company.html0000664000175400000410000001070410750133601013041 0ustar jhayswww-data Stach & Liu | Company
Company
About Us

Stach & Liu is a professional security services firm dedicated to providing innovative and effective solutions to our clients' complex and challenging information security needs. Recognizing that each organization is different, we work with all our customers to tailor our services to meet their unique requirements. Our clients benefit from our consultants' many years of experience at government intelligence agencies, Fortune 100 companies, the Big 4, and leading research institutions. Ultimately, our goal at Stach & Liu is to offer our clients what they value – world-class technical solutions with the highest level of professional integrity.

Careers

Stach & Liu is committed to providing our clients with the highest level of service from the best consultants in the industry. If you are interested in joining our select team of professionals, please send your resume to contact@stachliu.com.

Contact Us

For general questions or to find out more about our services, please e-mail us here.

Copyright © 2008 Stach & Liu LLC
index.html0000740000175400000410000001304310750151243012476 0ustar jhayswww-data Stach & Liu | Home
[Home]
[Services]
[Research]
[Training]
[Company]
Home
News & Events

December 6, 2007
Stach & Liu contributes as technical editors to the highly-anticipated, recently released AJAX Security, a book covering the latest in Web 2.0 application security. Read More...

Sep 12, 2007
Vincent Liu co-authors with Caleb Sima of SPI Dynamics the latest publications in the SPI Dynamics Expert Articles series:

Effective Controls for Attaining Continuous Application Security throughout the Web Application Development Lifecycle

Sep 12, 2007
Stach & Liu is sponsoring HP Software's SPICon2007, where Vincent Liu will be presenting Lessons Learned - Implementing an Application Security Program.

Click here to view archived Stach & Liu news entries.
HE_Wireless

Just Published

The Stach & Liu team team contributes technical expertise to newly published Ajax Security.
Read More...

Regulatory Compliance

Regulatory Compliance

Stach & Liu offers a wide range of solutions to meet your compliance needs.
Read More...

Copyright © 2008 Stach & Liu LLC
news_archives.html0000664000000000000410000002154010750151664014070 0ustar rootwww-data Stach & Liu | News Archive
[Home]
[Services]
[Research]
[Training]
[Company]
Home
Archived News & Events

Aug 9, 2007
Vincent Liu will present and participate on the Provider and Vendor - Implementation Lessons Learned panel at the SANS Application Security conference.

Aug 1, 2007
Vincent Liu authors Penetration Testing: The White Hat Hacker as featured in the July 2007 issue of the ISSA Journal.

Jun 21, 2007
Vincent Liu co-authors with Caleb Sima of SPI Dynamics the latest publications in the SPI Dynamics Expert Articles series:

May 31, 2007
Vincent Liu featured in CSO magazine’s article The Rise of Antiforensics, which has also been featured in CIO magazine.

Mar 26, 2007
Stach & Liu announces its support and participation in the industry's first certification for secure programming, the SANS GIAC Secure Software Programmer (GSSP).

Mar 26, 2007
Stach & Liu is proud to announce the release of our book, Hacking Exposed: Wireless, the latest installment in the international best-selling Hacking Exposed series published by McGraw-Hill.

Jan 25, 2007
Patrick Stach presents “Commonly Overlooked Cryptographic Vulnerabilities in Web Applications” at the San Francisco OWASP chapter meeting.

Jan 11, 2007
Jon Rose will be hosting the first Phoenix OWASP chapter meeting in 2007 featuring Brian Christian from SPI Dynamics, who will be presenting "Protecting Web Applications Throughout the Development Lifecycle".

Nov 24, 2006
Vincent Liu provides expertise on protecting corporate assets in in the November 24, 2006 issue of The Business Journal Phoenix.

Nov 9, 2006
Jon Rose will be presenting application security vulnerabilities in publicly available source code at the kick-off Phoenix OWASP meeting.

Oct 17, 2006
Vincent Liu will be leading the consulting services roundtable discussion and will be a panel member on the Industry Experts Panel for Application Security at SPICON 2006.

Jun 14, 2006
Vincent Liu will be presenting the latest in anti-forensics techniques at the Arizona High Technology Crime Investigation Association (HTCIA).

