Blog

2014-04-01 Recap of the March HackerSpace Thanks to everyone who took part in the special anniversary HackerSpace on March 27, 2014. The room was almost full! Lots of you came... 2014-03-18 Application Security and Penetration Testing: Much More Than an Automated Scan Hello, Last week, I gave a presentation at ASIQ about a cause close to our hearts: the types of technical security tests and how...

2013-12-18 HF 2013 War Game - Missile launchers write-up Setup Here’s an overview of what was used for this  challenge: 3x USB missile launchers A usb hub with at least 4 usb ports... 2013-12-06 Hackfest 2013 Model making of This is a short write-up of the War Game 2013 model. Enjoy! HackfestCity.pdf 2013-11-26 Hackfest Security Podcast #27 - November 2013 News Hackfest 2013 recap Statistics War Game CTF Lock Picking challenge Richer Password Reset Anonymous Guillaume Guillaume's blog Article about Schemes Martin scotch gling... 2013-11-05 Cloud and smartphone data security You probably heard some sermons about how putting your data in the clouds isn’t such a great idea?  Well, imagine a cloud of clouds,... 2013-10-20 Password cracking - correlation of words in various languages to build wordlists [hashrunner 2013 writeup] I initially wanted to fully involve in hashrunner, but being in the last week of a job, finishing migrations and the preparation of a... 2013-07-26 iHack 2013 Forensic track #3 & 4 - Your eyes are bleeding and you need to split something. iHack 2013 Forensic track #3 & 4 - Your eyes are bleeding and you need to split something. That one was damn fun to... 2013-07-16 iHack 2013 Forensic track #1 - time machine iHack 2013 Forensic track #1 - time machine This track was really fun to realize, because I was in a nostalgic mood and wanted... 2013-06-25 Press Release: Tribute to Community Contributors (Quebec City) June 21, 2013 Two weeks ago, on June 4, 2013, Hackfest Communication was invited to "Expo TI 2013 - Villes du Québec", which showcased... 2013-06-24 x86 Assembly Month, week 4 - Functions and system calls  June takes on a special flavor this year on the Hackfest blog: four articles on assembly programming will be published, one each week, and... 2013-06-17 x86 Assembly Month, Week 3 - Logic Structures June has a special flavour this year on the Hackfest blog: four articles on assembly programming will be published, one each week, and the... 2013-06-10 x86 Assembly Month, week 2 - First Steps June takes on a special flavour this year on the Hackfest blog: four articles on assembly programming will be published, one each week, and... 2013-06-03 x86 Assembly Month, week 1 - Introduction June takes on a special flavor this year on the Hackfest blog: four articles on assembly programming will be published, one each week, and... 2013-05-30 Forensic track challenges from iHack 2013 Hey guys and gals, We decided to share the iHack challenges we made for 2013's iHack, for further practice, before writeup publication.  Don't hesitate... 2013-05-21 Getting Ready for iHack! The iHack is coming up fast! As you know, iHack is probably one of the best places to start learning "pentest" techniques and other... 2013-05-07 Wardriving: A Quebec City-Montreal Round Trip A few weeks ago, the Hackfest team made a round trip from Quebec City to Montreal, and to make the trip more interesting we... 2013-05-02 That's Not Playing Fair! A small startup in the video game world pulled an interesting "stunt" this week. Greenheart Games , when releasing its first game, put out... 2013-04-22 News roundup! In the podcast this week! Attention, attention: follow this week's podcast for news about where the blog is heading! We won't say more for... 2013-04-15 Hackfest needs you! Do you love security? Do you take part in the various activities organized by the Hackfest team? The Hackfest organizing team is currently looking... 2013-04-04 The Malware Challenge An interesting article was published on Security Week about the challenge today's malware poses to security teams. It's an interesting read that offers an... 2013-03-28 Ubuntu and China? Last week, the Chinese government and Canonical announced that a new version of the famous Ubuntu Linux distribution would be produced specifically for the... 2013-03-21 Hacking = innovation Generally speaking, you'll all agree that hacking usually requires a person to be able to think "outside the box". In fact, it necessarily requires... 