My Security Planet » Tags » the

Feeds

13620 items (0 unread) in 75 feeds

• Jeremy Zawodny's blog
• Mozilla Webdev
• Transcendental Technical Travails
• Ian Bicking: a blog
• Hackosis

WebSecurity

• Watchfire Application Security Insider
• BlogSecurity
• sirdarckcat
• Google Online Security Blog
• CGISecurity.com: Your Web Site and Application Security Resource
• Switch/Twitch
• mybeNi websecurity
• cat slave diary
• SecuriTeam Blogs
• Curiouser and Curiouser
• Alex's Corner
• Billy (BK) Rios
• Chris Shiflett
• christian's weblog
• funkatron.com
• GNUCITIZEN
• The Spanner
• hackademix.net
• Ruby on Rails Security Project
• It's a shampoo world anyway
• Web Security Blog
• ha.ckers.org web application security lab
• Yet Another Infosec Blog
• PHP Security Blog
• Security Thoughts
• Sunnet Beskerming Security Advisories
• Disenchant's Blog
• Sylvan von Stuppe
• Larholm.com
• The Turkey Curse
• Jeremiah Grossman
• Anurag Agarwal - Application Security Evangelist
• Ivan Ristic
• deep inside | security & tools
• omg.wtf.bbq.
• BlueHat Security Briefings
• Tactical Web Application Security
• .:Computer Defense:.

Security

• tssci security
• Plynt Penetration Testing Blog
• Michael Howard's Web Log
• Security Retentive
• BindShell.Net
• Dominic White's .tHE pRODUCT
• SecurityFocus News
• Justice League
• Schneier on Security
• Rational Survivability
• terminal23
• 1 Raindrop
• hiredhacker.com
• Matasano Chargen
• Security Vulnerability Research & Defense
• Michael on Security - Musings on Information Security
• Fortify blog
• The Art of Software Security Assessment
• GDS Security Blog
• Vodun.org
• Robert Penz Blog
• Mark Curphey - SecurityBuddha.com
• Liminal states
• Security Ripcord
• ModSecurity Blog
• IBM Internet Security Systems Frequency X Blog
• Suspekt...
• extern blog SensePost;
• Zero in a bit

SEO

• SEO BlackHat: Black Hat SEO Blog
• busin3ss.name

Tools

• Opensourcetesting.org News

48 items tagged "the"

Related tags: Expert [+], Ask [+], universe [+], everything... [+], and [+], Life [+], Web [+], Problem [+], Clouds [+], Above [+]

cat slave diary

• 

  On penetration testing – harmful?

  Posted: May 7th, 2012, 7:47pm CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Over at Sensepost Security, there’s a new blog entry wondering about Haroon Meer‘s talk “Penetration Testing Considered Harmful“. Those who know me know that I’ve had this view for a very long time. I’m sure you could find a few posts in this blog.

  Security has to be a intrinsic element of every system, or else it will be insecure. Penetration testing as a sole activity and piece of assurance evidence makes security appear on the fringes of the development, something that you pass or fail, something to be commodotized, a box to be ticked, and ultimately ignored. Penetration testing as is done by most in our industry is incredibly harmful. It’s a waste of investment to most organizations, and they know it so they try to minimize wastage by minimizing the scope, the time, and poo-pooing the outcomes.

  Penetration testing should be a part of a wider set of security activities, a verification of all that came before. All too often, we come across clients who want to do a one or two day test the day before go-live. They’ve done nothing else, and when you completely pwn them, they’re terribly surprised and upset.

  We need to move on to make penetration testing the same as unit testing – a core part of the overall software engineering of every application.

  Penetration testing should never be ill informed (zero knowledge tests are harmful and a WAFTAM for all concerned), and it should have access to source, the project, and all documentation. Otherwise, you’re wasting the client’s money up against the wall and acting unethically in my view.

  Tests should come from the risk register maintained by the project (you do have one of those, right?), as well as the use cases (the little cards on the wall) as well as from the OWASP ASVS / Testing Guides. More focus must be made on access control testing and business logic testing.

  Penetration testing has become vulnerability assessment – run a tool, drool, re-write the tool’s results into a report, deliver. No! Write selenium tasks and automate it. If you’re not automating your pentests, how can your customers repeat your work? Test for it? They should be taught how to do it.

  Folks at consultancies will shriek away in horror at my suggestion, but getting embedded is actually a good thing. Instead of hearing from a client once in a blue moon, you’re integrated into the birth and growth of software. This is a huge win for our clients and the overall security of software.

SecuriTeam Blogs

• 

  Smartphone vulnerabilities

  Posted: March 8th, 2012, 12:00pm CST by p1

  Tags:  Ask the Expert   [edit]

  Scott Kelly, platform architect at Netflix, gets to look at a lot of devices.  In depth.  He’s got some interesting things to say about smartphones.  (At CanSecWest.)

  First of all, with a computer, you are the “tenant.”  You own the machine, and you can modify it any way you want.

  On a smartphone, you are not the only tenant, and, in fact, you are the second tenant.  The provider is the first.  And where you may want to modify and customize it, the provider may not want you to.  They’d like to lock you in.  At the very least, they want to maintain some control because you are constantly on their network.

  Now, you can root or jailbreak your phone.  Basically, that means hacking your phone.  Whether you do that or not, it does mean that your device is hackable.

  (Incidentally, the system architectures for smartphones can be hugely complex.)

  Sometimes you can simply replace the firmware.  Providers try to avoid doing that, sometimes looking at a secure boot system.  This is usually the same as the “trusted computing” (digital signatures that verify back to a key that is embedded in the hardware) or “trusted execution” (operation restriction) systems.  (Both types were used way back in AV days of old.)  Sometimes the providers ask manufacturers to lock the bootloader.  Attackers can get around this, sometimes letting a check succeed and then doing a swap, or attacking write protection, or messing with the verification process as it is occurring.  However, you can usually find easier implementation errors.  Sometimes providers/vendors use symmetric enryption: once a key is known, every device of that model is accessible.  You can also look at the attack surface, and with the complex architectures in smartphones the surface is enormous.

  Vendors and providers are working towards trusted modules and trustzones in mobile devices.  Sometimes this is virtual, sometimes it actually involves hardware.  (Personally, I saw attempts at this in the history of malware.  Hardware tended to have inherent advantages, but every system I saw had some vulnerability somewhere.)

  Patching has been a problem with mobile devices.  Again, the providers are going to be seen as responsible for ongoing operation.  Any problems are going to be seen as their fault.  Therefore, they really have to be sure that any patch they create is absolutely bulletproof.  It can’t create any problems.  So there is always going to be a long window for any exploit that is found.  And there are going to be vulnerabilities to exploit in a system this complex.  Providers and vendors are going to keep trying to lock systems.

  (Again, personally, I suspect that hacks will keep on occurring, and that the locking systems will turn out to be less secure than the designers think.)

  Scott is definitely a good speaker, and his slides and flow are decent.  However, most of the material he has presented is fairly generic.  CanSecWest audiences have come to expect revelations of real attacks.

  

• 

  Michelangelo date

  Posted: March 6th, 2012, 11:23am CST by p1

  Tags:  Ask the Expert   [edit]

  OK, having now had this conversation twice, I’ve gone back to the true source of all wisdom on all things viral, “Viruses Revealed.”  I got it off my shelf, of course, but some helpful vxer (who probably thought he was going to harm our sales) posted it on the net, and saved David and I the bother.  (Remember, this guy is a vxer, so that page may not be entirely safe.)

  Michelangelo is covered between pages 357 and 361, which is slightly over halfway through the book.  However, since I guess he’s missed out the index and stuff, it turns out to be at about the 3/4 mark on the page he’s created.

  Anyway, Michelangelo checks the date via Interrupt 1Ah.  many people did not understand the difference between the MS-DOS clock and the system clock read by Interrupt 1Ah. The MS-DOS DATE command did not always alter the system clock. Network-connected machines often have “time server” functions so that the date is reset to conform to the network. The year 1992 was a leap year, and many clocks did not deal with it properly. Thus, for many computers, 6th March came on Thursday, not Friday.

  

• 

  Michelangelo

  Posted: March 5th, 2012, 5:10pm CST by p1

  Tags:  Ask the Expert   [edit]

  Graham Cluley, of Sophos and Naked Security, posted some reminiscences of the Michelangelo virus.  It brought back some memories and he’s told the story well.

  I hate to argue with Graham, but, first off, I have to note that the twentieth anniversary of Micelangelo is not tomorrow (March 6, 2012), but today, March 5.  That’s because 1992 was, as this year is, a leap year.  Yes, Michelangelo was timed to go off on March 6th every year, but, due to a shortcut in the code (and bugs in normal comptuer software), it neglected to factor in leap years.  Therefore, in 1992 many copies went off a day early, on March 5th.

  March 5th, 1992, was a rather busy day for me.  I was attending a seminar, but kept getting called out to answer media enquiries.

  And then there was the fact that, after all that work and information submitted to the media in advance, and creating copies of Michelangelo on a 3 1/2″ disk (it would normally only infect 5 1/4″s) so I could test it on a safe machine (and then having to recreate the disk when I accidentally triggered the virus), it wasn’t me who got my picture in the paper.  No, it was my baby brother, who a) didn’t believe in the virus, but b) finally, at literally the eleventh hour (11 pm on March 4th) decided to scan his own computer (with a scanner I had given to him), and, when he found he was infected, raised the alarm with his church, and scanned their computers as well.  (Must have been pretty close to midnight, and zero hour, by that time.)  That’s a nice human interest story so he got his picture in the paper.  (Not that I’m bitter, mind you.)

  I don’t quite agree with Graham as to the infection rates.  I do know that, since this was the first time we (as the nascent antivirus community) managed to get the attention of the media in advance, there were a great many significant infections that were cleaned off in time, before the trigger date.  I recall notices of thousands of machines cleaned off in various institutions.  But, in a sense, we were victims of our own success.  Having got the word out in advance, by the trigger date most of the infections had been cleaned up.  So, yes, the media saw it as hype on our part.  And then there was the fact that a lot of people had no idea when they got hit.  I was told, by several people, “no, we didn’t get Michelangelo.  But, you know, it’s strange: our computer had a disk failure on that date …”  That was how Michelangelo appeared, when it triggered.

  I note that one of the comments wished that we could find out who created the virus.  There is strong evidence that it was created in Taiwan.  And, in response to a posting that I did at the time, I received a message from someone, from Taiwan, who complained that it shouldn’t be called “Michelangelo,” since the real name was “Stoned 3.”  I’ve always felt that only the person who wrote that variant would have been that upset about the naming …

  

cat slave diary

• 

  Resurrecting the wife’s laptop – Asus hates you and you and you

  Posted: November 1st, 2011, 11:33pm CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  At Christmas last year, I bought a new laptop for the wife, an Asus K52DR with 4 GB of RAM and 500 GB hard drive. I quote from then:

  [...Asus should...] supply a real copy of Windows 7 installation media, so you can clean install the OS easily instead of wasting hours and hours and hours getting rid of the circusware. Asking folks to sit there for 2.5 hours to create 45 cents worth of DVDs is morally repugnant and evil.

