Additional Reference Pointers by Topic (to be updated continuously):


New!! Attacking Tor: how the NSA targets users'online anonymity


Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate


MD5 Birthday Attack demonstration


OWASP TOP 10: The ten most critical web application security vulnerabilities    2007    2004


Live after Antivirus -- What does the future hold?    ( Panel Presentation from RAID, Oct 2008)



Intrusion Detection Systems

Intrusion Detection Systems (slides courtesy Prof. Stolfo)


Forensic Analysis

Forensic Discovery, by Wietse Venema, IBM T.J.Watson Research, USA


Novel Attack

Chinese PC virus may have hidden agenda

New Research Result: Cold Boot Attacks on Disk Encryption


Web Application Security / Cross-site scripting (intro)

The Web Application Firewalls (WAF) Information Center

Stanford Web Security Research

GNUCITIZEN

The Web Hacking Incident Database

Finjan Vital Security

Browser Security Handbook

XSS

XSS, Cookies, and Session ID Authentication – Three Ingredients for a Successful Hack

Cross Site Scripting Attacks: Xss Exploits And Defense

Web Security from Google Code University

XSS overview


Attack Patterns

Attack Patterns: Knowing Your Enemy in Order to Defeat Them, as presented at Blackhat DC 2007

Other cigital presentations

Exploiting Software: How to Break Code


General FAQs and Security Related Resources

CERT/CC Malicious Web Scripts FAQ

Computer and Network Security: Security FAQs

WWW Security FAQ

Telstra Corporation: Computer and Network Security Reference Index

Technical Resources and Course Web Site for Cryptography and Network Security: Principles and Practice, Second Edition

The book Security Engineering: A Guide to Building Dependable Distributed Systems by Ross J.Anderson, publisher: Wiley.

RFC2196: Site Security Handbook


Cryptography

RSA Laboratories | Cryptography FAQ

GMU Cryptography Web Resources

Differential Cryptanalysis: Why 16 rounds for DES ?

COPACOBANA: How to Break DES for 8980 Euros

How easy is collision search? Application to DES.

How Easy is Collision Search. New Results and Applications to DES.

THE STORY OF NON-SECRET ENCRYPTION


Authentication Protocols Design, Mistakes and Lessons Learned

Using Encryption for Authentication in Large Networks of Computers

Authentication Revisited

Prudent Engineering Practice for Cryptographic Protocols

Programming Satan's Computer

An Attack on the Needham-Schroeder Public-Key Authentication Protocol


Network and System Security

Top 20 System Vulnerabilities list by SANS: http://www.sans.org

Bugtraq: THE "full-disclosure" security mailing list

A talk by a Cisco Security Expert on Layer 2 Network Vulnerabilities

Sniffing (network wiretap, sniffer) FAQ

Home Network Security

Building Internet Firewalls: Chapter 13: Internet Services and Firewalls of a book published by O'Reilly

Top 75 Network/System Security Tools from Insecure.org

Googling Master Passwords for Automatic Teller Machines

Search engine for Malware


Buffer Overflow Attacks and Defenses

Defeating Microsoft Windows XP Heap buffer-overflow protection

Smashing the Stack for Fun and Profit by Aleph One

Z Liang, R Sekar, "Automatic Generation of Buffer Overflow Attack Signatures: An Approach Based on Program Behavior Models", Computer Security Applications Conference, 21st Annual, 2005

J Pincus, B Baker, "Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns", IEEE Security & Privacy, 2004

C Cowan, S Beattie, J Johansen, P Wagle, "PointGuardTM: Protecting Pointers From Buffer Overflow Vulnerabilities", Proc. of the 12th Usenix Security Symposium, 2003

C Cowan, P Wagle, C Pu, S Beattie, J Walpole, "Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade", Foundations of Intrusion Tolerant Systems, 2003

X Wang, CC Pan, P Liu, S Zhu, "SigFree: A Signature-free Buffer Overflow Attack Blocker", Proceedings of the 15th conference on USENIX Security Symposium

E Buchanan, R Roemer, H Shacham, S Savage, "When Good Instructions Go Bad: Generalizing Return-Oriented Programming to RISC", Proceedings of the 15th ACM conference on Computer and Communications Security

J Wilander, M Kamkar, "A Comparison of Publicly Available Tools for Dynamic Buffer Overflow Prevention", Proceedings of the 10th Network and Distributed System Security Symposium


Heap Overflow Attacks

Engineering Heap Overflow Exploits with JavaScript

Heap Feng Shui in JavaScript


String Formatting Attacks

Exploiting Format String Vulnerabilities


IPSec

S.M.Bellovin, Guidelines for Mandating the Use of IPSec. October, 2002, Work In Progress.


Wireless LAN Security

Wireless LAN Security Site

(In)Security of the WEP algorithm

Jesse Walker's paper titled "Unsafe at any key length"

Jesse Walker's Series of articles on 802.11 Security: Part I Key Management for WEP and TKIP, Part II The Temporal Key Integrity Protocol (TKIP), Part III AES-based Encapsulations of 802.11 Data, The Wired Equivalent Privacy (WEP)

Nancy Cam-Winget, Russ Housley, David Wagner and Jesse Walker, Security Flaws in 802.11 Data Link Protocols , Communications of the ACM, May 2003, Vol. 46, No. 5.
Presentations, 1, 2, 3 on Wireless LAN security by a group of graduate students (Tzachy Reinman, Roy Werber and Bracha Hod)  for a class in Hebrew University.


GSM Security

A news article about the latest claim on cracking GSM Security, reported on Sept 2003.

The paper led to the above news article: Elad Barkan, Eli Biham, Nathan Keller, Instant Ciphertext-Only Cryptanalysis of GSM Encrypted Communication (.ps),CS-2003-05, Proceedings of Crypto 2003.

Presentations, 4, 5, 6 on GSM Security by a group of graduate students (Yuri Sherman, Max Stepanov, Gregory Greenman) for a class in Hebrew University.

"A precis of the new attacks on GSM encryption", Gre Rose, 10, Sep 2003


Web Services

Gokhale, B.Kumar, A.Sahuguet, "Re-inventing the Wheel? CORBA vs Web Services", in the Proceedings of WWW 2002.


Apache Web Server Digest-based Authentication

Digest Authentication in Apache 1.3

User authentication using MD5 Digest Authentication in Apache 2.0

RFC2617: HTTP Authentication: Basic and Digest Access Authentication