tag:blogger.com,1999:blog-38326219510013649422013-03-23T16:35:44.901+01:00_ Where facts are few, experts are manyThierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.comBlogger163125thierryzollerhttp://feedburner.google.comtag:blogger.com,1999:blog-3832621951001364942.post-27784928771133505462013-03-23T15:56:00.000+01:002013-03-23T16:35:44.914+01:002013-03-23T16:35:44.914+01:00Interesting Reads - Week 12 / 2013 Binary Instrumentation for Exploit Analysis Purposes (part 1) Binary Instrumentation for Exploit Analysis Purposes (part 2) Using the PIN instrumentalisation framework to analyse exploits Randomly failed!...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/9szL6gXZp_o" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com0http://blog.zoller.lu/2013/03/interesting-reads-week-12-2013.htmltag:blogger.com,1999:blog-3832621951001364942.post-25837408529241553552013-03-03T21:32:00.004+01:002013-03-23T16:04:48.518+01:002013-03-23T16:04:48.518+01:00I have updated my little TLS/SSL Scanner called "SSL Audit" to version 0.8. I tweaked it slightly but the tool is still based on it's own rudimentary SSL Engine and hence is not limited by the number of ciphersuites and protocols available to...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/NQ0h2Nyqkn8" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com0http://blog.zoller.lu/2013/03/tool-ssl-audit-v08-release.htmltag:blogger.com,1999:blog-3832621951001364942.post-39933681639686452222012-11-19T22:22:00.000+01:002012-11-19T23:00:20.953+01:002012-11-19T23:00:20.953+01:00I would like to invite you to this years OWASP BeNeLux Event, I won't give a talk this year but I happily invite you as part of OWASP BeNeLux Program Committee: Quick Facts Date : 29-30 Novembre&nbsp; Location: Leuven (Belgium) Price :...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/0k9tHDypFrI" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com1http://blog.zoller.lu/2012/11/owasp-benelux-2012-invitation.htmltag:blogger.com,1999:blog-3832621951001364942.post-74560785322084242372012-08-05T19:40:00.000+02:002012-08-07T23:30:42.775+02:002012-08-07T23:30:42.775+02:00[ Updated : Added&nbsp; "10 Common Mistakes of Incident Responders" at the bottom] The following post will brake one major rule I adhere to&nbsp; when blogging, a post shall have not more than 10% of content that is not authored by myself. The...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/oHYiDeusuok" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com1http://blog.zoller.lu/2012/08/mistakes-made-in-incident-response.htmltag:blogger.com,1999:blog-3832621951001364942.post-41844538656838556182012-08-04T16:44:00.000+02:002012-08-07T23:34:14.473+02:002012-08-07T23:34:14.473+02:00A post within the "straight to the meat" category : There was a talk at Defcon 20 entitled "Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2", by Moxie and David Hulton - the talk announced the implementation of a tool that reduced the...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/gJBnXZ1YaIQ" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com2http://blog.zoller.lu/2012/08/what-you-need-to-know-about.htmltag:blogger.com,1999:blog-3832621951001364942.post-18581162926741180712012-07-02T22:15:00.001+02:002012-08-07T23:34:24.787+02:002012-08-07T23:34:24.787+02:00I updated BTCrack Open Source Edition (BTCrack OSS) to version 1.01 by patching 2 bugs that were reported by Michael Ossmann and Carl Dunhamm. Description The&nbsp; primary goal of BTcrack is to crack/recover the PIN and reconstruct...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/XFxHPYq_RXw" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com1Luxembourg49.815273 6.12958349.487429 5.497869000000001 50.143117 6.761297http://blog.zoller.lu/2012/07/btcrack-101-updated-release.htmltag:blogger.com,1999:blog-3832621951001364942.post-68333186582213229632012-06-24T14:45:00.000+02:002012-06-24T14:46:52.182+02:002012-06-24T14:46:52.182+02:00Publications In a blink of an eye - there goes your AES Key Advances in extracting keying material from Hardware (FPGA) Visualising Botnets Why allowing active ipv6 stacks on your network is a bad idea (but we don't route ipv6) A bad couple of...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/PXLtl_Mz2Ss" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com1http://blog.zoller.lu/2012/06/recommended-reads-week-25-2012.htmltag:blogger.com,1999:blog-3832621951001364942.post-85611749809729422962012-06-10T20:48:00.000+02:002012-06-10T20:48:30.521+02:002012-06-10T20:48:30.521+02:00Tools / Techniques How to Extract Flash Objects From Malicious MS Office Documents Burp plugin for scanning GWT and JSON HTTP requests SQLite3 Injection Cheat Sheet Unoffical Guide to scapy Scapy is immensely powerfull as a seperate tool or as...