G-SEC - Blog

An Overview of the BEAST - TLS, CBC, countermeasures (Update 3)

noreply@blogger.com (Thierry Zoller) — Mon, 26 Sep 2011 07:38:00 PDT

Lots of good information floating on the internet on the Proof of Concept (dubbed 'BEAST) against TLS 1.0 by Juliano Rizzo and Thai Duong at the Ekoparty. This Post summaries the credible information...

[[ This is a content summary only. Visit our blog for more ]]

SSL/TLS Hardening and compatibility report 2011 (updated)

noreply@blogger.com (Thierry Zoller) — Tue, 20 Sep 2011 08:05:00 PDT

Subscribe to the RSS feed in case you are interested in updates My professional and private commitments made it difficult to maintain a healthly blogging style, I am trying to get back to some...

[[ This is a content summary only. Visit our blog for more ]]

New Paper: SSL/TLS Hardening and Compatibility report 2010

noreply@blogger.com (Thierry Zoller) — Thu, 18 Feb 2010 06:20:00 PST

Subscribe to the RSS feed in case you are interested in updates At last. What started as an "I need an overview of best practise in SSL/TLS configuration" type of idea, ended in a 3 month code,...

[[ This is a content summary only. Visit our blog for more ]]

Harden SSL/TLS - Tool release

noreply@blogger.com (Thierry Zoller) — Tue, 16 Feb 2010 09:43:00 PST

Subscribe to the RSS feed in case you are interested in updates “Harden SSL/TLS” allows hardening the SSL/TLS settings of Windows 2000,2003,2008,2008R2, XP,Vista,7. It allows locally and ...

[[ This is a content summary only. Visit our blog for more ]]

SSL/TLS Audit (alpha) - Tool Release

noreply@blogger.com (Thierry Zoller) — Wed, 10 Feb 2010 07:33:00 PST

Subscribe to the RSS feed in case you are interested in updates Developed as part of G-SEC's investigation into the "Secure SSL/TLS configuration Report 2010" (to be published) we developed this...

[[ This is a content summary only. Visit our blog for more ]]

TLS / SSLv3 renegotiation vulnerability explained (Update #2)(

noreply@blogger.com (Thierry Zoller) — Fri, 13 Nov 2009 03:52:00 PST

Subscribe to the RSS feed in case you are interested in updates This paper explains the vulnerability for a broader audience and summarizes the information that is currently available. The...

[[ This is a content summary only. Visit our blog for more ]]

SSLv3 / TLS Man in the Middle vulnerability - update #9

noreply@blogger.com (Thierry Zoller) — Thu, 05 Nov 2009 04:00:00 PST

Subscribe to the RSS feed in case you are interested in updates Updated 17:50 GMT+1 / 05.2009 - added Mitigation / Impact Updated 16:40 GMT+1 / 06.2009 - added IETF draft Updated...

[[ This is a content summary only. Visit our blog for more ]]

Solving the HACK.LU 2009 reversing challenge like it's 1998

noreply@blogger.com (Thierry Zoller) — Mon, 02 Nov 2009 12:15:00 PST

Subscribe to the RSS feed in case you are interested in updates Here is quick overview of one possible way to solve the Hack.lu 2009 crackme (reversing challenge) with the classical JZ/JNZ...

[[ This is a content summary only. Visit our blog for more ]]

Advisory : Computer Associates multiple products - arbritary remote code execution

noreply@blogger.com (Thierry Zoller) — Tue, 13 Oct 2009 07:46:00 PDT

Subscribe to the RSS feed in case you are interested in updates G-SEC released an advisory today that affects various Computer Associates products. The most interesting part is the multitude of...

[[ This is a content summary only. Visit our blog for more ]]

IIS 5 & IIS 6 & IIS7 FTP vulnerability - information and tools (updated)

noreply@blogger.com (Thierry Zoller) — Tue, 01 Sep 2009 05:06:00 PDT

Subscribe to our RSS feed for regular updates Renowed security researcher "Kingcope" published a recent zero day vulnerability (i.e no patch and unkown at the time of publication) affecting...

[[ This is a content summary only. Visit our blog for more ]]

New advances in Office/Excel/Powerpoint Malware detection and analysis

noreply@blogger.com (Thierry Zoller) — Thu, 30 Jul 2009 15:20:00 PDT

Subscribe to the RSS feed in case you are interested in updates As you may or may not know there is massive client-side exploitation movement going on since last year (there has been before but on a...

[[ This is a content summary only. Visit our blog for more ]]