  Although I stand behind every word I said above, I’m begrudgingly glad I spent the extra 2.5 hours creating those DVDs as I’m restoring her computer to factory default after she killed the previous HD by cooking it in the bedding. Obviously, not Asus’ fault, but what happens after replacing the HD is most certainly Asus’ fault. This Asus will be our last PC – my life is just too precious to donate to absurd and evil corporate practices.

  When I bought the Asus, it took me about three days to get the PC to a default-ish Windows installation, Office 2010, and iTunes with just enough drivers to run “advanced” technical devices like the display or the wireless network. Don’t get me started on the number of reboots or gigabytes of patches required. Copying Tanya’s data, migrating her PST and recovering her calendar was simple by comparison.

  I am dreading wasting yet another two to most likely three days of my personal life YET AGAIN to weed out all the circusware from the factory default build. Asus must start providing a fast circusware free method of complete restoration like Apple do. The time I’m going to spend over the next few nights, and probably the next weekend, is like a working week away from my family. Completely unacceptable.

  I tried restoring the repair partition I dd’d off, but due to the new 750 GB drive having different sized clusters and alignment than the old 500 GB drive, I struggled to create a bootable recovery partition without spending yet more time than it would take to restore using the DVDs. So I’m using the restore DVDs.

  I still don’t have a Time Machine work-a-like that can back up Tanya’s data. This is a serious issue as hers is the most likely computer to die. [...]

  And die it did. I tried Windows 7 Backup for months on and off after buying a new 2TB external HD, but as per usual being a Microsoft product, it doesn’t actually work. So too late, I found Rebit, which is just like Time Machine … but expensive. I’ll be trying that after restoring Tanya’s data. Luckily, I was able to get her most if not all of her data off under Linux all the while the HD was making very high pitched death screams. It’s dead now – all the sparing sectors are spared and the computer wedges hard if you try to do anything with it in read / write mode.

  My newish MacBook Air 11.6″ is significantly faster and cheaper than this Asus, and more so every time I have to fix it up. Once I had recovered Tanya’s data to my 2TB dumping ground on my Mac, she was up and running with one of our AppleTV’s in about two minutes.

  Tanya’s next computer will be a Mac when this one dies. I will not tolerate the loss of any more of my life to Asus insistence on circusware in the default build, and cheapening out by not providing real installation media, or Microsoft’s insistence on a recovery CD and crappy end user experience.

  I stand by my recommendation:

  Score so far: 2/5. Do not recommend. PCs are only cheaper if your time is worthless. I just don’t get it.

   

  I’m going to reduce the rating to 1/5, and the 1 is only due to the surprisingly resilient Seagate 500 GB drive that survived just long enough to get nearly all of Tanya’s data off it.

• 

  RIP Meebles 1997-2011. Best cat ever

  Posted: September 4th, 2011, 2:03am CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Some blog entries are easy to write. Not this one.

  Meebles is no more. In the end, it was peaceful, but his last days must have been hell. At least he had chicken (and lots of it) last night.

  I first met Meebles in early 1998 when I was looking for a companion to Greebo. I went to the Lost Dog’s Home, and picked the most feisty cat there. After 14 years, I know now why his original slaves put him up for adoption again, but I didn’t mind the random attacks, the aloof distance he preferred, and his general bat craziness. It was part of his charm, and it’s the reason I picked him. He had 3 days to go before what I had to do today would have been done to a six month young cat back then.

  All in all, I got the best of the bargain for all 14 years. He was steadfast in his loyalty. You had to earn that loyalty, something dog owners will never and don’t understand, but once you had it, he was a part of your life.

   

  

  I miss him already. Catchya round buddy.

• 

  Time for something new

  Posted: May 16th, 2011, 11:52am CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  As many of you have probably noticed by now, my larger than life frame is not at AusCERT 2011. This is a shame as it sounding like one of the best AusCERTs in the history of AusCERT. There’s a couple of reasons for my absence - flu and the strange case of the disappearing job.

  My services at Pure Hacking are no longer required, and so I need to get on with the job of getting on with the next phase of my life – and that means finding a great job that allows everyone to win.

  There are a couple of options on the table as I write this. But the most intriguing to me right now is to be the advanced gun for hire for consultancies with schedule overload. If you think your consultancy could use me in that fashion even a few times a year, I definitely want to hear from you. If I can make alliances with even a few of you, this could work for us all. This would allow me to work for anyone in the world from my lab here, and would allow consultancies all over the world to plug their scheduling nightmare with one of the best web app sec minds* out there period.

  • My Linked In Profile
  • My resume

  I have a strong preference for remote telecommuting jobs as I live in a regional city. This doesn’t mean that a full time job in Melbourne is out of the question, but I will be upfront about my need for flexibility (i.e. allow me to work on the train and a day a week at home), or full time remote working from Geelong. Being 2011, full time or partial telecommuting should not be a difficult decision today.

  I know I have a small but loyal readership in this blog, so if you know someone who knows someone, I’m available. I only have a short window before I have to make a decision, so if you’re able to pick me up, I definitely want to hear from you – vanderaj @ greebo . net.

  * Just in case you didn’t know, I was the Project Leader and primary author of the OWASP Developer Guide 2.0, OWASP Top 10 2007 (the one in PCI DSS), and ESAPI for PHP, and I helped set the exam for the SANS GSSP (Java).

• 

  New laptop – Asus K52DR-EX143V

  Posted: December 31st, 2010, 8:49am CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Much earlier this year, the Minister of War and Finance’s (hi Tanya!) old Dell augured in and bought the farm. First, Tanya spilt Milo (granulated malt) grains on the keyboard and this got under the key caps, causing the keys to stick. I tried cleaning it a couple of times, but many keys were never very good after even a solid cleaning. Then I spilt soup into the keyboard. In trying to take it apart and wash off the soup, I managed to break the little ribbon connector holder to the trackpad, and the keyboard didn’t appreciate being taken apart again, and I couldn’t get about six or so keys back on. Despite this, the laptop “worked” with an external keyboard for months. Finally, Mackenzie stomped all over our bed and the laptop, breaking the power cord connector near the screen. This last one did it – couldn’t get any more charge into it.

  So I gave Tanya my maxxed out late 2006 17″ MacBook Pro. We were free of the evil, monstrous Windows beast and I was happy even though I was down a computer. Unfortunately, Tanya doesn’t like MacOS, not even after six months. Color me shocked, but there you go.

  So for Christmas, I bought her a new Asus K52DR-EX143V from MSY. This unit has a 4 core AMD processor, 4 GB of RAM, 1 GB of dedicated VRAM and ATI HD5470M display chipset, 500 GB of disk, and BluRay / DVD-RW combo drive. Sounds sweet.

  Opening the packaging wasn’t too bad (there are videos all over YouTube if you’re an unboxing freak), but then the stark differences between Mac and PC packaging starts to set in.

  • There’s quite a lot of papers and odds and ends in the box. With the Mac, you get a simple, small Getting Started booklet and a sticker.
  • The Asus power brick is fairly large, but the cables are pretty short – about 1 m in total length. The end is a traditional plug that is of similar design that caused the demise of the previous Dell. You may need to take an extension cord with you on site if you travel with this model as the cable is pretty short. The Mac has a small power brick with integrated cable organizer, with long cords (about 2 m total) with a MagSafe connector. There’s no doubt in my mind that Tanya’s Dell would have survived if it had a Magsafe connector.
  • However, there’s no recovery DVD (urgh) or installation media. With the Mac, you get a single MacOS X DVD that allows you unlimited re-installs.
  • Stickers randomly cover about 45% of the Asus palm rest. Luckily, they came off fairly easily in about five minutes and a sharp knife. There was some residual stickiness from one of the stickers which I’m still yet to get completely off. There’s no stickers on a Mac.
  • There are a lot of shipping protective stickers on the Asus, such as around the bezel, on the web cam,and so on. Some of it is actually quite hard to remove such as on the hinges. There’s only a small piece of soft foam between the keyboard and the keyboard in the last two Macs I had.

  Turning on the Asus requires installing the battery, and plugging the power cord in. Immediately, differences between Windows 7 OEM and MacOS X start to stand out. For a start, the Asus is by any standards a fast computer, but it took over a minute to get to the first registration screen asking for personalization and registration details. I was working and online in two minutes out of the box on my Macbook Pro 13″ in 2009.

  Windows 7 starts in about a minute, but there’s so much circusware and trial software installed that I spent the next fourteen hours:

  • Decoding and removing all unnecessary crap off the machine. This is still not complete, but I’m much happier now. The Asus now boots in about 45 seconds
  • Removing the stupid “data” disk partition – for some reason there’s a 116 GB system partition (far too big), and a 329 GB data partition (far too small). Removing the data partition solves both issues. To fix it on yours, assuming there’s no data on the data partition, start the disk partitioner (diskpart.exe):

  select disk 0
  list partition
  select partition 3 
  
  * the data partition was 3 on my system - YMMV and do not delete your system partition!
  

  • Upgrading Adobe Reader 9 to X
  • Upgrading Flash to be as secure as it'll ever be (which is not very)
  • Installing the 78 patches for Windows, requiring just over a gigabyte of bandwidth, several attempts and reboots
  • Installing decent firewall, anti-virus and anti-spyware - not needed on a Mac (yet)
  • Installing Microsoft Office 2010. There's a trial copy of Office 2010 Starter edition already installed, but that also has all the installation bits for all editions. So I bought the Product Key Card of Home and Business edition and chose "Activate key" to turn Starter edition into Home and Business. However, it failed to install the first time, so I tried again after a reboot and that worked. On the Mac, you just drag MS Office from the install DVD to your Applications folder. The Mac install is far faster and just works. Of course, once installed, there were Office 2010 patches to install.
  • There's no installation media or recovery DVDs, so I broke out my DVD-R supply, and after 2.5 hours (seriously!) it burnt five recovery DVDs with hilarious Chinglish prompts such as "Predictably, burning will take five DVDs to create a recovery DVD". You can't make that crap up. Of course, using the recovery DVDs will blow away all Tanya's data and return the circus ware, but ... it had to be done. The Mac has a full OS DVD and thus doesn't lose any user data, and in many cases keeps your applications and settings working too.
  • I'm currently installing iTunes and migrating data across. This would take time no matter if it's a PC or a Mac, so I'm going to give it a free pass at the moment.
  • I'm still trying to set up Outlook 2010 and her Windows Mobile 6.1 phone. This should be a no brainer, but ... Windows 7 doesn't seem to like Windows Mobile 6.1.
  • I still don't have a Time Machine work-a-like that can back up Tanya's data. This is a serious issue as hers is the most likely computer to die. Suggestions welcome.

  
  Using the laptop
  
  As it's only the second day of having the laptop, I've not done any real work on it yet. PCs are unproductive like that. I'm still yet to find out if it can run videos in iTunes full screen on our TVs, which the Macs do in their sleep. Tanya's previous Dell used to have serious lag time between video and sound and the fans were on full time, requiring extra volume. I'm hoping that this computer is at least as able as a four year old Macbook Pro.
  Problems so far
  
  I don't know if this is just me, or known problems with Asus laptops, but I've found that connecting the VGA adapter to a 24" screen at 1920x1080 @ 32 bpp produces a wobbily and shimmering display that flickers a great deal. I would get eye strain after a few minutes if I had to use this as my primary display. So I tried a HDMI cable, but that produced a pink / purple display centered in the middle of the screen. I don't know if this means I have a broken laptop yet, or if this is how crappy all PCs are. I hope it's not broken, as I've invested so much time in getting to where I am at the moment.
  Conclusion
  
  In short, the machine is very fast at some things. Except for booting and running Office seems a bit tardy. The external display connectors don't seem to be working properly. At least, it found my Bluetooth mouse and used it without any additional issues.
  
