Durante del 12 al 14 de junio de este año se celebró la conferencia de desarrolladores noruega en Oslo, NDC 2013. El evento está lleno de charlas y muchas de ellas tienen muy buena pinta.

Para no perder la costumbre, aquí os dejamos la lista de los vídeos de las charla:

• The Science of Communities Behind Software
• Accelerating Agile: hyper-performing teams without the hype
• Making Magic: Combining Data, Information, Services and Programming, at Internet-Scale
• Continuously Deploying Complex Apps Doesn't Have to Suck!
• Building Real World Cloud Apps with Windows Azure - Part 1
• Concurrent and High-Performance Programming in .NET with TPL, async/await, and Dataflow
• Creating Web Experiences with Users in Mind
• SP2013 Workflows and you
• Better Software — No Matter What
• Effective Leadership: How to avoid anti-learning Agile advice
• Clean Architecture and Design
• Powershell for developers
• Building Real World Cloud Apps with Windows Azure - Part 2
• The Abstractions of AngularJS
• From requests to responses: a journey into the ASP.NET Web API runtime architecture
• Cage Match - EmberJS vs. Angular
• Better Software — No Matter What
• Refactoring Noda Time (part 1)
• Do it right, then do the right thing
• Succeeding with Functional-first Programming in Industry
• Windows - Having its ass kicked by Puppet and PowerShell since 2012
• Cloud Messaging with Node.js and RabbitMQ
• The road to Atlantis - Right past that bend beyond Temporal Coupling Lane.
• Backbone is supposed to give me structure, but everything is still just a mess
• SharePoint 2013 Search - What's new and cool
• Better Software — No Matter What
• Patterns of Effective Teams
• Developing Offline Applications with HTML 5
• (Re-)architecting for Continuous Delivery
• Racing Thru the Last Mile: Cloud Delivery Web-Scale Deployment
• Practical Publishing for Profitable Programmers
• Ember.js in Action
• Windows 8 Store Apps – An Introduction
• Better Software — No Matter What
• Building Applications with ASP.NET MVC (Workshop)
• Reintroducing Business Analysis into the Agile Stream and The Need for Structuring the Conversation with Stakeholders
• All you need to know about TypeScript
• You are not (only) a software developer! - Simplicity in practice
• Brewing Beer with Windows Azure
• Principles of Component Design.
• Patterns of large-scale JavaScript applications
• Live coding: The Windows Store Apps showdown - C# vs JavaScript
• Better Software — No Matter What
• Building Applications with ASP.NET MVC (Workshop)
• ++ Building Open Source Communities Through Social Architecture
• Faking Homoiconicity in C# with graphs
• Chef for developers
• Reactive meta-programming with drones
• .NET Rocks - Functional Programming Panel: Type systems and static typing - saving your ass or getting in your face
• How to cope with overnight success - Scaling your web app fast and cheap
• From Windows Forms to WinRT
• Better Software — No Matter What
• Building Applications with ASP.NET MVC (Workshop)
• Real World Polyglot Persistence
• Adopting Continuous Delivery
• Hacking .NET(C#) Application: An Unfriendly Territory
• Ground Control to Major Tom
• Require JS
• How to Change the World
• Windows 8 Store Apps – From Turtle to Rabbit
• Building clean and cohesive concurrent systems with F# agents
• CQRS Hypermedia with WebAPI
• UX by Developers
• Hacking .NET(C#) Application: Code of the Hacker
• Maintainable CSS - The Next Frontier of Front-End Engineering
• Abusing C#
• Don't let your process hide your ignorance
• Asynchronous Programming on the .NET Platform
• Windows Phone 8 – The advanced session
• The Seven Pillars Of Collaboration - Why agile teams need HISTORY in order to collaborate
• Telephones and postcards: our brave new world of messaging
• All projects should do usability testing!
• Securing ASP.NET Web APIs and HTTP Services
• Functional Programming You Already Know
