Origapy - a Python module to sanitize PDF files
Origapy is a Python interface to Origami, a PDF parser written in Ruby. It provides access to pdfclean.rb, in order to sanitize PDF files by disabling all active content (javascript, launch actions, embedded files, etc). Because Origami is a full PDF parser, it is much more effective than PDFiD (when sanitizing/disarming PDF files), but also quite slower.
PDFiD - a Python module to analyze and sanitize PDF files
PDF files may be used to trigger malicious content, as described here. PDFiD is a Python tool to analyze and sanitize PDF files, written by Didier Stevens. Here is PDFiD_PL, a version that I have slightly modified so that it can be imported as a module in Python applications (originally for ExeFilter).
SSTIC10 - Visualization and Dynamic Risk Assessment for Cyber Defence
Paper and presentation about visualization and dynamic risk assessment for cyber defence, presented at the SSTIC symposium on June 9 2010.
Frenchpyxmldsig - a Python module to create and verify XML Digital Signatures (XML-DSig)
pyxmldsig is a Python module to create and verify XML Digital Signatures (XML-DSig). This is a simple interface to the PyXMLSec library, aiming to provide a more pythonic API suitable for Python applications.
How to obtain the binary representation of an integer in Python
With Python 2.6+, that's quite simple:
print "{0:b}".format(i)
SSTIC03 - Malware and file formats
This article explains how many common file formats (DOC, XLS, PDF, HTML, XML, RTF, ...) may hide or trigger malicious code (virus, Trojan horse, ...) using their native features such as active content (macros, Javascript, etc). It was presented at the SSTIC symposium and OSSIR in 2003.
Python crash course
This is a Python course I have written to quickly teach Python to my colleagues and students, made of slides and samples for hands-on exercises.
Using ExeFilter against PDF exploits and zero-days such as CVE-2009-4324
This short article shows how ExeFilter can be used to disable JavaScript in PDF files, which is effective against many Adobe Reader exploits discovered in 2009, including the recent zero-day CVE-2009-4324.
SSTIC08 - Dynamic Malware Analysis for Dummies
This article (written in French) was presented at the SSTIC symposium on the 6th June 2008.
It describes several methods to perform malware analysis, especially on Windows platforms. It focuses in detail on dynamic analysis, also called runtime analysis or sandboxing. Dynamic malware analysis consists in running malicious code on a dedicated system, configured to record all its actions to determine its behaviour. It is then possible to quickly determine the nature of the malware and decide how to respond to an incident. The article also shows how to build a simple dynamic malware analysis lab at low cost, provides details about the methodology and suggests how to go further.
