OWASP’s AppSecDC 2010 is less than a month away, running at the Washington Convention Center November 8-11. The first two days provide attendees and locals with an excellent opportunity to attend high-quality training for very little money. In particular, Gemini Security will be delivering KRvW Associates‘ “Software Security Best Practices” curriculum. This course is a 2-day program that only costs $1,495! The curriculum is hands-on in nature, portable to most code bases, and builds on the successes of the OWASP Top 10 list, OWASP Live CD, and several years of quality curriculum from KRvW Associates. We hope that you’ll be able to attend the conference and also take advantage of this, or other, training programs. Sign-up today!
Once upon a time, the Web was filled with static pages of text, hyperlinks, and the occasional image. Security problems existed even back then, but the pages themselves were generally innocuous. As the years went by, however, the Web became a platform for all sorts of communications and services. In time, the mild-mannered web page became a delivery mechanism for large-scale, dynamic applications. Even mobile browsers now include engines for loading powerful object-oriented programs. As the capabilities of websites expanded, the problem of HTML injection, or cross-site scripting (XSS), became a significant threat. Check any recent research on web-based threats, and you’ll find that this type of vulnerability is widespread online. And if the past few weeks are any indication,[…]
Fuzzing is a fairly recent term for what pen testers (and testers in general) have been doing for years – feeding invalid data to a program/web page/etc and seeing what happens. When you wrote your first C program that had to take command line arguments – did you ever mash on the keyboard and see what happens? You were fuzzing even if you didn’t know it at the time. The old Christmas tree packet in networking was a sort of fuzzing. Fuzzing can get kinda boring though, so there are several tools that will help you with it. They work on various kinds of inputs – some are for networks, some are for web pages, some are for the HTTP[…]
Source In early October, Microsoft will be making the Microsoft Security Essentials suite free for small businesses (i.e., fewer than 10 computers) in addition to home users. This is a good thing – MSSE is a good suite of security tools, and the price tag is just right for individual and small business users. However, has anyone ever read the language in the EULA for the tool? The installer itself only checks that you have a genuine copy of Microsoft Windows before allowing the installation to proceed; there are no license keys or anything to deal with. The source article indicates that the types of business that will now be allowed to use MSSE for free already were using it[…]
Please join Gemini Security Solutions at AppSecDC 2010 where we will be delivering a 2-day “Software Security Best Practices” course based on the materials we support from KRvW Associates. The course is $1,495 and will run November 8-9 here in Washington, D.C. Course Description: This tutorial starts with a description of the security problems faced by today’s software developer, as well as a detailed description of how defective software can be exploited. It goes on to provide a thorough description of the best practices available to prevent, detect, and remediate security problems in software. Next, the tutorial includes hands-on design review exercises to reinforce each of the concepts presented, together with dozens of examples of common coding errors (primarily in[…]
A new problem has been uncovered that allows an attacker to obtain encrypted session cookies or other encrypted/protected data stored on any version of ASP.NET from Windows XP to Windows 7 and 2008 R2. When properly exploited, the attacker gets full administrative rights to the application and gets access to files such as the web.config file which often stores sensitive information and passwords. From ComputerWorld: Hackers can exploit the vulnerability by force-feeding cipher text to an ASP.Net application and noting the error messages it returns. By repeating the process numerous times and analyzing the errors, criminals can learn enough to correctly guess the encryption key and thus decrypt the entire cipher text. It will take some time for Microsoft to[…]