C++0X becomes an international standard

Who would have thought we would see Duke Nukem and C++0x materialize in the same year?  Well its official,  C++0x has become a standard with unanimous approval.  C++0x has some interesting features such as Range-based loops, lambda functions and type inference.  Its been almost a decade for C++0x (and even longer for Duke which makes me wonder what 3D realms was doing?).  As a big fan of Bjarne Stroustrup I must admin I'm excited.  

Hacking: The Art of Exploitation (Review)

Hacking is a powerful topic.  People with absolutely no interest in computers can still be captivated with a story about hacking.  Anyone who displays the slightest amount of technical ability will repeatedly be asked about hacking, how to hack and how to learn to hack.  When I'm asked "How can I learn to hack?" I have one reply.  Buy Hacking: The Art of Exploitation.  

I have read both versions of Hacking: The Art of Exploitation and both times I have been surprised and impressed.  The reader is first given a definition of what hacking actually is (the unintended use of laws or properties of a given situation as Jon explains).  Then they are walked through a gentle explanation of programming with non-technical real world examples.  Comparisons are made between giving driving directions to a person and how to program those same directions for a computer.  This ensures that the reader is not overwhelmed when they realize they are learning to program. 

Once the reader is comfortable with basic programming concepts the book gets right into the topic at hand.  Simple programs are given with explanations of how each program works and why each program is insecure.  This is followed by an explanation of the attack vector that will be used and then the reader is walked through coding a fully functional exploit, step by step.  Most of these explanations show memory maps and debugger commands used to see how the exploits are detected and crafted.  

After explaining common places to attack code such including both stack and heap-based overflows Jon moves into networking and how computers communicate.  DOS attacks, network sniffing, TCP/IP hijacking and port scanning are all covered in the networking section.  The reader is then brought back to shellcode with a very low level look at how code works.  By this time the reader has a fairly strong grasp  of several attack vectors. Countermeasures are then discussed to explain what will prevent a hack from working, or at least being logged, and how to counter the countermeasures.  

Jon brings the book to a close with one final subject, cryptography.  Hybrid ciphers, password cracking and WEP cracking are all discussed here.  WEP may seem a bit dated but I still don't have an issue finding a WEP network these days.  The book comes with a CD containing all the source code used as well as a pre-configured linux hacking environment (Ubuntu) that will allow the reader to test all of the  exploits they have just learned.  As I said the great thing about this book is that it doesn't teach you to hack via paint by numbers because that becomes dated quickly.  Instead it teaches the reader how to look for, find and craft exploits which is a timeless skill.  If you or someone you know wants to learn to hack, this is the place to start.  Well, here and Phrack.

 

     

Fluidinfo.com is like a Wikipedia for databases

What if there was a database that stored everything?  I know that sounds like a tall order but consider that Wikipedia strives to have a page for everything the question.  Having a database that stores everything doesn't sound so absurd and it is the idea behind fluidinfo.com.  Fluidinfo wants to be able to store meta-data regarding everything (or as close as physically possible).  

The idea behind Fluidinfo is that read-only information is just not as useful as on the Web as openly writable information.  Metadata is used routinely in the real world from name tags to post-it notes but it is much harder to apply metadata to information on the Internet.  That is where Fluidinfo comes along.  When information needs to be stored about an object the Fluidinfo database is queried.  If the object exists in Fluidinfo, the information is appended to the object.  If the object does not exist then it will be created and stored.  

So if anyone can add information then can't people just deface Fluidinfo?  No, permissions are not applied to the object but to the information regarding the object.  Therefore information can be managed by the user who created it.  When querying Fluidinfo trustworthy sources can be used to derive the information requested.  For example if you were looking for book reviews Fluidinfo could return reviews from Tim O'Reilly and Frank from Nebraska.  Tim O'Reilly would clearly have a greater reputation than Frank (but don't you worry, Frank is an up-and-comer).  Reputations and trusted domains can be used to filter data, as well as the fact that the user is generating the query.  Fluidinfo is probably sounding pretty good.  It gets better.  Fluidinfo uses a very simply API and queries can be returned in JSON makes Fluidinfo very intriguing   

For a more visual representation check out the slideshow on Fluidinfo.

Building an Animated Cartoon Robot with jQuery | CSS-Tricks

I have been looking more into web development these days and I found an awesome jQuery tutorial on css-tricks.com that shows how to animate a robot. As everybody loves robots I felt it pertinent to share.

Canadian Court Rules Domain Names Are Property

Canadian Court Rules Domain Names Are Property

The Court of Appeal for Ontario ruled in favor of Tucows that domain names are property. This now leads to a flurry of new questions. What does this mean for ICE domain seizures? How will this affect service outages? Can domains be seized for violating a TOS of a web host? Before we get ahead of ourselves, this ruling still has the option of being appealed at the Supreme Court of Ontario. It is going to be very interesting to see how this unfolds.

Hack the Sticky Keys Feature to Reset a Forgotten Windows Password

Here's a neat little trick I stumbled on at lifehacker.com. Boot off a repair disk then opening a command prompt and copying cmd.exe over sethc.exe. Then boot windows and hit the Shift key 5 times at the Windows login prompt to bring up a command prompt. From there you can simply reset the user's password using the net user command.

Kinectasploit - Metasploit Hacking using Kinect in Blender 3D Environment | Kinect Hacks

3D hacking is here thanks to Kinectasploit. Combining Metasploit with Kinect and the Blender game engine, you can actually hack and explore your system in 3D. Kinectasploit is free to download at http://p0wnlabs.com/defcon19 but I think p0wnlabs is down due to the Slashdot effect.