Web Security

By Jeremiah Grossman, White Hat Security
Someone begins watching a basketball game and asks who is winning. You might helpfully answer, “Lakers up 76 to 64.” Imagine if instead you said, “The Lakers are 60% from the field, have 12 rebounds, are 8 of 10 from the line, and the average height of the starting lineup is 6’7.” Sure, these are important statistics, but they certainly do not answer the question. (Inspired by Richard Bejtlich) The person listening would probably think you were trying to be funny, a jerk, or perhaps both.
Yet, this is how the Web security industry responds when businesses ask about the security of their websites. “We identified 21 security defects including eight Cross-Site Scripting and four SQL Injection, we are improving our SDL processes, and most of our programmers have been through security training.” Again, important metrics, but still not answering the most important question — how well defended is a website from getting hacked.

Mozilla’s security response team is scrambling to ready a patch [zdnet.com] for what appears to be a serious security vulnerability affecting users of its flagship Firefox browser.

By Bradley Anstis, Marshal8e6
While search engine optimization (SEO) is becoming one of the must do’s for companies that are trying to improve theirsite ranking in search engines like Google and Yahoo, it’s also increasingly becoming a trick of the trade for spammers and malware authors looking to drive traffic to their own infected websites or websites they might have hacked with their malware.
Like any owner of a website, criminals are interested in directing as much traffic as possible to their pages in order to distribute content and increase potential profits. Of course, in their case, the content that they are pushing is malware that aims to use their unsuspecting victim’s computer to send spam, launch denial of service attacks or steal valuable information from other users, such as online banking passwords and credit card numbers. The financial goals are nothing new, but the technique shows the growing sophistication of the spammer and malware author community.  

Microsoft has hired yet another well-known security researcher to join its ever-growing team of exploit and defense experts. This time it’s Ken Johnson, known in the hacker world as Skywing. Johnson is known as an expert on debugging and reverse engineering, and has done a tremendous amount of work tearing apart Windows defenses specifically.

By Bill Brenner, CSO
Ask a room full of security practitioners for a list of security settings that’ll make Internet Explorer (IE) safe to use and you’ll either hear laughter or advice to get a new browser like Mozilla Firefox, Opera, Safari or Google Chrome.
Even as Microsoft has worked diligently to improve security in its troubled browser, especially in IE7 and the newly-released IE8, security pros simply don’t trust it. Most have turned to alternative browsers, especially Firefox. Those who have no choice but to use IE have turned to a number of coping mechanisms [cio.com]. Here are ten of the best security settings for Internet Explorer:

It’s been the better part of a decade now since Microsoft got religion about the security of its products, following the release of Bill Gates’s famous Trustworthy Computing memo. In that time, the reliability, security and resiliency of the company’s products has improved greatly, as has Microsoft’s standing in the security community.

The researchers at Microsoft are working on a new automated vulnerability analysis tool called Paladin, which will be included in the next version of the company’s Forefront enterprise security suite. The new technology was unveiled at CanSecWest last week and is designed to speed up the process of analyzing exploits and how the malicious code works.