How to secure Wireless Networks

René Pfeiffer/ July 28, 2010/ Security

You have probably followed the news and heard about AirTight Networks’ demonstration of the WPA2 design flaw. What does this mean for operators of wireless networks? Do you have to care? Do you feel threatened? Is there a way to feel better again? First take a look what the design flaw means and what the attack looks like. Hole 196 means that „an insider can bypass WPA2 private key encryption and authentication to sniff and decrypt data from other authorized users as well as scan their Wi-Fi devices for vulnerabilities, install malware and possibly compromise those Wi-Fi devices”. So an attacker has to be authenticated before she can use the exploit. This does not mean that „WPA2” is compromised entirely (yet). It just means that we (maybe) deal with a design flaw. Attacking „WPA2”

Read More

In-Depth Security Conference DeepSec Tackles Mobile Data Assaults

René Pfeiffer/ July 17, 2010/ Press

Vienna – it’s the 4th time that the international IT security conference DeepSec calls the world’s elite from the sectors Network-Security and Hacking together. From the 23rd until the 26th of November 2010 the conference focuses on mobile security (for users and gadgets alike) and Next Generation Infrastructure. „After the success of DeepSec 2009 we try once again to present exciting and controversial topics.  It’s our aim as a neutral platform to bring Hacker-Community, IT- and Security companies, users, government agencies and researchers together to interact and exchange experience and thoughts in workshops and talks.”, prompts René Pfeiffer – one of DeepSec’s organisers. The call for papers is still going until the 31st of July and young security researchers can register for  special support in this year’s U21 programme (U21 means under 21 years

Read More

Sneak Preview – Workshop about Advanced PHP Security

René Pfeiffer/ July 1, 2010/ Schedule

Our CfP ends on 31 July 2010, so we start publishing information about some of the submissions in advance. We got the confirmation from Laurent Oudot, founder of TEHTRI-Security, concerning the Advanced PHP Hacking training. The workshop will deal with breaking into PHP environments, methods of attackers once they are inside, defense against intruders and real hack simulations. This is a hands-on exercise guided by TEHTRI Security experts. Everyone running, developing or auditing PHP web applications should attend. Knowing how attacks work is the first step of avoiding them. When it comes to web applications, there is no silver bullet. You have to deal with the hosting environment, known about possible vulnerabilities, learn about the tools attackers use and then you can tune your defenses. Code analysis, filters, fuzzing, NIDS and hardening alone are

Read More