Google adds (some) malware and phishing info to Transparency Report
Google adds (some) malware and phishing info to Transparency Report
US law enforcers want to see a kill switch on our mobile phones
US law enforcers want to see a kill switch on our mobile phones
Google security: You (still) are the weakest link
A posting from Cnet News in there Security and Privacy section: AN FRANCISCO--Two of Google's top Chrome and Google Apps security experts confessed that the problem of passwords will continue to plague the people who use them and computer security for the foreseeable future. On the second day of the company's I/O conference here on Thursday, Eran […]
Hackers fail to crack Chrome OS
An interesting article from YAHOO News tech section: Google (GOOG) offered hackers a chance at a big pay day if they could crack its Chrome OS platform. The company held its annual Pwnium competition at the ConSecWest security conference in Vancouver this week where it put $3.14159 million up for grabs. While a number of […]
Google patches 'loophole' in two-factor verification system
An Interesting article in NBC News technology security section: A security firm found it could bypass Google's two-step login verification process, reset a user's master password and gain full control of the account "simply by capturing a user's application-specific password." Application-specific passwords are passwords generated by Google that you can opt to use instead of […]
Black Hat // Webcast 28 - HTTP Parameter Pollution Vulnerabilities in Web Applications
While input validation vulnerabilities such as XSS and SQL injection have been intensively studied, a new class of injection vulnerabilities called HTTP Parameter Pollution (HPP) has not received as much attention. HPP attacks consist of injecting encoded query string delimiters into other existing parameters. If a web application does not properly sanitize the user input, a malicious user can compromise the logic of the application to perform either client-side or server-side attacks. This talk analyzes HTTP Parameter Pollution and presents the first automated system for the detection of HPP flaws in real web applications. We used this system to conduct a large-scale experiment by testing more than 5,000 popular websites and discovering unknown HPP bugs in many important and well-known sites such as Microsoft, Google, VMWare and PayPal. In this presentation we will describe the details of the architecture and of the algorithms we implemented to efficiently detect HPP vulnerabilities. We will conclude by discussing the HPP phenomenon and giving suggestions on how to prevent this novel class of injection vulnerabilities in future web applications.