SecurityFeed.info » Strike Center

« Expand/Collapse

Strike Center (10 unread)

May 16, 2008
0:34
StrikePack 26944 Released
» ‎ Strike Center

StrikePack 26944 is now available to BreakingPoint customers. This StrikePack adds ten new strikes to the tree. One strike was moved to the correct strike group, and improved for correctness.
May 09, 2008
17:54
StrikePack 26760 Released
» ‎ Strike Center

StrikePack 26760 is now available to BreakingPoint customers. This StrikePack adds three strikes, and improves one existing strike.
May 01, 2008
18:46
StrikePack 26404 Released
» ‎ Strike Center

StrikePack 26404 is now available to BreakingPoint customers. This StrikePack adds four new strikes.
April 30, 2008
19:05
CSI-SX 2008
» ‎ Strike Center

CSI-SX is the new branding for the CSI NetSec conference, which is co-located with Interop Las Vegas, and is essentially the security-focused portion of the overall conference. As with the annual CSI conference, this conference targets a different demographic than I'm used to speaking for as the attendance is usually comprised of very large enterprise and government employees and I usually speak for conferences targeted at the research and hacker communities.

The night before the first day of conference sessions a speaker reception was held which I attended. I met a number of people from the conference staff whom I had not met before as well as a few of the other speakers. Surprisingly I was well-received by this crowd, even with my spiked green hair, which I'm sure they don't see a lot of at this type of conference.

For my thoughts on the various presentations and talks that I saw, please click through to my Personal Blog.
April 24, 2008
0:20
StrikePack 26037 Released
» ‎ Strike Center

StrikePack 26037 is now available to BreakingPoint customers. This StrikePack adds sixteen strikes. The added strikes contain coverage for CVEs listed in Sans Top 20 2007 list.
April 22, 2008
22:27
ToorCon Seattle 2008
» ‎ Strike Center

The ToorCon organization puts on some of the best conferences in my opinion, and this last weekend was version 1.0 of their Seattle conference (beta was last year, which I also attended). Friday night was entirely 5-minute lightning talks and then Saturday was entirely 20-minute turbo talks. Sunday was workshops, which unfortunately I could not attend since I had to fly back to Austin mid-day. Last year was invite only and if you were there last year you received a coupon code for a discounted rate this year ($300), otherwise it was a little expensive to attend ($1000). Overall there were a number of excellent speakers with excellent content.

For my thoughts on the various presentations and talks that I saw, please click through to my Personal Blog.
April 19, 2008
0:19
StrikePack 25803 Released
» ‎ Strike Center

StrikePack 25803 is now available to BreakingPoint customers. This StrikePack adds ten new strikes, including coverage for the GDI stack overflow bug that was addressed by Microsoft in MS08-021.
April 14, 2008
18:59
Adobe Flash Security Update
» ‎ Strike Center

The latest update for Adobe Flash fixes a handful of security flaws. However, this update also changes how the cross-domain socket policy is enforced. The result is that many Flash applications (such the BPS-1K and BPS-10K user interface) will no longer be able to connect to a socket on the originating host. The BPS development team is hard at work on a fix for the UI, but until the StrikePack containing the fix is available, we are urging our customers to hold off on the Flash upgrade on at least one system. If you have already upgraded to the latest version of Flash and need to downgrade, please see the Archived Flash Players page on Adobe's web site. Our support staff are available to assist customers with this process (1-866-352-6691 prompt 4).
April 12, 2008
1:16
StrikePack 25482 Released
» ‎ Strike Center

StrikePack 25482 is now available to BreakingPoint customers. This StrikePack adds 16 new strikes, improves no existing strikes, and removes no strikes. This StrikePack also adds support in Appsim for the unix time and daytime protocols.
April 04, 2008
22:51
More Musings on Oracle
» ‎ Strike Center

Hi, I'm Tod Beardsley. You might remember me from other blogs such as DVLabs and Plan B Security, but now I'm here in the StrikeCenter. It's a fun gig that's about as close to "R&D" as I've gotten -- so far, it's almost exactly half research, half development.
For me, most of the research part so far has been figuring out how Oracle authentication works. If you've ever looked at the Oracle dissector for Wireshark, you've noticed it's pretty sparse. Apparently there are about four people outside of Oracle who do any work at all on the wire protocol, and the guy who wrote a custom parser isn't saying much due to "security factors." This is not surprising, because Oracle's authentication sequence takes forever, with a bunch of pre-authenticated data flying around before access is granted. The sequence goes something like this:
(Client) "Hey Oracle, can I see your database?"
(Server) "What?"
"Your database. Give it to me."
"Oh, sure."
"Great. Here's some encrypted and encoded data."
"Cool, I have some too. Here you go."
"Oh, and I'm a Windows PC."
"I'm a Linux server! We have so much in common!"
"Hmmm."
"Yes...."
"Did you want my machine name? Or my process ID's?"
"Yes, that's what I was waiting for. Here's a session key."
"Oh, okay. I'll use that to encrypt my password. By the way, here's a bunch more info about me."
"Your password? Oh yeah, I haven't authenticated you yet. Just a second."
...and so on.
Now, why there's so much traffic between an unauthenticated client and a expensive enterprise-class server is beyond me; Microsoft SQL Server is a very normal and straight-forward exchange of "Access please, here's my username and password." "Sure thing buddy!" But what do I know, I've never written an unbreakable database server, so all this extra cruft must make it extra secure, somehow.

← HP ASC Portal Sunbelt Blog →

SecurityFeed.info » Strike Center

Feeds

Strike Center (10 unread)