One of the coolest things about WordCamp is that they post videos of each talk and presentation on WordPress.tv for viewing afterwards. It give you the chance to see all the great presentations you may have missed, or to revisit the ones you attended.
With so many WordCamps happening all over the world, it is a great resource.
My presentation from WordCamp Asheville 2016, titled WordPress Security: Don’t Be a Target, is now live on WordPress.tv.
Thanks to everyone who came out to the Asheville Area WordPress Group meetup last night, and thanks for the great discussion! I learned a lot from you all, and I hope you came away with something you could use to make your own website more secure.
As promised, here are the slides from the presentation:
Shimmers are the new skimmers. I’m sure it’s only a matter of time before they become as difficult to detect by the average person pulling up to an ATM.
This article reveals that the people holding the keys are often the juiciest targets, regardless of their innocence, as they are a means to and end. However, perhaps the most interesting part of the article, Inside the NSA’s Secret Efforts to Hunt and Hack System Administrators, is this:
Once the agency believes it has identified a sys admin’s personal accounts, according to the posts, it can target them with its so-called QUANTUM hacking techniques. The Snowden files reveal that the QUANTUM methods have been used to secretly inject surveillance malware into a Facebook page by sending malicious NSA data packets that appear to originate from a genuine Facebook server. This method tricks a target’s computer into accepting the malicious packets, allowing the NSA to infect the targeted computer with a malware “implant” and gain unfettered access to the data stored on its hard drive.
Looks like I chose a good week to cancel my Facebook account 😉
Disclaimer: Don’t do this unless it’s for legitimate reasons, such as the one outlined below.
At work, I recently came across the need to crack a handful of MS Office files that someone had password protected. Of course, that person was no longer around, so the person who took over needed to figure out how to access these documents, and they asked the Security team for help.
My first instinct turned out to be the correct one: use John the Ripper on Kali 2.
The main issue I faced was extracting the password hash from the Office docs in question so that John The Ripper could have something to run against. Turns out there is a handy python script you can use that does exactly this: office2john.py (https://github.com/kholia/RC4-40-brute-office)
Download office2john.py, then make it executable.
# chmod a+x offce2john.py
# ./office2john.py secret-company-secrets.docx > hash.txt
# cat hash.txt
# john --session=docx --rules --wordlist=/usr/share/wordlists/sqlmap.txt hash.txt
Now, sit back and wait for John to do its thing.
Just use pdfcrack in Kali.