Tuts 4 You : Forum

[ Game Review ] Darkness 2

Wed, 22 Feb 2012 18:26:45 +0000

This week, Zero Punctuation reviews Darkness 2.

View the full article

TED: Shilo Shiv Suleman: Using tech to enable dreaming - Shilo Shiv Su

Wed, 22 Feb 2012 16:59:48 +0000

Has our technology -- our cell phones and iPods and cameras -- stopped us from dreaming? Young artist Shilo Shiv Suleman says no, as she demos "Khoya," her new storybook for iPad, which floats us through a magical world in 7 minutes of pure creativity.http://feeds.feedburner.com/~r/TEDTalks_video/~4/uFa8MUhKj4w

View the full article

[ BBC Tech ] EU court to rule on Acta legality

Wed, 22 Feb 2012 13:03:23 +0000

A controversial anti-piracy agreement is to be referred to the EU's highest court due to concerns surrounding internet freedoms.

View the full article

[ Kasp. Lab ] DDoS attacks in H2 2011

Wed, 22 Feb 2012 11:11:07 +0000

All statistical data used in this report were obtained using Kaspersky Lab's botnet monitoring system and Kaspersky DDoS Prevention.

View the full article

DEFCON : DEF CON 20 Contest & Event RFI

Wed, 22 Feb 2012 03:07:22 +0000

The DEF CON 20 Contest & Event Request for Information is live! If you already run or want to run a contest or event at DEF CON 20, it's where to find all of the info you need to get your contest or event on the map! Check it out at: https://www.defcon.org/html/defcon-20/dc-20-contest-rfi.html

View the full article

[ BBC Tech ] Megaupload founder granted bail

Wed, 22 Feb 2012 01:24:12 +0000

The founder of shut down file-sharing website Megaupload, Kim Dotcom, is granted bail by a New Zealand court.

View the full article

[ HITB ] Fake RIAA copyright violation notification serves malware

Wed, 22 Feb 2012 00:40:17 +0000

First spotted nearly a week ago, notifications of copyright violation supposedly sent by the Recording Industry Association of America are still hitting inboxes around the world.
The sender's email address is spoofed to make the message seem legitimate, and the email contains a warning and an attachment that the user is asked to open in order to see details of the violation.

Tags:

Industry News
Viruses & Malware

View the full article

[ BBC Tech ] Late Playbook OS upgrade released

Tue, 21 Feb 2012 20:11:06 +0000

Research in Motion releases an update to the Blackberry Playbook - almost a year later than first promised.

View the full article

OllyDbg Fake ImageName Bug

Tue, 21 Feb 2012 17:20:19 +0000

I have recently found a weird behavior in OllyDbg, which can further be used as an anti-debugging / anti-attaching trick. The problem occurs when enumerating the running processes if the "Select a process to attach" dialog box is opened.

The psapi "EnumProcesses" function is called to get the list of process identifiers (PIDs). For each PID, the psapi "EnumProcessModules" and "GetModuleFileNameExA" functions are called to extract the image base and full name of the main executable.

As i have shown in previous posts, the values in PEB.LoaderData can easily be manipulated. In this case i will manipulate only the full name of the main executable to be of an existing but malformed file. Surprisingly, OllyDbg trusts the new file name and starts to extract essential information from it. Information extracted includes MZ signature, optional header values, section table data, etc.

The interesting thing about the forged executable is that it is rejected by the OS loader but still used by OllyDbg.

To create a one-file demo for this bug, i had to embed the malformed executable into the original one as a binary resource.

As you can see in the image below, the number of sections is set to 0xFFFF (malformed executable).

The demo can be found here.
http://ollytlscatch....ttach_to_me.exe
The virustotal report can be found here.
https://www.virustot...sis/1329795141/
N.B. This has been tested on OllyDbg v1.10 only.

Update:
Another demo, that crashes OllyDbg upon debugging or attaching, has been created. You can find it here.
http://ollytlscatch....es/Debug_me.exe

TED: Chris Bliss: Comedy is translation - Chris Bliss (2011)

Tue, 21 Feb 2012 16:54:58 +0000

Every act of communication is, in some way, an act of translation. Onstage at TEDxRainier, writer Chris Bliss thinks hard about the way that great comedy can translate deep truths for a mass audience.http://feeds.feedburner.com/~r/TEDTalks_video/~4/5YfmJWl_730

View the full article