• The Javascript Inferno - A Decent Into the Client-side MVC Netherworld
• Your Path through Agile Fluency
• Developing Games with Windows 8
• The Issuu Ecosystem - a real life perspective on web-scale infrastructure
• The Seven Pillars Of Collaboration - Why agile teams need HISTORY in order to collaborate
• Successfully retrofitting extensibility into established software products
• Information Alchemy: Presentation Patterns (& Anti-patterns)
• People, Process, Tools – The Essence of DevOps
• Erlang: a jump-start for .NET developers
• Being an Anti-social Geek is harmful
• Make Impacts, Not Software
• Sharing code with MVVM Light in Windows 8 and Windows Phone
• Defensive Programming 101 v3
• The Architecture of Uncertainty
• Web Usability on a Budget
• OAuth2 – The good, the bad and the ugly
• Certifying your car with Erlang
• Advanced HTTP Caching and patterns for Ninja Unicorns
• How much is a great developer worth?
• Tekpub's Full Throttle! Live on Stage with Jon Skeet
• Data is everywhere. Also in your Windows 8 app
• MVVM Without XAML: Writing Cross-Platform Mobile Applications with ReactiveUI
• A Developer's Guide to Design Frameworks (and More!)
• Rediscovering JavaScript
• What Every Hipster Should Know About Functional Programming
• Game on: Developing HTML5 games
• Growing software from examples
• Applied MVVM in Windows 8 apps: not your typical MVVM session!
• Lightning talks
• Enterprise hipster-apps with SharePoint and JavaScript
• SQL Server's Last Breath
• Architecting PhoneGap Applications
• Rigorous, Professional JavaScript
• ClojureScript: Lisp's Revenge
• How simple maths and BELIEF can help you coach people to change
• Leave the backend to us: building mobile apps with Azure Mobile Services
• Lightning talks
• Refactoring Noda Time (part 2)
• NuGet for the Enterprise
• HTML5 JavaScript APIs
• Introduction to Clojure
• Rigging Plan B: How To Go Live Safely With Bubbles, Domain Toggles And Obsessive Monitoring
• Sharing C# across Windows, Android and iOS using MvvmCross
• TDD, where did it all go wrong
• Mining your Creativity Mind
• Doing SPA with MVC & KnockoutJS
• Code-First NoSQL with .NET and Couchbase
• Lightning talks
• The Curious Clojureist
• Grid Computing with 256 Windows Azure Worker Roles & Kinect
• Real Cross-platform Mobile Applications - The Anti-Pattern
• Bleeding edge ASP.NET: See what is new and next for MVC, Web API, SignalR and more…
• Effective GitHubbing: The GitHub Flow
• Value of unit test: way from good design to easy maintenance
• Big Object Graphs Up Front
• Building Third-party Widgets and APIs using JavaScript
• Generic Programming Galore using D
• Continuously Deliver with ConDep
• iOS with C# using Xamarin
• Simulation Testing
• Debugging your mind
• Test Driving Nancy
• Writing Usable APIs in Practice
• Test-Driven JavaScript Master Class
• Exploring the C# Scripting Experience with scriptcs
• Continuous Delivery Zen on Windows Azure
• Android with C# using Xamarin
• Race Conditions, Distribution, Interactions--Testing the Hard Stuff and Staying Sane
• Building Startups and Minimum Viable Products using Lean Startup techniques
• Why Document Databases supercharge your app development
• Refactoring Noda Time (part 3)
• Service oriented architectures (hardcore separation of concerns)
• The Hip Hop Virtual Machine
• Succeeding with TDD: Pragmatic Techniques for effective mocking
• Web diagnostics with a Glimpse in ASP.NET
• Under the covers with ASP.NET SignalR
• Automated release management with TeamCity & OctopusDeploy
• Uncomfortable with Agility: What has Ten+ Years got us?
• Running with Ravens
• Deep C++
• Bare-Knuckle Web Development
• C# 5
• Running OSS Projects: From Zero to Sixty
• Building URL-Driven Apps with Ember.js
• Don’t do that, do this! Recommendations from the ASP.NET team
• Understanding Dependency Injection and Those Pesky Containers
• Holistic testing

