<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments for comp527</title>
	<atom:link href="http://seclab.cs.rice.edu/comp527/?feed=comments-rss2" rel="self" type="application/rss+xml" />
	<link>http://seclab.cs.rice.edu/comp527</link>
	<description>course blog for COMP 527: Computer Systems Security</description>
	<lastBuildDate>Mon,  9 Nov 2009 19:19:54 -0600</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.4</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>Comment on Jailbroken IPhone Security by yuliyp</title>
		<link>http://seclab.cs.rice.edu/comp527/?p=461&#038;cpage=1#comment-66</link>
		<dc:creator>yuliyp</dc:creator>
		<pubDate>Mon, 09 Nov 2009 19:19:54 +0000</pubDate>
		<guid isPermaLink="false">http://seclab.cs.rice.edu/comp527/?p=461#comment-66</guid>
		<description>And today someone in Australia wrote a worm to rickroll people with the default SSH password. &lt;a href=&quot;http://www.sophos.com/blogs/gc/g/2009/11/08/iphone-worm-discovered-wallpaper-rick-astley-photo/&quot; rel=&quot;nofollow&quot;&gt;Here&#039;s Sophos&#039;s take on this&lt;/a&gt;.</description>
		<content:encoded><![CDATA[<p>And today someone in Australia wrote a worm to rickroll people with the default SSH password. <a href="http://www.sophos.com/blogs/gc/g/2009/11/08/iphone-worm-discovered-wallpaper-rick-astley-photo/" rel="nofollow">Here&#8217;s Sophos&#8217;s take on this</a>.</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Vulnerability in SSL Protocol. by yuliyp</title>
		<link>http://seclab.cs.rice.edu/comp527/?p=468&#038;cpage=1#comment-65</link>
		<dc:creator>yuliyp</dc:creator>
		<pubDate>Sat, 07 Nov 2009 10:29:13 +0000</pubDate>
		<guid isPermaLink="false">http://seclab.cs.rice.edu/comp527/?p=468#comment-65</guid>
		<description>Well actually this vulnerability does not allow eavesdropping, only tampering with the initial portion of a session. The problem is that SSL renegotiation is designed to allow for switching the security, and then continuing without requiring the streams to be reopened. However, due to this style of MITM attack, the streams should be considered to come from different sources potentially.

Also, this vulnerability affects many other protocols routed over TCP (such as SMTP over TLS)</description>
		<content:encoded><![CDATA[<p>Well actually this vulnerability does not allow eavesdropping, only tampering with the initial portion of a session. The problem is that SSL renegotiation is designed to allow for switching the security, and then continuing without requiring the streams to be reopened. However, due to this style of MITM attack, the streams should be considered to come from different sources potentially.</p>
<p>Also, this vulnerability affects many other protocols routed over TCP (such as SMTP over TLS)</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Vulnerability in SSL Protocol. by as44</title>
		<link>http://seclab.cs.rice.edu/comp527/?p=468&#038;cpage=1#comment-64</link>
		<dc:creator>as44</dc:creator>
		<pubDate>Fri, 06 Nov 2009 22:31:12 +0000</pubDate>
		<guid isPermaLink="false">http://seclab.cs.rice.edu/comp527/?p=468#comment-64</guid>
		<description>This was indeed a surprise! Check this out too: http://arstechnica.com/security/news/2009/11/https-ssl-attack-vector-discovered-fix-is-on-the-way.ars

And when you check online your account balance tonight, think that someone may be eavesdropping  &gt;:)</description>
		<content:encoded><![CDATA[<p>This was indeed a surprise! Check this out too: <a href="http://arstechnica.com/security/news/2009/11/https-ssl-attack-vector-discovered-fix-is-on-the-way.ars" rel="nofollow">http://arstechnica.com/security/news/2009/11/https-ssl-attack-vector-discovered-fix-is-on-the-way.ars</a></p>
<p>And when you check online your account balance tonight, think that someone may be eavesdropping  >:)</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Smartphone Security by cjenkins</title>
		<link>http://seclab.cs.rice.edu/comp527/?p=451&#038;cpage=1#comment-63</link>
		<dc:creator>cjenkins</dc:creator>
		<pubDate>Tue, 27 Oct 2009 05:16:20 +0000</pubDate>
		<guid isPermaLink="false">http://seclab.cs.rice.edu/comp527/?p=451#comment-63</guid>
		<description>I agree, though it&#039;s creative, nonetheless.  The greater potential threat is certainly in the Internet-enabled functionality or in simple things like not password-protecting your phone then losing it.  It might not be impenetrable, but it&#039;s at least a deterrent to the not-so-sophisticated thief.</description>
		<content:encoded><![CDATA[<p>I agree, though it&#8217;s creative, nonetheless.  The greater potential threat is certainly in the Internet-enabled functionality or in simple things like not password-protecting your phone then losing it.  It might not be impenetrable, but it&#8217;s at least a deterrent to the not-so-sophisticated thief.</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Smartphone Security by xzl</title>
		<link>http://seclab.cs.rice.edu/comp527/?p=451&#038;cpage=1#comment-62</link>
		<dc:creator>xzl</dc:creator>
		<pubDate>Tue, 27 Oct 2009 03:35:15 +0000</pubDate>
		<guid isPermaLink="false">http://seclab.cs.rice.edu/comp527/?p=451#comment-62</guid>
		<description>IMHO, the risk of virus infection via Bluetooth is overstated. 

