Essential Terminology

• Threat – An action or event that might prejudice security. A threat is a potential violation of security.
• Vulnerability – Existence of a weakness, design, or implementation error that can lead to an unexpected, undesirable event compromising the security of the system.
• Target of Evaluation – An IT system, product, or component that is identified/subjected as requiring security evaluation.
• Attack – An assault on system security that derives from an intelligent threat. An attack is any action that violates security.
• Exploit – A defined way to breach the security of an IT system through vulnerability.

Email Evolution

• Business email will grow by 25–30%through 2009
• Over 60%of email is spam
• 80%of viruses enter through the email gateway
• 75%of a company’s Intellectual Property is now contained in email
• 79%of companies accept email as written confirmation of approvals, orders and other transactions
• Email is now the de facto document of record for corporate communications

Is your server blacklisted?? Know here...

This would be a good sign that your server is being used as a relay.

ORDB	http://www.ordb.org	Open Relays
SBL	http://www.spamhaus.org	Spam Sources
XBL	http://www.spamhaus.org	Compromised Hosts
Sorbs DUHL	http://www.sorbs.net	Dynamic IPs
DSBL	http://www.dsbl.org	Insecure Servers

E-Crime and Hacking

US hacker gets five years in the slammer

A US man has been sentenced to nearly five years in prison after he was found guilty of illegally controlling around 400,000 third party PCs for the purposes of launching malware attacks.

Jeanson James Ancheta, 21, from California, rented out space on this zombie network of compromised machines for the sending of spam and malware, and also for launching denial of service attacks.

Among the machines infected by Ancheta were computers at the US military test base at China Lake in the Mojave Desert. Ancheta was ordered to pay the US Navy $15,000 in damages as well as surrendering $60,000 in proceeds from his crimes.

Ancheta advertised his zombie network - or botnet - on his own website called botz4sale.

Read More >>

XSS Attacks

There are two ways for users to become infected by XSS attacks.

1) . Users may be either tricked into clicking on a specially crafted link (called a Non-Persistent
Attack) or,

2). User unknowingly visiting a web page embedded with malicious code (also called as a
Persistent Attack). It’s also important to note that a user’s web browser or computer does
not have to be susceptible to any well-known vulnerability.

This means that no amount of patching will help users, and we become solely dependent on a website’s security procedures for online safety.

General tips to prevent phishing

1. Bank sends an email for verifying some information either new account holder, or withdrawal or something like that. Please contact the bank by phone (use the phone number you know) and verify the legitimacy of the mail.
2. The golden rule is 'don't click the link' to login the bank website. Type the bank website link on your browser by hand and go to the website.
3. Most big companies will address people with your names; if you get general mails like 'dear valued user' it could be phishing mails.

The weakest link in the security chain? You

Human error was responsible for nearly 60 per cent of information security breaches last year, a new study has found.

According to the fourth annual CompTIA (Computing Technology Industry Association) study on information security and the workforce, released on Tuesday, this figure is significantly higher than the number in 2004, when 47 per cent of security breaches were blamed on human error alone.

Despite the prominent role that human behaviour plays in information security breaches, just 29 per cent of the 574 organisations worldwide that participated in the survey said security training is a must for employees. Only 36 per cent of organisations offer security awareness training, the study found.

"The primary cause of security breaches - human error - is not being adequately addressed," Brian McCarthy, chief operating officer of CompTIA, said in a statement. "The person behind the PC continues to be the primary area where weaknesses are exposed."

Buffer Overflow

See this

http://www.insecure.org/stf/smashstack.txt

...Njoy !

Introduction to Web Services Security

Although the basic standards for web services are of great use for a lot of different scenarios, they do lack some features that are required in most real world applications, e.g. standard ways for handling security and authentication. These features are currently under development in various standardization initiatives, and some have just surfaced as standards. One of them is WS-Security, which is an OASIS standard.

Formerly Web Services authentication was something that you would have to implement yourself in your application.

Furthermore you would need to apply transport based security to guarantee confidentiality of the data communication, if your web service exchanged data over the wire that is confidential.

Earlier SOAP implementations mainly used HTTP as the transport protocol, so the assumption was made, that the security could also be based on HTTP and thus Web Services could be secured by using SSL/TSL and Basic Authentication.

Consequently SOAP does not contain any security elements itself, but instead leaves this to be handled by a combination of transport security and custom authentication implementations.

Nowadays SOAP implementations use other protocols than HTTP in an increasing level, so the need to apply security to the messages exchanged has become very important.

Also, SOAs are designed to be a number of interconnected nodes / applications that sometimes communicate through other systems, which makes point-to-point security mechanisms as SSL/TLS inadequate

The STRIDE Model

Many Security Evangelists use STRIDE Model for Threat Modeling an Application

Spoofing user identity - Spoofing threats are usually associated with a wily hacker being able to impersonate a valid system user or resource to get access to the system and thereby compromise system security.

Tampering with data - Tampering with data involves the malicious modification of system or user data with or without detection.

Repudiation - Repudiation threats are associated with users—malicious or otherwise—who can deny performing an action without administrators having any way to prove otherwise. An example of a reputability threat is a user performing an illegal operation in a system that lacks the ability to trace such operations.

