XML Web Services provide a flexible API for building distributed systems as a collection of endpoints that can send and receive SOAP messages. These systems are secured using message-based cryptographic mechanisms defined in a series of specifications developed by Microsoft, IBM, and others. Such home-grown security protocols often go wrong; they are prone to a well-known class of attacks, formalized by Dolev and Yao, where an attacker can intercept, modify, and replay messages. The vulnerability is only increased by the flexible message formats and complex trust configurations allowed by the standards. Our goal is to verify the security of families of protocol configurations, such as those deployed for Microsoft’s WSE and Indigo web services implementations.
Read the rest of this entry »

• 0 Comments

SSH (Secure SHell) is a network protocol which provides a replacement for insecure remote login and command execution facilities, such as telnet, rlogin and rsh. SSH encrypts traffic in both directions, preventing traffic sniffing and password theft. SSH also offers several additional useful features:
• Compression: traffic may be optionally compressed at the stream level.
• Public key authentication: optionally replacing password authentication.
• Authentication of the server: making ”man-in-the-middle” attack more difficult
• Port forwarding: arbitrary TCP sessions can be forwarded over an SSH connection.
• X11 forwarding: SSH can forward your X11 sessions too.
• File transfer: the SSH protocol family includes two file transfer protocols.
Read the rest of this entry »

• 0 Comments

With Active Directory, Microsoft has provided administrators with a powerful directory service to organize network data and to control access to network resources from a central point. However, “powerful” by necessity also means complex, and the complexity of Active Directory has probably contributed to slowing down the rollout of Windows 2000 and 2003 servers. Initially, many organizations found simply migrating their flat NT4 domain structures into a more sophisticated Active Directory wrapping to be a significant challenge. By now, many have defined their Active Directory Forests, survived an often cumbersome deployment process, and seen their directories mature into efficient tools for centralized administration. Policies have become the levers of network management, and, as a result, Active Directory has become a repository holding extremely sensitive data.
Read the rest of this entry »

• 0 Comments

The Point-to-Point Tunneling Protocol (PPTP) is used to secure PPP connections over TCP/IP links. In this paper we analyze Microsoft’s Windows NT implementation of PPTP. We show how to break both the challenge/response authentication protocol (Microsoft CHAP) and the RC4 encryption protocol (MPPE), as well as how to attack the control channel in Microsoft’s implementation. These attacks do not necessarily break PPTP, but only Microsoft’s implementation of the protocol.
Read the rest of this entry »

• 0 Comments

The Point-to-Point Tunneling Protocol (PPTP) [HP+97] is a protocol that allows Point-to-Point Protocol (PPP) connections [Sim94] to be tunneled through an IP network, creating a Virtual Private Network (VPN). Microsoft has implemented its own algorithms and protocols to support PPTP. This implementation of PPTP, called Microsoft PPTP, is used extensively in commercial VPN products precisely because it is already a part of the Microsoft Windows 95, 98, and NT operating systems.
Read the rest of this entry »

• 0 Comments

The security mechanisms Known vulnerabilities Tools that are used Live demonstration Who is investigating Adam Laurie CSO of The Bunker Secure Hosting Ltd. DEFCON staff and organizer Maintainer of the Linux Bluetooth stack Marcel Holtmann Martin Herfurt
Security researcher Founder of trifinite.org What is this about What is Bluetooth Bluetooth SIG Trade association Founded 1998 Owns and licenses IP Bluetooth technology A general cable replacement Using the ISM band at 2.4 GHz Protocol stack and application profiles How it works Data and voice transmission ACL data connections SCO and eSCO voice channels Piconet and scatternet topology Frequency hopping 79 channels 1600 hops per second Creating the topology Hopping sequence defines the piconet
Read the rest of this entry »

• 0 Comments

Installation Step 1: Inserting the PC Card Step 2: Connecting your equipment U Interface S/T Interface Connecting your interface to the PC Card Step 3: Configuring the PC Card Windows 95 Windows NT 4.0 Windows NT 3.51 Windows 3.x and DOS Chapter 3 — Windows Configuration Tool Using Setup Wizard Profile configuration Updating firmware Chapter 4 — VT100 Configuration Tool VT100 Configuration Tool activation Profile configuration
Read the rest of this entry »

• 0 Comments

2.1 SYSTEM REQUIREMENTS 2.2 INSTALLING MULBERRY 2.3 GETTING HELP 2.4 STARTING MULBERRY 2.5 DRAG AND DROP 2.6 CONTEXTUAL MENUS 2.7 USING A NETWORK CONNECTION 3. BASIC CONCEPTS 3.1 MODES OF OPERATION 3.2 THE IMAP AND POP PROTOCOLS: ACCESSING YOUR EMAIL 3.2.1 The IMAP Protocol 3.2.1.1 Subscriptions 3.2.1.2 Extensions to IMAP 3.2.1.3 Disconnected Mode 3.2.2 The POP Protocol 3.3 THE MIME PROTOCOL: EMAIL IS NOT JUST TEXT ANYMORE 3.4 THE SMTP PROTOCOL: SENDING MAIL 3.4.1 Extensions to SMTP
Read the rest of this entry »

• 0 Comments