DevDevin

How many IP addresses does IPv6 support?

Devin A. Rychetnik — Tue, 25 Mar 2008 19:17:14 GMT

How many IP addresses does IPv6 support? Well, without knowing the exact implementation details, we can get a rough estimate based on the fact that it uses 128 bits. So 2 to the power of 128 ends up being 340,282,366,920,938,000,000,000,000,000,000,000,000 unique IP addresses.

Well, we know that sounds like a lot, but this blurb from http://en.wikipedia.org/wiki/Ipv6 really puts it in perspective:

"approximately 5×1028 addresses for each of the roughly 6.5 billion people alive today. In a different perspective, this is 252 addresses for every star in the known universe – a million times as many addresses per star than IPv4 supported for our single planet"

Black Hat DC 2008 Briefings

Devin A. Rychetnik — Tue, 26 Feb 2008 18:45:41 GMT

Last week I attended the Black Hat DC 2008 Briefings. The following is a list of the presentations I saw, the key concepts discussed as well as things I found interesting or didn’t know.

Summary of Black Hat DC 2008 Briefings

DAY 1 - Web App Track

Preparing for the Cross Site Request Forgery Defense

· A cross site request forgery (CSRF) can be used to force users to submit data to online web applications, sometimes manipulating their local cache or history.

· This vulnerability could make a user run a search query, fetch arbitrary image files or pages as well as post messages to online forums, or even manipulate their account.

· Two demos showed how this could be done using Netflix and Google.

· Basic way to prevent CSRF is to always require one parameter that the attacker would not know

Threats to the 2008 Presidential Election

· Online donations for presidential campaigns have been used more than ever in 2008

· Typo squatting such as www.hillaryclingon.com (mistype of www.hillaryclinton.com) is easy way people can get trapped or tricked

· Email squatting, for example, emails to something@hillaryclingon.com go to the unintended recipient

· Phishing sites that redirect donations to opposing candidate, the phisher or someone other than the intended candidate

· Denial of services attacks are possible by a high-number of small transaction donations at one time

· Browser data leakage, using a CSS link visited feature, website can determine whether you’ve viewed a webpage before

· Monitoring of people’s communications (i.e. FlexiSpy receives copies of SMS, call logs, emails and lets you listen to conversations on mobile device)

· Ransomware could be a virus, Trojan, or worm that encrypts your data and demands a ransom for it’s restoration

Bad Sushi: Beating Phishers at their Own Game

· www.phishtank.com is a collaborative website for tracking phishers on the Internet and has an open API for developers to integrate anti-phishing into applications

· Reality is scary, simple Google searches such as “Spam ReZulT” return numerous compromised online identities

· Phishing is easy, a number of phishing kits have been developed and are just copied, edited, and reused in most cases

· Phishers even phish each other, the author of a phish kit builds in his/her own feedback loop, which other phishers may or may not notice when modifying and reusing

· Root problem is that static identifiers & passwords are often used, resolution is to use two-factor authentication

· (ATMs are a target as well, ATM skimmers steal swipes of your debit card and record keypad touches)

URI Use and Abuse

· Some software such as Trillian, iTunes, Picasa expose a custom URI (for example, picasa://) that can be used in a browser

· This opens up the attack vector of vulnerabilities in the software to the Internet

· Registered URIs are kept in the registry of Windows (Macs have them too)

· Demos included using an exploit in Adobe Reader to cause a buffer overflow and using Google’s Picasa to steal the user’s pictures

Scanning Applications 2.0

· Web Hacking Incidents Database (WHID) is Web Application Security Consortium project dedicated to maintaining a list of web application related security incidents

· Web 2.0 applications differ from traditional ones in that they usually leverage dynamic client-side scripting and web services (see Pageflakes for numerous examples)

· Techniques for testing web 2.0 applications include

o determining the web service type via fingerprinting

o determining the AJAX library type via fingerprinting

o fuzzing information structures such as JSON, XML etc.

