My Blog

  • Still using HTTP? That’s so 2015…

    Security HTTPS Spoofing 25.04.2016

    Since the launch of Let’s Encrypt CA in late 2015, obtaining TLS certificates has become cheap, quick and easy. Statistics this month showed Let’s Encrypt has yet issued nearly 1.8 million certificates. But it seems like this information hasn’t arrived at some website owners and API developers.

    So I wrote a little script to poison DNS requests and let a little node.js script exchange all pictures requested by the victim (i will perhaps blog about this script another time). Sites and apps using TLS are perfectly fine, because they will reject connections to the fake webserver without a valid certificate. Without transport security, things get mad.

  • UWP-Apps - First Steps [Part 1]

    Programming .NET C# Universal Windows Platform WPF 22.03.2016

    As a mainly WPF developer, I decided to take a look at the new Universal Windows Platform (UWP). In this post I will focus on some small differences between WPF and UWP, including StringFormat and DataTemplates.

  • Adobe patches Flash - again

    Security Flash HTML5 12.03.2016

    Adobe just released some new security-related patches for their Flash Player.

    My question here is not “why again”, because I expected that. We all expected that. The real question is - who the hell still uses flash? And why are guides like “This is how you secure your flash installation now” so popular? (The expression “security hole” is always particularly funny; that’s obviously no hole here, because a hole clearly has an edge ;) )

    The times when you needed Flash for watching YouTube videos are gone (they support HTML5 since, uh…) and they even set HTML5 as default in early 2015. So please stop writing tutorials on how to secure flash and start writing tutorials on how to use other technologies. Thanks.

  • Invoking unmanaged 32bit library out of 64bit process

    Programming .NET C# 28.09.2015

    When loading unmanaged / native libraries from managed .NET code, the normal way is to use the “Platform Invoke (P/Invoke)” mechanism.

    [DllImport("shell32.dll", CallingConvention = CallingConvention.Winapi)]
    static extern int DllGetVersion(ref DLLVERSIONINFO pdvi);

    The problem

    P/Invoke has an annoying limitation: You can not load a x86 (32bit) library into a 64bit process and vice versa. This is especially problematic when your application is compiled with the “AnyCPU”-flag - which lets the .NET runtime decide which architecture to use at runtime - and there is only one 32bit version of a specific dll. If recompiling the library against a different architecture is not an option, you have to find another solution.