  As a Mac user, I cannot understand why PC manufacturers don't take that little bit of extra time and make sure their product works out of the box with minimal fussing. The circusware was very annoying. That should go, as should the sticker vandalism. The patching was annoying but necessary. It shouldn't require multiple reboots. Someone should test the installation of Office 2010 with a product key card before creating the image. A slightly longer power cable would really help and is not that expensive. And supply a real copy of Windows 7 installation media, so you can clean install the OS easily instead of wasting hours and hours and hours getting rid of the circusware. Asking folks to sit there for 2.5 hours to create 45 cents worth of DVDs is morally repugnant and evil.
  
  Although in terms of raw speed, the equivalent Mac is about twice as expensive as what I've spent on the Asus, the reality is that my two year old Mac boots up faster, starts Office 2010 faster in emulation than this thing, and has a better screen and a longer battery life. The price of a Mac with my Mac's performance is $1499, only a few hundred more. If the display ports are broken, I'll have to do all of this again with a replacement unit next week. Argh!
  
  Score so far: 2/5. Do not recommend. PCs are only cheaper if your time is worthless. I just don't get it.
  

• 

  E-mail bankruptcy 2010

  Posted: December 22nd, 2010, 3:47am CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  I’m very sorry to do this – again – but I’m going to declare e-mail bankruptcy on Dec 31, 2010. I have failed miserably in keeping my personal inbox clear and replying to e-mails this year. That has to change as it lets a lot of good folks down.

  If you have sent mail to me and I have not replied, please wait until Jan 1 and send it to me again. I will deal with it as soon as I get it.

  My only new year’s resolution is to do the Inbox Zero thing properly this time around.

• 

  Looking for inspiration

  Posted: June 20th, 2010, 8:17am CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Like many technical writers, I am constantly looking for ways to improve my writing skills. I don’t think there will ever be a time when I think “Okay, that’s good enough” and stop criticizing my own work.

  I am constantly in awe of other authors, particularly those that have published great works. I seek out author interviews on scholarly websites, and places like Galley Cat, in an effort to glean small insights into the life of an author.

  I started out by reading author interviews for any morsels on how they organized their day and their writing space. This accelerated once I started working from home. This is a futile project – each author, if they mention it at all, has a completely different day structure and writing space than the author before. Some write early in the morning (impractical for me), some write late in the night (I’d love to, but I have a 2.5 year old who says “close eyes” and means it); some write in glorious writing palaces redolent in over stuffed furniture and old books others write in long hand at the local coffee shop or library. No two are the same. Sigh.

  The one common theme is that they write every day. Iain Banks, one of my favorite authors, writes for only part of the year and takes the rest off, but still manages a punishing schedule and daily word count to pump out beautiful works of art.

  Another common theme is supportive family and friends. I can attest to that – my cats led a lonely life whilst I was tapping away at the OWASP Guide 2.0 for several months. I don’t think I could ever do that again – not least for family reasons.

  Technical writing for web application security is far different from any form of fiction. It’s different from most non-fiction – and it’s dramatically different from sports writing. We’re expected to dumb down (“communicate”) with our peers in a way that nearly no other technical field would allow. In my field, respect is paid to those who can communicate highly technical, very advanced concepts in a way that could be understood if they were on the back of a “Fantale” wrapper.

  I am not disparaging my field, for I love it, but I do object that our terms of art – our short hand – is so easily sacrificed. I need to learn how to write dumber, become one with my inner dumb writer, and make sense even when it makes no sense to write for the average tabloid reader. I think we underestimate our reader’s intelligence and insult them terribly every time we pump out a report in basic English (that is – using only the 500 most common words).

  Viva la revolucione! Whoops, that wasn’t basic English. My bad. As for more author interviews – it’s like reading a good autobiography – hard to put down. I think I will continue to seek out author interviews, even though I think they will in the end not shape my writing style nor my work space to any great degree.

• 

  GaiaBB: Dog food coming soon

  Posted: January 30th, 2010, 9:04pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  It’s been a slow haul working on converting all the database access to PDO. There’s just so MUCH crap in there.

  So to keep things moving, I’m going to move www.gaiabb.com to run on the donated OLPCs at my home.

  More details here.

• 

  Inbox Zero

  Posted: December 17th, 2009, 7:21pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  It’s Inbox Zero time again. Every year, I do the Inbox Zero thing and archive all my mail (read and unread) on January 1 from the year just gone. I also tell myself it’s time to start following the IZ rules, but … they somehow always fall to the wayside.

  I get a lot more personally addressed e-mail than most folks do, and I don’t have a chance to action every item that needs it. I know I have missed replying to at least 20% of my mail – my bad. To make amends, I will work on replying to the last three months of outstanding mail by the end of the year. But I bet there will be mail that still needs actioning that will be archived.

  Action Required: If you e-mailed me, and not had a reply from me by January 1, please re-send your mail to me after January 1, and mark it REPLY NEEDED in the subject. I have an e-mail rule that flags such messages and I will reply to you.

• 

  Be careful for what you wish for

  Posted: December 1st, 2009, 7:16am CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Well, the Emissions Trading Scheme is dead – for now. Yay! I do a little dance on its grave. We’ll have to fight it when the double dissolution election comes up sooner than later.

  However, I wasn’t expecting the mad monk, Tony Abbot, to gain the Liberal leadership. That was a surprise, as I bet it was to the majority of the Liberal party MPs.

  With such a right wing, homophobic, anti-abortion, anti-pretty much anything we’ve achieved over the last forty years to several centuries, and top of that a truly hard core Catholic elected leader by the thinnest of margins (1 vote – a donkey vote *), the Libs will be in electoral wasteland for at least one and probably two more elections. Either the Libs will have to split into the electable bit and the unelectable’s, or they will have to try again in a few years after they get rid of Abbot.

  Abbot is simply unelectable – even my wife who leans in the Libs direction doesn’t like him. Sure, Abbot will make the hard core religious and climate deniers happy, but they’re a tiny minority here – and they already vote Liberal. All the moderate swinging voters – they who elect our governments – will abandon ship once they realize just how backward Abbot is on so many things.

  With Abbot being the mental giant that he is, he’s going to oppose pretty much all Government bills. I bet he opposes a really stupid little bill and that’ll be the trigger. KRudd could phone it in and win.

  Bring it on – maybe enough of the disaffected voters will move to the Greens and we can get some real carbon reduction instead of the reward-the-polluters ETS.

  * I bet the idiot ^H^H^H^H^H Member of Parliament who cast the deciding donkey vote (‘no’) is regretting their ineptitude tonight. The silly thing is that the vote was almost certainly cast by a moderate Liberal. That moron has ensured they stay unelected for at least another four and most likely seven years.

• 

  Dang expired credit cards

  Posted: October 19th, 2009, 5:01am CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Well, that’s been a rotten few days…

  • My friend TJ, 43, passed away from diabetic related complications and worse than third world access to basic health care in a first world country – the USA.
  • My USA credit card expired.
  • This domain expired and failed to auto-renew using my USA credit card.
  • Tanya had to go to hospital twice after a fall in the back room… on my birthday.

  Some of these things are important, others not so much. So apologies all who might have tried to mail me and for this site to be down for more than 24 hours, but I had other things on my mind. Please re-mail anything if you haven’t heard back from me.

  TJ – rest in peace mang. I just wished you could have migrated to any other first world nation and gotten the basic meds and help you needed instead of dying so, so young from completely and utterly preventable and manageable diseases. I’ll miss you and remember you.

• 

  40 years ago today, humanity landed somewhere else than Earth

  Posted: July 20th, 2009, 11:17am CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  40 years ago today, three brave folks and a huge team at NASA (and indeed the entire industrial military might of the USA) travelled to the moon, and two landed somewhere else other than Earth. Neil Armstrong and Buzz Aldrin stepped out for two and a half hours, slept for a bit, ate a meal, and nearly 22 hours later came back to Earth.

  It was an amazing achievement, one that brought all of humanity closer together.

  Once you see the photo of the entire Earth from Apollo 8, national borders become irrelevant, nationalities are irrelevant, and petty politics and hateful people are irrelevant. We’re on this one small blue globe together, and we have to look after it together. Stupid shows like “Border Security” show the small minded at work. One day, and I hope it will be soon, such petty and silly concerns will be as quaint as the feudal towns who were as countries unto themselves not even 600 years ago. We breathe the same air, we’re all related together, we eat the same food. We’re all doomed if we continue to think like four year old children who refuse to share the sand pit because “it’s mine”. Nations, borders and immigration controls cannot be demolished soon enough.

  However, space exploration is best left to robotic missions. They are cheaper, safer, and they can do more. The only manned moon mission that achieved decent science outcomes was Apollo 17, and that was because for the first time, they sent a geek instead of flying jocks. You can teach geeks how to fly, but you can’t teach jocks to be geeks.

  The shuttle has been a total disaster. It has locked us into low earth orbit, does almost no science, costs zillions, killed two crews, and by the time it retires, it will have delivered only a very small number of scientists to a completed ISS, which will hamper ISS’s ability to do science. There’s a good chance after the shuttle retires, science at ISS will stop. This means about $1T has been wasted building a nonsensical space outpost. It has provided a large number of contractors with awesome corporate welfare for over 30 years, but that’s not an “achievement”. It doesn’t get us all thinking how great we are as a species, nor fosters good will amongst all peoples. Boondoggles are like that. We’ve squandered enough life and money on such frivolities.

  Robotic missions like Pioneer, Voyager, Hubble, Galileo, Cassini, Deep Space One, SOHO, Messenger, Mariner, Viking, Pathfinder, Spirit and Opportunity and now the new Herschel mission provide far more science for the buck. Indeed, Hubble has provided more papers than any other observatory and confirmed some of the most intriguing basic properties of the Universe.

  All publicly funded space missions should be robotic missions. Let’s leave people in space to commercial interests as there’s no scientific reason for them to be there. We need to have people in space, but not by public funds. If human space exploration was funded privately, the funds required to put them there will be optimized rather than being solely about corporate welfare to the military industrial complex. Such space ventures should be regulated for sure, because we don’t want another disaster like the Shuttle killing off an exciting new path for humanity, but it should not be publicly funded. We need to dream big and think about how to get there faster. The nearest star is at least 160,000 years away travelling at Helios speeds (which is currently the fastest thing we have ever launched). That’s far too long for an interstellar mission. We’ve got so far to go, and yet we’ve wasted 30 years doing nothing of any real lasting value in low earth orbit. That has to stop. We must move on.

  Don’t get me wrong, I’m all for more space faring activities. One day we will need to get off this planet, and developing those technologies may as well start now. Just not in the failed ISS or back to the future moon missions (Orion / Ares).

• 

  Soon, there will be one

  Posted: June 21st, 2009, 10:46am CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Well, what an interesting weekend. A cold, working like a slave, and one of my co-workers is a father for the first time (Congrats, Ty!). But that’s not the most interesting news.

  I will be taking sole ownership of my forum, Aussieveedubbers, sometime this week. This means that I will have to spend a bit more non-existent personal time attending to it.

