Westside in Mumbai stores your credit card numbers..

Hi,

If you are a Mumbai local, I am sure you would have visited Westside - one of the famous retail shops. I happened to bump into their store in Andheri(W) Infinity Mall and to my surprise, when I gave my credit card for swipe, they swiped it twice. :(
- Once on the processing machine and second on his computer.

I asked the fellow, "Why are u swiping my card twice?"

He replies, "Sir, we need to store your card information for tallying it at the end of day."
I was really disturbed by this. They stored my name, card number and expiry date. Only thing remaining was the CCV number. Remember this is generally a 3 or 4 digit number usually at the back of the card.

I am surprised that these merchants are allowed to store credit card information. No PCI compliance required ??

I felt like calling up the media - Mumbai Mirror, DNA or Times and yelling them that see these guys....what are they upto ?? Why the hell are they storing credit card information and if they need it, why is is not encrypted??

A hacker's mind would surely think of compromising their database having thousands and thousands of credit card holders information.

To add to all my fuss that day, they gave me a printed receipt to sign off and that too printed my entire credit card number (none of the digits were masked) and even the expiry date.

I am sure there are many such places in mumbai where credit card information is stored and is highly likely for hackers to get inside them very easily. If the merchants or shop owners do not bother to care about the credit card information, they must be banned from handling these transactions.

I wanted to raise my voice for all the people who actually opt for credit card transactions. Please make sure and shout if you find they are storing your credit card information. If they are swiping the card twice for their sake. This is illegal.

Visa / Mastercard and other card issuers must look into this matter asap.

Please send in your comments and let's raise this to get in media of possible and spread awareness.

Thanks.

Dharmesh.

Oracle Default Passwords

Hi,

Beware of database Default Accounts before you ship your database to production.
I saw this screen while installing Oracle. I think this kind of screen should be shown in all database tools and also there should be a warning mentioning the harm of keeping the default accounts ON in the database.

For now, enjoy this screen... :)

Introducing - TechTrails

Dear Software Professional ,

So the rupee’s rising. Now why’s that causing sleepless nights for some software exporters? And hey, what’s the net impact on you? . Does this rise of the rupee present a great opportunity that could have far-reaching positive consequences ? What is the future of Indian IT industry ? What will happen when other low cost destinations for outsourcing catch up with India ? Will India sustain it’s cost advantage ? These are questions that impact your career and you need an answer on how and what you need to do to get ready for the next wave of Indian IT .


www.techtrails.com has the answers for you .


This is the only web portal of it’s kind that will help you as a IT professional or a student planning a career in IT to get ready for the future . Thought leadership articles , interviews with industry leaders , tips and tricks , white papers www.techtrails.com has it all . Besides you would get invited to free seminars and panel discussions on topics that would impact you .

Over time the www.techtrails.com would be a place for 3rd wave Indian IT professionals to hang out , exchange information , share links to their blogs , upload content that would be of benefit to all who are a part of this community .


Registration to www.techtrails.com is Free ! Rush and register yourself to www.techtrails.com Now !

App Security Testing Cheat Sheet

Hi,

I thought to prepare a brief cheat sheet for Application Security Testing.

Please have a look and drop in your views. In case you wish to use it for your testing, please drop me a mail at dharmeshmm at gmail dot com to notify me about it.

Authentication Checks

1. Login and Change Password pages on SSL?
2. All sensitive pages (accepting SSN, Credit Card) over SSL?
3. Strong Password Policy? (Joe Accounts/Blank Passwords/Max Password Age/Min Password Age, etc)
4. Is Forgot Password page secure?
5. Password Change forced on 1st login?
6. Re-authenticate before moving to sensitive pages (Edit Account Info?)
7. Prompts old password before changing password?
8. Has "Remember Me" feature? If so, how's password stored?
9. Warns before allowing "Remember Me"?
10. Has CAPTCHA to prevent password guessing?
11. Does show error msgs like "Invalid User/Invalid Password"?
12. Can auth. be by-passed for priviledged URL's?
13. Is AutoComplete set to OFF?
14. Is password re-submitted on 'Back/Refresh' of browser?
15. SQL Injection in login?

Session Management

1. Is session id random enough?
2. Session Timeout present?
3. Stored in what form? (persistent cookie/in-memory cookie)?
4. Session Id expires on request tampering?
5. Sensitive data in cookie?
6. Can you see X user's data with Y's session id?
7. Session expires at server-side on logout?
8. Can logged out user's session be re-used?
9. Is new session id generated on login?
10. Is cookie over-written on logout?

SQL Injection Checks

1. SQL Injection : '
2. SQL Injection : ' OR 1=1 --
3. SQL Injection : '; waitfor delay'00:00:05'--

XSS Checks

1. XSS Javascript
2. XSS Encoded
3. XSS Cookie
4. Is CSRF possible?

Input Validation Checks

1. Use proxy to by-pass client side validation?
2. Generate errors for information disclosure?
3. Web Page source reveals sensitive application information
4. HTTP Headers manipulation
5. Viewstate manipulation
6. GET and POST parameter manipulation

Secure Storage Checks

1. Are passwords stored in clear text?
2. Is sensitive information like Credit Card encrypted?
3. What encryption algo used? Standard or Proprietary?
4. Is connection string in clear text?
5. Any passwords hard-coded in application?