May 3, 2006
Vincent Liu and Patrick Stach will be presenting Defeating Forensic Analysis at Computer and Enterprise Investigations Conference 2006.

Apr 3, 2006
Vincent Liu and Francis Brown will be presenting Bleeding-Edge Anti-Forensics at InfoSecWorld 2006.

Oct 13, 2005
Vincent Liu will be presenting The Metasploit Anti-Forensics Project v2 at Microsoft BlueHat.

Sep 16, 2005
Vincent Liu will be presenting The Metasploit Anti-Forensics Project at Toorcon 7.

Jul 27, 2005
Vincent Liu will be presenting Catch Me If You Can at BlackHat 2005.

Contact Us

For general questions or to find out more about our services, please e-mail us here.

Copyright © 2008 Stach & Liu LLC
research_advisories.html0000664000000000000410000001130410750133463015246 0ustar rootwww-data Stach & Liu | Research | Advisories
Research
Advisories

12/08/2005
PGP Desktop Wipe Free Space Flaw
PGP Desktop includes a Wipe Free Space utility that claims to eliminate data in all the free space on your hard drive including the the little areas after the end of existing files which may still have old data left behind. In short, the utility claims to wipe file slack space, the unused space in a disk cluster. The software does not work as advertised. It does not clean slack space.

12/07/2005
Windows File Time Stamp Display Flaw
Windows file time stamps can be set to extremely low values via the NtSetInformationFile() system call. The Windows API does not properly translate the low 64-bit time values stored on disk into human readable format, and displays no information instead. Although this is not a security vulnerability in itself, it adversely affects third-party applications that rely upon the Windows API to perform the translation.

Resources

Projects and Tools
Publications
Conferences
Advisories

Copyright © 2008 Stach & Liu LLC
research_collisions.html0000664000000000000410000002117610750150710015256 0ustar rootwww-data Stach & Liu | Research | Projects and Tools | MD5 and MD4 Collision Generators

MD5 and MD4 Collision Generators

MD5 Collision Generation
Faster implementation of techniques in How to Break MD5 and Other Hash Functions, by Xiaoyun Wang, et al.

Win32 binary and source port
Thanks to Steve Dispensa

Old (Wang, et al.) average run time on IBM P690 supercomputer: 1 hour
New average run time on P4 1.6ghz PC: 45 minutes
Note: some block #1's don't have block #2 solutions
Compile note: for gcc use -Os and appropriate -mcpu and -mtune flags for optimal performance. 

IV        0x67452301  0xefcdab89  0x98badcfe  0x10325476
M  00-03  0x7145bd7e  0x6e3f662b  0x295fe965  0x47b62554
M  04-07  0x39b70f11  0xe011ec84  0x951d1143  0xc4450838
M  08-11  0x06342cd5  0xc2945409  0x7a98f40b  0x14d052f6
M  12-15  0x3eb35b13  0x9b2cd6e5  0x251c71d6  0xa26055fd
M  16-19  0x7aea969c  0x3df40576  0xc75becdf  0x922ccfcc
M  20-23  0x96f618d4  0xdc09dec1  0x76317914  0xf01d8a54
M  24-27  0x8a7f381d  0x2cc1fafe  0xd1af99da  0xbceed491
M  28-31  0x37ffdcf9  0x521fe162  0x50cf3655  0x0606283a
M' 00-03  0x7145bd7e  0x6e3f662b  0x295fe965  0x47b62554
M' 04-07  0xb9b70f11  0xe011ec84  0x951d1143  0xc4450838
M' 08-11  0x06342cd5  0xc2945409  0x7a98f40b  0x14d0d2f6
M' 12-15  0x3eb35b13  0x9b2cd6e5  0xa51c71d6  0xa26055fd
M' 16-19  0x7aea969c  0x3df40576  0xc75becdf  0x922ccfcc
M' 20-23  0x16f618d4  0xdc09dec1  0x76317914  0xf01d8a54
M' 24-27  0x8a7f381d  0x2cc1fafe  0xd1af99da  0xbcee5491
M' 28-31  0x37ffdcf9  0x521fe162  0xd0cf3655  0x0606283a
Output    0xa25cb233  0x0ffc881d  0x58fe4504  0x542863ec
        	
