Initial Ideas on How to Detect a Rogue CA Cert

Based on Verisign's response here and here (in the comments), they have prevented future attacks, but seem to find the undermining of their PKI for the next several years an acceptable risk versus revoking thousands of certificates at great expense. However, Tim did mention that if they can find a unique characteristic of the bad certs, that would help, here's my attempt.

Continue reading "Initial Ideas on How to Detect a Rogue CA Cert"

Wednesday, December 31. 2008
Posted by Dominic White in Security
Comments (0) | Trackbacks (0)

Using MD5 Collision to Create a Fake CA Certificate

The presentation by Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik and Benne de Weger is done. ~~I am busy reading up on it and will post a summary and my thoughts here a bit later. Those are happening real-time on my twitter feed or on the right panel of my blog.~~

There's already a lot of coverage on this. I'm going to dig into laying blame, and potential geeky solutions for the end user.

Continue reading "Using MD5 Collision to Create a Fake CA Certificate"

Tuesday, December 30. 2008
Posted by Dominic White in Security
Comments (0) | Trackbacks (0)

Brand Plagiarism?

While taking my drugs this evening I noticed something interesting; vs. . Is this rampant plagiarism? If so, somebody at SensePost better sue the arse off those Schering guys ;)

Continue reading "Brand Plagiarism?"

Monday, December 29. 2008
Posted by Dominic White in Play
Comments (0) | Trackbacks (0)

OpenVAS & Metasploit

hdm just posted a graphic on his twitter feed of an OpenVAS client talking to a Metasploit server. This is pretty cool, and the possibility of integrating ~~Nessus~~ OpenVAS at the ~~NASL~~ NVT level (assuming that's what's happening) gives a good reason for greater adoption of the OpenVAS project.

Sunday, December 28. 2008
Posted by Dominic White in Security
Comments (0) | Trackbacks (0)

DLP, Users and Workflows

Jock (welcome to the blogging world) and Allen have responded to my last entry on Data Loss/Leak Prevention (DLP) vendors partnering with Digital Right Management (DRM) vendors. Jock had an interesting point about getting users involved via DRM, and Allen had some ideas around maturing DLP processes. I'm not sure I fully agree with Jock's ideas, although they do point to some important points that Allen and I agree on about workflows (but not that DLP is dead ;) ).

Continue reading "DLP, Users and Workflows"

Wednesday, December 10. 2008
Posted by Dominic White in Security
Comment (1) | Trackbacks (0)

DLP Vendors Partnering with DRM Vendors

First RSA with Microsoft, then McAfee with Liquid Machines. It makes sense, especially for companies wanting to get proactive about preventing data loss. Although, what DRM (Digital Rights Management)/ERM (Enterprise Rights Management) doesn't have that DLP (Data Loss/Leak Prevention) does is the simplicity. It relies on user's pro-actively protecting their data, something we know we aren't good at. Sure, the DLP solution is there for when they don't, but then what's the point of the ERM solution? I'm playing devil's advocate a bit here, and am not committed to that position. It is interesting to note that there hasn't been much partnership between DLP vendors and other 'data focused' security products such as database activity monitoring (DAM) or data backup vendors and only limited partnership with encryption solutions. ERM seems to fit well from a marketing point of view, but I think there are some key integration points between the other solutions that can provide an easier security onion (aka defense in depth).

Thursday, December 4. 2008
Posted by Dominic White in Security
Comment (1) | Trackback (1)

Lenovo T400 HSDPA (Ericsson f3507g) on Ubuntu Intrepid 8.10

I needed to get this working, and things didn't work out the box. Here's how to do it.

Continue reading "Lenovo T400 HSDPA (Ericsson f3507g) on Ubuntu Intrepid 8.10"

Thursday, December 4. 2008
Posted by Dominic White in Geek
Comments (4) | Trackback (1)

Corporate OSS - Aventail VPN on Ubuntu

I've decided I'm sick of Windows. I used to use Linux as my primary OS with no Windows, but since joining the corporate world, especially in South Africa, I've been forced into using Windows against my will.

This is for various reasons, and despite my many attempts over three years. There were lots of little battles along the way, like driver support for the laptop I was using etc. Those have mostly been won. However, there are some big battles left, and I plan on tackling them. This is the first of my 'Corporate OSS' entries, where I will document my solutions to these problems, if they exist.

