Obviously still working on my 'Cloud and Internet Security' report (780+ pages/207K+ words now). Has been incredibly englightening and interesting.
A few data mining projects (law enforcement/intelligence) have really getting in the way of themselves really. So much data is being classified that doesn't need to be that it's resulting in a huge number of false positives, redundant data, and just plain waste. It's clear that there are some programs to fix this problem and to clean up a lot inaccurately marked data. Ironically, some material that I came across during research for this document clearly had unfriendly embedded content (I often just switch formats to one that doesn't allow for 'embedded/rich' content to reduce the chances of having to deal a potential security risk. If you understand how most existing AV/IDS/IPS systems work then you'll realise how trivial it can be to bypass them.).
http://cryptome.org
Seems clear that we are trudging over the same material over and over again. Declassified Walsh report from about a decade ago seems to cover a lot of the same ground that we are now covering in regards to surveillance/intelligence collection by law enforcement/intelligence.
https://www.efa.org.au/Issues/Crypto/Walsh/walsh.htm
Nice resource on biometrics. Seems clear that a lot more work research needs to be done though.
http://www.cse.msu.edu/~cse891/Sect601/textbook/
Nice introduction to reverse engineering.
http://hackingthexbox.com/
http://archive.org/details/HackingTheXboxAnIntroductionToReverseEngineering
A lot of work is being done with regards to cyberwarfare rules of engagement/playbooks at the moment. The 'Tallinn Report' is one attempt by NATO at covering these issues.
http://www.ccdcoe.org/
Is it possible to convert an Arduino device into an automated password cracking device? Believe it may be possible since it all it need do is send a stream of characters right? Will leave this experiment for when I have more spare time.
Looking at issues related to export control and cybersecurity it seems clear that there is quite a bit of flawed logic/hypocrisy out there at times. Countries/people clearly want stronger security/the ability to withstand any attack and yet they still want to maintain the ability to be able to attack others. One example of this is that depending on the nations involved even export of defensive capabilities/services is tightly controlled/restricted to neutrals and sometimes even allies. The irony is that the Internet already provides people/states with enough knowledge already to be able to acquire the knowledge themselves from both the defensive and offensive perspective. Take a look at the current Syrian crisis as an example with regards to their makeshift weapons, rockets, and even a hybrid car/tank. Where there is a will there is often a way (though it may be more difficult). Another thing that needs to be thought of is that human thought is often iterative. Inductive leaps in theory and implementation are far more rare than one may think. Many things can be inferrered or reversed. Critical sectors such as law enforcement, intelligence, defence, and advanced research and development have all been caught out (undercover agents, sources, and scientists literally blown via Facebook, Google, and so on).
http://www.bbc.co.uk/news/world-middle-east-20522585
http://www.networkworld.com/community/blog/famous-patriot-hacktivist-jester-shares-battle-chest-osint-tools
Confirmation of some of my earlier work in the 'Convergence' report.
http://www.ukmediacentre.pwc.com/News-Releases/UK-companies-leaving-the-security-of-their-data-on-cloud-to-chance-shows-research-by-PwC-Infosecurity-Europe-122c.aspx
Changing signatures of your network/system architecture is something I've been playing around with as indicated in my 'Convergence' report.
A few data mining projects (law enforcement/intelligence) have really getting in the way of themselves really. So much data is being classified that doesn't need to be that it's resulting in a huge number of false positives, redundant data, and just plain waste. It's clear that there are some programs to fix this problem and to clean up a lot inaccurately marked data. Ironically, some material that I came across during research for this document clearly had unfriendly embedded content (I often just switch formats to one that doesn't allow for 'embedded/rich' content to reduce the chances of having to deal a potential security risk. If you understand how most existing AV/IDS/IPS systems work then you'll realise how trivial it can be to bypass them.).
http://cryptome.org
Seems clear that we are trudging over the same material over and over again. Declassified Walsh report from about a decade ago seems to cover a lot of the same ground that we are now covering in regards to surveillance/intelligence collection by law enforcement/intelligence.
https://www.efa.org.au/Issues/Crypto/Walsh/walsh.htm
Nice resource on biometrics. Seems clear that a lot more work research needs to be done though.
http://www.cse.msu.edu/~cse891/Sect601/textbook/
Nice introduction to reverse engineering.
http://hackingthexbox.com/
http://archive.org/details/HackingTheXboxAnIntroductionToReverseEngineering
A lot of work is being done with regards to cyberwarfare rules of engagement/playbooks at the moment. The 'Tallinn Report' is one attempt by NATO at covering these issues.
http://www.ccdcoe.org/
Is it possible to convert an Arduino device into an automated password cracking device? Believe it may be possible since it all it need do is send a stream of characters right? Will leave this experiment for when I have more spare time.
Looking at issues related to export control and cybersecurity it seems clear that there is quite a bit of flawed logic/hypocrisy out there at times. Countries/people clearly want stronger security/the ability to withstand any attack and yet they still want to maintain the ability to be able to attack others. One example of this is that depending on the nations involved even export of defensive capabilities/services is tightly controlled/restricted to neutrals and sometimes even allies. The irony is that the Internet already provides people/states with enough knowledge already to be able to acquire the knowledge themselves from both the defensive and offensive perspective. Take a look at the current Syrian crisis as an example with regards to their makeshift weapons, rockets, and even a hybrid car/tank. Where there is a will there is often a way (though it may be more difficult). Another thing that needs to be thought of is that human thought is often iterative. Inductive leaps in theory and implementation are far more rare than one may think. Many things can be inferrered or reversed. Critical sectors such as law enforcement, intelligence, defence, and advanced research and development have all been caught out (undercover agents, sources, and scientists literally blown via Facebook, Google, and so on).
http://www.bbc.co.uk/news/world-middle-east-20522585
http://www.networkworld.com/community/blog/famous-patriot-hacktivist-jester-shares-battle-chest-osint-tools
Confirmation of some of my earlier work in the 'Convergence' report.
http://www.ukmediacentre.pwc.com/News-Releases/UK-companies-leaving-the-security-of-their-data-on-cloud-to-chance-shows-research-by-PwC-Infosecurity-Europe-122c.aspx
Changing signatures of your network/system architecture is something I've been playing around with as indicated in my 'Convergence' report.
http://www.militaryaerospace.com/articles/2012/07/raytheon-cyber-maneuver-technology-to-help-safeguard-army-networks-from-information-attacks.html
The more you dig the more you figure out that there is no single company that has a really 'pure history' when it comes to best security practice and even business process. The larger the firm is the more likely it will have a long history, have gone through a break up, merger, or acquisition which means that standards may often drop for a small period of time. Moreover, based on personal experience/observation vendor communication/co-operation can often be disengenuous. Patches are often delayed, a severe bug report can often be 'spun', or you can often be ignored completely... Communication is no guarantor and neither are legal frameworks as well depending on the people/states involved.
http://www.h-online.com/security/news/item/Huawei-sends-team-to-visit-critical-researcher-1741575.html
http://www.h-online.com/security/news/item/Huawei-s-routers-of-vulnerability-1657620.html
Interesting...
http://www.h-online.com/security/features/Detecting-CSRF-vulnerabilities-1743836.html
Soldering tips
http://www.fixup.net/tips/soldering/index.htm
On a finishing note, if you run out of (or prefer not to buy) disc scratch fixing fluid try toothpaste or bicarbonate soda. They are both light/mild abrasives and I've used them successfully.
- as usual thanks to all of the individuals and groups who purchase and use my goods and services
http://sites.google.com/site/dtbnguyen/
http://dtbnguyen.blogspot.com.au/
