Security Opus - a week later

Security Opus rocked. Very laid back attitude (hey, it's San Francisco). Free drinks every night - thanks Microsoft, Richard and other sponsors! Great speakers and talks. Networking with friends in a relaxing environment. We'll do it again in September I think. BE THERE!

Some of the topics you missed that I liked (and can remember right now):

• Stefano Zanero ranted about Intrusion Detection|Prevention Systems. Stuff many of us have been saying for a long time like "Real-time response is not really possible" but he had the math and pretty graphs to prove it to management. IDS isn't dead but it's never been a killer app in my opinion. It is still very important to have in any environment.
• Cedric Blancher's presentation on 802.11 security was insightful and I spoke with a few people who hadn't yet heard about all of the attacks before.
• Shawn Merdinger from VOIPSA showed a few of VoIP's problems. He's primarily focused on client/handset issues vs protocol weaknesses or server issues but his liquid-fueled talk was informative and put the spark back in me to finish setting up an asterisk server. So many projects, so little time!
• Matt Hargett and Luis Miras have very strong opinions on source code analysis for vulnerabilities. It's a topic I'm looking into this year for work and understand it's a very difficult problem with no real good answer.
  
• Whoever named it "Web 2.0" should stop trying to name things. I'm tired of seeing crap about "Web 2.0". Every time somebody says it in a presentation, God kills a puppy or kitten from a no-kill shelter.

There were other talks about crytovirology, botnets, etc. Show your support and come in September. My favorite quote from Richard Thieme: "Foreclose on the antelope!"

Richard cracks me up sometimes, especially when he and Simple Nomad get to talking about UFOs and secret government projects (last year's SecurityOpus).

In other news, some more projects, exploits and scripts will be uploaded sometime this week when I get around to cleaning them up. It's been a busy week.

Exploit frameworks are the best

This week I wrote an exploit for a JRun vulnerability released in 2002! I was proud of myself as we rarely get the chance to write an overflow during a penetration test. Usually it's all web exploits, unpatched windows systems, poor administration, etc. My friend said we found "the oldest box on his network." So much for "no public exploits exist" as a mitigation! HA!

The hardest part of all this was getting a copy of the JRun software installed and running in a VM. It was so old the company (Allaire) had been bought twice so no installers could easily be found! A few hurdles later and within half a day I had a stable module written for Metasploit. Later in the evening I wrapped one up for Canvas. I don't have a copy of CORE Impact - it's a little expensive and, well, we do alright with what we have. :)

Dave Aitel once said he envisioned a future of exploit writing becoming a marketplace where they can be sold by third parties like ActiveX objects were in the early days of IE. Needed to do some video? Here's a library that'll help!

To be honest I don't see that happening. There's little value for me to spend some amount ($100 to $5000?) for a single exploit that may or may not work to "prove" the system is vulnerable. There's so much wiggle area when exploiting a system, even with the protections provided by today's frameworks, that it'll just be too unreliable. I'd have a hard time justifying the cost but maybe that's just me.

There's been talk on the Metasploit mailing list of putting together an exploit module repository. Something centralized that can be maintained by developers. I've been searching for a project, maybe this will be it. :) Anyone else that's interested drop me a line. I envision a Trac Wiki + SVN repository with some core supporters and community submissions/requests. Of course we'll have to weed out the 100s of "writemesumthin 2 hax myspace/yahoo/aim" but that's part of the fun!

Until then.. enjoy my meager contributions: http://grutz.jingojango.net/exploits/

SecurityOPUS is coming up March 19-21 here in San Francisco. It's an awesome conference and I highly recommend coming -- registration is still open. We don't have many get-togethers here for some reason other than big marketing events like RSA. There's a lot of talent in the bay area and this is a great way for the security community to come together more. Come! Learn! Enjoy! Eat some great food on Rich's dime! Then later come to our OWASP meetings. They're lots of fun and free beer when iSEC Partners hosts. :)