IT Security Lab The Playground for IT Security Specialists and Pentesters

13Apr/110

Knowledge sharing event: Risk-based approaches to protecting your data – London, Tuesday 19th April

I would like to invite everyone to the knowledge sharing event which my company (7Safe) is arranging in London next week. This will be about risk-based approaches to protecting data. This suppose to be much bigger event (joined with Core Security Technologies), especially comparing to the one we did last year. Interesting (and very much up-to-date!) topics and presentations, highly recommended to attend! As you may notice, I also would be presenting something there (presumably cool), but what is it...? As for now it's a little secret. :-)

Time: Tuesday 19th April

Location:
Furniture Makers’ Hall, 12 Austin Friars, London, EC2N 2HE
(Nearest convenient tube: Bank, Moorgate, Liverpool Street)

More info:

Download the PDF with the invitation (as seen above) from here [invitation].

Please don't forget to confirm if you want to come: send the e-mail to pentestinfo(@)7safe.com /remove brackets of course/

C U there! :-)

A.

 

D:\7SAFE\London 19.04 - Event\image.jpg
12Apr/111

Training – Hacking and Securing Oracle Database (11g)

My company (7Safe) will be delivering the training at the nearest Blackhat 2011 conference (Las Vegas). This will be about hacking and securing Oracle Database (11g), so highly recommended to be there! I took a liberty to prepare a small promotional video about it. So take a look and well... SEE YOU IN VEGAS! :-)

When:

  • Weekend Training Session: July 30-31
  • Weekday Training Session: August 1-2

 

Registration:
http://blackhat.com/...

More details:
7Safe together with Red-Database-Security will be delivering the two-day hands-on course at Blackhat 2011. The course will teach the audience the security problems related to Oracle database. The training covers a variety of security problems arising from flaws such as insecure design, insecure features/packages, insecure PL/SQL code, patch management, weak passwords etc. The second day will focus on securing and hardening databases using built-in oracle features along with a number of externally available scripts and tools. Implementing auditing solutions will also be a part of the training. The audience will have access to an infrastructure with a number of Oracle components deployed, and they will be encouraged to identify/exploit/patch security vulnerabilities as they learn them. The training will provide software developers understanding of writing secure PL/SQL code, DBAs the understanding of thorough auditing of the database and penetration testers the understanding of how to break the unbreakable Oracle.

3Jan/115

Changed language does not persist when Skype is restarted: how to solve the annoying issue

You know, I like intelligent and handy software. I really do. But I hate with my all heart when the application (or the application's author?) is eee... "too smart". ;-) And what especially makes me nervous is when author calls some idiotic application's behavior "a  feature". I think Skype is a nice example of it. Look at this:

I have the default system language in Windows set up as English, but the default one for the non-Unicode programs is set to Polish. Nothing wrong with it, right. So when I start Skype for the first time it happily detects this setting and switches its language accordingly to the Polish too. Chaaarming. ;-)

Now let's imagine that I want to change the default Skype's language permanently to English (well, I much prefer English UI in all apps, ok). Seems life is easy: click the main menu, then Tools --> Change language --> English ... and the language is changed. Now try to close Skype and open it again... What you you see: the application's language is immediately switched back to Polish! Ok, you may try to attack the problem from the different side: Tools --> Options --> Tab: General setting --> Languages combo: English, then Save. Unfortunately the effect is exactly the same: when Skype is restarted - it switches the language to the one set up as the default for non-Unicode programs (in my case: Polish). God knows why this proggy has such amazing feature, but believe me - to change the language manually after each restart is becoming pretty annoying after some time.

As usual, I google the problem and quickly found out that I am not alone: look here for example http://portableapps.com/node/21644. So can we do anything? Yes we can®! :-)

I wrote a small program which runs the Skype and then simulates mouse clicks on the main menu and kind of "pseudo-manually" switches the application's language to the default one (English). This is also a nice small example how you may access the main menu of the application "B" from the code of application "A" and execute some  functionality in application "B". No worries, we are not "literally" moving the mouse cursor the the menu, but issuing some appropriate system messages - so everything is pretty elegant.

