Some Songs About Appscan

Well, first of all, about Appscan

Appscan is big platform by IBM, and what I want to talk about in particular are:

• Appscan Standard
• Appscan Enterprise
• Appscan Source 

Those products deal with the security assurance 

Appscan Standard is actually the real Appscan. It has been purchased from Watchfire and as an Application Security consultant I have been using it in my daily job for ages. 

The Appscan Enterprise, it the same engine which is used in the Standard version, however, it has a web interface and some useful features like scheduling and saving different digital certificates for different scan jobs.

Appscan Source is what it used to be Ounce Labs. It is a product that can get your source code and point you to the security issues. 

Since I am working with IBM people, and from time to time, they point me to the some public technical information, I think that this is a good place to put it. 

enjoy 

--

Microsoft SharePoint scanning guidelines

http://www-01.ibm.com/support/docview.wss?uid=swg21301935

--

Troubleshoot license issues

http://publib.boulder.ibm.com/infocenter/rational/v0r0m0/index.jsp?topic=/com.ibm.rational.license.doc/topics/t_troubleshoot_lic.html

the IBM support site is on web sphere.. so be patient .. :)  

Certificate port binding: SSL Certificate add failed, Error: 1312 A specified logon session does not exist. It may already have been terminated.

There are very annoying messages in Windows. I will talk here an in the next posts about some of the security related errors and how do they help you to understand the problem.


So here is the thing: you have just Installed the certificate in the certificate store, and you can visually see it, but when you try to bind it to the ip port using netsh or httpcfg (more on this here: http://msdn.microsoft.com/en-us/library/ms733768.aspx) you get an annoying message saying nothing:  A specified logon session does not exist. It may already have been terminated.

 Microsoft Windows [Version 6.1.7600]  
 Copyright (c) 2009 Microsoft Corporation. All rights reserved.  
 C:\Windows\system32>netsh http add sslcert ipport=0.0.0.0:443 certhash=3045c0dab3764dd641a3742253c9b22e07acf645 appid={11223344-4455-6677-8899-AABBCCDDEEFF} clientcertnegotiation=enable  
 SSL Certificate add failed, Error: 1312  
 A specified logon session does not exist. It may already have been terminated.  

So after some time, of investigating the issue, it seems that the problem is that the certificate must be in the local machine store to be successfully binded with the port. All you have to do is to drag and drop it there

Moving cert with drag and drop is a simple operation. It copies the cert and it's private key.

So now the same command should work

 C:\Windows\system32>netsh http add sslcert ipport=0.0.0.0:443 certhash=3045c0dab3764dd641a3742253c9b22e07acf645 appid={11223344-4455-6677-8899-AABBCCDDEEFF} clientcertnegotiation=enable  
 SSL Certificate successfully added  
 C:\Windows\system32>

Nokia PC suite Contacts Database

Have you ever used nokia PC Suite? It is a cool product by Nokia. Among other cool stuff, it can manage your phone contacts. What I noticed, that the program somehow keeps the keeps the contacts and the calendar information, even though the phone is disconnected from the computer.

After looking in some user directories in the computer, I found some files in the Nokia directory and one of them id "PCCSContact.db". The .db extension told me that is might be some kind of database and opening a file in a notepad showed me that the first string of the file is "SQLite format 3". That is very logical. After all, SQLite is being frequently used by the light code developers, such as Apple with iPhone or Google with Offline Gmail extensions and Gears.

For those who did not know:
From wikipedia:

Unlike client–server database management systems, the SQLite engine is not a standalone process with which the application program communicates. Instead, the SQLite library is linked in and thus becomes an integral part of the application program. The library can also be called dynamically. The application program uses SQLite's functionality through simple function calls, which reduces latency in database access as function calls within a single process are more efficient than inter-process communication. The entire database (definitions, tables, indices, and the data itself) is stored as a single cross-platform file on a host machine. This simple design is achieved by locking the entire database file during writing.

The contact data is stored in Boyce-Codd normal form, which, in English, means that it is nice and compact, but less trivial to read. There is of course more data like modified_time_stamp , emails, details, pictures so if you are looking for data mining or forensics, this is an interesting place as well.

Let's say we want to store myself as a contact in such a way:

firstname:Ilya
lastname:Chernyakov
cell:1234567890

-------------------------------
number_data
-------------------------------
uid|number_full |number_type
20 |1234567890 |64

-------------------------------
string_data
-------------------------------
uid|text_data |field_subtype
20 |Ilya |2
20 |Chernyakov |3


As math professors like to say: it is easy to see that tables share the same uid for all the properties of the same contact. Using this SQL query we can read the contact information in a nicer form:

select s.text_data ||' '|| t.text_data as Name , c.number_full as Number
from string_data s, string_data t
join number_data c on s.uid = c.uid
where (s.field_subtype =2 and t.field_subtype = 4)
and s.uid = t.uid
order by 1

I have created a C# dll library that is available at sourceforge. As usual, any comments are welcomed. Please do not use this software to develop nuclear weapons :)

origin
http://programmingatnights.blogspot.com/2010/07/nokia-pc-suite-contacts-database.html

Hotel door hacking - By Barry Wels

Funny, I have been doing this for years at my parents' home using the intercom cable, however the guy suggests a universal way to open those locks.

I think that the video deservers our attention.

Taken from https://www.youtube.com/watch?v=7INIRLe7x0Y

And remember: It is not that I am paranoid - people just try to harm me all the time.

Thanks to Avi Douglen for sharing this.

USB to ATM-like machine

Recently, I got myself a new soldiering iron, and it is about time that used it for my job.

One of our clients is using is working on a ATM-like device for providing it's clients with self service options. It has a stripped off keyboard (without Alt and Ctrl button) to make it harder for you to press the Alt+Tab or Ctrl+Alt+Delete. Basically it is being used to pay bills and fees without disturbing the working personnel. Since the services are not that trivial (come on, we are talking about paying money to the government here) there is an earpiece hanging on the side of the device, and when you have a question, you can call a representative for a guidance.

Seems nice, right ? RIGHT ? WRONG!

The thing is that the earpiece is a Skype phone and attached to the USB port of the computer running Windows Vista, so in a matter of fact, we have an exposed USB port. Here is where my soldiering skills come in.

Apparently, the Skype phone uses the same pine-out USB does (duh) and, therefore, all we need is to connect the wires :

• 1- Ground
• 2- TR
• 3- RX
• 4- 5Vcc

I am not sure about the TR and the TX, Just play with them. the moment you are done, you can just plug a normal keyboard or a Flash storage.

I had this old ADSL filter that I managed to use it's RJ-11 connector and an old USB extenders female plug that I had at home. Some soldiering and a tape and here it is.

Now we can plug a keyboard, mass storage and even a USB hub.

P.S. I did a crappy soldering. Don't ever hire me for that :)