Presentation on "Security - An Introduction"

Here is one of my presentations on security titled - "Security for Thinkers". You may want to view the presentation in full screen (and if you see full presentation, treat me with a comment/feedback :-))

Don't miss to visit revived "Unstuck". I have made some changes to linkbars, removed some stuffs and added few stuffs. I m planning to make one presentation per week and host it here. I welcome your comments on this initiative - "Unstuck Blackboard" and Unstuck in general.

You may want to subscribe to "Unstuck" via Email subscription so that the email notifications is delivered to you whenever new posts/presentation is posted. Here is the link for Email Subscription.

Security - An Introduction

Thanks to Scribd, for making us to converse through presentation.

Web Goat - Deliberately Weak

We generally call "scapegoat" and in web application security world, there is also a scapegoat "WebGoat". WebGoat is deliberately vulnerable web application that helps us to learn web application attacks and this knowledge helps us to avoid those vulnerability in the application we develop. WebGoat is written in Java and so we can install on any operation system. All the web attacks are discussed in 30 lessons and it also comes with install guide. WebGoat is being maintained by OWASP. The details can be found here.

Java Decompiler - Reverse Engineering Java Bytecodes

For quite sometime, I have been working on reverse engineering and particularly on reverse engineering Java applications. When we say reversing, we immediately think of generating source code from the binaries. For Java too, we have a decompiler that works like a charm. The tool is Java Decompiler. Few months back, I tried using this tool for reverse engineering an enterprise web application. I did not face any issue either interpreting the output (source code) and in using the tool. It did a decent job in reversing the bytecodes.

Java Decompiler comes as three components. JD-Core is core for decompiling that has the logic for bytecode interpretation and creating source code. JD-GUI is the frontend for JD-Core. Apart from these two packages, it also has JD-Eclipse. As the name suggests, it is a plugin for Eclipse. I didn't get a chance to use JD-Eclipse. I used JD-Core and JD-GUI and recovered source code of more than 1000 class files. If you are security expert, this is one of the tools that you should have in your toolkit.

The homepage of Java Compiler can be accessed through this link.

Reverse Engineering Java Apps

Professionally, I am a Java developer and had worked sparingly in C++ and other scripting languages. I always felt that Java is easier and with the modern day IDEs like Eclipse and Netbeans, you don't even need to know what is compilation and building and similarly you dont even need to know OOPS. As an interviewer, I always face candidates, at least handful, who do not know how to set the classpath and compile using "javac".

Java by its inherent nature is very easier than C/C++ and these IDEs make it much easier. If forward is easier then in most of the cases the reversing should also be easier (but there are exceptions like security algorithms). Unfortunately, reversing Java applications is much easier and I would say it is much easier than developing it. In the next couple of weeks, I ll be writing few posts on my experiences with reversing Java applications and my inputs on how to carry out effective penetration testing for Java applications.

Most Fruitful Day

Today was a fruitful day. As I told yesterday, I needed to give a technical talk to Bank of America office at Chennai (this is Merrill Lynch office to be precise) on Security. It was raining later in the afternoon, but I had a little window when the rain stopped and started from my office around 3.15 pm. The journey to Merill Lynch took almost an hour. After going through security check (like the one in airports), I met my friend who invited me for the talk. Within few minutes we were ready for the talk.

The talk itself was very interesting to me and the audience asked me questions from basics to advanced. The management made the event lively by giving away some gifts to participants who answer questions. I felt like this was most interactive session I ever presented. I talked about Security, why it fails, myths and attack spectrum of a banking application. Due to lack of time, I cut shot the presentation by 15 minutes but overall I felt that I learned a great deal by giving this talk. I received a feedback of 3.5/5 and shows that I got to improve. During this talk, I met new friends.

On the way back to my home, I had an appointment with my college friend (who is research scholar in IIT Chennai). He was explaining me about his new venture and his business plans. We discussed about his consulting experiences, stock market, education system, social responsibility. We planned to collaborate in few initiatives that greats impact in society. I spent around four hours with him and it was quite a learning for me. We also discussed about algorithms, mathematical modeling, fiber optics, network security, open source and philosophy.

Overall, today (particularly the afternoon), went like a super fast express.

Security For Thinkers - Tech Talk

Tomorrow (26-Aug-09), I will be giving a technical talk in one of the famous US banks IT department at Chennai. After reading few pages of Beyond Fear and few pages in System Thinking, I tried to put together a presentation that primarily focused on security from system thinking point of view. So many things fail or produce adverse effects due to poor understanding and security is one. The attacks that are published are only very few percentage of the attacks and many do not like to report it. We never think about how to have our software/hardware secured. It is quite a irony that an attacker who knows about our application hardly anything cracks the software in no time or in few hours.

This shows the incapability in thinking and still we are playing a catching up game. In this presentation, I am planning to give system thinking view about security, the proactive security and sensible security. Unlike other security talks, I will not be presenting or discussing about Top 10 attacks as we never know which will be in Top 10 and we cannot predict when 100th attack will move to Top 10. We need a view that protects us always. Here is what I m planning to cover.

Credits should go to my friend M.S. Rajkumar Pandian for recommending me to BoA friend. Thank you Raj. I would have been much happier if we present this talk together.

Why Security Fails? - One Reason

All organizations pay huge price for security, something like running a separate department and spending millions of bucks to just secure from outdated attacks. Most of the software or devices just secure the assets from a worm that pampered few years back. We think that the attackers are naive (again and again they prove that they aren't). Why do we think that they are naive? It is simply because we never want to think differently, we never want to squeeze our brain and we don't know how to use our brain.

We focus on luxury part of life and so most of us discount ideas which needs hard work (like thinking). Thinking and productive thinking is stressful exercise and now you know why attackers keep winning. Attackers have great mindset (but obviously bad motive). But we say that our motive is good but we lack the attitude of hard work. We still think that someone's devices/products/software alone secure our assets and we fail to appreciate "thinking" is necessary to secure the assets.

This blurred view leads to "panic and patch", "let it happen, we have products to secure" situation. The situation becomes pathetic where the people are ready to offer sympathy and ouch. If you want to secure your asset, you need to be hard working thinker and build the ability to see through the system and emerge with good understanding of the systems. It is our understanding about system will secure not the devices.

So, the security fails due to poor thinking. This is going to be my topic for my upcoming talk in Chennai.