fingerprint

Forensic Discovery - a (free) book by Wietse Venema and Dan Farmer about forensic techniques for gathering digital evidence

I accidentally stumbled over this today: the book Forensic Discovery, written by two security gurus — Wietse Venema and Dan Farmer - has been published by Addison-Wesley.

Which is nice and all, but even nicer is the fact that the book is freely available for online reading. There's also a ZIP-file, if you want to get the whole thing.

This should make for some interesting reading during the next few weeks...

Play-Doh fingers can fool 90% of all fingerprint scanners

Oops. Engadget reports that Play-Doh fingers can fool 90% of all fingerprint scanners. This is nothing really new. The remarkable thing is that more and more companies and government organizations rely on such biometric authentication. Now, they all have been told about the problems, but nobody seems to want to listen...

(via Techdirt)

The Underhanded C Contest - Results

Being too busy sucks. I didn't even have the time to blog about the Underhanded C Contest, whose results have now been announced.

Quick reminder: the goal of the contest is to

write innocent-looking C code implementing malicious behavior. In many ways this is the exact opposite of the Obfuscated C Code Contest: in this contest you must write code that is as readable, clear, innocent and straightforward as possible, and yet it must fail to perform at its apparent function. To be more specific, it should do something subtly evil.

I blogged about the contest earlier, but only later decided to take part in the contest myself (together with Daniel Reutter). After some initial brainstorming we hacked together our solution in roughly one day.

Although we didn't win (damn, no beer for us ;-), we managed to submit one of the simplest solutions (ca. 34 lines of code), i.e., it's very hard to embed any malicious but innocent-looking code in there... Our solution exploits an array bounds overrun, with an extra equals sign ("<=" instead of "<").

I have yet to look at the two winning entries by M. Joonas Pihlaja and Paul V-Khuong (team submission), as well as Natori Shin. Congratulations guys! Also, I noticed the Slashdot story about the contest results, but didn't get around to read that article, either. Sigh...

Syndicate content