9 blog posts tagged security
Quality of SSL protection for US financial institutions
Troy Hunt put together a list of top Australian banks and their SSL rating using the Qualys SSL Server Test that reveals the somewhat depressing state of SSL security of various banks down-under.
Thoughts on awareness of security vulnerabilities & full disclosure
HTML, SQL and XSS injection vulnerabilities aren’t new but they are still largely ignored by developers.
5 signs your ASP.NET application may be vulnerable to HTML injection
If you don’t encode data when using any of the following methods to output to HTML your application could be compromised by unexpected HTML turning up in the page and modifying everything from formatting though to capturing and interfering with form data via remote scripts (XSS). Such vulnerabilities are incredibly dangerous.
How dangerous is HTML injection?
A few years ago I believed that HTML and SQL injection vulnerabilities were headed for extinction. Thanks to object-relational mapping tools SQL injection continues to die but HTML and script injection vulnerabilities are as popular as ever.
Security vulnerabilities are not acceptable in sample code
Earlier this week the ASP.NET article of the day linked to 4-Tier Architecture in ASP.NET with C# which I noticed suffered from both HTML and SQL injection. I promptly informed the author and the ASP.NET site (who pulled the link) but the author was unconcerned and wrote (after editing my comment):
Web Application Security for Developers presentation
Last nights Guernsey Software Developers Forum meeting was sparsely attended with a number of the regulars attendees absent. There were however two new faces including Kezzer who I’d been chatting to on-line for years.
Web Application Security presentation in Guernsey
Announcing a Guernsey Software Developers Forum talk on web application security focused on SQL injection, cross-site scripting, and input manipulation.
Avoiding SQL injection
Back in ’98 I was developing an extranet site for a local company when I realized that it would be open for exploit if somebody put single quotes in text fields. It was early in the development cycle so I fixed it and moved on, unable to find out how other people were avoiding the problem.
Phishing with IDNs
Currently “hot news” is the fact that Firefox, Mozilla and Safari browsers have been demonstrated as susceptible to a new form of phishing attack.