-
Skein Hash Function
"Executive Summary Skein is a new family of cryptographic hash functions. Its design combines speed, security, simplicity, and a great deal of flexibility in a modular package that is easy to analyze. Skein is fast. Skein-512 — our primary proposal — hashes data at 6.1 clock cycles per byte on a 64-bit CPU. This means…
-
Article: Be aware of SOA application security issues
"Extensible Markup Language (XML), Web services, and service-oriented architecture (SOA) are the latest craze in the software development world. These buzzwords burn particularly bright in large enterprises with hundreds or thousands of systems that were developed independently. If these disparate systems can be made to work together using open standards, a tremendous amount of time,…
-
Site News: We want to hear from you!
As some of you may have noticed I’ve expanded the news beyond purely technical articles/papers/advisories to security process as well. Rather than alienate many of you I’m asking what are the sorts of things you’d like to see posted more often? What do you care about most? – Advisories – Product Press Releases – Industry…
-
Threat Models Improve Your Security Process
"This column proposes a way to think about secure design from a more holistic perspective by using threat models to drive your security engineering process, primarily helping you prioritize code review, fuzz testing, and attack surface analysis tasks. As a setup…
-
Agile SDL Streamline Security Practices For Agile Development
"In the September 2008 issue of MSDN Magazine, I wrote a column about the additions that Microsoft has made to the Security Development Lifecycle (SDL) process to address security vulnerabilities in online services. I talked about the importance of input validation and output encoding in order to prevent cross-site scripting attacks; about using parameterized stored…
-
Microsoft’s Stance on Banned APIs
Microsoft has a blog entry on their mentality/process on banning certain API calls to improve their software’s security. "Jeremy Dallman here with a quick note about a code sanitizing tool we are making available to support one of the SDL requirements – Remove all Banned APIs from your code. This requirement was put in place…
-
ICANN Terminates EstDomains Registrar Accreditation due to Fraud, Money Laundering Convictions
Gadi Evron posted the following link to the Full Disclosure list this morning which I thought was interesting. Read More: http://www.icann.org/correspondence/burnette-to-tsastsin-28oct08-en.pdf
-
Yahoo Security Flaw Fixed in hours
"Hours after Web analytics firm Netcraft (www.netcraft.com) announced a flaw on a Yahoo (www.yahoo.com) website used to steal users’ authentication cookies to gain access to Yahoo accounts, such as Yahoo Mail, the company blocked entry to hackers. In an email message to theWHIR Monday, Yahoo’s HotJobs division stated that the cross-site scripting vulnerability found on…
-
Identifying browsed pages behind SSL via packet size monitoring
The following article was posted to The Web Security Mailing List earlier today. "Recently, the world saw The Pirate Bay offering SSL encryption on their server. This means that your ISP won’t know anymore which torrent you are downloading, right? Wrong. HTTPS is quite useless for protecting static and public content. By static, I do…
-
Why Microsoft’s SDL Missed MS08-067 in their own words
"No doubt you are aware of the out-of-band security bulletin issued by the Microsoft Security Response Center today, and like all security vulnerabilities, this is a vulnerability we can learn from and, if necessary, can use to shape future versions of the Security Development Lifecycle (SDL). Before I get into some of the details, it’s…
-
Emergency Microsoft Patch MS08-067 Issued, Exploit code in wild
The Patch: Microsoft has released the patch to windows update. Details: "This security update resolves a privately reported vulnerability in the Server service. The vulnerability could allow remote code execution if an affected system received a specially crafted RPC request. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, an attacker could exploit…
-
What videogames teach us about security
Forbes has an interesting interview with Gary McGraw on how computer games provide insight into the motives and mindset of an attacker. "What problem do these trust boundaries pose? In this case, the gamer is the attacker and what they’re doing is cheating in the virtual world to generate wealth that they can sell…
-
CGISecurity FAQ
1. What is CGISecurity? CGISecurity was founded in 2000 making it the oldest application security news site on the web. It focuses on the aspects required to secure your site from the ground up. 2. When is your next advisory coming out? d I’ve decided to stop releasing advisories. That is all. 3. Is your…
-
Phishing and Security
