Dan Kaminsky's Blog

Webcast

Webcast at 1PM Pacific today. Link here.

JeffJuly 24, 2008 at 12:30 pm
Will there be an archive of this webcast available after the fact? You know, for those people who are too busy dealing with this thing to watch live? 🙂
Friðrik Már JónssonJuly 24, 2008 at 2:28 pm
After registration, the event website claimed “This presentation will be available on July 25, 2008 at 01:00 PM Pacific Daylight Time.”
Tomorrow? I had my hopes all up for today.
Friðrik Már JónssonJuly 24, 2008 at 2:30 pm
The confirmation message said:
> Date: July 24, 2008
> Time: 1:00 PM PDT
> Duration: 90-minutes
Now I’m all confused and panicky.
Joe IncredibleJuly 24, 2008 at 5:16 pm
can you please post a link to let us input our own DNS server address, instead of your widget which just looks at my local web browser DNS path?
billyJuly 24, 2008 at 6:13 pm
is it just me or does Dan Kaminsky have the overinflated ego of doom?

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 1,182 other followers

Yet Another Dan Kaminsky Talk: Hard Drive Operating Systems, Storage XOR Execution, Secure Random By Default, Cryptomnemonics, Ending Use After Free in Browsers, Fast Spoofed DDoS Tracing, NSA Crypto Fallout

Black Ops: Practical System-Wide Timing Attack Defense, Real World Entropy Generation For Devices, Safe String Interpolation, Image Loads For Censorship Detection, Certificate Extraction w/ Flash Sockets, Stateless TCP Sockets

Black Ops of TCP/IP 2011: Bitcoin Cloud Deanon/Data Embedding, External Interface UPNP, TCP SEQ# Attacks Revisited, Generic Password to Asymmetric Key Generation, Net Neutrality Validation

Introducing The Domain Key Infrastructure: Zero Configuration DNSSEC Serving, End-To-End Client Integration w/ UI Via OpenSSL and Secure Proxies, Federated OpenSSH, DNS over HTTP/X.509, Self-Securing URLs, Secure Scalable Email
Interpolique: Where's The Safety in Type Safety?, Preventing Injection Attacks (XSS/SQL) With String Safety, Automatic Query Parameterization, How LISP Was Right About Dynamic Scope, Dynamic DOM Manipulation For Secure Integration of Untrusted HTML
Realism in Web Defense: Why Security Fails, What's Wrong With Session Management On The Web, The Failure Of Referrer Checking, Interpreter Suicide, Towards a Real Session Context, Treelocking, The Beginnings of Interpolique

Staring Into The Abyss: Middleware Fingerprinting, Firewall Rule Bypass, Internal Address Disclosure, Same Origin Attacks Against Proxied Hosts, TCP NAT2NAT via Active FTP And TCP Spoofing
Paper (PDF)
Black Ops Of PKI: Structural Weaknesses of X.509, Architectural Advantages of DNSSEC, ASN.1 Confusion, Null Terminator Attacks Against Certificates
Financial Cryptography Paper

It's The End Of The Cache As We Know It: DNS Server+Client Cache Poisoning, Issues with SSL, Breaking "Forgot My Password" Systems, Attacking Autoupdaters and Unhardened Parsers, Rerouting Internal Traffic
Ad Injection Gone Wild: Subdomain NXDOMAIN injection for Universal Cross Site Scripting

Design Reviewing The Web: DNS Rebinding, VPN to the Browser, Provider Hostility Detection, Audio CAPTCHA Analysis

Pattern Recognition: Net Neutrality Violation Detection, Large Scale SSL Scanning, Securing Online Banking, Cryptomnemonics, Context Free Grammar Fuzzing, Security Dotplots
Weaponizing Noam Chomsky, or Hacking with Pattern Languages: XML Trees For Automatically Extracted Grammar, "CFG9000" Context Free Grammar Fuzzer, Dotplots for Format Identification and Fuzzer Guidance, Tilt Shift Dotplots, Visual Bindiff

Black Ops of TCP/IP 2005.5: Worldwide DNS Scans, Temporal IDS Evasion, the Sony Rootkit, MD5 Conflation of Web Pages

MD5 To Be Considered Harmful Someday: Applied Attacks Against Simple Collisions Via Malicious Appendage, Executable Confusion, Auditor Bypass, Bit Commitment Shirking, HMAC Implications, Collision Steganography, P2P Attacks Against Kazaa Hash
Slides (PDF)
Black Ops of DNS: Tunneling Audio, Video, and SSH over DNS

Stack Black Ops: Generic ActiveX, SQL for Large Network Scans, Bandwidth Brokering, SSL for IDS's
Slides (PDF)

Gateway Cryptography: SSH Dynamic Forwarding, Securing Meet-In-The-Middle, PPTP over SSH
Advanced OpenSSH (PDF)