If you’re working with SSL (whether websites or otherwise), it sometimes helps to be able to send text and commands directly to the server, but it’s not as easy as just telnetting to the server like with non-SSL servers. That’s where s_client comes in. It’s part of the openSSL suite, so you’ll find it on all unix based systems, and can compile it on Windows based systems. s_client handles all of the SSL negotiation, with you controlling as much of the negotiation as you want. You can tell s_client what algorithms to “support”, and if the server will complete the negotiation, you know that the server supports that algorithm as well. This is useful to determine if a server supports[…]
Author: Laura Raderman
If you haven’t heard yet, Google has opened up their own public DNS servers. Many people I know would love to use them rather than their ISP’s DNS servers for various reasons – mostly due to lack of availability. I’ve been using OpenDNS’s resolvers for the last year or so now, so this service isn’t exactly new, neither is the free option as OpenDNS has one. So what does Google bring to the table from a security perspective? Google has a great document that they’ve created all about the security of their DNS service. Basically, they’re concerned about the availability (hence the overprovisioning), and the replay, birthday, and Kaminsky attacks. The only thing they might offer above and beyond your[…]
You may have heard about the latest SSL vulnerabilities over the last month, but how do they work and what does it mean to you (or your users)? When I earlier described how SSL works, I glossed over two SSL functions: session resumption and re-negotiation. These two functions allow a client or server to renegotiate an SSL connection if they decide they want to use new keys. Session resumption allows the client to use a previous session ID, and have this happen faster – without renegotiating new keying material. These optional protocols allow a man-in-the-middle (MITM) attack. The MITM gets authentication information from the client headers (through sniffing, DNS spoofing, etc.) and replays those to the server – asking for[…]
Over the past few days I attended the Techno Forensics 2009 conference held at NIST. It was free and I needed the CPEs, and it’s vaguely inline with what I do, so I went.
October is Cyber Security Awareness Month (among other things including Breast Cancer Awareness Month), so this post is going to help make you aware of how to learn about vulnerabilities and – more importantly – patches in the systems you manage. Vulnerabilities are found in several places – the first place you’re likely to find public disclosure of a vulnerability is the Full Disclosure mailing list. On the downside, it’s a very high noise to content ratio (i.e. there’s a *lot* of noise – probably 90-95% noise). The second place it’s likely to show up, and be more useful to you is in the bugtraq mailing list – this is because bugtraq is moderated. It has a much lower noise[…]
NIST recently released an overview report on the current state of research in security metrics (short story: there are almost none), and some areas where they feel more research is warranted. One of the problems with security as a business process is that managers are being taught process improvements is the way to save money, but with security, there are no obvious metrics to measure to improve the process. Security is subjective, based on the person and the situation, and measurements tend to the objective side of things. I think that seeing new measurements is really going to improve the overall security landscape – once they’re accepted and used. NIST and the Feds already kind of lead the way with[…]