One of the most expanded targets lately in vulnerability research is Adobe’s Flash. It has become a common everyday occurrence on the web; everything from banners, to games, to file uploads. It’s almost hard to find a mainstream site that doesn’t have some sort of flash application running somewhere within the domain. As a result it has become a target for many attacks. But one thing that hasn’t increased is the amount of time and checking that goes into the flash applications to ensure they are secure.
Category: Technology & Tool Thursday
Each Thursday, Security Musings features a security-related technology or tool. Featured items do not imply a recommendation by Gemini Security Solutions.
GFI LanGuard 9 is a network / PC auditing tool. The tool does a pretty decent job of detecting machines on the network, devices, appliances, and other misc. items. It can also do a fairly deep scan of each local machine for installed software, installed patches, missing patches, open ports, and detecting vulnerabilities that are present. The “Quick Scan” option is fairly quick taking no longer than a minute or two for each machine, and the “Full Scan” no longer than 5-6 minutes per machine.
Good File Transfer Protocol software can be hard to come by. Luckily there are some very good programs out there for those of us who like to throw data around using FTP. This is where WinSCP comes in– it handles all of your FTP needs perfectly, offering secure copy, secure FTP, and regular plain vanilla FTP (not recommended). With secure FTP, your sessions are encrypted, offering protection from packet sniffers and whatnot. WinSCP supports multiple sessions, saved configurations, handles the SSH host keys just fine, and integrates with the desktop so you can just drag and drop stuff in there all day. And it’s free. It’s one of those programs that’s just solid all around. Obligatory screen shot: Each Thursday,[…]
In past blog posts, we’ve talked about how important it is to be aware of the encryption being used when communicating with your bank’s website or other sites where private information may be exposed. We’ve seen how web browsers try to help keep you on your toes, and we’ve encountered malicious programs that fool you into thinking your connection is secure when it’s not. SSLPasswdWarning is a Firefox add-on designed specifically to avoid being tricked by something like sslstrip. If you click on or give focus to a password box, the add-on will examine the web page’s source to make sure that the password will be submitted using a secure connection. A warning box is shown, and the submission is[…]
The Windows utility Sandboxie runs applications in an isolated environment on your computer so you can protect yourself from malware, surf the web, and maintain your registry without affecting your host system. You can run a number of applications including Firefox and Outlook to protect your privacy and keep viruses and other potentially harmful changes from messing up your Windows machine. Sandboxie is a good alternative to setting up a virtual machine, especially if you just want to run a quick test or two without having to wait for an entire operating system to boot up. Each Thursday, Security Musings features a security-related technology or tool. Featured items do not imply a recommendation by Gemini Security Solutions. For more information[…]
Damn Vulnerable Web App (DVWA) has released an updated version (v1.04) of their PHP/mySQL web application that is intended to be attacked. It’s intended to be run on a local (closed) network as a learning tool for exploits and vulnerabilities. As it sits now, it pretty much contains a lot of the basics – brute force, command execution, file inclusion, SQL injection, and XSS.