentially arise in these applications.

Link:
foundstone.com

The article below talks about the things you can do to advance your career in infosec. It includes certifications, books to read, and many other things you can do to further your career. Read it, don’t skim through it!

http://www.microsoft.com/technet/community/columns/secmvp/sv0706.mspx

I haven’t been to Defcon for a while now (2001) and I miss all the show and tell part of it.  I was browsing thesecure.net today and I found a link to this article:
http://www.tgdaily.com/2006/08/30/defcon2006_janus_project/

It has 8 cards and it can sniff data from up to 300 networks at one time. It can also crack WEP, WPA, and WPA2 keys quickly. Best of all, the off switch stops everything instantly, and the hard disk is AES 256 bit encrypted! To start the computer back up again a USB key with a 2000-bit passkey and a password must be entered…. Respect!

This kind of stuff you just don’t see in the corner of your friend’s apartment (at least not my friends)… You need to go all the way to Las Vegas to see it.

Codeen is a proxy server system created at Princeton University. I felt that I needed to tell you about it in relation to my paper on Tracing E-mail Headers. CoDeeN operates in the following manner:

1. Users connect to a proxy server nearest to them (or any proxy server in the codeen network).
2. Requests are then forwarded to a network node that has cached the file and that has sent recent updates showing that it is still alive (in the form of heartbeats). The file is then forwarded to the proxy and from there to the client.

Interesting for caching purposes but has the potential of becoming a nightmare for network forensics including web and email tracing. Abuse was addressed by CoDeeN in the following statement:

All accesses via CoDeeN are logged, mostly to aid in identifying abuse and other forms of damage control. We sometimes monitor these logs, report abuse, and release entries to aid in investigations. In case of suspicious traffic, we may access URLs from the logs to determine what kind of content is passing through our network. We are also using these logs in our own research, so they may be examined as needed for non-abuse reasons. For normal users, we do not expect that we will intentionally release any personally-identifying information. To prevent abuse, some sites have requested we pass along the client IP addresses, and these are included with every request forwarded to those sites.

 So, if you see a CoDeeN server IP in your logs, you know who to contact!

Links:
http://codeen.cs.princeton.edu/
http://en.wikipedia.org/wiki/Codeen

My Paper on Tracing E-mail Headers:
http://scissec.scis.ecu.edu.au/publications/forensics04/Al-Zarouni.pdf

If you get over the annoying beginning of the show, the rest of it is pretty good. 

Topics include:

• The Kevin Mitnick hack
• Bruce Scheiner’s 2600 article
• Defeating fingerprint scanner with ballistics gel (40:00)
• Penetration Testing
• Jay Beale’s Bastille Linux for Mac OS X: http://www.bastille-linux.org/jay/dc14.pdf
• Etc…

Link:
http://www.pauldotcom.com/2006/08/25/pauldotcom_security_weekly_epi_42.html

The Interview with Ivan Arce from CORE is available here:

• Direct Download

Also check out this link:
http://marc2.theaimsgroup.com/?t=114617845500002&r=1&w=2

The University of Abertay in Dundee will offer students an Ethical Hacking and Countermeasures Course at the BSc (Hons) undergraduate level from the start of the next academic year in October. Read more from CNET’s Silicon Site:
http://software.silicon.com/security/0,39024655,39159714,00.htm

News release from the Uni:
http://www.abertay.ac.uk/News/NewsPopup.cfm?NewsID=1038

course details:
http://www.abertay.ac.uk/Courses/CDetails.cfm?CID=363&Key=002

Thanks Salama

This magazine has been published in seven different languages for a long time.  Finally, an English version will be available through book stores in Spetember.

hakin9 is a bimonthly technical magazine about IT security and hacking. It offers an in-depth look at both attack and defence techniques and concentrates on difficult technical issues.  hakin9 is useful for all of those interested in securing network infrastructure and systems - both professionals and hobbyists.

Read more on it on Domber’s Basecamp!

Link:
http://code-foundation.de/?p=31
for more blackhat news, go to google news:
http://news.google.com/news?hl=en&ned=us&q=blackhat

UPDATE: Read http://code-foundation.de/?p=69

OK, here is the scenario: 

• An SMS is sent to mobile phones that lures the victims to visit a web dating site.
• After they visit the specially crafted website address, another message thanks the recipient for subscribing to a dating service, which is fictitious, and states the subscription fee of $2.00 per day will be automatically charged to their cellular phone bill until their subscription is canceled at the online site.
• Recipients visiting the site to cancel their subscription are redirected to a screen where they are prompted to enter their mobile phone number to unsubscribe, then given the option to run a program which is supposed to remove their subscription to the dating service.
• When they run the executable file, it adds several files to the host and changes registry settings to open a backdoor port and lower Windows security settings. The host file is modified to prevent the victim from browsing to popular anti-virus Web sites. The executable also turns the infected computer into a “zombie” network, which can be remotely controlled by the hackers.

