SANS Penetration Testing: Monthly Archives: Nov 2015

TLS/SSL Failures and Some Thoughts on Cert Pinning (Part 1)

By Chris Crowley It's going to happen sooner or later...sooner probably. You're going to be asked about your company's mobile app or a mobile app your company wants to install across all mobile devices. They'll put the request in the "yet another duty as assigned" (YADAA) category/bucket. You look at the network traffic; it's using … Continue reading TLS/SSL Failures and Some Thoughts on Cert Pinning (Part 1)


Using the SSH "Konami Code" (SSH Control Sequences)

By Jeff McJunkin Are you familiar with the Konami code? The one popularized by the Contra video game? Pictured above: Tangentially related to SSH If not, let me fill you in. This code is a sequence of control actions for some video games that'll let you jump forward in the game (some call it a … Continue reading Using the SSH "Konami Code" (SSH Control Sequences)


What's the Deal with Mobile Device Passcodes and Biometrics? (Part 2 of 2)

By Lee Neely In the first installment of this 2-parter, I discussed the use of mobile device fingerprint scanners to unlock the device. As a follow-up, I'd like to discuss how a developer can integrate the scanner into their applications. This discussion may provide some insights into how to secure mobile apps, or even inspire … Continue reading What's the Deal with Mobile Device Passcodes and Biometrics? (Part 2 of 2)