<![CDATA[[SecurityRatty] tag: episode]]> http://www.securityratty.com/tag/episode Tue, 09 Sep 2008 15:23:37 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Show 032 - An Interview with Jeremiah Grossman]]> http://www.securityratty.com/article/b0449f2ccd72f29ee2665301bb7c2d9e http://www.securityratty.com/article/b0449f2ccd72f29ee2665301bb7c2d9e Jeremiah Grossman

The 32nd episode of The Silver Bullet Security Podcast features founder and Chief Technology Officer of WhiteHat Security, Jeremiah Grossman. Gary and Jeremiah discuss clickjacking, cross-site request forgery, why 50% of web problems can’t be discovered reliably automatically, and which conferences Jeremiah most enjoyed on his 2008 world tour.

]]> Thu, 13 Nov 2008 23:17:49 +0000 jeremiah grossman web web application scan-o-meter chief technology officer internet con game whitehat security conferences jeremiah 32nd episode prevention pdf Show 032 - An Interview with Jeremiah Grossman <![CDATA[Hak5 Episode 10: Phreaknic, and a short interview of me :)]]> http://www.securityratty.com/article/07c265f0dac0ae7d15cc835468a6b58b http://www.securityratty.com/article/07c265f0dac0ae7d15cc835468a6b58b Hak5 Episode 10: Phreaknic, and a short interview of me :)
I met the Hak5 folks at Phreaknic this year, it was a great time. Check out their footage at the link above.

]]> Wed, 05 Nov 2008 12:03:40 +0000 short interview hak5 episode phreaknic link hak5 folks footage time check Hak5 Episode 10: Phreaknic, and a short interview of me :) <![CDATA[Hak5 Episode 10: Phreaknic, and a short interview of me :)]]> http://www.securityratty.com/article/fc3ae759fc6bf5cd1073f69a509439a6 http://www.securityratty.com/article/fc3ae759fc6bf5cd1073f69a509439a6 Hak5 Episode 10: Phreaknic, and a short interview of me :)
I met the Hak5 folks at Phreaknic this year, it was a great time. Check out their footage at the link above.]]> Wed, 05 Nov 2008 12:03:40 +0000 short interview hak5 episode phreaknic link hak5 folks footage time check Hak5 Episode 10: Phreaknic, and a short interview of me :) <![CDATA[Microsoft Begins the MS08-067 Post-Mortem]]> http://www.securityratty.com/article/8b1a636e03c8882d65a7f324bcded81f http://www.securityratty.com/article/8b1a636e03c8882d65a7f324bcded81f Microsoft has already begun examining these questions in an entry on the SDL blog. The problem, the blog seems to conclude, is the complexity of the code. It's just really hard to find bugs of this nature. To have found it would have been lucky. Michael Howard, the SDL guru and blogger, isn't really pointing fingers, although commenters on the blog are. It's a prime example of what I wrote about not long ago when I said buffer overflows would never go away. The examples we all see of what overflows are and how to stop them are fairly simple things: Allocate a buffer of size b, read 2*b bytes into it. In this case, there were two problems making the problem significantly more complex: The overflow happens inside a loop, during which pointer arithmetic is done. This alone makes it harder to identify for humans to identify the bug and perhaps impossible for tools to identify it without incurring a large incidence of false positives. Stack-checking also failed in this instance. Howard called the code in question "reasonably complex" and said at a later date he would publish source code from the function. He said Microsoft's automated tools wouldn't find this bug in this type of code. Some comments on the blog asked him whether this complexity is, in and of itself, a problem. Perhaps manual code reviews should have rejected it. Howard didn't go this far, but I sense, in between the lines, that maybe he feels the same. As a programmer I've seen this sort of code plenty of times and written it myself. The code may have seemed particularly efficient or just plain cool to the programmer, but complex loops with pointer arithmetic sound inherently like asking for trouble. I've written before that Microsoft has a long-term way of writing for the next generation of hardware, and CPU processing power is becoming absurdly cheap. Perhaps an implementation that is slower than necessary, but clear in its operation, is the better choice. Then leave the optimizing to compilers. It's actually an old argument. Another thing Howard remarks on is the failure of Microsoft's fuzzing tools in this instance. All he says is they didn't find it and they'll work on that, and they are always working on their fuzzing tools. Fuzzing is cool and this episode shows how there's always more work to do in it. Aviram on the SecuriTeam blog relates how over two years ago famous researcher Dave Aitel said his fuzzer found no more bugs in the MS RPC code, so there must not be any. This was probably tongue-in-cheek, but even so, Aitel's probably biting his tongue now. Even though many levels of tools and procedures put in place to prevent such vulnerabilities failed to do so, it would be a mistake to say the system failed altogether. This vulnerability, just about the worst class of bug we ever get, comes with significant mitigating factors, and is probably, as a practical matter, not exploitable on Windows Vista and Server 2008. Not everything failed.

