Do you ever find yourself driving down the road in an unfamiliar place and you get that gut feeling that youâre headed in the wrong direction? Well, I feel thatâs exactly where we are with application security â heading in the wrong direction. First off,…
The top Web vulnerability we face
I recently took some time off which gave me the opportunity to clear my head and think about some of the big issues weâre facing with Internet security. I thought if I had to pick one thing, what would be the greatest Web vulnerability out…
Top 10 Reasons Not to Invest in Website Security
For some light humor! 1) You really enjoy waking up in the morning with your coffee, hitting your homepage, and finding a new page marketing âspecial offersâ for âenhancementâ products⌠You spill your coffee, burnâŚouch. 2) You just love getting a hosting bill showing your…
Authenticated XSS – problem or not?
Obviously, cross-site scripting (XSS) is a big problem on the public Web. But thereâs another angle to XSS that no one seems to be talking about â at least I’m not seeing anything on it. Itâs the issue of XSS on Web pages that are…
e107 CMS system website compromised
As part of my job here at Invicti, from time to time I analyze source code looking for security problems. Using this information I adjust Invicti WVS to detect these problems automatically (when it’s possible). Monday, I downloaded e107 from e107.org and started analyzing the…
Security is hard
The year debuted with ‘Operation Aurora‘: Google and over 30 other companies were hit by a spear phishing attack which resulted in theft of intellectual property from Google and probably other companies. Spear phishing is a targeted form of phishing in which an e-mail message might look…
2009 Security News Update – PCI Council, Aweber, Adobe – Hacks and Cracks
Back for the last entry of 2009, here are the latest updates in the security world: Aweber announces its own incursion into its site, unnumbered amount of email addresses pilfered. AWeber was recently the victim of an intentional attack to mine email addresses. Weâd like…
A Malicious Website Hacker Attacks – CitiGroup Denies Knowledge
While I try and not to be so graphic with my comments, I canât help but feel CSI-esque lately with all of these website hacker attacks. So here we go again. This time, its CITI. Just reported today by marketwatch.com, Citigroups stock sank significantly based…
Rockyou gets rocked by hackers and old exploit
Well, it has happened. This time, the users themselves have taken action against rockyou.com for their inadvertent disclosure of customer information. Â Hacker activity has meant Rockyou disclosed what looks like over 32,000,000 accounts. Yes, 32 Million! What is interesting about this case, for me anyways,…