michaelrash

6 ms·

1.
by michaelrash 8y ago
The design decisions that govern fwknop provide guidance on how fwknop is different from knockknock: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#d...
2.
Speaking of obscurity as a security layer(cipherdyne.org)
1 points by michaelrash 10y ago|0 comments
3.
by michaelrash 10y ago
Not exactly. OpenSSH gated by SPA can only be interacted with by an attacker that can either hijack an SPA-authenticated connection, or is on the same network as the SPA client if the client must go through a NAT. This is a fairly limited s
4.
by michaelrash 10y ago
There are some similarities between this and SPA: -> | SPA / fwknop | ssh There are important differences too though (beyond the fact that SPA is not encrypting/decrypting traffic for SSH itself). SPA is a UDP authenticator so
5.
by michaelrash 10y ago
An adversary who can watch port knocking sequences is one reason why SPA was developed: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#w...
6.
by michaelrash 10y ago
SPA is applicable to arbitrary services - not just SSH. Essentially it is a lightweight UDP authenticator, and it can be applied to commercial VPN's, webservers, or anything else. Achieving asymmetric costs on attackers is easily achie
7.
by michaelrash 11y ago
Some information on this is located in the fwknop tutorial: http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html
8.
Tracking CVE's found by afl-fuzz(github.com)
2 points by michaelrash 11y ago|0 comments
9.
by michaelrash 11y ago
Here is a rebuttal to the "why not" argument: http://www.cipherdyne.org/blog/2013/10/port-knocking-why-you...
10.
Afl-fuzz code coverage with afl-cov(github.com)
23 points by michaelrash 11y ago|0 comments
11.
NAT and Single Packet Authorization(cipherdyne.org)
2 points by michaelrash 11y ago|0 comments
12.
by michaelrash 12y ago
Ok, that sounds like a reasonable alternative, and Brendan Greeg is certainly a powerful force in this area. I'll run dtrace and see what happens, but I'm going to let a current long-running fuzzing run finish first.
13.
by michaelrash 12y ago
On the VM, AFL is rewriting the same small file millions of times, and the fuzzed program is reading this file from disk (as opposed to stdin). I think the main question is why does the OS X activity monitor show a massive spike in disk wri
14.
by michaelrash 12y ago
Remember from the article that AFL is being run from a VM. So, my guess is that OS X (host) doesn't know anything about whether what is being written on the VM is a small file or not. There are two possibilities: 1) either the OS X act
15.
RAM Disks and Saving Your SSD from AFL Fuzzing(cipherdyne.org)
25 points by michaelrash 12y ago|12 comments
16.
by michaelrash 12y ago
First, let me state that I have a lot of respect for Moxie. That out of the way, knockknock is not above criticism too: 1) It is possible to mount a MITM attack against knockknock just by intercepting a knockknock packet, changing the sour