Tobi Waves

Nick Gall and IT Analyst

Nick talks about how to design an architecture that is sustainable over the long term? The secret of sustainable architectures is that they are using simple protocols that enable extensibility above as well and below. Simple and successful applications are identified by three properties.

               identifier    format            protocol
               ------------  --------------    ---------------------
examples        ip address    ip packet        ip protocol
email           @ address     rfc 2822         SMTP
web             URL	      HTML/MIME         HTTP
Web Service     URI	      SOAP              SOAP Processing Model
Containerized
Shipping        Container ID  20t Container    Porthandling Protocol 

David Heinemeier Hansson from 37signals

David talks about the "Secrets behind Ruby on Rails". Ruby on Rails is a integrated stack of web-applications frameworks. Basically a framework of frameworks that makes the Webapplication developers lifes fun.

Rails has sparked a huge interest in Ruby for Webapplication development since its publications. There are currently 7 books on Rails in the works and the first one is already published.

The three guiding principles behind Rails design and thus its success are:

Convention over Configuration - As long as you follow the golden path, Rails does things automatically. This results in less code and faster development. You only have to add explicit configuration information when you deviate from the golden path.

Change is instant - This allows a "Use it, break it, fix it, trash it, change it" work pattern. There is no compilation, deployment, server-restarts, and code-generation. This is mainly due to Rubies excellent introspection and open classes that can be extended and modified from user code.

Rails ships as a complete, integrated and familiar stack - this means once you have installed rails, it will start working right away and take care of all the tires of a web application.

Flexibility is highly overrated. Rails trades flexibility for ease of use.

Constraints are liberating! Because you do not have to think about it and take the decisions on your own.

Katik Subbarao from HP

He takes inspiration from the four elements and compares OpenSource to "Water" and closed source to "Earth". Water flows everywhere and is transparent. Earth is solid, opaque and it has to be transported explicitly from one place to another. He draws a 4 quadrant graph:

 Earth
 ^             |
 |  Desert     | Venice 
 |             |
 | -------------------------
 |             |
 |  Swamp      | Ocean
 |             |
 ----------------------------gt Water

You should aim to be in Venice with your IT organization. Buy and build your environment, taking the best from both worlds and become part of the eco system. Contract OpenSource developers to add the Features you need and pay them for support. This will give you contract security and OpenSource transparency at the same time.

Robert Lang on Computational Origami

Today origami designs are created with specialized computer software. Lang showcases spectacular dasigns, all done from a single sheet of paper without cutting. (www.origamidatabase.com ...) and (www.langorigami.com ...)

Dick Hardt from sxip

Dick has a exceptional presentation style. While showing about 10 slides a second he completely captures the audiences attention. See it to believe it.

Dick makes a case for Identity2.0, an electronic equivalent to drivers license, passport, national identity cards to enable Web2.0. Currently you have to register on every website seperately, and most of them rely only on your eMail for identification.

There are several solutions for this in the works, but nothing is widely accepted. Dick predicts that only a solution which leaves control with the individual (I choose whom I show my ID, and the state will never know whom I showed it to) will have a chance.

(www.sxip.com ...)

by Jorand Hubbard and Kevin van Vechten (from Apple)

All OpenDarwin sources are on-line and Google indexed.

One of the most prominent component is (webkit.opendarwin.org ...) the rendering component used in Safari.

If you want to put other OSS software onto your mac go to (darwinports.opendarwin.org ...) which is similar to freebsd ports. Use this to build software from source. If you want to get pre-built packages have a look at (fink.sourceforge.net ...)

OS X ships with many different version of gcc ... use gcc_select to switch the default compiler.

When building Darwin Kernel components, note that while Tiger ships with gcc-4.0 the kernel and its tools are compiled with gcc-3.3. Kernel compilation is governed by a number of environment variables which you have to set explicitly prior to compilation. There are also a number of missing header files.

To resolve all the potential problems you might run into when building Darwin components you may want to use the DarwinBuild Environment from (opendarwin.org ...)

With the darwinbuild command you can easily download and rebuild individual components of the OSX System.

If you are into hacking, OSX you will find all the normal communications from apple rather fluffy. This has mainly todo with the standard audience for this kind of material. Make sure you subscribe to the mailinglists for opendarwin, since all the important and knowledgeable tech people (from apple) are there too and you should be able to get answers at a high technical level. Also if you find a problem, make sure you do file a bug with apples bugreporting system. These bugreports go directly to the responsible technical people within apple.

The main problem with security scanners is that they produce a lot of false positives. If you work with a closed source tool there is no way for you to figure out where the false positives come from. With OSS tools these issues can be resolved easily.

Penetration Methodology

a) Discovery stage with whois, traceroute, google

b) Scanning to figure out which boxes exist

c) Service enumeration (service identification and banner grabbing) do not get confused by services running on the wrong port

d) Exploit known vulnerabilities if you can identify versions of services.

e) Install rootkits and log cleaning tools

Obviously only steps a) to c) are executed by security testing companies.

Google as Security tool

Google does not discriminate private information. Often you can find xsl and doc files in google which had not been put there intentionally.

Another great resource are Webserver directories without index files.

Error messages also get indexed by google. Especially php apps are very helpful in this respect, revealing lots of internal information like path and file names.

Webcams use standard file names, so if you search for these strings you can easily find lots of them.

If you find htpasswd files via google you can pull them, crack the passwords using john and then try password user name combinations on yahoo, google, hotmail. Since users often reuse user names and passwords, these things have a high probability of being successful.

The biggest advantage of google though, is that doing google queries is anonymous and will not be detected by the target.

For greater efficiency one could write a script that uses google webservice apis for automatically doing interesting queries in connection with a certain target.

Nessus

The coolest thing about nessus is that it is very easily extensible. It comes with its own optimized scripting language NASL. The advantage to writing NASL scripts as opposed to writing them in a random scripting language is that NASL scripts plug right into the comprehensive Nessus user interface.

SQL Injections for Web applications

Many web application have only rudimentary input validation.

$sql = " select * from users where user'$a' and password  '$b' "

how about trying to login with

' or true

This would end up as

select * from users where user'ddd' and password '' or true;

The possibilities are limitless. By adding a '; you could even start a completely new command.

Absinthe from (0x90.org ...) is a tool that tries to automate these attacks.

Tools

Metasploit is a point click root tool (metasploit.com ...)

Wikto is an automated google enabled website vulnerability scanner (www.sensepost.com ...)

Ettercap Network MITM attacks, content filtering, sniffing, etc: (ettercap.sourceforge.net < ...)

Whax is live linux distro with lots of AampP tools (iwhax.net < ...)