Below are a list of phishing resources that I’ve gathered that I’ve decided to stick in one central location. If I’m missing a link please let me know by filling out our Contact Form. Sites: Anti-Phishing Working Group "Our mission is to provide a resource for information on the problem and solutions for phishing and…
-
Wireshark 1.0.4 Released
A new version of Wireshark (Ethereal) has been released to address multiple security issues. "Impact It may be possible to make Wireshark crash by injecting a series of malformed packets onto the wire or by convincing someone to read a malformed packet trace file. Resolution Upgrade to Wireshark 1.0.4 or later. Due to the nature…
-
My Trip To Microsoft’s Bluehat Conference
Last week I attended Microsoft’s Bluehat conference for the first time and found the experience to be pretty positive. Here are a few highlights New Tools Announced– Microsoft Threat Modeling tool v3.1 RC2 (Public release date: unknown)– CSSH is a CSS history theft tool combining a crawler to enumerate the links you’ve visited on a…
-
Load Jacking latest buzzword
I hate promoting new buzzwords but found this one amusing. "So what do you do when you’re a couple of bored Russian immigrants with some cool hacking skills and you want to make some money the easy way? Well, if you are Nicholas Lakes and Vaiachelav Berkovich you set yourself up as a trucking company…
-
Microsoft URLscan Web Application Firewall (WAF)
URL Scan is a plug into IIS that allows for request based filtering (Not signature based) of incoming requests. By enabling some of these filters it is possible to prevent exploitation of known, or new unpublished vulnerabilities. Additional information on ‘Web Application Firewalls’ can be answered at our What is a Web Application Firewall FAQ…
-
Mod Security Web Application Firewall (WAF)
ModSecurity is a plug-in module to the Apache webserver that allows for request based filtering of incoming requests. By enabling some of these filters it is possible to prevent exploitation of known, or new unpublished vulnerabilities. ModSecurity also supports Signature based rules which allows you to write your own custom signatures. Ivan Ristic the author…
-
AJAX (Asynchronous Javascript and XML) Security
Last Update: June 28th News Is Web 2.0 Safe? Developers warned to secure AJAX design (4/4/07) Web 2.0 Apps Vulnerable to Attack (4/4/07) The security risk in Web 2.0 Ajax Security Vulnerabilities Could Pose Serious Risk, foxnews Worm wriggles through Yahoo mail flaw JavaScript Worm Targets Yahoo AJAX Experts Tackle Security, Other Issues AJAX Security…
-
Web 2.0 (Really Simple Syndication) RSS, Atom, and Feed Security and Hacking
Below is a collection of resources that I’ve gathered that I’ve decided to stick in one central location. If I’m missing a link please let me know by filling out our Contact Form. Articles Vulnerability Scanning Web 2.0 Client-Side Components 08/08/06 Microsoft Team RSS Blog discusses more RSS Risks Feed Injection In Web 2.0: Hacking…
-
Web service (XML-RPC,SOAP, SOA) security documentation
Specifications: Specification: Web Services Security (WS-Security) (PDF) (HTML) Web Services Glossary, W3C Working Draft 14 November 2002 Web Services Security (WS-Security) Version 1.0, April 5, 2002 (PDF) Web Services Specifications Web Services Security Kerberos Binding (PDF) Web Services Security XrML Token Binding (PDF) Web Services Architecture Requirements, 01 April 2002 Misc: Microsoft .NET Web Services…
-
This page contains references to things CGISecurity.com has been involved with. * http://www.webappsec.org I co founded the Web Application Security Consortium with Jeremiah Grossman in 2004. * http://www.webappsec.org/lists/websecurity/ I am the lead moderator for ‘The Web Security Mailing List’. * www.net-security.org/article.php?id=91 This is an article I helped review content for, including making some changes, and…
-
Coming soon
You’ve reached a section that isn’t completed yet. If you have any comments or suggestions for this section Contact us!
-
Silverlight 2 Released
From the asp.net blog. "Today we shipped the final release of Silverlight 2. You can download Silverlight 2, as well the Visual Studio 2008 and Expression Blend 2 tool support to target it, here. Cross Platform / Cross Browser .NET Development Silverlight 2 is a cross-platform browser plugin that enables rich media experiences and .NET…
Favorite Links
- Security Templates (New)
- The Web Application Security Consortium
- QA Security
- The Web Security Mailing List
- Romain Gaucher’s Blog
- Jeremiah Grossman’s Blog
Popular Pages
WASC Threat Classification
- Abuse of Functionality
- Application Misconfiguration
- Brute Force Attack
- Content Spoofing
- Credential/Session Prediction
- Denial of Service
- Directory Indexing
- Information Leakage
- Remote File Inclusion Attack
- Routing Detour Attack
- SOAP Array Abuse
- XML Attribute Blowup
- XML Injection
- XML External Entity Attack