o crawling sites with the DOM as opposed to direct links

· Presenter offers free tools for scanning web 2.0 applications here

DAY 2 - Defense Track

DTRACE: The Reverse Engineer’s Unexpected Swiss Army Knife

· DTRACE was created at Sun and release with Solaris 10

· Now in Apple OS X, and soon to be in FreeBSD

· Allows you to trace an application at runtime in an almost root-kit like way

· Beauty of it is that it’s built into the OS and was designed to be the least intrusive on the application under trace

· Uses the language of D, which is a subset of C, but without control-flow constructs

· DTRACE toolkit gives you templates out of the box for seeing stack analysis, code coverage, heap analysis etc.

Dynamic Taint Propagation: Finding Vulnerabilities Without Attacking

· Taint propagation is a technique where you track your system code during execution and figure out what values are “tainted” by input that comes from outside

· A taint propagation tool would track inputs throughout the system and give you test coverage execution information of all possible input paths

· Fortify is a company that sells products that do this for .NET or Java

(un)Smashing the Stack: Overflows, Countermeasures, and the Real World

· Recommended reading, How to Writer Buffer Overflows, by Mudge

· Discussed defense mechanisms (such as StackGuard, DEP, ASLR) that have been built into operating systems to make exploiting overflows harder

Classification and Detection of Application Backdoors

· Backdoors exist in many applications and are sometimes purposely baked in

· Types include special credentials to bypass authentication and/or hidden functionality that can be used to do something extra to the system

· One example was given, the creator of Unix put a backdoor into the login prompt. To prevent people from seeing this backdoor in the code, since it was open-source, he hid the logic for putting the backdoor in the code inside the compiler. To prevent people from seeing that, he only distributed the compiler binaries and not the code. To prevent people from seeing the logic when the disassembled the binaries, he put code in the dissembler that stripped it out. Moral of the story is that backdoors exist many places we don’t know about

Botnet Population and Intelligence Gathering Techniques

· Botnets usually refers to a group of compromised computers (via a remote access trojan, RAT, for example) remotely controlled by a master

· They utilize DNS instead of IP addresses since you can create an almost infinite amount of domains using subdomaining and change them to point to new IP addresses

· Tools out there make it easy to set up a botnet (for instance, using the PoisonIvy trojan)

· Research at Georgia Tech is using DNS caching distribution patterns to estimate relative size of botnets that exist on the Internet

Information Operation in the Cyber Domain, Immunity Style

· Presenter was hired for a large-scale targeted attack on a private company

· This differed from other penetration tests in that they had no time limit

· They were able to compromise the network first through the email server and monitored all emails

· Then via a little social engineering and an ActiveX script vulnerability they installed an undetectable shell extension on user’s computers

· At that point they discovered that there was another segmented network that something was moving between with a USB keychain

· They modified a USB memory dump tool to write all the data from the keychain to disk and managed to compromise secret data from the segmented network

· (A Microsoft Research tool called Detours was used as part of the attack!)

ECMA C# and Common Language Infrastructure Standards

Devin A. Rychetnik — Mon, 04 Feb 2008 19:34:34 GMT

http://msdn2.microsoft.com/en-us/aa569283.aspx
(It has links to things such as the C# language specification and a reference guide to the CIL Instruction Set).

Dependency Injection with Spring.Net

Devin A. Rychetnik — Thu, 24 Jan 2008 16:05:15 GMT

Good article on dependency injection using Spring.Net: http://www.developer.com/net/csharp/article.php/10918_3722931_1.

