http://www.cisco.com/c/en/us/products/ios-nx-os-software/eos-eol-listing.html
? IOS 12.2 http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-software-release-12-2/prod_end-of-life_notice0900aecd80330813.html
-> IOS 12.2.33 SXJ http://www.cisco.com/c/en/us/products/collateral/switches/mgx-8800-series-switches/end-of-life-notice-c51-729742.html
? IOS 12.3 http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-software-releases-12-3-mainline/prod_end-of-life_notice0900aecd8052e110.html
? IOS 12.4 http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-software-releases-12-4-mainline/end_of_life_notice_c51-574251.html
? IOS 15.x http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-15-1m-t/eos-eol-notice-listing.html
and browse here: http://www.cisco.com/cisco/web/psa/default.html?mode=prod&level0=268438303
ex:
- 3548 XL http://www.cisco.com/c/en/us/support/switches/catalyst-3548-xl-switch/model.html IOS 12.0(5)WC17 http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3500-xl-series-switches/prod_end-of-life_notice0900aecd8021a948.html
? PANOS https://www.paloaltonetworks.com/support/end-of-life-announcements/end-of-life-summary.html
? ScreenOS http://www.juniper.net/support/eol/screenos.html
? TMOS F5 / BIGIP https://support.f5.com/kb/en-us/solutions/public/3000/200/sol3225.html
http://www.nosdeputes.fr/anne-yvonne-le-dain http://www.assemblee-nationale.fr/presse/communiques/20150409-11.asp
voir portail de L'office parlementaire d'évaluation des choix scientifiques et technologiques http://www.assemblee-nationale.fr/commissions/opecst-index.asp
sénat, http://www.senat.fr/opecst/index.html
auditions http://www.senat.fr/rap/r14-271-2/r14-271-2.html
Simian Army consists of services (Monkeys) in the cloud for generating various kinds of failures, detecting abnormal conditions, and testing our ability to survive them. The goal is to keep our cloud safe, secure, and highly available. More details can be found at this blog.
http://techblog.netflix.com/2011/07/netflix-simian-army.html
VMware is rejigging the way it shares memory among virtual machines, after turning off Transparent Page Sharing (TPS) because academics identified insecurities in the technology.
The academic paper is entitled “Wait a minute! A fast, Cross-VM attack on AES”
https://eprint.iacr.org/2014/435.pdf
slightly different opinions
http://vsphere-land.com/news/why-the-vmware-vsphere-tps-vulnerability-is-a-big-deal.html
http://wahlnetwork.com/2014/10/20/tps-vulnerability/
Hard-coded RSA keys found in firmware
(－‸ლ)
liste à voir - mais site à pub/popups, gaffe
Vito Rallo blog :)
https://github.com/google/nogotofail
Nogotofail is a network security testing tool designed to help developers and security researchers spot and fix weak TLS/SSL connections and sensitive cleartext traffic on devices and applications in a flexible, scalable, powerful way. It includes testing for common SSL certificate verification issues, HTTPS and TLS/SSL library bugs, SSL and STARTTLS stripping issues, cleartext issues, and more
http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_tomorrow/
http://www.theregister.co.uk/2014/10/14/google_drops_ssl_30_poodle_vulnerability/
https://www.dfranke.us/posts/2014-10-14-how-poodle-happened.html
test: https://www.poodletest.com/
better test: https://dev.ssllabs.com
http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566
https://wiki.mozilla.org/Talk:Security/Server_Side_TLS
sur blog de Joe Schreiber (alienvault)
see also discussion at https://bugzilla.redhat.com/show_bug.cgi?id=1141597
there is a fix and a fix to the fix, two CVE:
CVE-2014-6271 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 https://security-tracker.debian.org/tracker/CVE-2014-6271
CVE-2014-7169 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169 https://security-tracker.debian.org/tracker/CVE-2014-7169
Journal linuxfr http://linuxfr.org/users/tankey/journaux/mets-a-jour-ton-bash-maintenant
suivre sur touitteure: https://twitter.com/hashtag/shellshock
(MS) http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html
scanner http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html
shellshock pour les nuls http://blog.ippon.fr/2014/09/26/shell-shock-un-obus-dans-les-dents-de-bash/
more bash bugs http://lcamtuf.blogspot.fr/2014/09/bash-bug-apply-unofficial-patch-now.html
Shellshocker - Repository of "Shellshock" Proof of Concept Code - https://github.com/mubix/shellshocker-pocs
X-force http://securityintelligence.com/how-bash-shellshock-bug-couldve-been-avoided-7-years-ago/
Kristin Paget - Shmoocon 2012: Credit Card Fraud: The Contactless Generation
https://www.shmoocon.org/2012/presentations/Paget_shmoocon2012-credit-cards.pdf
la vidéo https://www.youtube.com/watch?v=HRXb-FZ6WFM
NFCproxy http://blackwinghq.com/assets/labs/presentations/EddieLeeDefcon20.pdf
l'original, https://code.google.com/p/readnfccc/
Open source tool developped and showed for Hackito Ergo Sum 2012 - "Hacking the NFC credit cards for fun and debit ;)"
et la vidéo http://www.ustream.tv/recorded/21805507
idem via korben http://korben.info/les-cartes-bancaires-sans-contact-nfc-ne-sont-pas-securisees.html
Great guidance from IEEE's Center for Secure Design
via Sean: The following link is quite relevant to us: http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf It's about automated scans of embedded firmware images and is quite recent.
http://www.eurecom.fr/en/publication/4323/detail/a-large-scale-analysis-of-the-security-of-embedded-firmwares
a large catalog of interesting publications: http://www.s3.eurecom.fr/publications.html
Une backdoor dans un routeur Netis/Netcore
http://www.nearsecurity.net/love-china-netisbackdoor-exploitation/
ernw, troopers, loki, l2spike
http://www.insinuator.net/tag/loki/
http://www.insinuator.net/2011/05/update-for-your-fuzzing-toolkit/
en vrac sur bluecoat
https://sitereview.bluecoat.com/sitereview.jsp
https://kb.bluecoat.com/index?page=content&id=KB2921
voir reflets
et http://surveillance.rsf.org/en/blue-coat-2/
rdp-sec-check is a Perl script to enumerate security settings of an RDP Service (AKA Terminal Services)
again, thanks to Laszlo :)