  This is good and bad news:

  • For UltimaBB, the underpinning forum software, it’s fabulous news. UltimaBB was never released and is now effectively a dead project. My acquisition of AVDS gives me the impetus to make the forum software as good as I can make it. Once I’m complete, as it’ll be by far the most secure PHP forum out there. Very few open source programs ever get the chance of a top to bottom code review. Once I’ve fixed all those issues, I will think about possibly adding a few flashy features and integrate it with CPanel and others, so ISPs can easily deploy it. Obviously that integration will not come cheap. Hopefully, I can start to earn a bit of income from the forum, finally.
  • For OWASP, this is not good news. I have two current projects, the Developer Guide and ESAPI for PHP. I need ESAPI for PHP to be complete to help UltimaBB, so you can guess which of the two projects will get my time.
  • For my personal life, I hope Tanya will forgive me making her do some basic accountancy work. I think it’ll ease her eventual way back into the workforce in a few years, as she is terrific at accountancy, and I would hate to see her lose all her skills for the want of a bit of work here or there. However, it’s not just delegating the book work to my poor suffering wife, it’s also a bit of an ask for the few hours I have to give right now.

  So if you want to help with the Developer Guide, please join the mail list and let us know how much time you have, and where your interests are.

• 

  Texas School Board of Education ^W Dumbasses

  Posted: March 28th, 2009, 9:25am CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  SHAME! SHAME! SHAME!

  Texas’ Board of Education will be ridiculed by pretty much everyone (including me in this post). I would make more fun of them if the consequence of their gross incompetence didn’t lead directly to irreparable harm to the next ten year’s worth of students who will be unemployable in any medical, bio medical, biology, DNA testing, stem cell research, drug research, geology, paleontology, farming, animal husbandry, crop research, or pretty much any field which requires them to understand the basics – or indeed, fine detail – of evolution.

  Modern medicine, to name but just one field, doesn’t make ANY sense except if evolution is true. It’s as simple as that. There’s about as much doubt regarding evolution as there is doubt the planet is round and is orbiting our sun.

  In my view (and IANAL), these students have due cause to sue the asses off the Board of Education for future earnings loss. What does a specialist medical doctor make per year? Half a million? Million per year? Multiply by all the number of students in each of these fields… whoa that’s a lot of moolah.

  I call on all biology text book authors to refuse to allow “updated” editions to be issued with the forthcoming Texas changes. If the schools can’t buy any books, so be it. They can use the ones they have today that have the facts, instead of sowing doubt. Scientists everywhere should make it incredibly clear to their congress critters and senators, as well as their local Boards of Education, that this decision is about as dumb as they come.

  I’m actually struggling to understand how “educated” folks, charged with the incredible responsibility of educating their state’s children could be so abusive. They should be sacked immediately and this terrible position stuck down for all time.

• 

  Baby Girl Makes 21,710,079

  Posted: March 23rd, 2009, 9:04am CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Mackenzie is now an Australian citizen. Awesome.

• 

  Baby Girl Makes 21,710,079

  Posted: March 23rd, 2009, 9:04am CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Mackenzie is now an Australian citizen. Awesome.

• 

  The new dark ages are approaching

  Posted: March 21st, 2009, 10:10pm CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  When I left for America, I was surprised at how few places accepted electronic payment methods compared to our experience in Australia. By the time we left the USA barely two years later, that was not a problem - almost everywhere took cards.

  Except … now, we’re back in Australia, and things have gone backward. Few places have EFTPOS now. It’s actually hard to pay electronically. Where I live, it’s impossible to buy coffee using EFTPOS, debit or credit cards.

  I bet it is because the local Big 4 banks are cutting their noses off to spite themselves. It leads me to believe we are entering the downward spiral into luddite non-use of electronic payments. We may have seen “peak” EFTPOS rollouts, and it’s all downhill from here.

  We’ll be a cash society soon, and this is incredibly bad. So many things that were once trivial to do require effort to do. It will cut economic output. Folks like me who refuse to pay the “disloyalty” fees at ATMs just will not buy at places without card machines when I run out of cash.

  This is bad news for the local economy, bad news for the banks, and bad news for employment. And bad news for me because I do not get a good cup of coffee and I’m pissed off.

Rational Survivability

• 

  Berkeley RAD Lab Cloud Computing Paper: Above the Clouds or In the Sand?

  Posted: February 19th, 2009, 9:33am CST by beaker

  Tags:  Above the Clouds   [edit]

  I've waffled on how, or even if, I would write my critique of the Berkeley RAD Lab's paper titled "Above the Clouds: A Berkeley View of Cloud Computing." 

  I think I've had a hard time deciding where the authors have their heads, hence the title.

  Those of you who know me are probably chuckling at the fact that I was a good boy and left off the potential third cranial location option...

  Many people have written their respective reviews of the work including James Urquhart, David Linthicum and Chuck Hollis who all did a nice job summarizing various perspectives.
  I decided to add my $0.02 because it occurred to me that despite several issues I have with the paper, two things really haven't been appropriately discussed:

  1. The audience for the paper
  2. Expectations of the reader 

  The goals of the paper were fairly well spelled out and within context of what was written, the authors achieved many of them.
  Given that it was described as a "view" of Cloud Computing and not the definitive work on the subject, I think perhaps the baby has been unfairly thrown out with the bath water even when balanced with the "danger" that the general public or press may treat it as gospel.
  I think the reason there has been so much frothy reaction to this paper by the "Cloud community" is that because the paper comes from the Electrical Engineering/Computer Science department of UC Berkeley, a certain level of technical depth and a more holistic (dare I say empirical) model for analysis is expected by many readers and their expectations are therefore set a certain way.  
  Most of the reviews that might be perceived as negative are coming from folks who are reasonably technical, of which I am one.
  
  To that point and that of item #1 above, I don't feel that "we" are the intended audience for this paper and thus, to point #2 above, our expectations -- despite the goals of the paper -- were not met.
  That being said, I do have issues with the authors' definition of cloud computing as unnecessarily obtuse, their refusal to discuss the differences between the de facto SPI model and its variants is annoying and short-sighted, and their dismissal of private clouds as relevant is quite disturbing.  The notion that Cloud Computing must be "external" to an enterprise and use the Internet as a transport is simply delusional. 
  
  Eschewing de facto models of reference because the authors could not agree amongst themselves on the differences between them -- despite consensus in industry outside of academia and even models like the one I've been working on -- comes across as myopic and insulated.  
  Ultimately I think the biggest miss of the paper was the fact that they did not successfully answer "What is Cloud Computing and how is it different from previous paradigm shifts such as Software as a Service (SaaS)?"  In fact, I came away from the paper with the feeling that Cloud Computing is SaaS...
  
  However, I found the coverage of the business drivers, economic issues and the top 10 obstacles to be very good and that people unfamiliar with Cloud Computing would come away with a better understanding -- not necessarily complete -- of the topic.
  
  It was an interesting read that is complimentary to much of the other work going on right now in the field.  I think we should treat it as such and move on.
  
  /Hoff

cat slave diary

• 

  Back in Australia

  Posted: February 9th, 2009, 6:01am CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  It’s a bit of a shock coming back. Some things are the same, many things are very different. 

  I had been homesick for some time, and I was glad to meet up with my family and my cat(s). Unfortunately, Greebo either did not remember me or worse, didn’t want to talk to me. Meebles was not to be found. I hope I can look after them again soon. Mackenzie is a universal hit here with everyone, which is awesome. She’s also taking well to so many new faces. 

  The weather changed from being icy and snowy -5 C (20 F) to a scorching 47.9 C (118.2 F), with the worst fires on record raging about 200 km from where we now live. We’re okay - even if so many are not. My thoughts are with those affected by the fires. 

  The sunsets are glorious - I’ve missed them. You can only work this out once you actually viscerally experience something old you fondly remember. The light is different here, and not just because the air is tinged with burnt ash and smoke. 

  The shopping hours shortened, the online shopping options that were in Australia seemed to have disappeared. I remember far longer hours in the past, and many more options … but they’re gone. Oh well. 

  I managed to drive on the correct side of the road with no real issues - still haven’t turned into the wrong lane, although shopping center car parks are still interesting. 

  TV is still crap, and yet awesome. I had missed good news coverage, and weather forecasting that is within 1 degree C of the actual temperature a few days out, and now I have it back. I miss the ease of watching what I want on my Tivos, but then again, I know have a lot more time to do stuff with my family. I always found US TV a bit odd - almost everything was bleeped, but there was no diminuition in the number of bleeps. Tonight, I watched a depression special with one of the world’s best comedians, Stephen Fry, and he dropped the c word, and various other words that would be bleeped in the US. I will not miss the bleeping.

  We’re well on our way to restarting our life here. Life is good.

• 

  Speaking at OWASP AU

  Posted: February 6th, 2009, 5:38pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  I will be speaking at OWASP AU 2009 this year!

  I am conducting a one day training session on how to BUILD secure applications using ESAPI and verifying the same using Application Security Verification Standard (OWASP ASVS). If you are a builder, you will want to attend that class, which is very reasonably priced at USD $650. Typical instructor led training is $2500 per day - at least. The main conference is only USD $425, which is a bargain compared to Black Hat or RSA. 

  During the two day main agenda, I will be speaking about why you should be protecting your VALUE, and not worrying so much about THREATS. It’s time we stopped worrying so much about XSS and so on, and move on to something that actually pays some returns. 

  Get your registration fingers happy here:

  • OWASP AU 2009 Main Page
  • OWASP AU 2009 Agenda
  • OWASP AU 2009 Training Schedule
  • OWASP AU 2009 Registration

  See you there!

• 

  Andrew: Cultural Learnings of America Benefit Glorious Nation of Australia

  Posted: January 9th, 2009, 9:15am CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Well, it’s time to go home.

  We’re leaving the USA at the end of the month, and should be back in Australia February 2-4.

  It’s going to be a bit busy over the next few weeks whilst we pack, sell all our worldly goods, and organize our new life in Australia.

  I’ve had a blast whilst in the USA, and I’ve been to (at last count) 25 states. I will update my Google Map and find out for sure. I’ve seen lots of places I’d never come to by myself, like Pittsburgh, and loved every bit of it. I’ve been to places that I would have been, and loved it - like Miami, SF, NYC, and DC. Recently, we started exploring Baltimore, but unfortunately, that’s going to be cut short. I hope to make the Air and Space Museum before we go, but the amount of stuff we have to do, including sell the car, may simply preclude that.  

  I don’t have a job lined up yet, so if you are in a position to hire a remote worker or have a position in Melbourne or Geelong, Australia, I’d love to hear from you. You can find me on Linked In, and I’d be happy to give you my current resume.

• 

  2009 - The Year of WebAppSec Solutions

  Posted: December 31st, 2008, 5:02pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  “He who controls the present, controls the past. He who controls the past, controls the future” - Orwell, 1984

  Looking back at the last few years, we’ve made some huge leaps at swatting at issues that bit us in back in the past, but still have not made a huge fundamental leap to controlling the future, and in particular controlling the risk from VALUE attacks, such as phishing, crime ware, and process issues (aka business logic issues).