IV        0x01234567  0x89abcdef  0xfedcba98  0x76543210
M  00-03  0xb4471f81  0xf90b2af1  0xc06d5200  0x712812e3
M  04-07  0x6bdea90d  0x77be2e9d  0x165b9345  0x6983893f
M  08-11  0x06336cd5  0x81736205  0x8f68a747  0xd3c94d92
M  12-15  0x1b2e7702  0xe84d4915  0xc8cbe7c8  0xfa0ef739
M  16-19  0x22bc0f12  0x0465e9c9  0xefa461d4  0x9bcf0e26
M  20-23  0x17cbd50b  0x1c37af37  0x776ae540  0x80b1c54b
M  24-27  0x5df2efb5  0x47e27bb4  0xb3bc602e  0x1c69f883
M  28-31  0x323490f7  0x9ca7b969  0x4ac9202a  0xd7d687a0
M' 00-03  0xb4471f81  0xf90b2af1  0xc06d5200  0x712812e3
M' 04-07  0xebdea90d  0x77be2e9d  0x165b9345  0x6983893f
M' 08-11  0x06336cd5  0x81736205  0x8f68a747  0xd3c9cd92
M' 12-15  0x1b2e7702  0xe84d4915  0x48cbe7c8  0xfa0ef739
M' 16-19  0x22bc0f12  0x0465e9c9  0xefa461d4  0x9bcf0e26
M' 20-23  0x97cbd50b  0x1c37af37  0x776ae540  0x80b1c54b
M' 24-27  0x5df2efb5  0x47e27bb4  0xb3bc602e  0x1c697883
M' 28-31  0x323490f7  0x9ca7b969  0xcac9202a  0xd7d687a0
Output    0x7297ab80  0x48f91116  0x8750c05a  0xf5efea42

MD4 Collision Generation
Faster implementation of techniques described in Cryptanalysis for Hash Functions MD4 and RIPEMD, by Xiaoyun Wang, et al.

Average runtime on P4 1.6ghz: 5 seconds

IV        0x67452301  0xefcdab89  0x98badcfe  0x10325476
M  00-03  0x20747f65  0x62d719bd  0xd2229c4b  0x57f333e5
M  04-07  0x7f88bf6c  0xe66dd6f4  0x67ddcb5c  0x9fd01676
M  08-11  0xad509278  0x28bd9c15  0x19377325  0xc52a708a
M  12-15  0x8997cf8e  0xe06b03c0  0x44ef33cd  0xdc88c3ba
M' 00-03  0x20747f65  0xe2d719bd  0x42229c4b  0x57f333e5
M' 04-07  0x7f88bf6c  0xe66dd6f4  0x67ddcb5c  0x9fd01676
M' 08-11  0xad509278  0x28bd9c15  0x19377325  0xc52a708a
M' 12-15  0x8996cf8e  0xe06b03c0  0x44ef33cd  0xdc88c3ba
Output    0x592aba33  0xf1204f5a  0x2be8ef9b  0xb61d5450
        	
IV        0xaaaaaaaa  0xbbbbbbbb  0xcccccccc  0xdddddddd
M  00-03  0x2cb0477c  0xaab8b133  0x990142cd  0x1e489832
M  04-07  0xdaa64578  0x71df4a73  0x6c368a4a  0x0812dc17
M  08-11  0x281789fd  0xfc55eb57  0xcbb7c2b9  0x65b6ed43
M  12-15  0x916dd18c  0x8c5cdca7  0x0168eabd  0xd22051ff
M' 00-03  0x2cb0477c  0x2ab8b133  0x090142cd  0x1e489832
M' 04-07  0xdaa64578  0x71df4a73  0x6c368a4a  0x0812dc17
M' 08-11  0x281789fd  0xfc55eb57  0xcbb7c2b9  0x65b6ed43
M' 12-15  0x916cd18c  0x8c5cdca7  0x0168eabd  0xd22051ff
Output    0x3c8da0ad  0xe71f75b3  0x452339f7  0xbcce30e1
Resources

Projects and Tools
Publications
Conferences
Advisories

Copyright © 2008 Stach & Liu LLC
research_conferences.html0000664000000000000410000001267210750133465015403 0ustar rootwww-data Stach & Liu | Research | Conferences
Research
Conferences

Aug 9, 2007
Vincent Liu will present and participate on the Provider and Vendor - Implementation Lessons Learned panel at the SANS Application Security conference.

