TLS / SSLv3 renegotiation vulnerability explained - NEW update
| 0 comments ]

Subscribe to the RSS feed in case you are interested in updates

I updated the whitepaper "TLS / SSLv3 vulnerability explained" :

Updated 18.11.2009 : Added SMTP over TLS attack scenario, added s_client testcase
Updated 30.11.2009 : Added FTPS analysis, new attacks against HTTPS (injecting responses and downgrading to HTTP)  




New SSLv3 / TLS vulnerability - MITM attacks possible
| 0 comments ]

Subscribe to the RSS feed in case you are interested in updates


In order to allow me to update in a more convenient manner, the latest updates will be added to the G-SEC blog only. Once the final revision of this blog post will be achieved I will update this blog with the latest one.

  • Updated 17:50 GMT+1 / 05.2009 - added Mitigation / Impact 
  • Updated 16:40 GMT+1 / 06.2009 - added IETF draft 
  • Updated 14:35 GMT+1 / 07.2009 - added SSLTLS Test Tool 
  • Updated 16:34 GMT+1 / 07.2009 - added OpenSSL patch 
  • Updated 13:00 GMT+1 / 09.2009 - added GNUTLS patch 
  • Updated 19:40 GMT+1 / 09.2009 - added Mikestoolbox.net testing TLS renegotiation support 
  • Updated 21:29 GMT+1 / 09.2009 - added Apache patch, Mozilla Bug ID, Redhat Bug ID, Mozilla patch disabling tls renegotiation, Tomcat mitigation 
  • Updated 21:00 GMT+1 / 12.2009 - added a whitepaper trying to explain the vulnerability and it's implications to a broader audience


After some in-house tests, we can confirm that the vulnerability presented at http://www.extendedsubset.com/ indeed real and should pose a significant threat to most. The vulnerability has been discovered by "Marsh Ray".

We are currently looking into possible mitigations and will update this blog post regularly with more information regarding said vulnerability - if available.

Details
Patches
  • OpenSSL 0.9.81 ( Attention: OpenSSL removed the TLS/SSL renegotiation feature from this package - you need to test application before/after updating to this version ) (via ISC)
  • GnuTLS patch (implements a new TLS extension proposed in the IETF Draft) (via SID)
  • Apache patch (patches renogtiation prefix attacks at the application layer, still need openssl fixes for other attacks)
Impacts :
Currently known to exist
  • In general an attacker positioned in the middle of a connection may inject arbritary content into the beginning of an authenticated strea, it will be interesting to see what potential impact this vulnerability has within each of the applications / protocols supporting it. IMAPS, FTPSSL, POP3 etc
  • For web servers - Attackers (if in the middle) can inject data into a segment that is authenticated to the web server, the web server will merge those requests and process them. (GET requests are trivially exploitable, POST are not known to be)
Mitigations :
  • Monitor renegotiation requests
  • To mitigate possible attacks against web applications - use an IPS/IDS/Application firewall to catch recurrent HTTP request that are enclosed within each other











Computer Associates multiple products - RCE
| 0 comments ]



Subscribe to the RSS feed in case you are interested in updates


I released another advisory today, the affected products are from Computer Associates who I'd like to thank for the cooperation and feedback.

I published the advisory @G-SEC




Derren Brown guessed the lottery numbers - afterwards
| 0 comments ]


Subscribe to the RSS feed in case you are interested in updates


Derren Brown, the NLP master and magician  "predicted" the Lotterie numbers Live on TV and promised to tell on Friday how he did it - well he didn't really. The explanations on Friday is obviously not very convincing. He claimed to have used the phenomenon called "Crowd wisdom" whereas a group of poeple, taking the average often guess correctly. Right.

Daren Brown predicting the Lottery




The "ball" that gave it away
<


Simulation of the trick



Real NLP trickery



You get what you pay for
| 0 comments ]

Subscribe to the RSS feed in case you are interested in updates

On a more non-technical note, I stumbled across this offer from a "renowed luxemburgish recruitment agency." I am not sure what part of this job opening is the worst, that they actually publish such a bad written job opening or that the candidates will be judged by the person that wrote this opening. Apparently they are being paid to do so.

Disclaimer: The text has been shortened but not edited.







Did you get the "our aim is to keep the highest standards in terms of quality" - They sure succeeded with this job posting.

Original: http://www.iitjobs.com/candidates/ShowJobDetails.aspx?jid=137014