This article describes the Microsoft Office Open XML file formats (docx, xlsx, pptx), related security issues and useful resources. [WORK IN PROGRESS]
OVALdi, also named the OVAL Interpreter, is an open-source tool developed by MITRE to demonstrate how the OVAL language may be used to scan a computer for vulnerabilities. This article provides a few hints about how to use this tool.
This article (written in French) was presented at the SSTIC symposium on the 6th June 2008.
It describes several methods to perform malware analysis, especially on Windows platforms. It focuses in detail on dynamic analysis, also called runtime analysis or sandboxing. Dynamic malware analysis consists in running malicious code on a dedicated system, configured to record all its actions to determine its behaviour. It is then possible to quickly determine the nature of the malware and decide how to respond to an incident. The article also shows how to build a simple dynamic malware analysis lab at low cost, provides details about the methodology and suggests how to go further.
This page provides a few methods to create X509 certificates for testing purposes.
Article and presentation about security issues in OpenDocument and Open XML formats (OpenOffice and MS Office 2007) - published in the Journal of Computer Virology in Oct 2007 and presented at the PacSec 2006 conference.
BlindFTP is a simple and portable tool for file transfers through unidirectional network connections (without acknowledge), for instance an optical network diode.
pyClamd is a portable Python module to use the ClamAV antivirus engine on Windows, Linux, MacOSX and other platforms. It requires a running instance of the clamd daemon. pyClamd is more portable than pyClamAV because it does not need to be compiled, so it works on Windows.
This is a slightly improved version of pyClamd v0.1.1 originally created by Alexandre Norman and published on his website: http://xael.org/norman/python/pyclamd/
XML Canonicalization (C14N) is useful in some cases such as digital signature.
lxml provides a very easy way to do it in Python. However, the current version lxml 2.1 does not give access to all C14N parameters. Here is a simple patch to improve its C14N support.
Using XML-DSig (XML Digital Signature) and OpenSSL from Python scripts is not straightforward, but there are solutions. Here are a few links to useful libraries and articles.