Security

Annoying. I wonder why it didn't do that for all the other non-http ports I used today, though.

Part of the motivation for working on my thesis titled "Pandora's Bochs: Automatic Unpacking of Malware" was to write a publicly available and open source unpacker for runtime-packed executables, so I had originally planned to polish my code, write up better documentation and release it to the public. However, since handing in my thesis, 6 months passed and I have still not found the time to do so. I do not know when that time will come, so I decided to at least release the latest snapshot to the public. It will probably be non-trivial to set up outside of its original development environment, but it might be useful to somebody. Feel free to pester me with flames or questions.

A slightly modified version of Bochs with a Python instrumentation interface and instrumentation code that attempts to supervise processes of a Windows XP SP2 guest system can be found here. The instrumentation code logs instrumentation events to an SQLite3 database. Additionally, the address space of a supervised process is dumped to the database, when execution of a modified memory region (indicating execution of newly unpacked code) is detected.

A tool that attempts to reconstruct valid PE images from these databases can be found here. It can also do other stuff I have long forgotten.

Like Bochs, my additions to it are released under the LGPL.

Interesting article about how carelessly some institutions deal with personal information over at lipflip.org

Checking referrers to my website through awstats, i found that some people actually found it by searching for the terms "UCSB CTF". That reminded me to check the UCSB CTF website for updates, and in fact, the website says "The 2006 iCTF is scheduled Friday, December 8, 2006, from 8am to 5pm, PST". Good news, I'm really looking forward to it

UPDATE: I just noticed: While the VMware images of the past CTFs contained only a single virtual host, the UCSB CTF website now says "The iCTF is scheduled on Friday, December 8, 2006. The contest starts at 8am, PST, by distributing a VMware-based virtual network (one or more hosts running a composition of Linux? *BSD? Windows? services) that supports a number of services.". Sounds interesting, maybe we'll be getting multiple hosts per team to defend and attack.

Ross Anderson's book "Security Engineering" is now available for free download.

I managed to compile the SILC plugin for Irssi 0.8.10 on Debian stable. Whenever I tried that before, stuff failed. I wonder why it worked now, but here it is: a build of the SILC plugin for Irssi 0.8.10 compiled on Debian stable

Finally, in our third attempt, we won the UCSB CTF (after scoring second place, twice). Check out the final scores

I would like to thank UCSB for organizing yet another fun++ CTF.

I'm really looking forward to participating in the next UCSB CTF as part of the RWTH Aachen Team "0ld Eur0pe" which is coming up on December 9th.

From the UCSB CTF Website:

The UCSB International Capture The Flag (also known as the iCTF) is a distributed, wide-area security exercise, whose goal is to test the security skills of the participants from both the attack and defense viewpoints.

The Capture The Flag contest is a multi-site, multi-team hacking contest in which a number of teams compete independently against each other.

Each team is given a virtualized server installation (for example, a virtual Linux server). The server provides a number of services. The services have a number of undisclosed vulnerabilities, which have been included in the server's software by the contest organizers.

The goal of each team is to maintain the set of services available and uncompromised throughout the contest phase. Each team can (and should) attempt to compromise other teams' services. Since all the teams receive an identical copy of the virtual server, the task of each team is to find vulnerabilities in their copy of the server and possibly fix the vulnerabilities without disrupting the services. At the same time, the teams have to leverage their knowledge about the vulnerabilities they found to compromise the servers run by other teams. Compromising a service will allow a team to bypass the service security mechanisms and to "capture the flag" associated with a service.

During the contest a scoring system keeps track, for each team, of which services are available, and which services have been compromised.

I participated in both international CTF contests organized by UCSB so far and really enjoyed them. Not only were the vulnerable services fun break, I also think the virtual servers' "evil company" themes were awesome and integrated all the services into a nice and consistent setting.