Operations and Security of ownCloud


This is an English summary of the German paper "Betrieb und Sicherheit von ownCloud" (V1.0 2015-06-16) of "Bundesamt für Sicherheit in der Informationstechnik" (Federal Office for Information Security Germany) available for download here. Please note that this English translation is my own (so all errors and language issues in this post are also my own ) and that I have the approval of writing this summary by BSI (2015-06-22).

The [...]

Kursbuchkarte 1953

Eine Kursbuchkarte (Bahnbus) aus dem Jahr 1953 hat den Weg zu mir gefunden. Um sie zu erhalten und besser einsehen zu können, habe ich sie in kleinen Kacheln eingescannt und dann zusammen "gestitcht". Das Ergebnis findet sich hier (freigegeben nur zur nichtkommerziellen, privaten Nutzung!):

Anmerkung: Die Feindatei (Klick auf das Bild) ist 16 MB groß.

Sehr schön sieht man m.E., wie "weit" die Elektrifizierung zur damaligen Zeit vorangeschritten [...]

PenTest, Forensics and Rescue Live CDs

Some pentesting live CDs have been updated recently or will be shortly. Time for an overview.



ESXi 5.5 Scratch Pad

This is my personal scratch pad with information I had to research to get ESXi 5.5 to work for me.

Installation ESXi 5.5 / Win 7 Dual Boot

I decided that it would be handy to have ESXi running on my box … So basically this is what I did (disclaimer: if you break your stuff you're alone – don't blame me!):

important: have one physical disk dedicated for ESXi moved [...]

ShellShock Scans (Update)

A little grep'ing through logs reveal the following scan patterns (red: October):

Source IPs: Page Requests: GET /admin.cgi HTTP/1.1 GET //cgi-bin/bash HTTP/1.0 GET /cgi-bin/bash HTTP/1.0 GET /cgi-bin/hello HTTP/1.1 GET /cgi-bin/helpme HTTP/1.0 GET /cgi-bin/info.sh HTTP/1.0 GET /cgi-bin/php5-cli? HTTP/1.1 GET /cgi-bin/php5? HTTP/1.1 GET /cgi-bin/php.fcgi HTTP/1.0 GET /cgi-bin/php? HTTP/1.1 GET /cgi-bin-sdb/printenv HTTP/1.1 GET /cgi-bin/test-cgi HTTP/1.1 GET /cgi-bin/test.cgi HTTP/1.1 GET /cgi-bin/test.sh HTTP/1.0 GET [...]

New RSS Feed for News

I've added a new RSS feeds for external news and blog posts I personally consider worth reading You should be able to add it to any RSS feed reader.


If you like it, drop me a line.

[Video]: Conf Call

You can only find this funny if you attend conf calls in real life … but then it's hard to spot the difference to the last call you attended


[RP]: SANS SIFT 3.0 Virtual Machine Released

Finally: the new version of SIFT has been released.


Blog Software Migrated

The server needed an upgrade … so the migration to the next Debian release had to be done. And of course the migration of the CMS.

This was more complicated than expected … I wasn't able to find a smooth migration path from Drupal 6 to 7 for me (some important modules weren't available for Drupal 7 anymore). So after much hassle I decided to go with WordPress.

I googled [...]

[RP]: Research Revisited: The 3 Dirty Little Secrets of Disclosure No One Wants to Talk About