Browser Checks
1. Check browser history? Are sensitive pages cached?
2. Is data cached by search engines or desktop search engine?
3. Any hard-coded secrets in javascripts?
4. Web Page code reveals sensitive comments?

File Checks

1. Is file upload /download allowed?
2. Can files be downloaded directly from URL?
3. Can malicious files be uploaded?


Environment Checks

1. Are default apps installed?
2. Are default accounts enabled? Do they have strong passwords?
3. Is firewall deployed?
4. Is code obfuscated?
5. Can detect server details using banner grabbing?
6. Are forms bot resistant?

In case you have your views, please feel free to write here or mail me at dharmeshmm at gmail dot com

Cheers,
Dharmesh.

Get into pay sites for free as a Googlebot

Ever wondered why Google returned search results that lead to sites that require a registration? How did Google index the site without a registration? Many sites want their site indexed in Google to receive more hits, so they allow Googlebots in. Because of this reason we can take advantage of this. All we have to do is disguise ourself as a Googlebot and many sites will let us in without registration.

To do this we have to change the User Agent. The user agent defines the browser and what version you are using. For example if you go to this site it will tell you what browser you are using, and it finds this info out by the user agent.

Changing the user agent is easy, to do this in Opera you have to uses these settings:

User Agent: Googlebot/2.1 Compatible: http://www.googlebot.com/bot.html

Firefox users can use this extension and import this file (right click and save) that has a huge list of user agent settings including Googlebot/2.1 and many other spiders/bots.

Internet Explorer users you will need to change the registry entries, to do this open notepad and copy this into it:

Windows Registry Editor Version 5.00 [HKEYLOCALMACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet Settings5.0User Agent] @="Googlebot/2.1" "Compatible"="+http://www.googlebot.com/bot.html"

Then save it as ua.reg and double click on it.

To revert the changes back, you will need to do the same but this time copy this in:

Windows Registry Editor Version 5.00 [HKEYLOCALMACHINESOFTWAREMicrosoftWindowsCurrentVersionInternet Settings5.0User Agent] @="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

Save as oua.reg and double click.

To see if it has worked go here and your browser should now be Googlebot v2.1

Enjoy!

The Perceptive Pixel

OWASP Mumbai Venue Map - 6th Sep Meet

OWASP Mumbai Meet : 6th September 2007

Mumbai Celebrates OWASP Day : OWASP Live 0

OWASP Day - Day of Worldwide OWASP One Day Conferences

Date: 6th September, 2007

Timing: 2:30 PM to 6:00 PM

Venue: HOTEL HEAVENS INDIA

Plot No A-1, Opposite SDF 4, SEEPZ, SEZ,

ANDHERI (E)- MUMBAI

Registrations - LIMITED SEATS !!!

The event is FREE to attend.

Event Agenda

2:30 PM - 3:00 PM Welcome Keynote : Dharmesh Mehta, Mastek Ltd.

3:00 PM - 4:00 PM Black Vector of Web Exploitation : Aditya Sood, Sec Niche

4:00 PM - 4:45 PM End User Privacy Breaches : Rishi Narang, ThirdBrigade

4:45 PM - 5:30 PM Advanced SQL Injections : Mastek Ltd

5:30 PM - 6:00 PM Snacks & Networking

You can be arrested for using free Wi-Fi

A Michigan man has been arrested and will be prosecuted for using a cafe’s free Wi-Fi network from his car without buying anything.

According to reports, Sam Peterson says he didn’t realize he did anything illegal until he was cuffed (nor did the cafe owner or even the police officer).

Prosecutors believe him, so they’re letting him off easy with a $400.00 USD fine and 40 hours of community service.

So let me get this straight - $400.00 and 40 hours of community service is considered being let off easy?

Apparently under Michigan’s “Fraudulent access to computers, computer systems, and computer networks” law, Peterson’s actions could result in a five-year felony and a $10,000 fine, so I guess the answer is yes.

If the prosecutor and the cop believe him, they should just let the guy walk completely.

Moral of the story… if you plan on using the “free wireless internet” at your local Cafe Coffee Day, Cross Word Store or other favorite hangout, be sure to buy something before hand.

Big B Watching or Is this Intrusion of Privacy?

I ain't talking about Big B - Amitabh Bachhan here....
This is about Big Brother - our own police force.

I read an article in Hindustan Times (April 30th, 2007). In first-of-its-kind intitative to tackle cyber-crime, the Nashik police is keeping an electronic eye on cyber cafe users. They aim to maintain real-time photo record of users at cyber cafes and the times spent surfing. This is all done using a software called Webcafe.

Hence if a user goes to a cyber cafe, his photo, name, address and identity proof gets recorded into the main server which would be connected to a central server located at police head quarters. So everytime a user logs on to a computer the details would be automatically transeferred to the police servers. I saw similar kind of photograph based logs in Hyderabad when I was touring. Now with these kind of systems coming in place, we would hope that cyber crimes would reduce atleast from cyber cafes as point of origin. I am still not seeing such measures from cyber crime cell in Mumbai though.

Let's see the other side of story. How many of us like to be photographed everytime you go to a cyber cafe? What is the guarantee that the cafe owners will not misuse the photographed data? Indian Penal Code asks cafe owners to keep a manual record of every user. I think this is really intrusion of one's privacy. If we see the real world attackers - the so called smart hackers will be doing away with all these measures either by using multiple proxy servers or spoofing IP addresses to cover their tracks. They have thousands of ways to find a victim for attack.

