New Technology Reviews!.: Insecurity

How Could Web Application (In)Security Affect Me?

Nearly 55 percent of all vulnerability disclosures in 2008 affected web applications. Web applications have become the major hunting grounds for cyber criminals who quite rightly view them as low hanging fruit. Just as building new motorways improves access for traditional burglars and car thieves, web applications' internet accessibility literally delivers them to the hackers' doors. For some time now, cyber crime has simply been another arm of organised crime. And organised crime is pouring a substantial portion of its vast resources into cyber crime... because the return on investment is very high. Organised crime goes to great lengths to get its hands on any information - and the more confidential it is, the better. Once they've hacked into an application, they can either make use of it themselves or sell it on to others. They can also take control of the various resources such as servers and databases that house that information and turn a profit from that as well. Having gained control of your computing power by exploiting vulnerabilities and adding code to your application, they add your power to their existing haul and create botnets - a global network of robots reporting to their master command-and-control node - which can be directed to attack other organisations, or sold to other criminals who, once they hold enough power, can orchestrate denial of service attacks. No longer is it enough for these criminals to boast of their hacking prowess; these days it's all about the money. Given that a properly engineered denial of service attack is powerful enough to bring down pretty much any global multi-national corporation or, in fact, any small country and take them off-line for the duration, this is not about bragging rights, it's extortion. It is money-motivated from start to finish. Because all information and all computing power is grist to the mill for the criminals, no company is too small and certainly no company is too big to be targeted. And as the security in large enterprises is often no better than small entities, size is truly no barrier to the criminals. And no business can afford the consequences of a security breach. At the very least, mismanaging confidential information almost always leads to reputational damage. Reputational damage leads to departure of existing clients as well as difficulty attracting new business - a situation that can go on for many years. There are obvious bottom line implications to those consequences; in the most extreme cases, businesses can go under. According to IBM's X-Force 2009 Mid-Year Trend and Risk Report, the predominant risks to web applications are from cross-site scripting, SQL injection and file include vulnerabilities. Cross-site scripting vulnerabilities occur when web applications do not properly validate user input, thus allowing criminals to embed their own script into a page the user is visiting. This script can steal confidential information or exploit existing vulnerabilities in the users web browser. Cross-site scripting vulnerabilities are typically exploited in phishing attacks by sending users a malicious link to a page in a legitimate domain name via email. The criminals get high returns because users trust the familiar domain name they are visiting and thus trust the links (created by the criminals) therein. SQL injection vulnerabilities are also about improperly validated user input, but in this case that input includes SQL statements that are executed by a database, giving attackers access to that database to read, delete and modify sensitive information (like credit card data) as well as embedding code into the database allowing attacks against other visitors to the web site. File-include vulnerabilities occur when the application is forced to execute code from a non-validated remote source, allowing criminals to take over the web application remotely. This category includes some denial-of-service attacks as well as techniques that allow criminals direct access to files, directories, user information and other components of the web application. Facilitating all these kinds of attacks is the fact that many web sites contain some code to support various features and functions which inadvertently introduces vulnerabilities. Russian roulette, anyone? Sense of Security is Australia's premier provider of a range of IT security and risk management solutions. Its services include IT security reviews, <a href="">penetration testing</A>, audit and PCI compliance. Sense of Security provides PCI compliance services through its team of QSA's to many of the countries leading organisations.

How Could Web Application (In)Security Affect Me?

Nearly 55 percent of all vulnerability disclosures in 2008 affected web applications. Web applications have become the major hunting grounds...

Security in the Midst of Internet Insecurity

The explosion of personal and non-personal information is seemingly endless and the frequency of such is boosting in the highest degree. A survey done in January 2007 even shows that half of UK population harbors a deep mistrust because of security reasons. Many organizations and institutions are gathering proofs of information against these web insecurities but unfortunately, many citizens aren't still threatened by the issue, and are not taking it seriously.Many would think dependencies of the economy on infrastructures concerned the web and other key service providers that enable information exchange, a disturbance or disruption would cause loss of lives, property and the fall of public confidence worldwide. But simple domestic hacking is not the main problem. It is just but essential and urgent to remove personal and public computer units to cut off the lives of these "cyber criminals." It was estimated that over 172,000 computers were hacked everyday, making them "zombies", giving full control to cyber thefts in 2005. This statistics increased to 500,000 hijacked computers per day in 2007, making it almost thrice as much as it is two years earlier! And because personal computers are most dominant in the internet, they are most vulnerable with over 150 million of these connected to "bot herders". Zombie network is even possible where cyber exploits such as hacking, virus spreading, illegal access on personal data, ID fraud, spamming and webcam spying are spreading widely.Since computers were originally created to complex work, each has about 65,000 open doorways to the web, one of the obvious reasons that make them susceptible. With the nature of computers to respond, a "bot herder" would use thousands of controlled computers to say hello to a unit all at the same time. The PC then becomes overwhelmed and crashes. Cyber criminals are abundant due to the existence of black market and accessible zombie-making virus kits. All of these, according to the FBI, poses a dangerous threat not only in the household or business level, but also to national security (information, structure and economy), because the internet holds no limit but offers widely available possibilities and capabilities.So what are the people to do with these? One important thing is to secure the end-users and administer awareness of such insecurity that may cause massive destruction, being responsible cybercitizens. It is also wise to produce a safer internet planet by improving administrative, regulatory and technical solutions and handing resources out to reinforce companies, airports, banks and power plants. As users, we should take initiative to clean our malware with patches, updates, upgrades and other software that would ensure protection, and leave no room for compromises.Security and convenience should be on top priority. Although tedious, it is our duty to uphold a healthy, safe, infection- and attack-free computer to avoid affecting others, as well as to save time and money. There is no need to be technically savvy to be legally responsible for keeping your computer secured. It would benefit both yourself and other users. The simplest solution would be this: install professional security software, updated and checked regularly.	 	 		 			 				 					 						Tina L. Douglas is a well established author on the topic of internet security. For more advice and information on <a href="http://5identitytheftprotection.com/" rel="nofollow" target="_new">internet security software</a>, just click on the link.

Security in the Midst of Internet Insecurity

The explosion of personal and non-personal information is seemingly endless and the frequency of such is boosting in the highest degree. ...