EthicalHack.co.uk

Hi Francisco, you may have a valid point in saying...

2008-12-10T22:23:12.835Z

Hi Francisco, you may have a valid point in saying so, but then we have to maintain a balance between security and usability. To prevent high call volumes to call centers, it may be a good idea to automate the username/password reminder process and to send the user ID or the password to the registered email address after successful user verification.

What are your thoughts on the usability of this ap...

2008-12-04T13:59:00.000Z

What are your thoughts on the usability of this approach? Online applications are not just for preference, but to ease volume on higher cost customer channels and keep product cost down. With people maintaining so many id's and passwords, if you don't specify which is at issue, don't you think you will greatly increase call to the call center to address the forgotten id or password? Any recommendations to balance this?

Hello,Most extensions enumerated in FireCAT 1.4 ca...

2008-11-23T00:55:00.000Z

Hello,
Most extensions enumerated in FireCAT 1.4 can be found in a package:
http://phrack.fr/tools/FireCAT-1.4.tar.gz

@ lyalc:I totally agree with you, and as you said,...

2008-02-11T10:32:24.581Z

@ lyalc:

I totally agree with you, and as you said, requirement 6.6 is about making sure that all other steps have been followed and to catch some unthoughtful bugs and errors. I am actually trying to say that both source code review and WAF would complement each other and we cannot replace one for the other.

Moreover I would say that we can put a WAF to better use by using it as an analysis tool rather than just using it as a protection mechanism. This would help us to understand the attacks faced by an application and we can use this information to improve the security of an application to the next level.

Actually, PCI requires security throughout the SDL...

2008-02-09T21:58:00.000Z

Actually, PCI requires security throughout the SDLC (This is most of what section 6 is about).
WAFs and or third party code review is there to catch the inevitable "we didn't implement against that' gaps. and bugs.

I completely agree with this. The best way to secu...

2008-01-30T15:40:57.356Z

I completely agree with this. The best way to secure applications would be to integrate security early into the SDLC. We may then want to add WAFs on top just to mitigate risks arising from unintentional coding errors.

Hi VishalIMHO this is another example of PCI DSS u...

2008-01-30T14:33:00.000Z

Hi Vishal

IMHO this is another example of PCI DSS unintentionally promoting the use of silver bullets. An application firewall can sometimes help stop the most common attacks, but frequently it's just another appliance for security solution vendors to sell.

As you imply, there's no substitute for building security in to the development process, and for developers to be given the time and resources to write more secure code.

Don't you just love the imperatives of capitalism ;-)

Exactly what I meant, thanks. However, after furth...

2008-01-06T09:23:00.000Z

Exactly what I meant, thanks. However, after further experimentation, it looks like blogger.com *does* differentiate between unknown users and wrong passwords. No so good!

Thanks Mr. Wood for being the first commentator on...

2008-01-05T21:48:32.031Z

Thanks Mr. Wood for being the first commentator on my blog.

I can understand your point. It would hardly matter what error message has been returned as long as the behaviour of the application remains the same no matter the username is wrong or the password is wrong. But if the application behaves differently for a wrong username to a wrong password, that would provide enough ground to an attacker to enumerate valid user accounts on that web application.

An excellent explanation Vishal. I look forward to...

2008-01-05T13:54:00.000Z

An excellent explanation Vishal. I look forward to reading how developers can mitigate these problems.

BTW blogger.com reports "incorrect password" for both a legitimate user and a false username - demonstrating they may know what they're doing!