Archive for 'Web security' Category
Sanitizing PHP file uploads
Security folks are often called in at the last stage of a project, after the architecture and development work is finalized, with a mandate to “secure the system” just before it goes live.
Usually the web code and network architecture can’t be changed because “that phase of the project has completed”, or the app is from [...]
OWASP meetings are depressing
Our local OWASP chapter met last night for a talk on “rich internet applications” (meaning Ajax, Flash, MS Silverlight, Adobe AIR etc.).
It was grim. The talk (given by this guy) mainly focused on how business logic, passwords and encryption keys are being embedded into client-side Flash applications, under the mistaken assumption that compiled Flash is [...]
Core GRASP – SQL injection prevention for PHP
SQL injection vulnerabilities are still common in web applications. The damage done when attackers are able to send raw SQL commands through to your database are severe enough that most developers have some idea about avoiding it: using bound parameters and stored procedures rather than the usual method (building an SQL statement by concatenating constants [...]
Read the rest of this entry...Port scanning with Adobe Flash
The same origin policy for web browsers is completely blown. Last year SPI Dynamics demonstrated how to trick a browser into doing a port scan of the local network using plain old Javascript. Now researchers at the Chaos Communication Camp demonstrated that Adobe Flash can do the same thing. [...]
Read the rest of this entry...(Unencrypted) site security confirmed!
SSL vendors still equate encryption with “security”. Forget about hardening your e-commerce server. Don’t bother encrypting data at rest. According to the ads from SSL vendors, all you need is their 128-bit SSL certificate (preferably the new EV SSL variety) … and to pay the annual fee.
VPN and other crypto product vendors do the same. [...]