Wednesday, April 25, 2012

Thoughts on AppSecDC 2012


The first week of April brought another edition of AppSecDC to Washington, D.C., but this year people from two different worlds came to the same conference: Web security and Industrial Control Systems security.  Of course, at the device level this convergence happened a long time ago if we take into account that almost every modern PLC  includes at least a web server, among other things.

Thursday, April 12, 2012

TLS Renegotiation and Load Balancers


I seem to be fielding more and more questions of late around the rather well-known SSLv3 and TLS renegotiation flaw. For those who aren’t familiar, the TLS renegotiation flaw allows the injection of data into a SSLv3 or TLS stream, potentially causing data injection or the program to misbehave in some other fashion. It is not a full man-in-the-middle attack because the attacker can't read what's in the data stream, only inject into it. Ultimately, this is a protocol flaw—one that's been fixed as an extension to TLS as dictated by RFC 5746—but adoption in SSL libraries has been relatively slow.

Wednesday, April 4, 2012

Hackito Ergo Sum: Not Just Another Conference

My name is Jonathan Brossard, but you may know me under the nic Endrazine. Or maybe as the CEO of Toucan System.. Nevermind: I'm a hacker. Probably like yourself, if you're reading this blog post. Along with my friends Matthieu Suiche and Philippe Langlois,—with the invaluable help of a large community worldwide—we're trying to build a conference like no other: Hackito Ergo Sum.