Zero Byte Scripts Still Effective

Devin A. Rychetnik — Mon, 12 Nov 2007 14:21:00 GMT

Many antivirus programs are still susceptible to this evasion technique:

Original post: http://blog.didierstevens.com/2007/10/23/a000n0000-0000o000l00d00-0i000e000-00t0r0000i0000c000k/

News article: http://www.vnunet.com/vnunet/news/2202468/hackers-wreak-havoc-zero-byte

Coding Shortcuts in C# 3.0

Devin A. Rychetnik — Tue, 30 Oct 2007 12:24:56 GMT

Default get/set accessors:

public class Person
{
public string Name { get; set; }
public int Age { get; set; }
}

Property initialization:

Person author = new Person { Name = "Jay Miller", Age = 40 };

From this article: http://www.codeguru.com/csharp/csharp/net30/article.php/c14427/

Cryptographic Solutions for .NET Developers: Hashing and Encryption

Devin A. Rychetnik — Mon, 06 Aug 2007 10:28:11 GMT

Here is a pretty good introductory article on crypto in .NET: http://www.codeguru.com/csharp/.net/net_security/encryption/article.php/c14033__1/.

Useful Windows Utilities

Devin A. Rychetnik — Wed, 25 Jul 2007 00:43:00 GMT

I know that I'm going to be looking for this article later so I might as well share it here: http://computerworld.com/action/article.do?command=viewArticleBasic&articleId=9025855&pageNumber=5.

It has some useful PDF utilities as well as others.

Goodies for Microsoft Office 2007

Devin A. Rychetnik — Thu, 19 Jul 2007 00:49:30 GMT

Here are a few goodies I came across for Office Word 2007...

Want help getting started with Word 2007? Add the "Getting Started" ribbon tab inside of Word: http://blogs.msdn.com/microsoft_office_word/archive/2007/07/05/helpful-new-word-ribbon-tab.aspx

Having trouble with the new Word ribbon (menu) system? Use this interactive guide to help with the transition from the previous menu system to the current ribbon system: http://office.microsoft.com/en-us/word/HA100744321033.aspx

What to save Office documents in the PDF format? Get the free plug-in: http://www.microsoft.com/downloads/details.aspx?familyid=4D951911-3E7E-4AE6-B059-A2E79ED87041&displaylang=en

Open-source Distributed Pub/Sub Event System

Devin A. Rychetnik — Fri, 06 Jul 2007 15:46:03 GMT

This is a huge open-source contribution from Microsoft: http://www.codeplex.com/pubsub.

The Distributed Pub/Sub Event System is a solution for cross-process and/or cross-server scenarios where a large amount of event handshaking is required and low latency is important. Basically, this architecture was designed for speed.

Even if you can't think of a usage scenario for this code-base in your stack right now, I strongly encourage you to just crack open the source and take a look. I personally think the design is a prime example of true software engineering craftmanship, which is simply a thing of beauty.

By the way, I was the one who tested this bad boy before it was released. Therefore, I can't claim rights to the elegant design, but I can claim rights to some of the quality--hopefully not the lack thereof!

Performance Matters

Devin A. Rychetnik — Sat, 30 Jun 2007 00:38:03 GMT

A few good write-ups on performance:

http://www.acm.org/ubiquity/views/v7i24_fallacy.html

http://www.panopticoncentral.net/articles/946.aspx

Five Ideas That Will Reinvent Modern Computing

Devin A. Rychetnik — Fri, 22 Jun 2007 23:02:37 GMT

This article was inspiring to read. Well, at least 4 out of the 5 ideas sound really cool to me. I don't completely see the benefits of trying to model the human brain with a computer seeing as we don't even understand how it works yet: http://www.pcmag.com/article2/0,1895,2147447,00.asp.

WCF NetTcpBinding Lessons Learned

Devin A. Rychetnik — Wed, 13 Jun 2007 02:43:28 GMT

I just got done with a long afternoon of implementing a Windows Service to self-host my WCF service. It was a bit trickier than I thought it would be so if I can save you the headache I'll be happy.