Information Disclosure - Information disclosure threats involve the compromising of private or business-critical information through the exposure of that information to individuals who are not supposed to see it.

Denial of service - Denial of service (DoS) threats when carried out deny service to valid users—for example, by making the system temporarily unavailable or unusable or by forcing a reboot or restart of the user’s machine.

Elevation of privilege - In this type of threat, an unprivileged user gains privileged access and thereby has sufficient access to compromise or destroy the entire system.

What is a Comprehensive Assessment?

A comprehensive assessment is a systemic assessment performed on the application code.

Security Comprehensive Assessment – This is a line-by-line assessment of the application code to ensure there are no security vulnerabilities such as clear text passwords and SQL injection problems. NOTE: if we do not have access to the source code for a 3rd-party application black-box testing will be conducted.

Privacy Comprehensive Assessment – This is an assessment of the application code to ensure there are no privacy violations such as using the incorrect privacy statement or Legal Notice and not using data input validation rules (e.g., zip codes should only have numeric values).

Cleared the CEH

Hi ,

I have cleared the CEH (Certified Ethical Hacker) examination.

The CEH certification covers nearly every aspect of penetration testing and I would recommend to start with CEH.

My certification is an asset to my company and the value of the knowledge I carry.
It indeed has made a valuable difference to me and my company.

Regards,
Dharmesh.

Google: Yes, You Can Find Just About Anything

Hackers and security experts use various custom and open source tools tocomplete their tasks.

In fact, one of the tools they use you probably useevery time you browse the web, the Google Search Engine.I remember the first time I used the Google Search Engine years ago. I was amazed at how quickly it fulfilled my search request.

Google's huge indexof systems / information and it's ability to perform complex searches haveevolved over the years. When we performed security assessments andpenetration test, we regularly use Google to locate information thatorganizations typically want to keep private and confidential.

Full: http://castlecops.com/article-6466-nested-0-0.html

Data protection watchdog investigation finds no evidence

UK banks escape punishment over India data breach

UK banks will not face any action over a data breach in an Indian call centre last year, where an undercover newspaper reporter was allegedly sold bank and credit card details of 1,000 customers.

Automatically Hardening Web Applications using Precise Tainting.

Most web applications contain security vulnerabilities. The simple and natural ways of creating a web application are prone to SQL injection attacks and cross-site scripting attacks as well as other less common vulnerabilities. In response, many tools have been developed for detecting or mitigating common web application vulnerabilities. Existing techniques either require effort from the site developer or are prone to false positives. This paper presents a fully automated approach to securely hardening web applications. It is based on precisely tracking taintedness of data and checking specifically for dangerous content only in parts of commands and output that came from untrustworthy sources. Unlike previous work in which everything that is derived from tainted input is tainted, our approach precisely tracks taintedness within data values.

Resolutions for 2006

‘Tis the time to change old habits and go for a smart new way to make your security grow.
The Expectations and Predictions from Web Application Security for year 2006 mainly focus on :
Worms and Browser Vulnerabilities
Phishing and Cross Site Scripting
Web Application Backdooring
RSS Feeds

Click on the link to view the complete details..

Enjoy the new year...

Regards,
Dharmesh Mehta

Google to buy Opera?

Google may soon announce its acquisition of browser firm Opera, if rumour is to be believed.

Pierre Chappaz, founder of Kelkoo and ex-Yahoo! Europe president, has revealed in his personal blog, Kelblog, that a "usually well informed source" has told him the buy is on the cards.

Such a move could come in response to Microsoft's latest iteration of its Internet Explorer, IE 7. Should Microsoft, for example, make a better fist of integrating its own search technology into its browser, Google could see itself losing market share.

Database Threats

• Password Compromised – same as brute force, or username/password hard-coded in code

• SQL Injection - attacker uses poorly designed input validation routines to create or alter SQL commands to gain access to unintended data or execute commands.Access with Elevated Privileges – incorrect configuration leads to access with higher-than-expected privileges

Authentication Threats

• Brute Force – attacker iterates through multiple combinations in the hope of finding a valid username/password combination
• Man in the Middle – attacker sniffs packets from the network, modifies them, and inserts them back into the network
• Session Hijacking - attacker uses authentication tokens to seize control of a legitimate user’s session while that user is logged into the application
• Session Replay - attacker captures authentication tokens (e.g. session ID, cookies) to bypass normal authentication without the legitimate user having to be logged into the application.

Microsoft
OWASP
OISSG

Will the concept of 'office' fade out?

Technology which might expedite the arrival of the next generation workplace is Personal Internet Communicator (PIC), which is an affordable consumer device designed to provide managed internet access for people in global, high-growth markets to enhance communications, entertainment and education opportunities.

The emergence of collaborative technology and tools will further reduce the need to go to office and be at your desk per se. You might be able to sit on India gate lawns and write that important mail, or might be able to present an important presentation over video conferencing while your kids enjoy their favorite ride at Appu Ghar. If this sounds like a sci-fi then wake up to reality. All this and more is likely to happen in the coming three-to-four years. In fact, IT-majors Microsoft and IBM are working hard to make this vision a reality

Details