<?xml version="1.0" encoding="UTF-8"?><!-- generator="WordPress/2.9.2" -->
<rss version="0.92">
<channel>
	<title>PhishMe</title>
	<link>http://blog.phishme.com</link>
	<description>Internet Security Professionals comment on innovative phishing ploys, social engineering techniques, and the latest hacks. Bashing or bowing to the latest and greatest news in the security community. Keep up to speed with what phishers, hackers, and spammers are doing or just listen in on the latest geek rants. PhishMe is your one stop blog for the latest in anti-phishing and security news.</description>
	<lastBuildDate>Thu, 19 Feb 2009 17:29:15 +0000</lastBuildDate>
	<docs>http://backend.userland.com/rss092</docs>
	<language>en</language>
	
	<item>
		<title>Moxie Marlinspike Un-masks Tor Users</title>
		<description><![CDATA[It is common knowledge that people get phished on non-SSL HTTP web sites. RSnake has blogged and presented about the weaknesses in todays web browsers that make this possible. These same weaknesses are presumably what Moxie Marlinspike exploited after he thwarted SSL site-validation and encryption via man-in-the-middle (MITM) attacks against HTTP traffic on the Tor [...]]]></description>
		<link>http://blog.phishme.com/2009/02/moxie-marlinspike-un-masks-tor-users/</link>
			</item>
	<item>
		<title>Digital Sampling Theory to the Rescue!!!</title>
		<description><![CDATA[


Hello everyone, I&#8217;m Rajendra Umadas, the newest member of the Intrepidus team. I joined Intrepidus not too long ago and I’m loving every second of it. We just came back from ShmooCon, which was my first security conference. Shmoo was a great experience, and I’m excited to attend further cons. While a few of the [...]]]></description>
		<link>http://blog.phishme.com/2009/02/digital-sampling-theory-to-the-rescue/</link>
			</item>
	<item>
		<title>How do you trust?</title>
		<description><![CDATA[SSL PKI is designed to do two things: encrypt data on the wire, and allow web site validation through the use of trusted third party signatures. The former works pretty well, the Debian weak key debacle aside. Unfortunately, the latter seems about as robust and secure as Windows 98. Case in point, https://discovercard.com. As my [...]]]></description>
		<link>http://blog.phishme.com/2009/01/how-do-you-trust/</link>
			</item>
	<item>
		<title>Nobody is perfect</title>
		<description><![CDATA[Just before Christmas, an admin from StartCom certificate authority disclosed that he was able to procure an SSL certificate for Mozilla.com from a registered agent of the CA Comodo. He was not authorized to obtain this certificate, and the RA and CA clearly failed to properly vette his cert signing request. Shame on Comodo. You [...]]]></description>
		<link>http://blog.phishme.com/2009/01/nobody-is-perfect/</link>
			</item>
	<item>
		<title>More than one way to skin a CA</title>
		<description><![CDATA[Alex Sotirov, Jacob Appelbaum, and crew did some awesome work. They showed that it was possible to exploit RapidSSL&#8217;s use of MD5 for signing certificates in order to create their own rogue CA signing certificate. This exploitation is many orders of magnitude more severe than when I used a loop hole to get the login.live.com [...]]]></description>
		<link>http://blog.phishme.com/2008/12/more-than-one-way-to-skin-a-ca/</link>
			</item>
	<item>
		<title>slithering along a file with python</title>
		<description><![CDATA[
The &#8216;file&#8217; command is a nice tool.  It has a database of filetypes and &#8220;magic&#8221; numbers which correspond to offsets and values within a file and are used to hazard a guess as to what type of file it is.  On my system, the /usr/share/file/magic database has 13474 lines in it.  Quite [...]]]></description>
		<link>http://blog.phishme.com/2008/09/slithering-along-a-file-with-python/</link>
			</item>
	<item>
		<title>IT Security World 2008 &#8212; Wowzerz!</title>
		<description><![CDATA[I just got back from the IT Security World Conference &#38; Expo 2008.  This was the first time I&#8217;ve attended this conference. The speaker line up looked good. I wasn&#8217;t there to see the speakers though; I was an exhibitor working a phishme booth.
I&#8217;ve spoken at DefCon, BlackHat, Shmoocon, etc&#8230;. but at this conference, I wore [...]]]></description>
		<link>http://blog.phishme.com/2008/09/it-security-world-2008-wowzerz/</link>
			</item>
	<item>
		<title>Defcon 16 Review (where have you been?)</title>
		<description><![CDATA[
Better late than never right?
Since we basically missed all of Blackhat except Schmoilito&#8217;s talk this year (hey, pool security is important too), I&#8217;ve made a list of the best Defcon talks I heard this year. To sum it up: Cable Modems, Wifi, NMAP, and Mati Aharoni.
Both Guy Martin&#8217;s and Blake Self&#8217;s talks on cable modems [...]]]></description>
		<link>http://blog.phishme.com/2008/09/defcon-16-review-where-have-you-been/</link>
			</item>
	<item>
		<title>DNS vuln + SSL cert = FAIL</title>
		<description><![CDATA[Authenticating to a web application is a mutual process. Before a user enters credentials into the application, they validate the web applications credentials: its hostname, content, and SSL certificate (assuming it uses SSL).
Essentially, you validate the web site against what you know to be true (hostname and expected content). The browser validates that a trusted [...]]]></description>
		<link>http://blog.phishme.com/2008/07/dns-vuln-ssl-cert-fail/</link>
			</item>
	<item>
		<title>openmoko: cool little linux box</title>
		<description><![CDATA[The OpenMoko project ( http://www.openmoko.org ) has &#8220;freed&#8221; the cell phone. OpenMoko is an open development platform with complete hardware specs (as complete as possible) that runs linux, can be recompiled from scratch from source code, and operates as a normal &#8220;unlocked&#8221; cellular device. This news isn&#8217;t new, but it is the first time I&#8217;m [...]]]></description>
		<link>http://blog.phishme.com/2008/07/openmoko-cool-little-linux-box/</link>
			</item>
</channel>
</rss>

<!-- Dynamic Page Served (once) in 0.314 seconds -->
