Computing

cloudflared on Debian with Ansible
Today I wanted to make a web service internet facing without exposing the origin server. Cloudflare offers cloudflared, a tool that tunnels traffic from the origin server to Cloudflare’s network. This gives the benefit of Cloudflare’s protection.
David Cannings
Sep 21, 2024 1 min read Computing
An interesting Callisto YARA rule
Yesterday Félix Aimé posted on X (formerly known as Twitter) a neat YARA rule to detect PDF documents. Tweet by @felixaime These documents relate to the Callisto group, which is attributed to the Russian FSB by various Western intelligence agencies.
David Cannings
Jun 26, 2024 9 min read Computing
Testing Magika

Google recently announced the release of Magika, an “AI-powered file-type identification system”. I tested this on a corpus of nearly 125k files to see how it fared.

David Cannings
Mar 24, 2024 9 min read Computing
rtfsig released
Today I released a new tool named rtfsig. rtfsig is a simple Python utility that helps create signatures for malicious RTF documents. The tool automatically generates YARA rules and makes suggestions for VirusTotal’s vtgrep based off potentially distinctive parts of RTF documents.
David Cannings
Sep 21, 2020 1 min read Computing
New GPG key

I have updated my GPG key, revoking ID 0x35076cbaa663a704 and replacing it with 0x57974c5b48a00d9b (find it on keyservers).

David Cannings
Mar 22, 2019 1 min read General, Computing
Signaturing an Authenticode anomaly with YARA

This is a local mirror of a blog written by me and originally published by NCC Group.
David Cannings
Sep 1, 2017 5 min read Computing
Solving Suko with pysmt

In a waiting room this week I opened a newspaper to find the following puzzle, named “Suko” (a trademark of Puzzler).

David Cannings
Jun 3, 2017 7 min read Computing
Sakula - an adventure in DLL planting

This is a local mirror of a blog written by me and originally published by NCC Group.

You can also read the related publication: Sakula DLL planting analysis.

David Cannings
Jun 16, 2016 3 min read Computing
sdelete - when secure delete fails
This is a local mirror of a blog written by me and originally published by NCC Group. Note: there are now better ways of wiping modern SSDs, as many will be self encrypting or support ATA commands for secure erase.
David Cannings
Mar 7, 2016 8 min read Computing
Analysis of the Linux backdoor used in freenode IRC network compromise
This is a local mirror of a blog written by me and originally published by NCC Group. This project was a highlight of my time at NCC Group, and I enjoyed collaborating with Pete Beck during analysis.
David Cannings
Oct 17, 2014 8 min read Computing