Update
Saturday, August 16, 2008 11:34:28 AM
I have some saved posts near completion on debugging that I had completely forgotten about, I'll post these soon (or maybe I should move to blogger now, I'll try it out)
Some security news, I'm not usually involved with windows security, but recently did some experimentation with a few tools I've developed or contributed to at work, and tried making them apply to windows software. I actually found several serious vulnerabilities in Internet Explorer using this method, and the first one was just recently released here (more to come):
http://www.microsoft.com/technet/security/Bulletin/MS08-045.mspx
What has surprised me is that nobody has asked me for any details on the issue I reported, Microsoft didn't give away many details (certainly not enough for an IDS sig), and I haven't released any advisory, so I would have expected one of the big IDS vendors whose entire business model is getting these signatures before vulnerabilities are exploited would want to email me before someone bindiffs the patch, but that hasn't happened (even though I would be more than happy to discuss the vulnerability with anyone who cared).
(Not that IDS offer any real protection or represent real security, of course they undoubtedly reduce overall security by dramatically increasing attack surface, but they do seem to be big business)








Anonymous # Saturday, August 16, 2008 2:15:20 PM
Anonymous # Wednesday, September 3, 2008 12:54:08 AM
Anonymous # Saturday, February 13, 2010 1:57:58 PM
Anonymous # Sunday, April 4, 2010 12:33:11 PM
Anonymous # Sunday, June 13, 2010 6:47:20 AM
Anonymous # Wednesday, June 16, 2010 1:39:08 PM
Anonymous # Thursday, June 17, 2010 8:05:23 AM
Anonymous # Saturday, July 17, 2010 3:24:38 AM
Anonymous # Friday, August 13, 2010 8:36:51 AM
Anonymous # Thursday, March 24, 2011 3:05:02 PM