Sign In
Michael Howard's Web Log
A Simple Software Security Guy at Microsoft!
Translate This Page
Translate this page
Powered by
Microsoft® Translator
Options
Email Blog Author
RSS for posts
Atom
RSS for comments
OK
Search
Advanced search options...
Search In:
Everything
Blogs
Forums
People
Groups
Places
Pages
Date range:
All Time
Last Year
Last 6 Months
Last 3 Months
Last Month
Last Week
Last Two Days
Tags
General
Pages
Personal
Privacy
Rant
Security
Vista
Archive
Archives
September 2009
(1)
July 2009
(1)
May 2009
(2)
March 2009
(1)
December 2008
(2)
November 2008
(3)
October 2008
(3)
September 2008
(7)
August 2008
(5)
July 2008
(3)
June 2008
(1)
May 2008
(1)
April 2008
(5)
March 2008
(5)
February 2008
(4)
January 2008
(9)
December 2007
(4)
November 2007
(4)
October 2007
(6)
September 2007
(1)
August 2007
(2)
July 2007
(4)
June 2007
(13)
May 2007
(6)
April 2007
(8)
March 2007
(11)
February 2007
(4)
January 2007
(8)
December 2006
(4)
November 2006
(15)
October 2006
(5)
September 2006
(6)
August 2006
(6)
July 2006
(2)
June 2006
(7)
May 2006
(8)
April 2006
(2)
March 2006
(5)
February 2006
(6)
January 2006
(10)
December 2005
(2)
November 2005
(2)
October 2005
(1)
September 2005
(4)
August 2005
(5)
July 2005
(5)
June 2005
(3)
May 2005
(9)
April 2005
(8)
March 2005
(5)
February 2005
(9)
January 2005
(7)
December 2004
(7)
November 2004
(9)
October 2004
(11)
August 2004
(13)
July 2004
(4)
June 2004
(12)
May 2004
(17)
April 2004
(2)
March 2004
(2)
February 2004
(3)
January 2004
(2)
15 Oct 2004
MSDN Blogs
>
Michael Howard's Web Log
>
15 Oct 2004
Posts
Subscribe via RSS
Sort by:
Most Recent
|
Most Views
|
Most Comments
Excerpt View
|
Full Post View
Michael Howard's Web Log
The Election and Signed Integers
Posted
over 8 years ago
by
Michael Howard
10
Comments
A colleague sent me a link to an interesting article that looks just like an integer overflow issue: http://www.palmbeachpost.com/politics/content/news/epaper/2004/11/05/a29a_BROWVOTE_1105.html Broward machines count backward By Eliot Kleinberg Palm Beach...
Michael Howard's Web Log
Ya Gotta Larf
Posted
over 8 years ago
by
Michael Howard
0
Comments
A nasty set of security bug fixes by Mandrake in xorg-x11 had the funniest text I've seen in a security bulletin. Ever! I have highlighted the funny part in red. http://www.linuxsecurity.com/advisories/mandrake_advisory-5081.html Problem Description:...
Michael Howard's Web Log
Spam senders convicted in first felony case
Posted
over 8 years ago
by
Michael Howard
1
Comments
Wow, 9 years recommended for spamming! http://www.msnbc.msn.com/id/6401091/
Michael Howard's Web Log
A Phishing Attempt in my Inbox
Posted
over 8 years ago
by
Michael Howard
2
Comments
Normally, most phishing attacks don't get past the spam filters, but this one did, not sure why... anyway here it is, complete with an appropriate level of bad grammar! Oh, and the IP address points to China! Dear Customer: Recently there have been a...
Michael Howard's Web Log
NSA Posts Mac OS X 10.3.x security guide
Posted
over 8 years ago
by
Michael Howard
1
Comments
Weighing in at a hefty 3Mb and 109pp, the NSA has posted the "Apple Mac OS Security Configuration Guide." If you use Macs you should read this doc at http://www.nsa.gov/snac/os/applemac/osx_client_final_v.1.pdf This is goodness.
Michael Howard's Web Log
The Evils of strncat and strncpy redux
Posted
over 8 years ago
by
Michael Howard
15
Comments
Following my previous post about the Apache 'fix', I was asked what code examples I had showing lousy instances of strncpy and strncat. <rant> Many developers think that because they are using a counted string copy function the code is safe from...
Michael Howard's Web Log
Buffer Overflow in Apache 1.3.xx fixed on Bugtraq - the evils of strncpy and strncat!
Posted
over 8 years ago
by
Michael Howard
22
Comments
This just came in my inbox from Bugtraq, a buffer overrun processing Apache 1.3.x .htpasswd files. " local buffer overflow in htpasswd for apache 1.3.31 not fixed in .33? " at http://www.securityfocus.com/archive/1/379842/2004-10-26/2004-11-01/0 What...
Michael Howard's Web Log
Anatomy of a Hack
Posted
over 8 years ago
by
Michael Howard
4
Comments
My good friend, Jesper Johansson, just did something that's really hard to do - make the front page of www.microsoft.com , with his "Anatomy of a Hack" paper. Go take a look... In a few days this'll be replaced with something else, in which case, you...
Michael Howard's Web Log
A New Way to Detect Integer Overflows?
Posted
over 8 years ago
by
Michael Howard
10
Comments
David LeBlanc and I have written a good deal about Integer Overflow issues, including the following: WSC 2nd Ed: pp620-624. Reviewing Code for Integer Manipulation Vulnerabilities ( http://msdn.microsoft.com/library/en-us/dncode/html/secure04102003.asp...
Michael Howard's Web Log
What about .NET vs Java Security?
Posted
over 8 years ago
by
Michael Howard
31
Comments
Interesting stuff, no?
Michael Howard's Web Log
Updated Writing Secure Code Errata
Posted
over 8 years ago
by
Michael Howard
3
Comments
A big thanks to Niels Dekker for providing me with the feedback. Here's the diff only. Chapter 5, Page 145 There’s a small error in the ArrayIndexError code: printf("Usage is %s [index] [value]\n"); Should read: printf("Usage is %s [index] [value]\n"...
Michael Howard's Web Log
Security issue of MSDN is out today
Posted
over 8 years ago
by
Michael Howard
4
Comments
The annual Security issue of MSDN is out, and you should find a copy in your local book or magazine store. Or, if you like, you can read the issue online at http://msdn.microsoft.com/msdnmag . I wrote an article in this issue outlining a method to reduce...
Michael Howard's Web Log
Follow-up on IIS6 and Apache Security
Posted
over 8 years ago
by
Michael Howard
39
Comments
Man, I got a ton of email from all over the place about my last blog entry, and it seemed to fall into four groups: Perhaps the security work you guys are doing is paying off?! No way can this be true, you work for Microsoft, so how can you be unbiased...
Michael Howard's Web Log
IIS6 vs Apache2 Security Defects
Posted
over 8 years ago
by
Michael Howard
46
Comments
A few days ago I decided to look into how IIS6 has faired security-wise since its release well over a year ago. But I didn't want to use Microsoft figures; I wanted to use other figures. This led me to Secunia.com as they have a very nice Web site tracking...
Page 1 of 1 (14 items)