SecurityFeed.info » Didier Stevens

Feeds

57253 items (57253 unread) in 90 feeds

• Aviv Raff On .NET (29 unread)
• Bugtraq (bugtraq) Mailing List (2875 unread)
• CGISecurity.com: Your Web Site and Application Security Resource (415 unread)
• christian's weblog (25 unread)
• Irongeek's Security Site (344 unread)
• Jeremiah Grossman (191 unread)
• Heorot.net (19 unread)
• milw0rm.com (1332 unread)
• Nmap Hackers (nmap-hackers) Mailing List (27 unread)
• Rootsecure.net (3276 unread)
• SecuriTeam.com (645 unread)
• Security Vulnerability Research & Defense (147 unread)
• SecurityFocus News (436 unread)
• SecurityFocus Vulnerabilities (2715 unread)
• Securityvulns news channel (1749 unread)
• SecWatch - Latest Exploit Alerts (10 unread)
• Taking Network Security to the Streets (28 unread)
• The One And Only Matt Parnell.com (86 unread)
• The Register - Security (2373 unread)
• The Register - Software (2752 unread)
• VulnWatch (vulnwatch) Mailing List (19 unread)
• Web App Security (webappsec) Mailing List (433 unread)
• IceСμbeς (15 unread)
• Linmagazine (760 unread)
• ‫netcraft Bytes :) (130 unread)
• Blonde 2.0 (219 unread)
• The Microsoft Security Response Center (MSRC) (175 unread)
• (IN)SECURE Magazine Notifications RSS (45 unread)
• 0x000000 Security (95 unread)
• ----- Anti-Malware ----- Analysis and Defense (16 unread)
• Apple Fun (25 unread)
• Technorati Search for: aviv.raffon.net (368 unread)
• C.I.S.R.T. (25 unread)
• Determina Zero-Day Protection (6 unread)
• Didier Stevens (157 unread)
• eEye Digital Security - Research Blog (12 unread)
• Ryan Naraine's Security Watch (489 unread)
• Security - RSS Feeds (1103 unread)
• Exploit Prevention Labs (28 unread)
• Software Vulnerability Exploitation Blog (22 unread)
• F-Secure Antivirus Research Weblog (473 unread)
• Full Disclosure (1289 unread)
• George Ou (10 unread)
• GNUCITIZEN Media Portfolio (157 unread)
• ha.ckers.org web application security lab (136 unread)
• heise security (1866 unread)
• invisiblethings' blog (57 unread)
• Jeff Jones's blog (13 unread)
• JScript Blog (26 unread)
• Matasano Chargen (74 unread)
• McAfee Avert Labs (357 unread)
• Michael Howard's Web Log (46 unread)
• PandaLabs (228 unread)
• Zero Day (874 unread)
• SANS Internet Storm Center, InfoCON: green (1121 unread)
• Latest Secunia Security Watchdog Blog Entries (71 unread)
• SecuriTeam Blogs (248 unread)
• Security Fix (494 unread)
• HP ASC Portal (30 unread)
• Strike Center (12 unread)
• Sunbelt Blog (915 unread)
• Sunnet Beskerming Security Advisories (149 unread)
• Technobabylon
• The Recurity Lablog (34 unread)
• Wired: Threat Level (1468 unread)
• TrendLabs | Malware Blog - by Trend Micro (637 unread)
• Uninformed Journal (49 unread)
• WabiSabiLabi's blog (23 unread)
• WatchGuard Wire (135 unread)
• Latest Blog Entires From WebSense Security Labs (165 unread)
• Hackszine.com (665 unread)
• DVLabs: Blogs (146 unread)
• Errata Security (177 unread)
• Robert Hensing's Blog (93 unread)
• PaulDotCom Community Blog (14 unread)
• David LeBlanc's Web Log (34 unread)
• Billy (BK) Rios (29 unread)
• David Litchfield's blog (22 unread)
• Farfromr00tin (27 unread)
• aut disce, aut discede (17 unread)
• pwn* (26 unread)
• hackademix.net (106 unread)
• SecurityDot Vulnerabilities (1939 unread)
• Vulnerabilities & Exploits (87 unread)
• Malicious Code (100 unread)
• Security Risks (66 unread)
• Digg / Security / upcoming (17411 unread)
• digg.com: News / Security / Popular (401 unread)
• DarkReading - Security News (969 unread)
• DarkReading - All Stories (151 unread)

