Masking Credit Cards for PCI
PCI DSS, the security standard for companies that handle credit cards, defines a number of rules as to how credit cards are handled. One of those rules, 3.3, is defined as follows: Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed). So based on this requirement I assumed that the code to do this would be common and widely available; much to my surprise there are rather few samples that do this, and of those I found they only showed the last four (which when you are handling a lot of credit cards, searching for an account by the last four isn’t all that helpful) and were often rather fragile.
Read more…Why Cringely is wrong about Java
A couple of days ago I was sent a link to Robert Cringely’s latest treatise: The second coming of Java – and to say I disagreed was a bit of an understatement. To me, it represents a fundamental flaw in his perception of developers, and more importantly the economics of software development. The key to Cringely’s argument comes down to this: When SSDs gain enough capacity there will be a shift from the Ruby world back to the Java world.
Read more…Pen-Testing Silverlight+RIA with SoapUI
I was recently given the task of ensuring that a Silverlight+RIA application that could contain private information was secure for deployment to a public web site. So I started searching for automated pen-testing tools that could work against Microsoft’s Binary SOAP protocol (msbin1, a.k.a application/soap+msbin1) and found only disappointment. For various reasons, it’s significantly more complex to pen-test an application using msbin1 than traditional SOAP + WSDL. To properly test the services, I had to make a compromise: temporarily modify the application to expose a SOAP endpoint.
Read more…A brief look at the latest @LulzSec release
Earlier today, the hacker collective Lulz Security released a batch of 62,156 email/password combinations from unknown sites; I decided to take a look at the data and see if there was anything to be learned from it. And as always, LulzSec delivers: mediafire.com/?9em5xp7r0rd2y… 62,000+ emails/passwords just for you. Enjoy. — The Lulz Boat (@LulzSec) June 16, 2011 So, let’s take a look at a few stats: Total Domains: ~5,230 Top 15 Domains:
Read more…bbPress 2.0 (beta-1) released!
This morning, the latest version of my favorite forum software, bbPress, was released. While this is a beta and not a final release, it’s still a major event for the project: this release is in the form of a WordPress plugin, instead of a stand-alone application as it’s been in the past. In December 2009 I wrote about this decision – and at the time I was rather disappointed with the change in direction; but now my views have changed.
Read more…Happy 20th birthday Visual Basic!
Today I saw a post on Facebook by a friend of mine, Anthony Green, about writing his first blog post as a Microsoft employee (he has a personal blog as well, unfortunately he’s not written anything since 2008) – when I saw the title, I couldn’t believe it was 20 years already – seems just yesterday that I wrote about its 15th birthday: Happy 20th Birthday Visual Basic! My, what a journey it’s been.
Read more…VB6: Not so open source
Earlier today, a rather surprising tweet hit, being retweeted at least 80 times, including by a few rather influential people in the .NET world: Microsoft announces to mvps at #msteched that VB6 will be released as open source on codeplex end of june! w00t — Roy Osherove (@RoyOsherove) May 19, 2011 Needless to say, that’s not an announcement that anybody was expecting, but given the talk going on at the time – and the high-profile people talking about it, there wasn’t much reason to doubt.
Read more…Errors on ‘gem install mysql2’
On my fresh Ubuntu 11.04 box running Ruby 1.9.2 instead of the standard Ruby 1.8, I ran into some undocumented errors while installing the mysql2 gem. Here’s what I was seeing: $ gem install mysql2 Building native extensions. This could take a while... ERROR: Error installing mysql2: ERROR: Failed to build gem native extension. /usr/bin/ruby1.9.1 extconf.rb <internal:lib/rubygems/custom_require>:29:in `require': no such file to load -- mkmf (LoadError) from <internal:lib/rubygems/custom_require>:29:in `require' from extconf.
Read more…Facebook Scams
As a tip for all my Facebook friends, despite the promises you see spreading wildly across Facebook, you can’t see who’s looking at your profile. If you ever see anything like this, it’s a scam – pure and simple: If you ever see a page like this, or one that asks you to paste a script into your address bar as this one does, please immediately report the page. If you see any of your friends ’like’ a page like this or send messages linking to something like this, please warn them – they have likely handed their account over to a scammer or other bottom-dwelling script-kiddy.
Read more…Microsoft & Skype: PR Failure?
While looking at the reactions to Microsoft’s acquisition of Skype, I found one tweet that really stood out: How you know you have a PR problem: As soon as you buy popular service X, their userbase starts posting alternatives #skype #Microsoft — Ted Han (@knowtheory) May 11, 2011 While many users are busy joking about names (personally my money is on “Microsoft Live Skype” – my only hope is that there isn’t an “Ultimate Edition” or “Unicorn Edition” tacked to the end of the name) Microsoft has a significant problem, and I really hope they are looking at public reaction.
Read more…
About Me
Security researcher, engineer and software developer with more than 20 years of experience.
Work: I primarily focus on application security, usable security, secure communications, and cryptography. I build and lead strong and dynamic teams, who cover all facets of security and privacy.
Writing: I write about my research, security in general, development and software design, and leadership through my blog, essays, and various publications. I also engage in some creating writing when I can.
Photography: I am a purist fine art photographer, working primarily in black & white, and focused on sharing new perspectives of the world. Limited edition prints of my work are available on my online gallery. I also have a background in photojournalism, and volunteer in this field when I can.