security [ARCHIVED] May 2014

security@lists.fedoraproject.org

15 participants
35 discussions

developing the "critical updates repo" plan
by Matthew Miller 25 May '14

25 May '14

See <https://fedorahosted.org/rel-eng/ticket/5886>. In short, the time to do an updates compose and push (plus sync times to mirrors) severely limits our ability to put out critical updates quickly. Would anyone be interested in filling out a plan for an alternate repository which would use a special expedited process to make ultra-critical updates available more quickly? -- Matthew Miller mattdm(a)mattdm.org <http://mattdm.org/>

7 12

Breakpoint 2014 Call For Presentations
by cfp＠ruxcon.org.au 06 May '14

06 May '14

Breakpoint 2014 Call For Papers Melbourne, Australia, October 8th-9th Intercontinental Rialto http://www.ruxconbreakpoint.com .[x]. Introduction .[x]. The Ruxcon team is pleased to announce Call For Papers for Breakpoint 2014. Breakpoint showcases the work of expert security researchers from around the world on a wide range of topics. This conference is organised by the Ruxcon team and offers a specialised security conference to complement and lead into the larger and more casual Ruxcon weekend conference. .[x]. Important Dates .[x]. May 1 - Call For Presentations Open August 30 - Call For Presentations Close October 6-7 - Breakpoint Training October 8-9 - Breakpoint Conference October 11-12 - Ruxcon Conference .[x]. Topic Scope .[x]. Topics of interest include, but are not limited to: o Mobile Device Security o Exploitation Techniques o Reverse Engineering o Vulnerability Discovery o Rootkit Development o Malware Analysis o Code Analysis o Virtualisation, Hypervisor Security o Cloud Security o Embedded Device Security o Hardware Security o Telecommunications Security o Wireless Network Security o Web Application Security o Law Enforcement Activities o Forensics o Threat Intelligence .[x]. Submission Guidelines .[x]. In order for us to process your submission we will require the following information: 1. Presentation title 2. Detailed summary of your presentation material 3. Name/Nickname 4. Mobile phone number 5. Brief personal biography 6. Description of any demonstrations involved in presentation 7. Information on where the presentation material has or will be presented before Breakpoint * Preference will be given to presentations that contain original research that will be first presented at Breakpoint. * As a general guideline, Breakpoint presentations are between 45 and 60 minutes, including question time. If you have any questions about submissions, or would like to make a submission, please send an email to submissions(a)ruxconbreakpoint.com .[x]. Speaker Benefits .[x]. Speakers at Breakpoint will be entitled to the following benefits: - A return economy airfare to Melbourne (total cost limit applies) - Three nights accommodation at the Intercontinental Rialto - Complimentary registration for Breakpoint and Ruxcon conferences - Invitation to all Breakpoint and Ruxcon parties * All speaker benefits apply to a single speaker per submission. .[x]. Contact .[x]. If you have any questions or inqueries, contact us at: * Email: submissions(a)ruxconbreakpoint.com * Twitter: @ruxconbpx

1 0

Fwd: Fedora crypto policy vs the real world Was: available crypto policies
by Aaron Zauner 05 May '14

05 May '14

Hi *, On 05/05/2014 11:02 PM, Pavel Kankovsky wrote: > (AlFardan et al. describe a different and possibly somewhat more > efficient > approach to find the maximum-likelihood choice of a plaintext byte.) > > If you capture "just few" connections you do not collect enough > information to distinguish between the correct value and incorrect > values, and no amount of computing power will help you (that is unless > you have got enough to crack the cipher directly) Added to this is the possibility of "nation-state actions" that may have found RC4 cryptanalytic attacks the public cryptography community does not know about. Yes, I do not have sources on that, but it's been suggested by people that viewed the Snowden leaks a couple of times. I don't really see a reason to keep RC4 in there. I'm totally for removing it. But that's just my opinion. Aaron

1 0

Ruxcon 2014 Call For Papers
by cfp＠ruxcon.org.au 05 May '14

05 May '14

Ruxcon 2014 Call For Presentations Melbourne, Australia, October 11th-12th http://www.ruxcon.org.au The Ruxcon team is pleased to announce the Call For Presentations for Ruxcon 2014. This year the conference will take place over the weekend of the 11th and 12th of October at the CQ Function Centre, Melbourne, Australia. .[x]. About Ruxcon .[x]. Ruxcon brings together the individual talents of the best and brightest security folk in the region, through live presentations, activities, and demonstrations. The con is held over two days in a relaxed atmosphere, allowing delegates to enjoy themselves whilst networking within the community and expanding their knowledge. Live presentations and activities will cover a full range of defensive and offensive security topics, varying from previously unpublished research to required reading for the security community. .[x]. Important Dates .[x]. May 1st - Call For Presentations Open September 30th - Call For Presentations Close October 6-7 - Ruxcon/Breakpoint Training October 8-9 - Breakpoint Conference October 11-12 - Ruxcon Conference .[x]. Topic Scope .[x]. o Topics of interest include, but are not limited to: o Mobile Device Security o Virtualization, Hypervisor, and Cloud Security o Malware Analysis o Reverse Engineering o Exploitation Techniques o Rootkit Development o Code Analysis o Forensics and Anti-Forensics o Embedded Device Security o Web Application Security o Network Traffic Analysis o Wireless Network Security o Cryptography and Cryptanalysis o Social Engineering o Law Enforcement Activities o Telecommunications Security (SS7, 3G/4G, GSM, VOIP, etc) .[x]. Submission Guidelines .[x]. In order for us to process your submission we require the following information: 1. Presentation title 2. Detailed summary of your presentation material 3. Name/Nickname 4. Mobile phone number 5. Brief personal biography 6. Description of any demonstrations involved in the presentation 7. Information on where the presentation material has or will be presented before Ruxcon * As a general guideline, Ruxcon presentations are between 45 and 60 minutes, including question time. If you have any enquiries about submissions, or would like to make a submission, please send an email to presentations(a)ruxcon.org.au .[x]. Contact .[x]. o Email: submissions(a)ruxcon.org.au o Twitter: @ruxcon

1 0

[Secure Coding] master: sect-Defensive_Coding-TLS-OpenSSL: Mention "openssl genrsa" entropy issue (564ffc8)
by fweimer＠fedoraproject.org 01 May '14

01 May '14

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 564ffc80149307d0a99724e2689ed3a8816513bf Author: Florian Weimer <fweimer(a)redhat.com> Date: Fri Apr 25 13:47:22 2014 +0200 sect-Defensive_Coding-TLS-OpenSSL: Mention "openssl genrsa" entropy issue >--------------------------------------------------------------- defensive-coding/en-US/Features-TLS.xml | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-) diff --git a/defensive-coding/en-US/Features-TLS.xml b/defensive-coding/en-US/Features-TLS.xml index 936910d..f4da007 100644 --- a/defensive-coding/en-US/Features-TLS.xml +++ b/defensive-coding/en-US/Features-TLS.xml @@ -186,6 +186,15 @@ verify</command> result in an exit status of zero. </para> <para> + OpenSSL command-line commands, such as <command>openssl + genrsa</command>, do not ensure that physical entropy is used + for key generation—they obtain entropy from + <filename>/dev/urandom</filename> and other sources, but not + from <filename>/dev/random</filename>. Keys generated by + these tools should not be used in high-value, critical + functions. + </para> + <para> The OpenSSL server and client applications (<command>openssl s_client</command> and <command>openssl s_server</command>) are debugging tools and should <emphasis>never</emphasis> be

5 9

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

security [ARCHIVED] May 2014