XSA Attack Stopping the cross-site authentication attackNov 01, 2005
A new form of phishing attack deposits an HTML tag on the vulnerable service to trap users into authenticating.more »
Admin Workshop: Resolvers Insider Tips: Resolving Names in DNSOct 01, 2005
The resolver is the window from your computer to the global DNS system. Simply typing a URL awakens a link to computers all over the world.more »
Charly's Column The Sysadmin’s Daily Grind: PortfwdSep 01, 2005
Incoming TCP connections do not always end up where they are supposed to. A freely configurable redirector points digital debris in the direction of a new and better place.more »
TCP Hijacking Understanding and preventing TCP attacksSep 01, 2005
It is quite easy to take a TCP connection down using a RST attack, and this risk increases with applications that need long-term connections, such as VPNs, DNS zone transfers, and BGP. We’ll describe how a TCP attack can happen, and we’ll show you some simple techniques for protecting your network.more »
Socks 5 Examining the generic Socks version 5 proxy protocolJul 01, 2005
Socks is a universal proxy protocol for TCP and UDP that allows internal hosts to securely pass the firewall and authenticates users. This article describes the latest version of the Socks proxy protocol and shows how to implement it.more »
ARP Spoofing ARP spoofing and poisoningJul 01, 2005
Any user on a LAN can sniff and manipulate local traffic. ARP spoofing and poisoning techniques give an attacker an easy way in.more »
Security Intro Knowing the ways of the enemyJul 01, 2005
New flaw in an old encryption scheme leaves the experts scrambling to disable SSL 3
Lennart Poettering wants to change the way Linux developers talk to each other.
Enterprise giant frees itself from ink and home PCs (and visa versa).
Mozilla’s product think tank sinks silently into history.
TODO group will focus on open source tools in large-scale environments.
New tool will look like GParted but support a wider range of storage technologies.
New public key pinning feature will help prevent man-in-the-middle attacks.
Carnegie Mellon researchers say 3 million pages could fall down the phishing hole in the next year.
The US government rolls new best-practice rules for protecting SSH.