First on the menu is connecting to the network believe it or not.

Continue reading "Corporate OSS - Aventail VPN on Ubuntu"

Thursday, December 4. 2008
Posted by Dominic White in Geek
Comments (5) | Trackbacks (0)

Compiling 32bit apps on a 64bit Ubuntu

I've just installed my first 64bit OS in the form of Ubuntu's Intrepid 8.10. However, I ran into some problems trying to get my SSL VPN up and running (but that's another story). I ended up needing newer versions of libssl and libcrypto. However, OpenSSL's configure scripts didn't want to believe me when I asked it nicely to make 32bit version. After struggling with various arch, target and -m32 settings, but having 64bit headers still included in the resulting Makefile; I eventually found this blog entry, which pointed me to the helpful 'linux32' app, which is part of the util-linux package. It creates a shell which wraps calls to uname to make it look as though you're on a 32bit architecture. Problem solved.

Thursday, December 4. 2008
Posted by Dominic White in Geek
Comments (0) | Trackback (1)

27 Dinner Tonight

Tonight's 27 dinner was great. I haven't been in a while, but there was a good crowd and I had some really interesting conversation. My presentation went well it seems. I've attached a copy here if anyone is interested.

Continue reading "27 Dinner Tonight"

Sunday, November 23. 2008
Posted by Dominic White in Security
Comments (6) | Trackbacks (0)

SOA is a Concept, not a Goal

I like the idea of a Service Oriented Architecture; all of your applications reorganised as re-usable and generically consumable services ushering in a new capability to mash-up services across your organisation, aligned to business processes rather than application architectures. I just don't think it will happen.

Continue reading "SOA is a Concept, not a Goal"

Tuesday, November 18. 2008
Posted by Dominic White in Geek
Comments (4) | Trackbacks (0)

German Gov says Google is the Devil; SRWare performs exorcism

My tin foil, now covered in joyous spittle, reflects the news that I'm not crazy (and neither is the EFF or Tom). In reaction, SRWare provides Iron, which according to downloadsquad had none of the privacy invading evil zombies the German Federal Office for Information Security warned us about (you'll notice the warning is similar to mine, take *that* persistent GoogleUpdate process). If you really need another browser and aren't happy with the one, use Iron instead of Chrome at least.

Continue reading "German Gov says Google is the Devil; SRWare performs exorcism"

Wednesday, September 24. 2008
Posted by Dominic White in Security
Comments (7) | Trackbacks (0)

Privacy Enhancing Techniques

Ritasha Jethva, our Privacy & Data Protection competency lead added some nice tips to a publicity piece that made it otherwise more useful than it would have been. I'm republishing them here along with some other stuff I've found of late.

Continue reading "Privacy Enhancing Techniques"

Monday, September 15. 2008
Posted by Dominic White in Privacy
Comments (0) | Trackbacks (0)

CISSP Networks & Telecomms Domain Presentation

Here's a set of training slides I put together for the CISSP networks & telecomms (domain 7) component. I'm using these to present to the InfoSec Group of Africa CISSP study group. I'm not a CISSP, but I know networks. While half the content is mine, the other half is stolen from many many places. It was all done in a hurry too. If you can improve them and promise to send changes back, I'll send you the source.

Wednesday, September 10. 2008
Posted by Dominic White in Security
Comments (5) | Trackbacks (0)

My Thoughts on Google's Chrome

First, let me preface this by saying I don't trust Google at all. Their entire business model is based on violating my privacy and for a security & privacy person who wears more tinfoil than most, this irks me. Google irks me to the extent that I have a separate Firefox profile just for the odd Google thing I may do, and I use Scroogle to deliberately anonymise my searches with the big eye. Why the rest of the world gets up in arms about warrantless wire-tapping by AT&T, and not explicit tapping on an arguably more important/sensitive medium confuses me. Imagine if your telco said they would give you a free phone line, but in exchange they would monitor all your calls and periodically have a telemarketer phone with offers you may be interested in? Beyond the irritation, the privacy outrage may even get the EFF's attention.

Continue reading "My Thoughts on Google's Chrome"

Wednesday, September 3. 2008
Posted by Dominic White in Security
Comments (9) | Trackback (1)

« previous page (Page 9 of 15, totaling 212 entries) next page »

.tHE pRODUCT - Security & Privacy Blog