Malware Sample Sources for Researchers

Malware researchers have the need to collect malware samples to research threat techniques and develop defenses. Researchers can collect such samples using honeypots. They can also download samples from known malicious URLs. They can also obtain malware samples from the following sources:

• Contagio Malware Dump: Free; password required
• Das Malwerk: Free
• FreeTrojanBotnet: Free; registration required
• KernelMode.info: Free; registration required
• MalShare: Free; registration required
• Malware.lu’s AVCaesar: Free; registration required
• MalwareBlacklist: Free; registration required
• Malware DB: Free
• Malwr: Free; registration required
• Open Malware: Free
• theZoo aka Malware DB: Free
• Virusign: Free
• VirusShare: Free

Be careful not to infect yourself when accessing and experimenting with malicious software!

My other lists of online security resources outline Automated Malware Analysis Services and On-Line Tools for Malicious Website Lookups. Also, take a look at tips sharing malware samples with other researchers.

Encoding vs. Encryption vs. Hashing vs. Obfuscation

• Encoding
• Encryption
• Hashing
• Obfuscation

There is often significant confusionaround the differences between encryption, encoding, hashing, and obfuscation.

Let’s take a look at each one:

ENCODING

The purpose of encoding is to transform data so that it can be properly (and safely) consumed by a different type of system, e.g. binary data being sent over email, or viewing special characters on a web page. The goal is not to keep information secret, but rather to ensure that it’s able to be properly consumed.

Encoding transforms data into another format using a scheme that is publicly available so that it can easily be reversed. It does not require a key as the only thing required to decode it is the algorithm that was used to encode it.

Examples: ASCII, Unicode, URL Encoding, Base64

ENCRYPTION

The purpose of encryption is to transform data in order to keep it secret from others, e.g. sending someone a secret letter that only they should be able to read, or securely sending a password over the Internet. Rather than focusing on usability, the goal is to ensure the data cannot be consumed by anyone other than the intended recipient(s).

Encryption transforms data into another format in such a way that only specific individual(s) can reverse the transformation. It uses a key, which is kept secret, in conjunction with the plaintext and the algorithm, in order to perform the encryption operation. As such, the ciphertext, algorithm, and key are all required to return to the plaintext.

Examples: AES, Blowfish, RSA

HASHING

Hashing serves the purpose of ensuringintegrity, i.e. making it so that if something is changed you can know that it’s changed. Technically, hashing takes arbitrary input and produce a fixed-length string that has the following attributes:

1. The same input will always produce the same output.
2. Multiple disparate inputs should not produce the same output.
3. It should not be possible to go from the output to the input.
4. Any modification of a given input should result in drastic change to the hash.

Hashing is used in conjunction with authentication to produce strong evidence that a given message has not been modified. This is accomplished by taking a given input, hashing it, and then signing the hash with the sender’s private key.

When the recipient opens the message, they can then validate the signature of the hash with the sender’s public key and then hash the message themselves and compare it to the hash that was signed by the sender. If they match it is an unmodified message, sent by the correct person.

Examples: SHA-3, MD5 (Now obsolete), etc.

OBFUSCATION

The purpose of obfuscation is to make something harder to understand, usually for the purposes of making it more difficult to attack or to copy.

One common use is the the obfuscation of source code so that it’s harder to replicate a given product if it is reverse engineered.

It’s important to note that obfuscation is not a strong control (like properly employed encryption) but rather an obstacle. It, like encoding, can often be reversed by using the same technique that obfuscated it. Other times it is simply a manual process that takes time to work through.

Another key thing to realize about obfuscation is that there is a limitation to how obscure the code can become, depending on the content being obscured. If you are obscuring computer code, for example, the limitation is that the result must still be consumable by the computer or else the application will cease to function.

Examples: JavaScript Obfuscator,ProGuard

SUMMARY

• Encoding is for maintaining datausability and can be reversed by employing the same algorithm that encoded the content, i.e. no key is used.
• Encryption is for maintaining dataconfidentiality and requires the use of a key (kept secret) in order to return to plaintext.
• Hashing is for validating the integrityof content by detecting all modification thereof via obvious changes to the hash output.
• Obfuscation is used to prevent people from understanding the meaning of something, and is often used with computer code to help prevent successful reverse engineering and/or theft of a product’s functionality.

