If you haven’t heard of Firesheep yet, I’ll let you go read those details for a bit. When you come back, I want to talk about why SSL is generally not used in these situations – the title gives a hint – it’s all about economics. SSL is still quite expensive in terms of computing power. Sure, not for your computer when you’re browsing, but for a server which is handling thousands if not millions of requests per second? That’s a lot of the CPU (and RAM) being dedicated to just SSL, not counting whatever service the server is providing. There are hardware SSL accelerators, but they are also fairly limited: this one claims up to 14,000 transactions per second.[…]
Author: Laura Raderman
Pen-testing as a job is quite boring compared to learning it or doing it for fun. Why is that? You have to be meticulous about logging every packet that goes between your machine and your client’s. You have to keep logs of everything you’ve tried and what worked and what didn’t. So, when the client comes back and says you crashed their servers, you can show them why/how you crashed them, or you can show that you weren’t doing anything that should have crashed their servers (aka, their servers are broke). You can also use those logs to find things that didn’t stick out at you initially. When you’re doing it for fun, you don’t have to worry about this[…]
Fuzzing is a fairly recent term for what pen testers (and testers in general) have been doing for years – feeding invalid data to a program/web page/etc and seeing what happens. When you wrote your first C program that had to take command line arguments – did you ever mash on the keyboard and see what happens? You were fuzzing even if you didn’t know it at the time. The old Christmas tree packet in networking was a sort of fuzzing. Fuzzing can get kinda boring though, so there are several tools that will help you with it. They work on various kinds of inputs – some are for networks, some are for web pages, some are for the HTTP[…]
HP announced this morning that it would buy ArcSight. This follows Intel’s acquisition of McAfee last month. This isn’t the first time a large computer maker/systems offering has purchased a security company, but what does it mean for our industry? Will it mean that McAfee will only run on Intel computers (not that there are many others..)? Or that ArcSight will only be available on HP systems? Or will the companies operate fairly independently and we won’t see much in the way of changes for consumers (and businesses)? I’m really hoping that the industry stays fairly open, allowing cross-platform interoperability between systems and products. It allows customers to select the best non-security system for their needs, and then allow them[…]
Recently, Vinay Deolalikar self-published a proof that P is not equal to NP. So what does that mean exactly? P is short for Polynomial, and NP is short for Non-deterministic Polynomial. To understand the exact difference requires you to understand Turing machines (usually a senior level CS class). P is the class of problems that can be solved in polynomial time on a deterministic Turing machine in polynomial time, and NP is the class that can be solved on a non-deterministic Turing machine in polynomial time. Here’s the catch: so far, no non-deterministic Turing machines exist. There’s speculation that quantum computers are non-deterministic Turing machines, but not a proof that I know of. Another way of thinking about P and[…]
With a new version of Backtrack around, many people may be ready to take the plunge into learning it. This is a little late for those of you who decided to try it at Blackhat/Defcon, but ShmooCon will be coming up in a few months… Apt is the debian packaging system. It’s found in all debian based Linux distros – like K/Ubuntu and Backtrack. If you’re going to be at a hacker conference, the least you can do is update your system before you go! Packages are generally GPG signed by the maintainer, and debian keeps a list of trusted GPG keys updated on your system (debian-keyring debian-archive-keyring are the debian specific packages). Apt checks these signatures to help ensure[…]