Niels Provos

To get better control over the atmosphere in the forge, I have decided to build a blown gas forge based on a design by Tim Zowada.

Downloads OutGuess 0.2 - Source Code https://www.provos.org/uploads/outguess-0.2.tar.gz MD5 = 321f23dc0badaba4350fa66b59829064 SHA1 = d8d7ff3d8f492c3fbb075ecd2c6e87ce7cf13b80 RMD160 = 1411a83ae9e6c059f1d19054f19df65b9438a02e Stegdetect 0.6 - Source Code h…

A list of the top-10 malware sites found by Google’s infrastructure over the last two months is available at the Google Online Security Blog.

The 2nd USENIX LEET workshop is going to take place on April 21st in Boston next week.

In preparation for CodeCon, Nick and I wanted to see how HTTP performance differs between Libevent 1.4 and Libevent 2.0.

WOOT is the Workshop on Offensive Technologies.

This release contains a number of small bug fixes: 32-bit compilation has been fixed 32-bit policies are no longer created as Linux64 with running on a 64-bit system The source code can be downloaded here [sig].

I got to set up the anvil today and spent a few minutes hammering hot metal.

A new version of Systrace that supports 64-bit Linux installations can be downloaded from here.

We just released libevent 1.4.9-stable.

Usually, I get to find compromised web servers, but last week I was asked to fix one.

Jupiter, Venus and Moon are currently in close conjunction in the evening sky.

During my invited talk on web-based malware at USENIX Security, I mentioned SQL Injection as one of the more popular means of compromising web servers.

The CfP for the 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET ‘09): Botnets, Spyware, Worms, and More is up at: http://www.usenix.org/event/leet09/cfp/.

Earlier this year, I published the fantasy novel my father wrote 15 years.

I just finished a three day bladesmithing class with Grant Marcoux in Alameda.

This is another bug fix release.

You can download the source from the usual place: http://monkey.org/~provos/libevent-1.4.7-stable.tar.gz This release fixes a bug where headers arriving in multiple packets were not parsed.

This week is going to be crazy busy with HotSec and USENIX Security in San Jose.

With all the DNS stuff that is going on at the moment, it took longer than planned to release libevent 1.4.6-stable, but here it is.

As everyone was upgrading their DNS infrastructure to be ready for August 7th, some security reseachers independently discovered the DNS flaw and disclosed it.

As we are all trying to patch and upgrade our resolvers and NAT devices, I created a small image tag that automatically assesses the randomess of a visitor’s resolver: This is still in reference to the CERT Advisory on Multiple DNS implementations vulnera…

Over the last few days, we have heard a lot about DNS cache poisoning and how we need to get our recursive resolvers to use random source ports.

What is OutGuess OutGuess is a universal steganographic tool that allows the insertion of hidden information into the redundant bits of data sources.

This year, I have the pleasure of chairing the 3rd USENIX Workshop on Hot Topics in Security, an invitation-only workshop that provides a forum for leading security researchers to discuss current trends and new research ideas.

I often use Tor for anonymous web browsing; mostly when investigating malware distribution sites.

The Name of the Wind by Patrick Rothfuss is one of the best fantasy books that I have read lately.

I am happy to announce the release of libevent 1.4.5-stable.

Fifteen years ago my father wrote a fantasy novel that no publisher in Germany wanted to print.

I am happy to announce the release of libevent 1.4.4-stable.

This release addresses a number of correctness and reliability problems with the ptrace backend.

At WOOT this year, Robert Watson presented a paper on how to evade popular system call interposition systems, including Systrace.

When I got home from traveling at around 3am last night, I found a box with 10 books on the table.

The SpyBye source code is now available via http://code.google.com/p/spybye/.

SpyBye 0.3 adds an interesting twist to SpyBye.

During HotBots last month, I presented a paper on a systematic approach for detecting malware on the web called “The Ghost In The Browser”.

To make the best use of SpyBye, it’s important to understand how to interpret its output.

Another weekend, another release.

Exploits are often obfuscated to make it more difficult to detect nefarious activities.

Here is a typical example of a compromised web page.

The simplest way to get exposure to SpyBye is to configure your browser to use http://www.spybye.org:8080/ as proxy.

SpyBye is a tool to help web masters determine if their web pages are hosting browser exploits that can infect visiting users with malware.

Chris Evans from Google Security discovered an integer overflow in the Systrace kernel code.

I was going to do some late night hacking but then I found this.

Been travelling and working too much on other stuff lately to make much progress with Systrace.

This new release of Systrace adds translations for a number of new system calls and should also take care of zombies accumulating for users of the Linux ptrace backend.

Last October, I (Marius Eriksen) updated the Linux-kernel patches for systrace.

Systrace does not provide translations for all system calls.

It turned out that emulating waitpid for threads was more complicated then I initially assumed.