j-j.co.za
Sharing thoughts and ideas on business, security and photographyPresentation to UKZN MBA class on Security and Ethics
Posted on July 23, 2010I’ll be doing a presentation to the University of KZN MBA class on “Security and Ethics” on Tuesday 27th July at 7pm at the Graduate School of Business Lecture theatre 1, Westville Campus.
I have presented on a similar topic for the last 3 years, and have thoroughly enjoyed the hour or so spent with the class on each occasion. The presentation has generally encouraged some lively discussion and some intelligent questions and discussions. I’ll put up a copy of the presentation on the website sometime after Tuesday (probably next weekend).
Anyone interested in attending (who isn’t already part of the class :), drop me a note and we can arrange something.
The lurking dangers hidden in .PDF’s
Posted on June 13, 2010A couple of days ago there was some noise around some nasty payloads being delivered through .PDF’s. So just in-case you thought that opening a PDF file was safe, take a read of the blog post that Z0nbi put together on the actions of a spam PDF that he received :
” Today I was trawling through my Gmail spam folder like a good little mail monkey when I came across a rather strange bit of spam. Usually you just get rubbish about making your manhood the size of a small country or the latest twitter/gmail support/facebook AV malware. Most of the time I just ignore the messages due to them being very boring and not really worth a coffee and a few hours in Terminal…Today’s message was a little different. It was a very simple email with the subject line “New Resume” and one line in the body of the email saying “Please review my CV, Thank You!“. So, seeing as I have NO idea who the sender was and that there are no issues with the PDF format that I know of, I saved the PDF document to my desktop as I had a virtual machine I just knew the PDF would love immediately. ”
ISG (Whitehat) Durban June meeting : Information Warfare
Posted on June 13, 2010The details for the next ISG Durban (White Hat) meeting :
Title: Information Warfare
Speaker: Brett van Niekerk
Date: 17 June 2010
Time: 18:30
Venue: Elephant Room, M Block, UKZN Westville Campus
If you have any problems or need help getting to the venue, email ralfepoisson@gmail.com or drop me a mail and I will provide you with whatever details you need.
To get to the Elephant Room, first follow the map to get to M block, then go through the door to the right, in front of you there will be the access the LANs (light blue turnstiles and a door), the door will be open, go through and listen for the voices 
Importing NMAP .xml output into MS Access part 2
Posted on June 13, 2010As in the previous post, our initial NMAP scan produced an XML file over 600mb in size. To finish the scans we split the remaining ip ranges into more manageable chunks and ended up with another 20+ xml files of around 50mb each.
Running all of these through Exult XML to get a single consolidated access database was a bit problematic. The tool didn’t have the functionality to add additional scans to our original database, so all of the XML files had to be selected together and run through the tool to produce a single database. The conversion ran for 24hrs without completing so we had to come up with a better plan. Initially we considered running the conversion on a more powerful machine with much faster disk, but when trying to install the tool discovered the license key wouldn’t work. It used some (undisclosed) technique to ensure single install only. An email off to the developers and they sent us a new key (about 6 hours later – thanks to time differences, not any delay on their part). In the meantime plan B was in place.
Looking through the raw XML files I saw that the vast majority of the IP’s were non responsive and those few lines indicating this were taking up an awful lot of space when looked at collectively. A quick search and replace to remove these lines and the XML files were reduced to about 1/20th of their original size. With the new reduced file sizes Exult happily produced our Access database in less than half an hour and we were ready to continue with the exercise. The old sayings about better planning and new strategies certainly applied here.
Using access we were then able to produce great summary reports to pull out details on top active ports, numbers of machines in each class, active IP ranges etc etc. Next step choose our samples for more detailed scanning.
Importing NMAP .xml output into MS Access
Posted on June 03, 2010Over the last few days we ran a really large discovery scan on a client’s network. The scan was discontinued part of the way through and at that stage had produced a 650Mb .xml file. Smaller files are easy to load into Excel or Firefox to view and work with. With this much data we needed a more workable solution.
The first though was to import it into MS Access 2007. Access has built in import filters, easy enough we though. Two error lines in a table and no data brought an end to that hopeful idea. A little bit of googling found as a tool that promised to do pain free importing of XML into access, building the table structures on the fly and automatically creating the necessary table links.
The Exult XML converter from novixys.com was a lifesaver.We downloaded the trial, tested it on a scan of the local class C and it worked wonders, creating all the required tables and links. $105 later on the credit card and the full version was purchased.
Using it on out full scan file was a little trickier. Since we aborted the scan the .xml file hadn’t been properly completed. Exult didn’t like the incomplete file so threw out an error message and refused to build the access database. A comparison of the short test scan and the full scan revealed the missing XML tags. We copied and pasted these over to the full file, updating the scan information manually, and saved the file. Running Exult again took a while (over an hour) but produced the required file. Perfect solution.
Thanks Novixsys.
We are scanning the rest of the network as we speak. Not sure how we will import the balance of the .xml files into the same database. Hopefully Exult can do that for us too. Will find out soon enough 
ZaCon II Call For Papers
Posted on May 28, 2010Date : 9 October 2010.
Location : University of Joburg. Joburg.
