Archive for category: Web Security

You are here: / Web Security

“Osama Bin Laden Dead” Computer Security Tips: Black-Hat Search Engine Optimization (BH-SEO)

On Sunday evening, May 1, 2011, President Obama stated, “a small team of Americans raided the compound.  After a firefight, they killed Bin Laden.”  The information spread across the Internet at an exponential rate.  Twitter reported more than 4,000 tweets per second at the beginning and end of Obama’s speech, and with no surprise, Google’s top-trending search term is, “Osama Bin Laden Dead”.

As cities, military installations and US Embassies are increasing security measures at the wake of the announcement, so should organizations and individual computer users.

After every major news event in recent years, such as the “Haiti Earthquake”,  “Japanese tsunami”, “William and Kate Wedding” and now, “Osama Bin Laden dead” an increase of fraudulent web sites, links and files offering to provide information and unseen video, pictures come to a rise via emails and social networking sites.

This technique is called Black-Hat Search Engine Optimization (BH-SEO). Black Hat search engine optimization is customarily defined as techniques that are used to get higher search rankings in an unethical manner (Boswell, 2011).  For example, a cyber-crook can increase their search-ranking by feeding them fake pages to make their malicious content seem legitimate, thus tricking users to visiting their malicious site that may be hosting malicious content to infect computers with malware.  The newer the event or content, the more susceptible it is to the BH-SEO techniques, while older content are less susceptible.

What can you do to keep safe?

  • As always, make sure you have an anti-virus/malware application installed and updated on your computer.
  • Try to reside on reputable sources to view content.
  • Do not blindly trust search results; examine the title and content before actually accessing the website.
  • If you get redirected to an unexpected site or obtain a “click here for a free security scan” page, or to take a survey page, or even to a “download this codec program to view the video” DO NOT do it and exit the site.

 

References

Boswell, W. (2011). Black Hat Search Engine Optimization: What is Black Hat SEO? Retrieved from: http://websearch.about.com/od/seononos/a/spamseo.htm

 

Introducing SAINT for MAC OS X

Vulnerability Scanning –

Assess any target with an IPv4, IPv6, or URL with pre-defined policies for PCI, HIPAA, FISMA, and more. Identify CVE, OSVDB, IAVA, OVAL, and more.

Penetration Testing –

Exploit vulnerabilities to gain remote access. Run social engineering, phishing assessments, and more with the exploit tools suite.

Checklist Compliance –

Show compliance with FDCC & USGCB security configuration policies defined by NIST SP 800-70.

For more information visit www.saintcorporation.com/mac or phone 1-800-596-2006

SAINT is SCAP validated by NIST and is a PCI approved scanning vendor (ASV)

Browser History Hijacking Flaw

Browser history hijacking is a flaw in a web browser that allows certain websites access to all the sites a user has ever visited.  This is a techniques used by sporting, news, movie, financial and porn websites to better place ads and check to see if you have visited any of their competitors.

The information is captured by a script that is executed on the visiting site against your web browser to see if stored links have changed colors.  If the link is a different color, then that indicates a visited sited.

A survey conducted by researchers from University of California at San Diego concluded out of 50,000 most visited websites; nearly 500 of them were capturing browser history from users with porn sites being among the highest offenders.

Modern browsers such as Apple’s Safari, Google’s Chrome and Firefox version 3.6 and above are not vulnerable to the browser history-hijacking flaw.  Internet Explorer unfortunately is vulnerable to browser history hijacking but is able to remediate the issue by turning on “Private Browsing” on the version 8 web browsers only.  You can activate “Private Browsing” in IE8 by either selecting that option from the Safety button at the upper right, or from the Tools menu in the Menu Bar if you have chosen to make that bar visible.

At the very least, this flaw, pose a risk to personal privacy.  Companies or hackers can collect your browsing history without your consent and target you for whatever purpose they what.

If you would like to see if your web browsers are vulnerable to the browser history hijacking flaw, a website has been created to check.  You can click here or paste the URL in yourself: http://whattheinternetknowsaboutyou.com/

In addition, to checking if your web browsers are vulnerable to the history hijacking issue; there is a lot of other useful information on the site to further preserve your web browsing privacy.  Among some are the following:

1. Disable your browser’s history – If you configure your browser to not keep any browsing history, no one will be able to detect which sites you visited.

2. Disable CSS styling of visited links – Remove special rules for displaying visited links, the cost is not immediately knowing which pages you’ve already been to.

3. Use special browser extension to fix the problem – If you are a Firefox 1.5/2 user, you can install the SafeHistory extension to protect yourself against the flaw.

[media id=10]

Web Application Security: An Overview

An area of information security that has been gaining a lot more focus in recent years is the security of web applications.   This area is of particular interest because of the growing complexity of websites which makes them a strong target for those with malicious intent.  Websites are attractive to attackers because they manage bank accounts, handle credit cards, store intellectual property, and other data of high value.

Web developers typically do not have any formal training in the area of security and their priorities usually lie elsewhere.  Business functionality and meeting tight deadlines are typically the focus areas of developers and security is often forgotten, or at most, an afterthought.  This leaves the door wide open for attackers to discover vulnerabilities and exploit them to gain access to sensitive data.

One of the most recent certifications now being offered by the SANS institute focuses on this area.  I had the privilege of taking this particular class and obtaining the certification.  The class taught me how to perform a “penetration test” on a web application and exploit the vulnerabilities that are found.

There are plenty of products on the market today that are used by organizations to run automated scans on their web applications to find vulnerabilities.  However, often times the most effective way to find vulnerabilities in a web application is to combine this automated testing with manual testing.  Automated testing alone often yields many false positives that require manual investigation to discover.

Overall, I believe the best way to implement web application security within your organization is to incorporate security into the software development life cycle.  It is much more difficult and requires much more time and money to fix security problems in your application after it has already been deployed to production.  Security vulnerabilities like Cross-Site Scripting and SQL Injection are all two common in web apps and these vulnerabilities pose a bigger business risk than many organizations realize.