13620 items (0 unread) in 75 feeds
Watchfire Application Security Insider
sirdarckcat
Google Online Security Blog
Switch/Twitch
mybeNi websecurity
cat slave diary
Alex's Corner
Billy (BK) Rios
Chris Shiflett
christian's weblog
GNUCITIZEN
The Spanner
hackademix.net
Ruby on Rails Security Project
It's a shampoo world anyway
ha.ckers.org web application security lab
Yet Another Infosec Blog
PHP Security Blog
Sunnet Beskerming Security Advisories
Disenchant's Blog
Sylvan von Stuppe
Larholm.com
Jeremiah Grossman
Anurag Agarwal - Application Security Evangelist
Ivan Ristic
omg.wtf.bbq.
Tactical Web Application Security
.:Computer Defense:.
tssci security
Plynt Penetration Testing Blog
Security Retentive
Schneier on Security
Rational Survivability
terminal23
1 Raindrop
hiredhacker.com
Matasano Chargen
Michael on Security - Musings on Information Security
Fortify blog
GDS Security Blog
Vodun.org
Mark Curphey - SecurityBuddha.com
Liminal states
Security Ripcord
IBM Internet Security Systems Frequency X Blog
extern blog SensePost;
Zero in a bit
Our BlackHat 2009 Whitepaper is now available here. Here we discuss the details of the stuff we are presenting, including the ATL vulnerabilities and Killbit bypass. We also discuss some vulnerability classes that are unique to interoperability layers - primarily type confusion and object retention.
Hope to see some of you in the talk!
David Dewey, Ryan Smith, and myself are speaking at the upcoming BlackHat conference on Attacking Interoperability. I have written an overview of what our speech is going to contain and it is available on the ISS blog here.
Two weeks ago I spoke at PacSec on browser exploitation in Vista. Although it was based on the talk Alex and I gave at BlackHat, there was some new material in this talk and a slightly different focus. Specifically, I targeted web languages (in particularly .NET and Java), and the implications these languages have on memory corruption-style exploits. Some of the topics covered include “Virtual Shellcode” (writing shellcode in a language such as Java rather than native code in order to bypass DEP), statically located DLLs in web pages (we covered this at blackhat), and overwriting native stubs in .NET. The slides are now available here for anyone who is interested.
Hi,
The link for the slides did not work in the last post, so for those interested - you can get the slides here.
Hi there,
Alex Sotirov and I are presenting at BlackHat USA today on bypassing the Windows Vista memory protections in the context of the web browser in a speech titled “How to Impress Girls with Browser Memory Protection Bypasses”. Specifically, we will be discussing how rich browser functionality can be utilized to help lessen the impact of memory protections (and in some cases, completely negate them). Some of the techniques we will be discussing are known ones, whereas others are new approaches that we haven’t seen discussed in public forums before.
We have written an extensive paper documenting how the various memory protections function, and how to break them. The paper that accompanies the speech is available here (we also have slides and code available). Some of the more interesting topic areas we will be covering include:
- “Stack Spraying”, an alternative method to heap spraying with some additional benefits
- Exploiting poor permissions, such as Java’s RWX memory allocator, and
- Utilizing .NET binaries to map data at an attacker-controlled memory location with arbitrary page protections applied to that data.
Finally, we did some field testing and found that this kind of research does occasionally impress girls, but ongoing research in this area is needed. Therefore, Alex and I will continue this research, starting right here in Vegas. :)
I had intended to post a blog entry here concerning the MJPEG disclosure in the recent MS drop. This is basically one of the bugs John and I were alluding to at CanSecWest earlier this year when discussing vulnerabilities in Windows media software. However, one of the joys of working for an employer with a blog is that I have to contribute to it as well as this one. So, rather than repeat the same post twice, I will redirect you to my post on ISSs blog: http://blogs.iss.net/. (It is currently the second post from the top.)
I know the blog has been fairly quiet lately, but as you can see, I’ve been busy doing some Internet research.
Hey there,
As we mentioned a while ago on this blog, John and I presented at CansecWest on finding vulnerabilities in Windows media software. We have uploaded the slides now to our website, and you can download them here.
Adobe released a patch recently for the Flash Player application that addresses several vulnerabilities, one of which I discovered. Although it initially seemed like the ability to exploit this bug was fairly limited, I found an interesting methodology that I was able to use to reliably exploit the bug. I have documented the details of it for interested readers here.
Enjoy!
Hi there,
As Justin indicated in his last post, he and I will be delivering a “dojo” class on finding vulnerabilities in contemporary C/C++-based applications. We have really tried to focus on delivering fresh and interesting material on the subject, rather than just regurgitating the same old stuff you have heard 100 times before (although, admittedly, some of that stuff is necessary). Our goal is to create a class that will examine not only vulnerability classes, but the processes that you need to follow to find those spicy 0day bugs. The stuff I have put in has proven successful for me, and hopefully will give attendees insight into the practical application of vulnerability knowledge on high-value targets.
In other news, I am also giving a talk at CansecWest with John McDonald on Windows Media stuff. Here, we are going to discuss the various media architectures prevalent on Windows OSs for developing both filters (codecs) and playback software. After touching on the architecture, we will discuss enumeration of attack surface and how to go about auditing media-based software (codecs in particularly) for vulnerabilities. It turned out that due to time constraints (our speech is 1 hour), we will not be able to present all the material we have prepared in its entirety, however we will probably leave all the content in the slides that get posted on the website.
Hope to see you all there!
Well it now the 24th and mine has moved nowhere fantatic just what you might expect from them. Come on google let the green bar fly away and drop your pr as you no it makes no sense
Hi there!
We would like to announce that we will be speaking at Blackhat in Las Vegas (beginning August 1) this year on the topic of C++. The basic premise for the speech is this: Most security literature about vulnerability analysis (or secure programming) for C/C++ tends to only address potential problems that can occur in C (dangerous API calls, integer overflows, pointer arithmetic, and so on). While these problems also affect C++, it is very rare that C++-specific problems are dealt with at all. As such, we are going to speak to a few problems that are specific to C++ and C++ runtime environments. There is too much material to address every potential problem that can occur in C++ in the time we have, but some of the things we intend to cover include VLA’s, the STL, and exception handling. So, if this sounds like your cup of tea, swing by and check it out!
We will also be doing a book signing on the first day of BlackHat at 12.30 PM.
Hope to see you there!
Hi guys,
In a post we did recently, we pointed to informit, who is selling our book at a 40% discount. However, due to a mixup with ISBNs, both informit and AW Professional marked our book as unavailable, and so you were unable to actually purchase it at either of these sites. Well, the problems seems to have finally been resolved, and the sale still appears to be running. Get it while it’s hot!
