Google: Yes, You Can Find Just About Anything

Hackers and security experts use various custom and open source tools tocomplete their tasks.

In fact, one of the tools they use you probably useevery time you browse the web, the Google Search Engine.I remember the first time I used the Google Search Engine years ago. I was amazed at how quickly it fulfilled my search request.

Google's huge indexof systems / information and it's ability to perform complex searches haveevolved over the years. When we performed security assessments andpenetration test, we regularly use Google to locate information thatorganizations typically want to keep private and confidential.

Full: http://castlecops.com/article-6466-nested-0-0.html

Data protection watchdog investigation finds no evidence

UK banks escape punishment over India data breach

UK banks will not face any action over a data breach in an Indian call centre last year, where an undercover newspaper reporter was allegedly sold bank and credit card details of 1,000 customers.

Automatically Hardening Web Applications using Precise Tainting.

Most web applications contain security vulnerabilities. The simple and natural ways of creating a web application are prone to SQL injection attacks and cross-site scripting attacks as well as other less common vulnerabilities. In response, many tools have been developed for detecting or mitigating common web application vulnerabilities. Existing techniques either require effort from the site developer or are prone to false positives. This paper presents a fully automated approach to securely hardening web applications. It is based on precisely tracking taintedness of data and checking specifically for dangerous content only in parts of commands and output that came from untrustworthy sources. Unlike previous work in which everything that is derived from tainted input is tainted, our approach precisely tracks taintedness within data values.

Resolutions for 2006

‘Tis the time to change old habits and go for a smart new way to make your security grow.
The Expectations and Predictions from Web Application Security for year 2006 mainly focus on :
Worms and Browser Vulnerabilities
Phishing and Cross Site Scripting
Web Application Backdooring
RSS Feeds

Click on the link to view the complete details..

Enjoy the new year...

Regards,
Dharmesh Mehta

Google to buy Opera?

Google may soon announce its acquisition of browser firm Opera, if rumour is to be believed.

Pierre Chappaz, founder of Kelkoo and ex-Yahoo! Europe president, has revealed in his personal blog, Kelblog, that a "usually well informed source" has told him the buy is on the cards.

Such a move could come in response to Microsoft's latest iteration of its Internet Explorer, IE 7. Should Microsoft, for example, make a better fist of integrating its own search technology into its browser, Google could see itself losing market share.

Database Threats

• Password Compromised – same as brute force, or username/password hard-coded in code

• SQL Injection - attacker uses poorly designed input validation routines to create or alter SQL commands to gain access to unintended data or execute commands.Access with Elevated Privileges – incorrect configuration leads to access with higher-than-expected privileges

Authentication Threats

• Brute Force – attacker iterates through multiple combinations in the hope of finding a valid username/password combination
• Man in the Middle – attacker sniffs packets from the network, modifies them, and inserts them back into the network
• Session Hijacking - attacker uses authentication tokens to seize control of a legitimate user’s session while that user is logged into the application
• Session Replay - attacker captures authentication tokens (e.g. session ID, cookies) to bypass normal authentication without the legitimate user having to be logged into the application.

Microsoft
OWASP
OISSG

Will the concept of 'office' fade out?

Technology which might expedite the arrival of the next generation workplace is Personal Internet Communicator (PIC), which is an affordable consumer device designed to provide managed internet access for people in global, high-growth markets to enhance communications, entertainment and education opportunities.

The emergence of collaborative technology and tools will further reduce the need to go to office and be at your desk per se. You might be able to sit on India gate lawns and write that important mail, or might be able to present an important presentation over video conferencing while your kids enjoy their favorite ride at Appu Ghar. If this sounds like a sci-fi then wake up to reality. All this and more is likely to happen in the coming three-to-four years. In fact, IT-majors Microsoft and IBM are working hard to make this vision a reality

Details

More Windows exploits posted online

Two new pieces of computer code that could be used in cyber attacks on Windows users were posted on the web on Wednesday and Thursday.

The exploit posted on Thursday is another that could allow a remote attacker to gain complete control over a vulnerable computer. The code takes advantage of a flaw in a Windows component for transaction processing, called the Microsoft Distributed Transaction Coordinator. Microsoft addressed the flaw in security bulletin MS05-051 in October.