2013-03-06 BYOB, nothing new - s/OB/OD/g Everyone is talking about it these days: how it's a huge risk, it's hard to manage, it's getting out of control, there are lots... 2013-03-04 Physical trojan Does physical security matter when it comes to IT sec?  Some lazy people will say no, maybe this will change some opinions : I... 2013-02-21 HackferSpace: Slides and Screencast 28th January 2013 (Why NTLM sucks!) Hi, here are the slides and screencasts (video demo) of our last HackerSpace by Mart & Vn Part1 httpv://www.youtube.com/watch?v=8DnL2pnulVk Part2 httpv://www.youtube.com/watch?v=17DwDrnURj8 Slides Hackerspace jan-2013... 2013-02-13 News Roundup New kid on the block A new exploit kit has surfaced! After blackhole, here comes whitehole . This one is said to be more... 2013-02-07 Packets of Death A very interesting article was posted on /. today about packets of death and Intel network cards.  The author used a packet generation and... 2013-02-04 The Great Wall Last week, we learned that several American media outlets were the target of cyberattacks, by all evidence coming from China. Over the weekend, the... 2013-01-31 News roundup Java, a little hope? The folks at Oracle made a public statement announcing they would do everything in their power to "fix" Java. What's... 2013-01-28 Responsible Disclosure 2013 has barely started and we've already seen it all. From scandals to the discovery of several major issues in various products. All of... 2013-01-23 News roundup Java, always Java... Bad month for Oracle, bad year really. The recent Java security updates apparently did not actually fix the security problems they... 2013-01-21 The Right to Privacy A few days ago, a Hackfest reader/attendee contacted us to tell us a rather surprising story. He was apparently the victim of an "information... 2013-01-16 News Roundup Clever A clever programmer gets caught red-handed ! A security audit apparently revealed that a programmer at a major US company was "subcontracting" his... 2013-01-14 The Cat and the Mouse A month ago, we learned that spider.io ( http://spider.io/blog/2012/12/internet-explorer-data-leakage/ ) had informed Microsoft, back in early October 2012, of a flaw that makes it... 2013-01-01 Happy New Year 2013 Hi all, The Hackfest wishes you a wonderful year 2013 and we hope that it will be the most prosperous and innovative. We wish...

2012-12-23 Holiday break We take a break during the xmas holiday. From the Hackfest crew, we wish you a merry xmas and happy new year! We’ll be... 2012-11-28 Hackfest 2012: Press release Quebec city, November 27th 2012 On November 2nd & 3rd 2012 Hackfest 2012, Canada’s largest Information Security conference East of Toronto was held in... 2012-11-04 Remote Crack Me Just like we promised, here are the files that can be downloaded in order to do some of the challenges that you can do... 2012-10-31 News roundup Hackfest: Registration for Hackfest is now closed, thanks to everyone who registered in advance! With Hackfest starting in exactly 48 hours, we can already... 2012-10-29 News roundup Weather  alert : Some people are starting to raise the possibility that a wave of spam/fraud will hit internet residents because of Hurricane Sandy.... 2012-10-26 Backtrack 101-5-NetCat The Backtrack 101 series aims to introduce beginners to several tools distributed with Backtrack Linux. By following these articles, a beginner can take part... 2012-10-25 News roundup Huawei again The company announced it would agree to make the source code used in its devices available, in order to prove to the... 2012-10-23 The spoon is not real This paper is not available in english, please refer to the french version. 2012-10-19 Backtrack 101-4-Hydra The Backtrack 101 series aims to introduce beginners to several tools distributed with Backtrack Linux. By following these articles, a beginner can participate in... 2012-10-17 War Tomorrow We all remember the virus attack on Aramco this summer, right? For those who may have forgotten: on August 15 , a computer virus... 2012-10-15 Backtrack 101-3-nmap + nse The Backtrack 101 series aims to introduce beginners to several tools distributed with Backtrack Linux. By following these articles, a beginner can take part... 2012-10-11 Enterprise IT Security Policies Series 2 Behaviour Management and User Education It's easy, even too easy, to think of IT security as something purely technical, a matter of applying configuration... 2012-10-10 Crash test dummies When an industry reaches maturity, it generally comes with a slew of regulations, approved methods, standards (followed... or not) and ways of doing things.... 