Dear dear Readers

I know it can be rather frustrating to return to a blog you read of similar interests, and it hasn't been updated, not a picture or a text.

I understand you dear reader, and I must give my utmost apology for this space of time when I've been unable to click on the "blogger" or bring myself to think of the phrases to explain my next "adventure".

This is my little note of apology and I hope you understand. Since I got my new role that has barely given me space for myself due to the job excitement, I have been incommunicado with you. I sincerely do apologise but I won't be too quick to add that it will never be repeated because I am human and we always make mistakes. Rather, I'll add that I will do my best to keep the experience here more up-to-date and well, exciting (I should hope). Having said that, I've been up to rather new and strange exciting tasks of late.

I am doing something quite different at the moment and I thought to share this because I do not know if I'll be able to keep my head above water. To save you from drowning in this sea of AWS and Salesforce, I had to quickly steal 10 minutes from my regular desk to my news desk.

So here:
I am working on moving Salesforce logs which is saved in an app termed EM WAVE to Amazon's S3 bucket.
As you may all have guessed, I'm pretty new to Amazon Web Services (A.K.A AWS). I took a dive in when the AWS Engineer bailed out on the organisation I work for. Well, not exactly but kind of. He wasn't very happy with his job and I could tell on my first week on the job. Anyway, fast-forward to this week, I have to create a lambda function to move the Wave logs to S3, apparently, I need a python script for this. "Where is my Python knowledge stored again?"
What I've done is, I'm trying it out with a test S3. I thought to install an app in my Salesforce Sandbox to try it out, that was so silly because Salesforce logs aren't stored in salesforce.com. I'm getting a little help from Salesforce website and another referred by Salesforce:

That's it so far. I'll update the blog about my big mistake with Salesforce, I promise.

How to know what needs to be known

I have a problem choosing what particular course to take online, or what experiment to do in relation to InfoSec because I studied Computing and Security and I just finished studying Information Systems security (I am not satisfied though because universities choose what to teach you)..

I decided to choose what I wish to learn but then the more vulnerabilities and threats I assess, the more I want to know indepth about that area of infosec, I can't!!

Thank you Information Security you are so broad!!!

How to decide what path to take
I asked me, "what excites you about Info Sec"? Managing vulnerabilities, watching threats, helping to block out threats and fix problems. That brought me to ---> Pen testing. (I have only a year of experience in vulnerability management and threat analysis).

Okay, great! there's so much to know in Pen testing where do I begin? ARM/x86, scripting in python, learning to use more tools like nmap?

I need help!!!!

Currently I am taking a course in py, (I know, this is my second attempt at scripting, first it was js and I got bored but python has got me captured).
I am also taking a course in Ethical hacking along side and I am interested in Comptia A+ to know more about networking and dodgy request coming through. Argh!!! too much at one time but I need to choose between eth hacking and comptia, please help if you are a pro in this or have overcome this decision making process.
Thank you kindly!

How time flies

Its been a while I was on here to keep you up-to-date with my experiments in IS security. I can tell you there hasn't been much done since my last post, the reason being that I have been swarmed up with work and I can't seem to get a breather.

This weekend, I am back on my course. I'm learning ethical hacking and afterwards reverse engineering.
I am also learning python along side but that's taking too long as the course is going through the first phases of programming (boring and I already know it) but I have to do it anyway because I can't skip!
I'll certainly keep you updated if anything new comes up.

The only new thing so far is the BEEF tool. (you can use this to hack a windows pc, that's how much I know at the moment).

Have a fun filled week doing what you love doing, hopefully that's something in IS security.

Kali Linux installation - VM

For a while I had struggled with installing Linux on Oracle VM and it always fails at some point during the installation.

What I did
I updated my VM and downloaded the Kali light version, then installed it and followed the steps carefully. It worked!!

What went wrong
After installation, login failed. I had to create another VHD to install a fresh version of Kali, only to find out that the username is simply "root" without the quotes and use the password you setup, capische!,..

Let pen testing practice begin!!

My First with ARM programming

What you need to know before learning the assembly language: any knowledge of programming will help, even better with prior knowledge of BASIC

My Experience

So I found resources online that will get me started in programming the microcontroller. I was excited initially but my excitement wore off when I realised I'd be programming in ARM on an x86, okay... not as planned.
Well, I found this tool online that gives you an IDE in programming in ARM. It gets you started and you can find more examples on the website (see link below). This IDE is uVision by Keil. I found it pretty cool tbh but I couldn't go further and this is it after couple of hours playing around, it's off my computer!

Unfortunately I didn't take a snapshot of the IDE when it was open, I realised that when I was uninstalling it. I'll be moving on to x86, and I'll keep you posted as I go along. For those who'd like to learn ARM, I'll post my resources below. Please share with us as you get along programming your architecture.

Resources to get you started

ARM IDE (Keil uVision description and visual representation) ¦ http://www2.keil.com/mdk5/uvision/

ARM programming examples from Keil ¦ http://www.keil.com/support/man/docs/armasm/armasm_dom1359731145503.html

ARM IDE (Download - you may need to register) ¦ https://www.keil.com/demo/eval/arm.htm#/DOWNLOAD

Tutorials about ARM Assembler and the language

1. http://www.heyrick.co.uk/assembler/

2. http://www.peter-cockerell.net/aalp/html/frames.html

3. http://www.rigwit.co.uk/ARMBook/ARMBook.pdf (free online book, I believe)

My note from Recorded future using Splunk

Splunk is the security nerve centre:
found in SOC/ SIEM and Command centres
Splunk is at the heart of web proxy, firewall, app, network, threat intelligence servers, endpoints, identity, internal network security
It is used to correlate your information from your Recorded future resources or your OSINT.

Adaptive response
Enterprise security (information, permission) is built on Splunk. With Adaptive response you can run a command on an ad-hoc bases.
You can specify the domains and vulnerability type, you can use information from a log file as well. You can run it and find the information Recorded future may have pulled around that vulnerability or IP, you find the rule that was used to pull the information. References could be non traditional from twitter and blogs.

With recorded future, quick response is integrated into Splunk. There's enrichment i.e. adding content to what you are monitoring or to your information. Recorded future data is pulled in in real-time and reduces traffic for analysis.
For example: monitoring an IP, finding it malicious but it may be related to hashes and other IPs, it gives you more locations to investigate.

Seminar from Splunk and Recorded Future

D-link routers - Buffer overflow vulnerability

As reported on US-cert, D-link routers have the buffer overflow vulnerability. Specifically it was mentioned that it is the stack-based buffer overflow vulnerability (the buffer overwritten is located on the stack), this is due to  SOAP malfunction. It has to do with the action of login (username, password, login action and the captcha).

How this may have worked:
An attacker can leverage this vulnerability by injecting a shellcode through the login function and this can cause a stack overrun, which will the return address in the stack to be overwritten and the attacker can gain root privileges. Basically, in the shellcode, the attacker specifies where its own return address, this gives the attacker the upper hand and an elevated privilege.

Solution to D-link users: Update your firmware, there's a new update available

If you have a better explanation, I will appreciate it very much.