For now, you can have a look at my presentation on the same topic. I had presented it at Barcamp Bangalore 7, and PHPCamp Pune. It was recommended by Dan Peterson, Google, on the Shindig developer’s mailing list.

For those who don’t have an idea what I am talking about; I have been (officially) working on OpenSocial for quite sometime. OpenSocial is a specification developed by giants like Google, MySpace, Ning, etc. to provide a common platform (API) for social app developers. Shindig, an Apache incubator project, is what can help your site become OpenSocial compliant.

By the way, I am referring to the Six degrees of Separation in the initial slides.

• Apache-MySQLPHP Installation & Configuration Tutorial for Beginners :)
• The Web is Broken
• Google Lost Me!
• An insight into Sun’s *crazy* strategy.
• Apache Headache: “no listening sockets available”

The second day consisted of 6 workshops - 3 before lunch and 3 after. I was confused on choosing between Sheeraj Shah and Mano Paul’s workshops during the first half; and Jason Li’s talk on “Web 2.0  Security” and “Secure Code Review” workshop (originally by Dinis Cruz, but conducted by Gaurav Kumar of Microsoft) on the second half.

Mano Paul

Choosing Mano Paul’s Workshop on Threat Modelling was relatively easier because I am trying to push in Threat Modeling in my company. However, the disappointment of missing Sheeraj’s talk was no less. Although, I must confess Mano Paul is one heck of a presenter. I guess experience always count.

Gaurav Kumar

The decision for the second half was pretty tough. I had finally chosen Secure Code Review talk over Jason Li’s talk, because I’ve a personal interest in Code Review; added by the fact that the workshop was to be conducted by Dinis Cruz. Since we had to pre-select the talks, there was no scope to change it later. Needless to say, I was a bit disappointed initially. However, I must also mention that I don’t regret attending it. It was conducted by Gaurav Kumar, Ace Team, Microsoft. The best part about him, apart from the fact that he knows his stuff, is that he took all the M$ jokes sportingly :).

Bipin with Walter and Jordan

I also got to meet Jordan Forssman (Armorize) and Walter Tsai (CTO, Armorize), although I regret not being able to spend enough time and talk some Geeky stuff. Oh and yes, Walter gifted me and Amit the 31337 Armorize T-Shirts :D. I also got to meet a couple of more like minded people, though very briefly. I couldn’t share cards with all of them. Today Lava (whom I met during Gaurav’s workshop), contacted me today via this blog. Feel greats to be in touch with fellow geeks and to be able to share the geekiness. I’d like to be in touch with others too. Please feel free to buzz me.

I must admit, the hangover remained for quite a few days. It had motivated us to evaluate the possibility of another OWASP conf at Banglore. We’ll be discussing it at the next meet. For now, I have another interesting announcement to make. OWASP Banglore Chapter is starting Open Workshops for developers, students, and anyone interested to learn about Web Security. The first one is on Sept. 7th, at Microland, Bellandur. If you are interested kindly drop me a mail; or even better, joing the OWASP Bangalore mailing list and put up your details.

• OWASP AppSec Conf Delhi - Day 1
• SecurityCamp is here, where are you?
• SecurCamp and back.
• Reviving OWASP Bangalore Chapter
• Rediffmail Bug. Anyone Interested?

Special Note: I don’t have my Canon EOS 350D with me nowadays, so I had to borrow my roomates Canon Powershot. The quality sucks, but still, the pictures are here.

I’ll be honest, going by the conf prices and some of the talk titles; I was expecting OWASP AppSec Delhi to be targeted mainly for managers. Moreover, I didn’t really have enough hopes for the first day talks, at least. It felt even worse when I realized that Dinis Cruz hasn’t been able to make it. I was looking forward to his workshop in App Sec Code Review. But boy, what a day!

The registration was scheduled to begin at 8:15 AM and I reached at 7:45. As if that was not enough, the registration was delayed by another 40-45 minutes. I like to be punctual, but end up playing the endless wait-game more than often.  However, on the bright side I got to interact with a couple of great guys, like Amit Parekh (MPS). Quite surprisingly, I also came across Manjula (Aujas Networks). I say surprisingly because when we had discussed about the conference at a previous OWASP Bangalore chapter meet, she had no plans to visit. I am glad she decided at the last moment.

Before I mention about the talks, I feel obligated to thank Nitin of OWASP Delhi chapter for letting me attend the conference even though my company has failed to pay the conference fees at the moment due to some strange procedural issues.

