Tasty » Adam Sampson's security bookmarks

Blind Return Oriented Programming (BROP) edit / delete

"Evolving" an ROP attack against an automatically-restarting server. This works by finding two gadgets whose behaviour you can distinguish (e.g. crashing vs. hanging), then constructing ROP chains that will have different behaviour depending on how many items are popped, then trying lots of addresses and combinations of arguments to find gadgets. Neat!

to buffer-overflow exploit rop security ... on 29 June 2015

Debiania — Migrating to LVM on LUKS edit / delete

Constructing an LVM-on-LUKS setup by hand that's the same as the Debian installer will make.

to debian encryption linux luks lvm security ... on 07 June 2015

How We Learned to Cheat at Online Poker: A Study in Software Security edit / delete

Why you want to use a good RNG and a proper shuffle algorithm.

to ag0803 games random security shuffle ... on 07 June 2015

Not A Number - Painless IPSec setup for a home network. edit / delete

A script to automate ipsec with static keys. Neat -- it takes surprisingly little code.

to crypto ipsec network security ... on 23 March 2015

Security/Projects/Bandit - OpenStack edit / delete

A security scanner for Python code.

to python security static-analysis ... on 23 March 2015

Secure Secure Shell edit / delete

Some recommendations for modern SSH configuration. (Note that we've had another major rev of SSH since this was written...)

to openssh security ssh ... on 22 March 2015

Mirage OS edit / delete

"Mirage OS is a library operating system that constructs unikernels for secure, high-performance network applications across a variety of cloud computing and mobile platforms." In OCaml. They've done some nice work around their safe TLS implementation.

to ocaml os security tls ... on 22 March 2015

The IX Multilevel-Secure UNIX System edit / delete

"A collection of papers about the IX system, a simple but comprehensive multilevel-secure operating system with mandatory access control, based on the research v10 UNIX system."

to access-control mac os security unix ... on 22 March 2015

Karl Lunt's Home Page (revised) edit / delete

Various little microcontroller projects, including a neat device to set or clear the lock bit on an SD card, and some Tandy Model 100 stuff.

to avr electronics microcontroller mmc retrocomputing sd security tandy ... on 17 March 2015

Kryptos Logic Research: OpenSSL's squaring bug, and opportunistic formal verification edit / delete

Detecting an OpenSSL bug (after the fact) using formal verification. Interesting because the original formal proof was wrong...

to formal-methods openssl security ssl ... on 16 March 2015