I hadn't told many people about this because I didn't know if I would get accepted, but I am presenting at BlackHat Federal in January. The topic is Analysis of Web Application Worms and Viruses

Yes, Rattle was right, I am working on some badass Javascript stuff right now. This presentation grew out of that and my analysis of things like Perl.Sanity and the MySpace.com Virus. The really cool Javascript stuff will hopefully be at BlackHat in Las Vegas this summer.

A detailed outline of this talk is available on Most Significant Bit Labs. Be sure to check the details on Web Worms and Web Viruses to better understand the threat.

Worms traditionally propagate by exploiting a vulnerability in an OS or an underlying service. 2005 saw the release in the wild of the first worms that propagate by exploiting vulnerabilities in web applications served by simple http daemons. With the near ubiquity of W3C compliant web browsers and advances in dynamic content generation and client-side technologies like AJAX, major players like Google, Yahoo, and Microsoft are creating powerful application accessible only through web browsers. The security risks of web applications are already largely neglected. The discovery of programs that automatically exploit web applications and self-replicate will only make the situation worse.

This presentation will analyze the scope of these new threats. First we will examine how Web Worms and Viruses operate, specifically focusing on propagation methods, execution paths, payload threats and limitations, and design features. Next we will autopsy the source code of the Perl.Sanity worm and the MySpace.com virus to better understand how these programs function in the wild. We will discuss the shortcomings of these two attacks, what that tells us about the authors sophistication, and how their impact could have been worse. Then we will hypothesize two future programs, the Smogmoh worm and the 1929 virus, and discuss their capabilities to learn how these threats might evolve. Finally, we will present guidelines for implementing new web applications securely to resist these new threats.

Participates should have a good understanding of the different HTTP methods, Javascript, DOM manipulation and security, Perl, and be familiar with web application design.

Speaking at Black Hat Federal 2006!

Ethanol Demagogue wrote:

A malicious user can use the ultra-popular search website – or one that operates like it – to find vulnerabilities in corporate websites more quickly than had previously been possible, hacking expert Johnny Long has said.

More and more I'm seeing centralized media lag behind, especially when it comes to tech news. This particular article has been around for over 2 years now.

Media, meet Perl.Sanity, Perl.Sanity, meet the Media.

I submitted to BlackHat Federal in January to discuss trends in web worms like Sanity. I'll post my 8 page CFP soon.

RE: Google also a hacker ally - IT Security News - SC Magazine UK

Microsoft's internal, unsupported application for mounting CD/DVD ISOs as drives. No more stupid daemon tools with their spyware filled BS that takes 20 minutes to get rid of!

Mounting ISO images in a virtual CD-ROM drive

Web applications are among the most common computing services that are exposed to the Internet, and thus they pose an inviting target to anyone who wants to break into your network to steal sensitive information, tamper with your data, or otherwise compromise your system. Ensuring the security of a Web application is a serious task, and requires consideration throughout the design, development, deployment, and operation phase

Working reading that doesn't feel like work.

Design and Deploy Secure Web Apps with ASP.NET 2.0 and IIS 6.0

AIM Robots are sponsored and operated by AOL and other vendors and appear as buddy icons in the buddy lists of AIM users who install them.

For example, users can send an instant message to the AOLYellowpages AIM Robot with the name of a local business or with simply a keyword and the robot replies with related directory listings. The Wall Street Journal robot lets users set up news alerts to be delivered via AIM, as well as request stock prices.

For those who have been under an IT rock, Time Warner is looking to sell off AOL. With Yahoo dropping out the main parties interested are Microsoft and Google.

AOL's instant messaging technologies and userbase is its crown jewel. While Google does have an IM service I couldn't figure out why Google would be interested. How wrong I was! Google doesn't care about AOL's dial-up customers or adding AIM users. Google sees AIM as a conduit to spread services.

Decius has a T-Mobile Sidekick. So does my friend Strick. Web browsing on it is about on par with a 9600 baud modem. While there are some services/proxies/gateways which will strip HTML down to something doable on a handheld, I find they leave much to be desired. This is because they are doing it in real time. At times its faster to IM Rattle to search for something than to actually search for something.

So what does this mean about IM? IM is fast. IM is faster than web browsing on most non-PC devices. AIM compatible IM clients exist in many mobile phones. AIM has a ton of existing users. Creating Google IM Robots to respond to Local searches, Direction requests, Maps, address lookups would fill a need for mobile devices. In short, AOL and AIM allows Google to expand beyond the computer.

Why would Google want AOL?

A representative of the United States government last week warned entertainment publishers against using CD and DVD copy protection software that hides inside computers.

"It's very important to remember that it's your intellectual property; it's not your computer. And in the pursuit of protection of intellectual property, it's important not to defeat or undermine the security measures that people need to adopt in these days," said Stewart Baker, the assistant secretary the Department of Homeland Security, at a conference.

oh how I wish he had said "its important not to endanger a computer or impede the fair use of the intellectual property."

Can't win them all.

US Gov't weighs in on Sony DRM

Server Used: [ whois.pir.org ]

ida.org = [ 129.246.225.12 ]

Domain ID: D1226635-LROR
Domain Name: IDA.ORG
Created On: 11-Aug-1988 04: 00: 00 UTC
Last Updated On: 22-Oct-2004 21: 05: 23 UTC
Expiration Date: 10-Aug-2007 04: 00: 00 UTC
Sponsoring Registrar: Network Solutions LLC (R63-LROR)
Status: CLIENT TRANSFER PROHIBITED
Registrant ID: 19939329-NSI
Registrant Name: Institute for Defense Analyses
Registrant Organization: Institute for Defense Analyses
Registrant Street1: 4850 Mark Center Drive
Registrant Street2:
Registrant Street3:
Registrant City: Alexandria
Registrant State/Province: VA
Registrant Postal Code: 22311
Registrant Country: US
Registrant Phone: 1.70384525

A co-worker got a call from these guys today. Who did you contact in 1988 to even register? The US Commerce department? These guys are in VA and seem to scream Feds...

Update: These guys are serious players

WHOIS: Holy Crap!

Y Combinator is a new kind of venture firm specializing in funding very early stage startups. We help startups through what is for many the hardest step, from idea to company.

We invest mostly in software and Web services. And because we are ourselves technology people, we prefer groups with a lot of technical depth. We care more about how smart you are than how old you are, and more about the quality of your idea than whether you have a formal business plan.

Very cool concept, the deadline for their second batch of funding is past but there's always next time. Basically they provide you all the money you need to survive for a few months during which you do nothing but work on developing a prototype and business plan -- in return they have an investment in your company should it succeed.

Put on your thinking caps

Open Source Projects

Everyone always talks about how Google uses open source. Here is a list of open source projects google has started all of which are hosted on SourceForge.

Google Code: Projects

colorado wrote:
This sounds useful for creating add-on modules for open source CMS (Content Management System) web apps. Can TinyDISK or NanoURL be installed and used on a remotely hosted unix server and MySQL database, administered via FTP or through a web-baseed interface like cpanel?

Sure. NanoURL was written to test TinyDisk and to provide a framework for future services.

What most of the slashdot crowd doesn't seem to get is:

-This hack is about how things like PHP magic quotes cannot secure you if your web application design is bad.
-This hack is about how to write extensions to web applications, hopefully adding value to them (Chicagocrime.org)
-This hack could be applied to nearly any service on the Internet.
-This hack is crippled by default to *NOT* flood TinyURL.
-This hack is supposed to be fun. Come on, there's a picture of a dude hugging a Penguin in there now!

RE: TinyDisk - An anonymous shared file system on top of TinyURL.