You know those Facebook applications that occasionally pop up on your news feed, promising to add a “dislike” button, let you view who’s been looking at your profile, or implement some other feature that Facebook won’t ever support? A lot of these applications are not much more than thinly disguised malware designed to harvest personal information or trick the user into participating in a click fraud scam. Well, it looks like we’re in for a lot more of them, thanks to a new, cheap toolkit that allows users with little to no programming knowledge or experience create these malicious applications. For the low price of $25, this application will guide you through the process of creating your own nefarious Facebook[…]
Category: software
What is the first step to creating a new building? Is it grading the land? Building a foundation? No, the first step to creating a new building is to architect it. I might be able to learn enough about engineering and architecture to design a house. I doubt anything I came up with would be elegant enough to be on the cover of Architectural Digest – I don’t have enough experience! And likewise, my friend who is an artist could probably come up with some really fantastic, charming design for a house, sure to stun anyone who walks by… but her design might not be sufficient to meet building codes or even support its own roof. Architecture is the process of design,[…]
A number of our employees are currently spending a fairly large amount of their time helping a customer with a task. In a perfect world, this task would be completely unnecessary. Suffice it to say that there is some maintenance that must be performed on a number of systems before the year is out, and they are having trouble getting responses from the system administrators who are responsible for the systems. When we perform assessments, we often ask our customers about whether they have a configuration management database (CMDB) or something similar. While CMDB systems may be useful for performing a physical inventory of your systems, that isn’t the real benefit. The real power of a CMDB comes in being[…]
Recently I changed my personal firewall software. I was using the default Windows7 Pro firewall, which is fine for basic stuff, but I found a deal on one of my favorite security suites, so I went ahead and sprung for it. One main befuddlement people have with additional firewall software is the amount of nagging it often does when it’s first installed. You open your email client – popup – “program X is trying to communicate on port Y would you like to allow this?” You click yes, and move on. You open your instant messaging client and again – popup – “program X is trying to communicate on port Y would you like to allow this?” This can be[…]
Back in January, Google announced they would pay between $500 and $1,337 for bugs in their Chromium web browser code, if the discoverer first reported it privately to them and followed certain conditions. Since then, the company has handed out quite a few bounties to security researchers who found problems. Now, Google has expanded the program by offering similar bounties for vulnerabilities in their web-based applications. Hackers who find issues such as HTML injection or cross-site request forgery in important Google services can now report them and possibly qualify for rewards ranging from $500 to $3,133.70. As with the Chromium bounties, bug hunters have to follow a few rules and conditions, such as giving Google some time to fix the[…]
AntiXSS is an open source .NET assembly available for download from Microsoft (source here). This library provides much more flexible XSS protection in .NET applications than the built-in Server.HTMLEncode() approach, as it adds support for XML and LDAP filter encoding in addition to HTML encoding. By allowing flexible and secure encoding and decoding of strings for these types of data, application developers can breathe a little easier when accepting data across trust boundaries. Libraries such as AntiXSS that perform string processing are incredibly useful for developers, for several reasons. First, they are maintained separately from your code base, so any updates to the string processing functions for emerging threats can be applied without much hassle. Second, by using a code[…]