BlackHat USA 2010
Learning from the Best
I've been to BlackHat twice now, and both times I have taken the same lesson home: If you think things are getting better in the field of computer security, you're probably wrong. Over the years, progress has been made identifying bug types – currently the CWE lists 668 weaknesses in 120 categories – and some progress has been made with projects to identify and remove them systematically (e.g., OpenBSD has had remarkable success). However, you then come to the BlackHat conference and see a presentation like "HTTPS Can Byte Me," in which Robert Hansen and Josh Sokol disclosed 24 vulnerabilities (Figure 1) that can compromise the integrity and security of SSL-encrypted web traffic [2].
Figure 1: Final HTTPS slide – 24 issues in all.
The problem is not so much a failing within SSL, but unless you're taking extreme measures to protect network traffic against analysis (e.g., padding traffic out, introducing time delays, etc.), chances are, attackers will be able to glean information even if they can't read the traffic directly.
Also, consider the case of the well-meaning web browser that attempts to be helpful. I guess people hate typing in personal information, so almost all browsers support "auto-complete," which automatically fills out form fields (e.g., name,
...
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
-
Forensic Analysis on Linux
In computer forensics, memory analysis is becoming increasingly important as a means for investigating security incidents. In this article, we provide an overview of the various memory dumping options on Linux and introduce the support in Linux for the Volatility Analysis Framework.
- Zero Day Mac OS Kernel Flaw
-
If You Don't Like Security Guys, Call a Hacker
Many years ago on a school field trip to the local police station, I noticed a bumper sticker on a cop's cruiser that read: "If you don't like Cops, next time you're in trouble call a Hippie." - BlackBerry 10 Achieves FIPS Certification
-
What tools do intruders use to
Professional attackers have much more pointed at your site than just Nmap, and you should too if you want to test your network's security. We'll show you some tools intruders use to gather information.
Subscribe to our ADMIN Newsletters
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Most Popular
Support Our Work
ADMIN content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