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/FyUUiledC9U" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com0http://blog.zoller.lu/2012/06/recommeded-reads-week-23.htmltag:blogger.com,1999:blog-3832621951001364942.post-61766580191907674832012-06-09T15:00:00.001+02:002012-06-13T23:13:17.273+02:002012-06-13T23:13:17.273+02:00Introduction Due to the latest row of high profile websites being compromised and parts of the password hashes being published here's a quick crash course on storing passwords "securely", for those that want a quick heads up. In this case I'd define...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/5oeTYBdf5S4" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com6http://blog.zoller.lu/2012/06/storing-password-securely-hashses-salts.htmltag:blogger.com,1999:blog-3832621951001364942.post-10934078731553976802012-06-02T14:50:00.000+02:002012-06-02T15:44:51.266+02:002012-06-02T15:44:51.266+02:00My Reads The Vulnerabilities Market and the Future of Security Bruce Schneier comments on the evolution of the Vulnerability Market and it's implications, the essay is surprisingly good supplement to the presentation I gave at OWASP on the...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/WMtr9jUvmKs" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com0http://blog.zoller.lu/2012/06/interesting-reads-of-week-week-22.htmltag:blogger.com,1999:blog-3832621951001364942.post-88484276903748179962012-05-17T13:23:00.001+02:002012-05-17T13:27:12.624+02:002012-05-17T13:27:12.624+02:00Updated Posts : The Post "Attacker Classes and Pyramid " has been updated to the third iteration. The post was updated in terms of coherency but I also added my OWASP BENELUX presentation entitled "The Rise of the Vulnerability Markets - History,...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/LF0CjUs5kT4" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com1http://blog.zoller.lu/2012/05/updated-posts-and-notable-updates.htmltag:blogger.com,1999:blog-3832621951001364942.post-55361910326535601942012-05-05T15:47:00.001+02:002012-11-05T12:55:17.505+01:002012-11-05T12:55:17.505+01:00Following up on my blog post a few months ago entitled "PCI compliance, Security in isolated systems and Parking Tellers Part 1" - I took a brief look the other day at another Ticket issued by a Parking Teller in Luxembourg. Updated : Clarified...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/aHI-1zsORLE" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com2http://blog.zoller.lu/2012/05/pci-compliance-security-in-isolated.htmltag:blogger.com,1999:blog-3832621951001364942.post-35375301592587047422012-03-24T14:51:00.000+01:002012-06-02T22:24:31.166+02:002012-06-02T22:24:31.166+02:00Ever since I started my career in information security I was both interested and&nbsp;intrigued by metrics applied to vulnerabilities (or metrics in general for that matter). CVSS is&nbsp;certainly&nbsp;not new and I had to make the choice whether...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/8KUdP2NQDV8" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com3http://blog.zoller.lu/2012/03/cvss-common-vulnerability-scoring.htmltag:blogger.com,1999:blog-3832621951001364942.post-73149693464554740572011-12-27T16:02:00.003+01:002012-06-02T23:14:20.798+02:002012-06-02T23:14:20.798+02:00Preamble : During my research on TLS/SSL Compatibility across different Operation Systems and Browsers I created supporting tools for myself and later decided to release them for the public. "SSL Audit" remotely scans web servers for SSL...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/40A547UPkuM" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com0http://blog.zoller.lu/2011/12/ssl-audit-updated-released-ssltls.htmltag:blogger.com,1999:blog-3832621951001364942.post-24634975953114684032011-12-23T13:19:00.000+01:002011-12-23T14:00:00.431+01:002011-12-23T14:00:00.431+01:00Final release for my paper explaining the different attack vectors and impacts for (CVE-2009-3555) "TLS / SSL renegotiation vulnerability". Added comments and corrections by Alun Jones (Who I hereby thank for his time) Changed FTPS...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/SPMFeQtDntE" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com1http://blog.zoller.lu/2011/12/final-ssltls-renegotiation-explained.htmltag:blogger.com,1999:blog-3832621951001364942.post-64815943161510502362011-12-06T20:13:00.001+01:002013-03-16T13:47:23.646+01:002013-03-16T13:47:23.646+01:00A colleague of mine spotted the below while doing expenses - The photograph below shows two separate receipts from two parking buildings that are not far away from each other in central Luxembourg (est. 1km). Both were paid by credit card / debit...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/PVJdzrnO6mQ" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com9http://blog.zoller.lu/2011/12/pci-compliance-security-in-isolated.htmltag:blogger.com,1999:blog-3832621951001364942.post-11509696403595888522011-11-01T13:57:00.002+01:002011-11-01T14:47:52.139+01:002011-11-01T14:47:52.139+01:00As some regulars might have noticed I restructed this blog a bit trying to get rid of some clutter. At the same time I updated a few specific pages I wanted to point out : Vulnerability Coordination Policy ( More backround on the "why" ) About Me...