I do not say that we should not do anything. But should the measures be at cost of a general user's privacy? Do the police now storing these information now guarantee the safety of our data same way as our banks do for online transactions. Also one needs to wonder how secure are the central servers at police station. It surely has such large amount of personal data now. Are the softwares and servers tested for security before they store such data?

I think everybody should think about this. Feel free to share your comments here. You can mail me at dharmeshmm at gmail dot com

Thanks,

Dharmesh.

Security Concerns in Web 2.0

Hi,

I did get a chance to submit a paper on security concerns in Web 2.0
This paper has been published by OWASP now and is available at link below:

PDF version:
http://www.owasp.org/index.php/Category:OWASP_Papers

HTML version:
http://www.owasp.org/index.php/OWASP_Papers/Jeopardy_in_Web_2_0

Happy reading !!!
Please feel free to drop in your comments about the paper.
You can mail me at dharmeshmm_at_gmail_com

Wregs,
Dharmesh M Mehta
Mastek Ltd.

Things to ponder for securing your UI

#1. Clearly describe how to set security

· Ensures that UI reduces the level of complexity in configuring and managing security
· Are there features to test roles?
· Will users understand how the test features work?
· What are Default Security Roles for New Objects
· When objects are created, what are the default security settings?
· Are users informed what the security settings are?
· Default Security Roles for Updated Objects
· What is the default security mode for updated (sub-) objects?
· Are users aware of the default security permissions?
· Is the security mode appropriate?
· When updating the object, will users think/be prompted to change the security?
· Are there Multiple Methods of Setting Security:
· Are there are multiple methods of setting security for an object?
· How are the methods different?
· Do users understand the key differences between the methods? (Will they be able to choose the appropriate method?)
· If a parent object rolls-up security state from its children, is the state accurately rolled up?
· Can I Bulk Edit Security Roles?
· Do users require bulk editing of security roles?
· Are bulk editing facilities provided?

#2. Does UI provide a means to quickly reset to a secure mode in case of a security lockdown?

• Provide a single place for users to turn off features in security lockdown.
• If clusters or a group of servers are used, provide a facility to bulk reset

#3. Does the UI imply security when system may not be secure

• Don’t give users a false sense of security: Users feel secure when they have set a password. Counter intuitively, if this password is weak, a blank password is in fact a stronger defense, since the system will restrict certain access if there is no password, but will not do this if there is a password is present.
• Giving partial or incomplete information can falsely imply security.

#4. Ensure that UI provide admins an overview of privilege granted to users

• Ensure that admins have a means to have a system overview of which user has what privileges.
• Excessive privileges granted are a major vulnerability. Ensure that UI allows admins to easily revoke granted privileges, and clearly see consequences.

#5. Does the UI actively promote security

• Ensure that your UI does everything it can to actively help the user secure their system.
• If a user must compromise their system’s security to perform a task, provide some way to automatically restore the system’s security later, or prompt the user to restore the setting when the user has completed the task.
• Make it clear to the user where they need to go to reestablish a secure configuration. Provide direct links wherever possible.
• Enable your feature to be updated easily if security issues appear after it ships using an automatic mechanism such as Windows Update.
• Make sure that the most secure option is the default. Explain to users the security issue that makes this is the recommended option.
• When the default option is not the most secure option (for reasons of product compatibility or some other intention), indicate visually which setting is the most secure.
• Provide an option to automatically secure system, such as to lock unattended machines
• Provide a simple means in the UI for users to determine if preventive measures such as virus signatures are up-to date

#6. Are security messages effective?

• Ensure that security messages are differentiated from other messages. Users are inundated with so many message boxes that they often breeze through these obstacles. Security messages look much like every other message, so users get a mixed message and tend to ignore them. In one usability study, 5 out of 8 clicked either Yes or No without reading the security dialog.
• Emphasize security by giving a visual clue that this is a different type of message. Even as users become familiar with the style and learn to click through without reading the text, we alert them to the fact that there is a security issue during the split second we have their attention. Used judiciously, users may even perceive them as infrequent enough and visually arresting enough to slow down and pay attention.
• Communicate the level of risk associated with any choice provided in security-related information. Users should be able to identify the severity of the problem, likelihood that it will affect them, and any necessary steps to correct the situation.
• A high risk warning would have more lasting impact if the frequency of other messages is low.
• Make information in the message box specific enough for the user to follow up after closing the box, such as searching for the terms in the message to find relevant Help content or links to security features.

#7. Are UI graphics appropriate to the severity of the message?

• Use graphics to reinforce, highlight or convey security information, but ensure that the graphics are appropriate and related to the content.
• Do not use the question mark message icon. This image does not clearly represent a specific type of message or could be misinterpreted as related to Help information.
• Avoid overusing the warning icon. Be sure that the content is truly a warning, and not simply an fyi or even more serious than a warning.
• Use graphics that look professional and consistent with the product’s look and feel so that the user feels they can trust the source of the message. Work with a designer to define the correct style for icons in your product.

#8. Does UI Help assist user to be secure?