What is Blogging ?

Hi,

Well many people asked me of what is this blogging all about...
And this is how I can define for you all...
Comments are always welcome..!!

Blogging
A blog is essentially a web application which contains periodic posts on a common webpage.
Blogging combines a personal web page with tools to allow comments to be left and to make linking to other pages and blogs and ‘trackbacks’ – a system that allows a blogger to see who has seen the original post and has written another entry concerning it.

Failure to comply W3C...

Hi,

The vast majority of public service websites in Europe are failing to meet international e-accessibility standards.

That's according to a report released by the UK EU presidency, which shows that a mere three per cent of public service websites are fully meeting the terms of the minimum accessibility requirements as stated by World Wide Web Consortium (W3C) guidelines.

Most of the websites fell down in the area of providing suitable text alternatives for images on their sites, with a large number of websites also failing to fully explain the relationship between frames on a website.

Seems, there is a trade-off somewhere ...

Regards,
Dharmesh.

ISSAF Draft o.2 to be released soon...

HI All folks,

As a part of ISSAF, it's nice to tell you all that the ISSAF (Information System Security Assessment Framework) Draft 0.2 will be available to you soon.

Watch out at http://www.oissg.org

My contribution includes the Web Application Security Assessments....:)

WRegs,

Dharmesh.

Free Software Foundation to take Gates to task...

The Free Software Foundation Europe (FSFE) has filed a request with the European Union asking to get involved in an EU antitrust suit against Microsoft.

The Linux and Samba developer group has filed its request for leave to intervene in the case saying Microsoft's fiscal might is skewing the fight unfairly.

Georg Greve, president of FSFE, said in a statement: "The more Microsoft is able to purchase its opponents' solidarity, the more important FSFE's commitment to freedom and interoperability is."

Conversely, Microsoft has also been lobbying for new supporters in the case, asking big business to intervene on its side. Several opponents of Redmond, including the Computer and Communications Industry Association and Novell, dropped their objections following payouts from Microsoft.

Myself....

New Sober Virus

There are at least three new variants of the Sober worm spreading across the internet via email messages. The viruses are activated once a user clicks on an infected attachment.

Sober can hijack a Windows-based computer and force it to send spam emails. The continuous emailing can lead to overloaded servers and reduced network performance.

Free desktop apps from Microsoft

Microsoft is planning to to offer free, ad-supported versions of some of its desktop products.

Does it it make sense to release ad-supported versions of products such as Works, Money, or even the Windows operating system itself ?

Google Analytics

To track user behaviour to determine which features keep visitors on the site and which ones make them click away

Google Inc. plans to give away a set of analytic tools allowing Web developers, administrators and advertisers to fine-tune their sites including advertising.

The tools are intended to address a key aspect of successful Web sites, which is the ability to track user behaviour to determine which features keep visitors on the site and which ones make them click away.

Apple versus Microsoft

Running Microsoft Vista Beta 2, if I launch the QuickTime player, all applications running on the system lost their glass effect until I quit QuickTime.

Guess would be spite on the part of Steve Jobs...

ASP.NET __VIEWSTATE issues

ASP.NET's extremely popular __VIEWSTATE functionality provides an automatic, uniform method for storing current state of all webpage "controls" (including form fields, database views, etc), so that user-entered data auto-magically persists and is populated across newly rendered HTML, and so that current selections of displayed database records are cached and do not need to be looked up again after every operation.

The data is by "typically" stored on client side as base64-encoded, hidden POST form field. By default, the field is protected from tampering by being "signed" using SHA1 with machine-specific key and - although not discussed by Microsoft - presumably either target .aspx filename or other file ID parameter.

The ASP.NET's __VIEWSTATE field has been found to be prone to replay attacks as well as denial of service vulnerabilities.

internet Usage in India ??

Looking at the figures in other countries like UK where the tech-savvy people (most of students and shoppers) have crossed the European countries in internet usage, I was wondering where would India rank in terms of people using internet.

Just over 60 per cent of Britons are now making use of the internet. While the UK beat the European average for internet usage, which stands at 47 per cent, it is far behind the Nordic digital leaders – both Iceland and Sweden boast an 82 per cent average.

Any idea what percentage of Indians use internet ?