2012-10-09 Backtrack 101-2-Dirbuster Backtrack 101 Series aims to introduce beginners to tools distributed with Backtrack Linux. Thus, according to these articles, a beginner can more easily  participate... 2012-10-08 TED: Hire the hackers! (Misha Glenny) 2012-10-03 Announcing BackTrack 101 Hackfest team is proud to announce the beginning of a new series of article about Backtrack. From now on, until the Hackfest (and more?),... 2012-10-02 Fast news News: Telvent Canada, an important SCADA provider  gets hacked . The compagny effectively announced that they had a security breach on their network on... 2012-10-01 TED: Investigates global crime networks (Misha Glenny) 2012-09-26 TED: How cyberattacks threaten real world peace (Guy-Philippe Goldstein) 2012-09-25 Office of information security Last week, US Federal energy regulatory commission officially announced the creation of a new office that will concentrates its efforts on information security. This new office,... 2012-09-24 Fast-Flux Networks Web sources: http://www.honeynet.org/papers/ff/ http://en.wikipedia.org/wiki/Time_to_live http://en.wikipedia.org/wiki/Bulletproof_hostin http://en.wikipedia.org/wiki/Fast_fluxg Book source: Malware Analyst's CookBook And DVD Organized crime constantly has to adapt to the world it operates... 2012-09-24 TED: All your devices can be hacked (Avi Rubin) 2012-09-23 iHack 2012.3: Going back on the event Two weeks ago, the second edition of the IHack night at cegep Ste-foy organised by the Hackfest team was taking place. Multiple challenges were... 2012-09-18 Do You Like Java? Over the past few days, some development teams have clearly had a little too much of their beloved brew... Organized crime, for its part,... 2012-09-17 TED: A Navy Admiral's thoughts on global security (James Stavridis) 2012-09-13 TED: Your phone company is watching (Malte Spitz) 2012-09-10 TED: The security mirage (Bruce Schneier)   2012-09-05 TED At the last Blackhat, we got to talking about TEDxQuebec  (started by, among others, Denis François Gravel) and about how Mikko Hypponen had given... 2012-09-04 Technical skills for manager? Just heard the best answer ever to the question of whether security managers need to have hands-on technical skills. An Air Force Major was... 2012-07-19 Mobile threats in action A video made by TrendMicro , that explaining pretty well the mobile threats. Worth spreading to not so techies friends. 2012-07-18 Watch Dogs Not very far from reality, base on IBM smarter cities . https://www.youtube.com/watch?v=Qs4OcQNOM34 2012-07-13 The Media While going through my usual news feeds, I came across this article: 6 new ways hackers are using malware This article isn't interesting (to... 2012-07-11 The extortion continues Fraudsters' imagination knows no limits. THE HEIGHT OF BRAZEN SCAMS! I just find it a shame that the analysis doesn't go further, since the... 2012-07-05 I Remember... That Nothing Has Changed! When the "Mission possible" videos came out, several people told me the content of the clips was still relevant today. Going even further back... 2012-06-28 Leaving for Las Vegas Soon (2012 edition) BlackHat and DEFCON are right around the corner. For those who, like us, are heading into the middle of the desert to listen to... 2012-06-08 Russian Cyber Capabilities: Policy and Practice A comprehensive primer on Chinese cyber capabilities. http://youtu.be/ZVwVhegU1S4 2012-06-07 Chinese Information Warfare A comprehensive primer on Chinese cyber capabilities. http://youtu.be/h4qlHMJkbs8 2012-06-02 Mission Possible Dominic had convinced us to produce a first security awareness video. The original video was reworked and reformatted so it could be presented as... 2012-06-02 Hostage to a Project Hostage to a Project (Otage d'un projet) is a short film made by Dominic Pion to make the various levels of management aware of... 2012-05-30 Homographs Irongeek is definitely inspiring me this week... And I'd love to have the time to do such cool stuff! The concept of homographs as... 2012-05-29 Learning by watching For those who might feel intimidated by a virtual machine, Jeremy Druin (@webpwnized) has made available a lot (72!) of videos explaining possible attacks and how... 2012-05-28 Mutillidae, or How to Learn Not everyone is at the same level of knowledge when it comes to appsec intrusion. For those interested in learning the basics, Irongeek has put... 2012-05-27 The danger of penetration tests