High Quality
Open the downloaded document, and select print from the file menu (PDF reader required).
I
NTERPOLIQUE
(O
R
, T
HE
O
NLY
G
OOD
D
EFENSE
I
S
T
HROUGH
A B
RUTAL
O
FFENSE
)
Dan Kaminsky, Chief ScientistRecursion Venturesdan@recursion.com
A
NNOUNCEMENT
This is my new company. Woot.
Recursion
productizes significant research
y
I
t·s time to do things a little differently
y
This talk isn·t a sales pitch for Recursion, but it·s anidea regarding its philosophy
A S
TORY
Design flaw in SSL
y
The server thought it was resuming, the clientthought it was connecting
P
roject Mogul spawned to fix it
y
Several months in deep secrecy
y
Thousands of hours spent on
I
ETF fix
The fix broke <1% of servers
y
No big deal, right?
Sections
« prev | next »- ANNOUNCEMENT
- A STORY
- REALITY
- THEBADNEWS
- THEGOODNEWS
- SESSIONMANAGEMENT
- A SIMPLEQUESTION
- SIMPLETHINGS, SIMPLYBROKEN
- THE PENTESTERREACTION:
- A MODEST PROPOSAL
- ANATTEMPT
- WHENFAILURE ISSUCCESS:
- OUR PROBLEMWITHLATENCY
- ATMINIMUM
- ONLANGUAGES
- WEAREN·TACTUALLYUSINGTHEM
- ALL INJECTIONSARETYPEBUGS
- ISN·TTHISA SOLVED PROBLEM?
- NOESCAPE
- ACCIDENTALESCAPE
- WHATABOUT PARAMETERIZEDQUERIES?
- REALITYOF PARAMETERIZEDQUERIES
- POSITIONALGENERATION ISN·TANY
- BETTER(C/OMIKESAMUEL)
- (BESTCASEEYETRACKING)
- HOW INJECTIONSHAPPEN/
- HOWDEVSLIKETOWRITECODE
- IS IT POSSIBLE«
- INTERPOLIQUEDEMO[0]
- INTERPOLIQUEDEMO[1]
- INTERPOLIQUEDEMO[3]
- INTERPOLIQUEDEMO[4]
- INTERPOLIQUEDEMO[5]
- WHAT·SGOINGON
- WHATTO INTERPOLATE INTO
- COULDDOESCAPES«
- BASE64: ESCAPINGDONERIGHT
- WHYTHISWORKS
- TWOMODESOFBASE64
- STATICANALYSIS
- AHEM
- BASE64 INTHEOTHERDIRECTION
- DOM INTERACTION: SIMPLE
- DOM INTERACTION: COMPLEX
- IMPORTANTNOTE
- HOWTHISWORKS
- CANWEOPERATEWITHOUTEVAL?
- THESTATUSQUO
- WHYCUSTOM INTERPOLATORSARE
- HARD: THEANCIENTSCOPEWAR
- TOBECLEAR
- YES, THISMEANS
- RISKS
- THEHANDLERSAPPEARRELATIVELY
- SOLID
- EVALADDSSOMERISK
- MANAGINGRISKOFEVAL
- WHATONLYSORTOFWORKS
- PERFORMANCE
- ANYTHINGELSE?
Add a Comment