<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>doodle dabbles &#187; security</title>
	<atom:link href="http://ashish.tonse.com/tag/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://ashish.tonse.com</link>
	<description>a little nerdery for everyone</description>
	<lastBuildDate>Thu, 17 Sep 2009 21:35:47 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>OpenSSL: The Gift that Keeps On Giving</title>
		<link>http://ashish.tonse.com/2008/08/openssl-the-gift-that-keeps-on-giving/</link>
		<comments>http://ashish.tonse.com/2008/08/openssl-the-gift-that-keeps-on-giving/#comments</comments>
		<pubDate>Mon, 18 Aug 2008 23:42:11 +0000</pubDate>
		<dc:creator>Ashish</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[ssl]]></category>
		<category><![CDATA[unix]]></category>

		<guid isPermaLink="false">http://ashish.tonse.com/?p=36</guid>
		<description><![CDATA[OpenSSL is just a gem of a package. It is so incredibly powerful, and does just about anything you could imagine that a crypto library could do. I am admittedly just an amateur at using this library, but when debugging an SSL issue where a cert was not verifying for me, I discovered this command [...]]]></description>
			<content:encoded><![CDATA[<p>OpenSSL is just a gem of a package. It is so incredibly powerful, and does just about anything you could imagine that a crypto library could do. I am admittedly just an amateur at using this library, but when debugging an SSL issue where a cert was not verifying for me, I discovered this command through Tha Googles: </p>
<pre>openssl s_client -connect www.logoworks.com:443 -showcerts</pre>
<p>This shows you every step in which the SSL verification takes place, where the verification fails, etc. Really nifty.</p>
<p><span id="more-36"></span></p>
<p>But while you can get the MD5 hash of a file using the &#8220;md5&#8243; command (or &#8220;md5sum&#8221; on Linux), if you want to find the SHA1 or RIPEMD-160 hashes of a file, you can do so with:</p>
<pre>openssl sha1 whatever_filename
openssl rmd160 whatever_filename</pre>
<p>Also, from this <a title="awesome tip" href="http://osxdaily.com/2007/05/02/quickly-encrypt-a-file-with-openssl/">awesome tip</a> from OS X Daily, you can quickly encrypt a file using openssl using the following (I used AES 128 in CBC mode) &#8212; it even prompts you for the encryption password (key) twice:</p>
<pre>openssl aes-128-cbc -e -in filetoencrypt.txt -out encryptedfilename</pre>
<p>and decrypt with:</p>
<pre>openssl aes-128-cbc -d -in encryptedfilename -out decryptedfilename</pre>
<p>It prompts you for the decryption password once and you&#8217;re all set.</p>
<p>I&#8217;m still discovering all the goodies inside the OpenSSL command. But so far, it&#8217;s proving to be incredibly powerful awesome. I understand it&#8217;s the underlying library for SSH, one of the workhorse protocols of the secure internet, but I didn&#8217;t know that so much functionality was exposed through the console.</p>
<p>Update: Wow Ok misconception. I thought OpenSSH was based on OpenSSL &#8211; it&#8217;s not. It&#8217;s apparently a common misconception. <img src='http://ashish.tonse.com/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://ashish.tonse.com/2008/08/openssl-the-gift-that-keeps-on-giving/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Executing Office Plugins Across Two Zones</title>
		<link>http://ashish.tonse.com/2007/11/executing-office-plugins-across-two-zones/</link>
		<comments>http://ashish.tonse.com/2007/11/executing-office-plugins-across-two-zones/#comments</comments>
		<pubDate>Wed, 14 Nov 2007 20:51:04 +0000</pubDate>
		<dc:creator>Ashish</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[csharp]]></category>
		<category><![CDATA[dotnet]]></category>
		<category><![CDATA[microsoft]]></category>
		<category><![CDATA[office]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://ashish.tonse.com/2007/11/14/executing-office-plugins-across-two-zones/</guid>
		<description><![CDATA[When building Office plugins, you have to give the right permissions so that the plugins can execute. Depending on your situation, you will have to touch upon multiple security concepts.
One is a Zone. A zone is like the &#8220;area&#8221; of interest. There are two zones involved in doing this:

The location of your plugin (the dll [...]]]></description>
			<content:encoded><![CDATA[<p>When building Office plugins, you have to give the right permissions so that the plugins can execute. Depending on your situation, you will have to touch upon multiple security concepts.</p>
<p>One is a Zone. A zone is like the &#8220;area&#8221; of interest. There are two zones involved in doing this:</p>
<ul>
<li>The location of your plugin (the dll files, etc)</li>
<li>The location of the Word/Excel file being opened (*.doc, *.xls, etc)</li>
</ul>
<p>These zones usually match up (if your plugin is installed on your computer, and you&#8217;re accessing an Office document on your hard drive, both locations are the &#8220;My Computer&#8221; zone).</p>
<p>For my situation, I had the plugin installed in my computer, but the file being accessed was over an untrusted network share, hence the file was placed in the &#8220;Internet&#8221; zone.</p>
<p>I had my assemblies in C:\Program Files\InstalledAppDir\*<br />
My Word Doc was in: \\networkserver\sharename\something.doc</p>
<p>It triggered the following error:</p>
<p><code>The customization does not have the required permissions to execute.</code><br />
<code><br />
************** Exception Text **************<br />
System.Security.SecurityException: The customization does not have the required permissions to execute.<br />
at Microsoft.VisualStudio.Tools.Applications.Runtime.DomainFactory.CreateDomain(Uri evidenceUri, String domainName, String codeBase, String configFileName, IAddinSecurityManager secman)<br />
at Microsoft.VisualStudio.Tools.Applications.Runtime.AppDomainManagerInternal.CreateCustomizationDomainInternal(Uri uriFullDocumentDirectory, Uri uriFullDocFilePath, String documentName, IHostServiceProvider hostCallback, IAddinSecurityManager secman, AppManifest&amp; applicationManifest, Boolean&amp; manifestDirty, IAppInfo&amp; appInfo)<br />
at Microsoft.VisualStudio.Tools.Applications.Runtime.AppDomainManagerInternal.CreateCustomizationDomain(String applicationDomainPath, String documentName, IHostServiceProvider hostCallback, IExecuteCustomization&amp; executor)<br />
at Microsoft.VisualStudio.Tools.Applications.Runtime.AppDomainManager.CreateCustomizationDomain(String applicationDomainPath, String documentName, IHostServiceProvider hostCallback, IExecuteCustomization&amp; executor)<br />
The Zone of the assembly that failed was:<br />
MyComputer<br />
</code><br />
I followed <a href="http://msdn2.microsoft.com/en-us/library/9w6bd8f1(vs.80).aspx">this guide</a> and tweaked the following policies a little and it now works:</p>
<p>MyComputer zone:<br />
&#8220;FullTrust&#8221; permissions to the url: C:\Program Files\InstalledAppDir\*<br />
Internet zone:<br />
&#8220;Nothing&#8221; permission to the url: \\networkserver\sharename<br />
&#8220;FullTrust&#8221; permissions to the OfficeDocumentMembershipCondition</p>
<p>Make sure you add the membership collection to the internet zone, even if you are accessing a network share. The easiest way to know the zone (and how I found out) is to look at your status bar when you go to the network share. It&#8217;ll tell you what security zone that path is seen as.</p>
]]></content:encoded>
			<wfw:commentRss>http://ashish.tonse.com/2007/11/executing-office-plugins-across-two-zones/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
