AppSec Blog: Author - Johannes Ullrich

Top 25 Series - Rank 20 - Download of Code Without Integrity Check

Checking the integrity of code you download is important and has to be done not just for the initial download, but for updates as well. We will discuss the options to implement integrity checks correctly. Continue reading Top 25 Series - Rank 20 - Download of Code Without Integrity Check


Top 25 Series - Rank 25 - Race Conditions

Flying a lot, it happens once in a while that I arrive at the airport early enough to be offered to check in on an earlier flight. Usually the check-in Kiosk offers the option and lists the flight. Last year, I tried to took advantage of this offer, only to be told that the fligt … Continue reading Top 25 Series - Rank 25 - Race Conditions


Top 25 Series - Rank 24 - Use of a Broken or Risky Cryptographic Algorithm

There are a few rules every developer should follow when applying encryption: - don't invent your own algorithm Cryptography is a difficult topic, best left to the experts. Implementing encryption algorithms is difficult and there are many traps waiting. Many times, you can get away with a broken custom algorithm, but only because nobody challenges … Continue reading Top 25 Series - Rank 24 - Use of a Broken or Risky Cryptographic Algorithm


Top 25 Series - Rank 17 - Integer Overflow Or Wraparound

The author discussion integers, wraparound and how random numbers may very much be non random if you don't know how to read the manual. Continue reading Top 25 Series - Rank 17 - Integer Overflow Or Wraparound


Top 25 Series - Rank 16 - Information Exposure Through an Error Message

Error messages can leak everything from full path names to password. A user should never be exposed to them, unless you expect them to fix the problem for you. Continue reading Top 25 Series - Rank 16 - Information Exposure Through an Error Message