My Data Backup Routine

Tuesday, January 12th, 2010

I wanted to offer my personal backup routine to all those that do not have something in place and not sure where or how to start.  I tried many different methods over the years and so far I think this is the best one for me, my amount of data, ...

DNS Rebinding – Explained

Tuesday, December 1st, 2009

Here is a great video from Robert "RSnake" Hansen explaining what DNS Rebinding actually is and shows some various attacks that may be performed as a result of it.  RSnake also explains what can be done to fix the problem and explains why it might not happen any time soon. DNS ...

Clientless SSL VPN Vulnerability

Tuesday, December 1st, 2009

Web browsers enforce the same origin policy to prevent one site's active content (such as JavaScript) from accessing or modifying another site's data. For instance, active content hosted at http:///page1.html can access DOM objects on http:///page2.html, but cannot access objects hosted at http:///page.html. Many clientless SSL VPN products retrieve content ...

Most security products fail to perform

Monday, November 16th, 2009

Nearly 80 percent of security products fail to perform as intended when first tested and generally require two or more cycles of testing before achieving certification, according to a new ICSA Labs report. The “ICSA Labs Product Assurance Report” - co-authored by the Verizon Business Data Breach Investigations Report research ...

Researcher busts into Twitter via SSL reneg hole

Saturday, November 14th, 2009

A Swiss grad student has devised a serious, real-world attack on Twitter that targeted a recently discovered vulnerability in the secure sockets layer protocol.The exploit by Anil Kurmus is significant because it successfully targeted the so-called SSL renegotiation bug to steal Twitter login credentials that passed through encrypted data streams. ...