Latest Security News

Microsoft Security Compliance Manager TOOL

 Free GPO complience tool  with excellent security Base Lines, you can import GPO backup from your AD and compere it to any relevant baseline .
 Get the latest version HERE

About This Solution Accelerator

Microsoft Security Compliance Manager (SCM) is a free tool from the Microsoft Solution Accelerators team that enables you to quickly configure and manage your computers, traditional datacenter, and private cloud using Group Policy and Microsoft® System Center Configuration Manager.
SCM 2 provides ready to deploy policies and DCM configuration packs that are tested and fully supported. These baselines are based on Microsoft Security Guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats.
Easily configure the latest Windows® operating systems, Microsoft Office applications, and Internet Explorer with industry leading knowledge and fully supported tools.
Take advantage of SCM 2 to import the configuration of a “golden master” reference machine or existing Group Policy. Compare your standards to industry best practices, customize them using rich knowledge, and seamlessly create new policies and DCM configuration packs in the user-friendly UI designed to work with Microsoft System Center Configuration Manager 2007 R2.
Key Features Include:
  • Integration with the System Center 2012 Process Pack for IT GRC: Product configurations are integrated into the Process Pack for IT GRC to provide oversight and reporting of your compliance activities.
  • Gold master support: Import and take advantage of your existing Group Policy or create a snapshot of a reference machine to kick-start your project!
  • Configure stand-alone machines: Deploy your configurations to non-domain joined computers using the new GPO Pack feature!
  • Updated security guides: Take advantage of the deep security expertise and best practices in the updated security guides, and the attack surface reference workbooks to help reduce the security risks that you consider to be the most important!
  • Compare against industry best practices: Analyze your configurations against prebuilt baselines for the latest Windows client and server operating systems!



Another cool dDOS tool -in python


HULK is a web server denial of service tool written for research purposes. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching engines and therefore hitting the server's direct resource pool.
Published  on packet storm - 
Download it from HERE

defeting hulk with thor (mod ssl) -sig =

 SecRule REQUEST_HEADERS_NAMES ".*" "id:'11',chain,phase:1,t:none,log,drop,msg:'Request Header Ordering Alert: Potential Attack Tool - HULK DoS.',setvar:'tx.header_order=%{tx.header_order}, %{matched_var}'"
        SecRule TX:HEADER_ORDER "@streq , Accept-Encoding, Host, Keep-Alive, User-Agent, Accept-Charset, Connection, Referer, Cache-Control""

Perl IDE -Eclips Running EPIC - Eclipse Perl Integration

Some time ,Writing a Perl script with notepad is just not enough for getting the job done.
 an excellent module + debugger for running Perl in eclipse is called EPIC .
You can download it from  HERE and integrate it with eclipse classic (HERE) .

Follow the simple installation  
Have Fun


*install Padwalker package from ppm .
*known bug in the debugger running activestate perl :
change a line in the cwd.pm and remove the "eval" in line 758:
 if (eval 'defined &DynaLoader::boot_DynaLoader') {



McafeeQuarantineExtractor1.1 TOOL

Just finish writing the first beta tool for Auto extracting Mcafee Quarantine file 
It is written in c# and contain all the functions for upzip/xoring a bup file into a new directory for further examination.  
you can get it HERE ,just run the setup.exe and follow the install process .

SCREEN SHOTS:

  

How take out a sample from the MCAFEE quarantine folder for further examination

I wanted to take out a sample from the MCAFEE  quarantine folder on a host machine for further examination.But bad for me , I've  discovered that that only way to extract the virus is to the original place! After googling  a bit  I found out that the .bup extension is actually a 7zip archive + xor by 0X6A ! So After I downloaded the 7zip and a simple xor tool ((http://www.softpedia.com/get/Programming/Other-Programming-Files/Xor.shtml)I've got 2 file in every .bup
  ·xor.exe Details Details.txt 0X6A  
  > xor.exe File_0 file_0.xor 0X6A>

Rename File_0.xor to Original name found in Details.txt
 And the virus is ready for investigation!

Malware Sandbox Online -ניתוח דינאמי של קבצים חשודים


אתרים לניתוח דינמי של קבצים חשודים כ malware.
בתמונה ניתן לראות את תוכן העניינים המציג את הפונקוציות ההתנהגותיות שנבדקות .

האתרים המומלצים:
http://www.threattrack.com/ חברת GFI ( חינם)

http://www.norman.com/security_center/security_tools/en-us  -(חינם)

http://anubis.iseclab.org/

http://eureka.cyber-ta.org/

http://camas.comodo.com/

המידע באדיבות - רננה פרידליך hacktics

אתר VX נסגר =אתרים חלופיים_רשימה

אתר http://vx.netlux.org/index.html  נסגר בעקבות חקירת משטרת אוקראינה.

להלן אתרים חלופים להורדת וירוסים למחקר ובדיקות:

http://contagioexchange.blogspot.com/
http://www.kernelmode.info/forum/viewforum.php?f=16
http://www.malwareblacklist.com/showMDL.php
http://forums.malwarebytes.org/index.php?showforum=51
http://www.offensivecomputing.net/