• The Help topic should bridge the gap between the UI and real world usage. The Help topics can be the user’s last hope of understanding a concept or helping them make a decision. Often our Help topics are just as vague, technical and intimidating as the interface the user is trying to understand.
• Address common user scenarios.
• When the user experience is not great, explain how to understand the feature’s design and UI, not just the steps to use it. For example, if the settings for using a feature for a specific scenario are on a different tab or hidden behind a link to “advanced” features, explain that X users can find the settings they want there.
• Where a feature allows users to choose settings that affect the security of their system, explain the security consequences even if it makes it clear that they don’t get to have a perfect solution.

#9. Has the UI been designed to accommodate supplemental security?

• Design the product to anticipate security devices t such as smart cards, biometric product fingerprint, and retina scanners which are starting to be used to identify users to system.

How do you get Web Testing the right way?

With the eminence of Internet in business and culture which has expanded the applications to evolve in complexity and scale, it has become very crucial for organizations to build webs for scalability and rigor. The webs with capability to withstand expected (and unexpected) spikes and peaks in load are in the insight.
As web applications are becoming increasingly mission-critical, errors can mean disastrous strikes to a company’s business and reputation, as well as exposure to potential legal and financial liability.

With global access to systems, nonfunctional requirements such as security, performance, scalability, and availability suddenly become strategic. Many Internet systems are tested for performance and scalability only after the bulk of the functionality is built.

Since companies now realize that errors in web application performance and
functionality can be insidious, occurring as a result of multiple causes, and risky and
costly to fix, they are becoming more proactive in their web testing. The question
then becomes not whether a website is tested, but how well was it done?

To assure confidence in application deployment, in shorter project timeframes, testers must take a realistic and an integrated approach to testing.

Start by simulating concurrent users as realistically as possible. For
example, a online shopping site should mix many prospective shoppers with some purchasers and a few administrators. Each role will stress the application differently, giving you a
realistic view of how your users will experience your application.

Automation tools can help you simulate real-world variables at run time, such as different levels of SSL encryption, multiple client types, variable “think” times or the effect of slow line speeds.

The advantages of testing with an integrated, flexible solution cannot be denied. It is possibly the best way to identify problems sooner, reproduce them faster, and resolve issues earlier.

While designing this series of realistic tests, we need to determine what are the crucial factors to be evaluated for the tests. For eg. What is the number of users to simulate, what is the expected Page Load time, what type of hardware is required for these scenario, what is the CPU utilization on the servers, the Memory consumption at peak load and much more. . Bear in mind that your performance testing, while it may be focused on the end user’s experience, needs to uncover problems further back in the system. It does no good if the system performs well, but uses so much server memory that it crashes your servers after a few days in production.

Performance is the speed at which a system responds to user actions. Scalability is the relative ability of a system to maintain its performance when under load. Load is measured by the number of simultaneous requests that are dispatched to a system.

Scalability testing is to verify your application’s data integrity while verifying its performance. Both should be validated under load for every individual user. After all, what good is a speedy response from your web server if it is only delivering a “busy” message back to the user – or, worse yet, delivering subtle data errors?

Security among The Hottest Skills for 2007

With fewer openings this year, expect these five premium skills to win the jobs

Top skills IT executives say they will hire for in 2007:

1. Programming/application development
2. Project management
3. IT/business analysis
4. Security
5. Help desk/technical support

Source: Computerworld's quarterly Vital Signs survey

Using Google to View MySpace or Any Restricted Site

Most companies and schools employ proxy servers to filter unwanted sites so employees won't waste precious company resources surfing sites that the companies deem unproductive. While the use of proxy servers to block unwanted sites may be understandable in commercial cases, there are also companies that are overdoing it, banning almost all websites and creating a lot of inconvenience to their employees.

If you are in such an environment, what can you do about it? One way is to use an anonymous proxy server (such as http://www.spysurfing.com/). But once the system administrator learns about this, he will likely block this site as well. A much more foolproof way is to use Google (yes, you read that right).

Google Translate is a translation service provided by Google to help you translate text or web pages to the language you desire. Some of the languages supported include English, Simplified Chinese, Spanish, French, German, Korean, Japanese, etc.

If you want to translate a page from one language to another, here is the URL format:

http://www.google.com/translate?langpair=en|es&u=www.websiteurl.com

where en|es is the language pair to translate from one language to the other (here it is English to Spanish), and www.websiteurl.com is the site you want to translate.

An interesting workaround to bypass your proxy server is to use Google Translate to translate the page you want to view from English to English, like this:

http://www.google.com/translate?langpair=en|en&u=www.websiteurl.com

Here, since the origin language and the destination language are the same, Google Translate does not perform any translation and hence simply acts as a forwarder and forwards the page you want to view directly to you. As an example, if your workplace/school has blocked MySpace.com, you can use the following URL to view it:

http://www.google.com/translate?langpair=en|en&u=www.myspace.com

Using Google Translate to bypass your proxy servers does not work all of the time. In some instances, it does not work at all. And in some cases, Google Translate will only display the text of the site you want to view (the images will not load), while in other cases you may need to translate the page to other languages before you can view its content.

UI Security Check #1

I was trying to collate a few checks for Web UI Security. Here are somethings for check ONE....
I invite people to put in their suggestions and comments for the same.

#1. Does the UI disclose information that might compromise the security of the system?

