<![CDATA[[SecurityRatty] tag: tutorial]]> http://securityratty.com/tag/tutorial Mon, 14 Apr 2008 07:00:00 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Weak Hashing Algorithms: Outlook PST file CRC32 password cracking example]]> http://securityratty.com/article/41557eac24091743b5c3bae52439c7e1 http://securityratty.com/article/41557eac24091743b5c3bae52439c7e1 Weak Hashing Algorithms: Outlook PST file CRC32 password cracking example
In a previous video I explained the basics of cryptographic hashes. Go watch "A Brief Intro To Cryptographic Hashes/MD5" before this video. In this tutorial, I’ll be giving an example of why weak hashes are bad. The example I'll be using is the CRC32 hash that Outlook uses to store a PST archive’s password with. The CRC32 algorithm as implemented by Microsoft Outlook is easy to generate hash collisions for, so even if you can’t find the original password you can find an alternate one that works just as well.

]]> Tue, 30 Sep 2008 20:18:44 +0000 weak outlook video previous video weak hashes pst archives password microsoft outlook algorithms crc32 hash Weak Hashing Algorithms: Outlook PST file CRC32 password cracking example <![CDATA[Weak Hashing Algorithms: Outlook PST file CRC32 password cracking example]]> http://securityratty.com/article/6eb897d12f07f486813c3015723d8077 http://securityratty.com/article/6eb897d12f07f486813c3015723d8077 Weak Hashing Algorithms: Outlook PST file CRC32 password cracking example
In a previous video I explained the basics of cryptographic hashes. Go watch "A Brief Intro To Cryptographic Hashes/MD5" before this video. In this tutorial, I'll be giving an example of why weak hashes are bad. The example I'll be using is the CRC32 hash that Outlook uses to store a PST archive's password with. The CRC32 algorithm as implemented by Microsoft Outlook is easy to generate hash collisions for, so even if you can't find the original password you can find an alternate one that works just as well. ]]> Tue, 30 Sep 2008 20:18:44 +0000 password weak outlook video previous video weak hashes original password microsoft outlook algorithms Weak Hashing Algorithms: Outlook PST file CRC32 password cracking example <![CDATA[Building Secure Web Applications Training in Minneapolis]]> http://securityratty.com/article/425c10b73ebf6262c2b07d2a4b9edeaa http://securityratty.com/article/425c10b73ebf6262c2b07d2a4b9edeaa I am very excited to announce that I am co-teaching a public software security class with Ken van Wyk, in Minneapolis, the class runs September 30 - October 2. Ken co-wrote a great book called Secure Coding, and has trained folks in software security all across the globe. I am really looking forward to doing this class with Ken, I wanted to make sure we got Ken up here before the weather got too cold! The summary is below, if you would like more info please let me know. More details to follow.
Building Secure Web Applications in Java/J2EE

Course Description
This course teaches the students how to develop secure applications from the web front end through the middle tier and data and integration layers for today’s complex internetworked environment.  Students will receive a deep and thorough understanding of the most prevalent and dangerous security defects in today’s applications, and what to do about them.  Additionally, they will learn practical and actionable guidelines on how to remediate against these common defects in Java/J2EE and Web Services frameworks and how to test for them in their own applications.

This class starts with a description of the security problems faced by today's software developer, as well as a detailed description of the Open Web Application Security Project’s (OWASP) “Top 10” security defects.  These defects are studied in instructor-lead sessions as well as in hands-on lab exercises in which each student learns how to actually exploit the defects to “break into” a real web application.  (The labs are performed in safe test environments.)

Remediation techniques and strategies are then studied for each defect. Practical guidelines on how to integrate secure development practices into the software development process are then presented and discussed. Bring the concepts and hands on learning together, the class uses a case study to show how to design and architect security services for a real world application.

Intended Audience
The ideal student for this tutorial is a hands-on web application developer or architect who is looking for a fundamental understanding of today's best practices in secure software development.
]]> Tue, 26 Aug 2008 17:43:59 +0000 security defects defects applications secure dangerous security defects secure web applications develop secure applications secure software development security Building Secure Web Applications Training in Minneapolis <![CDATA[Cain RDP (Remote Desktop Protocol) Sniffing Log Parser]]> http://securityratty.com/article/3814d6fe011137e4e730e73714e82c2a http://securityratty.com/article/3814d6fe011137e4e730e73714e82c2a Louisville 2600 group now has it's own site, and the ISSA Kentuckiana chapter's site is back up.

