Browse Blog Posts by Tags

MVP WordPress Blogs

Browse Blog Posts by Tags

Showing related tags and posts for the Blogs application. See all tags in the site

Malware blue-screens when patched

The Microsoft update MS10-015 recently demonstrated rather dramatically that unauthorised patches of the operating system make your operating system significantly unstable and unreliable. In this case, the unauthorised patch is a rootkit called, among other things, “Alureon”, which alters some low-level...

Posted to Tales from the Crypto by Alun Jones on Thu, Feb 18 2010
Filed under: Filed under: General Security
Are you rugged?

As a developer, I’ve heard a number of adjectives applied to those who practice my craft. “Rugged” isn’t one I expect to hear very often. Granted, there are a few who alternate their brief stints of coding with explorations of the far-flung hinterland, but even these never quite seem to fill the “rugged...

Posted to Tales from the Crypto by Alun Jones on Wed, Feb 10 2010
Filed under: Filed under: General Security, Programmer Hubris
TLS Renegotiation attack – Microsoft workaround/patch

Hidden by the smoke and noise of thirteen ( 13! count them! ) security bulletins, with updates for 26 vulnerabilities and a further 4 third-party ActiveX Killbits (software that other companies have asked Microsoft to kill because of security flaws), we find the following, a mere security advisory: Microsoft...

Posted to Tales from the Crypto by Alun Jones on Tue, Feb 9 2010
Filed under: Filed under: General Security, Things I Learned At Microsoft, Why is PKI so hard?, Windows Vista, Windows Server 2008, Windows 7
So I deleted it without reading it.

Posted to Tales from the Crypto by Alun Jones on Wed, Feb 3 2010
Filed under: Filed under: General Security
A golden rule of performance improvement

The Rule: Performance optimizations are not worth making for anything less than 10% improvement in speed. Corollary: Performance optimizations must be measured before and after, and changes reverted if they do not cause significant performance improvement. Converse: If you are pushing back on implementing...

Posted to Tales from the Crypto by Alun Jones on Mon, Feb 1 2010
Filed under: Filed under: General Security, Programmer Hubris, Things I Learned At Microsoft
Ten key truths

In the spirit of "ten unavoidable security truths", and numerous other top-ten lists, here's a list of ten key truths that apply to public / private key pairs: Your private key has to be private to you. It cannot be created by anyone else. Anyone who has your private key is you, for the...

Posted to Tales from the Crypto by Alun Jones on Fri, Jan 22 2010
Filed under: Filed under: General Security, Why is PKI so hard?
Corrections to Thierry Zoller’s Whitepaper

Thanks to Thierry Zoller for mentioning me in the FTP section of his whitepaper summary of the TLS renegotiation attacks on various protocols. I’m glad he also spells my name right – you’d be surprised how many people get that wrong, although I’m sure Thierry gets his own share of people unable to spell...

Posted to Tales from the Crypto by Alun Jones on Sun, Dec 6 2009
Filed under: Filed under: SSL Tutorial, General Security, Why is PKI so hard?
My take on the SSL MITM Attacks – part 3 – the FTPS attacks

[Note - for previous parts in this series, see Part 1 and Part 2 .] FTP, and FTP over SSL, are my specialist subject, having written one of the first FTP servers for Windows to support FTP over SSL (and the first standalone FTP server for Windows!) Rescorla and others have concentrated on the SSL MITM...

Posted to Tales from the Crypto by Alun Jones on Wed, Nov 18 2009
Filed under: Filed under: SSL Tutorial, General Security, FTP, Why is PKI so hard?, Alun's code
My take on the SSL MitM Attacks – part 2 – clarifications

Since the last post I made on the topic of SSL renegotiation attacks , I’ve had a few questions in email. Let’s see how well I can answer them: Q. Some stories talk about SSL, others about TLS, what’s the difference? A. For trademark reasons, when SSL became an open standard, it had...

Posted to Tales from the Crypto by Alun Jones on Wed, Nov 11 2009
Filed under: Filed under: SSL Tutorial, General Security, Why is PKI so hard?
My take on the SSL MITM Attacks – part 1 – the HTTPS attack

If you’re in the security world, you’ve probably heard a lot lately about new and deadly flaws in the SSL and TLS protocols – so-called “Man in the Middle” attacks (aka MITM). These aren’t the same as old-style MITM attacks , which relied on the attacker somehow pretending...

Posted to Tales from the Crypto by Alun Jones on Mon, Nov 9 2009
Filed under: Filed under: SSL Tutorial, General Security, Why is PKI so hard?
Why changing passwords should be done regularly

A little birdie sent me a copy of today’s SANS ISC diary entry . That’s a good thing, because I’m at home sick with alleged piggy flu, and I’m not able to keep up with a whole lot. The diary entry argues that regular changes of passwords are often done for no other reason than “because we’ve always done...