Oct 17-19, 2006
Led the consulting services roundtable discussion representing consulting services and participated as a panel member on the Industry Experts Panel for Application Security at SPICON 2006.

June 14, 2006
Presented anti-forensics techniques at the Arizona High Technology Crime Investigation Association (HTCIA).

May 3-6, 2006
Presented Defeating Forensic Analysis at the Computer and Enterprise Investigations Conference 2006.

April 3-5, 2006
Presented Bleeding-Edge Anti-Forensics at InfoSecWorld 2006.

October 13-14, 2005
Presented The Metasploit Anti-Forensics Project v2 at Microsoft BlueHat.

September 16-18, 2005
Presented The Metasploit Anti-Forensics Project at Toorcon 7.

July 27-28, 2005
Presented Catch Me If You Can at BlackHat 2005.

Resources

Projects and Tools
Publications
Conferences
Advisories

Copyright © 2008 Stach & Liu LLC
research.html0000664000000000000410000001101410750133466013017 0ustar rootwww-data Stach & Liu | Research
Research
Philosophy

Giving back to the security community is not only a founding principle at Stach & Liu but also a distinguishing feature of our practice. We are one of the few professional services firms that actively conduct cutting-edge research, and we leverage our extensive relationships within the security community to give us unique access to the latest threats, tools, and techniques. This in turn allows us to provide our clients with true insight into emerging risks, so that they are able to make the most informed decision to protect their corporate data and infrastructure.

Recognized as experts in the industry, Stach & Liu professionals present at the top security conferences, author leading security books, and contribute to popular open-source security tools. It gives us great pleasure to share our knowledge with other professionals, and we are happy to give back to the community that has given us so much.

Resources

Projects and Tools
Publications
Conferences
Advisories

Copyright © 2008 Stach & Liu LLC
research_projects_tools.html0000664000000000000410000001000410750133470016141 0ustar rootwww-data Stach & Liu | Research | Projects and Tools
Research
Projects and Tools

MD5 and MD4 Collision Generators
Patrick Stach releases groundbreaking code to create MD5 and MD4 collisions. This implementation improves upon the techniques originally developed by Xiaoyun Wang. Using a 1.6 GHz Pentium 4, MD5 collisions can be generated in an average of 45 minutes, and MD4 collisions can be generated in an average of 5 seconds.

Resources

Projects and Tools
Publications
Conferences
Advisories

Copyright © 2008 Stach & Liu LLC
research_publications.html0000740000175400000410000001463410750133471015751 0ustar jhayswww-data Stach & Liu | Research | Publications
Publications

Stach & Liu professionals have proudly contributed to the following security books:

AJAX Security
AJAX Security

Publisher: Addison Wesley Professional
Published: December 06, 2007
ISBN: 0321491939
Hacking Exposed Wireless
Hacking Exposed Wireless

Publisher: McGraw-Hill Osborne Media; 1st edition
Published: March 26, 2007
ISBN: 0072262583
Writing Security Tools and Exploits
Writing Security Tools and Exploits

Publisher: Syngress; 1st edition
Published: March 1, 2006
ISBN: 1597499978
Penetration Tester's Open Source Toolkit
Penetration Tester's Open Source Toolkit

Publisher: Syngress Publishing; 1st edition
Published: February 8, 2006
ISBN: 1597490210
Sockets, Shellcode, Porting, and Coding
Sockets, Shellcode, Porting, and Coding

Publisher: Syngress Publishing; 1st edition
Published: March 21, 2005
ISBN: 1597490059
Resources

Projects and Tools
Publications
 Conferences
Advisories

Copyright © 2008 Stach & Liu LLC
services.html0000664000000000000410000001310010750133557013045 0ustar rootwww-data Stach & Liu | Services
Services
What We Do

Businesses choose Stach & Liu because they consistently receive world-class service and exceptional value from a team of dedicated security professionals. By leveraging our in-depth business experience and unmatched technical expertise, our clients have been able to effect positive and continuous change within their organizations. The following list represents our core service offerings. For more information on our tailored services, please contact us here.


