Category Archives: IT Security

Any security related topics such as posts about vulnerabilities, malware, rootkits

“The system cannot execute the specified program.”

Posted on 2010-11-02 by Oliver

There is a pretty interesting article over at winprogger.com about the problems connected with IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY (set through /integritycheck ever since VS2005) and ERROR_INVALID_IMAGE_HASH (aka Win32 error code 577). Now, I’ve been fighting with this problem for two full days and … Continue reading →

Posted in EN, IT Security, Programming, Reversing, Software | Tagged , , , | 4 Comments

Painful lessons I had to learn again and again

Posted on 2010-11-02 by Oliver

Since this is something I’ve stumbled over several times now and since it is discussed in Microsoft’s documentation only as if there is only the option to import it into your store, i.e. within your user account. Now, I was … Continue reading →

Posted in EN, IT Security, Programming, Software | Tagged , , | Leave a comment

LinkIconShim bequem verpackt

Posted on 2010-07-28 by Oliver

Hier ein vorübergehender Fix für das Problem mit LNK- und PIF-Dateien (CVE-2010-2568). Ich habe das Projekt LinkIconShim von Libor Morkovsky genommen und als MSIs verpackt um die Installation zu erleichtern. Erstmal muß man allerdings noch die korrekte MSI runterladen. Hier … Continue reading →

Posted in DE, IT Security, Programming, Software | Tagged , , , | Leave a comment

LinkIconShim conveniently packaged …

Posted on 2010-07-28 by Oliver

Here’s a preliminary fix for the problem with LNK and PIF files (CVE-2010-2568). I took the LinkIconShim from Libor Morkovsky and packaged it as an MSI for easier installation. For now you will still have to choose the right MSI, … Continue reading →

Posted in EN, IT Security, Programming, Software | Tagged , , , | 1 Comment

Fix for the LNK exploit

Posted on 2010-07-20 by Oliver

A clever fix has been made available against the exploit that has recently been found in the LNK icon handler.

Posted in EN, IT Security, Software | 1 Comment

Redefining “Security Researcher”

Posted on 2010-04-26 by Oliver

A nice blog post about the Full Disclosure and friends. // Oliver

Posted in EN, IT Security, Software | 1 Comment

Yeah … they are big, they can do it, right?

Posted on 2010-03-05 by Oliver

Connected_to_65.55.92.152_but_sender_was_rejected./Remote_host_said: _550_SC-004_Mail_rejected_by_Windows_Live_Hotmail_for_policy_reasons. _A_block_has_been_placed_against_your_IP_address_because_we_have_received_complaints_concerning_mail_coming_from_that_IP_address. _If_you_are_not_an_email/network_admin_please_contact_your_E-mail/Internet_Service_Provider_for_help._Email/network_admins,_we_recommend_enrolling_in_our_Junk_E-Mail_Reporting_Program_(JMRP),_a_free_program_intended_to_help_senders_remove_unwanted_recipients_from_their_e-mail_list:_http://postmaster.live.com/ I wasn’t sending from my own mail server, but through a really big German ISP. And that makes it even more delicate. // Oliver

Posted in EN, IT Security | Leave a comment

ecryptfs and sshd, again

Posted on 2010-02-25 by Oliver

In January I described an issue with ecryptfs and sshd. Now I wanted to get X11 forwarding to work with it, but the problem essentially remains the same. All I got this time was: /usr/bin/X11/xauth: timeout in locking authority file … Continue reading →

Posted in EN, IT Security, Linux, Software, Unix and unixoid | Tagged , , , , , | 4 Comments

Matching pool tags in Windows drivers

Posted on 2010-01-27 by Oliver

This is a note to myself, mainly. If the PROTECTED_POOL flag is set on a pool tag, freeing it will require the use of the same tag as when allocating it. For all other purposes the tag will be ignored … Continue reading →

Posted in IT Security, Programming, Software | Tagged , , | 1 Comment

China is right, it is censorship

Posted on 2010-01-27 by Oliver

If Germany or other EU countries try to block certain content due to “local laws” what’s the difference if China does it according to their “local laws”? And even the US, home of the free, is not exempt from censorship. … Continue reading →

