Didier Stevens

Monday 5 December 2022

Extracting Certificates For Defender

Filed under: Malware — Didier Stevens @ 0:00

A colleague asked me for help with extracting code signing certificates from malicious files, to add them to Defender’s block list.

The procedure involves right-clicking the EXE in Windows Explorer, selecting properties to view the digital signature, and so on …

But I don’t like procedures where one has to click on malware.

So I looked for a PowerShell command, and found this.

Get-AuthenticodeSignature .\malware.exe.vir | Select-Object -ExpandProperty SignerCertificate | Export-Certificate -Type CERT -FilePath SignerCertificate.cer

Sunday 4 December 2022

Update: python-per-line.py Version 0.0.9

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a small update to add the lineNumber variable.

python-per-line_V0_0_9.zip (http)
MD5: CD9FC344E4C5F649E4043BD703CDCA52
SHA256: BD6713A7DF86AC75ADC2A6742A453919F56583D8CC5EB3B82B736608D2A52619

Saturday 3 December 2022

Overview of Content Published in November

Filed under: Announcement — Didier Stevens @ 9:52

Here is an overview of content I published in November:

Blog posts:

YouTube videos:

Videoblog posts:

SANS ISC Diary entries:

Wednesday 23 November 2022

Update: what-is-new.py Version 0.0.2

Filed under: My Software,Update — Didier Stevens @ 0:00

This update of what-is-new-.py, my tool that reports what lines inside files are new (e.g., never seen before) has a new option: -a –action. It allows me to launch a command when something new is detected.

I use this for example to be alerted via TelegraM; More details in an upcoming blog post.

what-is-new_V0_0_2.zip (http)
MD5: 458B06FAF21F6BB150087196CCFEFAC2
SHA256: D020205346A778A4EE31B9C645F31BD4E14B465DC0B37BABD1DEEDFB6F347232

Saturday 12 November 2022

Quickpost: Testing A USB Fridge (Update)

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

I performed some extra tests with my USB fridge (see Quickpost: Testing A USB Fridge).

Here is how the temperature evolved when I put a can with cold water (around 12° C) in the USB fridge:

The temperature increased around 2° C over a period of 12 hours (room temperature was around 17 °C).

That required around 57 Wh.

And the temperature at the top of the can increased more than at the bottom:

For reference, here is how the temperature evolves of a cooled can of water left on the desk in that same room (so not inside the USB fridge):

Quickpost info

Friday 11 November 2022

Update: oledump.py Version 0.0.71

Filed under: Uncategorized — Didier Stevens @ 0:00

A new plugin and an updated plugin.

Plugin plugin_dttm is a plugin for Word documents: it searches for Dop structures. They contain DTTM timestamps.

And plugin plugin_metadata has been updated to parse digital signatures (option -s).

oledump_V0_0_71.zip (http)
MD5: BA1142136F28DB218BADEAA642EA0EA9
SHA256: FA09766D138A1AA60523B487D947BF29222D409CF1FCE078DE61BF62768A5950

Thursday 10 November 2022

Update: pdf-parser.py Version 0.7.7

Filed under: My Software,Update — Didier Stevens @ 0:00

This is a small update: you can now select which hash algorithm to use for option -H by setting environment variable DSS_DEFAULT_HASH_ALGORITHMS.

And the statistics options (-a) also display a list of objects with streams.

pdf-parser_V0_7_7.zip (http)
MD5: BCAE193F171184F979603DFB1380FF43
SHA256: 576C429FA88CF0A7A110DAB25851D90670C88EC4CD7728329E754E06D8D26A70

Sunday 6 November 2022

Quickpost: Testing A USB Fridge

Filed under: Hardware,Quickpost — Didier Stevens @ 14:50

A couple years ago, I received a USB fridge from NVISO’s Secret Santa.

It uses a Peltier element with a fan.

I did the following test: overnight, I let the fridge run for 12 hours. It contained an Aluminum can filled with water at room temperature (around 17° C).

I used a power meter to measure the electric energy consumption, and a multimeter with a thermocouple (type K) to measure the water temperature. The thermocouple was at the bottom of the water, not touching the bottom of the can.

The USB fridge consumed 60.717 Wh over that period, and the water temperature (at the bottom) was around 14.7 °C when I stopped the test. After the test, I moved the thermocouple to the top of the water, and there the temperature was 16.9 °C.

My multimeter logged the temperature every 60 seconds, resulting in this chart:

Notice that the first 12 minutes, the temperature rises a bit, and then starts to lower (I’ll do more experiments to try to figure out why it rises first). And then, when the cooling starts, it gradually slows down. Around 8 hours 45 minutes into the test, the water temperature reaches 14.80 °C and from then on barely changes.

The can is coolest at the bottom, as can be observed in this thermal image:

More pictures:

You don’t get much cooling from this USB fridge for the amount of energy it takes. I didn’t RTFM, so maybe its purpose is not to cool a can from ambient temperature down to a nice cool drink, but to keep a can cooled in a real fridge, cool when it’s sitting on your desk.

But most likely it’s an inefficient USB gadget 🙂

Quickpost info

Tuesday 1 November 2022

Overview of Content Published in October

Filed under: Announcement,Uncategorized — Didier Stevens @ 0:00
Here is an overview of content I published in October:

Blog posts: YouTube videos: Videoblog posts: SANS ISC Diary entries:

Monday 31 October 2022

Quickpost: BruCON Travel Charger

Filed under: Hardware,Quickpost — Didier Stevens @ 0:00

In my BruCON speaker goodie bag, I found a travel adapter & USB charger:

I already have a similar travel adapter, but this BruCON travel adapter has one extra important feature for me: a USB C port.

As I still had my setup ready for testing the electrical energy consumption of devices, I quickly tested the standby power of this charger.

It’s average standby electrical power consumption is 236,46 mW. Standby means: I plug the adapter into an electrical outlet (230V) without connecting any device for charging.

I imagine that for a travel adapter, standby consumption is not that important, as one would use it only occasionally.

Quickpost info
Next Page »

Blog at WordPress.com.