Archive for April, 2010

SSL Renegotiation Vulnerability

  • Posted April 29, 2010 at 21:41

In November 2009, the renegotiation vulnerability over SSL/TLS based protocols was published.  SSL renegotiation is a new SSL handshake over an already established SSL connection.

The attacker sits between the client and the server and applies MITM attack. The idea of the attack is as follows:
Read the rest of this entry »

No Comments
Filed under: Cryptography

Application Security Assessment @ IBM

  • Posted at 21:31

Two nice articles from Dinis Cruz (Chief Owasp Evangelist) regarding application security assessment by IBM:

2 Comments
Filed under: Security Assessment

IBM Database Encryption Expert

  • Posted at 21:30

For a customer project, we were asked a tool for database encryption. After some googling, I came across IBM Database Encryption Expert, which seems a great tool:

  • It encrypts and decrypts transparently the files on file systems and provides clear text context only for the authorized specified in the access control policies
  • It provides encryption of DB2 databases in offline mode (e.g. backup of databases)
  • It provides encryption of DB2 databases in online mode as well
  • It provides an interface for key management (encryption keys are stored within the DB2 database of Security Server in encrypted form)

Here is a video showing the tool in interaction.

What I wonder is the performance of online encryption. Does anybody have any experience with this issue?

No Comments
Filed under: Database Security

Google Advanced Search

  • Posted at 00:07

I  often use Google advanced search parameters. It helps to find target information in shorter time. in addition, irrelevant information can be easily removed from the search results. Here are some examples:

site: To filter results according to domain name

“security” site:ibm.de (security relevant information from ibm.de domain)
“security” site:com (security relevan information from all .com domains)

inurl: To filter results according to certain keywords in url

inurl:security (all web pages which contain the keyword “security” in their urls )
inurl: security site:ibm.com (all web pages from ibm.com which contain the keyword “security” in their urls )

ext/filetype: To filter results according to file type

security ext:ppt (security presentations)

There are other parameters as well: intitle, intext, cache etc. For more details, see http://www.googleguide.com/advanced_operators.html

No Comments
Filed under: General