CGISecurity Logo

Topics

Tags

  • Jacking out of the metaverse: Retaliating to cyberwar in the real world

    Posted by Robert A on

    in
    , ,
    | |

    I've been chatting with some folks in infosec about the escalation of 'cyber attacks' sponsored by governments which target other governments, and private corporations. There's uneasyness in the security industry about possible overeactions and restrictions of freedom as a result of this growing concern. This entry will attempt to break down some of these concerns,…

  • Five pieces of advice for those new to the infosec industry

    Posted by Robert A on

    in
    , , , , , ,
    | |

    I've worked in the security field in various roles (script kiddie, security researcher, incident response, application security engineer, security consultant, strategy, etc..) and thought I'd share a few points to those of you starting out in the security industry.   Things are worse than you expect The reality is that companies, even large ones, are…

  • Oracle website vulnerable to SQL Injection

    Posted by Robert A on

    in
    , , ,
    | |

    Someone has published a SQL Injection in labs.oracle.com at http://www.thehackernews.com/2011/07/oracle-website-vulnerable-to-sql.html . That is all.  

  • Announcing WASC Web Hacking Incident Database (WHID) Mail-list

    Posted by Robert A on

    in
    , , ,
    | |

    Ryan Barnett (Leader of the WASC Web Hacking Incidents Database Project) has announced a new mailing list where users can subscribe to hear about the latest hacking incidents. From his email to The Web Security Mailing List "Greetings everyone,I wanted to let everyone know that we have setup a mail-list for those of you who…

  • Most common password for Gawker users is 123456

    Posted by Robert A on

    in
    , ,
    | |

      Gawker was recently compromised and had its source code and user passwords leaked onto the web. The Wall Street Journal has published a list of the top 50 passwords with the #1 password being '123456'. The full list can be found at http://blogs.wsj.com/digits/2010/12/13/the-top-50-gawker-media-passwords/

  • Palin e-mail snoop sentenced to a year in custody

    Posted by Robert A on

    in
    ,
    | |

    "Former college student David Kernell, whose criminal prying into Sarah Palin's personal e-mail account caused an uproar two months before the 2008 presidential election, was today sentenced to a year and a day in federal custody by a judge who recommended that the time be served in a Knoxville, Tenn. halfway house. Corrections officials could…

  • Twitter XSS worm

    Posted by Robert A on

    in
    , , ,
    | |

    An XSS worm has hit twitter this morning and appears to have affected hundreds of thousands of users. Sophos has a good technical writeup at http://www.sophos.com/blogs/gc/g/2010/09/21/twitter-onmouseover-security-flaw-widely-exploited/ ARSTechnica has some coverage about Magnus Holm, the author of the worm. http://arstechnica.com/security/news/2010/09/twitter-worms-spread-quickly-thanks-to-blatant-security-flaw.ars I'll update this post once a more accurate count of affected users is published.

  • Apple website hit with SQL Injection

    Posted by Robert A on

    in
    , ,
    | |

    "A hack attack that can expose users to malware exploits has infected more than 1 million webpages, at least two of which belong to Apple. The SQL injection attacks bombard the websites of legitimate companies with database commands that attempt to add hidden links that lead to malware exploits. While most of the sites that…

  • Why publishing exploit code is *generally* a bad idea if you’re paid to protect

    Posted by Robert A on

    in
    , , , ,
    | |

    Update2: Further proof that people are abusing this in a wide scale and likely wouldn't have had the exploit code not been released. Update: I've clarified a few points and added a few others. Recently Tavis Ormandy (a google employee) discovered a security issue in windows, and days after notifying Microsoft published a working exploit…

  • Apache Compromised Again

    Posted by Robert A on

    in
    , ,
    | |

    It appears someone used a combination of XSS on an Apache domain, a url shortener, and an issue tracking system to ultimately lead to rooting of 2 core Apache machines used to host bugzilla, and the main shell server. This is a great breakdown of a real world incident that people rarely publicly speak about,…

  • TJX Hacker Gets Pwned, 20 Years In Prison

    Posted by Robert A on

    in
    ,
    | |

    Could the trend of claiming not to know any better while hacking due to asperger's be coming to an end? From Wired "Convicted TJX hacker Albert Gonzalez was sentenced to 20 years in prison on Thursday for leading a gang of cyberthieves who stole more than 90 million credit and debit card numbers from TJX…

  • Facebook security pretty much what you’d expect?

