Paul Maher's Blog

no thanks, I would rather wait on a real next-generation console :)

Yeah I have a good one for you it actually just happened yesterday, I am a developer but yesterday somehow 16 different administrators for a purchased app forgot their passwords. So they came to me. This purchased app took me 10 minutes to break into do to a common programming flaw. And no it wasn't sql injection. So where would you like me to send this story to?

How do u want us to communicate this to you? Via email, comments here, etc. or some other mechanism?

We bought an SOA based CRM solution taht works with AJAX. Each time the pages call a webservice, they need to provide a guid generated by the application at the first call. The funny thing is that the POST and GET were enabled by default and if you snooped in the javascript of the aspx pages you could find the servuce URL, go on to it and generate a GUID by yourself or even worse find a "Special" GUID that works evrytime!

We bought an SOA based CRM solution taht works with AJAX. Each time the pages call a webservice, they need to provide a guid generated by the application at the first call. The funny thing is that the POST and GET were enabled by default and if you snooped in the javascript of the aspx pages you could find the servuce URL, go on to it and generate a GUID by yourself or even worse find a "Special" GUID that works evrytime!

i noticed that you were interested in getting a core xbox 360, i am selling one and if you are interested just check out my shop

http://cgi.ebay.com/Xbox-360-Core-w-receipt-opt-overnight-to-many-areas_W0QQitemZ8262098028QQcategoryZ62054QQrdZ1QQcmdZViewItem

great chance !!!
at wich email address do we must send oru storiy ?

Bye from Spain :D

no they die off after 2yrs down the road, no upgrade option package to buy to upgrade the fool things.

i use to love playing a consule type games but after getting burn for using it like a year or 6mo later they are no more.

sorry i like them very much but got burn by them too. no more wasteing money for me. i got a life to live and price of things going up can't buy the games for it ether.

What address should we send our story to?

We had a cross-site scripting attack a few months ago in our Discussion Forums. Anyone going to our site forums page got redirected to some other site. The hacker did it by adding a post with an  iframe tag. We cleaned up the database and made sure all user inputs were encoded properly before passing to/from the server/database.

2 Such security nightmares come to mind,

1st one was dealing with an external firms Helpdesk software implemented on our site (not mentioning names), The main client app was fine but the web version left some security questions begging, in the end we had to debug a lot of the web front end (written in ASP) for when we published it externally to our clients.
Testing this became a logistical night mare, anything rating from trust issues with the site with documents that clients tried to upload to calls placed in the system (in the worst case one contained a virus that caused several headaches, ended up implementing our own file upload system that sandboxed the files for virus scanning)
To issues with safe code and signing, causing various glitches too numerous to mention, including the firewall blocking some area's
After all the problems were sorted out (or just re-written ourselves in ASP.NET) it was OK.


The other story relates to an in house App writing totally in XML and XLST using SQL XML as a backend.
Getting data communication working securely proved a challenge especially when exposed internally.
I had to write a secure front end and web service to handle communication to the SQL engine as windows authentication and the firewall and SQL were not happy being working though a proxy.
The front end was just a login Screen written using ASP.NET (signed and using SSL) this then used my web proxy service to relay all XML request to the SQL XML backend.
Worked well until someone tried using malformed packets to the web service, which crashed it repeatedly, ended up re-writing it using some of the Safe coding standards, even in .Net
needles to say I got a lot of flack from some of the senior management about the time lost from the re-write and the implication on the data in the backend, but from the way it was written initially I made sure (from a secure point of view) that data retrieval and updating only happened during secure working authentication so the malformed attacks only caused crashes or D.O.S, good forethought.
(Although as a side note turned out the attacks were coming from one of the boss’s sons who was board and found some cool tools to play with, I liked finding that bit out!!)

Lessens I learnt though both of these is expect the worst, it usually finds a way of happening even in the most unlikely circumstances

Thanks everyone...please keep the stories coming. Either log the story on the blog or email me directly. Either way is fine.

Thanks,

Paul

No since it was posed as a question.

A third-party vendor's software distrubution system had no mechanism for distributing the agent (I wanted to use SMS, but was shot-down - long story). Using VS 2005, programming in C#, I was able to create a client-server distribution mechanism that worked via a web-service and SQL back-end.

It only took a few days and worked like magic.

please give us your email id.

Yes my Son would love one as I definetly cannot get one for him as I was through an army, his Father beating me so bad, im going through surgeries so bad now and paying the price,
Anyways I have no idea what ive done, for one I need a new comp. this comp is so messed up, c drive is corrupter, items will not download, some will some wont, I cannot print anymore, and I feel it's not all of the SQL etc, but IVe downloaded alot of these items and i guess didnt need them, I thought I did, as I was doing some work at home for my Father's company and i couldnt finish it as to passwords, I think that when my Windows crashed one day and then I found alot of other problems I dont know what to do anymore. Mic. told me/ my comp co, stated that my comp is fried, I guess I had been a victim of being hi-jacked and crashing of windows consistenly. I crash every day and I cant tell you how many times so theres vew few programs i can use now..So it is time for a new comp one that i cannot afford.. tyvm.ccra

For me, the biggest security problem really lies within the organization.  I worked as a developer for both healthcare and financial software companies.  From time to time, developers and tech support personnel need to dial in to hospitals and bank sites to trouble shot. And all these times, every single piece of data is open to the person, SSN, hospital records, financial records, everything.  And I have seen people just copy/paste/print out these records during debugging sessions.  When everything is said and done, these print outs may just go to the trash can.  If these "trash" ended up at the wrong hand, identity theft can't be easier.  

I guess there is really nothing technical that can solve this problem; it's more of a process or company policy issue.  Still, kind of scary whenever I thought about this.  So many ways my personnal and security records can get lost or misused....

We had a client that wanted us to supply a single sign-on solution to a component that they were running within their own environment. The IT shop at the client stated that they were very security conscious and were not comfortable allowing us to grant logged in users of our system SSO access to their internally hosted solution. During a conversation with the IT shop they showed the current SSO solution that they were managing internally. You could tell they were quite proud with the work they had done. During the demo I noticed that there was a redirect occurring after they went to the other system. After the redirect there was nothing insecure in the URL but I wanted to see that first URL so I went into the browser history and saw the complete URL that included the individual's SSN and password for the other system. Needless to say they were not very proud of their solution when I walked over to the business rep from the client and gave him his login credentials.

I am a developer. I use VS.NET and it's so good I have so much free time I am shopping for an XBOX now. Good enough story? Why don't you send me also a universal msdn for one year. Pweeease...

My internal VB6 app that was used by 5000+ users in North America was brought to its knees all of a sudden at about 3:30 in the afternoon.  A teleconference call commenced at that time with back end folks joining and leaving the conversation at various times.  Even though my app hadn't been changed in over five weeks, people were still pointing the finger at my app at 8:30 p.m.  The call ended at around 10:30 in the evening when we found out that the user ID that the DLLs used had lost execute permission on the application servers due to a change made by the security vendor. Then I went home.

P.S.:  I no longer work for that employer, but I believe security has since been taken back in-house.

Developing a "Freeware" product is never easy.  Writing all the help files, the GUI, the backend....  Anyway, I posted a freeware application (an MP3 catalog that can be configured to monitor folders and files and automatically add them to SQL server database) and my first reviewer said " Product is great, but the price was too high to make it worth it".  I laughed for days.  

After months of complaints about SQL server price tag, I ammended the help files (and product) to ensure it would work with MSDE 7.0 and reposted it.  later reviewers said that the price of even the MSDE DB software that it needed was too expensive.  I laughed till I cried, and eventually pulled it after too many of the same responses.  I still use it myself, although its now on 2K5, but I still am perplexed as to how a freeware product could be too expensive.

Developing a "Freeware" product is never easy.  Writing all the help files, the GUI, the backend....  Anyway, I posted a freeware application (an MP3 catalog that can be configured to monitor folders and files and automatically add them to SQL server database) and my first reviewer said " Product is great, but the price was too high to make it worth it".  I laughed for days.  