Bipin & Amit

The day began with the keynote speeches by Dhruv Soni and Puneet Mehta (OWASP Delhi Chapter), Murli Krishna(HP), Dr. Kamlesh Bajaj (DSCI), Jason Li(OWASP), and Mano Paul(ISC^2). The welcome notes by Dhruv and Puneet were followed by Dr. Bajaj and Murli Krishna’s keynotes. I couldn’t help but wish I could get seniors from the network management unit of my firm. I would love to believe that they would have had a heart change with respect to application security after the keynote . Jason spoke on behalf of Dinis and introduced the newbies to OWASP and a couple of its projects. In case you are unaware (like me), there has been an interesting addition to the OWASP projects called ESAPI. It looks good at first glance. Hopefully, I’ll be having a closer look pretty soon. Finally, Mano Paul provided some interesting metaphors to the security scenario, and also introduced the youngest hacker in the crowd, his two year old son. It’ll surely be fun to attend his workshop on Advanced Thread Modelling.

Following the Keynote speeches, Jason Li introduced the crowd to his AntiSamy project. I especially liked the way he’d organized his talk to compare several XSS mitigation techniques and then prove why AntiSamy’s (or HTMLPurifier’s) approach is better . His talk was followed by Rajesh Nayak’s (HP) talk titled Web App Security: Too costly to ignore. Although, it was more of a sales pitch, it did have some valid points; and we did manage to have our share of fun. When a certain demo of his failed a couple of times and he had to restart his system, I couldn’t control my tendency to pass on loud remarks and asked whether it was an HP laptop .

Manjula, Sheeraj, & Amit

The much awaited Sheeraj Shah’s talk on Web 2.0 Security came after the lunch. As expected of him, the talk was pretty technical and wasn’t really for the noobs. He also talked about his home-brewed scripts to analyze Web 2.0 enabled/hyped portals. Later, Roshan Chandran of Paladion presented a very interesting case study on Testing 200+ applications in a $10 Billion Enterprise. This talk provoked a lot of techies in the crowd who were silent till now. Finally, Nischal Bhalla delivered a talk on Building Enterprise AppSec Program. This is something I’ve been trying to do at my workplace (with the help of my Bosses) and I guess I’ll be mailing Nischal for the presentation.

To summarize, none of the talks were any ground breaking research that we were not aware of, but the difference always comes in with experience; and that’s what made it an amazing day. It was great to look at things from the perception of these uber hackers. I am eagerly looking forward for tomorrows workshop’s - Advanced Threat Modelling by Mano Paul, and App Sec Code Review by Gaurav Kumar (which was originally scheduled by Dinis Cruz.

Oh and yes! The food was pretty good too.

• OWASP AppSec Conf Delhi - Day 2; and more
• Reviving OWASP Bangalore Chapter
• SecurityCamp is here, where are you?
• TPM Boys withdraw paper from BlackHat USA
• SecurCamp and back.

If you have not heard of him, I suggest you watch his “last lecture”. A summary of the lecture and Randy Pausch’s life can be read here.

p.s.:
@Johnny: Thanks for updating me.
@Slashdot-ters: Thanks for not making stupid and mean remarks this time.
@Randy Pausch: Rest In Peace dude.

• [OT] Sad demise of Guru Ammannur Madhava Chakyar
• Apache Headache: “no listening sockets available”
• Slashdot, uh! :|
• Open JavaFX, an alternative to AJAX?
• Amazing Interrupt Handling!

I presented on “A conceptual Phishing/Fraud IDS”, something I had worked in Jan/Feb, but have been sleeping on in for all this while. Thanks to Johnny’s pestering, I think I’ll write a small paper on it and distribute for review. I just hope the increased official workload is minimized by the new members joining the team.

We also used the opportunity to announce the OWASP Bangalore chapter revival. I have personally been working on identifying ways to ensure OWASP’s reach to the colleges, and have prepared a list of colleges in Bangalore. Let’s hope that we make it quick on that front too. Just to re-announce, if you are a student in/around Bangalore, drop me a note and we’ll put your college on top-priority.

I also had a very strange realization today. I have been a member of several communities (security and otherwise) and differences creep-in at some point. However, they are pretty quick (and a little more obvious) in the security communities. Be it mailing lists, blogs or even physical meets, people respond (and then re-respond) pretty loudly. Is it because security is pretty demanding field where there isn’t much scope for a mistake, or is it because we all in the field carry a “I CAN’T be wrong” badge, or is it some other reason?