So, how do you classify this attack? phishing (notice that no emails were sent), mobile virus, computer malware , Trojan, “no patch for stupidity” or “all of the above”?

Note: notice that bank sites always warn their customers not to trust emails…  But they say nothing about SMS! Even the banks that provide services such as mobile banking.

Links:
http://www.zone-h.org/content/view/13889/31/
http://www.ic3.gov/media/2006/060628.htm

Remember the stolen laptop incident?  “Which one?” you might ask! Well, there have been many of them lately. Search google news for “laptop stolen” and you are sure to find some news:
http://news.google.com.au/news?q=laptop+stolen

The question of the day is: If there are many protection machinisms against laptop and mobile device theft, then why isn’t anybody using them?

Some links:
Articles on the issue:
http://www.networkworld.com/news/2006/071706-mobile-users-security.html
http://www.dermatologytimes.com/dermatologytimes/article/articleDetail.jsp?id=100055

Hardware encryption option for laptops:
http://www.securesystems.com.au/pages/02_technology/01.htm

Tracking options for laptops:
http://mylaptopgps.com/
http://www.lojackforlaptops.com/
http://www.ztrace.com/
http://www.xtool.com/

No comment!  Just read the article:
http://blogs.reuters.com/2006/07/22/high-tech-cloning/

All you have to do is get some of that dental mold stuff and take an impression of the finger you want to fake and then just fill the mold with Play Doh and you got yourself a finger print.  No need to sever any fingers! 

Links:
http://www.yubanet.com/cgi-bin/artman/exec/view.cgi/8/28878
http://www.therawfeed.com/index.html

While searching for “Mobile Phone Forensics”, I came across the “Security & Forensics wiki” site.  I was pleasantly surprised.  It was inline with what I was already doing in my research.  I was sad though at the fact that no site that I knew of linked to them! I know that Wiki is not considered by many as a good source for information but so aren’t blogs, are they… We still consider blogs as legitimate sources of information and always link to them.  We even link to forum posts too, and ‘ahum… bugtraq posts’… so why not wikis? Links:
SecuriWiki Main Page:
http://polya.computing.dcu.ie/wiki/index.php/Main_Page
Mobile Phone Forensics Page:
http://polya.computing.dcu.ie/wiki/index.php?title=Mobile_Phone_Forensics
Email Analysis Page:
http://polya.computing.dcu.ie/wiki/index.php/Email_Analysis

Important Dates: Conference: 25-26 July 2006 • Exhibition: 24-26 July 2006

The conference is co-organised by National ICT Security and Emergency Response Centre (NISER). The list of speakers includes John Meakin, Group Head of Information Security, Standard Chartered Bank, UK;  Steve Orlowski, ex-Chair, APEC e-Security Task Group, Former Special Adviser IT Security Policy, Information and Security Law Division, Attorney-General’s Department, Australia. In addition to some (ISC)2 board members such as Howard Schmidt, Former Cyber-Security Advisor to the President of the USA and Professor Corey D. Schou, PhD, University Professor of Informatics & Information Systems, Associate Dean, College of Business, Idaho State University.

Registration for (ISC)2 members is US$380 and US$420 for others.

Link:
http://www.informationsecurityasia.com/home.htm

SCISSEC 2006 Conferences 

The conferences official website is http://scissec.scis.ecu.edu.au/conferences. The conferences will run concurrently and will be held on the ECU Mount Lawley Campus in Perth, Western Australia on 4th and 5th December 2006. The conferences are:

• 4th Australian Digital Forensics Conference
• 7th Australian Information Warfare Conference
• 4th Australian Information Security Management Conference

Important Dates (All Conferences)
Papers Due 1st October, 2006
Feedback 1st November, 2006
Final Papers Due 15th November,2006

A couple of people asked me about the CISSP exam and how to best study for it.  I personally used a combination of books, the Internet, and practical knowledge to prepare for the 6 hour exam.  For a month before the exam, I used the “CISSP, CISA, and SSCP Open Study GROUP Online Quizzer” everyday to test my knowledge.  I also used a combination of books to strengthen my knowledge in the areas I was not familiar with among the 10 domains of CISSP.  The books are available in my bookstore: http://www.marwan.com/store/ under the Category of “CISSP”.  Good luck to all on the exam :)