Software Security: a retrospective

Today I am going to cover a topic that is the most important to me: software security. When I talk about "software security", I refer to the process of building applications -- the artifacts, components, and capital that goes into making a polished [...]

Posted by Dre on Thursday, May 29, 2008 in Code, Defense and Security.

VBAAC Security and You

My good friend Arshan Dabirsiaghi at Aspect Security released an interesting paper today on Bypassing VBAAC with HTTP Verb Tampering. For those who don't know what VBAAC is, it stands for "Verb-Based Authentication Access Control." Unfortunately, most [...]

Posted by Marcin on Wednesday, May 28, 2008 in News and Security.

tissynbe.py -- Insert Nessus results into MySQL, output as a CSV

I mentioned in previous posts that I had been working with Nessus -- I used it a lot. At the end of the engagement, we had almost a gigabyte of Nessus data saved in nbe format. So to quickly go through and analyze all the results, inserting it into a [...]

Posted by Marcin on Friday, May 23, 2008 in Code and Security.

Protecting the global Internet routing infrastructure

Arbor Networks has a blog post up today about Using RPKI to Construct Validated IRR Data. Resource PKI (RPKI) is an extension to X.509 to allow for IP address (prefix) and AS identifiers (autonomous system numbers -- the organization-based assigned [...]

Posted by Dre on Wednesday, May 7, 2008 in Defense and Security.

Resident scripts and global cross-domain

In October of 2006, a vulnerability in IE7 known as the "mhtml:" Redirection Information Disclosure was discovered. RSnake wrote up a post about how nasty it was. The basics: it took over the entire browser experience. Fortunately, the bug was patched [...]

Posted by Dre on Wednesday, May 7, 2008 in Conferences, Hacking, Privacy and Security.

Lucky for NSM -- Extracting files from TFTP packets in Wireshark

So the other day I get a call from the forensics team at work asking for help with some packet analysis. A client's users had reported phishing activity, so they decided to run a full-content capture using Wireshark on the external and internal network [...]

Posted by Marcin on Monday, May 5, 2008 in Security and Work.

Another new blog over at NSS Labs

Not to be outdone by Neohapsis Labs, NSS Labs also enters the fray with their blog, Security Product Testing. Again, I think that NSS Labs (like Neohapsis Labs) has been blogging for awhile, but it has picked up more pace lately. In the past, the TS/SCI [...]

Posted by Dre on Monday, May 5, 2008 in News, Privacy and Security.