359 reputation
16
bio website palant.de
location
age
visits member for 3 years, 3 months
seen Aug 23 '12 at 6:26

I am primarily a Firefox add-on developer these days. My main areas of expertise is everything Mozilla-related (XUL, JavaScript, XULRunner etc.), web technologies (HTML5, CSS etc.), web application security, Perl, Python. Some C++, Java and PHP is also doable but I am by no means an expert here.


Sep
24
awarded  Autobiographer
Sep
8
awarded  Yearling
Jan
19
awarded  Commentator
Jan
19
comment ASP.NET HTTP Response Splitting Attack
I would be very surprised if HTTP Response Splitting were possible. This is an attack that is trivially solved by the framework, it usually affects applications not using any framework or using one that is immature. HttpResponse.AppendHeader simply has to disallow newlines in header names and values, this is sufficient to prevent the attack. And I mostly certain that it does that and what you've hit here is actually the second line of defense.
Oct
25
awarded  Nice Answer
Oct
24
comment What file formats are known to be unsafe?
@pepe: Yes, maybe. I find it remarkable however that the archive file trick is still being used - so maybe it isn't about AV scanners after all, they often fail to recognize most current malware anyway. The point might be to trick the "stupid" email filters that simply don't allow any executable attachments.
Oct
24
comment What file formats are known to be unsafe?
@user606723: .reg files cause a huge UAC warning in newer Windows versions that makes them unsuitable for anything malicious. If somebody sends you a .reg file and you open it without suspecting anything you will most definitely not give it privileges. You are again mixing up things that might theoretically be dangerous and ones that are really dangerous because commonly used for malicious purposes (due to the large attack surface).
Oct
24
comment What file formats are known to be unsafe?
@user606723: Postscript is covered by the first sentence. It is a theoretical danger but practically irrelevant because there is no widespread application to attack.
Oct
24
comment What file formats are known to be unsafe?
@user606723: See RSA hack for example. Flash is a commonly used attack vector, especially when not kept up to date (which happens often due to the crappy updater). There are lots more Flash vulnerabilities being discovered than those VB macro issues. And - yes, the only reason attackers prefer Office files over HTML is that they are less suspicious and that Internet Explorer won't automatically run Flash in local HTML files.
Oct
24
answered What file formats are known to be unsafe?
Sep
12
comment /dev/random security holes
The only kind of issue I can think of would be predictable random numbers - and of course any such issue that has been publicized is already fixed.
Sep
9
comment Why are CA's signing keys available on the internet
@Piskvor: As I said, I think that proper manual control (in addition to firewall/IDS/whatever) would give you the best results. In the end, if you carry as much responsibility as a CA you should have multiple protection layers. But I don't think that USB sticks are the best way to ensure manual verification, the mere fact of carrying over the stick won't produce reliable results. ;)
Sep
9
comment Why are CA's signing keys available on the internet
@this.josh: I don't think that I said anything different. But it just doesn't make sense to kill the connection and replace it by "USB sticks" - same effect can be achieved with a firewall or whatever.
Sep
8
awarded  Teacher
Sep
8
answered How safe are copies of Firefox that are on various Mozilla mirror sites?
Sep
8
comment Why are CA's signing keys available on the internet
@billybob: Sure, I simplified the request validation step. But it involves pretty significant communication of CA employees with the customer (particularly for EV certificates) and this cannot realistically be done without Internet connection (a CA who only accepts printed letters will go out of business immediately). So you can isolate the signing step but the request validation step remains a vulnerability.
Sep
8
answered Why are CA's signing keys available on the internet
Sep
8
awarded  Citizen Patrol
Sep
8
comment Why are CA's signing keys available on the internet
I don't think I understand your question. Your assumption that private keys of either Comodo or DigiNotar have been stolen is definitely wrong however. The private keys are still safe but the hackers were able to make CA's hardware sign their certificates. At least for DigiNotar this happened indirectly, the computers in question didn't have a direct connection to the Internet.
Sep
8
awarded  Supporter