After months of complaints about SQL server price tag, I ammended the help files (and product) to ensure it would work with MSDE 7.0 and reposted it.  later reviewers said that the price of even the MSDE DB software that it needed was too expensive.  I laughed till I cried.  I still use it myself, although its now on 2K5, but I still am perplexed as to how a freeware product could be too expensive.

Even with detailed instructions about how to set up an app account it seemed that no one could get the program to connect to SQL server.  I sent far too many emails telling peole how to use the app account and walking them through configuring XP/2003 Server security.   I eventually pulled it after too many of the same responses.

I suggest you stop giving away what few Xbox 360 machines you manage to make and instead send them to the many paying customers (me included!) who have been on a waiting list since last October.

ok please send me one :)

For the past 2.0 years I've been writing a racing game in Visual C++ 6.0 (Pro). I finally had enough of all the bugs, security vulnerabilites and downright library compability issues (DirectX 9.0c wasn't supported anymore!). I took the plunge and purchased Visual Studio 2005 (Standard). While recompiling my code tree I was horrified at how much functionality had been classified deprecated due to security concerns. With the game being released in the autumn, I was ecstatic that the functionality was flagged right away and we made the appropriate changes to avoid any obvious and potential problems. Security is a huge concern in this age, and the warnings helped my development tremendously.

Few years ago, i had to travel for aprox 2
weeks

I was reponsible for a t1 circuit with 8 servers installed with windows nt 4

my internet service provider was UUNET

when i came back there was several emails from
UUNET asking me wheter i wanted to upgrade my circuit

so i thought .. great.. i succeded....

checking usage i found my circuit had full t1
usage for weeks in a row...


unfortunately i didn't have enough time to
celebrate

Once i opened the first log to check where the
heavy traffic was orginated i had a surprise

All of my servers where turned in to content servers for live broadcats of the movie "The Cell", that wasan't even released.

I had to work for a few days in order to clean the machines and i lost one the hacker simply
changed the Administrator password so i couln't even log on

at the end of the month i received the expensive bill from UUNET for the heavy traffic
on my network

So i 've learned the lesson the hard way

and after that i never lost a service pack,security hot fix or security alert from
microsoft

Since i moved to Windows 2000 Advanced server i found better tools to protect the server from
unauthorized usage

Hi my email is gonzalo@gllg.net
gonzalo labrada

I've got a security nightmare which is almost too unbelievable to be real but believe me, it is!

A couple of years ago we were psyched by the prospect of switching to another MVC-Framework for one of our Java-based websites. However, looking in the rear-view mirror it was probably a very very bad idea to ever use it.

Anyways... I was the guy appointed by the company to take the framework, integrate it with our system and write documentation for it so that junior developers could use the new MVC-framework.

Little did we know about the catastrophic security hole in this framework and I was fairly surprised when someone suggested to me to write any java-command I like in any textbox I wish just as long as it is rendered by a framework's UI-component.

I of course tried that and first I didn't think it was too surprising that you actually were able to modify data in the underlying action-class in any way I desired. However, eventually it came to my mind that it may be possible to execute methods from Java's default namespace so I tried it and bam! Sending System.exit(0) actually caused the ENTIRE web application server to stop immedeatelly!

I couldn't believe that they would miss such a security hole so I started to browse the net and actually found that others had the very same problem.

Luckily this security issue was eventually reported and they resolved it and we were even luckier that no outsider ever found out that we were running this particular framework and that they could terminate our entire web application with a simple one-liner.

-Daniel (pfeifer@home.se)

Here is my story:

I was working as a developer at a Further Education College in the UK. We'd developed a web-based system in ASP.Net which was used for taking registers and tracking attendance for all the students in the college. We used LDAP to ensure that users could log into the application using their existing network usernames and passwords: effectively delegating user authN and authZ to our existing IT infrastructure. I was pretty sure that we'd made the application nice and secure - encrypted user data, audit logs, login attempt logging and suchlike - but one day we heard on the grapevine that a couple of students had been bragging about how they'd "hacked" into the College systems and improved their attendance scores!

We went through our logs and managed to find the culprits easily enough, and they were punished. How did they get in? It turned out that a network administrator was giving out passwords to new members of staff which were *the same as their username*. And of course the teachers weren't changing them. We learnt two lessons: the first (most obvious) one was the importance of making sure your network  enforces password complexity (they were using Novell Netware at the time...). The second one was that, no matter how secure you make your software, how much you lock down your servers, users themselves are often the weakest link in the security chain, and you need to educate them otherwise all your work could be for nothing!

jon [at] jonrowett.com

Internet security grows as more people become aware of how to secure their own network. That's why I enjoy answering technical questions on internet code forums about Internet Connectivity, developing client-server applications and developing secure applications using cryptography and SSL. By providing guidance so that more people can secure their private LANs is one step that pays large dividends. By helping more people understand the .NET namespace System.Security.Cryptography, I see more secure applications being developed. I regularly solve WAN/LAN, VPN, Firewall issues at work. And I am glad to see that security has become a common topic; discussion promotes understanding and understanding promotes action. Of course I would be remiss to not mention my biggest headache - my teenager kids. Privacy concerns are more important than ever. Keeping OS's loaded with the latest Service Packs and Security Patches is only one step. Teaching kids moral values and how to make the right choice is even more important if we expect to have a society that is wise to dangers of the internet it starts at home. When secuirty is the topic, spread the word. Teach it and you will benefit.

Yes i would like an xbox 360 please. I am a hardware engineer and not a security specialist. Business has been a bit slow lately so no interesting things have happened yet. But here's looking foward to a bright future.

Sitting next to hollow monitor and glaring to nothingess I installed the Proxy server on the last of my *nix hijacks. The chain of IPs was atlast complete.
The only thing that remained was to get the real IP address of SLS general hospital. The only intelligent thing I ever did was plant the two line code that pings my Dynamic DNS (with my configure I) with the current IP address of the Admin module from the software. My Boss wasn't so careful to read all the code, he was in too much hurry to test and deploy before the client might bail out.
The hospitals Wireless was fast enough and getting the Admin's "clear-text" password was not all that difficult when you are sniffing on the same network.
VB apps are so gullible. Nevertheless I had the IP from the ping logs. Now there are two IP addresses as they have two hospitals the other one must receive all the data for the day at night. Just when I 'll be waiting for it. All the clients, all the information. And they'll never know what hit them.

Tomorrow I make my first million.
- Fiction based on real facts.

We have a client who wants development of pay-per-use access to a system that analyzes the condition of your skin using UV light. Being complete novices regarding software, their initial demands were to have a card reader which would regulate access to the system. The cards would have credits added and deducted from them while in use. No attention was given to how credits were to be purchsed although the web was mentioned. Having given them a cost estimate for the development of such a system, their demands were reduced to a "trust" based system where users would purchase credits and be trusted to use only those credits that they have purchased (No more cards). Checking of proper use can only be done through a log file the system will produce on site. Finally this log can be exported as a text file to be checked elsewhere. Of course being a text file its data can be altered at any time. These systems will primarily be used in Saudi Arabia. Knowing full well the security limitations of such a system, its success largely depends on how ignorant salon and spa owners are of software in the middle east.

We have a client who wants development of pay-per-use access to a system that analyzes the condition of your skin using UV light. Being complete novices regarding software, their initial demands were to have a card reader which would regulate access to the system. The cards would have credits added and deducted from them while in use. No attention was given to how credits were to be purchsed although the web was mentioned. Having given them a cost estimate for the development of such a system, their demands were reduced to a "trust" based system where users would purchase credits and be trusted to use only those credits that they have purchased (No more cards). Checking of proper use can only be done through a log file the system will produce on site. Finally this log can be exported as a text file to be checked elsewhere. Of course being a text file its data can be altered at any time. These systems will primarily be used in Saudi Arabia. Knowing full well the security limitations of such a system, its success largely depends on how ignorant salon and spa owners are of software in the middle east.

Here is my security story.

The other morning I was on my way to work after an all-night C# coding session.  Suddenly, I had to pull over and save some children from a burning orphanage.  When I got back to my car, I realized I had left my keys in there.  My car was gone.  I caught the bus to work.

Leaving your keys in your car is a big security hole.

I miss my car, but owning an XBox 360 will fill the void for the moment.  Can you make sure it is delivered after 9:00am please, as catching the bus means I arrive at work a little later.  Thank you.