Time to move now. Hancock at 9:45PM

• Reviving OWASP Bangalore Chapter
• SecurityCamp is here, where are you?
• Zone-H Deafced by Saudi Hackers.
• Open JavaFX, an alternative to AJAX?
• Apache Headache: “no listening sockets available”

Koodiyattam exponent Ammannur Madhava Chakyar, recipient of the Padma Shri as well as the Padma Bhushan honours by the Govrnment of India. He was not only responsible for bringing the art form Kutiyattam (or Koodiyattam) out of temples, but also with reviving it.

The following news article from The Hindu provides other details.

Koodiyattom expert Ammannur Madhava Chakyar died at his residence, Ammannur Chakyar Madom, at Irinjalakuda, near here, on Tuesday. He was 92.
The end came around 9.30 p.m.
The history of modern Koodiyattom is inexorably entwined with Madhava Chakyar’s life and art.
He did not want Koodiyattam to be restricted to the temple arena. His major contribution to the art was to take it beyond traditional confines.
Ammannur’s debut performance was at the age of 11 at the Thirumandhamkunnu temple, Angadipuram. He played the role of Sutradhara in the play ‘Balacharita.’ His first-ever Prabandha Koothuwas held at Trikkovil temple at Chendamangalam.
He trained under the princes of the royal family of erstwhile Kodungallur. He played his first major role, Sreerama in ‘Soorpanakankam’ at the Koodalmanikya temple in Irinjalakuda. He was a recipient of Padma Bhushan, Kalidasa Samman, Kerala Sangeeta Nataka Akademi Award and Kendra Sangeet Nataka Akademi Award. He is survived by his wife Parukutty Nangiaramma.

May his soul rest in peace.

• IFrames - To be or not to be?
• TPM Boys withdraw paper from BlackHat USA
• Fake Steve Jobs Revealed

On a personal note, you did change the world Billy Boy. Hope you do the same again.

p.s. BTW, Joy Of Tech guys are good. Subscribe to them if you like a laugh once in a while.

• Bill Gates no more The Richest
• Apache Headache: “no listening sockets available”
• Dreams… and (huh!) Reality.
• TPM Boys withdraw paper from BlackHat USA
• The Web is Broken

Anyhoo! The important point is that we finally met today. There were around 12 peole who turned up, and boy, It’s always an honour to meet enthusiastic people from the Security community. Minutes of the meeting will be posted by Hari, Chapter coordinator, pretty soon on the OWASP-Bangalore mailing list. To cut things short, we discussed and decided on a couple of points to revive the Bangalore Chapter. I’ll personally be looking forward to spreading the information to younger audience. So, just in case you are a part of some College around Bangalore, feel free to drop me a note. We’d love to visit your campus and deliver talks, free of charge.
As for the regular meetings, we’ve decided to meet every fourth Wednesday of the month. Venues will of course, keep changing.

p.s. I love the song “Jaane Kya Baat Hai” from the movie Sunny. But somehow, I am not able to get the other song,”Aur Kya Ahde Wafaa Hote Hain”, out of my mind since morning. Not that I am complaining

• SecurCamp and back.
• OWASP AppSec Conf Delhi - Day 1
• SecurityCamp is here, where are you?
• OWASP AppSec Conf Delhi - Day 2; and more
• Yahoo! gone Insane!

I feel extremely glad to announce that Security Camp, the first security Barcamp in Bangalore (as far as as I know) is on12th of July. It’s being hosted by RSA.

Being a FOSS and NGO enthusiast, I am big fan of communities and highly respect the power they can unleash towards the motive. I have always felt that the Security community in India could be a little more organized and visible. Unfortunately, all I have seen till now is a couple of mailing lists (which are really good btw), some hacker gamers (who game all night long ), and a couple of small conferences (like Club Hack, OWASP’s Mumbai meet). Although these deserve respect in their own right, but there’s always scope for a lot more, especially the visibility factor. Now, this BarCamp isn’t going change everything overnight (in fact the number of registrations are pretty low), but I am happy to see yet another one popping up. Luckily, Harinath, the chapter lead of OWASP-Bangalore, has called for revival of the chapter. I am hoping that we meet at Security Camp and come up with a survival plan

But again, firstly I wish I can make it to the Security Camp. We, at office, are expecting some OpenSocial related work in the first week of July, which probably means no Saturdays and no Sundays I was also hoping to visit the meet with my Geeky-partner Johnny ;), but he’d be out of town. No complaints though, he’d be talking at GUADEC (uh, who came up with that acronym?)

I am sincerely hoping to be able to make it (and may be take my team there too). If I do, I’ll probably talk about a small research I did towards Designing a Phishing/Fraud IDS. Apart from the fact that I tried talking about it during DevCamp (where my lappy didn’t work with the projector and I’d to hold it in my hand ), I’ve been sleeping on it. Mostly because there’s lot to be done to reduce the false-positives, which is anyways the case with all IDSes.

