Online SQL Vulnerabilities {Comments Off on Online SQL Vulnerabilities}

by Andrew M
The article I am writing about tonight is entitled “A Survey on Web Application Vulnerabilities(SQLIA,XSS)Exploitation and Security Engine for SQL Injection” by Rashul Johari and Pankaj Sharma. This article talks about how hackers are finding vulnerabilities in online website which allow users to run SQL queries. In essence these hackers are running queries that the database is not prepared for. When this query returns results it gives back information that the hackers can use to exploit the company. The author describes three different attacks that hackers can use. There are stored/persistent attacks, reflected/non-persistent attacks and finally cross-scripting attacks. Stored attacks lure users to clicking on infected links of a website. This attack allows hackers to gain access to valuable information from the SQL server they are attacking. Cross-site attacks also deals with the redirection of web links and directs users to infected sites. read more...

ASP.NET DoS Vulnerability {2}

by Quoc L
A recently discover vulnerability within the ASP coding that let hacker overload the CPU core with HTTP request.  By sending in specially coded  ~100kb HTTP request, it will consume 100% of the core processing power. Sending those in multiples time can easy cog up server resources. This exploit was first identified at the Chaos Communication Congress, called CVE-2011-3414. Later on a user on GitHub(open source community) called HybirsDisaster release actual poof of this exploit. read more...

ASP.NET DoS Vulnerability {2}

by Alexander H
There has been controversy over recently a discovered vulnerability in Microsoft’s ASP.NET Web development platform. A new exploit code has emerged and been published online, increasing the risk of potential attacks on users. The patched denial-of-service (DoS) vulnerability was first announced last December at the Chaos Communication Congress, Europe’s largest and oldest hacker conference. “This vulnerability could allow an anonymous attacker to efficiently consume all CPU resources on a web server or even on a cluster of web servers” (Constantin). In ASP.NET, a single specially crafted 100kb HTTP request can consume anywhere upwards of 100% for one CPU core ranging from 1-2 minutes. An attacker can also repeatedly issue such requests on the server, causing CPU performance to diminish substantially, causing a denial of service condition for even multi-core servers. Recently, an anonymous hacker who goes by the name of HybrisDisaster, published a proof-of-concept exploitation for the ASP.NET vulnerability online. He encourages users to download it, use it how they see fit and spread it. With the high likelihood of someone releasing attack code for this DoS vulnerability played a significant role in Microsoft’s decision to release an out-of-band patch. It is highly recommended that Webmasters that use ASP.NET Web applications immediately deploy the Microsoft patches, which also address other ASP.NET vulnerabilities. read more...

Is Your Mac Safe? {4}

by Alexander H
Over the years, the Mac OS has been praised for its strong security and accessibility by users. Many consumers believe that the OS is impenetrable by viruses and the like. Contrary to popular belief, vulnerabilities to the Mac OS are possible and evident in the article by Lucian Constantin in this month’s issue of PC Magazine. According to researchers from antivirus firm F-Secure, a Java vulnerability has been found and being exploited by cybercriminals to infect Mac computers with a new variant of Flashback malware. Since first appearing in September 2011 as a fake Flash Player installer, the Trojan horse has since evolved and bypassed the Mac OS security through Java exploits. Oracle has recently released a patch to fix the targeted vulnerability in the Windows version of Java. However, the update released by Oracle for the Windows OS may take months to be available for Mac OS users. This is primarily because Apple distributes a self-compiled version of Java for Macs. Apple has since stopped including Java by default in Mac OS X starting with version 10.7 (Lion). It is highly recommended that all users disable their Java client to prevent an outbreak. read more...

More Database Protection {Comments Off on More Database Protection}

by Alexander V

Most people have probably heard of McAfee and their security solutions for personal computers. Now, they recently announced a database security solution that would protect databases with no loss in performance.  According to the article, McAfee’s database solution will be based on their Security Connected Initiative which means that data will be protected in all states and all centrally managed. A survey by Evaluserve showed that databases were the most difficult part of IT to protect. This can be seen from the recent outbreaks in data breaches. In addition to that, the article states that a large amount of data breaches involved a database, and the majority of those breaches required technical skills to execute. McAfee’s approach to database security includes: “automated discovery and assessment”,” protection”, and “manage and monitor.” “Automated discovery and assessment” uses McAfee Vulnerability Manager which scans the network for databases and checks if they are up to date and whether they have any vulnerabilities.  Their “protection” involves three layers of protection: a network firewall, application whitelisting and  host intrusion prevention, and protection of the data. Last of all is “manage and monitor,” customer’s use McAfee’s Database Activity Monitoring software so they can monitor their databases and be alerted of real-time data breaches. read more...