It all began with a thought someone have had in a small company – which I cannot provide the name off – we’re they had an idea about making an education material for programming language. They calculated how much it would cost them to write and produce the book and it coasted them about 200.000 DK kr. that is about 33.000 dollars. It wasn’t a big company so they rent the money, and hope that their book would sell as warm bread.
When they were done with it and had made the copies and started selling them soon discovered that, it was being copied and they was losing money on that. Then they went back to the company that produced the book for them and asked if they could like a secure on their materiel, it was a book and a CD which followed with the book. They could get a copyright thing and a secure on the CD too, but… It would have coasted them like 5-10 times as much as it took them to produce and make the material, to just get the secure thing. Of course they couldn’t handle it and the project was a failure, expect for the content provided by them. That didn’t miss anything.

Well, personally I don’t know about this story, my father told me it and also he gave me the name of company and when I was little I do believe that I heard something about them… I don’t think I have to say how happy I would for the Xbox 360… I personally is trying to get into the industry and learn all different things about Games and such. You will be hearing about me all over the forums from now on, because I am very much interested in learning about the DirectX API. And I hope that you send me the Xbox, because I want to do some testing on it, see how the console is, I’ve heard a lot about it, some in the XNA project, that it will have Managed Code inputs and such… My father doesn’t think well about buying consoles, says that they are old school and is a replacement of a PC… Well, I got to stop typing now. I hope to see you all in the MSDN Forums guys!

Mossa TheGreat…

Many, many years ago I worked at what is still a famous e-commerce fashion web site (nowadays and even then mainly for the wrong reasons).
One story I do remember was a hurried fix to implement additional currencies for the launch in the next country down the list.

This was done with three code changes:-

1) add a currency field against the user account (that could be changed at will regardless of the obvious security flaws we highlighted)
2) a change on the first checkout page to get prices for the shopping basket based the currency code in the user account
3) on the last checkout page to get the currency value from the user profile and pass the currency and the value of the basket to the credit card processor.

It wasn't long before the flaw become obvious:-

1) create a new account in a strong currency such as the British Pound,
2) fill a basket with say £1000($2000) of goods and start to checkout,
3) between the first and the last page change the account's currency to a different weaker currency (say the Italian Lire) and proceed to purchase the goods for 1000 lire (roughly £0.50 ($1)). With careful planning a discount of 99.95% was possible.

Sadly even the explanation above was not enough for a fix to be deemed necessary. It was only when the entire test department ordered entire new wardrobes to be delivered to reception that management realised how significant the problem really was.

Having been an developer for almost a decade and working as an independent consultant for 4 years now I have dealt with my fair share of security problems. I have always tried the basic risk mitigation tactics from an intrustion perspective but a couple years back I took over development and systems engineering of a publicly available site for a client with pretty robust security needs – the client was the United States Air Force. At the time we were experiencing rather significant traffic and considering the site had over a quarter million users we are talking about some load. One of the first things I did was implement some checks on traffic patterns to the site to see what type of abnormal requests we would get. With such a site it is not out of the ordinary to get the occasional script kiddy dictionary attacks to the login page and other basic intrusion attempts.



After a few months of work I had gotten the system to a point where I was instantly pushed emails with any exceptions or odd traffic flow – I had never really seen anything to scare me until the morning of May 16, 2004. I started getting errors popping out of the site in rapid successions with data I had never seen before. I hopped on the server and recognized that I was under some form of a pseudo attack and from the looks of it this was not some kid but something sophisticated and serious. The other end of the line was trying a number of techniques, generating serious traffic to the site and doing some things I had not seen before like supplanting ViewState info into the url. I googled such techniques and found nothing about such attacks which really worried me that I could be getting attacked with a zero day vulnerability!



What do I do? Should I call the General? The FBI? Homeland security? After all doing a reverse lookup on the originating IP gave me a rather weird domain name which I then googled and found to be an Iranian University. It is one thing to get a kid up late in Indiana but Iran is another story and to get sophisticated traffic from that country attacking a DOD server was, well….frightening.



OK, so first thing is make sure that the site is locked down, check the logs and look closely to make sure that whoever it is has not gotten in – to anything. About one hour of research and check, all systems look good. Next thing is to simply block the IP at the firewall level see what happens; few seconds and….shoooooo – all clear. Soon after that wall was erected someone on the other end realized they were caught and no connection attempts were made after that point.



Alert some people, let them know what was going on – and that we survived without intrusion…then tell the community to watch out which I did on my blog right here. http://weblogs.asp.net/kwarren/archive/2004/05/16/132817.aspx



Security is something all too often taken for granted as we assume that for run of the mill applications that they target value is of no value – but when you are charged with protecting information for hundreds of thousands of users who are all members of the United States armed forces the attitude toward security must be different – it must come first.

Last Year when I was in the cisco lab in my school I just got done programing my router and noticing my best friend was trying to telnet to my other class mates routers and ignored the situtation that he could telnet to my router and erase it. But he did just that in the next couple  of minutes but I learned to change my password imidiately when something like that is occurring .

Last Year when I was in the cisco lab in my school I just got done programing my router and noticing my best friend was trying to telnet to my other class mates routers and ignored the situtation that he could telnet to my router and erase it. But he did just that in the next couple  of minutes but I learned to change my password imidiately when something like that is occurring .

Here's one for you:  I was a developer for a defense contractor, and the Department of Defense is justifiably paranoid about security, especially in its web apps.  So my office sets up the developer network to mirror DoD security and we can't so much as debug an application, much less write to a file.  We had to carefully document which security measures we had to disable in order to the development work -- on our own systems on our own network in our own office -- to satisfy DoD that we were not compromising security.

Good Afternoon from Australia.
I find that web sites in general have to many security flaws. For example, I have noticed that I can easily access your style sheet,(it was designed by Jason Rice - line 2) i could reference your gradient.aspx page to serve gradient jpegs to my website (the neat little blue backgrounds on msdn.microsoft) all by analysing page source. I feel there should be a more secure way of being able to hide such details and files. I am a web developer by trade and feel there are far too many weaknesses in allowing users to view source. Could it be compiled client side? Anyway, thanks for the opportunity.
Regards
Dale.

A good friend of mine, fantastic graphic designer, started a company with her husband creating beautiful websites for fortune 500 companies. The sites looked fantastic because of her exceptional flash and GUI design skills but they outsourced their backend development to offshore workers because neither of them were skilled programmers.

To make a long story short these two offshore developers were diehard Unix snobs and would snub their nose at anything Microsoft. Well when it came time to implementation the fortune 500 company required they were the one who went to implementation. The only problem....they didn't have the Unix expertise to configure the server correctly. It took a month just to get the server up and running, when the entire application had a total development time of 300 hours.

So now the application is up and running for almost a year when they find the application allows anyone in the entire company to have full access to the site.

The Problem
Well they found these programmers set up the login process so that when an error occurred the user would have full access. Sort of like; for you .net programmers out there:

Try

If "Try Some Login Function" then
  "Give the access"
Else
    "Don't Give Access"
End if

Catch
     "Login Admin"
End Try

How did this happen. Well in the development environment the "Unix" guys set up a function to login the user in a file which the Fortune 500 company did not include in the correct place so the application would fail to the admin access.

It just goes to show that even if for some reason you think a Unix or some other environment is the way to go it is always better to go with the environment which the most people are familiar with. Your time to implementation will be faster and the possibility of someone downstream from your application screwing something up will be less.

Frank

Its a tale of woe. A combination of exhaustion, personal issues and other things which will not be mentioned to protect the guilty and/or stupid.
This story got my last contract terminated for non-performance. I also have not seen pay for the last 3 months I did work at this place (but that is another story). It also changed my path.

My worst encounter with the borg. Had the following elements:
1. My computer started doing funny things about two weeks before I recognised there were issues.
2. I could not explain it at first it was just a nagging feeling - almost more paranoia than an issue.

