• Facebook
• Twitter
• Reddit
• LinkedIn

Otra de las grandes conferencias USENIX que tuvo lugar a finales de enero Enigma 2016, enfocada a ataques emergentes, tiene publicado los vídeos de las presentaciones. La lista no es muy amplia, pero la mayoría muy interesantes:

• ToStaticHTML for Everyone! About DOMPurify, ...
• Building a Competitive Hacking Team
• Verification, Auditing, and Evidence: If We Didn’t Notice Anything Wrong...
• Keys Under Doormats: Mandating Insecurity...
• Trust Beyond the First Hop–What Really Happens to Data Sent to HTTPS Websites
• Drops for Stuff: An Analysis of Reshipping Mule Scams
• Sanitize, Fuzz, and Harden Your C++ Code
• Dolla Dolla Bill Y'all: Cybercrime Cashouts
• Usable Security–The Source Awakens
• Defending, Detecting, and Responding to Hardware and Firmware Attacks
• Timeless Debugging
• Modern Automotive Security: History, Disclosure, and Consequences
• Protecting High Risk Users
• Opening Video
• PKI at Scale Using Short-lived Certificates
• We Need Something Better—Building STAR Vote
• Bullet-Proof Credit Card Processing
• Why Is Usable Security Hard, and What Should We Do about it?
• NSA TAO Chief on Disrupting Nation State Hackers
• The Golden Age of Bulk Surveillance
• Hacking Health: Security in Healthcare IT Systems

• Facebook
• Twitter
• Reddit
• LinkedIn

Ya están publicadas todas las charlas de linux.conf.au 2016. Aquí os dejo como de costumbre la lista completa:

• Open Hardware Miniconf - Lightning talks, project showcase and general discussions
• Functional Programming Lightning Talks and Miniconf Close
• Open Knowledge Miniconf Opening
• Music and Multimedia Miniconf Lightning Talks
• Using Lnav
• Real Time Tuning Analysis
• Synchronised multi-room multimedia playback and synchronised live media processing and mixing with G
• Improving thread synchronization in GlusterD (Daemon for Gluster) using Userspace RCU (Read-copy-upd
• Record and replay debugging with "rr"
• The future belongs to unikernels.
• Open information: Documenting data and methods
• Intro to Open Street Map
• Prospects and pitfalls in open demography
• Terry & the path to an autonomous robot
• Usable formal methods - are we there yet?
• Vanguard Linux receiver 'Dreambox'
• Security Topics in Open Cloud: Advanced Threats, 2015's Vulnerabilities ...
• Using Linux features to make a hacker's life hard
• Building and deploying the Genomics Virtual Laboratory on the cloud(s)
• Forcing Change in Healthcare through Open Standards
• From Commit to Cloud
• Keeping Pinterest Running
• Accessibility and Security
• Lightning Talks and Conference Closing
• Tutorial: The eChronos Real-Time Operating System - Just what you want, when you want it
• Open Source Software in Silicon Manufacturing
• Tutorial: Hunting Linux malware for fun and $flags
• Using the OpenRadio as RF test equipment
• Overcoming barriers to open source adoption in the public sector
• Raspberry Pi Hacks
• Order in the chaos: or lessons learnt on planning in operations
• Site Reliability Engineering at Dropbox
• He aha te mea nui?
• GStreamer in the living room and in outer space
• Keynote #4 - Ms Genevieve Bell
• Helicopters and rocket-planes
• secretd - another take on securely storing credentials
• The Emperor’s New Closure: FP in Javascript
• Open Source Two Way Radio
• Linux Guest RDMA On Hyper-V
• Troublesome Privacy Measures: using TPMs to protect users
• Haskell is Not For Production and Other Tales
• Open Source Technologies in Neuroscience
• Swift Functional Programming
• Practical Functional Architecture
• Data made out of functions
• Fuzz all the things!
• Speaking their language: How to write for technical and non-technical audiences
• Open Radio Miniconf Panel Discussion
• Tutorial - Embedded sensor data with Lora radio modules
• All Your Modem are Belong To Us
• Machine Ethics and Emerging Technologies
• Free as in cheap gadgets: the ESP8266
• Copyleft For the Next Decade: A Comprehensive Plan
• Creating bespoke logging systems and dashboards with Grafana, in fifteen minutes
• The life of a sysadmin in a research environment
• Pingbeat: y'know, for pings!
• 'Can you hear me now?' Networking for containers
• A Gentle Introduction to Ceph
• CloudABI: Cloud computing meets fine-grained capabilities
• CloudABI: Cloud computing meets fine-grained capabilities
• Revisiting Unix principles for modern systems automation
• The world of 100G networking
• Export Control: A primer for open source hackers
• Life is better with Rust's community automation
• Ergonomics of Automation
• Python's Dark Corners
• Cloud Anti-Patterns
• Open information: Documenting data and methods
• Preventing Cat-astrophes with GNU MediaGoblin
• Network Performance Tuning
• Functional programming in Python with Toolz and fn.py
• The Essential Tools of Open-Source: Functional Programming, Parametricity, Types
• Prying Open Government - An Introduction to Freedom of Information
• What a Good Procedure is Made of
• Cutdown!: HAB Telemetry System
• Kernel Miniconf Unconference
• Kernel Miniconf Unconference
• Cloud Crafting – Public / Private / Hybrid
• RCU Mutation Testing
• Changes in the security module infrastructure
• Kerbal space program simulator hardware controller and display
• Hardware projects using eChronos and IwIP: toward high-assurance IoT
• LinuxCNC for fun and profit - now with deadly lasers!
• Open source car engine management
• ESP8266 ESPlant (Wi-Fi garden sensors) design and operation
• Pick and Place Machine (live demonstration)
• The Twelve-Factor Container
• Open Hardware Assembly Workshop Continued
• Tutorial: Packets don't lie: how can you use tcpdump/tshark (wireshark) to prove your point.
• Education and the AGPL: A Case Study
• Continuous Delivery using blue-green deployments and immutable infrastructure
• Tutorial: Applied Data Science in Python
• How To Write A Linux Security Module That Makes Sense For You
• Playing to lose: making sensible security decisions by assuming the worst
• Tutorial: The Power of Open Data with ELK
• Tutorial: Identity Management with FreeIPA
• Open Source and back again
• An introduction to monitoring and alerting with timeseries at scale, with Prometheus
• Embrace the Atomic (Display) Age
• What I've learned as the kernel docs maintainer
• Adventures in OpenPower Firmware
• Using Persistent Memory for Fun and Profit
• Creating an open and distributed video broadcast production environment using GStreamer
• Challenges when Scaling: Adventures in Swift's Sharding
• Building museum exhibits with open hardware: Raspberry Pi & Arduino
• Documentation Miniconf
• Builds, dependencies and deployment in the modern multiplatform world
• My beautiful jacket
• Two years of tech writing
• edlib - because one more editor is never enough
• SubPos - A "Dataless" Wi-Fi Positioning System
• Opening classrooms through the Australian Curriculum
• Sentrifarm - open hardware telemetry system for Australian farming conditions
• What Happens When 4096 Cores All Do synchronize_rcu_expedited()?
• Dropbox Database Infrastructure
• Open Source Tools for Distributed Systems Administration
• Five* non-cryptographic hash functions enter. One hash function leaves.
• Message fromthe ABACBS President
• Hardware and Software Architecture of The Machine
• Keynote #2 - Ms Catarina Mota
• Internet Archive: Universal Access. Open APIs
• Open Data + Video Games = Win
• Linux driven microwave
• A Detailed Look at Erasure Codes in OpenStack Swift
• Welcoming Everyone: Five Years of Inclusion and Outreach Programmes at PyCon Australia
• Open-Source Software Stack for High-Assurance Autonomous Vehicles
• Wait, ?tahW: The Twisted Road to Right-to-Left Language Support
• Open Tech School - Open learning in practice
• A live demo of the CubicSDR open source SDR software
• Keynote #1 - Mr George Fong
• Conference Opening
• Melvin: A new implementation of LVM in Rust
• Is that a data-center in your pocket?
• On working from home
• A brief history of technical writing with examples
• Informal Jam / Demo session and Lightning Talks
• Twoskip - a robust single-file key-value database
• Conference Recording 2.0: Building a Better System
• Free Software in the Audiokinetic Laboratory
• Why no FOSS on stage right?
• An Open Approach to Whole-House Audio
• Sequencing your poo with a USB stick
• Applied bioinformatics using open source software
• Going Faster: Continuous Delivery for Firefox
• R and Bioconductor: open source software for analysing genomic data
• Production Pathology: from spinning wheels to knitting mills
• Open Sourcing Anti-Harassment Methodologies
• Law and technology: impedance mismatch
• Microscopium: Interactive clustering of high content screen images
• Many Roads to Bioinformatics
• Computer Performance Microscopy with SHIM
• Clinical Genomics: a Computational Perspective
• Open Source and Bioinformatics Miniconf Welcome
• Live Migration of Linux Containers
• clsXlca Opening
• Managing Infrastructure as Code

• Facebook
• Twitter
• Reddit
• LinkedIn

Filtra los datos de entrada y sanea la salida (filter input, sanitize output) esto es de Seguridad 101, posiblemente las premisas más básicas en cuanto a temas de seguridad informática.

Aunque como bien decía estos son dos conceptos muy básicos, eso no quiere decir que sean fáciles de implementar. Sobre todo el filtrado de la entrada de datos.

Para cada lenguaje (con los que yo he trabajado) existen librerías que te ayudan con esta ardua tarea e incluso algunos soportan al menos de forma parcial este tipo de funcionalidad en el propio lenguaje.

Usemos librerías o no, el testeo de nuestras aplicaciones es fundamental y éste requiere mucho esfuerzo si lo hacemos de forma manual, ya que las permutaciones que se pueden hacer en una entrada de datos es prácticamente infinita.

The Big List of Naughty Strings es un pequeño proyecto alojado en Github que no es más que un fichero de texto, bastante amplio, con cadenas de texto que pueden crear algún tipo de problema en nuestra aplicación. Éste no sólo está enfocado a la seguridad.

Lo interesante es que es muy fácil coger este fichero y añadirlo a nuestros tests, de forma que se los podamos basar de forma fácil y ver como responde nuestra aplicación.

Los ficheros están en formato texto y json, y a su vez, los tienes en texto claro y codificado en Base64.

Nota: no te bases sólo en esta información para probar la seguridad de tus aplicaciones.