1) ¿Quién eres y a qué te dedicas?

Soy Niko, creador de Cálico Electrónico y me dedico a la animación Flash tanto para hacer webtoons del tipo Cálico como para hacer trabajos para publicidad, televisión o cine.

También soy mamporrero de bichos palo y sexador de chimpancés a tiempo partido.

2) ¿Qué hardware utilizas en el trabajo y en casa?

Ordenador pepino, monitor más grande que Australia, wacom y cintiq ahí, a todo poder

En este tercer y último reto nos enfrentamos a un fichero ELF. Este nivel fue el más fácil de los tres. Como veremos es súper sencillo.

Una vez bajamos el binario, lo primero es ejecutar file:

tuxotron@tuxotron-T530 ~/ctf/noconname2013quals $ file level.elf level.elf: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0xb589d432799bf15343387fea63d4bdc00faa177c, not stripped

Está compilado con símbolos y demás. Esto nos facilitará mucho la vida. Lo siguiente fue pasarle el comando strings, pero éste no arrojaba nada interesante.

En el segundo nivel nos enfrentamos a una aplicación Android. Lo primero que hacemos aquí es expandir el .apk con la herramienta apktool.

Primero miramos el contenido del fichero AndroidManifest.xml, donde podemos ver la clase inicial de la aplicacion:

También nos encontramos en el directorio res con un subdirectorio llamado raw, el cual contiene 17 imágenes, 16 de las mismas parecen ser trozos de un QR-Code. Parece que nuestro objetivo es leer dicho código. El problema es que no sabemos el orden de los trozos.

En el primer nivel o el primer reto de la Pre Qual del CTF de la NoConName , nos encontramos con una página en la que se nos pide un clave (Key). Cuando introducimos algún texto, inmediatamente nos muestra un mensaje: Invalid Password! (a menos que hayas introducido una clave válida en el primer intento, lo cual me sorprendería :)).

Lo primero que podemos apreciar es que el mensaje viene de la típica ventana que muestra el navegador cuando se ejecuta un alert en javascript. Esto nos dice que la comprobación de la contraseña se hace (al menos parte de la misma) en el lado del cliente, es decir en nuestro navegador.

A través de la magnífica web de Irongeek, podemos ver todos los vídeos de las charlas dadas (tracks 1 y 2 y algunas de la 3) en la DerbyCon 3.0.

La lista de los vídeos publicados es:

• Scanning Darkly – HD Moore (keynote)
• Kinetic Pwnage: Obliterating the Line Between Computers and the Physical World – Ed Skoudis (keynote)
• Look Ma – No Exploits! – The Recon-ng Framework – Tim “LaNMaSteR53? Tomes
• Cognitive Injection: Reprogramming the Situation-Oriented Human OS – Andy Ellis
• It's Only a Game: Learning Security through Gaming – Bruce Potter
• Practical Exploitation Using A Malicious Service Set Identifier (SSID) – Deral Heiland
• IOCAware – Actively Collect Compromise Indicators and Test Your Entire Enterprise – Matt Jezorek and Dennis Kuntz
• Ooops – Now What? :: The Stolen Data Impact Model (SDIM) – Brent Huston
• JTAGulator: Assisted discovery of on-chip debug interfaces – Joe Grand
• Cash is King: Who’s Wearing Your Crown? – Tom Eston and Spencer McIntyre
• Anti-Forensics: Memory or something – I forget. – int0x80
• Seeing red in your future? – Ian Iamit
• Security Sucks – and You’re Wearing a Nursing Bra – Paul Asadoorian
• TMI: How to attack SharePoint servers and tools to make it easier – Kevin Johnson and James Jardine
• Windows Attacks: AT is the new black – Rob Fuller and Chris Gates
• The High Risk of Low Risk Applications – conrad reynolds
• How Good is Your Phish – @sonofshirt
• It’s Okay to Touch Yourself – Ben Ten (Ben0xA)
• Identifying Evil: An introduction to Reverse Engineering Malware and other software – Bart ‘d4ncind4n’ Hopper
• Collaborative Penetration Testing With Lair – Tom Steele and Dan Kottmann
• How Im going to own your organization in just a few days. – RazorEQX
• Malware Automation – Christopher Elisan
• Pass-The-Hash 2: The Admin’s Revenge – Skip Duckwall and Chris Campbell
• What’s common in Oracle and Samsung? They tried to think differently about crypto. – L·szlÛ TÛth – Ferenc Spala
• The Cavalry Is Us: Protecting the public good and our profession – Josh Corman
• Burning the Enterprise with BYOD – Georgia Weidman
• Love letters to Frank Abagnale (How do I pwn thee let me count the ways) – Jayson E. Street
• Getting the goods with smbexec – Eric Milam(brav0hax) and Martin Bos (purehate)
• The Message and The Messenger – James Arlen
• Shattering the Glass: Crafting Post Exploitation Tools with PowerShell – Matt Johnson
• 50 Shades of RED: Stories from the "Playroom" – Chris Nickerson
• Cheat Codez: Level UP Your SE Game – Eric Smith
• Beyond Information Warfare “You Ain’t Seen Nothing Yet” – Winn Schwartau
• My Experiments with truth: a different route to bug-hunting – Devesh Bhatt
• Stop Fighting Anti-Virus – Integgroll
• The Art and Science of Hacking Any Organization – Tyler Wrightson
• Living Off the Land: A Minimalist’s Guide to Windows Post-Exploitation – Christopher Campbell & Matthew Graeber
• Cracking Corporate Passwords – Exploiting Password Policy Weaknesses – Minga / Rick Redman
• How the Grid Will Be Hacked – Josh Axelrod and Matt Davis
• Ownage From Userland: Process Puppeteering – Nick Cano
• help for the helpdesk – Mick Douglas
• ) UNION SELECT `This_Talk` AS (‘New Exploitation and Obfuscation Techniquesí)%00 – Roberto Salgado
• Weaponizing your Coffee Pot – Daniel Buentello
• Exploiting_the_Zeroth_Hour(); Developing your Advanced Persistent Threat to Pwn the Network – SOLOMON SONYA and NICK KULESZA
• Practical OSINT – Shane MacDougall (NOTE THAT THIS IS AN ADULT ONLY TALK – 18+ or older)
• Phishing Like The Pros – Luis “Connection” Santana
• Stop making excuses; it’s time to own your HIV (High Impact Vulnerabilities) – Jack D. Nichelson
• Raspberry Pi – Media Centers – and AppleTV – David Schuetz
• Uncloaking IP Addresses on IRC – Derek Callaway