]]> Sun, 03 Aug 2008 20:06:43 +0000 video tutorial shortly issa kentuckiana chapter site cain quick script rdp protocol gre studies middle hope Cain RDP (Remote Desktop Protocol) Sniffing Log Parser <![CDATA[Cain RDP (Remote Desktop Protocol) Sniffing Log Parser]]> http://securityratty.com/article/6cca334a6a88553acbb16b3162a01a99 http://securityratty.com/article/6cca334a6a88553acbb16b3162a01a99 Louisville 2600 group now has it's own site, and the ISSA Kentuckiana chapter's site is back up.]]> Sun, 03 Aug 2008 20:06:43 +0000 video tutorial shortly issa kentuckiana chapter site cain quick script rdp protocol gre studies middle hope Cain RDP (Remote Desktop Protocol) Sniffing Log Parser <![CDATA[Cain RDP (Remote Desktop Protocol) Sniffing Log Parser]]> http://securityratty.com/article/a7cefe0d5b4f7679c791f406d6230924 http://securityratty.com/article/a7cefe0d5b4f7679c791f406d6230924 Louisville 2600 group now has it's own site, and the ISSA Kentuckiana chapter's site is back up.]]> Sun, 03 Aug 2008 20:06:43 +0000 video tutorial shortly issa kentuckiana chapter site cain quick script rdp protocol gre studies middle hope Cain RDP (Remote Desktop Protocol) Sniffing Log Parser <![CDATA[See You in Vancouver at FIRST 2008]]> http://securityratty.com/article/a4426c49b792553a889c1700170a2a07 http://securityratty.com/article/a4426c49b792553a889c1700170a2a07 FIRST2008 in Vancouver next week: my "Logs for Incident Response" tutorial - a whole day of logging fun! - will be presented there on Monday, June 23rd.

It is a great pity that I won't be able to spend more time at the conference as I have another one on Tuesday :-( - a "can't miss" kind since it is related to CEE.

Also, Honeynet members in attendance are planning a meet-up. Come find us there Monday night...
About me: http://www.chuvakin.org
]]> Fri, 20 Jun 2008 08:13:00 +0000 monday monday night june 23rd vancouver incident response attendance time fun logs See You in Vancouver at FIRST 2008 <![CDATA[Finding Promiscuous Sniffers and ARP Poisoners on your Network with Ettercap]]> http://securityratty.com/article/0a45a068916afe2828d02866332ae510 http://securityratty.com/article/0a45a068916afe2828d02866332ae510 Mon, 19 May 2008 20:36:05 +0000 ettercap arp cop network scan poisoner attackers promisc plug-ins cover people Finding Promiscuous Sniffers and ARP Poisoners on your Network with Ettercap <![CDATA[Installing Windows XP SP3? Read This First]]> http://securityratty.com/article/6ef347184dd00f4978bb17ffd0cb3230 http://securityratty.com/article/6ef347184dd00f4978bb17ffd0cb3230 Mon, 12 May 2008 20:00:00 +0000 quick tutorial sp3 service pack time hands save sec mouse ready Installing Windows XP SP3? Read This First <![CDATA[Positive Approach to Security Requests]]> http://securityratty.com/article/bc1863c1a9e5b0bf933e01cc53f18bb3 http://securityratty.com/article/bc1863c1a9e5b0bf933e01cc53f18bb3 Gartner have taken my advice from last September and in a new research note entitled "Tutorial on How to Move Beyond Security Awareness to Create a Risk-Conscious Culture" advocate an approach of
Replacing the word "No" with the phrase "Yes, and ..." is a simple change in style of communication that can make a big difference in how the risk manager's role and contribution are perceived.
It's an important point because taking a negative stance towards requests for new services will eventually result in a loss of credibility. Responsibility works in both directions - if you turn down a request then what impact is that having on the functioning of the business? Remember that business teams have deadlines to meet and your information security policies will not be uppermost in their thoughts as they strive to meet targets within budgets and earn the revenue that pays your salary. My previous blog makes the point that you need to also use intuition. Just how much risk is really involved? That doesn't mean you've now allowed the business carte blanche to trample over all the good practices that you've strived hard to put in place. It simply means that a reasoned approach where risks are explained, alternatives proposed, and quick action is taken will win you respect and keep the wheels of the business turning. ]]> Mon, 14 Apr 2008 07:00:00 +0000 business business carte blanche risk risk manager business teams approach risk-conscious culture information security policies research note Positive Approach to Security Requests