A good place to start is by reading these two MSDN articles:

http://msdn.microsoft.com/msdnmag/issues/06/02/WindowsCommunicationFoundation/

http://msdn.microsoft.com/msdnmag/issues/07/06/ServiceStation/

Next, you'll want to understand these support articles:

http://msdn2.microsoft.com/en-us/library/ms733768.aspx (I needed this to get the wsdl stuff working)

http://msdn2.microsoft.com/en-us/library/ms733925.aspx (need to do this before TcpNetBinding will work)

http://msdn2.microsoft.com/en-us/library/ms731758.aspx (an example app hosting WCF)

http://msdn2.microsoft.com/en-us/library/ms750530.aspx (more on self-hosting)

Traditional & Agile Software Development Methodologies

Devin A. Rychetnik — Thu, 07 Jun 2007 23:38:37 GMT

Examples of Traditional Software Development Methodologies

Waterfall
http://en.wikipedia.org/wiki/Waterfall_model
http://www.cs.umd.edu/class/spring2003/cmsc838p/Process/waterfall.pdf

Spiral
http://en.wikipedia.org/wiki/Spiral_model
http://www.sce.carleton.ca/faculty/ajila/4106-5006/Spiral%20Model%20Boehm.pdf

Rational Unified Process (RUP)
http://en.wikipedia.org/wiki/Rational_Unified_Process
http://www-306.ibm.com/software/awdtools/rup/

CMMI
http://en.wikipedia.org/wiki/CMMI
http://www.sei.cmu.edu/cmmi/cmmi.html

Examples of Agile Software Development Methodologies

Extreme Programming
http://en.wikipedia.org/wiki/Extreme_programming
http://www.xprogramming.org

Scrum
http://en.wikipedia.org/wiki/Scrum_%28management%29
http://www.controlchaos.com

Lean Software Development
http://en.wikipedia.org/wiki/Lean_software_development
http://www.poppendieck.com

Feature Driven Development (FDD)
http://en.wikipedia.org/wiki/Feature_Driven_Development
http://www.featuredrivendevelopment.com

Dynamic Systems Development Method (DSDM)
http://en.wikipedia.org/wiki/DSDM
http://www.dsdm.org/

.NET Assemblies Lessons Learned

Devin A. Rychetnik — Thu, 07 Jun 2007 20:58:46 GMT

A few things I learned today while instrumenting some binaries in preparation for performance profiling:

Resigning a .NET assembly is as simple as opening a VS command prompt and entering:

sn –R MyAssembly.dll MyApplicationKey.snk

Browsing the GAC through Windows Explorer -- open a command prompt and enter:

SUBST L: C:\winnt\assembly

Now you can browser the assembly folder using your L drive. This also makes it easier to reference a DLL in GAC inside a VS project.

(tips taken from: http://aspalliance.com/1251_Miscellaneous_Concepts_of_NET__Part_2 & http://www.thejoyofcode.com/Accessing_dlls_in_the_GAC.aspx)

Remote File Access with WebDAV & IIS

Devin A. Rychetnik — Thu, 07 Jun 2007 02:34:21 GMT

WebDAV & IIS--A remote file access solution to consider: http://www.enterprisenetworkingplanet.com/netos/article.php/3680911.

Kerberos Authentication Protocol

Devin A. Rychetnik — Wed, 30 May 2007 04:56:13 GMT

I was curious to understand Kerberos on a much deeper level so I decided to gather some resources in order to learn what was really going on under the hood:

Kerberos Wikipedia.org
http://en.wikipedia.org/wiki/Kerberos_%28protocol%29

Kerberos Explained (Windows Server 2000)
http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/security/kerberos.mspx

Introduction to Kerberos Webcast (Windows Server 2000)
http://support.microsoft.com/default.aspx?scid=kb;en-us;822248

Kerberos Auth in Windows Server 2003
http://www.microsoft.com/windowsserver2003/technologies/security/kerberos/default.mspx

Kerberos Network Authentication Service (V5)
http://www.ietf.org/rfc/rfc4120.txt

Open-source Web service Testing Tools

Devin A. Rychetnik — Mon, 14 May 2007 23:03:40 GMT

This article reviews three open-source web service testing tools that might be useful if you don't already have one: http://www.infoworld.com/article/07/05/11/19TCwebservicetest_1.html.