So something felt wrong in Windows world. I have never had a computer virus or any form of unauthorised intrusion on my computer (I now have to add 'That I know of')

It was my PC slowing down at times - and its a fast 3.6GHZ 2GB 533 2X200GB SATA baby. So I modified my firewall, added no exceptions and did a whole bunch of other things. I had a program called Black Ice on my system that monitors intrusions and logs ip addresses, etc. I first got wind of things with black ice giving me an IP address of someone who was buggering with my PC. It was an address at the place of work and I tried to raise it. It was seen as nothing of importance and I accepted this but was still worried. My PC crashed the first time one week before the day of woe. I had a deadline so I promised myself I'll be focusing on it. The day before my project was due, my passwords stopped working (first time in the afternoon) - I have been up for well over 48 hours already and this made me realize there is something amiss. So from developer I had to assume the role of security man (I worked from home - just down the road - where all this happened). I managed to kind get into my computer, first I had to reset the passwords  and to do this I had to boot out of windows and my stiffy drive was not working. These things don't happen to me... I managed to (the story she is very long!) by returning to work and getting on the domain then using another pc with admin rights to access the windows folder, modify login.scr in order to try gain access via a command line. I found myself in a world where I had no rights - I could not reset password as I had no way to boot into the dark place at the time. I eventually replaced one of the services with an executable of my own and I did eventually, get hold of my computer again. But lo and behold the passwords got changed again when I got home. No I have to fast forward a bit - but at some point i realized the implications of what a breach could do at this very large financial institution i was at so I decided to try and get to the bottom of this (in hindsight, if i did continue work i would have lost it again 2 hours later)

Well in the end, when I got back to work, I was immediately and permanently removed from the company (my stuff was at reception waiting for me...) I tried to convey my concerns to my superior who told me i was my problem and he refused to listen to me. In the end, when I was trying to address a serious issue, I ended up being screwed over. I accepted the risk of being fired because I knew what was there had to be more important. I was apparently wrong.

So through December, I basically took up a learning curve and adventure I never thought possible, seeing some rather odd thing happening to my computer over the time. In the end, I am convinced that the initial issue was likely either internal monitoring by the company gone wrong or it was something they simply could not fathom?

I did a format of my hard disk (quick format) and started again. But lo and behold, thing simple kept on happening. At some point I was in Bios changing settings (and learning how to do all kinds of interesting things on a pc) and upon rebooting I'll find these settings changed. Lovely! My computer chased me from application level all the way to BIOS (I have dual bios which explained a lot to me in the end)

Finally I learnt what a rootkit was and I know for a fact something of that nature was harassing me. But there were other elements, for example

- my system clock setting was wrong at times
- my pc was seriously overworked
- so was i
- i could not decided whether I was in a virtual operating system or a jail of sorts or whether it was just me magically making everything happen. I go for combination.

In the end i had to combine lots of things I have learnt over many years and it was a wonderful experience to have to separate thoughts from different knowledge areas combine and give me ideas far outside the hell I was finding myself in.

I still want to one day write a rootkit of sorts in order to prove to myself that everything I found was in fact what I thought it was. I am still trying to figure out how this amazing puzzle fits together but my current standpoint is:

1. Don't play with WMI - if you shut it down, your firewall shuts down too. I am not sure whether its set to auto restart but mine was'nt.
2. Autoplay sucks and people putting things on your computer without permission can turn already-not-so-good-things into... shudder.
3. There is always something more to learn about everything.
4. Make sure that you are in a position where, when something is wrong, you are able (not impeded by fear and other factors) to actually escalate the issue or ask someone for help.
5. Take security seriously - its important.
6. I don't trust IIS enough but possibly because I have not studied networking properly.  
7. Learn to collaborate and communicate as well as you can and always try to improve these critical skills.
8. Make backups and adapt your backup plan with your conditions.

In any case this is a summary of my security experience. Its a far grander story than I could ever tell.

At RJS Software Systems we develop web based solutions for document management and workflow solutions.  Our customers require the most secure solutions in a environment where the web is something hackers penetrate every day.  Because we've built on Microsoft technology...not only can we deploy on the web, but in a Hosted environment.  We have NEVER had a security breach after upgrading to the .NET framework and are confident our customers are well served.

It's quite funny that I would see this now after talking to our dev. manager.

One of our "products" has 5 components to it. One component being a document storage application.

This morning I get in and it seems that one of our customers who was set up 6 months ago had their Document Storage application DataBase settings pointing to our live Test site in all the applications... except the "Document Storage" application.

When that customer logged in to see their files, they saw what they were supposed to see. However, whenever they went to the other applications we make they saw our testing material.

Now to give you a heads up on what our testing material is... my testing material usually lies with rogue ninjas roaming accross the country side. Maybe I'll throw a coding monkey in there to battle the ninja. Others use Pixar characters, or Star wars characters. This way our development team knows who's testing what.

When this one customer phoned to tell us the huge "security" flaw, and that they were seeing top secret documents, the development team laughed.

IT was quite humurous for us, seeing we knew that it was only bogus testing matieral, but to our customers, they thought it was very high secret documents. We had our people running around the office in a panic while us developers just sat in our chairs and laughed. We then fixed the issue.

Of course this doesn't solve the problem that now we developers must slave over manual labour and copy all their documents from our Test site to their site.

While working for a government agency, I was tasked with implementing a system that allowed tools and parts to be checked out for use, it used a barcode system and a hand held scanner to handle the transactions.
The security that was implemented for the program was dongle based. We used the program for about a year and a half and never had a problem, then one day...poof, it no longer acted as a liscensed product, but as a demo version. After checking everything, we realized that the dongle had suddenly stopped working for no apparent reason. We contacted the support for the program and we were told that there was nothing they could do for us because they no longer used the dongle and we would have to upgrade. The only problem was, governements don't spend money very fast and it would have taken a month or more just to get it and installed.
We couldn't wait that long, so we went about taking the dongle apart to try and find out why it quit working.
We couldn't diagnose the problem so we went into "crack" mode. Since having to crack a legitimate version of a program you own is ludicrous, we decided from that moment forward we would no longer use and program that required a hardware "key" for operation. Lesson learned, but we did crack it to use it, never upgraded and went with another company when the time came.

I'm developer. The story is happend in High school in lession of security. The teacher gives an execise for as, to try crack the win2000 OS admin password. And one of my classmate is done this....

Our software requires the strictest security due to its use within the US Government, namely the Department of Defense. Our custom security module works like this: The user enters a plain text password which is md5 hashed, appended with the current UTC time-code (down to the hundredth of a second) as salt, md5 hashed again, then validated against the database, which keeps a record of the last time every user logged in. So, even if someone were to sniff the encrypted packet, it is rendered no good as soon as it is used the first time (as the salt is now before the current time.) Well, one day a particular customer was having a rather frustrating problem, and we just couldn't get them to understand how to run a SELECT against the database. Our lead architect, in a matter of under an hour, was able to write a simple .NET application that went against one of the exposed application web services to allow any arbitrary SQL statement (both to select and update data) against the applicable databse. Needless to say, after we fixed the client's problem, we made sure no one else could do the same.

I have to share this one... we were working on a new password system that would cycle through and make everyone who currently has our generic office password to change it to a strong password.  We decided that the most practical approach was to run a script that would notify us of those still using this password.

Well the script itself worked wonderfully... The problem?  It was run off AD.  After 3 runs, it gave us the list in the most unusual way.  Since it was set up to be true false to the password, all the falses' were subsequently locked out of their accounts.  Even the head of our company.

I was working for a Seattle .com ecommerce web site that was pushing hard to get gift cards integrated into the purchasing pipeline of their site.  One of the developers found that he could call the gift card’s network socket api an unlimited number of times to query if the card number and pin was valid or not.  This presented a brute force attach security risk.  When he approached the management they deemed this a non-threat since you’d have to have internal access to the corporate firewall in order to pull this kind of attach.  The developer pointed out that a high number of hacks were perpetrated inside the corporate firewall by employees of the company getting hacked.  The management still didn’t believe him.  

So he wrote a hack program to generate random account numbers and call the ValidNumber API for each number.  When he found a valid account number he would query the API for the account balance for that gift card and store the account number and balance in a data file.  He ran the program over the weekend.  On Monday morning he had accumulated several hundred thousand dollars worth of validated account numbers.  He printed this list of and handed it to his director, who suddenly deemed this a valid security problem.

