alech.de

cryptanalysis.eu

Effective DoS attacks against Web Application Plattforms – #hashDoS [UPDATE3] | Cryptanalysis - breaking news

https://cryptanalysis.eu/blog/2011/12/28/effective-dos-attacks-against-web-application-plattforms-hashdos/comment-page-1

Cryptanalysis – breaking news. Effective DoS attacks against Web Application Plattforms – #hashDoS [UPDATE3]. Julian Wälde ( zeri. Presented a very nice way. How to bring down many popular websites at 28C3. The idea is quiet simple, effective and general. Many programming languages, especially scripting languages, frequently use hash tables to store all kinds of data. Hash tables ( which are very well explained on wikipedia. Operations for these operations in the worst case, compared to. Is used as an in...

shiftordie.de

Shell injection without whitespace - shift or die

http://shiftordie.de/blog/2011/12/23/shell-injection-without-whitespace

Security. photography. foobar. Shell injection without whitespace. Recently, I was in the situation where I could inject code into a Perl. Call, but whitespace ( s ) was filtered beforehand (probably not for security but rather for functionality reasons). Without using a single whitespace character. May it come in handy for you one day. Posted by Alexander Klink. Laquo; Moving to Octopress. Geohashing with GPX files and QLandkarte GT ». A portscan by email – HTTP over X.509 revisited.

shiftordie.de

Moving to Octopress - shift or die

http://shiftordie.de/blog/2011/12/22/moving-to-octopress

Security. photography. foobar. My blog has been running on Angerwhale. A Catalyst-based Perl blog framework. Although it worked fine for me from a usability point of view (plain text files plus some meta-data), it was way to slow to deal with a few concurrent hits. I never noticed until @chaosupdates. Linked to my blog post about @cryptofax2tweet and the server more or less exploded in (virtual) flames. Which uses the Jekyll. Posted by Alexander Klink. Laquo; Introducing CryptoFax2Tweet. Shell injection ...

shiftordie.de

Geohashing with GPX files and QLandkarte GT - shift or die

http://shiftordie.de/blog/2012/03/18/geohashing-with-qlandkartegt

Security. photography. foobar. Geohashing with GPX files and QLandkarte GT. Because of some scientists near the south pole. I recently re-discovered geohashing. As I wanted an easy way to see the most recent hash points (and the upcoming one(s), since I live east of W30. I did some automation. And the Openmtbmap.org. Map, as it shows cycling routes quite nicely. As it shows you the hash points of the surrounding graticules as well. I took an evening to hack something together using Ruby, Sinatra. But bac...

janschejbal.wordpress.com

Sicheres Onlinebanking? Kostet extra! | Jan Schejbal

https://janschejbal.wordpress.com/2011/01/19/sicheres-onlinebanking-kostet-extra

Es lebe die Freiheit! Die Postbank schaltet das iTAN-Verfahren zugunsten „sichererer“ Verfahren ab. Das iTAN-Verfahren, also die Eingabe eines Einwegkennworts von einer gedruckten Liste, ist bei einem verseuchten Computer über einen Trojaner angreifbar, der die Überweisungsdaten verändert. Der Schritt ist also erstmal logisch, nachvollziehbar und scheint sinnvoll zu sein. Kunden einer spanische Bank sollen auf diese Weise angegriffen. Auch das BSI vor dieser Art von Angriff. Update 3. Die SMS-Nachrichten...

theinvisiblethings.blogspot.com

The Invisible Things Lab's blog: Evil Maid goes after TrueCrypt!

http://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-truecrypt.html

The Invisible Things Lab's blog. Kernel, Hypervisor, Virtualization, Trusted Computing and other system-level security stuff. Friday, October 16, 2009. Evil Maid goes after TrueCrypt! From time to time it’s good to take a break from all the ultra-low-level stuff, like e.g. chipset or TXT hacking, and do something simple, yet still important. Recently Alex Tereshkin. And I got some spare time and we implemented the Evil Maid Attack. Or PGP Whole Disk Encryption. Or ”Coldboot” attacks. So, after our victim...

shiftordie.de

A portscan by email – HTTP over X.509 revisited - shift or die

http://www.shiftordie.de/blog/2013/11/12/http-over-x509-revisited

Security. photography. foobar. A portscan by email – HTTP over X.509 revisited. Disclaimer: This was originally posted on blog.nruns.com. Since n.runs went bankrupt, the blog is defunct now. I reposted this here in July 2015 to preserve it for posteriority. Design bugs are my favourite bugs. About six years ago, while I was working in the Public Key Infrastructure area, I identified such a bug in the X.509 certificate chain validation process ( RFC 5280. Were released in April 2008. Testing showed that i...

shiftordie.de

shift or die

http://www.shiftordie.de/impressum.html

Security. photography. foobar. Angaben gemäß 5 TMG:. Quelle: Impressum erstellt durch Impressum Generator.

shiftordie.de

Blog Archive - shift or die

http://www.shiftordie.de/blog/archives

Security. photography. foobar. A portscan by email – HTTP over X.509 revisited. Geohashing with GPX files and QLandkarte GT. Shell injection without whitespace. Evading AVs using the XML Data Package (XDP) format. Language-dependant spellchecking within sup. Raindrops in a spider web. Photo Challenge 2009: Yellow. Traversing Dan’s directory. Interview on Debian OpenSSL. The Debian and OpenSSL debacle — consider your passwords compromised, too. Installing Nexenta on USB drives. I should not ….

shiftordie.de

shift or die

http://www.shiftordie.de/blog/page/2

Security. photography. foobar. Evading AVs using the XML Data Package (XDP) format. At work, I recently obtained a copy of iText in Action, 2nd Edition. Because I have been playing with PDF a bit lately and the book not only offers advice on how to use the Java PDF library iText. But also some background on PDF internals and the new features in PDF 1.7. One thing I stumbled about in the book was that there is a format called XML Data Package. And went to play with it a bit. And uploaded it to VirusTotal.