In particular, the main decision was to handle the S-Boxes. The S-Box keys are derived from the main key and can be precomputed. So the main questions was whether we save clock cycles and precompute them or compute them on-the-fly while running enrcyption/decryption and save SRAM in the microcontroller. We decided to precompute them, as this would bring our implementation a significant performance increase.

These are the statistics..

Statistics Diagram

Statistics Table

Das Thema des Vortrags “Schadcode im Internet” wurde zu Beginn gleich in “Schadcode in Webseiten” umbenannt, denn darum ging es im Vortrag eigentlich. Begonnen wurde zugleich mit den beiden aktuell am weitesten verbreiteten Infektionsmethoden: Direct Downloads und Drive-by-Downloads. Das ist für Sicherheitsspezialisten sicher nichts Neues, wenn man jedoch bedenkt, dass noch vor einem Jahr der bekannteste Weg der Infektion verseuchte E-Mail Anhänge waren, die jetzt so gut wie nicht mehr auftreten, sieht man die Weiterentwicklung der Schutztechniken in E-Mail Programmen nun deutlich. Die Angreifer haben sich ein leichteres Angriffsziel gesucht: Den Browser.

Nun aber zu den interessanten Zahlen (ca-Werte):

• 10-12 Mio. Bots sind weltweit aktiv
• 30.000 neue Bots kommen täglich hinzu
• Über 80% des Spams kommt von etwa 200 Organisationen
• 10.000 Webseiten-Defacements pro Tag
• 3000 DDoS-Angriffe pro Tag! (seit Anfang des Jahres stetig steigend)

Insgesamt ein recht interessanter Vortrag, wenn auch etwas zu wenig detailliert, aber mit Malware kann man auch Abende füllen!

From the abstract:
In this paper we determine the security of user passwords on Linux
based operating systems. We have a look at the two basic security mech-
anisms passwords are created and stored using a reference Linux distri-
bution, locate common attack vectors and propose available countermea-
sures.

link to paper

I highly recommend everyone to read these ones:
1. The Evolution of RFID Security (take this as an introduction to RFID in general), link
2. Protection Profile for Machine Readable Travel Documents – Basic Access Control (BAC), link
3. Advanced Security Mechanisms for Machine Readable Travel Documents – Extended Access Control (EAC), link
4. E-Passport: The global Traceability or How to Feel Like an UPS Package (now it gets interesting), link
5. Security and Privacy Issues in E-Passport (personal favourite), link

1.) collect some recent phishing sites, e.g. from Google or Microsoft
2.) create user credentials such as name, bank, account number, TANs etc. (e.g. from wordlists, dictionaries)
3.) send these special credentials (called ‘phoneytokens’) to the phishing sites

When the phisher[s] now visit the bank site and enter a phoneytoken, it is detected by the system and the phisher is being redirected to a honeypot system (called ‘phoneypot’) instead of the real banking application. This phoneypot looks like the real banking application and can collect data about the phisher, revealing organizational structures of the phishing system and hopefully the phisher himself.

Talks with German banks are currently in progress, let’s see how this will work in practice. I’ll keep you up to date.
If you have any input, you can write to the authors mentioned in the paper or to me, of course.

see you, cordney*

Luckily my university takes part in the MSDNAA developer program which gives you free access to operating systems, IDEs and other stuff from Microsoft. So here we go: Drop by at the office with a study attestation and get your login data. Then simply download the iso and burn it. “What, a 404kB exe file? What the hell?” Yes, they have their own installer, really! So what do you do with an exe file if you don’t own Windows? Fire up Darwine! Thanks to Mike, who builds Darwine snapshots regularly and offers them for download I now have the installer working and downloading a mysterious de_win_xp_pro_w_sp2.sdc file. “What the hell is sdc?” Next step in the installer is extracting the file, so let’s see if we get a burnable iso for BootCamp.

To be continued…

[continue]
Coming home from buying food I found my MacBook at full fan speed telling me that the start volume is full. Great! And WinHelper crashed. Even greater! But the installer is still open and tells me to click to install the product. So let’s see if we have an iso now.

Yey! An iso file! What a heck to just get Windows, no mentioning of installing and RUNNING it! Yak!
[/continue]

You can follow the web coverage of our two teams at this blog: http://seclog.de/.

Update: Our team made 15th place out of 20 teams, ok for the first time. In the last 15 minutes we had a close challenge for 14th place but unfortunately 4 minutes before end of the contest someone cut our power cables and our router went down, so we had no chance… sabotage? Our other team, which already participated last year went 3rd, congratulations!

