security

The 19 Deadly Sins of Software Security

Michael Howard, David LeBlanc and John Viega have written a book called The 19 Deadly Sins of Software Security, which is to be published soon.

It explains the most important security issues one encounters in the software industry in a Design Patterns-like format. Each software security Sin is structured according to the following sections: Overview, The Sin Explained, Sample Code Defect, Spotting the Defect Pattern, Spotting the Defect during Code Review, Testing the Defect during Test, Example Defects, Redemption Steps, Extra Defensive Measures, Other Resources, Summary.

The 19 chapters, or Sins, each 10-15 pages long:

  1. Buffer Overflows
  2. Format String problems
  3. SQL injection
  4. Command injection
  5. Failure to handle errors
  6. Cross-site scripting
  7. Failing to protect network traffic
  8. Use of "magic" URLs and hidden forms
  9. Improper use of SSL
  10. Use of weak password-based systems
  11. Failing to store and protect data
  12. Information leakage
  13. Improper file access
  14. Integer range errors
  15. Trusting network address information
  16. Signal race conditions
  17. Unauthenticated key exchange
  18. Failing to use cryptographically strong random numbers
  19. Poor usability

(via Dana Epp)

MediaWiki 1.4.6 Fixes Security Issue

I just upgraded my Crazy Hacks wiki to MediaWiki 1.4.6.

The new release fixes a few bugs, but more importantly it fixes a security issue. All users are advised to upgrade.

Hacked by a Fool

Somebody got hacked by a complete fool without any sort of clue. What the attacker (i.e. script kiddie) tried to do (and how he failed) is actually quite funny IMHO.

E.g., after trying

rm -rf bash_history

(notice the missing dot in the filename) he wanted to be really sure and issued

unset HISTFILES

Surely, his tracks are perfectly covered now. Nobody will ever know.

(via EDV - Ende Der Vernunft)

Updated Drupal / Security Issues

As most of you probably noticed, the design and structure of my homepage and my blog changed quite a bit a few days ago.
That was me upgrading to Drupal 4.6.1, which makes my life a lot easier, has a bunch of new features (e.g. my blog now has del.icio.us-like tags) and bugfixes, and most importantly fixes a serious security issue.

Two days ago I tried to help a bit with the new Drupal 4.6.2 release, which mainly fixes two major security problems. The first one is an issue with incorrect input validation, resulting in the DRUPAL-SA-2005-002 security advisory. The second one fixes a problem in the XML-RPC library shipped with Drupal (and Wordpress, and PostNuke, and...), resulting in DRUPAL-SA-2005-003.
It was quite a fun experience for me, the release was coordinated and discussed on IRC, we had lots of peer-review of the advisories and release-announcement, testing the patches etc. Thanks to all who participated and made this such a great experience.

Updated Firewall / Iptables Scripts

I have updated my iptables scripts today, mostly minor improvements and documentation updates in fw_laptop. I also added a new script called fw_blockall, which literally blocks everything (incoming, outgoing, and forwarded packets, packet from/to localhost, pings). This might be useful sometimes.

Any comments and suggestions for improvements are highly welcome!

Syndicate content