• SecurCamp and back.
• Reviving OWASP Bangalore Chapter
• OWASP AppSec Conf Delhi - Day 2; and more
• OWASP AppSec Conf Delhi - Day 1
• What a new year Gift! :)

She is red, and she’s hot!

She’s a Dell XPS M1330. Other features include:

1. Intel Core-2 Duo, 2.1 GHz (My first intel. I used to be with AMD)
2. 200GB HD , 7200rpm
3. 128 MB Nvidia graphics card (the games run awesomely, and I have re-entered the gaming arena. Currently re-re-replaying Serious Sam, Second Encounter)
4. Pre-Loaded Vista :(  (I am still a little confused, whether I go ahead with OpenSuse 10.3 or wait 6 more days for OpenSuse 11 to arrive. )
5. and other regular features like DVD writer, fingerprint scanner, built-in webcam, etc. etc. etc.

I should have updated about her by now, but have been very very busy with an official work involving OpenSocial till yesterday. Hoping to publish other draftified articles soon.

• What a new year Gift! :)
• The Web is Broken
• IFrames - To be or not to be?
• SecurityCamp is here, where are you?
• Apache Headache: “no listening sockets available”

1. The Slashdot community, which is getting reduced to people who lurk around to post comic and sarcastic comments. It’s very seldom that you come across an intelligent and insightful comment.
2. The news, if I may say so, itself.



This rant is a direct result of a news titled Google Assists In Arrest Of Indian Man, posted on 19th. First of all this is an Old News. In fact I’d used the context to post a legal analysis of the impact of another Orkut worm, as per my knowledge and belief. I have nothing against reading old news, but for God’s sake, don’t claim it to be new.

Secondly, the post cites Shivaji as a saint. He was not a saint. He was a king and a warrior. Do your homework before posting, or rather approving such news.

Thirdly, the tone in which the post is written is as vague, if not more, as the point the post tries to make. If you wish to blame Google, get proper info before doing that. Google has a pact with Indian law enforcement. They are bound to provide such info. If you wish to convey the news that a false person was convicted, say it. If you wish to bring about the role of Yahoo! and Google in such cases, do it properly.

Being said all that, I don’t think I’ll completely stop reading /. . However, the prestige of being Slashdotted now seems to be just about traffic now.

• TPM Boys withdraw paper from BlackHat USA
• Google Lost Me!
• [How To] Implementing Shindig.
• "COLUKABKI - AOL - MSN - YAHOO - RED CROSS"….. aaah Comm’n Gimme a break.
• Orkut Latest XSS Worm; and what it means for Indian Orkuteers

People who know me, know that I desist Social networking portals. Don’t worry, this post isn’t another rant. It’s more of an announcement that I’ve joined a Social Network

Yup! The guys at GNUCitizen have started a social network for hackers, and very intelligently named it House of Hackers. I’d like to call it HoH (as in Hah!)

A few motives cited for creation of the network are:

• To provide platform for hackers to exchange ideas, communicate, or/and even form groups -elite or otherwise. Although Slackers is an amazing place to communicate, web is never big enough for two similar houses. Moreover, they aren’t same, just similar
• Create a Hacker recruitment market. Recruiters could advertise to recruit/hire people from here. The best part of this, as cited, would be that HoH would eliminate any middleman (or you employer), and hence help you earn more. Pretty obviously, this holds meaning for elite ones only. But then I have always believe that you can learn only to the extent you can challenge yourself… and good company definitely challenges you
• Fund Research programs from time to time. Not so long ago, Ronald came up with idea of Router Hacking Challenge, where you had to hack your own router and make the findings public. The _cutest_ hack would be regarded the best. GNUCitizen (Ronald is now a part of GNUCitizen) hosted the contest. I mention this just to affirm that I really like the guys at GNUCitizen, and I am really excited to know that they’d be encouraging the community (and funding them too). The money is expected to come from the recruitment advertisements.

Needless to summarize that I am keeping my eyes open, fingers crossed and hoping that this turns out to be a great venture for the community.

Just one concern, these %*^*@#$ hackers will keep screwing the portal networking portal, you know.

My profile link.

• Orkut Latest XSS Worm; and what it means for Indian Orkuteers
• Drive-by Download: Where Network Security Meets WebAppSec
• Idle Nights: Devil’s Mind
• Slashdot, uh! :|
• SecurCamp and back.