ASSESSMENT SERVICES
Infrastructure Assessments & Penetration Testing
Wireless Assessments & Penetration Testing
Web Application Assessments & Penetration Testing
Application Source Code Review

STRATEGIC ANALYSIS
Enterprise Infrastructure Security Planning
Application Security Strategy
Vendor Neutral Product Evaluations
Custom Consultation

REGULATORY COMPLIANCE
Compliance Driven Risk Assessment
Compliance Driven Product Evaluations

For additional information click here.

Why Stach & Liu?

For over a decade, Stach & Liu professionals have been authoring security books, publishing in leading journals, and presenting their research at security conferences around the world. We exclusively provide our clients with the best consultants available in the industry; junior staff does not exist at Stach & Liu. When you need Security You Trust, our team stands ready.

Copyright © 2008 Stach & Liu LLC
services_regulatory_compliance.html0000664000000000000410000001214310750133560017514 0ustar rootwww-data Stach & Liu | Services
Services
Regulatory Compliance

Over the past few years, the list of government and industry regulations that businesses must observe has increased in number and complexity. Companies seeking to operate in accordance with these regulations must now ensure the security of their client and customer data in addition to their own sensitive business information. Unfortunately, these requirements are often vague and result in misinterpretation, making it difficult for companies to meet these regulations.

Stach & Liu can help your organization navigate these regulatory requirements and achieve compliance. Our experienced professionals can assist you in identifying requirements gaps, provide expert remediation assistance, and work with your team to design an ongoing compliance strategy.

Stach & Liu's Compliance Practice covers the following regulations:

For business involved with health care: For business in the financial services industry: For business that deal with consumer credit card data:
Why Stach & Liu?

For over a decade, Stach & Liu professionals have been authoring security books, publishing in leading journals, and presenting their research at security conferences around the world. We exclusively provide our clients with the best consultants available in the industry; junior staff does not exist at Stach & Liu. When you need Security You Trust, our team stands ready.

Copyright © 2008 Stach & Liu LLC
training_hacking101.html0000664000000000000410000001133610750133324014744 0ustar rootwww-data Stach & Liu | Training | Hacking 101
Training
Hacking 101

Penetration testing is key component of the security life cycle. This course teaches IT professionals real-world hacking techniques that will enable them to locate and identify security weaknesses and critical vulnerabilities within their IT environment.

Course topics include:

  • Network Footprinting
  • Discovery and Enumeration
  • Microsoft Windows Enumeration and Attack Techniques
  • Unix Enumeration and Attack Techniques
  • Dial-up and Remote Access Attacks
  • Wireless Attacks
  • Web Application Attacks
  • Frequent exercises re-enforce learning of key concepts and tool usage
Sample Course Development

The following list is a selected sample of courses that we have developed for our clients in the past:

Security 101
Hacking 101
Wireless Security
Web Application Security
Malware Analysis

Copyright © 2008 Stach & Liu LLC
training.html0000664000000000000410000001162010750133325013033 0ustar rootwww-data Stach & Liu | Training
Training
Education

An intelligent, well-trained staff is one of the essential building blocks of a secure enterprise. Stach & Liu is committed to delivering first-class, hands-on training that will empower your employees and prepare them to face the threats in today's hostile digital environment.

Stach & Liu instructors are recognized experts in their fields, and have taught at prestigious academic institutions, the Fortune 500, and at security conferences worldwide. Selected venues include: BlackHat, Defcon, Microsoft BlueHat, Toorcon, Interz0ne, Kyoto University, and the University of Pennsylvania.

Stach & Liu’s approach to training calls for developing custom classes for each client’s particular training needs. Experience has taught us that tailored training allows our classes to cover a broader range of topics in greater detail. Students benefit from targeted training because it maximizes use of their time and increases knowledge retention.