Ok, if someone needs only executables here they are (with the source code in Delphi):

Usage is very simple: extract the executable and put it to the same folder where your SkypePortable.exe or Skype.exe is located and then run. My little program runs Skype, waits until it is loaded and switches the language to English. Job done! :-)

Some technical background

Ok, so this is how it works. First of all we have to find the Skype window in the system (assure it exists, so we may get it's handle and access its child elements). This is rather trivial, so no need to explain anything. Once the window is found this is what we are doing:

var
  menu: HMenu;
  id: integer;
  s: Array[0..255] of char;
begin
  tmrMain.Enabled := false;

  h := findWindow(pchar('tSkMainForm.UnicodeClass'), nil);  //--- find Skype's window
  menu := getMenu(h); //--- find the main menu
  GetMenuString(menu, 5, @s[0], 255, MF_BYPOSITION); //--- get the text of 6th menu item (should be '&Help')

  if string(s) <> '&Help' then  //--- current language is NOT English
  begin
    menu := getMenu(h); //--- main menu
    menu := GetSubMenu(menu, 4); //--- find the 5th menu item

    //--- activate this (5th) menu item, so all subitems can be redrawn. This is IMPORTANT!
    SendMessage(h, WM_INITMENU, WPARAM(menu), 0);
    SendMessage(h, WM_INITMENUPOPUP, WPARAM(menu),0);

    menu := GetSubMenu(menu, 2); //--- find the 3rd submenu item

    id := GetMenuItemID(menu, 9); //--- 10th menu item (select "English")
    PostMessage(h, WM_COMMAND, id, 0); //--- click it! :-)
  end;

  SendMessage(h, WM_SYSCOMMAND, SC_MINIMIZE, 0);
  application.Terminate;
end;

So 1st thing we have to do - we have to check what language is set up currently. We are getting the text of the 6th menu item and checking if it is equal to "&Help" or not. Currently it's "&Pomoc", which means the current language is not English (yea, it's Polish actually).

This is the code used for checking:

  h := findWindow(pchar('tSkMainForm.UnicodeClass'), nil);  //--- find Skype's window
  menu := getMenu(h); //--- find the main menu
  GetMenuString(menu, 5, @s[0], 255, MF_BYPOSITION); //--- get the text of 6th menu item (should be '&Help')

  if string(s) <> '&Help' then  //--- current language is NOT English
  begin
  [...]
  end;

Now we have to iterate through the menus and sub-menus and run some action on the target item. Look at this code:

    menu := getMenu(h); //--- main menu
    menu := GetSubMenu(menu, 4); //--- find the 5th menu item

    //--- activate this (5th) menu item, so all subitems can be redrawn. This is IMPORTANT!
    SendMessage(h, WM_INITMENU, WPARAM(menu), 0);
    SendMessage(h, WM_INITMENUPOPUP, WPARAM(menu),0);

    menu := GetSubMenu(menu, 2); //--- find the 3rd submenu item

    id := GetMenuItemID(menu, 9); //--- 10th menu item (select "English")
    PostMessage(h, WM_COMMAND, id, 0); //--- click it! :-)

Important detail: look at strings highlighted in red: this is important element of the code as the sub-menu with the list of languages is generated "on-the-fly" once the parent menu item is activated. Without it: the 10th menu item (language "English") simply does not exist, (hence can't be called).

One more remark: the proposed solution requires Skype user interface (Visual Style of the window) get running in "Classic Windows" mode.

29Dec/101

More 3D Fun with Kinect and Delphi. You can grab and save still 3D frames!

Foreword: I am still in a Christmas mood. ;-) And considering  a really huge interest in such "sparkling marriage" (Delphi and Kinect) and a very positive feedback from you guys, - I made some quick changes in the 3D demo, (which you should already know well), and added even more cool features. This is what was done:

  • Most important thing: now you can grab 3D frames (3D data + 2D mapping), save it and run on a computer without Kinect! No need to have any drivers installed. You can give this program to your friends and they will be able to see your 3D pictures! :-)
  • 2D to 3D mapping is fixed. It's still not ideal, but much better then before.
  • You can switch on/off 2D and3D viewing mode. Pretty handy.
  • It is possible to manage motor and change tilt of the Kinect.
  • Newest version of Kinect.pas is included (Simon J Stuart - thank you for the update! More info about TKinect project is here)
  • Bug fixed here and there.

