Google Releases Open Source Nogotofail Network Traffic Security Testing Tool 36
An anonymous reader writes: Google today introduced a new tool for testing network traffic security called Nogotofail. The company has released it as an open source project available on GitHub, meaning anyone can use it, contribute new features, provide support for more platforms, and do anything else with the end goal of helping to improve the security of the Internet. The tool's main purpose is to test whether the devices or applications you are using are safe against known TLS/SSL vulnerabilities and misconfigurations. Nogotofail works on Android, iOS, Linux, Windows, Chrome OS, OSX, and "in fact any device you use to connect to the Internet."
Words for the sake of words? (Score:1)
Re: (Score:2)
Re: (Score:2)
>> just because something gets released under a FLOSS license doesn't say anything about the policy of the original developers regarding outside contributions ...except for the fact that anyone could fork it as "neinjumpobama" or whatever and contribute to their fork any way they see fit.
While I see your point about explaining the original developers intentions toward outside contributions, the way the poster explained things makes it sound like anyone can contribute features to ANYTHING on GitHub (w
Nice name (Score:2)
I can't think of a name that would poke any harder at Apple.
Re:Nice name (Score:4, Funny)
I can't think of a name that would poke any harder at Apple.
They were afraid that "isopensslbrokenthisweek.org" would be too hard to type.
Re: (Score:2)
I thought it was hilarious how they managed to work Oracle's name into that "POODLE" flaw they found.
Any device? (Score:5, Funny)
There's nothing for the e-ink Kindle nor the Nintendo DSi, you insensitive clod!
Re: (Score:1)
Indeed, there doesn't seem to be support for any of Nintendo's network-enabled products, nor do I see Dreamcast or for that matter any cellphones (still being manufactured and sold, net enabled and with data plans, believe it or not) that don't run Android *or* iOS. Where is the security auditing tool for my Pantech Link II [pantechusa.com] god damnit?
Re: (Score:2)
Indeed, there doesn't seem to be support for any of Nintendo's network-enabled products, nor do I see Dreamcast or for that matter any cellphones (still being manufactured and sold, net enabled and with data plans, believe it or not) that don't run Android *or* iOS. Where is the security auditing tool for my Pantech Link II [pantechusa.com] god damnit?
If you can get your network-enabled device to talk through a router, nogotofail can test it. Which means your dumbphone is probably out, since it doesn't support Wifi and you probably don't have access to the routers in the cell towers, but the Nintendo and Dreamcast devices can be tested.
Re: (Score:2)
Re: (Score:2)
Nor OpenBSD - maybe Theo told them nicely that they didn't need it :-)
Github (Score:3)
Its interesting that companies that have competing products to github (codeplex, google code) release stuff on github.
Re: (Score:2)
My guess is that it's because it's a security auditing tool. Looking around Google Code, you'll notice that a lot of auditing tools that used the platform before have moved to github.
You may speculate over the reason.
Re: (Score:2)
It's probably because people actually use GitHub.
Does Google+ have a Facebook page?
Re: (Score:2)
Re: (Score:3)
I wonder why Google did not put it in the Play Store?
Now I need to sideload apps to be secure?
Re: (Score:2)
Its a python tool which you run outside your android. If you ran it on your android, you needed superuser, and google wouldn't endorse that, would they?
Re: (Score:2)
Perhaps on a Nexus device?
I'm not sure, I've never had one (and always have root)
I downloaded the package, and Python on my Android, but fell asleep in the docs last night.
It would be rather interesting to do those types of tests on the wireless operators, and the various Androids in my junk drawer.
Would running them from a tethered laptop give different results?
Fun times ahead.
Cheers
Does it check for MITM? (Score:2)
Does it have a man-in-the-middle detector? Those are rare, but useful.
Re: (Score:3)
Yes, according to https://github.com/google/nogo... [github.com]
Re: (Score:3)
No, that's not a man-in-the-middle detector. It's a MITM attacker for test purposes.
Re: (Score:2)
It is a MITM vulnerability detector for TLS/SSL among other things, if I understand the intention of the tool correctly. If so, that's fantastic. For example, most TLS/SSL environments are susceptible to a large class of MITM attacks simply because their website exposes both HTTP and HTTPS so then you decide to enable SSL only (perhaps with HSTS) - but did you do it right? Perhaps this tool can tell you. How about testing out a new Certificate Pinning implementation that your lead developer claims will prev
Re: (Score:2)
That is cold... (Score:2)
Using a spy agency's tool on my networks? (Score:1)
that's gotta hurt (Score:1)
"open source project available on GitHub"
All you need to know about google code and sourceforge. Stick a fork in it guys (no pun intended!), you're dead.