  I’ve been interested in process issues for a long time as its the easiest way to get VALUE out of a system. One the earliest web app sec attacks was against CDNOW back in the mid 90’s. They preceded and were bigger than Amazon for a long time. Ultimately, Amazon acquired CDNOW. Why? Apparently, they had a cool front end shopping cart, a payment system and a shipping system. Sure enough, the shipping system took a bunch of hidden fields and accepted a “paid=yes” type of flag. So essentially, you could fill in the hidden fields with the CDs you wanted and skip ahead to the ship bit, and get free stuff. End of story, they’re part of Amazon today instead of the other way around. The opportunity cost of being insecure for CDNOW can be measured in billions and will continue to rise as the years go on. That one attack wasn’t the end of the business, but it set them along the path.

  So why in 2009 we do we allow 1995 era attacks to succeed? Why is this stuff not taught at University? Why are the business folks who make really bad decisions allowed to continue on doing the same old, same old, when they should know - do know - that it’s going to cost them a lot more in the long run?

  So let’s look at the lows and highs of 2008:

  Highlights of 2008:

  • PCI compliance starts to hit merchants. They still suck, but they’re unlike before, they’re now going to have to fix their stuff or go out of business
  • PCI 1.2 updated to OWASP Top 10 2007. Awesome. 
  • OWASP has a huge security summit in Portugal, deciding on future directions, and an awesome set of security conferences around the world. I think we have hit critical mass
  • OWASP Application Security Verification Standard Released

  Low lights of 2008:

  • Phishing and malware links as tracked by APWG rose to its highest level ever. 
  • Massive compromise of credit cards continues - vendors continue to flout PCI regulations and common sense.
  • SQL injection attacks launch a million malware infestations

  This basically means that attackers have been noted by the mainstream media and others as attacking VALUE through web apps, and not assets, like pwnage. They don’t care about the mechanism so much as the money. This has been my view for at least five years. I don’t care about if you control a 100,000 bot fleet - your just desserts are coming soon in your very own dawn raid. I do care if you can steal from 95,000,000 folks or defraud thousands with one e-mail.

  “How’s that working out for you?” - Dr Phil McGraw

  When we do something that is clearly not working, it is beyond time to do something different.

  Back in 2002, I was doing security architecture in web apps for some of my more forward thinking clients. I have a draft book in my OWASP folder on Web App Security Architecture I started in 2003. When I moved to the USA in 2006, security architecture was completely off the average US enterprise architect’s radar. Only today are seeing some traction in this space, and not everywhere. 

  Success stories elsewhere

  With air safety, various safety bureaus review crashes and make binding resolutions on pilots, manufacturers and airlines to remediate design issues and human factors. For example, in many cultures, a strong hierarchal society is the norm. More than a few co-pilots have sat meekly by, refusing to override their captain as they plowed straight into the ground. So the airlines were forced to change the human element in the cockpit, forcing sub-ordinates to take control when the situation warranted it.

  Air safety is a poster child for what can and should be done. From the early days when cowboys ruled the roost and many died, to today when only rail is safer per million passenger miles, air travel is one of the safest transport forms, despite being so inherently dangerous from a physics point of view (speed, height, traffic density, weather conditions, etc). We need to emulate air safety. Web application security is at the point where enforceable regulations are in their early days, like seat belts in cars were 50 years ago. 

  We can and must skip 50 years. I’m not a huge fan of heavy handed regulation as I feel it will stifle the next big thing if done wrong, but I think many languages and frameworks are settling around a few major paradigms. We can help them, and they must help their users. 

  We KNOW how to secure those meta-issues. We MUST secure those meta-issues. So here’s my 2009 Wish List:

  Education

  We have to educate those who come after us. This means getting into every CS and Software Engineering course world wide, and ensuring they have at least one mandatory security architecture / software security subject.

  All applications share exactly one feature: security. I don’t think you can be a sound practitioner unless you have at least heard about this most fundamental of issues. It’s like graduating accountants who have not completed Audit 101. It’s completely ridiculous that there’s no equivalent in most CS and software engineering degrees today. 

  I am also only going to speak at developer and architecture conferences. Speaking at security conferences is awesome and I usually get married or drunk or both, but it really doesn’t advance the state of the art. Architects and developers must get on board, and to do so requires their buy in. 

  Eliminate XSS and SQL injection

  We really need to get some basic technical things off the radar, so in 2010 and beyond we can deal with VALUE attacks. To that end, 2009 should be spent encouraging open source and vendors to fix XSS and SQL injection. We know how to fix these things. OWASP’s ESAPI has the canonicalization, input validation, and output encoding features that every application can use. Every modern framework has prepared statements or a safe(r) mechanism than dynamic statements.

  I encourage the OWASP leadership and those in leadership positions to take a stand on these two items. I call on all framework providers to make the simplest possible output mechanism XSS safe. I call on framework providers to deprecate and eliminate dynamic SQL queries, or at least make serious warnings pop up so that folks know that they should not be using those interfaces. I call on open software reporsitories to stop downloads of packages that have open CVE entries. It’s important to bubble up the importance of safe software, and we can’t do this by wishful thinking.  

  We can do this. It’s not a pipe dream. 

  Security Architecture Is a First Class Citizen

  It’s important to start putting security architecture in its place - which is every bit as important as the shiny buttons folks click or the processes businesses use to get stuff done. We cannot hope to eliminate design issues that allow VALUE attacks unless security architecture fu is strong within every organization writing software today. 

  Although history is written by the victors, we’re a long way from victory. Let’s get cracking!

• 

  Santy Paws Came To Town

  Posted: December 26th, 2008, 10:09pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Well, that was a blast. 

  On Wednesday afternoon, I took Baby Girl to see Santy Paws (Satan Claws or Santa Claus, depending on if you believe in Ceiling Cat, Basement Cat, or are just a plain pagan). We stood in line for close to three hours. There was one Santa’s helper on duty, and for obvious reasons (being ridiculously old), he kept on taking breaks. You’d think Columbia Mall would  work out… 

  Thousands of parents  x $13.95 (at least) per sitting == they can afford more than one Santa, and possibly a few hundred Santa’s. 

  But no. Oh well.

  Baby Girl was awesome. She hung out in line with me even though she had little to do, and couldn’t go crawling or exploring - which as every parent knows is a recipe for Total Munchkiness. However, she was happy for the most part - including the first bit when we shuffled past Santa’s Grotto on the way to the entrance some hour or so ahead. She liked what she saw - kids sitting on this old man’s knee and stuff going on. However, looking back now, I think it may have been the computer and the cameras. She’s an awesome geek grrl and loves her gadgets.

  The line went on and on. When she got too antsy, I gave her some puffs and water. After about two hours, she started getting really antsy, trying to stand up and get out of the stroller. So I fed her one of the last pre-made bottles. Awesome baby girl returned. I didn’t know how much longer she’d last as it was well past nap time, but I persevered. She let the slightly older girls just in front of us touch her face and play with her toys on the front of the stroller. Things were looking good, even though I really wished she had taken a nap.

  She was ultra good right until the end. Santa took a break just before me, and as he walked past, Baby Girl started to show the five early signs of being tired, which is being a bit crotchety and rubbing her eyes and being a bit of a munchkin. Oh well, only a few more minutes. 

  So Santa came back, and I quickly put her on his lap thinking this could be a one shot deal, all the while making sure she could see me. I didn’t even let go of her hand before…

  WAAAAAAAAAAHHHHHH!

  Tears started flowing, tears of real fear. She stared at Santa, pulled away towards me, and started gulping air. Not good. Although I secretly (okay, not so secretly) wanted a photo of her crying as that makes an awesome 21st birthday picture, I didn’t want what came next…

  BAAAAAAAAAAARRRRRRRRF!  WAAAAAAAH!

  Santa got it good, and so did baby girl’s costume and the floor. Suffice to say, as she’s growing up fast she doesn’t do inoffensive and small up chucks any more. She did a veritable projectile exorcism of toddler barf. It stunk of mostly digested puffs, milk, lunch and formula. Poor baby girl!

  I took her to the men’s bathroom, which thankfully had a change area, and got her cleaned up and changed into emergency  civilian clothes.

  She looked at me so sadly that I couldn’t take her back to go sit on the old man’ s lap again. I’m reasonably certain Santa was relieved as well.

  So no Christmas photo with Santa this year. Of course, from the Silver Lining in Every Bad Cloud Situation Department: I have an awesome story for her 21st birthday! Yay!

• 

  A review of 2008

  Posted: December 25th, 2008, 4:46pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Last year, I made the following observations / resolutions. Let’s check out how well I did:

  • Be a good dad to Mackenzie my gorgeous daughter, and a wonderful (hopefully less chubby) hubby to Tanya, my beautiful wife. 

  I think I succeeded at this one

  • Lose some weight and mean it this time. What New Year’s Resolution is complete without this one?

  Although I am lighter (149 kg down from probably ~ 155 to 160 kg), I’m not significantly lighter. I could have been close to 100 kg if I had stuck to an appropriate diabetic friendly diet and exercised more. I blame baby girl. JOKING. I’m a member of the cult again, and I have diary entries for walks and gym, so hopefully this time next year, may be I could be closer to 100 kg than I am today. 

  • Finish at least one piece of first class research in the web app sec field

  Nope. Not even close. Started a few though. And that’s the subject of my next post - what to look forward to in 2009.

• 

  I fear mitochondria

  Posted: December 9th, 2008, 11:46pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  I was having lunch today at a nearby Chinese restaurant. I was seated next to some young folks who were loudly having a biology discussion. I tuned in because I’m a geek, but I kept my mouth shut after I heard one bad science moment after another.

  Unfortunately, the discussion quite quickly changed from being a biology discussion to a metaphysical discussion about whether mitochondria see us as the parasite or vice versa. Whilst I am not a biologist, I do receive “Nature” and therefore have the right to blog mindlessly on this topic and any other science related topic.

  From what limited understanding I scraped from the Wikipedia article, mitochondria and us are at best symbiotes, but the reality is that without mitochondria we would be nothing and without us, our specific types of mitochondria would not exist. Therefore, I doubt the mitochondria fear me any more than I fear the trillions of them running around my body right now.

  In the next few minutes, the discussion on the next table did not get any closer to making any sense. In the end, I realized that they were design students (I am lunching near Madison Ave). Nothing wrong with design and fashion per se beyond its obvious superficiality and banality, but it’s obvious that science is not a part of their education.

  I wonder about this country’s long term future. The USA needs folks who at the very least understand science and do not fear it.

• 

  Diabetes: One Year To The Day

  Posted: November 28th, 2008, 11:30am CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  This is the one year anniversary of being diagnosed with type 2 diabetes. It’s been an interesting year, and I’ve learnt a lot about what it means to have diabetes, and it’s definitely impacted my diet.

  The biggest change is a sad one for me - some of my favorites are simply not good for me. I can’t eat a bunch of stuff, including white rice (> 200 mg/dL blood glucose for even small amounts), which eliminates so many foods and makes eating commercial asian food basically off limits. Pretty much everything white - white flour, white bread, sugar, potatoes, etc, is off limits.

  Another loss, which I feel sad about the most is alcohol (I do have the very occasional drink, but I’ve had less than 1 litre of alcoholic drinks in the last year, mostly beer, and I usually pay at the finger jab for it too).

  In some ways, knowing that I have diabetes helps explain some of the things I have had wrong with me for a while, but in other ways, I’m sort of frustrated as I’m at the very low end of the diabetic scale. My A1C is 6.1 for several endocrinologist visits. I’ve been put on some interesting medications, including one that helped me mostly get over my needle phobia. Nothing concentrates the mind more than having to inject yourself three times a day. However, that med made me feel quite ill, so I was able to stop it.