• Don’t provide information in error messages that might compromise the security of the system.
• Don’t reveal data store locations and URL’s when they are not necessary
• Mask sensitive information such as SQL Server name, User ID, Password
• Don’t return errors with cross-site scripts
• Don’t allow links to open executables
• Don’t provide error information with clickable links. Convert links to plain text to encourage these to be scrutinized prior to being launched
• Ensure that logs are correctly stripped of sensitive information

Relevance: Developer

Web Services Design Security Considerations

Web Services Design Security Considerations

I. Information Gathering

1. WSDL Retrieval: Identify web method call mechanics
2. SOAP Error Messages
3. Web Method Enumeration: Identify methods not published in the WSDL.

II. Parameter Manipulation

1. Identify mishandling of numerical fields, character strings, Base64 data handling, etc.
2. Identify SQL Injection/XPATH Injection Vulnerabilities
3. XML input data is validated based on an agreed schema.
4. If parameter manipulation is a concern (particularly where messages are routed through multiple intermediary nodes across multiple network links). Messages are digitally signed to ensure that they cannot be tampered with.
5. Determine whether the logging mechanism is vulnerable to arbitrary entry creation via carriage return and line feed injection.
6. Assess the possibility of inserting HTML tags into a HTML based log.
7. Assess the possibility of inserting XML elements and/or attributes into an XML based log.
8. Determine the logging mechanism’s susceptibility to white space injection.
9. Assess the ability of the web service to log messages that contain special separator characters.
10. Assess the handling of log data after reaching the upper log size limit.
11. Assess the web service’s susceptibility to LDAP injection.

III. Authentication and Authorization

1. Web services that support restricted operations or provide sensitive data require and support authentication.
2. Where appropriate, access to publicly accessible Web methods is restricted using declarative principle permission demands.

IV. Sensitive Data

1. Sensitive data in Web service SOAP messages is encrypted using XML encryption OR messages are only passed over encrypted communication channels (for example, using SSL.)
2. Identify the encryption cipher used in the application.
3. Determine the items within web service communications that are encrypted.
4. Determine the items within web service communications that are protected by message integrity checks.

V. Exception Handling

1. SOAP Exceptions are thrown and returned to the client using the standard SOAP element.
2. If application-level exception handling is required a custom SOAP extension is used.

VI. Auditing & Logging

1. The Web service logs transactions and key operations.

VII. Proxy Considerations

1. The URL Behavior property of the Web reference is set to dynamic for added flexibility.
2. The endpoint address in Web Services Description Language (WSDL) is checked for validity.

VIII. Configuration

1. Unnecessary Web service protocols, including HTTP GET and HTTP POST, are disabled.
2. The Web service runs using a least-privileged process account.
3. Debugging and Tracing are disabled.
4. Identify directory traversal vulnerabilities.
5. Assess the level of information disclosure from temporary files.

Alternative to IE and Firefox

An interesting alternative is SecureIE (www.secureie.com) which costs 30$ and seems
to outperform Firefox and IE in the security field (http://tinyurl.com/bjayn).

Design Considerations for Security

1. Do not trust on Client-User Input. Security decisions should not rely on client-side validations; they are made on the server side

2. Identify application to fail gracefully. An approach to exception management should be such that does not reveal any internal software information.

3. Partition the application into public accessible and restricted areas. Isolate higher privileged sections of the application.

4. Granular authorization check for pages and directories.

5. Web controls, user controls, and resource access code are all partitioned in their own assemblies for granular security

6. Mechanisms have been identified to secure credentials, authentication tickets, and other sensitive information over network and in persistent stores

Firefox popups

Firefox popups

Like you, I love Firefox for many reasons, including popup blocking. So over the last few weeks I’ve been surprised to see occasional popups.

It turns out that some clever people figured out that you could launch popups from Flash, getting around the Firefox default settings.

Fortunately, you can get around it:

1. Type about:config into the Firefox location bar.
2. Right-click on the page and select New and then Integer.
3. Name it privacy.popups.disable_from_plugins
4. Set the value to 2.

The possible values are:

* 0: Allow all popups from plugins.
* 1: Allow popups, but limit them to dom.popup_maximum.
* 2: Block popups from plugins.
* 3: Block popups from plugins, even on whitelisted sites.

Perspective of Performance and Security in IT

Performance and security are like brothers in IT. They are similar and yet they fight each other at times.

Both performance and security are important inherent qualities in IT systems. Who would not want a fast and secured IT system? You want your home computer to be fast and secured. The bank CEO wants his Internet banking system to be fast and secured for his customers.

This was a very nice article on ACE Team Blog. If you wish to read more...

Here it is: http://blogs.msdn.com/ace_team/archive/2006/07/03/655524.aspx

The Oracle Global Product Security Blog

Have you ever seen this?

The Oracle Global Product Security Blog

Oracle getting committed on security by providing rating to vulnerabilities at the security blog...:)

Security researchers have criticized Oracle in the past for the time the company has taken to fix vulnerabilities.

In July 2005, security experts at Red Database Security outed six flaws, claiming that the company had more than 650 days to fix the security issues.

Peter Finnigan, who first noted the change in policy has provided a great list of tools for auditing and testing oracle databases. If you get a chance, do visit his site at :
http://www.petefinnigan.com

Developing More-Secure Microsoft® ASP.NET 2.0 Applications Now Available

A new book in the Secure Software Development Series, this time from Dominick Baier is now available from Microsoft Press.

