osquery: querying host state with SQL
On 29 October 2014 Facebook released osquery, which exposes a system's processes, sockets and files as queryable SQL tables. Technical notes on its architecture and limits.
Read moreCybersecurity
Systems security, detection, cryptography and defensive infrastructure.
MISP: sharing indicators of compromise between CERTs
MISP grew out of Belgium's CyDefSIG in 2013 and is maintained by CIRCL: an event-and-attribute data model, export to Snort/Suricata and OpenIOC, and synchronisation between instances. Notes on the emerging STIX and TAXII formats and on the limits of trust between organisations.
Read more
Suricata 1.0: a multi-threaded IDS engine in C
The Open Information Security Foundation released Suricata 1.0 in July 2010: an intrusion detection engine rewritten in C with a multi-threaded architecture, port-independent protocol recognition and Snort rule compatibility. Technical notes on what changes against the single-threaded model.
Read more
Wireshark 1.0: dissectors as attack surface
Wireshark 1.0 shipped on 31 March 2008. The architecture weighs more than the version number: over a thousand protocol parsers reading hostile input, and the privilege separation that contains the damage.
Read more
OpenLDAP 2.2 as an attack surface
Centralising authentication on OpenLDAP does not remove the credential problem: it moves it from the local password to the channel and the directory's configuration. A technical note on slapd, syncrepl, SASL/TLS and the places where security is actually decided.
Read more
Integrating a bank payment gateway from an unsupported language
What it takes to connect a Python application to a card payment gateway that ships SDKs only for ASP, PHP and Java: a server-side encrypted handshake, a shared secret, HTTP GET transport, and the card number that never touches the shop.
Read more