  The one disappointment is that I’ve not had much luck in losing weight, which is a key component of getting off the various medications I’m on. I really need to spend way more time at the gym as my diet is optimized to the point that I’m no longer losing weight by eating less (and different). My body is extremely good at making me awesomely tired and exhausted rather than giving up the fat reserves. The only way to beat this thing is get the metabolism moving. I hope this time next year, I will have better news on the weight front. The good news is that I now fit into the clothes I came to the USA in, but that’s not as good as I wanted or expected of myself.

• 

  Decoding wp-admin/js/revisions-js.php easter egg

  Posted: November 25th, 2008, 9:17pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  From time to time, I look at WordPress, which as you may have guessed, runs my blog. It’s had a spotty security history. If I can find something in a few minutes, I’ll help out as it’s my data at risk.

  But then they go and do this:

  
<?php

  if ( !defined( 'ABSPATH' ) )
exit;

  /** @ignore */
function dvortr( $str ) {
return strtr(
$str,
'',.pyfgcrl/=\aoeuidhtns-;qjkxbmwvz"PYFGCRL?+|AOEUIDHTNS_:QJKXBMWVZ[]‘,
‘qwertyuiop[]\asdfghjkl;’zxcvbnm,./QWERTYUIOP{}|ASDFGHJKL:”ZXCVBNM?-=’
);
}

  $j = clean_url( site_url( ‘/wp-includes/js/jquery/jquery.js’ ) );
$n = wp_specialchars( $GLOBALS['current_user']->data->display_name );
$d = str_replace( ‘$’, $redirect, dvortr( “Erb-y n.y ydco dall.b aiacbv Wa ce]-irxajt- dp.u]-$-VIr XajtWzaVv” ) );

  wp_die( <<<EOEE
<style type=”text/css”>
html body { font-family: courier, monospace; }
#hal { text-decoration: blink; }

  <script type=”text/javascript” src=”$j”></script>
<script type=”text/javascript”>
/* <![CDATA[ */
var n = '$n';
eval(function(p,a,c,k,e,r){e= ... crap deleted ...split('|'),0,{}))
/* ]]> */
</script>
<span id=”noscript”>$d</span>
<blink id=”hal”>▌</blink>
EOEE
,
dvortr( ‘Eabi.p!’ )
);


  So what does it do? Let’s undo this obfuscation one thing at a time:

  The Caesar Cipher was easy - I created a new PHP file with the dvortr() function and the strings to be decoded. They came out as:

  
Don't let this happen again. Go Back.
Danger!


  The packer was also easy, I changed the code to pump out the HTML on the command line, plonked that back into Eclipse, and changed the definition of eval to alert, one of the more evil / stupid things JavaScript can get up to:

  
eval = alert;
eval(...)


  I then copy and pasted the code in the alert pop up and re-formatted it in Eclipse.

  Guess what? It’s got another layer of obfuscation, again using the same crappy caesar cipher. Figuring out the strings and what it does it pretty easy from that point on.

  Interestingly, when Firebug stumbles across code it thinks is compressed JS, it stops showing you the code. WTF? You can still step through it one line at a time, but the compressor is NOT a security mechanism, and hiding it will not stop me. I will report a bug with the Firebug team as stopping the display of JavaScript is a defect, not a feature to protect the revenues / reputations of compressors.

  So, decoding in multiple passes, the final output is this:

  
Self-comparison detected.
Initiating infinite loop eschewal protocol.
Self destruct in... 3
2
1


  It’s an easter egg error message when a revision comparison fails. Or something like that. This is completely unnecessary - there’s no dark secret here requiring this level of sneakiness, and it’s an excellent place for malicious folks to hide attacks.

  The code is so obscure, that no static analysis tool can inspect it, or security auditor would normally take the time out to look at it, and yet it may contain an XSS or DOM injection, or it may contain malware if the download is corrupted, or a fake version comes out. 

  I really wish that folks who think this sort of thing is necessary really stop to think about the amount of time it took them to craft this particular gem

  It would be best to delete this - and every other WP easter egg - now before it infects any 2.7 installations. Easter eggs are incompatible with secure software.

• 

  Decoding wp-admin/js/revisions-js.php easter egg

  Posted: November 25th, 2008, 9:17pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  From time to time, I look at WordPress, which as you may have guessed, runs my blog. It’s had a spotty security history. If I can find something in a few minutes, I’ll help out as it’s my data at risk.

  But then they go and do this:

  
<?php

  if ( !defined( 'ABSPATH' ) )
exit;

  /** @ignore */
function dvortr( $str ) {
return strtr(
$str,
'',.pyfgcrl/=\aoeuidhtns-;qjkxbmwvz"PYFGCRL?+|AOEUIDHTNS_:QJKXBMWVZ[]‘,
‘qwertyuiop[]\asdfghjkl;’zxcvbnm,./QWERTYUIOP{}|ASDFGHJKL:”ZXCVBNM?-=’
);
}

  $j = clean_url( site_url( ‘/wp-includes/js/jquery/jquery.js’ ) );
$n = wp_specialchars( $GLOBALS['current_user']->data->display_name );
$d = str_replace( ‘$’, $redirect, dvortr( “Erb-y n.y ydco dall.b aiacbv Wa ce]-irxajt- dp.u]-$-VIr XajtWzaVv” ) );

  wp_die( <<<EOEE
<style type=”text/css”>
html body { font-family: courier, monospace; }
#hal { text-decoration: blink; }

  <script type=”text/javascript” src=”$j”></script>
<script type=”text/javascript”>
/* <![CDATA[ */
var n = '$n';
eval(function(p,a,c,k,e,r){e= ... crap deleted ...split('|'),0,{}))
/* ]]> */
</script>
<span id=”noscript”>$d</span>
<blink id=”hal”>▌</blink>
EOEE
,
dvortr( ‘Eabi.p!’ )
);


  So what does it do? Let’s undo this obfuscation one thing at a time:

  The Caesar Cipher was easy - I created a new PHP file with the dvortr() function and the strings to be decoded. They came out as:

  
Don't let this happen again. Go Back.
Danger!


  The packer was also easy, I changed the code to pump out the HTML on the command line, plonked that back into Eclipse, and changed the definition of eval to alert, one of the more evil / stupid things JavaScript can get up to:

  
eval = alert;
eval(...)


  I then copy and pasted the code in the alert pop up and re-formatted it in Eclipse.

  Guess what? It’s got another layer of obfuscation, again using the same crappy caesar cipher. Figuring out the strings and what it does it pretty easy from that point on.

  Interestingly, when Firebug stumbles across code it thinks is compressed JS, it stops showing you the code. WTF? You can still step through it one line at a time, but the compressor is NOT a security mechanism, and hiding it will not stop me. I will report a bug with the Firebug team as stopping the display of JavaScript is a defect, not a feature to protect the revenues / reputations of compressors.

  So, decoding in multiple passes, the final output is this:

  
Self-comparison detected.
Initiating infinite loop eschewal protocol.
Self destruct in... 3
2
1


  It’s an easter egg error message when a revision comparison fails. Or something like that. This is completely unnecessary - there’s no dark secret here requiring this level of sneakiness, and it’s an excellent place for malicious folks to hide attacks.

  The code is so obscure, that no static analysis tool can inspect it, or security auditor would normally take the time out to look at it, and yet it may contain an XSS or DOM injection, or it may contain malware if the download is corrupted, or a fake version comes out. 

  I really wish that folks who think this sort of thing is necessary really stop to think about the amount of time it took them to craft this particular gem

  It would be best to delete this - and every other WP easter egg - now before it infects any 2.7 installations. Easter eggs are incompatible with secure software.

• 

  Coding Standard

  Posted: September 23rd, 2008, 11:03pm CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  I’m repro-ing this from the OWASP Top 10 mail list. I would like to hear folks’ thoughts about what I have included, taking into account that this is designed to be a standard, and not just a guide.

  The OWASP Top 10 Coding Standard

  I’ve been working on this on and off (mostly off) ever since getting a few comments back in 2005 that the Guide was too big. The big idea is that it’s short and every single item is actionable. If it’s not actionable, it’s not in there. It doesn’t try to fix everything, just the 80-90% of things that really bite folks. Looking through the breach chronology, I think if folks had to stick to this list, they would have been safe, or at least a lot better off.

  My goals are

  * Scalable - works from a single open source developer through to major enterprises through to huge ISVs
  * Applicable - nothing in here is because I wear tin foil underwear, but because it’s essential for a secure app - the omission of that one item will create insecurity
  * Easy to apply for new code - the proper way should be the fastest, easiest way to do it right without causing performance issues
  * Not hard for old code - the controls in here are going to be a stretch for the billions of lines of existing (crap) code. We can’t ask all that millions and millions of lines of COBOL or Java or C# or VBScript or PHP to be secure overnight. It’s not possible.

  To make it scalable, I propose a self-rating system, where single developers and small groups can state up front that they’ve complied with the small group version, with the sole exception of framework authors, who would have to comply with all relevant sections. I’m sick of frameworks being insecure because they can’t be bothered or believe (wrongly) that it’s not their problem. If you’re a framework / library author, such behavior / attitudes are criminally negligent as far as I’m concerned (Jack Slocum - I mean you! http://extjs.com/forum/showthread.php?p=68097#post68097 ). Large ISVs and enterprises have no excuses as they can generally afford this stuff; it’s just as cheap to do it the right way as the wrong way. Just pick those controls that are essential for the risk level and do them.

  My current outline is:

  1. Secure Development Lifecycle Best Practices
  - Discussion about SDLCs and ensure that folks have one
  - Development methodology - mandatory. Just pick one, add security as necessary
  - Code repository - mandatory. I never seen secure code without one
  - Defect tracker - mandatory. I never seen secure code without one
  - Peer review of checkins and break the build check in policy - nice to have
  - SCA tools - nice to have
  - Way to report security bugs - nice to have (although required by some RFCs)

  2. Secure Architecture and Design
  - Apply Security Principles to your design
  - Apply Risk Management to your design
  - Picking and implementing the correct controls for your app
  - Architecture Reference Model for Initiator / Approver / Receiver transactions
  - Architecture Reference Model for privileged CSR, admin features / apps
  - Documentation - mandatory. Secure apps have documentation

  3. Authentication
  - Evidence of identity
  - UML Sequence diagrams for common login and credential management scenarios for two factor, trx signing and SMS authentication
  - UML Sequence diagrams for low value login and credential management scenarios using passwords. This has in-built countermeasures for brute forcing, etc
  - Prohibition against questions and answers (this is how Sarah Palin was attacked. I’ve been railing against them since at least 2004 - see the Guide 2.0 drafts and final text)
  - Prohibition against CAPTCHA if disabled access is required (usually is)

  4. Access Control
  - Create an access control matrix for each secured function and secured resource
  - Deny all by default
  - Principle of Least privilege
  - Fail closed
  - Environment Access Control
  - Controller / Business Logic Access Control
  - Data Access Control
  - Access Reference Maps
  - Presentation Access Control

  5. Validation and Encoding
  - Validate from all sources (trust boundaries, where and how much to validate at that layer)
  - Canocalization
  - Input validation methods (positive validation only, how to validate text fields, fail safe, etc)
  - Output encoding (ESAPI like - encodeForJavaScript, encodeForXml() etc)

  6. Data Protection
  - Define a Collection and Retention of Sensitive Data Policy. Stick to it
  - Protect Data at rest (what to encrypt and where, backups)
  - In transit (SSL, IPsec, etc)

  7. Securely Accessing Services
  - Ajax and JSON
  - REST
  - Web Services (WS-Security)
  - Operating System
  - Databases (use only safe mechanisms, low privilege access)
  - Directories
  - Message queues and reliable messaging mechanisms
  - Mainframes

  8. Accountability
  - Error handling (fail safe / closed, etc)
  - Logging
  - Auditing

  9. Debugging, Testing and Maintenance
  - Do not deploy test or debug code into production
  - How to fix security bugs once and properly
  - How to write security tests for fixes
  - Prohibition against Easter eggs and magic modes

  10. Testing and Assurance
  - How to build up assurance
  - Doing your own security tests every build
  - When to get a SME involved
  - SCA tools - nice to have
  - Dynamic tools and services - nice to have

  Obviously, this is starting to look like the Developer Guide 3.0. I’m not sure that it can be done in any less volume, but we should try, especially as the non-control stuff in the Developer Guide 3.0 is going to the ADSR, the Testing Guide and the Code Review Guide.