It covers ASP.NET 2.0 security features as well as security defenses and design and coding best practices. There’s also a chapter on the not-so-well-understood aspect of building and deploying least-privilege and partial trust ASP.NET 2.0 applications. This is a must-read chapter for Web site hosters.

You can get more info about the book here.

Spoofing threats are usually associated with a wily hacker being able to impersonate a valid system user or resource to get access to the system and thereby compromise system security.

Tampering with data involves the malicious modification of system or user data with or without detection.

Repudiation threats are associated with users—malicious or otherwise—who can deny performing an action without administrators having any way to prove otherwise. An example of a reputability threat is a user performing an illegal operation in a system that lacks the ability to trace such operations.

Information disclosure threats involve the compromising of private or business-critical information through the exposure of that information to individuals who are not supposed to see it.

Denial of service (DoS) threats when carried out deny service to valid users—for example, by making the system temporarily unavailable or unusable or by forcing a reboot or restart of the user’s machine.

Elevation of privilege: In this type of threat, an unprivileged user gains privileged access and thereby has sufficient access to compromise or destroy the entire system.

Attacks against IIS

IIS is one of the most widely used Web server platforms on the Internet.
Microsoft's Web Server has been the frequent target over the years.
It has been attacked by various vulnerabilities.

Examples include:

• ::$DATA vulnerability
• showcode.asp vulnerability
• Piggy backing vulnerability
• Privilege command execution
• Buffer Overflow exploits (IIShack.exe)

IIS Components

• IIS relies heavily on a collection of DLLs that work together with the main server process, inetinfo.exe, to provide various capabilities.
• Example: Server side scripting, Content Indexing, Web Based printing etc.
• This architecture provides attackers with different functionality to exploit via malicious input.

ISAPI DLL Buffer Overflows

• One of the most extreme security vulnerabilities associated with ISAPI DLLs is the buffer overflow.
• In 2001, IIS servers were ravaged by versions of the Code Red and Nimda worms which were both based on buffer overflow exploits.

Download everything from Microsoft without WGA Check

When you want to download a file from Microsoft a WGA (windows genuine advantage) check is performed. Microsoft installs a small piece of software on your computer that contacts the Microsoft server and checks for validity. If the test fails you will not be able to download the file(s). The following method gives you the ability to download every file from Microsoft without a WGA check.

All you need is the tool mgadiag.exe and the download url of the file that you want to download. Mgadiag.exe is the Microsoft Genuine Advantage Diagnostic Tool. Start this tool and check the value of the “Download Center Code”, this should be seven chars consisting of upper case letters and numbers. Remember that code and open the website of the file that you want to download.

A download page looks similar to this one for Internet Explorer 7. All you need to do is append the following value to the url and you will be able to download the file without a WGA check.

&Hash=”download center code”

Replace the “download center code” with the code that you looked up in the mgadiag.exe tool. This code changes frequently, make sure you have the correct code before starting the downloads.

To sum it up:

1. download mgadiag.exe
2. start mgadiag.exe and look at the download center code
3. visit a download page at microsoft.com
4. append &Hash=”download center code” to the url (example &Hash=6VJPCR9), no quotation marks needed
5. Hit enter

Microsoft is probably going to fix this soon, it is working nevertheless at the moment.

Free Web Proxy List

A web proxy is becoming more and more important in todays internet. Schools and Companys tend to block sites pretty quickly nowadays, especially when the blocking is directed at just a few websites and not every website in that category. Web Proxys might be able to sneak past this policies and display the site in your browser even though it is banned in the network.

How do web proxys work ?

A network bans a website either by its IP, its name or part of its name. A web proxy makes only shows its own address to the network and not the actual destination of the user. The admin of the network will think everything is fine and you are free to reach the site that is banned. The only thing that might happen is that the admin is banning the web proxy as well, but this is not a big deal either. Hundreds of web proxys exist, just switch to a new one and you are ready to visit the banned site again.

Setup your own Web Proxy:

Let us assume that all proxy websites have been banned in your network, you can´t find a single web proxy that is still working. Your best choice is to create your own web proxy at an address that only you know. All you need is the php web proxy poxy and some webspace with php to upload it to. Search google for free webspace php and you should find some hosts that allow you to use php and upload your web proxy to them.

You can alternativly use a cgi web proxy which needs a webspace with cgi enabled.
Web Proxy List:

Please not that the list does not display if the webproxy is able to handle scripts, I did not find a reliable way to make a test for all languages out there, therefor this has not been added to the list. I also removed websites that loaded slowly, displayed errors or forced you to click on an ad before you could use the service.

It is most likely that the name “proxy” might have been banned as well, try using web proxys that do not have proxy i their url, this might help.

oxys that do not have proxy i their url, this might help.