Okay, how about this. I work for one of the biggest engineering software firms out there and they have this document management system (DMS) I'll call "PW".

The engineers at headquarters wanted a way to "integrate" with the DMS via a web interface so they made an ActiveX control (note from me: ugh!).

Programmers can interface with this control to a limited degree and even pass login credentials to it. How you might ask? Why via the query string of the URL, of course!

Knowing this was terribily insecure, they came up with a failsafe strategy to lock the credentials up tight: use base-64 "encryption" to obfuscate everything. The problem with this, of course, is that base-64 encoding isn't an encryption scheme, it's just character formatting so anyone can easily unencode it.

At least they eventually added to the docs that clients should use SSL.

We recently ran into an interesting security related problem using IIS 6.0 and a custom developed ISAPI extension. The ISAPI extension is used to import complex mortgage loan data, stored in uploaded Excel files, into a SQL Server database. The ISAPI extension implemented a custom thread pool to process the requests.

The security problem occurred when the ISAPI extension attempted to read the Excel file located on a network file share.  Attempts to access the file returned an “Access Denied” error. The developers verified the web site the ISAPI extension ran under was setup for Anonymous Access and to impersonate a valid user account having proper permission to the network share. In addition, using a file located locally on the web server worked without issue.

After some head scratching and creative troubleshooting the coding bug was uncovered. The developer had created the thread pool during the GetExtensionVersion call. This call is made one time during the initial loading of the DLL. While this seemed to be a reasonable place to do the thread pool initialization, the call to GetExtensionVersion is made under the security context of the Local System account, not the security context of the Anonymous Access user account. Therefore, the threads created during the thread pool initialization executed under the Local System context, not the anonymous user account.

In a past position as the lead web developer for a major wireless teleco security was paramount.  However as with many large web implementations the site was hosted across various servers and platforms both within the company and externally.  At last count the secure customer portion of the site was hosted across 17 web farms.  Managing the single sign on was challeging but theoretically unless the encryption keys were compromised it was a highly secure system.

The network admins estimated about 50 hack attempts per day, mostly originating from the US, China, and Russia.  Now it's worth noting that we never experienced a successful hack of consequence to the Windows OS or to the SSO architecture.

Ocassionally though a crafty user would get free ringtones or figure out how to manipulate a special offer but then they would usually brag about it on one of the web boards (a.k.a. Howerforums.com) which our security officer would quickly find and we could resolve.  However there was one hack on a third party web server that had me sitting in the CIO's office with him demanding an explanation.

It seemed that a billionair heiress to a hotel chain had her A-list phonebook stolen off of a third-party server and it was circulating accross the internet.  I later learned that the breach was socially engineered and not even technical in nature, but none the less it made headlines.

In the days that followed I cringed as I heard various (mostly inaccurate) reports of what happened on everything from the Today show to the Tonight show.  But the most profound report (and also the moral of this post) was right there on the drudge report website.  The extra big headline of coarse was the security breach on this one party girl's phone, when buried down below in small print was the headline that one million federal credit card numbers were stolen from a secure goverment computer system.

So the moral is that it's not always just the size or damage of the hack that matters but it is equally important to consider the perception that your customers will have of a hack.  Leave nothing to chance when it comes to customer data.

I started with VIC 20, then C64, Apple II, PDP-11, DEC 10, IBM mainframes, PIC16F84, Z80 and some other things like that. Some I made myself. When I bought my first Vic20, I spent about 20 minutes with the manual and then wrote my first run-and-shoot game just to get accustomed. That was the only time I ever red a programming manual more than about 50 pages. I wrote programs to drive laboratory X-ray devices, communications systems and data bases and tough mathematics for for example X-ray diagnostics. I tried all possible programming languages and allways returned to Basic. The reason was that the writing was easy and fast.

In PCs I first used GWBasic, then compilers and QBasic. I even wrote Finish keyboard drivers for QB2.0. The extreme top of that line was QB4.5. After that there was a deep downhill. I have tried all the versions of Visual Basic and liked none of them. They are missing the true power of Basic:
In Basic you could write in no time small simple programs to filter data, develop mathematics and get simple graphical views of functions.
Now the simplicity has disappeared. There is NO simple way to make simple mathematic programs in Windows. I now have this VB2005 demo packet and it is simply awfull: One gigabyte of who knows what where QB4.5 could be packed to one floppy. I have spent one evening trying to find  a way to get a directory listing and to open a file to be filtered.
The first step of beginning with VB is too high for a man who just wants to get results, not make beautiful windowzes.

PLEASE MAKE AN EXTREMELY SIMPLE VERSION OF BASIC FOR US, WHO WANT TO USE PROGRAMS IN OUR WORK AND WHO ARE NOT INTERESTED IN GRAPHICAL PROGRAMMING IN ITSELF !

The speed of the running program is not important nor the colors and fonts, when you are going to run the program maybe only one time or ten times. The time you spend thinking the maths and writing the program is what counts !

My time is too valuable to be spent in studying new tricks when I allready know BASIC by heart.

I'll be waiting. During that time I'll move my environment to Linux and continue using Perl and Fortran.

I had just been promoted to webmaster and was in the position for about a month when I noticed on our primary web server a message about "xxyaun.exe has caused an access violation" etc.  Now even though I was a new webmaster, I had a great deal of familiarity with NT 4 and realized very quickly that 1) that particular executable was not part of the MS distribution and 2) nothing else was supposed to be installed on that web server.  I called a few other people on the staff and asked if they knew about it.  After hearing no from everyone I scanned the machine to see what files had been created today.  Much to my horror, I found several that had been uploaded in the last hour.

At that point in time this server was our only public web server.  Regardless, it when down as fast as I could unplug the NIC.

After an extensive review by an outside company we were tasked with the following: secure all pages from SQL injection, install a serious IDS system that can send address blocks to the firewall dynamically, and decrypt and IDS inspect traffic before it reaches the web server.  A lot of work but it let me buy some seriously cool hardware and software.

Lesson learned: assume that if there is a potential vulnerability it will be exploited.  Anyone still using ASP instead of ASP.Net should get with the program.

My Surprise First Day of Work

It’s Saturday night and I am relaxing with friends after a stressful week of interviewing for a new job of Web Developer.  Just the day before, I had my last interview and accepted the position.  I agreed to start on Monday, even though I really could have used a few days of vacation between jobs.  

At 7:30 pm the telephone rang.  

One of the company’s largest clients was having a major emergency and I was asked to come in and help.   Even though I was eager to start my new position, I really wanted to enjoy my weekend before starting the new job.  Besides we were playing a new Xbox game (I believe it was Halo) and had plans to head out for a night on the town.  However, I was persuaded by the offer of a full days pay at double time.

At 8:30 pm I was in hell.

A new virus was wrecking havoc around the world called Slammer.  This virus was completely flooding the client’s corporate network.  Of course this resulted in having to stop production all around the world until a solution was found.  One by one, locations were re-added to the network, all except the location I was standing in.  Our location was still infected and would not be rejoin the rest of the network until the virus was stopped.  

1:00 am and the final culprit was found, my new company!

There was a forgotten installation of SQL Server on a development machine that was running a few applications.  The SQL installation did not have any service packs applied to it (sp3 had the fix for the slammer exploit).  Also, the SA account was created with the default blank password!  

I was told that the blank password was the company standard as it made development easier.  My initial reaction was to run for the door, decline the job, and take comfort in the fact that I may have just preserved my sanity.  After a moment, I simply stated, “Well, I guess that policy will have to change.”

A lot of Websites leave an open view of their source code (HTML). With Frontpage installed and via using IE 6.0, you can click on the FP icon to "Edit with Microsoft Frontpage" and then view the HTML code behind most Websites. A lot of people give away proprietary information in their HTML code.

A friend was boasting about his "secure" Website until I gave him a list of information disclosed via his HTML code that anyone could exploit in a Visual Studio .NET application for their own purposes.

User ID and Password Accepted!  Welcome Mr. Hacker…

As a new venture, our little company was proud to have landed a large client willing to reward us with a lucrative contract.  Having a fairly new team, we were all very excited and equally nervous... the client was very clear security was paramount.  

