Tadlock Enterprises » security http://www.tadlockenterprises.com A specialized west coast firm focused on product and technology vision, planning and execution. Thu, 18 Mar 2010 07:45:03 +0000 http://wordpress.org/?v=2.9.2 en hourly 1 Ignore an Invalid SSL Cert in .NET http://www.tadlockenterprises.com/2010/03/ignore-an-invalid-ssl-cert-in-net/ http://www.tadlockenterprises.com/2010/03/ignore-an-invalid-ssl-cert-in-net/#comments Sat, 06 Mar 2010 01:08:13 +0000 Craig Tadlock http://www.tadlockenterprises.com/?p=456 One of our clients integrates with a financial services company which provides an API to access data. Obviously this needs to be secure. Their QA environment is secured via SSL but is exposed only by IP address. A .NET client will by default throw a security exception when you try to create a SSL connection by IP because the certificate has been issued to a name. This code will get you past that…

ServicePointManager.ServerCertificateValidationCallback += ((sender, certificate, chain, sslPolicyErrors) => true);

]]> http://www.tadlockenterprises.com/2010/03/ignore-an-invalid-ssl-cert-in-net/feed/ 0 Fix Loopback 401 Errors in Windows Server 2008 http://www.tadlockenterprises.com/2010/02/fix-loopback-401-errors-in-windows-server-2008/ http://www.tadlockenterprises.com/2010/02/fix-loopback-401-errors-in-windows-server-2008/#comments Thu, 25 Feb 2010 08:13:16 +0000 Craig Tadlock http://www.tadlockenterprises.com/?p=446 If you use a loopback address (127.0.0.1) or hosts files on your Windows Server to reference a local IIS web application with Windows Authentication it will probably fail with a 401 error due to a new security constraint. This is often the case if you use a public url for your Sharepoint of TFS server. To resolve this you need to add a registry key…

  1. Open regedit
  2. Open the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  3. Create a new DWORD under Lsa named DisableLoopbackCheck
  4. Set its value to 1
  5. Restart the server for good measure

Related Links

http://support.microsoft.com/kb/896861

http://ppalakollu.blogspot.com/2009/04/ie-8-ntlm-authentication-on-windows.html

]]> http://www.tadlockenterprises.com/2010/02/fix-loopback-401-errors-in-windows-server-2008/feed/ 1 Hack a Wireless Network for $17 http://www.tadlockenterprises.com/2009/12/hack-a-wireless-network-for-17/ http://www.tadlockenterprises.com/2009/12/hack-a-wireless-network-for-17/#comments Tue, 08 Dec 2009 10:00:08 +0000 Craig Tadlock http://www.tadlockenterprises.com/?p=371 Cloud computing has started to change the way we think about building and hosting applications. The access to large computing resources on demand has allowed applications to rapidly handle their scaling needs. But it also has other uses… like breaking (oh, I mean testing) your (someone else’s) wireless network. WPA Cracker is a cloud solution to crack WPA-PSK wireless networks. It does this by leveraging a 400 CPU cluster and  a 135 million word dictionary. You just need to upload your network traffic capture to their server and after a bit of crunching it spits out they key. They claim it takes about 20 minutes to break, which will cost you all of $17. I think this is great. I’m pretty sure professional hacking groups had access to these types of resources in the past; so it’s really nothing new. Hopefully now that it has become a bit more public people will take the proper security steps to protect their networks, servers and data.

]]> http://www.tadlockenterprises.com/2009/12/hack-a-wireless-network-for-17/feed/ 0