  Thoughts?

• 

  Had the snip

  Posted: July 4th, 2008, 4:25pm CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Well, I’ve had the snip, which apparently is surprising to most of the folks who know us.

  Both Tanya and I are pretty darn clucky. We want more kids. But there’s this huge issue we can’t get past - Tanya’s health is just not going to get any better any time soon. Her arthritis is looking like it is staying, and her meds to maintain a moderate level of activity are simply incompatible with a pregnancy. We were very lucky with Mackenzie that she wasn’t deformed or brain damaged or dependant. We can’t knowingly do that again to another child as it’s not our life we would be affecting.

  After a couple of close calls recently, where there were two terrible choices - either Tanya going back to Australia with baby girl for nine months of bed rest at her parents and 10-15 hurls a day with the associated forced weight loss, or aborting, which both Tanya and I are against. We had to make a tough decision.

  So here I am.

  It’s not as bad a pain as I thought it would be, but it certainly wasn’t without it’s scary moments.

  I’m not good with needles, and I’m sort of glad I was put under as I don’t think I could have coped with the normal process, which involves a needle to the each site to numb the skin, and then a big needle full of local to each of the testes so you can go home in some comfort before the real pain sets in. I don’t care if you’re brave or not, that’s just one big needle I could not face.

  The biggest problem so far is getting up. You can’t lift more than 15 lbs, which is about 7 kg. Baby girl currently weighs about 10 or so kg, so basically I can’t lift her. I can’t easily lift me either. So getting up and down is a painful experience.

  I’m resting comfortably. After 24 hours, the pain is manageable, and most likely I’ll be completely okay by Monday or Tuesday.

SecuriTeam Blogs

• 

  Q: Cisco Site to Site VPN

  Posted: April 30th, 2008, 5:03am CDT by expert

  Tags:  Ask the Expert   [edit]

  New week a new question, in this case the question is a bit more generic and I believe raises a few dilemmas, feel free to take a shot at it:

  Hi Experts,

  Is it secure to just configure Cisco IPSEC/GRE site to site tunnel without firewall/IPS/IDS. The argument here is although it is internet facing, there is only a host to host routing between the routers and the default route goes to the tunnel. Am I right to say that it is technically secure since the router only route traffic between the designated routers?

  Thanks in advance.

  Regards,
  J. O.

• 

  Q: THC PPTP Bruter

  Posted: April 17th, 2008, 8:22am CDT by noam

  Tags:  Ask the Expert   [edit]

  Once again - another security question from our readers to the security experts who read this blog:

  I ran across your site looking for information regarding the security of PPTP. I then found the PPTP bruter program from THC. I am a small business owner. I am a VAR (value added reseller) of POS (point of sale) equipment. My POS equipment is usually windows PC’s running POS software. I install a SOHO router that is also a PPTP endpoint so I can VPN in and remotely administrator my clients systems.

  I’m trying to find out how easy it would be for someone to hack my PPTP endpoint. Can you help me figure out how to test my router?

  Thanks,

  K. L.

cat slave diary

• 

  Best. Daughter. Ever.

  Posted: April 11th, 2008, 8:18pm CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  We took Mackenzie to the pediatricians today. She did real well - even the vaccinations she only screamed for a few minutes. 

  Here’s a few very recent photos for you!

  

  • The first image is her sitting. By herself. At 3 and 3/4 months.
  • The second image is her out on the porch wearing her snazzy new sunnies from Rebecca.
  • The third image is her holding her own full bottle and drinking away without that much help. She’s been able to do this for a while, but we’ve not always had the camera to prove it

  For those who follow such things, she’s at the 75% percentile for height (62.5 cm tall or 1.25 rods), at the 95% percentile for weight (7.46 kg or 0.51 slugs), and around 75th percentile for head circumference (41.9 cm or 0.02 chains). 
• 

  Colorado Springs

  Posted: April 2nd, 2008, 12:52am CDT by vanderaj

  Tags:  Life the universe and everything...   [edit]

  I’m currently in Colorado Springs doing some training for a customer.

  The flight in was long - nearly 12 hours all up from the east coast, all told including delays and running to make my little rubber band plane connection. It takes only another 15 hours to make it to Australia. The puddle jumper was funny - as soon as we had finished climbing out of Denver, the hostie announced we had commenced our descent into Colorado Springs.

  It was surprisingly cold. I suppose the wind and snow should have alerted me, but the last time I was here in late August / early September, it was over 30C every day.

  I love coming here. Not only do we have a family friend (Hi Michelle! Hi Justine!) who lives here, the scenery includes Pike’s Peak dusted in snow outside my bedroom window every morning. You just can’t beat that.

  I don’t think I could live here, though. I’m used to fast paced life, and things move at a leisurely pace, commensurate with Colorado Springs’ diminutive size.

SecuriTeam Blogs

• 

  Q: Socket Security

  Posted: March 7th, 2008, 10:00am CST by expert

  Tags:  Ask the Expert   [edit]

  A new question for you guys - you have been great answering the previous one:
  —-
  Hi I’m a bit new to java and socket programming.
  Anyway I just wrote a client server socket program and I have an open port listening on my unix box.

  I was told that this is vulnerable because now anyone could write a client side program to my open port and send in whatever command line they want.

  I am not sure where to go about researching what security measures I need to put in place for socket programming.

  From:
  B.M
  USA
  —-

• 

  Q: Network Monitoring

  Posted: February 26th, 2008, 11:33pm CST by expert

  Tags:  Ask the Expert   [edit]

  Dear Expert,

  I am a Network Engineer at the University of Anonymous. I’m not sure if this is an irrelevant question, but here it is any way..

  I want to have a Network Monitoring Software with the following characteristics

  1 - I want to be able to monitor all the active workstations in each of the Labs.
  2 - I want to have a list of trusted MAC addresses. I need this because I want to block any non-trusted device from accessing network resources. Exceptions might be given when the device is verified to be secure..
  3 - I want to be able to detect any suspicious activities (pining, high traffic) and Block the associated IP address.

  So please, tell me if there is any software of combination of software that enable me to do what I want..

  I hope I will hear from you soon

  Yours

  M.M.

  —

  Our readers have been very helpful to person who wrote the previous post, I believe our readers have the answer in this case as well, and as in the previous case, further, the combined answer was way better than anything we could have provided.

  So I am going to let our readers answer this interesting question. Readers - what do you say?

• 

  Q: Restricted user rights and vulnerabilities

  Posted: February 12th, 2008, 5:56am CST by expert

  Tags:  Ask the Expert   [edit]

  Dear Expert,

  I know that a restricted user is less vulnerable to most exploits but is knowing that your users have restricted access enough of a reason NOT to patch? I am advocating that my IT support team update/ patch the following software for our end users; QuickTime, Java, Adobe Reader and Acrobat. Currently all of our installed versions have multiple known vulnerabilities. I am being told patching is unnecessary because 95% of our users have restricted user rights and therefore cannot be exploited.

  Will you please clarify? I understand how restricted user rights increases security, but is that enough of a layer to justify not patching. When I inquired about scanning thumb drives, this same answer is given, “It is not necessary because the users have restricted rights.” Many of our users have access to confidential and sensitive data and I remain concerned. I really appreciate any assistance that you can provide on this issue. Thank you for your help.

  Regards,
  L.P
  Anonymous University

  A: I am going to let our readers answer this interesting question. Readers - what do you say?

• 

  “php shell script on my server”

  Posted: January 24th, 2008, 11:26am CST by Kfir

  Tags:  Ask the Expert   [edit]

  Q:

  I have a webserver where i’ve found several different php shell scripts and I’d like to know how they got there.  Are there known vulnerabilities that allow uploading of php files to a server?

  I have several sites running on this server with several php script packages including…

  Zencart
  phpbb2

  Any ideas or pointers will be appreciated!

  A: Hi,

  There are several vulnerabilities in both off the shelf products as well as custom PHP scripts that would allow “uploading”, in essence they don’t need to upload, they just need to get your PHP scripts to execute an arbitrary (outside) PHP script.

  PHPbb has several:
  [www.securiteam.com]

  Listed as Code Execution, Arbitrary File Upload, etc.

  While zencart has just one problem:
  [www.securiteam.com]

  But that could be misleading, and just mean that the software is very uncommon.

cat slave diary

• 

  Fresh starts and modest changes: DMZ E-mail Day

  Posted: January 2nd, 2008, 2:36pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  In 2007, I realized I am not particularly good at prioritizing what time I have available. In true geek style, over the Christmas break I looked at all the recent time management fads to ensure I picked the laziest/easiest/geekiest (pick two), and found 43 Folders, which is based upon a slightly older - and dead tree form fad - Getting Things Done (GTD). The only downside to this particular fad is the fan boys are positively frothing at the mouth, which is what scared me off Python and Ruby on Rails. Rabid adherence is never a good sign. However, the things they want you to do are pretty simple, which is what attracts me to it.

  43 Folders is a bit structured for this unstructured procrastinator. With procrastination, it’s not about “doing X now, but sometime in the future”. As any true procrastinator knows, there is an infinite range of substitute activities instead of “doing X now”. So don’t think I’m lazy, for I’m not. I just don’t achieve as much of the things I actually care about as I want. And with married life and a new daughter in a new country, the time I have available is dramatically reduced to when I was a bachelor cat slave back in Melbourne.

  So far, I’ve:

  • Cancel Something I’m no longer on the OWASP Board. I have totally given up the idea of writing another book for a while. I’m seriously thinking about giving up updating the next edition of the OWASP Guide as it’s just as much work (if not more) than writing a 300+ page book from scratch
  • Replace a Project. I’ve picked a few things I love doing, and I’m going to find ways to do these first instead of things which interest me less. Obviously, family time comes first, but in what time I have remaining, my life should be fun and enjoyable. There’s no point in busting a gut to do something I don’t really enjoy. I’ve still yet to really do the maths to work out what makes me happiest, but once I do it, there will be a few more departures
  • Time to declare DMZ E-mail Day (again)

  So today, it’s DMZ E-mail Day on my renewed quest for Inbox Zero. I’ve archived all my work and personal e-mail for 2007. If you haven’t got a response from me for something, it’s time to re-send. 