Unfortunately we began to question our own ability to secure the requested internet application.  This application would allow the client to access patient and employee records processing bills and other tasks through an intranet and give public internet access allowing patients to see and edit their own information.  Seemingly straight forward standard fair!  However, as the solution architecture was fleshed out, we increasingly saw a real demand to bring on experienced security experts.

That decision led us to outsource the security components to an outfit specializing in working with enterprise level applications.  The development completed without any serious difficulties and we all celebrated in a successful deployment.  Unknown to us at the time, it would turn out to be another 2 months of midnight oil and coffee!

Only a week after full deployment and we received our first security call… several bill statements were clearly incorrect and going digital meant no paper trail existed to verify the actual amounts to bill patients!  After a fairly rigorous debugging and retesting of the application, no errors or security flaws could be found.  The zero paper standards quickly reverted back to the old forms.  However, with some assurances, the application’s use was continued.

Right away, the bill statements started reflecting incorrect amounts again!  The only conclusion we could arrive to was that someone was maliciously altering the bill statements.  Frustrated with zero leads, our team looked to the internal auditing set in place by the outsourced security company.  Thankfully it was fairly robust… unfortunately the actions were only related to the employee and not the patient records!  A massive problem that required a lot of re-plumbing!  Once the internal auditing was fixed, a patch was applied and the hunt was on.

We hit another wall.  The auditing told us all admin level users at one time or another changed bill statements.  This just made things even more perplexing.  Finally, we decided to map the IP address of each computer, create a trigger to email us whenever an existing bill statement’s dollar figure was being edited.  Perhaps not the best solution… but we quickly caught the culprit… a disgruntled desk employee with too much time.  He was quickly fired and brought up on criminal charges.

The real kicker was how he got everyone’s user ids and passwords.  It seems the security company wasn’t so experienced after all.  To secure the user id and password, the company resorted to smoke and mirrors and saved the information in an XML file in the hidden Isolated Storage (<systemdrive>\Documents and Settings\<user>\Application Data)!  They honestly believed the information would never be compromised… unless of course your computer is used to input patient records and you have all files showing with admin access (to everyone’s profiles)… like our disgruntled desk employee.

The damage to our client’s reputation and their patients fueled our embarrassment and was enough to have us train all our developers in security and for security to be brought back in-house.  While security can be compromised at any level, it is quite often the simple things that cause the most havoc.

Well I'm not sure if this would be a "security"
story per say, but as we were developing our
server client application we ran into some
"encryption challenges", first off
we were using Managed C++ and C#
and communicated directly via
TCP/IP to Flash 6,7 all was fine and
dandy, our messaging system worked
like a charm.

When development continued, we slowly
but painfully realized that we require,
encrypted messages to go and come
from Flash to and from our Server.

This no doubt proved a small challenge.
Does flash support Encrypted Sockets
out of the box, or do we have to implement
our own encryption.

Painfully realizing flash does not
support encryption at all we had no
choice but to write our own.

Don’t want to be reminded of that painful
lack of support for proper integers, forget
flash doesn't support signed int  !! TWO'S
COMPLEMENT IN FULL EFFECT !,
This was indeed a real pain in the ass,
Thus we could not have pairs of private
keys at 32bits, so we had no choice
but to limit ourselves to 4 pairs of
24bits, and inevitably writing our
own reversible algorithm (with private
key of course), which I wont' get
into detail here.

So after several hours of dispute, I came
up with a simple mechanism that will
hide private key and will allow the
user receive encrypted messages.

First I would like to note that,
the user originally creates his or her
user and password via HTTPS by means
of a web service, and since we cannot
use HTTPS for our server client communication
(considering its a live application,
constantly receiving data) we had
no choice but to write our own Secure
Layer.

So continuing, we simply MD5 hashed
the users username sent it across
to the server, server checks its database
for a match of the MD5 against the user,
when found, takes the password within
the database, encrypts using username
+ password [ split into sets of
24bit numbers of course], generates 4
completely encrypted new keys via a
hardware random generator and then
sends it off to the flash piece,
since the CLIENT knows his or her password
and username it decrypts the message
received, uses the four new keys as
a new base for encryption and sends
off another encrypted message to
the server that confirms authentication,
the server then checks for validation,
and if all is fine and dandy, normal traffic
flows.

And that’s that...

Now how do I get my XBOX ;-)


-- kasra _at_ logiphi _dot_ com

Having worked for various software companies over the years, one of the biggest security threats I found that often go overlooked are what I term to be software "weeds". Whenever I use that term, developers seem to automatically know what I am referring to, because we have all seen it. Those little components or ideas that were never completed or abandonned, but never removed because it was easier. As time goes by those weeds just run deeper and deeper and become more difficult to kill.

Regardless of the tier you are developing keep it clean.

Josh worked for a company that landed a contract to develop a content management system for a fairly large government website. Much of the project involved developing a content management system so that employees would be able to build and maintain the ever-changing content for their site.

Because they already had an existing website with a lot of content, the customer wanted to take the opportunity to reorganize and upload all the content into the new site before it went live. As you might imagine, this was a fairly time consuming process. But after a few months, they had finally put all the content into the system and opened it up to the Internet.

Things went pretty well for a few days after going live. But, on day six, things went not-so-well: all of the content on the website had completely vanished and all pages led to the default "please enter content" page. Whoops.

Josh was called in to investigate and noticed that one particularly troublesome external IP had gone in and deleted *all* of the content on the system. The IP didn't belong to some overseas hacker bent on destroying helpful government information. It resolved to googlebot.com, Google's very own web crawling spider. Whoops.

After quite a bit of research (and scrambling around to find a non-corrupt backup), Josh found the problem. A user copied and pasted some content from one page to another, including an "edit" hyperlink to edit the content on the page. Normally, this wouldn't be an issue, since an outside user would need to enter a name and password. But, the CMS authentication subsystem didn't take into account the sophisticated hacking techniques of Google's spider. Whoops.

As it turns out, Google's spider doesn't use cookies, which means that it can easily bypass a check for the "isLoggedOn" cookie to be "false". It also doesn't pay attention to Javascript, which would normally prompt and redirect users who are not logged on. It does, however, follow every hyperlink on every page it finds, including those with "Delete Page" in the title. Whoops.

After all was said and done, Josh was able to restore a fairly older version of the site from backups. He brought up the root cause -- that security could be beaten by disabiling cookies and javascript -- but management didn't quite see what was wrong with that. Instead, they told the client to NEVER copy paste content from other pages.

Test

Yes! Yes! Yes!
I installed an internet explorer version 7 beta on my friend's business computer. It broke down the software link to a centralized deposity consisting of law documents.

My friend was able to download to the website but unfortunately anything placed there came back as garbage when we retrieved the information.

We finally decided to uninstall version 7 beta and install back IE explorer version 6. Now it works like a charm. My friend is a very happy customer for IE.

Thanks.
Jukifli bin Abas.
email: jukifli.abas@hp.com

We were maintaing our college website ... one day all of sudden our websie got hacked ... through investingating we found out that some body has done sql injection in it . one example of it was, since we have written inline sql queries our query was like

string strQry = "SELECT Count(*) FROM Users WHERE UserName='" +
   txtUser.Text + "' AND Password='" + txtPassword.Text + "'";

but some body entered 'Or 1=1 -- , so sql now become

SELECT Count(*) FROM Users WHERE UserName='' Or 1=1 --' AND Password=''

We solved this problem by introducing regular expression on client side and have put the query in stored procedure ... Now it is save :)

regards,
Rameez Sajwani
email: rameezwazirali@hotmail.com

www.iLinkTech.ca is hosted on a Windows 2003 server(.net 2.0 framework), and several days later after it published, it get hacked by changing my IIS virtual directory, all thing is mess on the server.

Researching msdn and google, and download service package and reset the site, works fine since then.

www.iLinkTech.ca - All in one job search

About a year ago, my company appointed me to consult a government agency in my country, they have a distributed applicaction with smart clients, with a considerable use of design patterns, the security of both the application and the data are essential for the agency.

