Entries by 'Will Dormann'

Heartbleed: Q&A

Vulnerability Analysis , Team Software Process (TSP) , Secure Coding 1 Comment »

By Will Dormann
Vulnerability Analyst
CERT Division

Will DormannThe Heartbleed bug, a serious vulnerability in the Open SSL crytographic software library, enables attackers to steal information that, under normal conditions, is protected by the Secure Socket Layer/Transport Layer Security (SSL/TLS) encryption used to secure the internet. Heartbleed and its aftermath left many questions in its wake: 

  • Would the vulnerability have been detected by static analysis tools? 
  • If the vulnerability has been in the wild for two years, why did it take so long to bring this to public knowledge now? 
  • Who is ultimately responsible for open-source code reviews and testing? 
  • Is there anything we can do to work around Heartbleed to provide security for banking and email web browser applications? 

In late April 2014, researchers from the Carnegie Mellon University Software Engineering Institute and Codenomicon, one of the cybersecurity organizations that discovered the Heartbleed vulnerability, participated in a panel to discuss Heartbleed and strategies for preventing future vulnerabilities. During the panel discussion, we did not have enough time to address all of the questions from our audience, so we transcribed the questions and panel members wrote responses. This blog posting presents questions asked by audience members during the Heartbleed webinar and the answers developed by our researchers. (If you would like to view the entire webinar, click here.)

Read more...

Hacking the CERT FOE

CERT No Comments »

By Will Dormann
Senior Member of the Technical Staff
CERT Vulnerability Analysis Team

Will DormannOccasionally this blog will highlight different posts from the SEI blogosphere. Today we are highlighting a recent post by Will Dormann, a senior member of the technical staff in the SEI’s CERT Division, from the CERT/CC Blog. In this post, Dormann describes how to modify the CERT Failure Observation Engine (FOE),when he encounters apps that “don’t play well” with the FOE. The FOE is a software testing tool that finds defects in applications running on the Windows platform.

Read more...

Vulnerabilities and Attack Vectors

CERT No Comments »

By Will Dormann
Senior Member of the Technical Staff
CERT Vulnerability Analysis Team

Will DormannOccasionally this blog will highlight different posts from the SEI blogosphere. Today we are highlighting a recent post by Will Dormann, a senior member of the technical staff in the SEI’s CERT Division, from the CERT/CC  Blog. This post describes a few of the more interesting cases that Dormann has encountered in his work investigating attack vectors for potential vulnerabilities. An attack vector is the method that malicious code uses to propagate itself or infect a computer to deliver a payload or harmful outcome by exploiting system vulnerabilities.

Read more...

Don’t Sign that Applet!

CERT 1 Comment »

By Will Dormann
Senior Member of the Technical Staff
CERT

Will DoormanOccasionally this blog will highlight different posts from the SEI blogosphere. Today’s post by Will Dormann, a senior member of the technical staff in the SEI’s CERT Program, is from the CERT/CC (Coordination Center) blog. This post explores Dormann’s investigation into the state of signed Java applet security.

Read more...