]]> Mon, 03 Nov 2008 10:41:51 +0000 code code plenty publish source code manual code reviews microsoft rpc code securiteam blog blog howard remarks Microsoft Begins the MS08-067 Post-Mortem <![CDATA[Three years of Blue Box podcasts....]]> http://www.securityratty.com/article/cc61b7549892d897fdca3fb3d3366a42 http://www.securityratty.com/article/cc61b7549892d897fdca3fb3d3366a42 Today is a special day for me. It was three years ago on October 24, 2005, that Blue Box Podcast #1 was uploaded. It was an 11-minute episode where I talked about... Skype security, SIP security, IETF, VOIPSA and some other VoIP security news..... (Hmmm... sounds lot like our recent shows, too, eh?)

Jonathan Zar joined me a week later on Blue Box Podcast #2 and we've been going ever since. We've now produced over 112 episodes, had close to 245,000 downloads of our various shows, met some amazing people, learned a lot along the way... and hopefully helped you all learn a lot out there as well.

Thank you to all of you who have joined with us on this journey... whether you've listened to our show from the very beginning (and we know of a couple of you who have) or have only recently joined in... thank you!

And now... on to the next three years... :-)

Technorati Tags: , , , , , , , ,

]]> Fri, 24 Oct 2008 17:35:22 +0000 voip security news security blue box sip security voip voip security blue box podcast lot jonathan zar Three years of Blue Box podcasts.... <![CDATA[Show 031 - An Interview with Matt Bishop]]> http://www.securityratty.com/article/fe6f5a3f65699efdb870d5e05c34a5bd http://www.securityratty.com/article/fe6f5a3f65699efdb870d5e05c34a5bd Matt Bishop

On the 31st episode of The Silver Bullet Security Podcast, Gary talks with Matt Bishop, professor of Computer Science at UC Davis and author of the book Computer Security: Art and Science as well as many peer-reviewed papers. Gary and Matt discuss Matt’s plan to work security analysis and secure coding into a wider computer science cirriculum, Matt’s early work with Mike Dilger on TOCTOU, whether or not progress is being made in the field of software security, and the role of training in large-scale software security initiatives. Their chat closes with a mention of Matt’s home menagerie (which does not include any one-legged chickens at this time).

]]> Mon, 20 Oct 2008 14:33:12 +0000 matt bishop secure computer systems matt bishop pdf computer systems secure computer security book computer security secure computer system matts home menagerie Show 031 - An Interview with Matt Bishop <![CDATA[Show 030 - An Interview with Ken van Wyk]]> http://www.securityratty.com/article/0b1369b7e3490f60e22d2ae7d871f6c7 http://www.securityratty.com/article/0b1369b7e3490f60e22d2ae7d871f6c7 Ken van Wyk

On the 30th episode of The Silver Bullet Security Podcast, Gary talks with Ken van Wyk, principal and founder of KRvW Associates. Ken was the first employee of CERT and has been an active member of FIRST. Ken and Gary discuss why the discipline of computer science doesn’t learn from failure like mechanical engineering does, how we’re making steps backwards in computer security, whether focusing on web applications is a good or bad thing for software security, and Ken’s recommendation for moderately-priced red wines.