• 

  Sayonara 2007, Konnichiwa 2008

  Posted: December 30th, 2007, 7:34pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  It’s that time of the year again. In my previous list, it turned out I did some of the things I said I would, and a lot more besides.

  In 2008, my desires are:

  • Be a good dad to Mackenzie my gorgeous daughter, and a wonderful (hopefully less chubby) hubby to Tanya, my beautiful wife
  • Lose some weight and mean it this time. What New Year’s Resolution is complete without this one?
  • Finish at least one piece of first class research in the web app sec field

  Although my time will now necessarily be limited out of hours, I think it’s better to complete one or two really good ground breaking ideas than to spurt the same old, same old things over and over again. I think many of you know what I’m currently researching, and I hope to finish that by the end of the year.

funkatron.com

• 

  Assumptions and Mac browser share

  Posted: December 28th, 2007, 8:24pm CST by funkatron

  Tags:  the Web Problem   [edit]

  

  If there’s one thing I’ve learned in my years as a grown-up, it’s this: Don’t make assumptions. All too often, things I’ve thought were no-brainers turned out to be questionable at best, like:

  • John Romero will make an awesome game on his own
  • Sony and Microsoft have made Nintendo irrelevant
  • Women will find my company tolerable

  I often see techie types making assumptions based on their experience, like “program A is unusable” (because on his rather oddly set-up system, it crashed on install) or “no real programmers write in Ruby” (because he doesn’t know anyone personally who do) or “only a tiny fraction of Mac users browse with Firefox” (because it’s the default browser out of the box, and average users always use the default, right?).

  It was this last assertion, and the accompanying statement “I don’t have to prove something so obvious” that inspired this article. I wouldn’t have been particularly surprised if Safari had a majority of the Mac browser market, but my personal experience had been that a fair number of non-techie Mac folks use Firefox. Beyond that, I wanted to get some real data, and not make assumptions. If you can’t provide some basis for your assertions, they’re not worth much. It’s a clear sign of a bad argument, and little gets me more worked up than weak logic.

  The audience for a web site has a pretty significant impact on what browsers we see visitors using. Tech-oriented sites tend to have a higher percentage of users running alternate browsers like Firefox. You’ll get more Camino users on a Mac-oriented site, and Konqueror will show up more often on sites with content for Linux users. That means we have to at least take into account the content of the site when drawing conclusions from the numbers.

  Here’s what I’ve found myself, and what others have shared with me, so far. Understandably, some folks shared their stats with me asked to remain anonymous, or that the site they come from not be revealed. I’ve described them as best I can. Also note that in some cases I received just info on Mac browsers, and others I had data for all browsers. I’ve calculated a ratio and “winner” at the end of each entry.

  Is this data conclusive? Of course not. It’s a small sample of a handful of sites, and not particularly popular ones at that. But, it does seem to at least indicate that Firefox may be quite a bit more popular among Mac users than I – and certainly other people – thought.

  If you’d like to contribute data, just drop me a line or leave a comment.

  Funkatron.com

  This site, obviously strongly tech-oriented, but also gets a decent amount of sport-oriented search engine traffic

  Browser	% of total
  Firefox/Macintosh	19.31
  Safari/Macintosh	13.38

  Approx ratio: 1.5/1 Firefox

  • Screenshot

  Sorority web site

  Non-tech focused, active site for members of sorority

  Browser	% of Mac
  Safari/Macintosh	48.44
  Firefox/Macintosh	41.78

  Approx ratio: 1.1/1 Safari

  EricaBaker.com

  Personal blog, significant tech/mac content

  Browser	% of Mac
  Firefox/Macintosh	53.86
  Safari/Macintosh	40.19

  Approx ratio: 1.3/1 Firefox

  Abandoned non-tech subculture site

  Very low, mostly search engine traffic

  Browser	% of total
  Firefox/Macintosh	10.75
  Safari/Macintosh	10.75

  Approx ratio: 1/1

  • Screenshot

  Abandoned personal blog

  Some tech/mac content

  Browser	% of total
  Firefox/Macintosh	61.15
  Safari/Macintosh	36.21

  Approx ratio: 1.7/1 Firefox

  New sports blog

  Browser	% of total
  Safari/Macintosh	50.74
  Firefox/Macintosh	45.92

  Approx ratio: 1.1/1 Safari

  Abandoned sports web site

  Very low, mostly search engine traffic

  Browser	% of total
  Safari/Macintosh	3.43
  Firefox/Macintosh	1.75

  Approx ratio: 2/1 Safari

  • Screenshot

  Low-traffic, non-tech site

  Browser	% of Mac
  Firefox/Macintosh	74.15
  Safari/Macintosh	25.85

  Approx ratio: 3/1 Firefox

  
• 

  Assumptions and Mac browser share

  Posted: December 28th, 2007, 8:24pm CST by funkatron

  Tags:  the Web Problem   [edit]

  

  If there’s one thing I’ve learned in my years as a grown-up, it’s this: Don’t make assumptions. All too often, things I’ve thought were no-brainers turned out to be questionable at best, like:

  • John Romero will make an awesome game on his own
  • Sony and Microsoft have made Nintendo irrelevant
  • Women will find my company tolerable

  I often see techie types making assumptions based on their experience, like “program A is unusable” (because on his rather oddly set-up system, it crashed on install) or “no real programmers write in Ruby” (because he doesn’t know anyone personally who do) or “only a tiny fraction of Mac users browse with Firefox” (because it’s the default browser out of the box, and average users always use the default, right?).

  It was this last assertion, and the accompanying statement “I don’t have to prove something so obvious” that inspired this article. I wouldn’t have been particularly surprised if Safari had a majority of the Mac browser market, but my personal experience had been that a fair number of non-techie Mac folks use Firefox. Beyond that, I wanted to get some real data, and not make assumptions. If you can’t provide some basis for your assertions, they’re not worth much. It’s a clear sign of a bad argument, and little gets me more worked up than weak logic.

  The audience for a web site has a pretty significant impact on what browsers we see visitors using. Tech-oriented sites tend to have a higher percentage of users running alternate browsers like Firefox. You’ll get more Camino users on a Mac-oriented site, and Konqueror will show up more often on sites with content for Linux users. That means we have to at least take into account the content of the site when drawing conclusions from the numbers.

  Here’s what I’ve found myself, and what others have shared with me, so far. Understandably, some folks shared their stats with me asked to remain anonymous, or that the site they come from not be revealed. I’ve described them as best I can. Also note that in some cases I received just info on Mac browsers, and others I had data for all browsers. I’ve calculated a ratio and “winner” at the end of each entry.

  Is this data conclusive? Of course not. It’s a small sample of a handful of sites, and not particularly popular ones at that. But, it does seem to at least indicate that Firefox may be quite a bit more popular among Mac users than I – and certainly other people – thought.

  If you’d like to contribute data, just drop me a line or leave a comment.

  Funkatron.com

  This site, obviously strongly tech-oriented, but also gets a decent amount of sport-oriented search engine traffic

  Browser	% of total
  Firefox/Macintosh	19.31
  Safari/Macintosh	13.38

  Approx ratio: 1.5/1 Firefox

  • Screenshot

  Sorority web site

  Non-tech focused, active site for members of sorority

  Browser	% of Mac
  Safari/Macintosh	48.44
  Firefox/Macintosh	41.78

  Approx ratio: 1.1/1 Safari

  EricaBaker.com

  Personal blog, significant tech/mac content

  Browser	% of Mac
  Firefox/Macintosh	53.86
  Safari/Macintosh	40.19

  Approx ratio: 1.3/1 Firefox

  Abandoned non-tech subculture site

  Very low, mostly search engine traffic

  Browser	% of total
  Firefox/Macintosh	10.75
  Safari/Macintosh	10.75

  Approx ratio: 1/1

  • Screenshot

  Abandoned personal blog

  Some tech/mac content

  Browser	% of total
  Firefox/Macintosh	61.15
  Safari/Macintosh	36.21

  Approx ratio: 1.7/1 Firefox

  New sports blog

  Browser	% of total
  Safari/Macintosh	50.74
  Firefox/Macintosh	45.92

  Approx ratio: 1.1/1 Safari

  Abandoned sports web site

  Very low, mostly search engine traffic

  Browser	% of total
  Safari/Macintosh	3.43
  Firefox/Macintosh	1.75

  Approx ratio: 2/1 Safari

  • Screenshot

  Low-traffic, non-tech site

  Browser	% of Mac
  Firefox/Macintosh	74.15
  Safari/Macintosh	25.85

  Approx ratio: 3/1 Firefox

  

cat slave diary

• 

  Video of Mackenzie

  Posted: December 23rd, 2007, 7:19pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  Enjoy!

• 

  What a week!

  Posted: December 15th, 2007, 12:31am CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  After the emergency caesarian, Tanya needed me quite a bit, so I ended up staying in the hospital with her until Friday. The rooms in the MCU are nice, but the fold out arm chairs which become a bed for the odd stay here and there are not so good for my back. Things were a bit strange as we didn’t have Mackenzie in the room with us, but down at the NICU where she was being closely monitored.Mackenzie was a little irritable in the first few days, but in the end, she didn’t need any medicine to help her over the meds that Tanya had to take to make it through the pregnancy.I had my diabetic nurse appointment at 9 am, so the commute two floors down was pretty easy. It turns out I have type 2 diabetes, which is not so good, but the prognosis is good if I can lose the weight, which should also help the high blood pressure and the sleep apnea. We talked about a bunch of stuff, but the main thing is behavior modification, along with diet and exercise changes. I have way more to learn about living with diabetes, including learning to live with pricking my finger four times a day.However, during the diabetic appointment I started having the sniffles, and soon enough it’s turned into quite the rotten cold. I’ve been unwell now for a number of days, which is no good when all I really want to do is hold Mackenzie. I still feel a bit disconnected from it all as we didn’t have her in the room, and because of the cold, I really haven’t had a lot of opportunities to bond with her beyond a feed here or there.

• 

  We’re fully baked! Welcome to Mackenzie Lynne van der Stock

  Posted: December 11th, 2007, 11:54pm CST by vanderaj

  Tags:  Life the universe and everything...   [edit]

  What a week!

  Today, we came in for a nice ultrasound with the in-laws so they can see, and maybe beg our obgyn for an earlier inducement. We sort of got what we wanted, and then some! We never made it to the obgyn appointment as things had moved on!

  In a whirlwind, it turned from being low on amniotic fluid to immediate inducement followed by lots of pain then to much earlier than expected epidural to … well, let’s just say a lot of folks rushed in and thirty minutes later we are the proud parents ofMackenzie Lynne van der Stock!

  
  
  

  Awesome! She might have come a little early (38 weeks), but that’s not a day too soon for Tanya, who has had a very difficult pregnancy.

  Mackenzie weighed 2.75 kg (about 6 lbs 1 oz after conversion - even the US folks measure in metric for babies now!) and is 50 cms long today.It’s been very exhausting and I’m using a tiny connection to the Internet via my mobile phone, so things will have to wait until tomorrow. We have photos and movies.

  UPDATE: Photos here:

  http://picasaweb.google.com/vanderaj/Mackenzie/