Sometimes we need to have our perception of things shaken up. On penetration testing – harmful? http://www.youtube.com/watch?v=GvX52HPAfBk 2012-05-24 Security myth #4: You can rely on the wisdom of the crowd Security in modern systems can't be based on the wisdom of the crowds, because our intrinsic “wisdom” is built to spot a lion in... 2012-05-16 Top 10 free ways to secure your Mac Nothing new, but always good to be remembered ;-) Turn off Java in Safari Keep Mac OS X up-to-date Turn off automatic login Use... 2012-05-04 Active Directory Hold-up ... give me all the information ... i'm "Authenticated Users" (Part 1) Why talk about the group "Authenticated Users"? If you ask the question "What AD account is most likely to be compromised during an intrusion?", It is likely that the most popular answer is "a Domain Admins account". It... 2012-05-02 A cloud that's not so private after all Ahhhhh, cloud computing. For many it's the dream solution, the nec plus ultra that modern technology makes possible. At their purest, these solutions are... 2012-04-27 Avril 2012 : Hacktivisme, data-leaking, consumérisme TI, big-data [scribd id=91527362 key=key-1m0res5q0l7amj50ilu8 mode=list] 2012-04-27 Security Myth #3: Changing passwords regularly hardens password systems As I discussed in a previous post ( Password management… A new kind! ), forcing password changes adds no value to security systems. Nobody... 2012-04-25 Password Management… A New Kind! Sometimes we have epiphanies by connecting two things together. While setting up my girlfriend's iPad, I remembered that with Exchange support, you have to... 2012-04-20 Security Myth #2: Distributed Denial of Service Is a Bandwidth Problem Denial of service attacks, distributed or not, are not limited to bandwidth alone. It remains true that one class of denial of service works... 2012-04-18 Deceiving your way in I came across this article: How to sneak into a security conference It's always fun to target a security event and ridicule it by... 2012-04-13 Security Myth #1: "More Security Is Always Better!" We all have the impression that more security never hurts. You can never be too protected! This notion is deeply rooted in our psyche…... 2012-04-11 IAM Identity management. GIA. IAM. IDM. A little festival of acronyms for the thorny business of identity management. Identity is one of the key pillars... 2012-04-06 RIM vs Apple It's surprising what the key factor is that drives companies' stock market valuations. Take the same case: a security flaw in the operating system.... 2012-04-04 Traceability of Actions on the Internet It's sometimes surprising that so many people still believe in the anonymity the Internet provides. In the early days of the "commercial" Internet, there... 2012-03-30 Fraud, Damn Fraud! On a day like any other, while I was making supper, I got a call from VISA Desjardins. There had apparently been a change... 2012-03-28 How to properly wipe your iPad before reselling it As you probably know, Apple launched the third iteration of the iPad. If, like me, you already owned an iPad and you're switching to... 2012-03-24 Abusing Terminal Server SSO to pwn more boxes (Janurary 2012) Slides: [scribd id=83016269 key=key-17s38uih87udesb86pii mode=list] ScreenCast (part 1): [youtube=http://youtu.be/W31Zt-8XYl0] ScreenCas (part 2): [youtube=http://youtu.be/NArCn7_lSj4] 2012-03-23 Mobile Passwords (part 4) Like a lot of people, I browse more and more on a tablet and my smartphone. For "unauthenticated" browsing, that's not a problem. However,... 2012-03-21 The Social Engineering Toolkit I just had to find a French translation for " Social Engineering Toolkit ", or SET to its friends. I'm a big fan of... 2012-03-15 Mountain Lion MacOSX was long considered the most secure of operating systems, even though that reputation was mostly due to its small market share. Since Lion... 2012-03-14 Live and Let Live The trend toward exposing social media information to others is strong. I already reported that there's a big trend among teenage couples to share... 2012-03-09 Did you say Anonymous? Sorry for the delay in publishing this post. Since there have been a lot of twists and turns involving Lulzsec and Anonymous lately, I... 2012-03-07 SSL and the Security Myth There is a persistent myth about SSL. The premise is that if you use cryptography to protect communications, all security problems will be solved.... 