RSS Feed
RSS Feed

  Gunter's Blog

Home to the latest (and exclusive) collection of security blogs and observations of Gunter Ollmann.

Frequency-X_BlogEntry Security Blogging and Damballa - April 11th, 2009
Gunter's changed jobs and now has a personal security blog that gets updated regularly!
Frequency-X_BlogEntry Continuing Business with Malware Infected Customers Whitepaper - November 2nd, 2008
The problem facing online businesses going forward is, if upwards of one-third of their customers are likely to be using computers infected with malware to conduct business transactions with them, how should they continue to do business with an infected customer base? This new whitepaper discusses many of the best practices businesses can adopt for their Web application design and back-office support processes in order to minimize the growing threat of man-in-the-browser malware, along with helping to reduce several of the risks posed with continuing to do business customers likely to be operating infected computers.
Frequency-X_BlogEntry Patching a sick health care system - April 23rd, 2008
My most recently published editorial for SC Magazine covering the problems encountered patching embedded systems within the complex health care environment.
Frequency-X_BlogEntry 2007 Vulnerability Disclosure Rates - February 10th, 2008
According to X-Force, there has been a 5.4 percent year-on-year decrease in the annual disclosure of new vulnerabilities. Why? In this blog entry I examine the probable influences in the decrease - decreasing vulnerability appeal, vendor security testing improvements, professional bug-hunters and vulnerability purchase programs...
Frequency-X_BlogEntry User-Agent Attacks - January 21st, 2008
The concept was quite simple. While most Web sites do a good job of scrubbing user input of unwanted HTML tags and JavaScript, the backend Web traffic analysis engines tend not to. Since just about all Web servers offer various online analysis tools for administrators to review visitor statistics, if these tools didn’t scrub the data correctly it would be possible to launch an attack against the administrator when they logged in.
Frequency-X_BlogEntry Hacking a Boeing 787? - January 7th, 2008
The FAA document entitled “Special Conditions: Boeing Model 787-8 Airplane; Systems and Data Networks Security--Isolation or Protection From Unauthorized Passenger  Domain Systems Access” raises the possibility of mile-high hacking a fly-by-wire multi-million dollar aircraft.
Frequency-X_BlogEntry WHOIS Cross-site Scripting - January 4th, 2008
There’s been a little fuss over a recent posting concerning the threat of WHOIS cross-site scripting. To get your attention, it starts with “This is massive.” Now don’t get me wrong, there is a threat, but it is marginal – and I’ll explain why in a little bit. What’s all the fuss about? Basically, when you register a new domain name (or manage an existing domain name), you...
Frequency-X_BlogEntry Hacking Barcodes- January 1st, 2008
"Barcode systems susceptible to serious hacker attacks" - so says Heise Security, in their article posted yesterday concerning FX's presentation at this weeks 24th Chaos Communication Congress. The article describes a few of the threats to systems that rely upon barcodes (on and two dimensional) - in particular their ease of manipulation for scamming purposes and the possibilities for code injection attacks.
Frequency-X_BlogEntry Commercial Keyloggers - December 30th, 2007
While malware keyloggers are typically developed and deployed by criminal gangs, did you know that there is a whole bundle of commercial-grade software-based keyloggers as well? These commercial keyloggers are designed for use by corporate IT/Security/Audit teams and law enforcement agencies, and they’re way more advanced than their malware cousins.
Frequency-X_BlogEntry Professional Keylogging - December 22nd, 2007
Of all the nefarious techniques that can be used to gain access to a hosts’ data, the keylogger continues to be a perennial favorite.  Whether it’s deployed in hardware or software formats, for as long as people rely upon password protected authentication processes, the keylogger will continue to be a reliable hacking tool. That said, hardware keyloggers seem to be oft-forgotten aspect to hacking (for fun and profit).
Frequency-X_BlogEntry Little Pinkie - October 16th, 2007
I was scanning through el Reg today and stumbled across their funny news-bite "Unimpressed Sheilas mock boy racers' todgers" concerning the recent Aussie TV advertising campaign targeting boy racers. In short (pun intended), females suggest that Australian boy racers are somewhat lacking in the trouser department.  Apparently the campaign has been a roaring success and has helped reduce speeding down under.
Frequency-X_BlogEntry Pained by Security Analogies - September 21st, 2007
Whenever I have to resort to using some kind of physical-world analogy to explain an Internet security principle, I can't but feel that I'm doing a disservice to the people listening.  Depending upon the audiences involved, my analogies have ranged far and wide - jumping from classic home security defenses (e.g. burglar alarm, deadbolts, fences, etc.) through to safety devices in cars (antiskid breaking, airbags, roll-cages, etc.) and even bank surveillance systems (e.g. steel vaults, video cameras, timed locks, etc.).
Frequency-X_BlogEntry Updated - September 1st, 2007
It's been a while, but I've finally managed to refurbish the Website.  As part of the refurbishment I've tried to simplify the interfaces and consolidate a lot of the content into a better hierarchical structure.

    Copyright 2001-2008 © Gunter Ollmann