Infosec Myths, Mistakes, and Misconceptions – Adrian Sanabria – ASW #279

About a year after OWASP released the first version of the OWASP Top 10, they have an update for it. It's mostly a tweak of titles, although they folded "Remote Administration Flaws" into "Broken Access Control" in order to create a new category for "Denial of Service".

I'm still disappointed that path traversal is buried under that A2 "Broken Access Control". Even though it's been three years since Nimda, a lot of vulnerable IIS servers are still out there. Plus, path traversal is also about normalization and security boundaries -- something that doesn't get mentioned in the doc.

The list is still a good start. Now that it's drawing attention to XSS and SQL injection (as part of the more general "Injection Flaws"), we should see those types of vulns die out in a few years.

H.D. Moore has rewritten Metasploit again! (Although it's still in Perl. Sigh...)

This version "...includes 18 exploits and 27 payloads…" A lot of the payloads are understandably against IIS and some other Microsoft vulns, but there's an exploit for the RealServer vuln on Linux and another for Solaris. Although sort of surprising there's not more Solaris considering how much it still crops up in so many datacenters.

The code is all open source. There's still a lot of misgivings from some corners of the infosec community about making a hacking tool -- especially exploit generation -- so easily accessible. But the better point is that tools like this are only going to become more prevalent. Plus, orgs shouldn't be basing their cybersecurity decisions on whether they're going to be attacked, they should be working to keep software patched, systems monitored, and users strongly authenticated.

Last year (Feb. 2003) PHP started work on a mysqli module. It'll be part of PHP 5.0, which will be out of beta any time now.

The cool thing about this module is that it "...includes an object-oriented interface in addition to a traditional interface; as well as support for many of MySQL's new features, such as prepared statements."

There's some other coverage on this. Although, to be fair, PostgreSQL has had prepared statements for a while now, too.

In any case, between this new feature for PHP devs and the first update to the OWASP Top 10, the lifetime for SQL injection vulns has probably dropped to single digits.

We're a few months late catching up on all the announcements from this year's RSA Conference.

Bill Gates gave the keynote, which was a chance to see just how much security change there's been inside Microsoft since the Trustworthy Computing push. It hasn't quite been a year of Patch Tuesdays yet (October 2003 was just six months ago), but having a predictable cadence seems to make the process of patch management easier for admins. After all, so many systems are still lagging behind patch levels that something helpful needs to be tried.

One of the things I wanted to highlight from Gate's speech was the move away from passwords. As the article notes, Gates demonstrated the "...Microsoft Tamper Resistant Biometric ID Card, a cryptographically tamper-resistant identification card that can be easily deployed using simple, low-cost hardware and regular paper.” Here's another article about it.

It'll be cool to see a future where web apps can rely on hardware-backed authentication. That'd be a lot better than web apps coming up with weird rules about how users should compose their passwords.

Here's the other article I wanted to share from this year's RSA. It has a lot of links to additional coverage.

I mentioned the new Patch Tuesday experiment from Microsoft in the previous article. This one explains a bit more Microsoft's "...quest to convince customers to regularly patch to secure software had largely failed." That's what led them to "...limit the release of fixes to once a month, and augment the upgrades with several other security initiatives..."

Another topic was Microsoft's partnership with VeriSign about OATH and their work on physical tokens for user authentication. That's the part that makes it sound like the death of passwords might actually be possible within the next few years.

There's not too much web app security in this one, but of course web app security testing spends most of its time in the browser. This is really just about getting used to calling it Firefox instead of Firebird.

Still, it's nice to have alternatives to IE. Between the newly minted Firefox and Apple releasing Safari last year, there's a nice trend in having choices about what browser to use.

That's what's nice about web app security, all you need is a browser and Paros Proxy to start finding XSS, SQL injection, and -- don't forget! -- path traversal vulns. (And maybe a few more. There's a top 10 of them after all.)