I just got back from London and the RSA Europe conference, I've had a great week! In addition to a solid program, the conference is a hotspot of highly skilled professionals. I ended up in a lengthy discussion at the Microsoft stand on the possibilities of the new Forefront Threat Management Gateway (TMG), and the Unified Access Gateway (UAG). One chat with a Microsoft professional, and I learned that the UAG is much more versatile than the official webpages indicate. Of course, I had many more interesting conversations with both sponsors and visitors to the conference. I have to mention that I was fortunate enough to bump into Steve Lipner from Microsoft while I was on my way from one session to another. I happened to be carrying around my SDL-book, he was kind enough to sign it. Good stuff!
I'll summarize some of my favorite sessions from the conference:
Bruce Schneier's keynote on "Security, privacy, and the generation gap" was great. He touched upon many interesting aspects of privacy, like how we do our privacy decisions (how we give it up), or the social challenges we face when spending time on social networks. He referred some very interesting research, here's one of the examples: In group A each person is given an anonymous value coupon worth $8 with the option of exchanging it in a coupon worth $10 — but the $10 coupon would include the person's name and address. In group B the setting is reversed, each person receives a $10 coupon with their name and address on it, and gets the option of switching it for an anonymous $8 coupon. One would expect to find the same pattern in both groups. However, the group who received their anonymous coupons first were more reluctant to give up their privacy! I've tried to find an article on the study, without success. I'll add the link here if I can find it, it's thought provoking stuff.
My metric of a good keynote is to which extent it makes you think. After Schneier's talk, I had a lot to think about!
Application level DoS
Bryan Sullivan from Microsoft's SDL team gave an important talk: "When a billion laughs are not so funny: application-level denial of service". He discussed a class of very potent attacks, where a carefully crafted attack will consume server side resources to the point where the server resources are depleted. The interesting aspect of these attacks is the assymetry. By sending a request which is only a couple of hundred bytes, the server can be triggered to consume all of its memory and/or cpu. Sullivan made a point of the assymetry, and also the difficulties in detecting or preventing these attacks — other than writing secure code in the first place of course.
Sullivan gave two important examples, one for regex and another for XML parsers. To aid in the detection of vulnerable regex statements, the SDL team has released a Regex Fuzzer. On that link, you'll also find references to how the vulnerability works. There's also an MSDN article on the challenges with XML parsing, check it out — especially if you're consuming untrusted XML!
Attacking mobile messaging
Another great session was the "Attacking mobile phone messaging" by Lackey and Miras. It was no surprise that the telephone system had major vulnerabilities. However, Lackey and Miras had set up an attack showing just how flawed the design of the administrative part of the mobile phone system is. Great presentation, a great demo, and they were both excellent speakers. And yeah, the mobile messaging system has major issues.
Adobe's Peleus Uhley gave a great talk on the security model for flash content and how to develop more secure flash applications. I haven't been working on flash content security before, so this was a brave new world for me. Uhley gave a great overview on how the whole Flash-model worked and what the challenges are as a Flash designer/developer. In short, treat your Flash animations with as much care as your do with your web applications! Check out the Owasp Flash Security Project to get up to speed, it's run by Uhley and contains all the important references you need.
And the other stuff
There were a lot of other interesting sessions but — like always at a conference — you once in a while realize that you went to the wrong session. That's how it goes! Apart from the sessions mentioned above I attended the sessions that where either SDL oriented, or targeting more technical security.
There was of course a vibrant social life after the formal program ended, I had great fun. I'm not outing anyone here, so: Thanks guys, you know who you are! :)
© André N. Klingsheim and www.dotnetnoob.com, 2009-2015. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to André N. Klingsheim and www.dotnetnoob.com with appropriate and specific direction to the original content.
Read other popular posts
I guess it was long overdue for me to follow up on my Hardening Windows Server 2003 SSL/TLS configuration and Windows server 2003 vs 20...
I just found out that Terminal services manager does not exist in Windows 7. But fear not, the Remote Desktop Services Manager will do the ...
Yesterday I was playing around with the validateIntegratedModeConfiguration="true" setting on IIS 7.5. To my surprise I got an ...
Security headers in an HTTP response There are many things to consider when securing a web application but a definite "quick win&qu...
The release of Firesheep a week ago brought a lot of attention to a problem that has been known for many, many years: cookies sent over both...
OWASP recently released their Top Ten 2013 list of web application vulnerabilities. If you compare the list to the 2010 version you’ll see t...
Though Windows Server 2003 has been around for a while, we'll still see them around the Internet for many years to come. Despite their u...
If you work in an environment where several people fiddle around on the same servers, every once in a while you'll get the message "...
I'm baffled. IIS 7.5 does not log to files by default, you have to enable the feature manually. In the settings it's called "HT...
If one of your ASP.NET applications need to access to a certificate from the certificate store along with its private key, you'll probab...