So to begin with, you need OS X Tiger, it is reported to work work on Panther, too, but that requires a little configuration of the installer package with Pacifist. Let’s move, time is money… hehe. First of all you need to download Java 5 Beta from the Apple website. Follow the installer:

Now you go to /Applications/Utilities/Java/J2SE 5.0 in Finder and start Java Preferences. From within there you make some necessary changes. Change “Use version:” to J2SE 5.0 and at runtime settings drag J2SE 5.0 to be above J2SE 1.4.2. That’s it. Click Save at the bottom of the window and quit.

You’re ready to use Java 1.5 on your Mac, but wait, where is the compiler? Well, I can tell you, it resides in /System/Library/Frameworks/JavaVM.framework/Versions/1.5/Commands/javac. Nice, is’nt it? If you want to work with XCode you can change the compiler – as well as the executable path for every project to match Java 5 Binarys.

I found this annoying and decided to take a XCode template and set it up to use Java 1.5. It’s pretty simple! Just get an existing Java Template from /Library/Application Support/Apple/Developer Tools/Project Templates/Java. I took the Java Tool folder and copied it over to my Desktop. Now i opened it in XCode and let XCode update it.

Following this article from Apple you change the following:

Update: There is a problem with the new template, indeed it seems that XCode 2.1 does not update the -jar argument (projectnameasidentifier).jar. Yaw Anokwa commented on this and was able to create an XCode template which fixes this issue. You can download it from here. Follow the instructions.txt in the archive.

Thanks to Yaw Anokwa for pointing this out.

Target Settings:
Double click the target to edit and provide /System/Library/Frameworks/JavaVM.framework/Versions/1.5/Commands/javac as the value for the JAVA_COMPILER build setting. Change the Target VM Version and Source Version in the Java Compiler Setting to use 1.5.
(To do this select ‘Default’ to show configuration at the top left of the window. Then select Expert View, then Java Compiler Settings.)

Executable Settings:
Double click the executable named java and enter /System/Library/Frameworks/JavaVM.framework/Versions/1.5/Commands/java as the Executable Path in the General tab of Executable info.

Now you are almost finished. To have a better sorting in the Templates window of XCode i created a new folder in the Project Templates Directory named ‘Java 5′. Now i again copy the new template from my Desktop over to the Java 5 folder.

Now you create a new project in XCode you will find our Java 5 Tool template. You can do that with all the other Java templates if you want.

I’ve been working at a German parcel service for a few hours daily to earn some money and you know, I also got a bit lazy. The thing is that I had to arrange my own life, I needed the time. I also thought about the future of QemuX in consideration to new circumstances: Apple’s Intel switch, perspectives for QemuX regarding my programming skills, competition with other apps, other projects I wanted to participate in… Now I settled down here where I am now, taking new steps in life, I can make some things clearer.

Life: Finishing my Abitur in 2003 I knew that I wanted to study at university. Directions were unclear for a long time, social work was considered, computer stuff, helping third world… You know, there is a time in life for a young man, where one asks himself: “Well, what is my task, what is my destiny in this system?” – And I don’t mean system stands for capitalism, society, social state, I think of destiny in a greater system, in a bigger context… man, it’s hard to describe.
Well, one would think helping the third world as a development aid worker would be the, let’s say ,’best’. My opinion about this changed in the last 2 years – I have another plan, but that’s secret… You will see. Something in society has to change, we have to built up a fair world, that’s not the way we can go on. We all should have learned from the past 2000 years and more… but we didn’t. Unfortunately. But things will change, for sure…

From October on I will study IT-Security at Ruhr-University Bochum. I think this can take me to a new direction- it’s interesting, powerful, responsible. Of course it’s a 600 kilometres move away from home, my first own flat, living alone… Thank god I have a family that supports me, my mom, my lil sis, my brother, my lovely grandparents…

Now I already live here in Bochum for about two weeks and I feel pretty comfortable! I visit a mathematics preparation course now from monday til’ friday and it’s quite cool, despite the fact that I feel a little lost, cause the topics are really hard.
In preparation to my courses and lectures I already bought some books: “Basics of electrical engineering” and “Java 5: First steps in programming”, in German, of course. Setting up Java 5 (which is not 5.0 but 1.5, crazy, he?) on OS X will be covered in another article later.

I hope you are now up-to-date and will read on here in my blog. I promise that I will from now on post a few more articles here.

So far, yours, cordney*