Safenet iKey 2032 In-depth Look Inside
Chances are you have probably seen one of these little USB based tokens made from Safenet, Inc. The one we opened was in a blue shell. Safekey says, iKey 2032 is a compact, two-factor authentication token that provides client security for network authentication, e-mail encryption, and digital signing applications.” As well, the brochure the link above takes you too states, iKey 2032s small size and rugged, tamper resistant construction, make it easy to carry so users can always have their unique digital entities with them.” Now we’re not really…
Decapsulated devices
Recently at Toorcon9 (www.toorcon.org), some individuals asked to see images of decapsulated parts still in their packages. I dug around and came up with some examples. Click on any of the pictures for a larger version. Above: Dallas DS89C450 Above: Microchip dsPIC30F6013 Using our proprietary procedures, all parts remain 100% functional with no degradation after exposing the substrate.
Unmarked Die Revisions :: Part I
We have noticed a few different die revisions on various Microchip’s substrates that caught our attention. In most case when a company executes any type of change to the die, they change the nomenclature slightly. An example is the elder PIC16C622. After some changes, the later part was named the PIC16C622A and there was major silicon layout changes to the newer ‘A’ part. The PIC16C54 has been through three known silicon revs (‘A’ – ‘C’) and has now been replaced by the PIC16F54. However, we’ve noticed two different devices from them (PIC12F683…
Multiple Buffer Overflows in legacy mod_jk2 apache module 2.0.3-DEV and earlier
CVE-2007-6257, VU#245025. Discovered: 05.01.07. Reported: 06.27.07. Disclosed: 09.20.07. A buffer overflow vulnerability exists in the Host Header field of the legacy version of the mod_jk2 apache module (jakata-tomcat-connectors), which allows for remote code execution in the context of the Apache process.
Multiple Total Remote Compromise Vulnerabilities in Mercury SiteScope Monitoring Software
CVE-2007-6257, VU#245025. Discovered: 10.05.06. Disclosed: 09.20.07. Critical vulnerabilities exist within the Mercury SiteScope server monitoring software. Some of these can result in a complete remote compromise of the entire monitored network, as well as arbitrary code execution on all servers managed by the SiteScope software.
Buffer Overflow in Mono BigInteger Montgomery Reduction Method
VU#146292. Discovered: 07.25.07. Reported: 08.24.07. Disclosed: 09.20.07. An exploitable buffer overflow vulnerability exists in the Montgomery reduction method within the Mono Frameworks BigInteger Class (Mono.Math.BigInteger).
Static Microsoft Windows WPAD entries might allow interception of traffic
CVE-2007-1692. Disclosed: 03.26.07. The default configuration of Microsoft Windows uses the Web Proxy Autodiscovery Protocol (WPAD) without static WPAD entries. A remote attacker could leverage this to intercept web traffic by registering a proxy server using WINS or DNS, then responding to WPAD requests.