royans

How fast is an security patch converted into an exploit ?  F-secure's  @ TimoHirvonen  did a study and came with this example to document a time-to-exploit timeline.   •  2012-08-14: Security update available for Adode Flash player, patches vulnerability CVE-2012-1535.      ( Security update available for Adobe Flash Player )   â€¢  2012-08-15: Microsoft Office Word documents with embedded Flash exploit for CVE-2012-1535 seen in the wild.      ( CVE-2012-1535: Adobe Flash being exploited in the wild ,  CVE-2012-1535 - 7 samples and info )   â€¢  2012-08-17: Exploit is added to Metasploit Framework — a public, open-source tool for developing and executing exploits.      ( Adobe Flash Player Exploit CVE-2012-1535 Now Available for Metasploit ) Took just one day for it to be converted into an exploit. In other words, it is not enough to release a patch. What matters now is how fast can all the clients can be updated after a patch is released.

In the browser world, Java and Adobe look very similar. Not only are they similar in the kind of stuff they allow embedded applets/flash_Code to do, but also in the way its exploited to get out of the security container which anonymous code should never be able to do. So here are couple of interesting news items you should know more about... Adobe revokes certificates : Some tools found in the wild were found to be signed with Adobe's signature which should have never leaked Adobe's infrastructure. Adobe had no option but to initiate the process to revoke the impacted signatures and are conducting forensics to understand what really happened and what else is exposed. More Java holes reported :   A number of readers alerted ISC of news reports stating that new "full sandbox escape" vulnerabilities had been reported to Oracle. At this point, there are no details available as to the nature of these vulnerabilities, and there is no evidence that any of these vulnerabiliti

If you had asked me a few years ago about how should a website owner protect a login page, I'd probably have said that they should make sure credentials are never sent over unencrpted channel. Now thanks to a little more knowledge and a few 'duh' moments I've come to realize that there is one another aspect of login page which goes un-noticed. While most websites today do enforce that credentials are sent over HTTPS, they do not verify that the login page itself is not in the clear. In fact many of them have a "login/password" form in the clean on many unencrypted pages. For those who understand the risk of javascript injection can tell you as a matter of fact that the forms can be modified by a MiTM (man in the middle) device to do lots of interesting things... including, sending your password to an attackers server. Hence getting the password over encrypted channel wouldn't protect much. A key point to note here is that this requires an active attack on

Its been a while since I last played with snort and even longer since I touched tripwire which was at one point the most popular host based intrusion detection tool out there. A lot has changed since then. From a quick glance at the various tools I found below, its clear that just alerting based on signatures isn't enough. This is not surprising since I can see how lot of false positives can lead to a configuration which could produce false negatives. Whats needed is a set of tools which can help investigate false positives quickly using visual notification or automated secondary scripts which could pull data from various sources to put a confidence number on each alert. Security onion  - Security Onion is a Linux distro for IDS (Intrusion Detection) and NSM (Network Security Monitoring). It's based on Xubuntu 10.04 and contains Snort, Suricata, Sguil, Squert, Snorby, Bro, NetworkMiner, Xplico, and many other security tools. The easy-to-use Setup wizard allows you to build an

Honeymap is  a real-time world map which visualizes attacks captured by honeypots of the  Honeynet Project . Red markers on the map represent attackers, yellow markers are targets (honeypot sensors). Not terribly useful in its current form, but a very interesting way to watch attacks to see if infected systems for a particular type of attack is geo-specific.

If you had asked me a few years ago about how should a website owner protect a login page, I'd probably have said that they should make sure credentials are never sent over unencrpted channel. Now thanks to a little more knowledge and a few 'duh' moments I've come to realize that there is one another aspect of login page which goes un-noticed. While most websites today do enforce that credentials are sent over HTTPS, they do not verify that the login page itself is not in the clear. In fact many of them have a "login/password" form in the clean on many unencrypted pages. For those who understand the risk of javascript injection can tell you as a matter of fact that the forms can be modified by a MiTM (man in the middle) device to do lots of interesting things... including, sending your password to an attackers server. Hence getting the password over encrypted channel wouldn't protect much. A key point to note here is that this requires an active attack on

Its been a while since I last played with snort and even longer since I touched tripwire which was at one point the most popular host based intrusion detection tool out there. A lot has changed since then. From a quick glance at the various tools I found below, its clear that just alerting based on signatures isn't enough. This is not surprising since I can see how lot of false positives can lead to a configuration which could produce false negatives. Whats needed is a set of tools which can help investigate false positives quickly using visual notification or automated secondary scripts which could pull data from various sources to put a confidence number on each alert. Security onion  - Security Onion is a Linux distro for IDS (Intrusion Detection) and NSM (Network Security Monitoring). It's based on Xubuntu 10.04 and contains Snort, Suricata, Sguil, Squert, Snorby, Bro, NetworkMiner, Xplico, and many other security tools. The easy-to-use Setup wizard allows you to build an

A lot of people shared this, so shouldn't be a surprise to most of you. But it seems like a good post to start this new blog with. Alice and bob are key figures in most talks about cryptography. Here is a proposal to change it Ram and Sita from the Hindu mythology . Thanks to Jerry for sharing.

A lot of people shared this, so shouldn't be a surprise to most of you. But it seems like a good post to start this new blog with. Alice and bob are key figures in most talks about cryptography. Here is a proposal to change it Ram and Sita from the Hindu mythology . Thanks to Jerry for sharing.