2012-03-03 Pwnie Express A small video explaining Pwnie Express products by creator itself. Nothing new per see, but the packaging of pentesting tools inside the SheevaPlug and... 2012-03-02 13 myths Ellen Messmer of Network World published an article ( 13 Security Myths You’ll Hear -- but Should You Believe? ) that details 13 security... 2012-02-29 Intrusive Security: Blackbox There's a debate that comes up every now and then in my conversations with other security professionals… The usefulness of blackbox testing. Back in... 2012-02-28 TLS/SSL Following up on the post Hide this security that I cannot bear to see , here is a presentation on SSL/TLS. [slideshare id=11741138&doc=tlsoptimizationprint-120224194603-phpapp02] 2012-02-22 Mobile Passwords (Part 3) This is a topic of great interest, and I believe it will stay that way until it's solved. Several studies detail what we already... 2012-02-17 Hide that security I cannot bear to see Every time it's revealed that a widely used application or service on the Internet doesn't use SSL, there's a wide range of emotions in... 2012-02-15 If you love me, don't ask for my password! To echo the latest trend ... and today's theme! It's true that among young people, this kind of transparency can be seen as proof... 2012-02-08 2012: The End of the World? It may well be the end of the world as we know it. The computerization of the great pillars of modern life has reached... 2012-01-27 A Victim of the Cloud! While flipping through the news, I came across this story: Megaupload shutdown upends the work of a Regina IT worker A victim of the... 2012-01-25 Carrier IQ I don't know if it's the winter that makes people so jumpy, but here comes the second big media spin about a story that...

2011-12-09 Multi-LOL Printer For a brief moment, there was a storm around multifunction printers. Apparently it's the attack vector of choice now… And get this: you can... 2011-12-07 Marcus Ranum Will Be in Montreal CHRISTMAS DINNER - ASIMM 30th Anniversary, December 13, 2011 at 5:00 p.m. To register, you can visit the dedicated website ( http://www.30e-asimm.org ) or... 2011-12-06 The photos Hackfest 2011 photos are now available here: Under the kimono 2011 Hackfest 2011 2011-12-05 Slides 2011 For those of you who want to look back at the slides of the Hackfest 2011 presentations, they are available in this scribd "... 2011-12-02 Be sôciâl We're taking this opportunity to look back on the social engineering attempts that took place to get into Hackfest and during the evening contests.... 2011-11-30 Participation Now that the Hackfest is behind us, we have time to put life in the blog. I take the opportunity to reiterate that we... 2011-11-26 Recovering Hashes from Domain Controller After seeing a Tweet about dumping password hashes from a live Windows 2008 Domain Controller, I was intrigued. Reading a post from Tim Tomes... 2011-11-23 Information leaks (remix no tech hacking for Secus) Translation courtesy of Steven McElrea For several years now, organizations have been investing enormous amounts of money in protecting their Information. Implementations of firewalls,... 2011-08-03 The Intranet, So Secure! Security risks are most often tied to services exposed in the Internet zone (DMZ), an extranet, or anything connected to the Internet. However, even... 2011-08-01 The plaster effect Note: The idea for this post and the text come from an anonymous colleague, with a little collaboration on my part. Every day we... 2011-07-29 I Don't Give a D... I just read an excellent post on the Veracode blog... Mobile Security – Users Just Don’t Care The gist of it is that users... 2011-07-28 APT, or crying wolf (part 2) Shame on me. Security paradigms are shifting at a frightening pace. When RSA had its seed vault stolen nearly three months ago, I said... 2011-06-16 Hide that attachment I cannot bear to see Security paradigms are sometimes curious. Not so long ago, I was attaching a file to an email. Outlook warned me that the file was... 2011-06-13 Dominic Pion Life is a dragon that ends up swallowing us all. Dominic was a driving force. Single-handedly, he managed to rally people around projects bigger than... 2011-03-13 ISSA-Québec Affiliation Quebec City, March 12, 2011 We are pleased to announce that Hackfest Communication has entered into a permanent partnership with  the ISSA Quebec City...

2010-10-04 Non-Interactive Shell, Uploading files and other parlor tricks Québec, 4 octobre 2010 Auteur : Steven McElrea Email : loneferret @ gmail.com So, you’ve just gotten a remote shell. You’ve successfully compromised your...