• 75i
• Anonymouse
• Anti Web Filter
• Back Fox
• BBScience
• Bored at School
• Browse at School
• Bypass browser
• Bypass it
• Cecid
• Cgi Proxy
• Clever Proxy
• Conceal Me
• Dark Proxy
• Dave Proxy
• Dejacey
• Desire Proxy
• Direct Proxy
• Dtunnel
• Dzzt
• Famous 5
• Fly Proxy
• Free Proxy
• Free Proxy Server
• Fsurf
• Ghost Click
• Gouc
• Hide and go surf
• Hide your Info
• Hujiko
• Iam new guy
• Idoxy
• IP Bounce
• IP Bouncer
• IP Zap
• Let me By
• Lin Fox
• Modern Proxy
• Mr. Proxy
• My Proxy
• Neo Proxy
• Net Sack
• New Proxy
• Ninja Proxy
• Peoples Proxy
• Perfect Shelter
• PHProxy
• Poxy
• Prime Proxy
• Pr0xy
• Proxy 121
• Proxy 77
• Proxy Anon
• Proxy Craze
• Proxy Drop
• Proxy Gasp
• Proxy Hero
• Proxy Lord
• Proxy Mod
• Proxy Mouse
• Proxy Prince
• Proxy Snow
• Proxy Spy
• Proxy Surf
• Proxytastic
• Proxyz
• Prxxy
• Psurf
• Pure Privacy
• Radio Farda
• Safe for Work
• Safe Hazard
• Safe Surfer
• School Bypasser
• SD9
• Secret Browse
• Smart Proxy
• Student Proxy
• Stupid Censorship
• Surf Anon
• Surf Nameless
• The proxy
• The web tunnel
• TNT Proxy
• To Hide
• Total Upload
• Traceless
• Unblock This
• Unbloxy
• Unipeak
• Url Encoded
• Virtual Browser
• VPN Tunnel
• W3 Proxy
• Website Proxy
• Wkccp
• World Wide Proxy
• Wootage
• Work Browse
• World Want
• XXX Proxy
• Your Free Proxy
• Your Proxy

Error document information and what it indicates.

ODBC Error Code = 37000 (Syntax error or access violation)

[Microsoft][ODBC SQL Server Driver][SQL Server]Line 4: Incorrect syntax near '='.

Data Source = "ECommerceTheArchSupport2" SQL = "SELECT QuickJump_Items.ItemId FROM QuickJump_Items WHERE QuickJump_Items.ItemId <> 0 AND QuickJumpId ="

The error occurred while processing an element with a general identifier of (CFQUERY), occupying document position (1:1) to (1:42) in the template file K:\InetPub\clients\login\http\ailment.cfm

The specific sequence of files included or processed is:
K:\INETPUB\CLIENTS\LOGIN\HTTP\AILMENT.CFM

This error message indicates that the target web application if running Microsoft SQL and discloses directory structures.

How do you use RSA for both authentication and secrecy?

RSA is based upon public key/private key concept.

For authentication one can encrypt the hash (MD5/SHA) of the data with a private key. This is known as digital signature.

And secrecy / confidentiality is achieved by encrypting the data with the public key of the target user.

Generally we dont use RSA for encryption because of key size (1024 bits).
Rather a symmetric session key (128/256 bit) is established between communicating parties and is used for encryption.

Performance Testing Tools [.NET]

*Network Analysis Tool – application EKG by Leadbyte (http://www.leadbyte.com/)

*ASP.NET Profiling Tool – Ants Profiler by red-gate software (http://www.red-gate.com/)

Built-in Tools – IIS Log, SQL Profiler, SQL QA, Event Viewer, Perfmon/Sysmon, and ASP.NET Trace

New !! OWASP Mumbai Chapter Activity Site

Hey I have got gr8 thing to share....

I have made a new Site for detailing OWASP Mumbai Chapter Activities.
Please have a look at the site to download the presentations of OWASP Chapter Meetings, Read Meeting Notes, View Meeting Snaps and much more....

Link: http://owasp.mumbai.googlepages.com/

Do send me your response...

~ Dharmesh

Registrations for OWASP Mumbai Meet [31st July 15:00hrs]

Hi All,

Everyone is welcome to join us at our next chapter meet to be held on Monday, 31^st of July.

Registrations for the event are free. If you are willing to attend, just send

a mail to dharmeshmm@owasp.org as a confirmation.

If you would like to speak at the event or sponsor, contact me ASAP.

Theme of Meeting: Securing Web Services

Details of the Meet:

Time: 03:00 PM - 05:00 PM

Sponsor and Venue Details:

Tech Mahindra Ltd.

Tech Mahindra Limited. Wing 1, Oberoi Estate Gardens, Chandivali, Andheri (E), Mumbai 400 072, Maharashtra, India.

Details of Event: http://www.owasp.org/index.php/Mumbai

Incase of any queries, please feel free to contact at +91 98670 75327.

Thanks & Regards,

Dharmesh M Mehta | Technology Cell | Unit 183, SDF-6 SEEPZ, Mumbai, India |
(O) +91-22-6695 2222 Ext: 1005 | (M) +91 98670 75327 | www.mastek.com

http://smartsecurity.blogspot.com

Dream as if you'll live forever. Live as if you'll die today. - James Dean

What is STRIDE

Threats faced by the application can be categorized based on the goals and purposes of the attacks. A working knowledge of these categories of threats can help you organize a security strategy so that you have planned responses to threats. STRIDE is the acronym used at Microsoft to categorize different threat types. STRIDE stands for:

● Spoofing. Spoofing is attempting to gain access to a system by using a false identity. This can be accomplished using stolen user credentials or a false IP address. After the attacker successfully gains access as a legitimate user or host, elevation of privileges or abuse using authorization can begin.

● Tampering. Tampering is the unauthorized modification of data, for example as it flows over a network between two computers.

