Building a Real Session Layer
D.J. Capelis explores building a real session layer at DEF CON 16, examining emergency-systems and practical defenses.
Summary
Architecture and Background
DEF CON 16 - D.J. Capelis: Building a Real Session Layer It's past time for a session layer. It's time to replace port knocking with a real authentication framework.
Vulnerability Analysis
It's time to do what DNS did with IP addresses to port numbers. It's time to run services over NATs, eliminate the need for vhosts in your webserver and provide optional transparent encryption for any client who wants it. In this talk, we'll do that and a couple other tricks...
Exploitation and Demonstrations
within the framework of a little-known RFC that was written almost 2 decades ago. D.J. Capelis spends his time at University of California, San Diego eating pizza.
Remediation and Defensive Strategies
A portion of the remaining time is dedicated to research on building more secure computer systems. His latest research areas include building trusted platforms that aren't evil, looking for the next hot thing among old ideas and raining on the parades of people who think virtualization is a wonderful idea for production systems. He yearns for a time when XML was a scary dream, SPRITE would transparently migrate your processes between machines and real programmers had an inexplicable hatred for quiche. For copies of the slides and additional materials please see the DEF CON 16 Archive here:
Related talks
Main Stage·1 hr 54 min
Workshop
Workshop details workshop: Davix Workshop Need help understanding your gigabytes of application logs or network captures.
Main Stage·41 min
Weasel
Weasel details weasel: Compliance: The Enterprise Vulnerability Roadmap Compliance is no longer new.
Main Stage·48 min
Valsmith · Colin Ames
Valsmith and Colin Ames explores metapost-exploitation at DEF CON 16, examining emergency-systems and practical defenses.