IT-Sec terms explained

threat actor = someone who wants to punch you in the face

threat = the punch being thrown
vulnerability = your inability to defend against the punch
risk = the likelihood of getting punched in the face
acceptable risk = your willingness to be punched in the face
attack surface = every part of you that can be hit, plus every place you hang out where someone could take a swing
attack vector = the route the fist takes to reach you: from the front, from behind, or via your buddy who holds you still

scusi / fixing eMudhra CA Keys Compromise in FreeBSD

Last active 2 weeks ago FreeBSD compromise eMudhra fix key

describes how to fix the issue in FreeBSD

0 0 1

fixing eMudhra CA Keys Compromise in FreeBSD

fixing the issue on FreeBSD ist literaly 3 commands:

sudo cp /etc/ssl/certs/14bc7599.0 /usr/share/certs/untrusted/14bc7599.pem
sudo cp /etc/ssl/certs/eed8c118.0 /usr/share/certs/untrusted/eed8c118.pem
sudo certctl rehash

scusi / spipe-ssh.md

Last active 6 months ago

0 0 1

Protecting sshd with spiped

This repository shows how to place spiped in front of your SSH daemon (sshd) in order to add an extra layer of symmetric-key protection and drastically reduce your exposed attack surface.

What is spiped?

spiped is a lightweight daemon designed to create symmetrically encrypted and authenticated “pipes” between socket addresses. It binds a local TCP port and forwards traffic to another socket—typically on the same machine—while encrypting and verifying all data in transit.

scusi / ConvertBinaryBpjmData.sh

Last active 6 months ago BPJM

0 0 1

1	#!/bin/sh
2	#
3	# USAGE:
4	# $> ./ConvertBinaryBpjmData.sh bpjm.data
5	#
6
7	RAWFILE=$1
8	OUTFILE=`strings $RAWFILE \| head -n 1`
9
10	od -t x1 -An -j 64 $RAWFILE \| tr -d '\n ' > $OUTFILE

scusi / dns_xor.go

Last active 6 months ago DNS-Tunnel FrameworkPOS Malware golang

0 0 1

1	// domain data encoding/decoding algo for FrameworkPOS Malware DNS-Tunneling Variant,
2	// as described on:
3	// https://blog.gdata.de/artikel/neue-variante-von-frameworkpos-schoepft-daten-ueber-dns-anfragen-ab/
4	//
5
6	package main
7
8	import(
9	"fmt"
10	"os"

scusi / parseFritzBpjmFile.go

Last active 6 months ago BPJM FritzBox golang

0 0 1

1	// parse a FritzBox Bpjm File
2
3	package main
4
5	import (
6	"os"
7	"fmt"
8	"bytes"
9	"io"
10	"io/ioutil"

scusi / bpjm.go

Last active 6 months ago BPJM FritzBox golang

go lib to scope with BPJM Lists

0 0 1

1	// go library to scope with the BPjM Censorship list
2
3	package Bpjm
4
5	import (
6	"net/url"
7	"regexp"
8	"crypto/md5"
9	"strings"
10	"bytes"

scusi / Parse.go

Last active 6 months ago BPJM FritzBox golang

script to parse BPJM file from a fritzbox

0 0 1

1	// tool that uses my bpjm library to load and parse a BPJM File from a FritzBox
2	package main
3
4	import(
5	"github.com/scusi/bpjm"
6	"fmt"
7	"os"
8	)
9
10	func main(){

scusi / gifExeExtract.go

Last active 6 months ago GIF Malware

go prog to extract EXE from GIF as Trojan-Ransom.Win32.Foreign did

0 0 1

1	## see also https://0x41414141.de/blog/2017-03-30-trojan-ransom.win32.foreign-hides-payload-exe-in-gif-file/
2	#
3	package main
4
5	import (
6	"bufio"
7	"bytes"
8	"container/ring"
9	"encoding/hex"
10	"flag"

scusi / rolling xor in go

Last active 6 months ago XOR golang

go prog which implements a rolling XOR

0 0 1

1	package main
2
3	import (
4	"container/ring"
5	"flag"
6	"io/ioutil"
7	"log"
8	)
9
10	var keyFile string