● Repudiation. Repudiation is the ability of users (legitimate or otherwise) to deny that they performed specific actions or transactions. Without adequate auditing, repudiation attacks are difficult to prove.

● Information disclosure. Information disclosure is the unwanted exposure of private data. For example, a user views the contents of a table or file he or she is not authorized to open, or monitors data passed in plaintext over a network. Some examples of information disclosure vulnerabilities include the use of hidden form fields, comments embedded in Web pages that contain database connection strings and connection details, and weak exception handling that can lead to internal system level details being revealed to the client. Any of this information can be very useful to the attacker.

● Denial of service. Denial of service is the process of making a system or application unavailable. For example, a denial of service attack might be accomplished by bombarding a server with requests to consume all available system resources or by passing it malformed input data that can crash an application process.

● Elevation of privilege. Elevation of privilege occurs when a user with limited privileges assumes the identity of a privileged user to gain privileged access to an application. For example, an attacker with limited privileges might elevate his or her privilege level to compromise and take control of a highly privileged and trusted process or account.

STRIDE Threats and Countermeasures

Threat	Countermeasures
Spoofing user identity	Use strong authentication. Do not store secrets (for example, passwords) in plaintext. Do not pass credentials in plaintext over the wire. Protect authentication cookies with Secure Sockets Layer (SSL).
Tampering with data	Use data hashing and signing. Use digital signatures. Use strong authorization. Use tamper-resistant protocols across communication links. Secure communication links with protocols that provide message integrity.
Repudiation	Create secure audit trails. Use digital signatures.
Information disclosure	Use strong authorization. Use strong encryption. Secure communication links with protocols that provide message confidentiality. Do not store secrets (for example, passwords) in plaintext.
Denial of service	Use resource and bandwidth throttling techniques. Validate and filter input.
Elevation of privilege	Follow the principle of least privilege and use least privileged service accounts to run processes and access resources.

OWASP Mumbai - Next Meeting

Next Meeting - Tentative Monday July 31st 2006
[03:00 PM - 5:00 PM]

Invitations are OPEN for all to present at the Next OWASP Mumbai Meet.

The meeting is to be scheduled tentatively on Monday, 31st July 2006 from 3:00 to 5:00 PM.

Venue and Sponsor Details:

Tech Mahindra Ltd..

Tech Mahindra Limited. Wing 1, Oberoi Estate Gardens, Chandivali, Andheri (E), Mumbai 400 072, Maharashtra, India.

If you would like to speak, please drop in a mail at dharmeshmm@gmail.com

OWASP, the free and open application security community, has gone Wiki.

UI Security Checklist

Hi,

I was trying to build a security checklist for UI for Enterprise Applications . May be people can send their views regarding the same. I think of building this as as when I recieve the feedback.

Some areas that could be starting points are or the checklist should assist in:

· To Ensure that UI safeguards the critical information and is not disclosed to attackers

· Reduce level of complexity in managing security from UI

· To ensure UI enforces the best security practices

I hope to get feedback and the checklist in few days...

~ Dharmesh

Essential Terminology

• Threat – An action or event that might prejudice security. A threat is a potential violation of security.
• Vulnerability – Existence of a weakness, design, or implementation error that can lead to an unexpected, undesirable event compromising the security of the system.
• Target of Evaluation – An IT system, product, or component that is identified/subjected as requiring security evaluation.
• Attack – An assault on system security that derives from an intelligent threat. An attack is any action that violates security.
• Exploit – A defined way to breach the security of an IT system through vulnerability.

Email Evolution

• Business email will grow by 25–30%through 2009
• Over 60%of email is spam
• 80%of viruses enter through the email gateway
• 75%of a company’s Intellectual Property is now contained in email
• 79%of companies accept email as written confirmation of approvals, orders and other transactions
• Email is now the de facto document of record for corporate communications

Is your server blacklisted?? Know here...

This would be a good sign that your server is being used as a relay.

ORDB	http://www.ordb.org	Open Relays
SBL	http://www.spamhaus.org	Spam Sources
XBL	http://www.spamhaus.org	Compromised Hosts
Sorbs DUHL	http://www.sorbs.net	Dynamic IPs
DSBL	http://www.dsbl.org	Insecure Servers

E-Crime and Hacking

US hacker gets five years in the slammer

A US man has been sentenced to nearly five years in prison after he was found guilty of illegally controlling around 400,000 third party PCs for the purposes of launching malware attacks.

Jeanson James Ancheta, 21, from California, rented out space on this zombie network of compromised machines for the sending of spam and malware, and also for launching denial of service attacks.

Among the machines infected by Ancheta were computers at the US military test base at China Lake in the Mojave Desert. Ancheta was ordered to pay the US Navy $15,000 in damages as well as surrendering $60,000 in proceeds from his crimes.

Ancheta advertised his zombie network - or botnet - on his own website called botz4sale.

Read More >>

XSS Attacks

There are two ways for users to become infected by XSS attacks.

1) . Users may be either tricked into clicking on a specially crafted link (called a Non-Persistent
Attack) or,

2). User unknowingly visiting a web page embedded with malicious code (also called as a
Persistent Attack). It’s also important to note that a user’s web browser or computer does
not have to be susceptible to any well-known vulnerability.

This means that no amount of patching will help users, and we become solely dependent on a website’s security procedures for online safety.