Ya hemos hablado aquí varias veces de las clases ofrecidas por OpenSecurityTraining. En esta ocasión nos hacemos eco de la actualización de la clase a la Introducción de la Ingeniería Inversa del Software, que ha sido renovada con material nuevo: Dealing with DLLs, Other Languages y Basic RE algorithms.

Los nuevos vídeos son los siguientes:

• Day 1 Part 1 (5:25) - What is RE and What Can it Tell Me?
• Day 1 Part 2 (30:03) - Refresher
• Day 1 Part 3 (34:57) - Know Your Tools
• Day 1 Part 4 (2:24) - The basic RE algorithm
• Day 1 Part 5 (7:14) - Applying the RE Algorithm to the Bomb Lab
• Day 1 Part 6 (22:29) - Lab Outline
• Day 1 Part 7 (6:33) - Creating the Bomb Lab Answers File
• Day 1 Part 8 (6:41) - Phase 2 Introduction
• Day 1 Part 9 (28:23) - Phase 2 Walkthrough
• Day 1 Part 10 (6:54) - Phase 3 Introduction
• Day 1 Part 11 (22:21) - Phase 3 Walkthrough
• Day 1 Part 12 (8:57) - Phase 4 Introduction
• Day 1 Part 13 (14:08) - Phase 3 Introduction
• Day 1 Part 14 (32:40) - Debugging
• Day 1 Part 15 (3:32) - Day 1 review
• Day 2 Part 1 (15:12) - Day 1 review 2
• Day 2 Part 2 (11:21) - Phase 5 Introduction
• Day 2 Part 3 (22:14) - Phase 5 Walkthrough
• Day 2 Part 4 (20:50) - Phase 6 Introduction
• Day 2 Part 5 (27:47) - Phase 6 Introduction 2
• Day 2 Part 6 (19:25) - Phase 6 Walkthrough
• Day 2 Part 7 (38:31) - Phase 6 Walkthrough 2
• Day 2 Part 8 (12:15) - Analyzing C++
• Day 2 Part 9 (7:39) - Next Class, Other Languages, & Day 2 Review

También está disponibles en Youtube con calidad HD. Y el contenido de la clase más algunos binarios para las prácticas lo podéis descargar desde aquí. El fichero .zip está protegido con contraseña para evitar problemas con los antivirus. La contraseña es "reclass2013", sin las comillas.

Introduction To Reverse Engineering Software

(click para ampliar, y aquí una noticia que tiene que ver con la viñeta de Pesqui)

Nuestro gran amigo y compañero del blog okajey comenzó una sección llamada "La Pira de Hades". Ahora tenemos un nuevo fichaje, Pesqui de Urbanarte, todo un crack, que va continuar con esta sección.

Nos vemos en “La Pira de Hades”.

No está en Spotify pero sí en GrooveShark, donde hay varias versiones.

Bob Sinclair

Esto es sólo apto para retro-geeks :). Si tienes que hacer una presentación muy geek y/o sobre algún tema retro, esto te va a gustar.

Vimdeck es una utilidad que se acopla con Vim para generar presentaciones en modo texto. Recalcar que no es un plugin para Vim.

Vimdeck está escrito en Ruby y lo puedes instalar a través de gem:

gem install vimdeck

Esta herramienta espera un fichero escrito en formato Markdown y a partir de éste genera una serie de ficheros, concretamente uno por cada diapositiva. Además de esto, añade tres operaciones de teclado: