http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2012-09-22 19:27:25 - ap0x : RT @gcluley: Latest Sophos security podcast - Black Hat, NFC, Steganography, IPv6 and File Disinfection Framework http://tco/6mKnfyPjhttp://www.secuobs.com/twitter/news/346060.shtmlhttp://www.secuobs.com/twitter/news/346060.shtml Secuobs.com : 2012-09-13 20:09:45 - ap0x - RT @helpnetsecurity: Video: Fast and furious reverse engineering - http://tco/IwLAjjf4 with @ap0xhttp://www.secuobs.com/twitter/news/343589.shtmlhttp://www.secuobs.com/twitter/news/343589.shtml Secuobs.com : 2012-09-10 10:48:44 - ap0x - @terebinlaaden Buy this book: http://tco/mQCKDCpR Its excellent as an introduction to reverse engineering on Windowshttp://www.secuobs.com/twitter/news/342516.shtmlhttp://www.secuobs.com/twitter/news/342516.shtml Secuobs.com : 2012-09-06 20:52:46 - ap0x - OllyDBG 201 is out You can now start writing your plugins for it http://tco/Fl94Yvpxhttp://www.secuobs.com/twitter/news/341536.shtmlhttp://www.secuobs.com/twitter/news/341536.shtml Secuobs.com : 2012-09-06 20:52:46 - ap0x - RT @gcluley: Latest Sophos security podcast - Black Hat, NFC, Steganography, IPv6 and File Disinfection Framework http://tco/6mKnfyPjhttp://www.secuobs.com/twitter/news/341535.shtmlhttp://www.secuobs.com/twitter/news/341535.shtml Secuobs.com : 2012-09-06 20:52:46 - ap0x - RT @helpnetsecurity: Video: Fast and furious reverse engineering - http://tco/IwLAjjf4 with @ap0xhttp://www.secuobs.com/twitter/news/341534.shtmlhttp://www.secuobs.com/twitter/news/341534.shtml Secuobs.com : 2012-09-06 20:52:46 - ap0x - RT @0xcharlie: The java 0-day reminds me of computers 10 years ago when everybody could just own everybody I like it better when only I http://www.secuobs.com/twitter/news/341533.shtmlhttp://www.secuobs.com/twitter/news/341533.shtml Secuobs.com : 2012-09-06 20:52:46 - ap0x - I've came to a conclusion that my bank hates me First IE6 was required for e-banking They just upgraded the system, now it requires Javahttp://www.secuobs.com/twitter/news/341532.shtmlhttp://www.secuobs.com/twitter/news/341532.shtml Secuobs.com : 2012-08-14 16:26:23 - ap0x - @waleedassar Why would anyone even use bind If the file has ASLR its going to be skipped anyway and the bound load time isn't that betterhttp://www.secuobs.com/twitter/news/340028.shtmlhttp://www.secuobs.com/twitter/news/340028.shtml Secuobs.com : 2012-08-03 12:49:32 - ap0x - RT @markrussinovich: Very cool: a file that's simultaneously a valid Windows EXE, PDF, JAR, and HTML file: http://tco/c8kBxGxhhttp://www.secuobs.com/twitter/news/337920.shtmlhttp://www.secuobs.com/twitter/news/337920.shtml Secuobs.com : 2012-07-20 15:21:44 - ap0x - RT @mikko: I just learned that I can plug a normal USB stick to the eSATAp port on my computer and it will actually work http://tco/Hl http://www.secuobs.com/twitter/news/334983.shtmlhttp://www.secuobs.com/twitter/news/334983.shtml Secuobs.com : 2012-07-16 20:47:34 - ap0x - Exciting day at the office TitaniumCore2 running natively under Linux http://tco/Gpym6aPLhttp://www.secuobs.com/twitter/news/333770.shtmlhttp://www.secuobs.com/twitter/news/333770.shtml Secuobs.com : 2012-07-01 21:04:57 - ap0x - @Gunther_AR Thanks You're going to BlackHat If so, looking forward to seeing you there :http://www.secuobs.com/twitter/news/331541.shtmlhttp://www.secuobs.com/twitter/news/331541.shtml Secuobs.com : 2012-06-26 19:15:10 - ap0x - @deroko_ Just a wild guess, using pintool to create a safe generic dynamic unpackerhttp://www.secuobs.com/twitter/news/330388.shtmlhttp://www.secuobs.com/twitter/news/330388.shtml Secuobs.com : 2012-06-26 19:15:10 - ap0x - @nicolasbrulez One of our unpackers didn't work on such sample because author added a polymorphic layer after basic decompressionhttp://www.secuobs.com/twitter/news/330387.shtmlhttp://www.secuobs.com/twitter/news/330387.shtml Secuobs.com : 2012-06-25 23:51:24 - ap0x - @ange4771 @erocarrera Those are from his training materials I believe Blackhat The whole bunch of those slides is nothing but awesomehttp://www.secuobs.com/twitter/news/330158.shtmlhttp://www.secuobs.com/twitter/news/330158.shtml Secuobs.com : 2012-06-12 12:25:14 - ap0x - File disinfection framework: Striking back at polymorphic viruses http://tco/i7v9ws58 #BlackHatUSAhttp://www.secuobs.com/twitter/news/326870.shtmlhttp://www.secuobs.com/twitter/news/326870.shtml Secuobs.com : 2012-06-12 12:25:14 - ap0x - RT @ReversingLabsHQ: ReversingLabs is proud to be one of the silver sponsors at this year's BlackHat US See you at out booth https://t http://www.secuobs.com/twitter/news/326869.shtmlhttp://www.secuobs.com/twitter/news/326869.shtml Secuobs.com : 2012-06-12 12:25:14 - ap0x - @bradarndt We are working on a new generation for all of our products With the next TitanEngine release it will be easier to contributehttp://www.secuobs.com/twitter/news/326868.shtmlhttp://www.secuobs.com/twitter/news/326868.shtml Secuobs.com : 2012-06-12 12:25:14 - ap0x - @bradarndt We will be releasing cool stuff in large chunks throughout the year It starts with the TitanEngine 31 release next monthhttp://www.secuobs.com/twitter/news/326867.shtmlhttp://www.secuobs.com/twitter/news/326867.shtml Secuobs.com : 2012-05-31 11:27:54 - ap0x - RT @suffert: Detecting Known Malware Processes Using Nessus http://tco/DXnYFQH7http://www.secuobs.com/twitter/news/324545.shtmlhttp://www.secuobs.com/twitter/news/324545.shtml Secuobs.com : 2012-05-30 07:19:57 - ap0x - @crackinglandia @nicolasbrulez Nope, skipping it this year Will be at BlackHat thoughhttp://www.secuobs.com/twitter/news/324226.shtmlhttp://www.secuobs.com/twitter/news/324226.shtml Secuobs.com : 2012-05-29 02:25:23 - ap0x - RT @radian: Decided not to hire Diablo He claims his last job was Prime Evil, but I just called Amazon and they've never even heard o http://www.secuobs.com/twitter/news/323953.shtmlhttp://www.secuobs.com/twitter/news/323953.shtml Secuobs.com : 2012-05-25 04:53:43 - ap0x - If you plan on attending TitanEngine 30 lab tomorrow and you want to play with it please install MS Visual Studio 2008 #HITB2012AMShttp://www.secuobs.com/twitter/news/323137.shtmlhttp://www.secuobs.com/twitter/news/323137.shtml Secuobs.com : 2012-05-21 03:53:16 - ap0x - @waleedassar Because Windows 95 did as well Strangely enough it only did so for DLL fileshttp://www.secuobs.com/twitter/news/321928.shtmlhttp://www.secuobs.com/twitter/news/321928.shtml Secuobs.com : 2012-04-29 03:36:21 - ap0x - @sansforensics Two same files packed with different packers or a single version of a polymorphic packer as found in malware such as Zeushttp://www.secuobs.com/twitter/news/316444.shtmlhttp://www.secuobs.com/twitter/news/316444.shtml Secuobs.com : 2012-04-29 03:36:21 - ap0x - @nicolasbrulez Don't you automate it I know its heavily polymorphic but still a dynamic unpacker should chew trough thathttp://www.secuobs.com/twitter/news/316443.shtmlhttp://www.secuobs.com/twitter/news/316443.shtml Secuobs.com : 2012-03-19 05:17:29 - ap0x - RT @HITBSecConf: #HITB2012AMS LAB - TitanEngine 30: Return of the Titan and the Exile of PE Malformation by M Vuksan T Pericin http://www.secuobs.com/twitter/news/304657.shtmlhttp://www.secuobs.com/twitter/news/304657.shtml Secuobs.com : 2012-03-15 19:13:30 - ap0x - @PiotrBania That is where DLLs go to die ^^http://www.secuobs.com/twitter/news/303827.shtmlhttp://www.secuobs.com/twitter/news/303827.shtml Secuobs.com : 2012-03-02 07:03:34 - ap0x - Why do people keep thinking that classifying polymorphic malware is as easy as picking random PE fields and applying machine learning to ithttp://www.secuobs.com/twitter/news/299336.shtmlhttp://www.secuobs.com/twitter/news/299336.shtml Secuobs.com : 2012-02-03 09:43:51 - ap0x - Just concluded the TitanEngine training http://tco/6EApucRQhttp://www.secuobs.com/twitter/news/290426.shtmlhttp://www.secuobs.com/twitter/news/290426.shtml Secuobs.com : 2012-01-18 05:13:13 - ap0x - #TitaniumCore2 working under #Wine on #Ubuntu Its glorious Native Linux build in production, hang on http://tco/uVvfHj51http://www.secuobs.com/twitter/news/284929.shtmlhttp://www.secuobs.com/twitter/news/284929.shtml Secuobs.com : 2011-12-21 23:39:23 - ap0x - RT @neiltyson: The best engineering flow chart ever: http://tco/Rs7GNh4Uhttp://www.secuobs.com/twitter/news/277347.shtmlhttp://www.secuobs.com/twitter/news/277347.shtml Secuobs.com : 2011-12-20 00:32:07 - ap0x - RT @kpyke: I am convinced that hackers from the future came back to invent the PDF format Widely deployed, loose, obfuscation, its the http://www.secuobs.com/twitter/news/276659.shtmlhttp://www.secuobs.com/twitter/news/276659.shtml Secuobs.com : 2011-10-19 20:26:31 - ap0x - @ange4771 @dpistelli Did you include stack overflow on infinite recursion resources in the reporthttp://www.secuobs.com/twitter/news/258221.shtmlhttp://www.secuobs.com/twitter/news/258221.shtml Secuobs.com : 2011-09-21 16:32:39 - ap0x - Writing virus disinfection routines using TitanEngine3 is really simple Crawling vxnetlux for good samples is harder than you might thinkhttp://www.secuobs.com/twitter/news/249732.shtmlhttp://www.secuobs.com/twitter/news/249732.shtml Secuobs.com : 2011-08-18 15:17:31 - ap0x - RT @mikkohypponen: I don't get what all these pentesting companies are doing Just how much testing does a pen needhttp://www.secuobs.com/twitter/news/239452.shtmlhttp://www.secuobs.com/twitter/news/239452.shtml Secuobs.com : 2011-08-04 16:04:25 - ap0x - @onceuponanop Thanks I will be adding more information to the whitepaper Some stuff is in the slides but didn't make it to the paper yethttp://www.secuobs.com/twitter/news/234863.shtmlhttp://www.secuobs.com/twitter/news/234863.shtml Secuobs.com : 2011-08-02 07:37:58 - ap0x - Landed in Vegas for this years BlackHat/Defconhttp://www.secuobs.com/twitter/news/233905.shtmlhttp://www.secuobs.com/twitter/news/233905.shtml Secuobs.com : 2011-07-09 22:01:29 - ap0x - RT @daniel_bilar: #recon2011 Rise shine, soda club party people Tomislav of TitanEngine http://bitly/pU9Ngw fame on REing #compres http://www.secuobs.com/twitter/news/225946.shtmlhttp://www.secuobs.com/twitter/news/225946.shtml Secuobs.com : 2011-07-09 22:01:29 - ap0x - Slides for my #Recon talk Reverse engineering software compressions are online: http://tco/wS6pG8dhttp://www.secuobs.com/twitter/news/225945.shtmlhttp://www.secuobs.com/twitter/news/225945.shtml Secuobs.com : 2011-07-09 22:01:29 - ap0x - Just got the word that our BlackHat arsenal submition has been accepted Visit our booth in Vegas to learn how to detect PE malformationshttp://www.secuobs.com/twitter/news/225944.shtmlhttp://www.secuobs.com/twitter/news/225944.shtml Secuobs.com : 2011-07-09 06:11:11 - ap0x - RT @nicolasbrulez: #recon2011 and #reconmtl for anyone interested in reverse engineering talks Good to be back herehttp://www.secuobs.com/twitter/news/225732.shtmlhttp://www.secuobs.com/twitter/news/225732.shtml Secuobs.com : 2011-07-08 08:31:06 - ap0x - Finished the #Recon training titled Reverse engineering software protections with @nicolasbrulez Thanks to attendees #reconmtlhttp://www.secuobs.com/twitter/news/225510.shtmlhttp://www.secuobs.com/twitter/news/225510.shtml Secuobs.com : 2011-07-07 19:33:26 - ap0x - RT @nicolasbrulez: #Recon 2011 Training about Software Protection System Reverse Engineering started today with @ap0xhttp://www.secuobs.com/twitter/news/225168.shtmlhttp://www.secuobs.com/twitter/news/225168.shtml Secuobs.com : 2011-07-02 02:14:27 - ap0x - One wouldn't expect to learn much from a single format but InnoSetup has an interesting layout which will impact future TitanEngine versionshttp://www.secuobs.com/twitter/news/223594.shtmlhttp://www.secuobs.com/twitter/news/223594.shtml Secuobs.com : 2011-06-17 20:35:03 - ap0x - RT @t0ka7a: #hackinparis SVG image format can carry javascript Double click on a downloaded picture and get backdooredhttp://www.secuobs.com/twitter/news/218597.shtmlhttp://www.secuobs.com/twitter/news/218597.shtml Secuobs.com : 2011-06-14 08:56:19 - ap0x - Our BlackHat talk got accepted Come to our talk to learn everything you didn't know about PECOFF Its a hell of a ride http://tco/HNjPlhFhttp://www.secuobs.com/twitter/news/217163.shtmlhttp://www.secuobs.com/twitter/news/217163.shtml Secuobs.com : 2011-06-03 02:40:10 - ap0x - @LambdaCube There's actually good amount of great ideas in there I'm going to have to add something like oon2 to TitanEngine3 now :http://www.secuobs.com/twitter/news/213328.shtmlhttp://www.secuobs.com/twitter/news/213328.shtml Secuobs.com : 2011-05-26 22:34:50 - ap0x - Random fact: xPack 098 causes stack overflow in files packed with LZMA You can work around this by increasing stack size allocated by PEhttp://www.secuobs.com/twitter/news/210992.shtmlhttp://www.secuobs.com/twitter/news/210992.shtml Secuobs.com : 2011-05-16 03:40:53 - ap0x - RT @RolfRolles: I care about reverse engineering problems and automating their solutions, the prettier the better on both countshttp://www.secuobs.com/twitter/news/206847.shtmlhttp://www.secuobs.com/twitter/news/206847.shtml Secuobs.com : 2011-05-11 23:44:30 - ap0x - RT @MalwareResearch: @nicolasbrulez and @ap0x are doing Software protection reverse engineering training at the REcon 2011http://www.secuobs.com/twitter/news/205250.shtmlhttp://www.secuobs.com/twitter/news/205250.shtml Secuobs.com : 2011-05-10 03:43:20 - ap0x - @nicolasbrulez and I are doing Software protection reverse engineering training at the REcon http://bitly/jaCRJ0 Early regs end this weekhttp://www.secuobs.com/twitter/news/203980.shtmlhttp://www.secuobs.com/twitter/news/203980.shtml Secuobs.com : 2011-04-06 02:24:51 - ap0x - RT @nicolasbrulez: I will give the Reverse Engineering software protections training at REcon 2011 with @ap0x http://reconcx/2011/tra http://www.secuobs.com/twitter/news/192705.shtmlhttp://www.secuobs.com/twitter/news/192705.shtml Secuobs.com : 2011-03-21 18:03:56 - ap0x - After deleting 4Gb of udd files I'm beginning to suspect I use OllyDbg way too muchhttp://www.secuobs.com/twitter/news/186965.shtmlhttp://www.secuobs.com/twitter/news/186965.shtml Secuobs.com : 2011-02-28 16:11:10 - ap0x - Curious case of circular logic in PE file format leading to stack overflow during loading Non critical but highly amusing #WWGWWPEFFSDhttp://www.secuobs.com/twitter/news/179000.shtmlhttp://www.secuobs.com/twitter/news/179000.shtml Secuobs.com : 2011-02-17 00:02:39 - ap0x - Random fact: In Oct 2001 NeoWorx was acquired by McAfee which spelled the end for Neolite and ExeLock Company was bought for its firewallhttp://www.secuobs.com/twitter/news/174919.shtmlhttp://www.secuobs.com/twitter/news/174919.shtml Secuobs.com : 2011-02-12 17:05:39 - ap0x - RT @daveaitel: If You Cheat In Engineering Classes… http://dlvrit/GPyqwhttp://www.secuobs.com/twitter/news/173220.shtmlhttp://www.secuobs.com/twitter/news/173220.shtml Secuobs.com : 2010-12-18 17:53:29 - ap0x - RT @RolfRolles: You know you've been reverse engineering x86 for too long when you find staring at big-endian byte dumps confusinghttp://www.secuobs.com/twitter/news/155113.shtmlhttp://www.secuobs.com/twitter/news/155113.shtml Secuobs.com : 2010-11-30 20:26:06 - ap0x - Walking down the memory lane with RLPack Trivia: LZMA was introduced in version 112 and the version 115 was the first that supported DLLshttp://www.secuobs.com/twitter/news/147487.shtmlhttp://www.secuobs.com/twitter/news/147487.shtml Secuobs.com : 2010-11-23 03:02:29 - ap0x - Increased the execution speed for static decryption module inside TitanEngine3 by another ~70 pourcents #TheFasterTheBetterhttp://www.secuobs.com/twitter/news/145197.shtmlhttp://www.secuobs.com/twitter/news/145197.shtml Secuobs.com : 2010-11-20 17:08:05 - ap0x - @PiotrBania Is it the function recognition via E8 bruteforce as Olly does ithttp://www.secuobs.com/twitter/news/144573.shtmlhttp://www.secuobs.com/twitter/news/144573.shtml Secuobs.com : 2010-11-17 21:42:48 - ap0x - New episode of MythBusters is called Reverse Engineering I'll just file this tweet into #guesswhatImdownloading