-
Security assessment of the Transmission Control Protocol (TCP)
The following email was sent to Full Disclosure today. I haven't had a chance to read this monster 140 document yet but it sure sounds interesting. "The TCP/IP protocol suite was conceived in an environment that was quitedifferent from the hostile environment they currently operate in.However, the effectiveness of the protocols led to their early…
-
PHP filesystem attack vectors
ascii writes "On Apr 07, 2008 I spoke with Kuza55 and Wisec about an attack I found some time before that was a new attack vector for filesystem functions (fopen, (include|require)[_once]?, file_(put|get)_contents, etc) for the PHP language. It was a path normalization issue and I asked them to keep it “secret” [4], this was a…
-
The security industry needs to re-align its training expectations for QA
I've been involved in the security community for over 10 years and have worked for small, medium, andlarge companies. I have also worked in Quality Assurance and base my comments here on my experiences being a QA tester, and speaking with them as an outsider. I've seen advice in articles, and conferences discussing the need…
-
Microsoft’s SDL and the CWE/SANS Top 25
"Bryan here. The security community has been buzzing since SANS and MITRE’s joint announcement earlier this month of their list of the Top 25 Most Dangerous Programming Errors. Now, I don’t want to get into a debate in this blog about whether this new list will become the new de facto standard for analyzing security…
-
Security metrics on flaws detected during architectural review?
I recently attended a private event where there was a talk on security metrics. Security metrics can be used to determine if action x is reducing risk y. Software security metrics typically involve counting the number of defects discovered over time to see if things are getting better. Most of these metrics involve issues discovered…
-
CWE & SANS TOP 25 Most Dangerous Programming Errors
“Most of the vulnerabilities that hackers exploit to attack Web sites and corporate servers are usually the result of common and well-understood programming errors. A list of 25 of the most serious such coding errors is scheduled to be released later today by a group of 30 high-profile organizations, including Microsoft, Symantec, the U.S. Department…
-
CWE & SANS TOP 25 Most Dangerous Programming Errors
“Most of the vulnerabilities that hackers exploit to attack Web sites and corporate servers are usually the result of common and well-understood programming errors. A list of 25 of the most serious such coding errors is scheduled to be released later today by a group of 30 high-profile organizations, including Microsoft, Symantec, the U.S. Department…
-
Article: Security Assessment of the Internet Protocol
The following was sent to the Full Disclosure mailing list last yesterday. "In August 2008 the UK CPNI (United Kingdom's Centre for the Protection ofNational Infrastructure) published the document "Security Assessment of theInternet Protocol". The motivation of the aforementioned document isexplained in the Preface of the document itself. (The paper is availableat: http://www.cpni.gov.uk/Docs/InternetProtocol.pdf ) Once…
-
MD5 considered harmful today: Creating a rogue CA certificate
UPDATE: I’ve added a link to the presentation slides and some other sites providing coverage of this. The following paper was published today at the CCC conference by Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik, and Benne de Weger. “We have identified a vulnerability in the Internet Public Key…
-
Learning More About the Underground Economy: A Case-Study of Keyloggers and Dropzones
"German researchers have discovered more than 300 cybercrime servers full of stolen credentials on more than 170,000 people — and it is only the tip of the iceberg, they say. Researchers at the University of Mannheim's Laboratory for Dependable Distributed Systems were able to access nearly 100 so-called "dropzone" machines, and say the actual number…
-
Software [In]security: Software Security Top 10 Surprises
"Using the software security framework introduced in October (A Software Security Framework: Working Towards a Realistic Maturity Model), we interviewed nine executives running top software security programs in order to gather real data from real programs. Our goal is to create a maturity model based on these data, and we're busy working on that (stay…
-
Metasploit Decloaking Engine
"The Metasploit Decloak Engine is now back online with a handful of new updates and bug fixes. Decloak identifies the real IP address of a web user, regardless of proxy settings, using a combination of client-side technologies and custom services. The first version was announced in June of 2006 and was eventually made obsolete by…
-
Google Chrome Receives Lowest Password Security Score
"Google's new web browser may be fast and slim, but the password management features it offers are full of bugs. Chapin Information Services (CIS) reported critical vulnerabilities in this software during its beta period, all of which were unfixed at release time. Among the problems are three in particular that, when combined, allow password thieves…
-
Internet Explorer 8.0 Beta 2 Anti-XSS Filter Vulnerabilities