EXE is precompiled as usual, so can be used right away. Here is the link to EXE and the source code in Delphi:

http://itsecuritylab.eu/files/kinect/kinect_delphi_3dpoints.zip

To make yourself more familiar with what the story is about, I strongly encourage you to look through the previous post about the Kinect and see the movie.

How to save/load3D frame

It's pretty easy actually. Select Frame --> Save from the main menu (you didn't expected anything else, yea?), then give a name without file extension. Program will grab the current frame and create 2 BMP files: one for 2D and the other for the 3D data (yes, they are just regular BMP files).

Those files would have a special suffix inside. A keywords: _KinectRGB and _KinectDepth.

If you want to open a frame: go to Frame --> Load and point to any of those two files. Program would find it's way to load them properly :-)

3D view on/off

There is nothing to explain here really.

Some sample images are included in the package (e.g. a nice 3D view of my corridor) :-)

This is it. Have fun and definitely drink enough to celebrate a New Year properly!

27Dec/1018

Having Fun with Kinect and Delphi (examples of 2D and 3D visualization)

Well well well... All signs in the Sky and on the Earth clearly say: it's a Christmas time! So it's time to have some rest and fun, and definitely nothing can be better then to spend some time with family and a new toy. ;-) Actually it's my son who got the XBox with the Kinect, but well... let parents have some fun too, right!

It's not like I am trying to reinvent the wheel (there are plenty of applications using Kinect on PC), but recently I did not find any nice examples of how this incredibly cool thing can be used with Delphi. And you don't think I can leave it "just like that", don't you? ;-) So see the results below (video) and so more technical details of both applications (2D and 3D visualization). So as for today there will be no hacking, boys and girls, but just pure awesome 3D-virtual-reality joy... :-)

Ok, so you want to try to get those samples tweak them probably and run your own code? There is nothing more simple:

Prerequisits:

Everything is installing like a charm. Some subtle obstacles with GLScene, but nothing too complicated to be mentioned really. Important: Before you run anything - be sure that the Kinect device is recognizable by your computer (check it in you Device Management panel).

Ach, almost forgotten: take the source files of my applications from here:

Running all that stuff

Now you can try to compile and test both applications. More details about how those application can be used you have already seeing in the movie. Pre-compiled exe files are already included into ZIP packages, just for your convenience. So at the end this is what we have:

2D data visualization

The experiment showing how to collect, process and draw the Kinect's data on the screen. Rather typical,- you've seen it before for sure. Additional challenge was to write a function which would be able to "track  blobs" - areas on the screen with similar pixels. This is needed to track your hands, fingers, nose or whatever you want to use. It is far far from ideal, but surprisingly works!

One more remark: this DOF function, selecting pixels in certain 3D range - is a part of the application, not the Kinect hardware.

I also hope you will forgive me such eeee... "untypical" way of getting depth data from pixel's color by such innocent transformation: RGB -> HLS -> [custom function] -> range [0..255]

3D data visualization

You can see my room (and actually yours too) in 3D in wobbling 3D virtual screen, containing tiny colorful dots :-) Do you like my Xmass tree?

So you see, Delphi is so nice and (important!) easy language (appropriate for lazy coders), so even writing pretty complex applications can take you just couple of hours. I also hope now even more people will start playing with Kinect and do some cool things, [so more happiness will come on Earth this Christmas, etc, etc.]. Remember: You are the controller®. Amen. :-)

Special thanks for Simon J Stuart for his TKinect Delphi component
and for Jet Noir (http://soundcloud.com/jet-noir) for her music for the video!

This is it. Let me know it you like those crazy apps, and well... Have a nice Christmas and a happy New Year! :-)