Application auditing and ethical hacking
Published by Evil Bee Friday, 22 June 2007 15:03
How likely is it that someone would try to hack into your company data? It's been estimated that 95% of companies experience breach attempts. We believe that estimate is low.
We understand the need for code reviews and security testing because many of our applications manipulate data that must be kept secure. To our select clients, we offer code auditing and penetration testing to help implement comprehensive security programs to protect private data.
What to do when you've been hacked?
Published by Evil Bee Tuesday, 22 May 2007 15:13
We've been hacked more than once. We've been called hundreds of times by others who have experienced the same. If you have prepared well, being hacked can be a 20 minute chore to fix. If you've not well prepared, then it can be costly, painfully embarrassing and potentially career-ending.
There are three levels of response, below is a summary of the steps within each. What's critical in any secruity breach is following a standard process and documenting every step along the way. When you're all done with a hacking fire drill, it's common that someone will want to know why it happended, what damage was done and how it will not happen again.
An Overview of Phishing
Published by Evil Bee Tuesday, 09 January 2007 00:00
Phishing continues to be one of the most significant security threats facing Internet users. During 2007, scammers distributed millions of phishing scam emails that targeted many different entities. Phishing attacks are sure to continue in 2008 and scammers will use such attacks to steal money and identities from many new victims around the world. Armed with a little knowledge about how phishing scams work, however, you can ensure that you do not become one of these victims.
Rainbow tables for password cracking
Published by Evil Bee Thursday, 09 November 2006 00:00
An announcement about a new site offering free 'rainbow tables' on the bugtraq mailing list sparked our interest; what are these tables and what can they be used for? It turns out that rainbow tables are the result of pre-computing various one-way hash functions to facilitate decrypting them. In effect, the right set of tables makes a one-way hash function reversible for certain inputs and the inputs of interest are passwords.
Google knows your joomla passwords!
Published by Evil Bee Monday, 09 October 2006 10:30
Well maybe, Now I have got your attention, read the following information published by the Joomla Core team.
Joomla! Developer Network
It has come to our attention that Google has released a new product, Google Code Search, that is capable of indexing and crawling through archive files stored in the public directories of web servers. We are reporting this as a security advisory because we have discovered that some site administrators are storing archives / backups of their website in the web root. Because of this, Google Code Search is able to crawl the archives and read unparsed PHP files as if they were plain text. This has resulted in the disclosure of some sensitive information including MySQL passwords and SMTP credentials.
Remote file inclusion vulnerabilities
Published by Evil Bee Thursday, 27 July 2006 13:46
A recent rash of reports to the bugtraq mailing list provides a nice confirmation of an article on this page two weeks ago. Google recently released a code search tool that is being used to find security holes in open source projects and the first target appears to be remote file inclusion (RFI) vulnerabilities in PHP programs. There has been a steady stream of vulnerability reports on security mailing lists as well as an increase in attempts to exploit them.
Home computers targeted by hackers 50 times a day
Published by Evil Bee Saturday, 22 July 2006 15:32
Home PCs could be under attack from hackers over 50 times a night, suggests a BBC News Website experiment.
The BBC News Website team set up a honeypot' PC – a computer that looks like a normal PC online but records everything that's done to it – in order to find out the dangers facing web users.
Every single time the 'honeypot' was put online it was attacked. In one of the busiest nights of malicious online activity, the computer was attacked 53 times:
Read more: Home computers targeted by hackers 50 times a day
Security Myths and Passwords
Published by Evil Bee Wednesday, 19 April 2006 00:00
In the practice of security we have accumulated a number of “rules of thumb” that many people accept without careful consideration. Some of these get included in policies, and thus may get propagated to environments they were not meant to address. It is also the case that as technology changes, the underlying (and unstated) assumptions underlying these bits of conventional wisdom also change. The result is a stale policy that may no longer be effective...or possibly even dangerous.
Policies requiring regular password changes (e.g., monthly) are an example of exactly this form of infosec folk wisdom.
From a high-level perspective, let me observe that one problem with any widespread change policy is that it fails to take into account the various threats and other defenses that may be in place. Policies should always be based on a sound understanding of risks, vulnerabilities, and defenses. “Best practice” is intended as a default policy for those who don’t have the necessary data or training to do a reasonable risk assessment.
SQL injection attacks
Published by Evil Bee Friday, 24 March 2006 13:42
One of the more devastating attacks on a web application is also one of the most common: SQL injection. This technique allows an attacker to gain access to the database that underlies many web sites and read and potentially modify data that is not meant to be available to users of that site. This article provides an overview of how SQL injection works and what can be done to avoid it.
Page 2 of 2