Blog Elements

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

Hackin9 November Issue – Spyware – Someone is always watching…

2010-11-17/0 Comments/in Security Magazine/by SecurityOrb_Staff

In order to download the magazine you need to sign up to our newsletter. After clicking the “Download” button, you will be asked to provide your email address. You need to verify your email address using the link from the activation email you will receive. If you already subscribed to our list, you will be asked to provide your email address each time you download the magazine. No activation email will be sent and you should see the link for download.

Web Application Security: An Overview

2010-11-17/0 Comments/in Web Security/by SecurityOrb_Staff

Web developers typically do not have any formal training in the area of security and their priorities usually lie elsewhere. Business functionality and meeting tight deadlines are typically the focus areas of developers and security is often forgotten, or at most, an afterthought. This leaves the door wide open for attackers to discover vulnerabilities and exploit them to gain access to sensitive data.

Hackin9 November Issue – Spyware – Someone is always watching…

2010-11-17/0 Comments/in Security Magazine/by SecurityOrb_Staff

Web Application Security: An Overview

2010-11-17/0 Comments/in Web Security/by SecurityOrb_Staff

Full Sized Blog Element (Big Preview Pic)

Hackin9 November Issue – Spyware – Someone is always watching…

2010-11-17/0 Comments/in Security Magazine/by SecurityOrb_Staff

Hackin9 November Issue – Spyware – Someone is always watching…

Free Issue to Download!

In order to download the magazine you need to sign up to our newsletter. After clicking the “Download” button, you will be asked to provide your email address. You need to verify your email address using the link from the activation email you will receive. If you already subscribed to our list, you will be asked to provide your email address each time you download the magazine. No activation email will be sent and you should see the link for download.

IMPORTANT NOTICE
1. After the activation of your subscription you need to click the“download” button once again to start downloading the PDF.
2. In case you do not get the activation email please check your spam folder. If it is not there, please use different email address.

· Deploying & Utilizing Intrusion Detection Using Snorby

Snorby is an advanced Snort IDS front-end. Snorby has two basic fundamental pieces, which are simplicity and power. The project goal is to create a free, open source and highly competitive application for network monitoring in enterprise environments or private use.

– Joshua Morin

· Malware Incident Response – Outbreak Scenario

This article applies to Microsoft OS on Intel Platform. With the ongoing threat of the Conficker Virus, which is still hanging like the sword of Damocles, it becomes very important to know and understand, what exactly needs to be done during a possible Virus Outbreak.

– Rajdeep Chakraborty

· TDSS botnet – full disclosure

What is a botnet? A botnet is not merely an army of infected computers. First of all, a botnet is an externally managed complex structure. While the malware side is studied pretty well in most known botnets, the management side is often underestimated. The latter usually involves hacking and vulnerability exploitation, because server side scripts of a centralized botnet are hidden from public.

– Andrey Rassokhin and Dmitry Oleksyuk

· When XOR is your friend…

Using a random enough input stream may sound like outright blasphemy to many if not all reading this; however in this article I will demonstrate when using it makes sense. One of my hobbies include creating crypto challenges where I hide an English message string in a block of numbers and letters. The first challenger that can correctly find what the message exactly states and demonstrate the algorithm used (usually in a programmatic fashion) they win a cash prize. I’ve learned over this year that in the past I had been making it far too difficult…

– Israel Torres

· Proactive Defenses and Free Tools

In my last article, I described the greatest breach in cyber history and made some suggestions on how it could have been avoided – enabling strong wireless encryption, testing your wireless routers for vulnerabilities, visitinghttp://nvd.nist.gov, limiting the number of trusted devices allowed
on your wired and wireless networks and hardening your systems.

– Gary S. Miliefsky

· Wuala – Secure Online Storage

– Michael Munt

· Book review: A beginners Guide to Ethical Hacking

– Shyaam Sundhar

· An analysis of the spyware threat and how to protect a PC

– Julian Evans

· Electronic Cold War

– Matthew Jonkman

Web Application Security: An Overview

2010-11-17/0 Comments/in Web Security/by SecurityOrb_Staff

An area of information security that has been gaining a lot more focus in recent years is the security of web applications. This area is of particular interest because of the growing complexity of websites which makes them a strong target for those with malicious intent. Websites are attractive to attackers because they manage bank accounts, handle credit cards, store intellectual property, and other data of high value.

One of the most recent certifications now being offered by the SANS institute focuses on this area. I had the privilege of taking this particular class and obtaining the certification. The class taught me how to perform a “penetration test” on a web application and exploit the vulnerabilities that are found.

There are plenty of products on the market today that are used by organizations to run automated scans on their web applications to find vulnerabilities. However, often times the most effective way to find vulnerabilities in a web application is to combine this automated testing with manual testing. Automated testing alone often yields many false positives that require manual investigation to discover.

Overall, I believe the best way to implement web application security within your organization is to incorporate security into the software development life cycle. It is much more difficult and requires much more time and money to fix security problems in your application after it has already been deployed to production. Security vulnerabilities like Cross-Site Scripting and SQL Injection are all two common in web apps and these vulnerabilities pose a bigger business risk than many organizations realize.