Comments for Suspekt... http://www.suspekt.org A Blog About Code, Information Security, PHP And More Fri, 12 Mar 2010 04:06:51 +0000 http://wordpress.org/?v=2.6 Comment on Month of PHP Security - Blog Post Drawing by 3/7/2010 Update « Go Code http://www.suspekt.org/2010/03/05/month-of-php-security-blog-post-drawing/#comment-3602 3/7/2010 Update « Go Code Sun, 07 Mar 2010 05:13:53 +0000 http://www.suspekt.org/?p=338#comment-3602 [...] Suspekt Blog Archive Month of PHP Security – Blog Post Drawing [...] [...] Suspekt Blog Archive Month of PHP Security – Blog Post Drawing [...]

]]> Comment on Month of PHP Security - Blog Post Drawing by Webby Scripts Suspekt… » Blog Archive » Month of PHP Security – Blog Post Drawing http://www.suspekt.org/2010/03/05/month-of-php-security-blog-post-drawing/#comment-3601 Webby Scripts Suspekt… » Blog Archive » Month of PHP Security – Blog Post Drawing Sat, 06 Mar 2010 22:29:10 +0000 http://www.suspekt.org/?p=338#comment-3601 [...] more from the original source: Suspekt… » Blog Archive » Month of PHP Security – Blog Post Drawing [...] [...] more from the original source: Suspekt… » Blog Archive » Month of PHP Security – Blog Post Drawing [...]

]]> Comment on Suhosin-Patch 0.9.9.1 by Stefan http://www.suspekt.org/2010/03/05/suhosin-patch-0991/#comment-3599 Stefan Sat, 06 Mar 2010 21:59:50 +0000 http://www.suspekt.org/?p=341#comment-3599 There are no offical windows binaries. And I suggest to not use inofficial windows binaries, because they might contain trojans. At the moment it is unknown if there ever will be windows binaries. There are no offical windows binaries. And I suggest to not use inofficial windows binaries, because they might contain trojans.

At the moment it is unknown if there ever will be windows binaries.

]]> Comment on Suhosin-Patch 0.9.9.1 by G. Flindt http://www.suspekt.org/2010/03/05/suhosin-patch-0991/#comment-3597 G. Flindt Sat, 06 Mar 2010 15:56:05 +0000 http://www.suspekt.org/?p=341#comment-3597 Where can I find the Windows binaries? Since your forum is offline (when will it be available again?), this is a little problem - I'd love to use Suhosin but I'm not able to build the extension on my own. :( Where can I find the Windows binaries?

Since your forum is offline (when will it be available again?), this is a little problem - I’d love to use Suhosin but I’m not able to build the extension on my own. :(

]]> Comment on Suhosin-Patch 0.9.9.1 by Stefan http://www.suspekt.org/2010/03/05/suhosin-patch-0991/#comment-3596 Stefan Fri, 05 Mar 2010 19:12:00 +0000 http://www.suspekt.org/?p=341#comment-3596 The pointer obfuscation is for now only a simple XOR of the pointers with a random value. Right now this random value will be generated once in the beginning, so it is the same for all requests (when PHP runs as module). However this was just the first attempt to implement it: Most probably it will be changed to use a different random value for each new request. Obfuscation affects the forward and backward pointers of free memory blocks. And the free memory cache. This stops several attacks against the free memory cache. Other pointer might get obfuscated in future versions, however the problem is to stay compatible with PHP extensions like APC and Zend Tools. These tools often do not use API functions to do the things they want (sometimes because there are no such API functions) so it is not possible to just obfuscate the pointers. The pointer obfuscation is for now only a simple XOR of the pointers with a random value. Right now this random value will be generated once in the beginning, so it is the same for all requests (when PHP runs as module).

However this was just the first attempt to implement it: Most probably it will be changed to use a different random value for each new request.

Obfuscation affects the forward and backward pointers of free memory blocks. And the free memory cache. This stops several attacks against the free memory cache.

Other pointer might get obfuscated in future versions, however the problem is to stay compatible with PHP extensions like APC and Zend Tools. These tools often do not use API functions to do the things they want (sometimes because there are no such API functions) so it is not possible to just obfuscate the pointers.

]]> Comment on Suhosin-Patch 0.9.9.1 by Willem http://www.suspekt.org/2010/03/05/suhosin-patch-0991/#comment-3595 Willem Fri, 05 Mar 2010 12:16:59 +0000 http://www.suspekt.org/?p=341#comment-3595 Can you tell me what kind of pointer obfuscation techniques you have used? Can you tell me what kind of pointer obfuscation techniques you have used?

]]> Comment on Suhosin-Patch 0.9.9.1 by trophaeum http://www.suspekt.org/2010/03/05/suhosin-patch-0991/#comment-3594 trophaeum Fri, 05 Mar 2010 12:09:40 +0000 http://www.suspekt.org/?p=341#comment-3594 thanks pax team for spending time on helping an already awesome project! thanks pax team for spending time on helping an already awesome project!

]]> Comment on Month of PHP Security 2010 - CALL FOR PAPERS by Suspekt… » Blog Archive » Month of PHP Security - Blog Post Drawing http://www.suspekt.org/2010/02/27/month-of-php-security-2010-call-for-papers/#comment-3593 Suspekt… » Blog Archive » Month of PHP Security - Blog Post Drawing Fri, 05 Mar 2010 08:06:37 +0000 http://www.suspekt.org/?p=319#comment-3593 [...] from various blog posts about it than there are submissions to drawing@php-security.org. Like I previously announced we will honor 10 blog postings with 25 EUR amazon coupons. The winners will be selected by random, [...] [...] from various blog posts about it than there are submissions to drawing@php-security.org. Like I previously announced we will honor 10 blog postings with 25 EUR amazon coupons. The winners will be selected by random, [...]

]]> Comment on State of the Art Post Exploitation in Hardened PHP Environments by - CNIS mag http://www.suspekt.org/2009/08/12/state-of-the-art-post-exploitation-in-hardened-php-environments/#comment-3589 - CNIS mag Wed, 03 Mar 2010 19:16:37 +0000 http://www.suspekt.org/?p=270#comment-3589 [...] Fabien Periguaud sur le Blog du Cert Lexsi. L’auteur revient en détail sur une communication de Stefan Esser (dernière BlackHat). A noter également ce papier très « complet » publié par La Sécurité [...] [...] Fabien Periguaud sur le Blog du Cert Lexsi. L’auteur revient en détail sur une communication de Stefan Esser (dernière BlackHat). A noter également ce papier très « complet » publié par La Sécurité [...]

]]> Comment on Month of PHP Security 2010 - CALL FOR PAPERS by Stefan Esser’s Blog: Month of PHP Security 2010 - CALL FOR PAPERS | Webs Developer http://www.suspekt.org/2010/02/27/month-of-php-security-2010-call-for-papers/#comment-3577 Stefan Esser’s Blog: Month of PHP Security 2010 - CALL FOR PAPERS | Webs Developer Mon, 01 Mar 2010 15:50:43 +0000 http://www.suspekt.org/?p=319#comment-3577 [...] Esser has officially announced the Call for Papers for the Month of PHP Security happening in May 2010. The MoPS is an effort to both close security [...] [...] Esser has officially announced the Call for Papers for the Month of PHP Security happening in May 2010. The MoPS is an effort to both close security [...]

]]>