And that is the scenario for 2 stories:

a) Fragility.
As the deadline for production was approaching, there were minor bugs being corrected by the four developers still involved at that time of the project lifecycle, when suddenly, the Web application that hosted all of our services died on us. No user could log in, nor access any data. At this time we were easy about it, thinking that maybe there was a network trouble and that the smart clients would manage it. To our surprise, there was no traces of any major event at the server, and the clients said that a SOAP header was the responsible. After a couple of hours, we had a diagnostic: we have been overjealused of registering users, and we provided them with client certificates, but also we were registering the user information on a database, to make sure that even having the certificate, their permissions could be revoked in seconds. There was a typing mistake on the name of one of the users. Each time that he logged in, the services died. A bad implementation of a singleton combined with a simple typing mistake. An hour later, we had everything corrected and included all the scenario as a new test.

b) Extensibility.
After implementing the smart client, we make a test of all the cycle, looking for weaknesses, according to our risk tree (STRIDE/DREAD). And we found a relevant one. We were using Application Updater Block, release 2. AUB used an unencrypted connection over http, that defied every standard we had on the security of the application. So we decided to extend the funcionality of AUB, to run over SSL and with client cerficicates. It took us barely over 2 hours on the changes and we submitted it for testing. It passed every test. So the application is actually on production and waiting for a migration to .net framework 2.

omar dot salinas at gmail dot com

My story is little different

Often people say "writing code is about logics" I strongly agree and this particular incident made my belife more stronger.

We developed a webapplication and used a third party system to send automated email & voice message notifications to group of user (user details on 3rd party server). We were able to test the application from North american locations like NY, Houston, Toronto & Vancouver but from Australia and India we were not. We searched on net and tried to embbed correct country codes but still user were not able to test it.

Dufff.....whats happening...Logically if it works for US & Canada it should work for other parts of world too....after doing few quick debug tests but no success...

My home country is India and I use calling cards to call home and what I observe is I need to prefix "011" before i dial my country code and thought to do a quick "logical" test .......wowwww....got it worked.

"logics" are important in development.

I forogt to send my email id

ksnaveen at hotmail dot com

I work for a company that produces a product for wealth advisors. We got a call from one who said that for some reason when his client was logging into the system he was getting another clients data. Upon further review of the situation (Since advisors are not that bright) it turned out that one client user name was "J Bell" and another one was "JBell" however because they are so creative with passwords, both advisors had giving the client the same password "Password1" :) and when the advisor told the one client his username, which was really the "J Bell", he didn't tell him about the space so he entered "JBell" and the password "Password1" and was getting the other clients info...DUH..He was logging in as the other client :)

You posted the story so how do we get the XBox360?

nickd@emoneyadvisor.com

send me one or im suing for false advertisement.

Here's mine. Some time ago I was working for a company where I was developing a web application that consumed one web service to get data needed by the application. Once I was testing the web application I noticed that the web service that I was calling to get data for this application didn't have the database connection strings encrypted. The connection strings where stored in a web.config file which was in a network folder that everybody had access to from inside our network. I suggested we secured that folder to prevent unauthorized people from reading the web.config file and its contents (such as the db connections strings with passwords and everything). I was told they could not do for reasons that I was not suppossed to know. Then I suggested we encrypt the file or at least the connection strings in the file to prevent people to see them...I was told the following: "Are you crazy? this file is not accessible from the outside and there are not issues about internal security, do not be paranoid" I tried to explain that even if they trusted all employees there was always the possibility of someone gaining access to our network and then have full access to this file and its contents...and much more files if they didn't secure the network shares and directories. The answer given to me was "Just don't worry about it, that is our job" After a while I left that company, it didn't feel right to work there.

Here's mine. Some time ago I was working for a company where I was developing a web application that consumed one web service to get data needed by the application. Once I was testing the web application I noticed that the web service that I was calling to get data for this application didn't have the database connection strings encrypted. The connection strings where stored in a web.config file which was in a network folder that everybody had access to from inside our network. I suggested we secured that folder to prevent unauthorized people from reading the web.config file and its contents (such as the db connections strings with passwords and everything). I was told they could not do for reasons that I was not suppossed to know. Then I suggested we encrypt the file or at least the connection strings in the file to prevent people to see them...I was told the following: "Are you crazy? this file is not accessible from the outside and there are not issues about internal security, do not be paranoid" I tried to explain that even if they trusted all employees there was always the possibility of someone gaining access to our network and then have full access to this file and its contents...and much more files if they didn't secure the network shares and directories. The answer given to me was "Just don't worry about it, that is our job" After a while I left that company, it didn't feel right to work there.

ricardo_gdl at hotmail dot com

I had a great experience with a popular ASP based WebMail system a few years ago (it was discussed on NTBugTraQ) that had a monstrous hole that I discovered and subsequently had to work around because the vendor would not provide a patch. "Our next version will not have this problem -- please upgrade $$$" was the official line.

The webmail system had the standard features; view all your mail online, make server-side folders, send attachments etc. I was assigned the role of installing the system on a test box and giving it a run through. I set up it easily enough and set down to try out a couple of penetration tests.

At this time, the Scripting.FilesystemObject activex object was lying dormant on NT4 systems, ready to bite the ass of many an inexperienced shared hosting company. It was commonplace at the time for these companies to partition clients using different IIS virtual servers running on the same physical box. These IIS instances also ran using the same IUSR_MACHINENAME guest account. Since upload of content was done via FTP, they could control where you put your files through ftp virtual directories. I knew at the time that you could get around this by abusing the FSO object by uploading an ASP file that used it to browse the entire local hard disk, thus exposing the source code of any other clients on the same machine. You could glean all sorts of interesting info from pages like ODBC connection credentials, embedded passwords from being able to read raw ASP pages since nothing was compiled like asp.net back then. The correct way to secure a shared environent s to create separate IUSR guest accounts for each virtual server, but noone did this.

So, back to the original story: I loaded the webmail homepage, registered an account and had a look around. I noticed that when I sent myself an attachment, it was exposed through a virtual directory when browsing my own mail online. You can probably guess the rest. I proceded to send myself an ASP page as an attachment and tried to download it from the webmail. Of course, the virtual directory was script enabled: instead of allowing me to download the asp page attachment, the server executed it. Doh. With a properly contructed attachment, I was able to dump the contents of the webmail's own asp pages and work out how to read every other users' mail on the system. I was able to get ahold of all their attachments, and do anything else that the IUSR account could do, which was quite a bit more than it should have been able to do. It turns out too that it was impossible to turn off the script bit for that virtual directory due to the way the webmail application was designed.

This was back in the late 90's and surprisingly there are plenty of web apps around today that are still vulnerable in the same way.

- Oisin G.

PingBack from http://www.msblog.org/?p=444

How about the story where the XBox 360 firmware got hacked due to Microsoft leaving it wide open.

The single easiest way to hack a good portion of hardware devices and applications is to simply scan the text of the executables using something as simple as Notepad. I was able to hack a wireless router (details available, but not here; to save the manufacturer some embarassment) because it has a backdoor password (in the embedded firmware).

By simply going to the router manufacturer's website, downloading an update to the firmware and scanning for text in that update with Notepad, I discovered a master password into the router.  I noticed the unusual word "buddha" in the the text, which I tried as a password into the configuration page of the router and it worked.

If that backdoor capability is essential to the product and needs to be there, the security flaw could still have been avoided if the developer assembled the password at run-time by concatenating small pieces of text into the desired password.  A better way is to assemble the password from two binary strings, each with bits that are XORed together into the final password.

Yes, sure, being a developer of desktop applications i thought of using .NET,
but spent so many days searching for good tool that would prevent cracking (disassembling and decompilation) my programs that i've though it would be good to have the portal called:

"Dotnet OFFline magazine"

Gathering all developers that had to face the same problem. And making free of charge,
hosting sponsored by Microsoft that is,
the powerfull tool to have us a better
sleep.

These days i've tried to used Anti-Reflector
produced early this Year by Russian programmers. Good tool i say.