]]> Fri, 26 Sep 2008 17:23:25 +0000 van wyk tjxs stock increase barbara dasti wines tacoma narrows bridge kens personal page red wines secure security breach gary talks Show 030 - An Interview with Ken van Wyk <![CDATA[This American Life on Scamming the Scammers]]> http://www.securityratty.com/article/a0f43444bc9afa0cd221b17cea1a78e0 http://www.securityratty.com/article/a0f43444bc9afa0cd221b17cea1a78e0 A recent episode of “This American Life” featured a couple of Nigerian scammers — who were being scammed by three other guys. Does it serve them right or is it just dangerous? Either way, it’s good once in a while to see a case where the scammers get scammed back, instead of unwitting consumers.

From the Consumerist:

Last week, “This American Life” featured a 30-minute piece on people who scam the scammers—in this case, three guys who prey upon small-time Nigerian con men and try to trick them into placing themselves in mortal danger. “This American Life” tells how they almost got a guy to enter a Western Union office in Chad carrying an anti-Muslim/pro-Bush note that announces his intention to rob the place. Whether you think these stunts are funny probably depends on your level of empathy even for criminals, and whether you think the avengers ever fully succeed. But c’mon, getting someone in another country to hold up a sign that’s offensive in your language is pretty much always funny

Listen to the episode over at this American Life.

]]> Wed, 17 Sep 2008 10:58:49 +0000 american life american life tells scammers episode recent episode small-time nigerian con nigerian scammers western union office mortal danger This American Life on Scamming the Scammers <![CDATA[ Mythbusters Episode on RFID Security Nixed]]> http://www.securityratty.com/article/cdb83c68d92b899f0de2ab938d8e6cd6 http://www.securityratty.com/article/cdb83c68d92b899f0de2ab938d8e6cd6 Seems that the idea was killed by lawyers under pressure from the credit card industry. Or maybe not; the person who started this rumor has retracted his comments. Or maybe those same lawyers made him retract his comments.

Don't they know that security by gag order never works, except temporarily?

]]> Wed, 10 Sep 2008 10:34:45 +0000 credit card industry lawyers comments security pressure retract gag person idea Mythbusters Episode on RFID Security Nixed <![CDATA[Another VMware Founder Leaves]]> http://www.securityratty.com/article/8e31d391fee4200c824ddc048a2d952b http://www.securityratty.com/article/8e31d391fee4200c824ddc048a2d952b Rosenblum_VMware I’m getting a little depressed for my upcoming trip to Vegas next week. Instead of a festive party atmosphere, I fear VMworld (and especially the Partner Day on Monday) is going to consist of a bunch of long faces on people wondering whether they should have gone to the Microsoft virtualization party instead.

Just a few months after CEO and founder Diane Greene was ousted, it comes as no surprise that her husband and co-founder, Mendel Rosenblum, has also resigned via a company wide message last night. Turns out he’s going back to Stanford to teach. What a lovely way to get out of the political mess VMware has become. Admit it, haven’t we all had a point where we get fed up with the latest work snafu and wondered, maybe I should go back to college and teach? I had a really good time in college… Kudos to Rosenblum for doing it and doing it in style.

And if you believe Tarry Singh, the company knew this was going to happen but waited until after registrations were closed for VMworld before making it official. Hmm.

From the New York Times, more on Greene’s firing and just what kind of atmosphere is forcing executives to leave VMware:

After Ms. Greene made a special presentation to VMware’s board, Mr. Tucci, who heads VMware’s parent company, EMC, pulled her aside, according to people familiar with the events, who asked for anonymity because they were not authorized to discuss internal company decisions.

Inviting Mendel Rosenblum, Ms. Greene’s husband and the co-founder of VMware, into the room, Mr. Tucci told Ms. Greene she was fired, effective immediately. And he said the board wanted Mr. Rosenblum, VMware’s chief scientist, to take her seat on the board. Mr. Rosenblum declined the offer.

Honestly, what kind of a judgement call was made to first fire the man’s wife in front of him and then offer him her board seat? Has Tucci never seen an episode of Survivor?

]]> Tue, 09 Sep 2008 15:23:37 +0000 vmware board seat board rosenblum mendel rosenblum political mess vmware founder diane greene greene vmwares board Another VMware Founder Leaves