Project Manager Security

Thomas Biege <thomas@suse.de>

GPG/PGP key

pub   2048R/558EBF03 2010-10-29
      Key fingerprint = 46DC C7B5 DC5E A9DF E2CB  D9A3 9A87 A152 558E BF03
uid                  Thomas Biege (Project Manager Security) thomas@suse.de
uid                  Thomas Biege (Project Manager Security) thomas@suse.com
uid                  Thomas Biege (Project Manager Security) thomas@novell.com

Disclaimer

All code and information on this site is intended for educational purpose only.

NEWS

2011-01-12: I released various tools via gitorious but forgot to mention them here:
- fuzzer for XMLRPC, fileuploads, POST and GET URLs etc.
- XSS fuzzer
- Ruby on Rails code scanner
- web spider for authentication coverage checks
- web brute-forcer
- OWASP test-suite
2010-03-01: released RESTful/XML-RPC fuzzer and RoR code vulnerability scanner: all code will be in gitorious now
2010-01-05: released command-line tool fuzzer BETA2, heavy rewrite of BETA1 during fuzzing dozens of setuid tools in openSUSE 11.2
2009-11-10: released command-line tool fuzzer BETA1, quickly hacked in 2008, not very well tested
2008-07-24: released two little scripts to dec-/encrypt Ruby's cookies
2008-07-11: released new version of DNS Transaction-ID Analyzer to analyze UDP source-port too (CVE-2008-1447)
2008-04-11: released DNS Transaction-ID Analyzer
2007-11-16: I'm blogging again...
2007-10-01: Added slides used for internal speach about web-security in the papers section
2007-06-06: released SSL Number Analyzer, a tool to audit TLS1 session handshake
2006-12-28: speach about RNG analysis at 23c3; you will find the paper and slides in the papers section
2006-11-30: The 23c3 schedule is finished. My talk: Analysis of a strong Random Number Generator
2006-11-09: holding a speach at the University of Dortmund about secure programming for students of the course "Reaktive Sicherheit"
2006-11-02: new version of my paper Sicherheitsrelevante Programmierfehler (still german-only ;-) )
2006-02-13: put SLES hardening-guide, written by Marc Heuse, online
2005-10-04: released slides for HITT talk in the papers section
2005-09-16: released beta1 of JPEG-Extractor, a forensic tool
2005-09-01: released beta1 of a RADIUS fuzzer tool here
2005-08-05: find the latest LAuS CVS snapshop here
2005-05-24: completely proof-read and enhanced (integer overflow, crypto) paper Sicherheitsrelevante Programmierfehler
2004-11-XX: the paper Sicherheitsrelevante Programmierfehler becomes part of Juergen Wolf's great book Linux-Unix-Programmierung
2004-11-18: released update for Vulnerability Severity Metric draft
2004-10-20: released draft about Vulnerability Severity Metric
2004-10-07: released new Paper: Sicherheitsrelevante Programmierfehler
2004-04-22: released new Secure Programming Library
2003-12-11: switched to new design

Papers and Slides

Writing papers and holding speaches helps me to keep myself uptodate with several interesting topics.

Projects

During my time working at the computer some more or less interesting projects were developed.
The most important one is a modular Intrusion Detection Framework called M-ICE (Your help is always welcome.).

SLES 8 and 9 Hardening Guide

These SLES hardening-guides were written by Marc Heuse.
They are released by me because they did not find their way to an official site
and people asking for it very frequently.

Misc

Stuff that does not fit elsewhere.

Contact

Get in touch with the SuSE Security-Team.

Last Update 2010-03-01 by Thomas Biege <thomas@suse.de>

kostenloser Counter