categoryhttp://www.secuobs.com/twitter/news/143397.shtmlhttp://www.secuobs.com/twitter/news/143397.shtml Secuobs.com : 2010-07-04 13:29:22 - ap0x - @ea_foundation We are giving these away at Recon and BlackHat And probably will be giving out some in another contribute to TE contesthttp://www.secuobs.com/twitter/news/110953.shtmlhttp://www.secuobs.com/twitter/news/110953.shtml Secuobs.com : 2010-06-18 08:47:43 - ap0x - RT @ReversingLabsHQ: Your submission, TitanMist:Reversing Nirvana has been accepted for BlackHat USA 2010, more free goodies from #Rev http://www.secuobs.com/twitter/news/105217.shtmlhttp://www.secuobs.com/twitter/news/105217.shtml Secuobs.com : 2010-06-04 21:19:46 - ap0x - RT @nicolasbrulez: RT @GadixCRK Ollydbg 2 Final Release http://ollydbgde/version2htmlhttp://www.secuobs.com/twitter/news/100081.shtmlhttp://www.secuobs.com/twitter/news/100081.shtml Secuobs.com : 2010-06-01 18:11:00 - ap0x - RT @ReversingLabsHQ: #ReversingLabs is presenting at #SAS2010 topic: Steganography, Formats Processing Vulnerabilities and Unpacking htt http://www.secuobs.com/twitter/news/98863.shtmlhttp://www.secuobs.com/twitter/news/98863.shtml Secuobs.com : 2010-05-14 22:34:51 - ap0x - RT @Ivanlef0u: Evolving Shellcode by Symantec http://bitly/dcgkhJ Cool sum up of shellcode techniques on Win32http://www.secuobs.com/twitter/news/93140.shtmlhttp://www.secuobs.com/twitter/news/93140.shtml Secuobs.com : 2010-04-13 12:09:17 - ap0x - Introducing #NyxEngine at #BlackHatEU Applied archive stegano data detection and recovery http://bitly/97Mb2F video: http://bitly/9ZMQ3nhttp://www.secuobs.com/twitter/news/82469.shtmlhttp://www.secuobs.com/twitter/news/82469.shtml Secuobs.com : 2010-03-29 20:10:55 - ap0x - ReversingLabs blog is back This week we are automatically fixing broken PE files with updated TitanEngine Nexus plugin http://bitly/aFVnSghttp://www.secuobs.com/twitter/news/77875.shtmlhttp://www.secuobs.com/twitter/news/77875.shtml Secuobs.com : 2010-02-19 04:43:56 - ap0x - Our #BlackHat Barcelona CFP got accepted Talk is about archive steganography and vulnerabilities in archive processing http://bitly/bMczLbhttp://www.secuobs.com/twitter/news/66743.shtmlhttp://www.secuobs.com/twitter/news/66743.shtml Secuobs.com : 2010-02-01 16:37:44 - ap0x - Minor inconveniences with OllyDBG and DLL files with unicode names http://bitly/aQ13inhttp://www.secuobs.com/twitter/news/60929.shtmlhttp://www.secuobs.com/twitter/news/60929.shtml Secuobs.com : 2010-01-29 23:59:00 - ap0x - Blog: #TitanGuard, protecting your PDF World against CVE-2009-4324 and future attacks http://bitly/92k9H7http://www.secuobs.com/twitter/news/60355.shtmlhttp://www.secuobs.com/twitter/news/60355.shtml Secuobs.com : 2010-01-29 23:59:00 - ap0x - RT @mikkohypponen: Our statistics for targeted attack file types we saw used in 2009: PDF 47,30 pourcents, DOC 37,96 pourcents, XLS 7,15 pourcents, PPT: 4,38 pourcentshttp://www.secuobs.com/twitter/news/60354.shtmlhttp://www.secuobs.com/twitter/news/60354.shtml Secuobs.com : 2010-01-29 23:59:00 - ap0x - ap0x: New ReversingLabs Corp Vulnerability security advisory, crashing OllyDBG analyze function #RLC_VSA_016_OLLYDBGhttp://www.secuobs.com/twitter/news/60353.shtmlhttp://www.secuobs.com/twitter/news/60353.shtml