    Posted by Robert A on

    in
    , ,
    | |

    An interview claiming to be with a facebook employee discusses a few things that you probably were hoping didn't happen. Here are some choice quotes from the article " Rumpus: Have you ever logged in to anyone’s account? Employee: I have. For engineering reasons. Rumpus: Have you ever done it outside of professional reasons? Employee:…

  • Stephen Watt sentenced to 2 years in prison for role in TJX

    Posted by Robert A on

    in
    ,
    | |

    Stephen Watt (alias JimJones/Unix Terrorist/PHC/etc) was sentenced to 2 years in prison for his role in writing the blablah sniffer used by the folks involved in the TJX credit card incident. From wired magazine "While accused TJX hacker kingpin Albert Gonzalez awaits a possible sentence of 17 years or more in prison, one of his…

  • 132,000+ sites Compromised Via SQL Injection

    Posted by Robert A on

    in
    ,
    | |

    Net-Security has posted an article on the discovery of 132k+ sites that have been SQL Injected. From the article "A large scale SQL injection attack has injected a malicious iframe on tens of thousands of susceptible websites. ScanSafe reports that the injected iframe loads malicious content from 318x.com, which eventually leads to the installation of…

  • Symantec SQL Injected, Seeks Counseling

    Posted by Robert A on

    in
    , ,
    | |

    "The Romanian hacker who successfully broke into a web site owned by security vendor Kaspersky Lab has struck again, this time exposing shortcomings in a Symantec web server. The hacker, known only as Unu, said in a blog post today that he was able to access a server belonging to the security giant using a…

  • TLS negotiation flaw published

    Posted by Robert A on

    in
    , , , , ,
    | |

    Steve Dispensa and Marsh Ray have published a paper describing a weakness in the TLS negotiation process. This is the same attack discussed on the IETF TLS list. From the whitepaper "Transport Layer Security (TLS, RFC 5246 and previous, including SSL v3 and previous) is subject to a number of serious man-in-the-middle (MITM) attacks related…

  • One character mistake knocks .se TLD offline

    Posted by Robert A on

    in
    , ,
    | |

    "What was essentially a typo last night resulted in the temporary disappearance from the Internet of almost a million Web sites in Sweden — every address with a .se top-level down name. According to Web monitoring company Pingdom, which happens to be based in Sweden, the disablement of an entire top-level domain "is exceptionally rare.…

  • WASC Honeypots – Apache Tomcat Admin Interface Probes

    Posted by Robert A on

    in
    , ,
    | |

    The WASC Distributed Open Proxy Honeypots project has published an entry on people performing brute force attacks against tomcat administrative interfaces through WASC's open relay proxies. Tomcat Brute Forcing: http://tacticalwebappsec.blogspot.com/2009/10/wasc-honeypots-apache-tomcat-admin.html

  • Reddit XSS worm spreads

    Posted by Robert A on

    in
    , , , ,
    | |

    UPDATE: Reddit has posted a blog entry at http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-us.html addressing this. "Popular social news website Reddit has stopped the spread of a cross-site scripting (XSS) worm that hit the site on Monday. The XSS worm spread via comments on the site, originally from the account of a user called xssfinder. Reddit failed to filter out…

  • SVN Flaw Reveals Source Code to 3,300 Popular Websites

    Posted by Robert A on

    in
    , ,
    | |

    "A Russian security group has posted a detailed blog post about how they managed to extract the source code to over 3,300 websites. The group found that some of the largest and best known domains on the web, such as apache.org and php.net, amongst others, are vulnerable to an elementary information leak that exposes the…

  • WASC Distributed Open Proxy Honeypot Shows Brute Force Attacks Against Yahoo

    Posted by Robert A on

    in
    , ,
    | |

    Fellow WASC officer Ryan Barnett has published findings pertaining to a distributed brute force attack against Yahoo's login pages as part of his findings for the WASC Distributed Open Proxy Honeypot Project . For those not aware of this project, Ryan leads an initiative where people run open relay proxies and centrally upload the logs…

  • Apache.org Incident Report For 8/28/2009 Hack

    Posted by Robert A on

    in
    ,
    | |

    From the report "Our initial running theory was correct–the server that hosted the apachecon.com (dv35.apachecon.com) website had been compromised. The machine was running CentOS, and we suspect they may have used the recent local root exploits patched in RHSA-2009-1222 to escalate their privileges on this machine. The attackers fully compromised this machine, including gaining root…

  • Apache.org Compromised via stolen SSH keys

    Posted by Robert A on

    in
    ,
    | |

    Netcraft is reporting that apache.org has been compromised. The apache blog posted the following message indicating an SSH key compromise. "This is a short overview of what happened on Friday August 28 2009 to the apache.org services.  A more detailed post will come at a later time after we complete the audit of all machines…

  • Flash Worm – SANS Analysis

    Posted by Robert A on

    in
    , ,
    | |

    Sans has write up about a recent flash worm. "A few days ago a lot of media wrote about a Flash worm. I managed to get hold of samples and analyzed it (thanks to Peter Kruse of CSIS for the samples). First of all, while the exploit code contains Flash, it is actually just used…

  • Gary McKinnon loses appeal

    Posted by Robert A on

    in
    , ,
    | |

    "Gary McKinnon has lost a judicial review against his extradition to the United States on hacking charges. Lawyers for the Briton hoped his recent diagnosis with Asperger's Syndrome would be enough to persuade judges to overturn previous rulings and allow McKinnon to be tried in the UK." – The Register Long story short Gary hacked…

Favorite Links

Twitter

Twitter

Popular Pages

WASC Threat Classification

Copyright 2000-2026 CGISecurity.com – The oldest application security site online, predating OWASP.