Sumber: https://danielmiessler.com/study/encoding-encryption-hashing-obfuscation/

Wacana Dana Pensiun untuk Non PNS (ASN)

Jakarta (Kemenag) --- Kementerian Agama melalui Direktorat Guru dan Tenaga Kependidikan (GTK) Madrasah menjajaki pengelolaan dana pensiun syariah untuk guru madrasah non PNS. Hal ini dibahas dalam pertemuan antara tim Direktorat GTK Madrasah dan tim Industri Jasa Keuangan Non Bank (IKNB) Otoritas Jasa Keuangan (OJK). 

Pertemuan ini dalam rangka sosialisasi dana pensiun syariah untuk guru madrasah oleh OJK. Direktur IKNB-OJK Mochamad Mukhlasin, mengatakan bahwa tunjangan hari tua atau dana pensiun sangat penting. Bagi guru Pegawai Negeri Sipil (PNS) tidak perlu kawatir dengan dana pensiun. Akan tetapi bagi guru swasta atau yang tidak memiliki penghasilan lain, akan kesulitan ketika tidak memiliki dana pensiun. 

Dikatakan Mukhlasin, jaminan di lembaga swasta itu masih sangat minim. Kami melihat perlunya kerjasama menggandeng kepala sekolah, guru untuk mulai aware terhadap persiapan menghadapi masa tua lewat dana pensiun. 

“Bagaimana kita mempersiapkan masa tua. Cara yang lebih mudah adalah dengan mengikuti program dana pensiun. Dana pensiun tidak terkena pajak,” ujar Mukhlasin di Jakarta, Rabu (20/9). 

Langkah awal yang perlu dilakukan, lanjut Mukhlasin, adalah mengenalkan guru-guru untuk merencakanan keuangan di masa tua. Pihaknya ingin difasilitasi untuk bertemu dengan guru-guru atau jaringan madrasah, untuk mengenalkan atau membantu lembaga pendidikan yang sudah memiliki pengelolaan dana sendiri. 

Menurutnya, perlu dipetakan rencana sosialisasi, potensi, minat dan guru-gurunya di mana. “Mungkin awalnya kami sosialisasi ke sekolah swasta yang sudah mapan. Karena pengalaman kami orang yang memikirkan dana pensiun adalah guru yang sudah memiliki income cukup besar,” sambung Mukhlasin. 

Kasubdit Bina GTK MI/MTs Kidup Supriyadi menyampaikan bahwa di Indonesia ada sekitar 700ribu guru swasta. Tinggal nanti meyakinkan guru-guru untuk mempersiapkan masa pensiun. 

“Saya pikir ini cukup besar untuk dikelola. Saya kasihan melihat guru honor, ketika sudah tidak mengajar nasibnya menjadi tidak jelas,” tuturnya. 

Hal senada juga disampaikan oleh Kasubdit Bina Guru MA/MAK, Siti Sakdiyah bahwa Dit GTK secara prinsip senang dan mengapresiasi program Pengelolaan Dana Pensiun Syariah Untuk Guru Madrasah yang coba ditawarkan oleh OJK. Menurutnya guru-guru madrasah perlu diproteksi dalam hal pengelolaan dana pensiun. 

“Akan tetapi saya berharap pengelolaan dana ini perlu diawasi dan dijaga juga, biar lebih safety,” sambung Sakdiyah.

https://kemenag.go.id/berita/read/505703/kemenag-jajaki-pengelolaan-dana-pensiun-syariah-untuk-guru-madrasah

Kalkulator Resistor Online

Bagi yang suka mengutak-atik rangkaian elektronik, tentu mengetahui nilai dari komponen digital yang akan dirakit itu sangat penting, agar tidak salah perhitungan sehingga membuat ramgkaian malah rusak terbakar atau konslet, berikut salah satu Kalkulator Resistor Online:
https://www.digikey.com/en/resources/conversion-calculators/conversion-calculator-resistor-color-code-4-band

How to suspend/hibernate windows 7 from command line

Shutdown Computer

Shutdown.exe -s -t 00

Restart Computer

Shutdown.exe -r -t 00

Lock Workstation

Rundll32.exe User32.dll,LockWorkStation

Hibernate Computer

rundll32.exe PowrProf.dll,SetSuspendState

Sleep Computer

rundll32.exe powrprof.dll,SetSuspendState 0,1,0

The command rundll32.exe powrprof.dll,SetSuspendState 0,1,0 for sleep is correct - however, it will hibernate instead of sleep if you don't turn the hibernation off.

Here's how to do that:

Go to the Start Menu and open an elevated Command Prompt by typing cmd.exe, right clicking and choosing Run as administrator. Type the following command:

powercfg -hibernate off

Sumber: https://sites.google.com/site/xiangyangsite/home/technical-tips/windows-tips/how-to-suspend-hibernate-windows-7-from-command-line