Tag Info

ARM processors are a 32-bit architecture, and are relatively inefficient at doing 64-bit arithmetic operations: when they must compute a 64-bit addition, they must do so with two 32-bit additions and some carry propagation. This is somehow equivalent to x86 used in 32-bit mode (except that recent enough x86 have access to SSE2 opcodes, which offer ...

The biggest risk in any language is to have developers who do not master the said language. Secure development requires thinking of all "corner cases" and it does not work unless the developer knows what he does at all points. A competent C programmer who does not know Java will do more secure code in C than in Java (and vice versa). A case can be made that ...

Most of these operations are "trivial": they replace combinations of two or three existing opcodes. For instance, the BLSR type of instruction is, as specified in the page you link to, equivalent to a subtraction followed by a bitwise AND. This could already be done. Extra operations don't harm, and compilers will benefit from them, and, undoubtly, some ...

You might want to read this http://www.x86-64.org/documentation/abi.pdf Essentially x86 and x64 are different in the way that they work. The new ABI describes the new ways in which it does with Leaf and Non Leaf calls, exception handling and unwinding. Since the purpose is to essentially overflow - you need to understand the new ABI how its working and ...

My gut feeling is that the MVC model, or, for that matter, any cleanly defined model, tends to decrease security risks. Although things are not that clear. From a very general point of view, security issues are a special kind of bug, on the implementation or on the structure (possibly the specification). Knowledge dilution is a huge risk factor: bugs happen ...

What I have done in the past when porting something between languages or working on something that will need to work really closely with a different language is to look up specific language issues on the OWASP website. C / C++ is: https://www.owasp.org/index.php/Category:C Java is: https://www.owasp.org/index.php/Category:Java Hopefully that helps as a ...

First, there is something weird with your example. Current processors which implement the amd64 mode (aka x86_64 aka x64 aka a bunch of other names) don't use the full 64 bits of address registers. They use 48-bit addresses, and make it mandatory that bits 48 to 63 are identical (as if it was "sign extension"). Thus, an address like 7fffffff_ff480a90 will ...

In slightly different words to Thomas: You do potentially increase the attack surface any time you increase the number of devices, layers, roles, developers purely as you have more variables. That said, you do at least have a framework which should ensure that security issues, including those brought by a more complex structure, are identified and ...

On first glance, it appears to be ingenious and a double layer of security. On further thought, it is quite similar to tokenization of credit cards, with 1 pro and 1 con as opposed to tokenization: pro - there are two layers of encryption in two separate systems con - full credit card numbers, although encrypted, are still stored in the business system ...

Since your DMZ host is basically a firewall, the design you described does not make sense, you are completely right. This is no better than one-interface firewall (which is the weakest possible architecture). When using a 2-interface firewall, the two interfaces have be on different networks - e.g. "internet" and the DMZ or the DMZ and the intranet. At the ...

Sounds over complicated and brittle - maintaining this is going to be a pain. How about this for a potential hole: "the key server is called via https and requests a key" If the https request to the key server is protected using a weak (e.g. self signed) certificate, the key exchange connection might be spoofed (e.g. by a MITM attack that returns a ...

The two-interface (aka two-tiered firewall) architecture is all about defense in depth for your internal network. The dirty and clean scenario makes traffic go through 2 different sets of firewalls. The internet-facing firewalls protect your DMZ against external threats, while your internal firewalls protect your internal network from potentially compromised ...