blocg - security

TrumanBox development continues at SourceForge

nospam@example.com (christian) — Thu, 06 May 2010 11:50:03 +0200

After a couple of requests about TrumanBox 0.1.03 which is available at trumanbox.s6y.org I would like to point you to trumanbox.sourceforge.net where you may find the latest development version provided via subversion. It has many new features and many parts of the code have been rewritten/-structured by Lothar Braun who continued development since July 2009. The only reason for keeping the version at trumanbox.s6y.org online is that it was pretty stable, when I submitted it as a result of my thesis work in July 2007.

RFI Project

nospam@example.com (christian) — Mon, 06 Apr 2009 14:47:46 +0200

As I have mentioned in my previous posting I have had a look at RFI attacks some time ago and planned to publish my results. Since those results were quite outdated we decided to alse collect come new data. Here one of my colleagues had a great idea, which he has also published on his blog. By proposing certain .htaccess configurations we allow others to easily protect themseleves from being rfi attacked while in the same time increasing our data feeds regarding RFI attacking attempts. By now we have put some more work on this and came up with a simple "rfi project" page where we also present some statistics. If you would like to contribute you can do so here. If there are any questions don't hesitate to drop us a line...

Once up on a time I had a closer look on RFI...

nospam@example.com (christian) — Thu, 29 Jan 2009 10:43:08 +0100

While enjoying my first coffee this morning I read about one "Quick RFI Analysis" Jose Nazario published on "The Arbor Networks Security Blog". This reminded me of some research I have been doing at the beginning of last year. Remote File Inclusion (RFI) is an attack usually exploiting vulnerabilities within PHP scripts, allowing to include PHP code from another (remote) server. Even though RFI is well known already for a couple of years it still seems to be an issue, particularly since, as Jose writes in his Quick RFI Analysis: "AV is rarely ever invoked". I am going to publish some of my results in this field as soon as I find some time...

TrumanBox - Internet Emulation

nospam@example.com (christian) — Tue, 02 Sep 2008 07:59:30 +0200

Last week I uploaded the result of my thesis - TrumanBox. Even though it is more than one year ago, I still get requests for the source code every now and then. Hence I uploaded a small website providing the source code and the corresponding thesis. Both can be found here.