Message Queues in .NET

Devin A. Rychetnik — Wed, 18 Apr 2007 00:45:04 GMT

A nice little article on leveraging MSMQ in .NET: http://www.builderau.com.au/program/dotnet/soa/Using-message-queue-services-in-NET/0,339028399,339274877,00.htm

Web Servers

Devin A. Rychetnik — Tue, 10 Apr 2007 17:51:00 GMT

Here is a nice overview of the web server usage statistics from the April 2007 Netcraft survey: http://www.serverwatch.com/stats/article.php/3670036.

Server	No. of Sites	Market Share	No. of Sites With .com domains
Apache	66,899,485	58.86%	36,803,903
Microsoft-IIS	35,377,426	31.13%	22,721,673
Unknown	2,761,059	2.43%	2,042,800
Sun-ONE-Web-Server	1,663,476	1.46%	1,244,246
lighttpd	1,382,843	1.22%	1,182,516
Oversee	845,404	0.74%	726,754
Zeus	488,838	0.43%	154,088
Netscape-Enterprise	241,852	0.21%	122,194
Rapidsite	194,758	0.17%	109,697
tigershark	189,791	0.17%	144,721
thttpd	142,575	0.13%	8,536
Lotus Domino	88,250	0.08%	29,840
AOLServer	70,301	0.06%	3,702
Zope	48,556	0.04%	12,337
WebLogic	29,579	0.03%	16,955
WebSTAR	28,334	0.02%	17,036
Stronghold	22,465	0.02%	13,751
Oracle-Application-Server-10g	17,617	0.02%	7,298
Squid	15,950	0.01%	4,674
4D_WebSTAR_S	11,669	0.01%	5,605
WebSitePro	9,353	0.01%	4,723
WebSite	7,908	0.01%	3,324
Orion	5,745	0.01%	3,738
Xitami	4,602	0.00%	3,248
Roxen WebServer	4,430	0.00%	1,373
Sambar	4,260	0.00%	1,765
Abyss	2,864	0.00%	1,309
Enterprise for NetWare	1,819	0.00%	489
Netscape FastTrack Server	1,472	0.00%	604
WN	1,353	0.00%	107
WebSphere	1,277	0.00%	658
JRun	1,222	0.00%	704
NCSA HTTPd	910	0.00%	206

It shows an already widely-used and gaining in popularity web server called lighttpd that is being used for static content serving in some large-scale scenarios like YouTube and Wikipedia.

IT Architect Skills Library

Devin A. Rychetnik — Thu, 05 Apr 2007 17:14:00 GMT

A new library website devoted to IT architects: http://www.iasahome.org/web/home/skillset.

SQL Server Whitepapers

Devin A. Rychetnik — Wed, 04 Apr 2007 18:04:00 GMT

A colleague of mine found this great resource of SQL Server whitepapers: http://www.sqlskills.com/whitepapers.asp.

Scalable Apps with Asynchronous Programming in ASP.NET

Devin A. Rychetnik — Mon, 19 Mar 2007 05:56:00 GMT

If asynchronous programming in ASP.NET is something you haven't been doing, then you'll want to check this article out: http://msdn.microsoft.com/msdnmag/issues/07/03/WickedCode/. Instead of spending more $ on new servers or hardware you might be able to utilize async Pages, Handlers, and Modules to lessen the amount of threads waiting to execute.

Custom Iterators, Predicates, and Generic Methods in .NET

Devin A. Rychetnik — Mon, 19 Mar 2007 05:28:00 GMT

This article proposes some great ways of making common sequences of operations on lists more reusable in .NET: http://msdn2.microsoft.com/en-us/vcsharp/bb264519.aspx. It reminds me of some of the built-in set operations that are available in the SmallTalk programming language.

Thread Synchronization in Windows Vista

Devin A. Rychetnik — Mon, 05 Mar 2007 22:27:00 GMT

Here is a useful article containing an overview of the new simplified thread synchronization capabilities in Windows Vista: http://www.codeguru.com/columns/kate/article.php/c13387/. These include CONDITION_VARIABLE, AcquireSRWLockExclusive/ReleaseSRWLockExclusive, and AcquireSRWLockShared/ReleaseSRWLockShared.