ToorCon Seattle 2008
The ToorCon organization puts on some of the best conferences in my opinion, and this last weekend was version 1.0 of their Seattle conference (beta was last year, which I also attended). Friday night was entirely 5-minute lightning talks and then Saturday was entirely 20-minute turbo talks. Sunday was workshops, which unfortunately I could not attend since I had to fly back to Austin mid-day. Last year was invite only and if you were there last year you received a coupon code for a discounted rate this year ($300), otherwise it was a little expensive to attend ($1000). Overall there were a number of excellent speakers with excellent content.
For my thoughts on the various presentations and talks that I saw, please click through to my Personal Blog.
CSI-SX 2008
CSI-SX is the new branding for the CSI NetSec conference, which is co-located with Interop Las Vegas, and is essentially the security-focused portion of the overall conference. As with the annual CSI conference, this conference targets a different demographic than I'm used to speaking for as the attendance is usually comprised of very large enterprise and government employees and I usually speak for conferences targeted at the research and hacker communities.
The night before the first day of conference sessions a speaker reception was held which I attended. I met a number of people from the conference staff whom I had not met before as well as a few of the other speakers. Surprisingly I was well-received by this crowd, even with my spiked green hair, which I'm sure they don't see a lot of at this type of conference.
For my thoughts on the various presentations and talks that I saw, please click through to my Personal Blog.
Adobe Flash Security Update
The latest update for Adobe Flash fixes a handful of security flaws. However, this update also changes how the cross-domain socket policy is enforced. The result is that many Flash applications (such the BreakingPoint BPS 1K and BreakingPoint BPS 10K user interface) will no longer be able to connect to a socket on the originating host. The BreakingPoint Labs team is hard at work on a fix for the UI, but until the 1.2 release containing the fix is available, we are urging our customers to hold off on the Flash upgrade on at least one system. If you have already upgraded to the latest version of Flash and need to downgrade, please see the Archived Flash Players page on Adobe's web site. Our support staff are available to assist customers with this process (1-866-352-6691 prompt 4).
StrikePack 25482 Released
StrikePack 25482 is now available to BreakingPoint customers. This StrikePack adds 16 new strikes, improves no existing strikes, and removes no strikes. This StrikePack also adds support in Appsim for the unix time and daytime protocols.
More Musings on Oracle
Hi, I'm Tod Beardsley. You might remember me from other blogs such as DVLabs and Plan B Security, but now I'm here in the StrikeCenter. It's a fun gig that's about as close to "R&D" as I've gotten -- so far, it's almost exactly half research, half development.
For me, most of the research part so far has been figuring out how Oracle authentication works. If you've ever looked at the Oracle dissector for Wireshark, you've noticed it's pretty sparse. Apparently there are about four people outside of Oracle who do any work at all on the wire protocol, and the guy who wrote a custom parser isn't saying much due to "security factors." This is not surprising, because Oracle's authentication sequence takes forever, with a bunch of pre-authenticated data flying around before access is granted. The sequence goes something like this:
(Client) "Hey Oracle, can I see your database?"
(Server) "What?"
"Your database. Give it to me."
"Oh, sure."
"Great. Here's some encrypted and encoded data."
"Cool, I have some too. Here you go."
"Oh, and I'm a Windows PC."
"I'm a Linux server! We have so much in common!"
"Hmmm."
"Yes...."
"Did you want my machine name? Or my process ID's?"
"Yes, that's what I was waiting for. Here's a session key."
"Oh, okay. I'll use that to encrypt my password. By the way, here's a bunch more info about me."
"Your password? Oh yeah, I haven't authenticated you yet. Just a second."
...and so on.
Now, why there's so much traffic between an unauthenticated client and a expensive enterprise-class server is beyond me; Microsoft SQL Server is a very normal and straight-forward exchange of "Access please, here's my username and password." "Sure thing buddy!" But what do I know, I've never written an unbreakable database server, so all this extra cruft must make it extra secure, somehow.