Didier Stevens (10 unread)

• March 09, 2010
• 2:00

  Frisky Solitaire – Another Info Stealer

   » ‎ Didier Stevens
  Marcus Murray gave a great talk at TechEd Berlin 2009: “Hack-Proofing Your Clients Using Windows 7 Security”. In one of his demos, he showed a trojaned Excel spreadsheet. The spreadsheet was a simple text-based game, but it had a malicious component that executed surreptitiously while the game was played. As I’ve done several hacks with Excel [...]
• March 08, 2010
• 2:00

  PDF Info Stealer PoC

   » ‎ Didier Stevens
  An info stealer is malware that steals credentials or files from its victims. Info stealers don’t require admin rights to perform their task, and can be designed to evade or bypass AV, HIPS, DLP and other security software. I helped out a friend testing his environment with a PoC PDF info stealer I designed (I will not [...]
• March 01, 2010
• 8:11

  Quickpost: NetworkMashup.xls

   » ‎ Didier Stevens
  NetworkMashup.xls is a spreadsheet with VBA macros I scraped from the Internet to execute pings and name/address resolution from within Excel with WIN32 API calls. Not only is it handy when you need to do some network mapping in a restricted environment, but also if you’ve just a list of machines to monitor. The spreadsheet contains several [...]
• February 22, 2010
• 12:26

  Ping Shellcode

   » ‎ Didier Stevens
  I’ve added 2 new assembly source files for shellcode to execute a ping. First one does a simple ping, second one does a ping with the computername and username in the ICMP packet data.
• February 16, 2010
• 2:40

  MemoryLoadLibrary: From C Program to Shellcode

   » ‎ Didier Stevens
  The DLL-loading shellcode I used in my cmd.xls spreadsheet was generated with a method I worked out to generate WIN32 shellcode with a C-compiler. You can find it on my new Shellcode page. With this release, I provide you with all the tools you need to build your own version of cmd.xls: take cmd.dll replace the dll in [...]
• February 08, 2010
• 23:17

  Excel with cmd.dll & regedit.dll

   » ‎ Didier Stevens
  I modified the source code of ReactOS‘ cmd and regedit for the following trick: Let me summarize how I did this, as this is the combined result of several techniques I blogged about before. The Excel spreadsheet contains macros that use VirtualAlloc, WriteProcessMemory and CreateThread to “inject” shellcode (stored inside macros) into the Excel process itself. Details [...]
• February 04, 2010
• 3:16

  cmd.dll

   » ‎ Didier Stevens
  This is something I’ve wanted to do for some time: take a command interpreter and transform it from an EXE into a DLL. Why you ask? Well, because it’s a fun challenge But also because a DLL is loaded into a process. In a restricted environment, it can be injected into a legitimate process and [...]
• February 02, 2010
• 11:54

  Quickpost: Quasi-Tautologies & SQL-Injection

   » ‎ Didier Stevens
  Last OWASP/ISSA Belgian chapter meeting was the location of an interesting discussion. For a full report of the meeting, read Xavier’s excellent blogpost. Many SQL-injection techniques rely on tautologies: adding an expression that is always true to the where-clause of a select statement. Like OR 1=1. 1=1 is a tautology, it’s an expression that always yields [...]
• January 28, 2010
• 5:08

  Quickpost: Shellcode to Load a DLL From Memory

   » ‎ Didier Stevens
  I finally took time to develop shellcode to load a DLL, not with LoadLibrary, but directly from memory. Not storing the DLL on disk prevents it from being detected by AV software; not using LoadLibrary bypasses HIPS software that monitors this system call. My shellcode is based on Joachim’s code. In previous posts, I showed how to [...]
• January 21, 2010
• 13:21

  Quickpost: PDF Header %!PS-Adobe-N.n PDF-M.m

   » ‎ Didier Stevens
  @Feliam has an interesting PDF library to create PDF files with an unconventional header (the generated document doesn’t start with %PDF-…, but %PDF appears somewhere in the first 1024 bytes of the document). As this trick is likely to be taken over by malware authors, I updated PDFiD to support this. The PDF reference document also [...]