Posted to Tales from the Crypto by Alun Jones on Mon, Nov 2 2009
Filed under: Filed under: General Security, What my wife knows
White House moves to Open Source

Subtitle: Media posts uninformed rubbish as commentary From the MSNBC story “ White House opens Web site coding to public ”: "Security is fundamentally built into the development process because the community is made up of people from all across the world, and they look at the source code from the...

Posted to Tales from the Crypto by Alun Jones on Mon, Oct 26 2009
Filed under: Filed under: General Security, Programmer Hubris
Phishing at Hotmail, GMail, Yahoo! Mail, etc.

Recent password exposures at a number of online email services remind me to give a little advice on passwords. Definitely use this as a reminder to do something about your passwords – but don’t do the obvious thing. Don’t rush round and change all your passwords right away. Don’t change your passwords...

Posted to Tales from the Crypto by Alun Jones on Sun, Oct 25 2009
Filed under: Filed under: General Security
SAL-like code annotations for Java

http://types.cs.washington.edu/jsr308/ seems to be talking about a set of type annotations for Java that are similar to those provided in Microsoft Visual C++ by SAL, the Standard Annotation Language . One thing that the Java annotations have going for them over the SAL is that these annotations are...

Posted to Tales from the Crypto by Alun Jones on Tue, Oct 20 2009
Filed under: Filed under: General Security, Programmer Hubris
Sometimes It Seems Like Unix(*) Needs to Learn from Windows

(*) By “Unix”, I mean Linux, Unix, AIX, OS/X, and similar flavours. Way back when, about twenty or so years ago, I was a Unix admin, and a Unix developer. I had to be both, because I was the only person in the company who could spell Unix. My favourite game was to go along to presentations...

Posted to Tales from the Crypto by Alun Jones on Sat, Sep 26 2009
Filed under: Filed under: General Security, Programmer Hubris, What my wife knows, EFS
Would you behave differently in a shared office?

How would you change your behaviour at work if you knew the person seated one desk over worked for a competitor? How would your behaviour change if you knew the person one cubicle over was about to work for a competitor? What if you knew that your cubicle neighbour was going to lose her job (be fired...

Posted to Tales from the Crypto by Alun Jones on Wed, Jul 22 2009
Filed under: Filed under: General Security
How FTP Data Connections Work Part 2 (OR: Fun With Port 20)

As we mentioned in the 1st part of this series , FTP is a more complex protocol than many, using one control connection and one data connection. A recap of the first post… In typical Stream Mode operation, a new data connection is opened and closed for each data transfer, whether that’s an upload, a...

Posted to Tales from the Crypto by Alun Jones on Tue, Jul 14 2009
Filed under: Filed under: General Security, FTP, What my wife knows, Alun's code
How FTP Data Connections Work Part 1 (OR: Don’t Open Port 20 in your Firewall!)

This will be the first of a couple of articles on FTP, as I’ve been asked to post this information in an easy-to-read format in a public place where it can be referred to. I think my expertise in developing and supporting WFTPD and WFTPD Pro allow me to be reliable on this topic. Oh, that and the fact...

Posted to Tales from the Crypto by Alun Jones on Thu, Jul 9 2009
Filed under: Filed under: General Security, FTP, What my wife knows, Alun's code, TCP/IP
Microsoft TechFest

Last week, I went to Microsoft’s TechFest as part of their “Public Day”. This is the first time MVPs as a group have been invited to this event, and although it’s clear we missed some of the demonstrations that are not public-ready, this is something that I hope can be extended to us in future, even...

Posted to Tales from the Crypto by Alun Jones on Tue, Mar 3 2009
Filed under: Filed under: General Security, Things I Learned At Microsoft, Miscellany - not security
If Your GPS Worked Like An Information Security Team

… it would fend off dangerous drivers from hitting you. … it would give you regular statistics on the number of accidents on your daily route, so you could make decisions to avoid newly bad parts of town. … it would help you plan your route to avoid the sorts of areas that have bad...

Posted to Tales from the Crypto by Alun Jones on Fri, Feb 6 2009
Filed under: Filed under: General Security

Page 4 of 14 (271 items) « First ... < Previous 2 3 4 5 6 Next > ... Last »

Questions? Contact Susan at Susan-at-msmvps.com. Each post's copyright held by the original author. All rights reserved. Blog site is an independent site not sponsored by Microsoft.
Our servers would like to thank www.ownwebnow.com and www.exchangedefender.com. We wouldn't be here without the generosity of Vlad Mazek and his companies.

Powered by Community Server (Commercial Edition), by Telligent Systems

Theme based on the Paperclip Blog Theme included in Community Server.
Enhanced to a Site-Wide Theme by Interscape Technologies.