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/QRum0TeKmec" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com0http://blog.zoller.lu/2011/11/blog-cleanup_01.htmltag:blogger.com,1999:blog-3832621951001364942.post-82947956317820827242011-10-26T20:41:00.001+02:002011-10-26T21:13:45.861+02:002011-10-26T21:13:45.861+02:00Since this is a rather old topic with both sides having valid points I will keep this post short and sweet. I have had no time to measure of investigate in depth and I don't think I will find any. Both have understandable view points, so let's...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/ZOBgjNFBXvA" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com2http://blog.zoller.lu/2011/10/thc-ssl-dos-vs-per-design.htmltag:blogger.com,1999:blog-3832621951001364942.post-56217275696771441422011-10-18T20:20:00.001+02:002012-05-17T13:12:13.336+02:002012-05-17T13:12:13.336+02:00This is a living blog post I will update whenever I have time and new ideas. TOC Introduction Updates Attacker Classes Attacker Pyramid Q&amp;A Introduction The other day I was brainstorming further on the attacker classes I came up with...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/LIoHUHR2NfY" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com1http://blog.zoller.lu/2011/10/attacker-classes-and-pyramid-version-1.htmltag:blogger.com,1999:blog-3832621951001364942.post-70966974108857734422011-09-26T16:18:00.000+02:002011-10-01T21:01:34.749+02:002011-10-01T21:01:34.749+02:00Lots of good information floating on the internet on the Proof of Concept (dubbed 'BEAST) against TLS 1.0 by Juliano Rizzo and Thai Duong at the Ekoparty. This blog post will be continuously updated as new items and possible mitigation...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/Mvqv5fDWooc" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com2http://blog.zoller.lu/2011/09/beast-summary-tls-cbc-countermeasures.htmltag:blogger.com,1999:blog-3832621951001364942.post-42933788044392868732011-09-20T17:21:00.003+02:002011-09-25T17:33:20.260+02:002011-09-25T17:33:20.260+02:00This is a cross post from the G-SEC blog My professional and private commitments made it difficult to maintain a healthy blogging style, I am trying to get back to some blogging on a more regular basis. Quick Update: G-SEC does&nbsp;no...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/Eo4LpJM9MZE" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com1http://blog.zoller.lu/2011/09/tlsssl-hardening-and-compatibility.htmltag:blogger.com,1999:blog-3832621951001364942.post-2316120409217146542011-08-23T20:47:00.000+02:002011-09-24T17:24:05.164+02:002011-09-24T17:24:05.164+02:00I stumbled across this weird PHP bug in the crypt() implementation (version&nbsp;5.3.7RC5) [1] The bug reporter states that : "If crypt() is executed with MD5 salts, the return value consists of the salt only." In other words the call...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/PsKLpyLTtmU" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com0http://blog.zoller.lu/2011/08/what-does-php-crypt-and-alzheimer-had.htmltag:blogger.com,1999:blog-3832621951001364942.post-41478133159978202842011-08-01T22:20:00.000+02:002013-03-16T15:59:07.152+01:002013-03-16T15:59:07.152+01:00Talks / Lectures During my career I had the opportunity to present my thoughts and views on Information Security to numerous people and organizations, below is a list of conferences I had the pleasure to present at. 2006 Luxembourg...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/Zl3UNvxhQQM" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com1http://blog.zoller.lu/2011/08/tools-whitepapers-talks.htmltag:blogger.com,1999:blog-3832621951001364942.post-42202930745857074442010-08-22T23:33:00.015+02:002011-09-24T17:51:31.234+02:002011-09-24T17:51:31.234+02:00Subscribe to the RSS feed in case you are interested in updates After Acrossecurity, published an interesting vulnerability and HDmoore appears to have stumbled on the same issue, I decided to investigate on my own. I am not 100% sure it's the...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/C6gVneAPWbY" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com2http://blog.zoller.lu/2010/08/cve-2010-xn-loadlibrarygetprocaddress.htmltag:blogger.com,1999:blog-3832621951001364942.post-31219831376806076212010-07-18T15:14:00.001+02:002010-07-18T16:37:06.295+02:002010-07-18T16:37:06.295+02:00Subscribe to the RSS feed in case you are interested in updates &nbsp;Ivanlef0u released a POC for the exploit used in targeted attacks :http://ivanlef0u.nibbles.fr/repo/suckme.rar More information :ISC SANS USCERT 940193 Microsoft...<br/> <br/> Read more....<img src="http://feeds.feedburner.com/~r/thierryzoller/~4/Uk9OAOexbe0" height="1" width="1"/>Thierry Zollerhttp://www.blogger.com/profile/14432216409558141236noreply@blogger.com0http://blog.zoller.lu/2010/07/cve-2010-2568-lnk-code-execution-proof.html