For years people have been getting their online accounts compromised due to phishing as well as via brute force attacks due to poorly chosen passwords. We also know that people tend to share the same credentials across multiple sites however I haven't seen any concrete research/metrics on how commonplace this is or...
Jeremiah grossman has posted the results of his "Web Application Security Professionals Survey (July 2008)". They are also available in ZIP format.
Welcome to the new and improved CGISecurity.com! After years of using the old design I've decided it was time for a change and thanks to my homeboy Romain we have a new design. In addition to the design you can now post comments, get partial story bodies in RSS feeds, and actually...
"Two weeks ago, when security researcher Dan Kaminsky announced a devastating flaw in the internet's address lookup system, he took the unusual step of admonishing his peers not to publicly speculate on the specifics. The concern, he said, was that online discussions about how the vulnerability worked could teach black hat hackers...
Michelle let us know about the following story on techtarget "A recent security assessment of an application by Ounce Labs has resulted in the discovery of two vulnerabilities that can affect Java Web applications that use the Spring Framework. Spring has been downloaded more than 5 million times to date, which means...
From the 'If you don't know, now you know, !@#$!' department The following email was sent to the full disclosure mailing list today by Brad Spengler, the author of GRSecurity. "I doubt many of you are following the "discussions" (if they can be called that) that have been going on on LWN...
"This paper draws attention to how the use of common programming APIs and practices could lead to flaws in the processing of numeric data, which could in-turn allow attackers to manipulate the outcome of transactions or otherwise interfere with the accuracy of calculations. It discusses the technical vulnerabilities typically observed in both...
"CAPTCHA went from relatively obscure security measure perfected in 2000 by researchers at Carnegie Mellon University to deployment by most of the major Web e-mail sites and many other Web sites by 2007. Sites such as Yahoo Mail, Google's Gmail and Microsoft's Hotmail all used -- and, for that matter, continue to...
WASC and OWASP are throwing a party this year during blackhat at the shadow bar which is being sponsored by Breach. This will be the 3rd party at the shadow bar, and 2nd joint WASC/OWASP conference. If you want to chat appsec this is where everyone in appsec will be.
A pretty nasty DNS vulnerability has been discovered in 81 products by Dan Kaminsky. This vulnerability type seems to be the same described by Amit Klein and involves abusing the PRNG involved in transactions on DNS queries. Long story short if you run a vulnerable caching DNS server you can have your...
"The current state of secure software development by corporations both large and small is a mess. Software vendors need to realize that they must begin exercising due diligence when producing their software products. Microsoft dedicated itself to secure development practices some years ago, yet its developers are still taking months to fix...
Microsoft has a decent article on security testing for CSRF worth checking out. "Tester Question: What is a cross-site request forgery attack? How do I test our website to see if it is vulnerable to this attack?" Article Link: http://msdn.microsoft.com/en-us/testing/cc664492.aspx
"The latest high trafficked web site to fall victim into the continuing waves of massive SQL injection attacks courtesy of Sony PlayStation's site SQL injected copycats and the ASProx botnet, is Sony's PlayStation U.S site according to a recent post at SophosLabs's blog" - ZDNet Article Link: http://blogs.zdnet.com/security/?p=1394
Firefox 2.0.0.15 was released addressing the following security issues. MFSA 2008-33 Crash and remote code execution in block reflow MFSA 2008-32 Remote site run as local file via Windows URL shortcut MFSA 2008-31 Peer-trusted certs can use alt names to spoof MFSA 2008-30 File location URL in directory listings not escaped properly...
"In this interview, cloudsecurity.org talks to Guido van Rossum about Python, Google App Engine and security. Guido is the creator of the Python programming language and more recently, Google App Engine team member. His involvement with the App Engine project was pretty late - the code "was almost ready for release" when...
Microsoft has posted a very extensive article outling the security improvements to IE8. Improvements have been made to the following area's. - Cross-Site-Scripting Defenses - Safer Mashups (HTML and JSON Sanitization) - MIME-Handling Changes (Restrict Upsniff and Sniffing Opt-Out) - Add-on Security - Protected Mode - Application Protocol Prompt - File Upload...
