Threat Level: green Handler on Duty: Pedro Bueno

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Transmiting logon information unsecured in the network

Published: 2010-07-24
Last Updated: 2010-07-25 04:02:44 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
5 comment(s)

There is nothing new on the issue of unsecured sensitive data traveling across the network in plain-text. In fact, many popular websites use SSL to crypt information because they became aware of the man in the middle attack, so owners secured their webpages to avoid the attack.

Unfortunately, there are many companies that thinks nothing will happen if they use plain-text to send logon information. You can say there is no problem with hashed passwords, but they are not enough. Rainbow tables are widely used so if a hash is grabbed from the network, it will be cracked in no time.

Delivering SSL and authenticating both ends might be a cheap and reliable solution for this. Yes, I know SSL is vulnerable to Man-in-the-middlle attacks, but it you authenticate certificates on both ends and pay attention when something like this appears, the risks is adecuately minimized:

SSL Error 

How many of us have clicked directly into continue to this website without paying attention on what is the error in the certificate?

I have seen universities where students capture professor's usernames and passwords and start to sell grade changes. I have seen many hijacked e-mail accounts on ISPs that doesn't crypt logon information.

These controls are easy to deploy: IIS has SSL client certificate authentication and  Apache also implements it. If you use all the available security functionality you have in your IT infrastructure, you will minimize many information security risks like this one.

-- Manuel Humberto Santander Peláez | http://twitter.com/manuelsantander | http://manuel.santander.name | msantand at isc dot sans dot org

5 comment(s)

GnuPG gpgsm bug

Published: 2010-07-24
Last Updated: 2010-07-24 06:11:43 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
0 comment(s)

gpgsm is a tool similar to gpg designed to provide digital encryption and signing services on X.509 certificates and the CMS protocol. There is a bug with this tool when importing a X509 certificate with more than 98 subject alternate names or implicitly while verifying a signature.

Version 2.0.16 is affected and older versions should be affected as well. More information at http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.html

-- Manuel Humberto Santander Peláez | http://twitter.com/manuelsantander | http://manuel.santander.name | msantand at isc dot sans dot org

Keywords: gnupg gpgsm X509
0 comment(s)

Types of diary: One liners vs full diary

Published: 2010-07-24
Last Updated: 2010-07-24 06:11:21 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
5 comment(s)

We would like to clarify something to our readers because of an e-mail received today. There are two types of diary: One-liners where we tell you things you should know and where we don't have anything else to add and full diaries where we discuss a subject. For example, we use one-liners to talk about many updates on popular software. We just point you to the link. These are not advertisement to other companies :)

-- Manuel Humberto Santander Peláez | http://twitter.com/manuelsantander | http://manuel.santander.name | msantand at isc dot sans dot org

Keywords: types diaries
5 comment(s)
Diary Archives