February 28, 2009 | Dominique Karg

Upcoming Installer testing version 1.2beta1

I’m proud to announce the availability of the first public testing release of the upcoming installer. We’re in final stages of testing now, and tho there are still known issues it’s time to get community feedback on it. Many many thanks to anybody willing to help test this iso. Please keep in mind that…

February 3, 2009 | Jaime Blasco

New Directives

I’ve just update the public CVS with some new directives as part of the effort we are doing to improve the upcoming installer: Attacks: Possible Successful Attack: Reverse Shell Access to the System Possible POP3 Bruteforce against SRC_IP Possible FTP Bruteforce against SRC_IP Command execution against webserver on DST_IP File /etc/passwd access on DST_IP …

Get the latest security news in your inbox.

Subscribe via Email

January 3, 2009 | Jaime Blasco

25C3: Fake CA Certificates

A security research team has demostrated how to use MD5 collision to create a rogue Certificate Authority certificate with a cluster of 200 ps3s!! You can find all the information here The attack take advantage of a weakness in the MD5 cryptographic hash function that allows the construction of different messages with the same MD5 hash and affects CAs that…

October 15, 2008 | Jaime Blasco

Microsoft Exploitability Index

Microsoft has just added a new index to new security bulletins to provide additional information about the potential exploitability of vulnerabilities associated with a Microsoft security update. The index classify each vulnerability with the Exploitability Index Assessment that indicate the likelihood of functioning exploit code, the three possible values are: - 1 Consistent exploit code likely - 2 Inconsistent exploit code likely …

October 15, 2008 | Dominique Karg

Tutorial 7: Feature highlight / pre-tutorial on Risk Maps

Introduction Today I would to share something interesting we’re working on: Risk/Availability/Vulnerability indicator Maps. The purpose was to fit the most important information that can be gained from ossim all over it’s interface, into a simple to use, simple to manage and simple to analyze interface. We already had an approach to both, to…

August 22, 2008 | Dominique Karg

Zattoo… Scam ?

#tags zattoo,tv,scam After having used their service for quite some time I received the announcement that they wanted to start charging users a samll fee. I’m talking about Zattoo. Quoting their site:   Zattoo is real TV on your PC - andd it’s absolutely free. It’s the football game as you chat,…

August 22, 2008 | Dominique Karg

NTop session query script

While coding the session monitor a couple of weeks ago I developed a quick script which could query ntop for session information. Jaime started using it for graphing now, so I thought it might be useful to soembody.   import sgmllib, re, sys import socket from sets import Set class MyParser(sgmllib.SGMLParser): "A simple parser class." def parse(self,…

August 20, 2008 | Jaime Blasco

3d Nmap

Here is a screenshot of a project I’m working on. The tool parse XML nmap scan files and shows an interactive 3d environment where you can inspect nmap scanning results. I’m developing with XNA (C#). I’ll will publish the code as soon as I fix some errors. …

August 11, 2008 | Jaime Blasco

Last Scada OPC Nessus Plugins

We have released some new Nessus Plugins related to OPC Servers security issues. List of New OPC Nessus Plugins: Multiple vulnerabilities in Comsoft Profibus OPC server Multiple vulnerabilities in Beijer Electronics OPC server Multiple vulnerabilities in VIPA OPC server Multiple vulnerabilities in Gesytec Easylon OPC server 2.0 Multiple vulnerabilities in Junzhi BACnet OPC server Multiple vulnerabilities in IPCDAS NAPOPC OPC server …

August 11, 2008 | Jaime Blasco

New Scada OPC Nessus Plugins

Today we have released some new Nessus Plugins related to OPC Servers security issues. List of New OPC Nessus Plugins: Multiple vulnerabilities in KEPware KEPServerEx 4 OPC server   Multiple vulnerabilities in Triangle MicroWorks OPC Server 2.0.2 Multiple vulnerabilities in Comsoft L1 OPC server We’ll release new plugins related to OPC and Scada in general during the next weeks!!! …

August 6, 2008 | Jaime Blasco

An approach to malware collection log visualization

I have just published an article related to malware collection log visualization. The paper focus on visualization of Nepenthes logs using AfterGlow. In the paper you can find information about correlation ips with countries and binary files with ClamAV signatures with the goal of generating interesting graphs. Get it here …

August 6, 2008 | Jaime Blasco

Visualization of Api calls and Imported symbols of malware binary files

I’m developing a tool to extract interesting information from malware files with the goal of generating a relation graph. The tool extract api calls and imported symbols of binary files, I?ve make some interesting graph from malware files collected by Nepenthes. # # Jaime Blasco - jaime.blasco[at]alienvault.com # # Thanks to Jan Goebel # [Amun - low interaction…

Watch a Demo ›
Get Price Free Trial