January 2006 - Posts
I've been using the current builds for ages now, here's my top reasons for using IE7 (beyond pure security and engineering): Printing is better (there was this really nasty habit of truncating on the right margin) Support for RSS and OPML in the browser.
Read More...
When exploiting a buffer overrun vulnerability, the goal of an attacker is usually to change the flow of execution from the normal execution flow to a flow dictated by the attacker. Sure, he may want to whack a DWORD in memory or change a variable, but
Read More...
One of the crypto guys here pointed this out to me last night, it's kinda cool. A small web-app to determine how long a key should be to provide adequate protection up to a specified year. There are a few other options in there too... http://www.keylength.com
Read More...
From http://channel9.msdn.com/Showpost.aspx?postid=157668 "This Fall, Microsoft hosted the second annual Blue Hat conference on Campus. The audience was primarily Microsoft employees who write code, as well as executives from around the company. Security
Read More...
There has been a lot of press recently about using ‘code scanning’ tools to find security bugs in source code. So I thought I’d share my view on code scanning tools. Such tools, often called static analysis tools, such as the tools we have included in
Read More...
CERT has released a Web-based library for information assurance, forensics and incident response. I've poked around, it looks pretty good. http://vte.cert.org/
Read More...
I'm not 100% sure why no-one seems to have picked up on this, Russinovich decided to do his own analysis of the WMF flaw to see if Gibson's belief that WMF/SetAbortProc() is an intentional backdoor. Of course, it's not! Here's Mark's analysis: http://www.sysinternals.com/blog/
Read More...
I just received an email from a product group wanting to replace a small number of calls to strlen with strlen_s to help them be SDL compliant. Problem is, there is no strlen_s ! :( So I had a chat with Martyn Lovell, who headed the SafeCRT work to find
Read More...
You heard it here first, if you use MmSecureVirtualMemory, you should be aware that there are some potential reliability issues. By the way, 'secure' is a verb in this case, not a noun. If you run PRE f ast on code using this function and it's not in
Read More...
Apple has released a patch for Quicktime that fixes a bucket-load of image parsing bugs. If you're a Windows user, you should apply th patch ASAP. The clock is ticking. http://www.us-cert.gov/cas/techalerts/TA06-011A.html
Read More...