Sample Course Development

The following list is a selected sample of courses that we have developed for our clients in the past:

Security 101
Hacking 101
Wireless Security
Web Application Security
Malware Analysis

Copyright © 2008 Stach & Liu LLC
training_malware_analysis.html0000664000000000000410000001135010750133325016446 0ustar rootwww-data Stach & Liu | Training | Malware Analysis
Training
Malware Analysis

The increase in sophistication and prevelance of malware such as Trojans and rootkits necessitates that forensic analysis and incident response teams continually adapt to these new threats. Students in this course will learn how to identify and analyze malicious files using behavioral and static techniques.

Course topics include:

  • Binary Fundamentals
  • Building a Test Environment
  • Final lab incorporates all topics covered throughout the class into a fun and educational capture-the-flag competition
  • Static Binary Analysis and Behavioral Analysis
  • Frequent exercises re-enforce learning of key concepts and tool usage
Sample Course Development

The following list is a selected sample of courses that we have developed for our clients in the past:

Security 101
Hacking 101
Wireless Security
Web Application Security
Malware Analysis

Copyright © 2008 Stach & Liu LLC
training_security101.html0000664000000000000410000001205110750133326015204 0ustar rootwww-data Stach & Liu | Training | Security 101
Training
Security 101

In order to build a truly secure enterprise, corporations must foster a culture in which security is the responsibility of each individual employee. This course will educate your IT professionals on the fundamental concepts of security and help them to better understand the different realms of threat and risk your company is facing.

Course topics include:

  • Security Fundamentals
  • The CIA Triad: Confidentiality, Integrity, and Availability
  • Authentication and Authorization
  • Encryption
  • Firewalls and Intrusion Detection Systems
  • Malware: Viruses, Trojans, Worms, Backdoors, Rootkits, Spyware
  • Hacking Basics
  • Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks
  • Network Based attacks: Sniffers, Man-in-the-Middle Attacks, Wireless Attacks
  • Application Based Attacks: Buffer Overflows, Input Validation, Design Errors
  • Social Engineering
Sample Course Development

The following list is a selected sample of courses that we have developed for our clients in the past:

Security 101
Hacking 101
Wireless Security
Web Application Security
Malware Analysis

Copyright © 2008 Stach & Liu LLC
training_web_application_security.html0000664000000000000410000001201310750133327020201 0ustar rootwww-data Stach & Liu | Training | Web Application Security
Training
Web Application Security

Web applications have become embedded in almost every aspect of modern business. We can conduct banking transactions, apply for loans, and purchase goods all on the World Wide Web. The price we pay for this modern marvel is the risk introduced by attaching complex web applications to sensitive data and then making them readily available to the world. This course will educate your IT professionals on the security risks associated with web applications and teach them how to identify and exploit web application vulnerabilities.

Course topics include:

  • Web Application Security Fundamentals
  • Authentication
  • Authorization
  • Session Management
  • Input Validation
  • Information Disclosure
  • Attacking Data Storage
  • Attacking Management Interfaces
  • Buffer Overflows
  • Denial of Service (DoS) Attacks
  • SQL Injection and Cross-site Scripting
Sample Course Development

The following list is a selected sample of courses that we have developed for our clients in the past:

Security 101
Hacking 101
Wireless Security
Web Application Security
Malware Analysis

Copyright © 2008 Stach & Liu LLC
training_wireless_security.html0000664000000000000410000001174210750133330016700 0ustar rootwww-data Stach & Liu | Training | Wireless Security
Training
Wireless Security

The rapid adoption of wireless technologies by businesses today is fundamentally changing network infrastructure. Tearing down the physical boundaries that once guarded our intellectual assets introduces a new breed of threat. This course will enable your IT professionals to identify attack vectors created by wireless technologies and better understand the security issues related to the diverse solutions and configurations of wireless implementations available today.

Course topics include:

  • Wireless Fundamentals
  • Protocol Descriptions
  • Hardware Considerations
  • Security Tools
  • Secure Configurations
  • Breaking Encryption and Attacking Management Interfaces
  • Device Hardening
  • Encryption Methods
  • Wireless Discovery and Enumeration
  • Bypassing Authentication and Authorization
Sample Course Development

The following list is a selected sample of courses that we have developed for our clients in the past:

Security 101
Hacking 101
Wireless Security
Web Application Security
Malware Analysis

Copyright © 2008 Stach & Liu LLC