Rafel Ivgi has published an extensive list of IE8 XSS filter evasions. "Aspect9 has discovered several vulnerabilities in Microsoft Windows Internet Explorer 8.0 Beta 2. This new version of Microsoft's famous browser includes new security improvements such as a Cross Site Scripting(XSS) filter. This version also includes a new object that safely allows transferring data…
-
Google publishes Browser Security Handbook
Michal Zalewski from google has published an an extremely in depth guide describing the various behavioral differences between the major browsers. "I am happy to announce the availability of our "Browser Security Handbook" – a comprehensive, 60-page document meant to provide web application developers and information security researchers with a one-stop reference to several hundred…
-
Computer scientists find audio CAPTCHAs easy to crack
"The Carnegie-Mellon University team behind the reCAPTCHA service is continuing to expand its effort to mix basic security and useful work. CAPTCHAs are the distorted text that helps various online services ensure that the entity opening an account is a human, not a bot bent on using the service to dish out spam. The reCAPTCHA…
-
Oracle Forensics Part 7: Using the Oracle System Change Number in Forensic Investigations
David Litchfield has published a new tool and paper on forensics on Oracle Databases. From his email to the Websecurity mailing list. "I've just posted a new tool and paper for Oracle forensics. The tool, orablock, allows a forensic investigator to dump data from a "cold" Oracle data file – i.e. there's no need to…
-
.NET Framework rootkits – backdoors inside your framework
"The paper introduces a new method that enables an attacker to change the.NET language, and to hide malicious code inside its core. It covers various ways to develop rootkits for the .NET framework, sothat every EXE/DLL that runs on a modified Framework will behavedifferently than what it’s supposed to do. Code reviews will not detectbackdoors…
-
Visa Card Features Buttons and Screen to Generate CCV Dynamically
A co worker sent me this link yesterday afternoon. "Using what appears to be Visa’s mutant hybrid of a credit card and a pocket calculator, users can enter their PIN into the card itself and have a security code generated on the fly. The method can stop thieves in two ways. Those who copy down…
-
Continuing Business with Malware Infected Customers
"Today’s media is full of statistics and stories detailing how the Internet has become an increasingly dangerous place for all concerned. Figures of tens of millions and hundreds of millions of bot-infected computers are regularly discussed, along with approximations that between one-quarter and one-third of all home computer systems are already infected with some form…
-
Uninformed Journal Release Announcement: Volume 10
Uninformed is pleased to announce the release of its 10th volume which iscomposed of 4 articles: Engineering in Reverse – Can you find me now? Unlocking the Verizon Wireless xv6800 (HTC Titan) GPS Author: Skywing – Using dual-mappings to evade automated unpackers Author: skape Exploitation Technology – Analyzing local privilege…
-
PHP 5.3 and Delayed Cross Site Request Forgeries/Hijacking
"Although PHP 5.3 is still in alpha stage and certain features like the PHAR extension or the whole namespace support are still topics of endless discussions it already contains smaller changes that could improve the security of PHP applications a lot. One of these small changes is the introduction of a new php ini directive…
-
Fyodor speculates on new TCP Flaw
Fyoder (the author of nmap if you’ve been sleeping under a rock) has posted a write up on the recent TCP Dos flaw. UPDATE: According to a post by Robert Lee this isn’t the issue. "Robert Lee and Jack Louis recently went public claiming to have discovered a new and devastating denial of service (DoS)…
-
W3C Working Draft for Access Control for Cross-Site Requests Published
"This document defines a mechanism to enable client-side cross-site requests. Specifications that want to enable cross-site requests in an API they define can use the algorithms defined by this specification. If such an API is used on http://example.org resources, a resource on http://hello-world.example can opt in using the mechanism described…
-
ViewStateUserKey Doesn’t Prevent Cross-Site Request Forgery
"ViewStateUserKey is not a completely effective mitigation against Cross-Site Request Forgery. It doesn’t work for non post-backs (I.e. GET requests), and it doesn’t work if the ViewState MAC is turned off. In several different places, we see a piece of advice repeated – use the ViewStateUserKey property to prevent One-Click Attacks. Often, this piece of…
Favorite Links
- Security Templates (New)
- The Web Application Security Consortium
- QA Security
- The Web Security Mailing List
- Romain Gaucher’s Blog
- Jeremiah Grossman’s Blog
Popular Pages
WASC Threat Classification
- Abuse of Functionality
- Application Misconfiguration
- Brute Force Attack
- Content Spoofing
- Credential/Session Prediction
- Denial of Service
- Directory Indexing
- Information Leakage
- Remote File Inclusion Attack
- Routing Detour Attack
- SOAP Array Abuse
- XML Attribute Blowup
- XML Injection
- XML External Entity Attack