Cost : The goal is to hit breakeven on the costs, so an entry fee (if charged) will be low.
Many other conferences exist to cater either to the strictly Academic or Professional individual. We want a simple community based forum that is completely free of corporate affiliation (or shilling). The intention behind this is that the passion for the field or of sharing knowledge should be the primary motivation of attending or speaking at this conference.
We aim to fulfill these objectives:
* Provide a platform for publication of infosec research
* Showcase free locally-developed infosec tools
* Support the interaction of industry, academia and the interested public
* Encourage discussion on infosec / hackery / sec-related-geekery at large
* Build the ZA infosec community
* Provide a platform to up-n-coming talent
Closing date for submissions is 20 August 2010.
Contacts
* Site: http://zacon.org.za
* Abstracts: abstracts AT zacon org za
* Organisers: people AT zacon org za
* IRC: #zacon on irc.atrum.org
Information security and its impact upon society (Jhb)
Posted on May 27, 2010by Prof. Vijay K. Bhargava, FRSC, FIEEE
DATE: Monday 7 June, 2010
TIME: 10h00 for 10h30 to 12h00, after which lunch will be served
VENUE: The Kerzner Building, Conference Room 1, Faculty of Art, Design and Architecture, Auckland Park Bunting Road Campus (click here for a map and directions)
COST: No cost, free-of-charge
There is no point in having information unless it can be communicated from one point to another point (telecommunications) or from one time to another time (storage). In both cases, protecting information from unauthorized access, modification and disruption is critical. Cryptography is a key technology in protecting information. It was traditionally concerned with maintaining confidentiality. Recently, there has been a dramatic growth in the applications of cryptography in other areas such as commerce.
Modern cryptography can be divided into symmetric-key cryptography and public-key cryptography. In this talk, some of the current symmetric-key and public-key cryptographic techniques used in achieving information security are outlined. These include the Advanced Encryption Standard (AES) which is the symmetric-key encryption standard adapted by the US government, and two well-known public-key cryptosystems, namely RSA (the initials of its inventors) and Elliptic Curve Cryptography (ECC).
The impact of information security upon society is then outlined. In particular, we focus on the usage of information security in Internet filtering. The Internet filtering can take place in different levels: local, organizational or national. In all these levels, the objective of filtering is to prevent or limit access to information/content that is against national/cultural values or is considered harmful for the users whether they are children or adults. Some of the current filtering techniques are outlined, as well as some of the circumventing methods to bypass it.
For catering purposes it is essential to register by latest 3 June 2010. For further information and regstration, please contact:
Monya Badenhorst, University of Johannesburg
Tel: 011 559-4743, Cell: 083 770 5902, Email: monyab@uj.ac.za
White Hat – May 2010 : Metadata: Have you sprung a leak?
Posted on May 20, 2010The details for the next Durban White Hat meeting are now available.
Title: Metadata: Have you sprung a leak?
Speaker: Sean Thomas
Date: 27 May 2010
Time: 18:30
Venue: Elephant Room, M Block.
If you have any problems or need help getting to the venue, email ralfepoisson@gmail.com or drop me a mail and I will provide you with whatever details you need.
If all goes according to plan will see you there.
ITWeb Security Summit 2010
Posted on May 19, 2010I was up in Johannesburg last week to attend and co-present at the IT Web Security Summit 2010. The conference had some really good speakers (Joe Grand, Moxie Marlinspike, FX, Charlie Miller, and others) covering a wide variety of most interesting topics.
You can read some articles about the conference, the speakers and the presentations at the link above. Alex Kayle did a brief email based Q&A ahead of the presentation and wrote up the following article. It gives some idea of what the presentation is all about.
I was co-presenting with a colleague, David Volschenk on the implementation of Security and control frameworks. We took two hypothetical companies (combined from various client experiences) and compared the processes and experiences to contrast what worked and what didn’t across the organisations, while looking at the key drivers (of which King 3 is now a significant one). This was woven around Dickens’ “A tale of two cities” to bring a bit of a different angle into what otherwise could have been quite a dry topic. Take a look at the King 3 responsibilities on the Board of Directors if you haven’t already. They are quite onerous compared to King 2 (which pretty much ignored IT governance). The King 3 report is available for download on the Institute of Directors (IOD) website.
Our presentation on the day went down reasonably well to quite a full venue. Thanks to all those who attended, hope you enjoyed what we had to say.
The presentation has been uploaded for all those who may wish to check it out.
It’s a new beginning
Posted on April 24, 2010It took a cold (well for Durban) miserable autumnish first day of the long weekend to finally get motivated to get this site back up and running again. After going through the process of changing ISPs a few times in short succession I finally have a new home (thanks Gridhost.co.za) and things are back up and running again.
The content from the old site is backed up on my old PC (which now won’t boot – duh) so it is time to start afresh. When I eventually get around to recovering the data from the old PC I will bring anything useful across.
The most accessed part of the old site was the Oracle default passwords list, linked from Pete Finnigan’s security site (www.petefinnigan.com) so I have uploaded it. You can grab it on : Oracle password list
Now to find a theme I like (that is usable from mobile devices and blackberry).
What people say
Close block