Nick’s post yesterday showed just how easy it can be to get a user to give up a password. For most homes (and probably many small businesses), you don’t even need to go that far. Many device manufacturers have decided to sacrifice security for ease of use, specifically being able to plug in a device and have it “just work”. The worst example of this that comes to mind is the wireless router. More often than is reasonable, you can connect to someone’s network without any authentication and have your way with the internal network. Or, maybe you just want to engage in some questionable activities on the Internet. Perhaps, you can hijack their DNS records to make mybigbank.com point[…]
Author: Walt Turnes
One of the irritating problems I have to deal with as a developer is the fact that I don’t really get to make any decisions. Sure I can make design decisions regarding the implementation of code modules, but when it comes to post-deployment issues, especially regarding security, all I can do is make some suggestions to managers and hope for the best. For example, in the extremely unlikely event that I find a security hole in one of my impeccably designed modules, I can write up a summary of the bug, mitigating factors, risks, and level of effort it would take to fix it. But, it’s not really up to me whether it winds up getting fixed or not. A[…]
It’s a shame that “national security” has turned into such a divisive political issue. Politicians have a way of managing to argue in the absence of facts, as facts just don’t get voters excited quite like rhetoric does. Congressmen give bills names like the PATRIOT Act and the Protect America Act to make opposition look treasonous without having to explain why.
What’s the difference between the following strings: ldap://myserver.mycompany.com/ ldap://myserver.mycompany.com LDAP://myserver.mycompany.com/ LDAP://myserver.mycompany.com Give up? Several hours of debugging, that’s what. In the .NET world, the System.DirectoryServices namespace contains classes named DirectoryEntry and DirectorySearcher. To search an LDAP directory, you created a DirectoryEntry based on the server address and DN to specify the root of your search, and then create a DirectorySearcher, passing in the DirectoryEntry to the constructor. This can be used to search any ldap directory. So, you would think that you could pass in any valid LDAP URL into the DirectoryEntry class, right? Wrong. Microsoft’s implementation of the DirectoryServices namespace is build upon ADSI. So, the URL you’re passing in isn’t a typical URL at all. It’s based on[…]
Digital signatures are not a new concept in the security world. The process is fairly simple: take some data, apply a hash algorithm to it, encrypt the hash with a private key, and then store the resulting signature somewhere. Assuming you don’t have to implement the cryptographic algorithms (which you shouldn’t), the process is very easy. So, why is it so hard to do over the web? For one thing, most security libraries have made the problem too easy to tackle. Libraries such as CAPI for Windows, BouncyCastle for Java, and OpenSSL for C like to make creating digital signatures a one-function event. Pass in the data, certificate, key, and you get your PKCS7 signature block. This works great for[…]
I’m a senior engineer at Gemini Security Solutions. When I’m not waist-deep in an ASN encoding or the inner layers of a PDF stream, you can probably find me racking up wins at the company foosball table. I mainly work on the software side of PKI issues, such as enabling web applications for digital signatures and developing signature plug-ins for third party applications.