Posted in EN, IT Security, Programming, Software, Thoughts | Leave a comment

De-registered сніжок.net

Posted on 2009-12-06 by Oliver

As already pointed out last year, the treatment of IDNs in Internet Explorer and Firefox is flawed, so that I decided to cancel the domain сніжок.net. However, apparently a few other domains have a privileged stance with respect to the … Continue reading →

Posted in EN, IT Security, Programming, Thoughts | Leave a comment

“Fun” news …

Posted on 2009-10-14 by Oliver

Finally John and Jane Doe, the average internet users, will get their security software from porn, gambling, banking and social networking sites if LS gets it its way. Frankly, I think this is a brilliant step in general, but it … Continue reading →

Posted in EN, IT Security, Lava-watch, Software | 3 Comments

Yoggie for the win …

Posted on 2009-05-05 by Oliver

Yoggie Open Firewall Pico is a pretty cool invention. As a geek I was basically forced to get myself one of those miniature Linux firewalls. Now, no one will deny that Yoggie exists for security reasons and although the separation … Continue reading →

Posted in EN, IT Security, Software | Comments Off on Yoggie for the win …

Conficker tools

Posted on 2009-03-31 by Oliver

A team of two German researchers has devised a method to detect Conficker (in its known variants) through the RSA keys which originally have been used by the Conficker authors against anyone attempting to fool Conficker into updating from an … Continue reading →

Posted in EN, IT Security, Programming, Reversing | Leave a comment

Harmful “badware” …

Posted on 2009-01-31 by Oliver

Google had an issue today. I noticed it by chance when looking for the name of an author. Later, coming to the office, Friðrik told me we had a major problem in that Google flags out company website with “This … Continue reading →

Posted in /dev/null, EN, IT Security, Software | Leave a comment

We have done it all …

Posted on 2009-01-17 by Oliver

“Secure” deletion of some piece of data. Programs, whether commercial or free – such as Eraser – offer to overwrite the data several times according to “DoD standards” (referring to the US department of defense) and so on. A study … Continue reading →

Posted in /dev/null, EN, IT Security, Software | 1 Comment

Zlob author leaves new year’s wishes in variant

Posted on 2009-01-15 by Oliver

As you can read here, the author of Zlob has once again hidden a message inside a variant. This time it’s about best wishes for the new year to the MS virus response team and future plans, so to speak. … Continue reading →

Posted in /dev/null, EN, IT Security, Software | Leave a comment

Schünemann will Internetzugänge effektiv abschaffen

Posted on 2008-12-16 by Oliver

Wie Heise berichtet, will der niedersächsische Innenminister (natürlich CDU) im Kampf gegen Kinderpornographie im Internet die Kunden von Internetzugängen zwingen eine Filtersoftware zu installieren. Und einige meinen nur der verehrte Dr. Schäuble säße allein in der Fraktion der Verfassungsgegner. Obwohl … Continue reading →

Posted in DE, IT Security, Programming, Reversing | Leave a comment

Patzige Humoristen bei Rasselkaefer.de (Update)

Posted on 2008-09-30 by Oliver

Letztens bekam ich eine Mail von Rasselkaefer.de, daß mein Benutzerkonto jetzt aktiv und bereit zur Nutzung sei. Putzig, ich hatte nie von der Seite gehört. Was tat ich also, ich suchte auf deren Seite nach dem Admin-Kontakt und schaffte nach … Continue reading →

Posted in DE, Gedanken, IT Security | 7 Comments

Affordable code-signing certificates, no chance!

Posted on 2008-09-07 by Oliver

GlobalSign == relatively cheap code-signing certificates. Cool, I thought. Bullcrap! After attempting to apply for a code-signing certificate for use with Authenticode in kernel mode drivers and other Windows binaries and then calling them on the phone I learnt that … Continue reading →

Posted in EN, IT Security, Programming, Software | Tagged , | 7 Comments