Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
Security

Submission + - The CookieMonster Demands Satisfaction (fscked.org)

mikepery writes: "------ Begin Cut Here —
Note to slashdot editors: Hey guys, I was wondering if you could help me out a bit to correct for the fairly inaccurate article you featured about my HTTPS hijacking work being a Gmail-specific attack tool. I want to make sure the record is set straight, and people realize that a lot more sites are potentially affected than just Gmail, so that they can ensure they are fixed properly.
------------ End Cut Here —

I figure the slashdot readership is the best place to reach a large number of slacking admins and developers, so I want to announce that it's been 30 days since my DEFCON presentation on HTTPS cookie hijacking, and as such, it's now time to release the tool to a much wider group. Despite what was initially reported, neither the attack nor the tool are gmail-specific, and many other websites are vulnerable. So, if you maintain any sort of reasonable looking website secured by any SSL certificate (Sorry Rupert, you lose on both counts), even if it is just self-signed, you can contact me and I will provide you with a copy of the tool. Be sure to put "CookieMonster" in the subject, without a space.

I'd also like to encourage security professionals and consultants to request a copy of the tool for use in encouraging their clients to adopt SSL properly for their websites. There's no possible way for me to reach every site, but if convincing demonstrations can be given of the vulnerability on an individual basis, perhaps that will drive the issue home much more than the press alone has done. Heck, the tool might even land you a few new clients."

Comment Re:Law Enforcement and Technology (Score 5, Insightful) 489

Sounds fine to me; We have to keep our law enforcement departments up to date with technology. I would gladly trade my privacy in silly conversations for the safety of a secured America. The only people who don't like this stuff are people who have something to hide.

That's nice for you, but I wouldn't trade my privacy in silly conversations for the (illusion of) safety in America. Neither would a lot of other people. The problem is, you can't just trade your privacy by endorsing wiretaps. You're trading everyone's privacy. Perhaps you'd like to write a letter allowing the government to listen to all the conversations they want, read your emails, and rifle through your files, but don't speak for the rest of the country.

Comment Re:RE/Cracking tutorials and games (Score 1) 211

Yeah, this is basically the exact reason why we're working on this book. Because there are SOOOoooooo many tutorials and atricles about doing specific things, and yet no one has documented a general approach.

Thanks for the links, will be traversing these for general ideas and assimilation ;)

Slashdot Top Deals

You might have mail.

Working...