How to find security holes

http://canonical.org/~kragen/security-holes.html

by iamwil • 17 years ago

16 14 17 years ago

khandekars2• 17 years ago

:-) Somewhat related: Bruce Schneier's "Self-Study Course in Block Cipher Cryptanalysis," http://www.schneier.com/paper-self-study.html

tptacek2• 17 years ago

This paper is pretty cryptic and (I think) unhelpful, for a couple reasons, not least the fact that protocol breaks kill far more systems than block cipher analysis. But it is still an interesting challenge.

Worth mentioning here is that there may be 5000 full-time vulnerability researchers worldwide, and fewer than .1% of them will ever even do protocol crypto. Not that that those 5 people aren't awesome.

khandekars2• 17 years ago

Correct. At the same time, even trying to break a protocol is an interesting activity and improves the fertility of mind. That would help in the areas like identifying security holes in a system.

pj2• 17 years ago

Wow, when I click this link I get

opera:fraud-warning:

The page you are trying to open has been reported as fraudulent. It will likely attempt to trick you into sharing personal or financial information. Opera Software strongly discourages visiting this page.

I don't know why, so I'm not continuing... I've only seen this message once before.

treo• 17 years ago

I think thats because of what rythie said: "Also canonical.org != the people who make Ubuntu (that's canonical.com)"

kragen3• 17 years ago

Wow, holy shit. Is there someone we can talk to at Opera about that? Would you be willing to get me a screenshot of the message and tell me what version of Opera you're running? I'd like to find out who reported that, and why. The page in question doesn't contain any scripts or interactive features of any kind. (I just looked at it on the server with less to make sure nobody had, say, injected some script tags since the last time I looked. Nope.)

pj2• 17 years ago

it's the same as what happened as reported here, same image as well http://www.joycebabu.com/blog/google-being-reported-as-fraud...

rythie4• 17 years ago

From the article:

"Note: I haven't found any security holes, so take this with a pillar of salt."

rythie4• 17 years ago

Also canonical.org != the people who make Ubuntu (that's canonical.com)

kragen3• 17 years ago

Yeah, we point that out on the front page of the site. We didn't think it was necessary to point it out on every single page. The page in question was last edited five years before Canonical Ltd. was formed.

kragen3• 17 years ago

For what it's worth, I have found a few since I wrote the article, and I still think the article is okay (although kind of outdated in some ways). I've fixed a few, too. Hopefully I've fixed more than I've created.

rythie4• 17 years ago

That's good to know, I would suggest for credibility, stating these instead of the sentence you have.

tptacek2• 17 years ago

This is a fine way to get started looking for vulnerabilities, but a very bad yardstick for testing software by.

How to find security holes

Related Stories