Bluetooth of most cell phones is off by default;
The sender needs the receiver to pair before sending any data - this is a feature of Bluetooth protocol;
The connection is unstable;
Mobile platform is highly heterogeneous;...

That&#039;s why there is not so many viruses on your cell phone.</description>
		<content:encoded><![CDATA[<p>IMHO, the risk of virus infection via Bluetooth is overstated. </p>
<p>Bluetooth of most cell phones is off by default;<br />
The sender needs the receiver to pair before sending any data &#8211; this is a feature of Bluetooth protocol;<br />
The connection is unstable;<br />
Mobile platform is highly heterogeneous;&#8230;</p>
<p>That&#8217;s why there is not so many viruses on your cell phone.</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Tor is blocked in China recently by xzl</title>
		<link>http://seclab.cs.rice.edu/comp527/?p=435&#038;cpage=1#comment-61</link>
		<dc:creator>xzl</dc:creator>
		<pubDate>Sun, 25 Oct 2009 20:27:20 +0000</pubDate>
		<guid isPermaLink="false">http://seclab.cs.rice.edu/comp527/?p=435#comment-61</guid>
		<description>Two or three years ago, I knew the government set up many fake Tor servers to disturb the service...</description>
		<content:encoded><![CDATA[<p>Two or three years ago, I knew the government set up many fake Tor servers to disturb the service&#8230;</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Egyptian Presidency &amp; Defense Ministy websites got hacked! by dwallach</title>
		<link>http://seclab.cs.rice.edu/comp527/?p=412&#038;cpage=1#comment-60</link>
		<dc:creator>dwallach</dc:creator>
		<pubDate>Thu, 01 Oct 2009 05:04:10 +0000</pubDate>
		<guid isPermaLink="false">http://seclab.cs.rice.edu/comp527/?p=412#comment-60</guid>
		<description>Awesome.

Needless to say, this isn&#039;t normally something you&#039;d consider when doing a threat analysis on the presidency&#039;s web site.  On the other hand, in Egypt I&#039;ll bet fewer people depend on those web sites being up and available.

(Thought experiment: if whitehouse.gov was down for a month, would that really be a catastrophe, or just more of an embarrassment to the commander in chief?)</description>
		<content:encoded><![CDATA[<p>Awesome.</p>
<p>Needless to say, this isn&#8217;t normally something you&#8217;d consider when doing a threat analysis on the presidency&#8217;s web site.  On the other hand, in Egypt I&#8217;ll bet fewer people depend on those web sites being up and available.</p>
<p>(Thought experiment: if whitehouse.gov was down for a month, would that really be a catastrophe, or just more of an embarrassment to the commander in chief?)</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Rice Thresher Today by dwallach</title>
		<link>http://seclab.cs.rice.edu/comp527/?p=386&#038;cpage=1#comment-59</link>
		<dc:creator>dwallach</dc:creator>
		<pubDate>Fri, 18 Sep 2009 17:15:18 +0000</pubDate>
		<guid isPermaLink="false">http://seclab.cs.rice.edu/comp527/?p=386#comment-59</guid>
		<description>I think military &quot;red team&quot; analysts have tried exactly this: launching standard scam emails (with permission) against their own personnel to see how bad the response rate is.

The broad problem of &quot;usable security&quot; is really in its infancy.  I&#039;ve done some work on this, in the context of electronic voting, so I&#039;ve begun to appreciate just how hard it is to design something to be secure in the hands of users who don&#039;t necessary know or care to do things &quot;properly.&quot;</description>
		<content:encoded><![CDATA[<p>I think military &#8220;red team&#8221; analysts have tried exactly this: launching standard scam emails (with permission) against their own personnel to see how bad the response rate is.</p>
<p>The broad problem of &#8220;usable security&#8221; is really in its infancy.  I&#8217;ve done some work on this, in the context of electronic voting, so I&#8217;ve begun to appreciate just how hard it is to design something to be secure in the hands of users who don&#8217;t necessary know or care to do things &#8220;properly.&#8221;</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on How NOT to practice Responsible Disclosure by dwallach</title>
		<link>http://seclab.cs.rice.edu/comp527/?p=344&#038;cpage=1#comment-58</link>
		<dc:creator>dwallach</dc:creator>
		<pubDate>Mon, 14 Sep 2009 18:35:34 +0000</pubDate>
		<guid isPermaLink="false">http://seclab.cs.rice.edu/comp527/?p=344#comment-58</guid>
		<description>Microsoft tends to speed up their patch process if/when it turns out a vulnerability is being actively (and embarassingly) exploited in the wild.</description>
		<content:encoded><![CDATA[<p>Microsoft tends to speed up their patch process if/when it turns out a vulnerability is being actively (and embarassingly) exploited in the wild.</p>
]]></content:encoded>
	</item>
	<item>
		<title>Comment on Japan&#8217;s Cell Phones May Get DRM, At Music Industry Behest by dwallach</title>
		<link>http://seclab.cs.rice.edu/comp527/?p=381&#038;cpage=1#comment-57</link>
		<dc:creator>dwallach</dc:creator>
		<pubDate>Mon, 14 Sep 2009 18:34:39 +0000</pubDate>
		<guid isPermaLink="false">http://seclab.cs.rice.edu/comp527/?p=381#comment-57</guid>
		<description>We know that Americans are increasingly hostile to this sort of thing.  How will the Japanese react?</description>
		<content:encoded><![CDATA[<p>We know that Americans are increasingly hostile to this sort of thing.  How will the Japanese react?</p>
]]></content:encoded>
	</item>
</channel>
</rss>
