Why learning assembly language is good for malware analysis

Usually when an attacker/malware author compiles his code using any number of compiled languages they end up with a machine executable format.
When an defender/malware analyst wants to disassemble this arcane mumbo jumbo machine executable format into a human readable format. The dis-assembler produces assembly language as its final product. You can read more about digital forensics at Lenny Zeltser's SAN forensics page here.

IBM restructuring its business units to bet big on cloud

The VAR guy reports big changes for IBM during 2015 including re-positioning business units for cloud business away from traditional silos of software, hardware and services. More on this here. This will be a fundamental shift in the way traditional IT companies have been doing business. More companies are trying to jump on the 3rd platform bandwagon. More on the 3rd platform in my later posts.

Vmware publications library any good?

I find VMware pub library to be a comprehensive and a great help for data center practitioners. Most of the the reference pubs are usually ignored and with vSphere 6 on the horizon, I am looking forward to new updates to the pub section located  at https://www.vmware.com/support/pubs/vsphere-esxi-vcenter-server-pubs.html

Home LAB for Cisco UCS and Nexus 1000v

Cisco UCS compute nodes drives most of today's converged infrastructure including Cisco ACI technology. It is useful to play around with a Cisco UCS lab at home. This link provides good home lab configurations

https://learningnetwork.cisco.com/thread/50700

Vmware Workstation is an invaluable tool for keeping different VM's up and running at a moment's notice. 

Social Engineering at its best!

I am sure IT Security professionals going to Blackhat must have really enjoyed the Advanced Practical Social Engineering course designed and written by Christopher Hadnagy author of Social Engineering: The Art of Human Hacking. I want to give a shout out to Christopher's blog and pod-casts which are very interesting. Check both the blog and pod-casts here.

Summary of changes from PCI 2.0 to PCI 3.0

Please visit the following websites to changes from PCI/DSS from version 2.0 to 3.0. Check out the link below.

https://www.pcisecuritystandards.org/documents/PCI_DSS_v3_Summary_of_Changes.pdf

What is PCI/DSS v3.0 Standards and why should penetration testers care?

PCI stands for Payment Card Industry and DSS stands for Data Security Standards.


We need to care about these standards as they affect at least three major business verticals like


  Merchants

  Financial Institutions



  Hardware/Software for merchants, financial industry etc


We now have updated PCI DSS version 3.0 standards located on the PCI website at
https://www.pcisecuritystandards.org/with increasing focus on penetration testing.

What’s changed in PCI/DSS standards v3.0 for pen testing?

Pen testing methodology is covered in section 11.3 which is new. It also states that pen testing should be according to NIST 800-115 standards. NIST 800-115 is just a framework for pen testing and we can remove parts which are not applicable for your customers. 

We need to test both from inside and outside the network. We also need to test to validate that the customer has segment their network and this network segmentation will reduce the scope of security controls applied to the network. The section also outlines we need to include application layer pen test at least check for vulnerabilities. 

New Sections

11.3.1 External pen test (To be performed annually. This test simulates an external hacker)

11.3.2 Internal pen test (To be performed annually. This test checks for internal rogue employee) actions.) 

11.3.3 Remediation & Retesting (Any exploitable vulnerabilities found during pen testing are corrected and tested to ensure the problem has been corrected.)

11.3.4 Segmentation Testing - Test the client's network is adequately segmented and appropriate security controls are applied on the network segment and this would also reduce the scope of network security controls applied on any particular network segment. 


When do the vendors need to comply?
Vendors need to comply with PCI 3.0 by end of the year 2014 and they have until end of June 2015 to comply with section 11.3 of PCI 3.0 which should give vendors and pen testers enough time to get ready!

 

Moving data in assembly language

mov is the most frequently used instruction in assembly language.

•mov is probably one of the most frequently used instruction in assembly language

•Usage: movx source, destination

–Where x is the following

–l for a 32-bit long word value

–w for a 16-bit word value

–b for an 8-bit byte value

–movl = Moves a 32 bit word value

•Movl %eax, %ebx

–movw=moves a 16 bit word value

•Movw %ax, %bx

–movb=moves a 8 bit byte value

•Movb %ah, %bh