Skip to content
Hallway
0:00 / 0:00

#ssl#tls#sslstrip

DEFCON 17: More Tricks For Defeating SSL

Christiaan008

73K subscribers • 19 videos on Hallway

YouTube
  • Recommended by 2 people: 2 in engineering communities.
  • Presented by Moxie Marlinspike, security researcher

Advanced. Deep dive for people who know the field.

93K views15 years ago2 recommendations

SecurityCryptographyExploits and vulnerabilitiesNetworking and protocols

Moxie Marlinspike demonstrates advanced techniques and tools for defeating SSL and TLS connections beyond basic SSL stripping.

Speaker: Moxie Marlinspike This talk aims to pick up where SSL stripping left off. While sslstrip ultimately remains quite deadly in practice, this talk will demonstrate some new tricks for defeating SSL/TLS in places where sslstrip does not reach. Cautious users, for example, have been advised to explicitly visit https URLs or to use bookmarks in order to protect themselves from sslstrip, while other SSL/TLS based protocols such as imaps, pop3s, smtps, ssl/irc, and SSL-based VPNs never present an opportunity for stripping. This talk will outline some new tools and tricks aimed at these points of communication, ultimately providing highly effective attacks on SSL/TLS connections themselves. For more information visit: bit.ly/defcon17_information To download the video visit: bit.ly/defcon17_videos

Why it's here

2 people recommend this

What people say. Recommended as a terrifying but essential talk on how SSL can be broken in practice.

u/Chandonin r/netsec • Recommends

It turns out that SSL is utterly broken in practice
9View on Reddit

u/SanityInAnarchyin r/compsci • Recommends

On “What is it about Adobe Flash that makes it a weak link in internet browsers?”

See, this much I agree with: > no, but open source != secure and closed source != insecure... However, what you said was "with enough eyes, all bugs are shallow" doesn't necessarily apply. And sure, a lot of bugs are found with black-box techniques, but having the source is still useful. I remember watching this terrifying talk and noticing that, while a lot of stuff didn't require the source, there was certainly one point where the source helped -- in this case, it helped him develop a working exploit to be more practical and less detectable. > what matters more than whether a piece of software is open-source or closed-source -- whether its security bugs will be found or not -- is whet…
3View on Reddit