Oh by the way, this is my first post on the new blog, and this pic is a response to Swenny’s post on Adding an “i”

• How about a Better & Cheaper MacBook Air!
• IFrames - To be or not to be?
• Yahoo!’s javascript based media player!
• "COLUKABKI - AOL - MSN - YAHOO - RED CROSS"….. aaah Comm’n Gimme a break.
• Bill Gates wins me!

Moreover, Apple isn’t just about cut-throat business. It’s also about making people feel bad about themselves.
Don’t trust me?
See here yourself.

• iHacker
• Bill Gates wins me!
• Dreams… and (huh!) Reality.
• Google Lost Me!
• Is Google Bomb REALLY Diffused?

1. Phizy-Phizy-Phizy

I have always loved making this phizy-phizy-phizy sound purposelessly, which I once heard in a Rob Schneider movie (which, if I remember correctly, was a pathetic movie). Anyhoo! I, now, have a set of very strong reasons to move around repeating the same lines.
First, we received a request to be involved in a discussion for a Risk Assessment Model for a Banking site. This model had to be focussed on Two Factor Authentication and Phishing. This brainstorming gave me a couple of interesting avenues to work on. Hopefully, I’ll be writing more in this pretty soon.
Secondly, Peter Thomas (one of my amazing Bosses), forwarded me the link about the latest research by Nitesh Dhanjani & Billy Rios. They virtually infiltrated the Phishers ecosystem and have come up with some very interesting information.
Thirdly, my friend Swen called me up to let me know about a phishing mail, claiming to be a Google survey, that had landed in his mailbox. He was excited for two reasons:
a) He had received a phishing mail for the first time, and I guess you all remember the excitement the first time you discovered your first phishing mail.
b) He is one of the Google fans, and is worried about the safety of the vast majority of user-base Google has. Obviously, his concern isn’t without reasons.

2. A Phish named GoogleSurvey

As I mentioned Swen informed me about the shiny phish called GoogleSurvey. It presents you a page that looks completely similar to the Google Login page and requests you to login in order to complete the survey. If you login, you are presented with 3 questions on by one. At the end you are thanked for completing the survey.

3. Anatomy of Google-Survey-Phish gills

The Google Survey Phish isn’t sophisticated y ANY standards. Clearly, it’s done by some n00b, and was probably deployed using a very cheap Phishing Kit. However, it’s really interesting to understand how it works.
The first page the you encounter while analyzing is http://www.googlesurvey.co.nr/, which I must admit, looks very similar to the Google Mail login page. A look at the source code reveals that this is not the original page. The google mail look-alike page is alike page is actually located at http://googlesurvey.99k.org/. http://www.googlesurvey.co.nr/ only frames the page at with 100% width and 0px border.

Another interesting point to note is that the phisher used a free hosting service http://www.zymic.com/free-web-hosting/. Thus, theoretically he/she cannot be traced. Not via the hosting service, at least.

Now, when you enter your id and password, the data is sent to a php script on the server located at http://googlesurvey.99k.org/LoginAuth.php. Quite obviously, this script stores/mails your credentials for someone who’s not a very pleasing person.

4. Demo: Farming your own Phishes for fun & profit *cough*

The world of Phishing is so dark, deep, safe, easy, and seductive that a person with even a slight malign would be tempted to this farm his/her own phishes and make easy money. I set up my phishing domain for educational purposes. It also shows how quickly you can setup your very own phishing portal, sometimes even without a phishing kit. The domain I’ve setup has the following flaws (introduced to prevent me getting screwed by some half-witted law enforcer) :
1. The domain points at Yahoo!, while the page displayed is similar to the GMail login page.
2. The information entered is NOT stored. You can check it by entering garbage data.

I have used the same page used by the GoogleSurvey Phish, and also used the same free hosting service.

5. Conclusion

It’s almost impossible to prevent users from getting Phished. People will continue to click on links they receive in their inbox and </sarcasm> proceed to win an ipod </sarcasm>. Reducing phishing requires a number of things to be in place -sensible developers, well informed end user, smart browsers with phishing aware features (IE7, Fx2 etc.), a few toolbars like NetCraft to be installed, etc. etc. And even doing all this doesn’t guarantee to save a user ignorant of phshing. I mean how do you save a person who doesn’t even know that such a kind of fraud exists.
Moreover, the URI vulnerabilities have added another dimension to the whole phishing scene.

• "COLUKABKI - AOL - MSN - YAHOO - RED CROSS"….. aaah Comm’n Gimme a break.
• Rediffmail Bug. Anyone Interested?
• AdSense exploited by malware (Trojan.Qhost.WU)
• Google Bomb! [Update: Diffused]
• Top Rating in Google :D