VB Migration

Tag: cryptography

  • VB2016 preview: Cryptography mistakes in malware

    “Don’t roll your own crypto”, software developers are often told: cryptography is hard and thus it is always safer to use a well-tested public library rather than writing your own implementation. Not everyone heeds that advice though, and among those not listening are the developers of various malware families. In a paper to be presented…

  • VB2016 preview: Cryptography mistakes in malware

    “Don’t roll your own crypto”, software developers are often told: cryptography is hard and thus it is always safer to use a well-tested public library rather than writing your own implementation. Not everyone heeds that advice though, and among those not listening are the developers of various malware families. In a paper to be presented…

  • How broken is SHA-1 really?

    Earlier this month, I gave a talk entitled ” How Broken Is Our Crypto Really? ” at the RSA Conference in San Francisco. In the presentation, I looked at vulnerabilities found in cryptographic protocols and analysed the likeliness of these being exploited in practice. I spent a few minutes talking about SHA-1 and stated that…

  • Throwback Thursday: Hash Woes

    Just last week, VB Editor Martijn Grooten addressed an audience at the RSA Conference in San Francisco on the topic of cryptographic protocols that have supposedly been broken in recent years, including the SHA-1 hash function which is considered all but broken. Back in 2004, the entire crypto community was abuzz with the astonishing news that a…

  • RSA and BSides San Francisco

    Next week, almost everyone with a stake in or an opinion on IT security will be in San Francisco for the annual RSA Conference . I will be there as well, and although Virus Bulletin doesn’t have a booth at the event, I am looking forward to meeting old and new friends and discussing our…

  • ‘NOMORE’ attack makes RC4 a little weaker again

    No good reason to continue using the stream cipher, yet attacks remain impractical. Researchers from the KU Leuven have presented a new attack against the RC4 stream cipher called ‘NOMORE’, which is short for Numerous Occurrence MOnitoring & Recovery Exploit. While it is really good research, and while it re-emphasises the point that the cipher…

  • Weak keys and prime reuse make Diffie-Hellman implementations vulnerable

    ‘Logjam’ attack possibly used by the NSA to decrypt VPN traffic. A group of researchers have discovered a number of vulnerabilities in the way the Diffie-Hellman key exchange protocol is deployed and have demonstrated an attack (dubbed ‘ Logjam ‘) that exploits these vulnerabilities. Diffie-Hellman is used by two entities (typically referred to as Alice…

  • FREAK attack takes HTTPS connections back to 1990s security

    Golden keys from the (first) crypto wars have come back to haunt us. When a web client makes a secure connection to a web server (using HTTPS), it starts by sending a ‘Hello’ message in which it announces which cipher suites it supports. The web server then chooses one, presumably the one that offers the…

  • Book review: Bulletproof SSL and TLS

    Must-read for anyone working with one of the Internet’s most important protocols. I was reading Ivan Ristić’s book Bulletproof SSL and TLS when rumours started to appear about an attack against SSL 3.0, which would soon become commonly known as the ‘ POODLE ‘ attack. Thanks to the book, I was quickly able to read…

  • Black Hat Europe – day 1

    Programme packed with interesting talks. Though the prestige of Black Hat Europe doesn’t compare to that of its American parent conference, and the event certainly doesn’t dominate the debate on Twitter in quite the same way, more than 800 security experts descended on Amsterdam this week where, in the RAI Convention Centre, the 14th edition…