Upgrade to WordPress 2.5.1 - Now!
Posted by: Owen on Friday, 25th Apr, 2008
Just upgraded this blog to WordPress 2.5.1 as I’ve only just spotted that it’s available. Probably the most important feature is a security fix that is pretty ugly:
An attacker, who is able to register a specially crafted username on a Wordpress 2.5 installation, is able to generate authentication cookies for other chosen accounts. This vulnerability [...]
The Joys of Scaremongering
Posted by: Owen on Tuesday, 25th Mar, 2008
According to a report I’ve just glanced over, 9 out of 10 websites are “sitting ducks”. The article lists a whole range of problems that websites ranging from Cross-Site Scripting (XSS) exploits to Cross Site Request Forgery (CSRF). With such a range of issues most websites seem to have, it’s a wonder there’s any sites [...]
AJAX attacks and how to mitigate against them
Posted by: Owen on Monday, 18th Feb, 2008
Excellent post on The Register entitled Reduce your exposure to AJAX threats, which talks about three pieces of advice you need to keep in mind when developing AJAX applications. There’s nothing new in terms of security principles, just an application to the fact that a good portion of AJAX applications work on the client’s browser [...]
The 12 most common application level hack attacks
Posted by: Owen on Monday, 26th Nov, 2007
I got an interesting paper in my email today entitled The 12 Most Common Application Level Hack Attacks written by Watchfire Corporation. Most development probably know about most of these, but it was nice to see them collected in one place. In a nut shell, these are:
Cookie Poisoning
Hidden Field Manipulation
Parameter Tampering
Buffer Overflow
Cross-Site Scripting
Backdoor and Debug Options
Forecful [...]
You make it, we’ll break it!
Posted by: Owen on Tuesday, 3rd Jul, 2007
The iPhone has only been around for a couple of days and a number of people out there are working hard at breaking into the device. It’s strange how a whole industry has spawned around people hacking their way around software and systems .. and making a legitimate living around it.
It seems like the main reason [...]
SecureZIP - The next generation of ZIP
Posted by: Owen on Tuesday, 24th Apr, 2007
PKWare will always have a place in my mind as being the people who brought the ZIP compression algorithm to the masses. Their then flagship product, PKZIP, had practically become the de facto standard for compression and was used by everyone I knew.
It seems like PKWare have now made their presence felt in the data [...]
GFI LANguard Network Security Scanner version 8
Posted by: Owen on Friday, 20th Apr, 2007
I noticed that GFI has released a new version of their network security scanner which now has the ability to scan your entire network for over 15,000 vulnerabilities. There’s a 30 days free trial to use the product, so I just went ahead and downloaded it to try it on my home network and see [...]
Cracking WEP now takes less than 1 minute
Posted by: Owen on Thursday, 5th Apr, 2007
It seems like WEP has gone the way of the dodo. According to this paper it is now possible to crack 104-bit WEP in under a minute. Here’s a synopsis.
We were able to extend Klein’s attack and optimize it for usage against WEP. Using our version, it is possible to recover a 104 bit WEP [...]
Bring on the honey
Posted by: Owen on Sunday, 1st Apr, 2007
Time for another HoneyPost! Here are some good links I came across in the last few days
101 Shareware and Freeware programs that every nerd needs
Metasploit - For all your security testing
Legal Andrew does blogtipping - I’ll try this sometime
The Cat-eating Monkey gets brought to justice - finally!
Top 100 April Fool Hoaxes
Btrieve Time Machine - Wow [...]
Security vs Access
Posted by: Owen on Friday, 23rd Mar, 2007
It’s interesting to see how the right sort of tension in the workplace can bring about better results in what a team is trying to achieve. I’m working on a long term project at the moment for the Isle of Man Government, which is tasked with putting a number of services online for citizens to [...]
Using Honeypots to learn about HTTP-based attacks
Posted by: Owen on Wednesday, 28th Feb, 2007
Excellent article about using Honeypots to learn about the sort of application threats that are prevalent today. The authors go into detail about how they conducted the study and walk the reader through the results. They cover the following set of topics:
Code Injection
Remote Code-Inclusion
SQL Injection
Cross-site Scripting
Spam
Blog Comment Spam
Defacements
Scanning Tools
[...]
Security Links
Posted by: Owen on Saturday, 13th Jan, 2007
Interesting post on Lifehacker about Ophcrack Live CD which is a resource to help you recover lost Windows passwords. Apparently you create a CD which you boot with. This examines your Windows partition and extracts any passwords it finds from it. The other interesting aspect of the post is the commend thread that follows as [...]
Using PHP? Watch out for your security!
Posted by: Owen on Thursday, 11th Jan, 2007
Excellent post on Security Focus by Kelly Martin called PHP apps: Security’s Low-hanging Fruit which is a worthwhile read for anyone using applications written in PHP, just like WordPress for example. The article talks about the rise in popularity of PHP, the subsequent increase in PHP-based applications and the problems brought about by less-experienced coders [...]
I hate image spam
Posted by: Owen on Sunday, 7th Jan, 2007
I’ve been getting a log of image spam recently, both on my personal email and on my work email. The problem with image spam is that most spam filters tend to look for word patterns and particular keywords, and when an email just consists of one image, well, the spam filter can’t really look into that.
There [...]
Ethical Hacking Talk in IOM
Posted by: Owen on Friday, 31st Mar, 2006
Yesterday, the local chapter of the BCS organised a talk on Ethical Hacking, given by Tony Cawte from Domicilium. Was a pretty good event, with lots of interest from the public. Tony gave a good, fluent talk, managing to get over his initial trepidation (it was his first public speaking engagement) and getting his comfort [...]