Cheers to all who are first humans,
then programmers.

p.s. Still using .NET and unmanaged C++

I`m a student from a tecnology school and my first class was about lan security bridge my teacher tell us to make a security code for a wimax system, i`d try to make a program run a low band that not cost to much to the server
and i program this on pascal the first time we run it he catch all the movement from my school web and among all this traffic we received 1 milion of non authorized acess after i realized this project this number fall to zero, and i receive a program premium
Thanks and bye  

after many years of working at a call center that does tech support for a computer manufacturer, i've seen almost every trick used by the phone techs in order to get around the websense security software we have in place, they done everything from looking up a website's ip and adding it to the hosts file of the computer, to using a fee based proxy like proxify.com, the other day i'm walking thru the call center and i see a tech strugling to get open his workstation, he aproaches me and asked me if I know how to get it open so he can connect the cd rom drive, I say yes, why?, he tells me he is been working all of this long hours taking call after call, after call, he is tired of not being able to access the web during work, so I asked him what is he going to do, he says well, i came across this program that will allow me to change the admin password so i can install another browser and thru a proxy connected to my home computer i can have  unlimited access to the web while he works, then I ask myselfhow is it that he is planing how to do all that when he does not even knows how to open one of the computer cases made by the computer company he takes tech support calls for?. Then I ask myself, should I teld him who I'm,  what should I do about this, laugh since he does not even knows how to open the case, or get him fired for attempting to tamper with the company's hardware and possibly putting at risk the callcenter's network?
Well I just kept on walking,....


Thanks

Andres V

I was consulting for a small digital assets management firm doing testing and development analysis, and found massive buffer overflow holes all over their product. It turned out that one of the previous developers was going mad with pointers, and wasn't freeing up anywhere. The code was an absolute maze, and almost impossible to navigate.

So, working nights and weekends, I converted the entire system over to a Visual C# solution, and performance went through the roof. Furthermore, they've gone 2 years without a single security hole!

Nowadays, all of the saved peoplehours from patching security holes are being converted into real progress being made at this organization. And since Visual C# is the development environment, they are achieving RAD style development with C++ performance.

We have a product based on a Microsoft Gina replacement that hooks in to our own custom user store and lets them log in using borrower number and pin rather then username and password.

One time we noticed someone had managed to stop the system clock somehow and was getting loads of extra time - which I had not considered in the replacement Gina's resource management thing to boot them off.

So I put that in, but at the same time if it detected time-travel it would play "that's all folks" through the system speaker before logging them off.  Not very nice for anyone in a library ;-)

In a project I did 2 years ago. The Architecture was as follow: WinForms/Smart client as UI. a Server Side with a connection to the Database. We took security in mind so beyond code checking for security exploits and having our database rights to only stored procedures. we also used WSE 2.0 to encrypt and sign the messages from the client to the server. Since this application was deployed on an Intranet we used Windows Authentication.

After completing version 1.0 we had to add support to allow Java application (mainly wrapper for mainframe apps) to connect and use some of our webservices. Java is unable to connect to WSE 2.0 web services, no mention the windows authentication security in the message nor the encrypt and sign of the messages. We had to "open" the webservices for the java clients.

The solution was to build a new set of web services, simple ones, not WSE 2.0 and have them use the same interfaces as our WSE 2.0 services, then route the request using a specific windows account to the regular WSE 2.0 services.

This is a very bad architecture, since it is a security hole. But when we found out that every computer in the company can access the mainframe, we sattle for this design. Further, it was approved by the security team (3rd party consultant company).

So again, business "rules" can force you to have security holes.

I have a pretty good security story to tell.

I had completed a web application and had deployed it, then someone in the network admin group wondered why I had encrypted all of my key values in the web.config file.  I mentioned to them about the immense traffic the site receives daily and it was essential that this encryption be in place.  The network admin group advised me to go back and unencrypt all the key values in the web.config file so they could more easliy maintain the web site.

A few weeks later, the web site was hacked. The network admin group no longer questions my advise.


joseph_d_davis@msn.com

An interesting story does come to mind.

I am one of the developers creating an enterprise remoting server system for asset tracking.  The one issue came to mind was that some customers who purchased our software would use it, but when an issue came up with it, they called it in, but their support contracts expired.  This was an issue because we had no licensing model associated with it, and that they continued to transfer software to another machine, which made system troubleshooting more difficult.  I decided on a new license model that will lock in what server the software can be install upon by using hardware Id's, much like how microsoft does their licensing.  The problem i ran into was that most of the license models was too complicated for just generic input of the license key, especially when we want to put the key on the packaging.

To alleviate this, I created a custom Algorithm class inheriting from the Triple DES class to make all values alphanumeric, then use combinations to distinguish specific letter types.  Added in was also to find certain hardware serial numbers to create a unique Id to make sure that the computer was in fact the computer we installed the software on.  Now with this new class, plus a connection to our servers that links up with our internal customer account servers, we can actually remind customers that their payments are past due, when support will cease, and give them an option to renew their information anytime.  It was a hassle with the algoritm but it turned out quite well, as well as the ability to add more information into the license whenever we decide on a feature change!

chcosgrove@verizon.net

When I started my current position three years ago the company had just completed a migration to a new HR system from one of the ‘Best’ companies. This system relies on SQL Server logins for manager login authentication. We have over fifty managers. All were assigned as System Administrators. Even better I ran checks against their passwords, most of which were very guessable. All set up by the HR software company.

john.major@citcomm.com

hello! http://www.areaseo.com/contacts/ google pr. Professional SEO, pagerank algorithm, Web Site Analysis. From google pr .

online directory main

Welcome!!! http://www.dirare.com/Sweden/">http://www.dirare.com/Sweden/ online directory. [URL=http://www.dirare.com]YP national[/URL]: MY yellowpages, SMART Yellow Pages, About DIRare. Also [url=http://www.dirare.com]global directory[/url] from online directory .

Welcome!!! http://www.areaseo.com/contacts/">http://www.areaseo.com/contacts/ google pr. [URL=http://www.areaseo.com]pagerank 5[/URL]: Web Site Analysis, SE marketing, High Rankings. Also [url=http://www.areaseo.com]online pr16[/url] from google pr .

hello! http://www.areaseo.com/contacts/ google pr. Web Site Analysis, SE marketing, High Rankings. From google pr .

Welcome!!! http://www.areaseo.com/contacts/">http://www.areaseo.com/contacts/ google pr. [URL=http://www.areaseo.com]pagerank 5[/URL]: Professional SEO, pagerank algorithm, Web Site Analysis. Also [url=http://www.areaseo.com]online pr16[/url] from google pr .

hello! http://www.areaseo.com/contacts/ google pr. Professional SEO, pagerank algorithm, Web Site Analysis. From google pr .

online directory main

Welcome!!! http://www.areaseo.com/contacts/">http://www.areaseo.com/contacts/ google pr. [URL=http://www.areaseo.com]pagerank 5[/URL]: pagerank algorithm, Web Site Analysis, SE marketing. Also [url=http://www.areaseo.com]online pr16[/url] from google pr .

hello! http://www.areaseo.com/contacts/ google pr. pagerank algorithm, Web Site Analysis, SE marketing. From google pr .

online directory main

Quit spamming the damn board morons.

hello! http://www.dirare.com/Sweden/ online directory. About DIRare, Search in Business Category, Yellowpages search. From online directory .

Ready to accept the challenge to develop the big market for Xbox 360

Here only the valuable information!!!

http://vaquin.sitesfree.com/levaquin-tablet.html

Too much for me to comment on.

PingBack from http://imani.lockcontainer.com/xbox360hardskin.html

PingBack from http://backyardshed.info/story.php?title=paul-maher-s-blog-would-you-like-us-to-give-you-an-xbox-360

PingBack from http://paidsurveyshub.info/story.php?title=paul-maher-s-blog-would-you-like-us-to-give-you-an-xbox-360

PingBack from http://hammockstandsite.info/story.php?id=17959

PingBack from http://weakbladder.info/story.php?id=2261

PingBack from http://insomniacuresite.info/story.php?id=1844

PingBack from http://cellulitecreamsite.info/story.php?id=719

PingBack from http://quickdietsite.info/story.php?id=150

PingBack from http://adirondackchairshub.info/story.php?id=178

PingBack from http://einternetmarketingtools.info/story.php?id=7818

PingBack from http://workfromhomecareer.info/story.php?id=12940

PingBack from http://fixmycrediteasily.info/story.php?id=2008

PingBack from http://debtsolutionsnow.info/story.php?id=69

where should i send the xbox 360 to ?