passwords: you can’t do it right

 programming, security  No Responses »
Sep 272011
 

i was recently asked to do a presentation for a local conference. i like coming up with new things to research and investigate and decided to pursue passwords (and how bad they are). below is my presentation and code for the talk:

title: passwords: you can’t do it right
description: some say you’re doing it wrong. i argue you can’t do it right (but some do it better than others). see how ineffective passwords are at protecting your accounts and ways of decreasing the chance of anyone using your passwords to achieve total domination.

 

passwords: you can’t do it right on prezi Continue reading »

 Posted by joshua.smith at 12:20 pm  Tagged with: ,

learning to code (on the cheap)

 programming  No Responses »
Sep 182011
 

in the time that i have been in IT (almost 6 years) i have become very proficient at hacking together code to do what i need. from vb scripts to do simple network administration to customizing some python to send over an exploit, i have found a way to make it work.

what i miss and don’t know is how to do is code correctly. in my search for learning how to code proper i ran across some great courses from stanford university and thought i would share.

i was looking for entry level classes that started at square one and these classes fit the bill perfectly. whats even better is that not only the video, but the homework assignments, handouts, and files are all available free of charge.

so far i have watched almost 4 of the classes and can say i have already learned some things, looking forward to the next 70+ classes ;)

here are the classes with links:

titleurllanguageitunes link
cs106a - programming methodologyhttp://www.stanford.edu/class/cs106a/javahttp://itunes.apple.com/us/itunes-u/programming-methodology/id384232896
cs106b - programming abstractionshttp://www.stanford.edu/class/cs106b/c++http://itunes.apple.com/us/itunes-u/programming-abstractions/id384232917
cs107 - programming paradigmshttp://www.stanford.edu/class/cs107/c++http://itunes.apple.com/us/itunes-u/programming-paradigms/id384233005

note: for the record, i am not really a fan of itunes (and you can get these classes on youtube as well), but being able to download all the classes to my hard drive with a single mouse click was compelling enough for me to do it through itunes.

 Posted by joshua.smith at 1:40 pm  Tagged with: , , ,

learning to reverse

 assembly, programming  No Responses »
May 172011
 

over the past week the topic of learning how to reverse engineer malware/binaries has come up several times in conversation.

i am not a skilled reverser, but i have been working over the last year or so to get better at it and really understand what is going on at the binary level.

earlier this year i discovered a series called “reversing with lena”. lena, the author, touts the series as a way to learn how to reverse for complete beginners, no programming experience required. its 40 lessons long (i am still on lesson 10, so i can only vouch for the first 10 being very good), and the flash videos and .exe’s you need to reverse are included. all reversing takes place  on a 32-bit intel x86 platform.

this series has helped me more than any other to actually understand reversing in the real world and i thought others might enjoy it as well.

before you download:

  • i take no responsibility for what you do with the knowledge you gain (i am using this to get better at reversing malware).
  • some of the programs will most likely be flagged as virus’ by your AV solution, which i don’t believe is accurate (but can’t guarantee either).
  • the password to the 7zip archive is ‘reverse’ (no quotes)
  • download the 7zip archive here (~140 mb)

i found the tutorial on tuts4you.com, a reverse engineering community that has lots of other resources on it (how good or bad, i do not know).

 Posted by joshua.smith at 5:51 am  Tagged with: , , ,

learning assembly

 programming  No Responses »
Jul 022010
 

i will be the first to admit i am not a coder. i have worked, at different points in my career, to learn c, perl, ruby, java, python, and now assembly. so, i have found i am disfunctional at all of them, but i have learned to copy, paste, and hack with the best of them ;)

about two months ago i started taking offensive security’s pentesting with backtrack course. its been a great course, i have learned a lot (i might do a writeup of it when i am finished). what the course also taught me was the importance of, at some level, understanding assembly. so, my quest for the past month has been to become more fluid with reading assembly.

i have sifted through a lot of resources and thought i would pass along the ones i have found valuable.

  1. dr. paul carters free assembly book will give you your footing.
  2. peter van eeckhoutte’s exploit writing tutorial is outstanding. its ten sections long, and very thorough, which i appreciate.
  3. while not as deep as the first two, skull security’s intro to assembly also provided some good insights.
  4. lastly, while much more broad and not strictly focused on assembly, i have found dan guido and crew’s stuff from nyu poly very insightful (its a college grad course for free, hard to beat that)

its great material, the hard part is finding the time to learn/read/watch it all.

 Posted by joshua.smith at 2:21 pm  Tagged with: ,
© 2011 toastresearch.com Suffusion theme by Sayontan Sinha