This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Template:Application Security News"

From OWASP
Jump to: navigation, search
Line 11: Line 11:
 
; '''Dec 2 - [http://blogs.oracle.com/security/2006/11/27#a39 Oracle blames security researchers]'''
 
; '''Dec 2 - [http://blogs.oracle.com/security/2006/11/27#a39 Oracle blames security researchers]'''
 
: "We do not credit security researchers who disclose the existence of vulnerabilities before a fix is available. We consider such practices, including disclosing 'zero day' exploits, to be irresponsible." So the question on everybody's mind - is the [http://www.oracle.com/security/software-security-assurance.html Oracle Software Security Assurance] program real? Or are David Litchfield and Cesar Cerrudo right that Emperor has no clothes?
 
: "We do not credit security researchers who disclose the existence of vulnerabilities before a fix is available. We consider such practices, including disclosing 'zero day' exploits, to be irresponsible." So the question on everybody's mind - is the [http://www.oracle.com/security/software-security-assurance.html Oracle Software Security Assurance] program real? Or are David Litchfield and Cesar Cerrudo right that Emperor has no clothes?
−
 
−
; '''Nov 30 - [http://www.whitehatsec.com/home/resources/articles/files/myth_busting_ajax_insecurity.html What? Ajax is secure now?]'''
 
−
: Nice article making the point that Ajax is not necessarily insecure. Read it carefully folks - it isn't easy to build a secure Ajax application, just possible. And remember that although the article doesn't mention it, Ajax apps use new parsers and interpreters that haven't been very well tested for security.
 
−
 
−
; '''Nov 30 - [http://vote.nist.gov/DraftWhitePaperOnSIinVVSG2007-20061120.pdf Democracy Schlemocracy]'''
 
−
: A paper from NIST argues that touchscreen voting machines are "more vulnerable to undetected programming errors or malicious code" and that "potentially, a single programmer could 'rig' a major election."
 
−
 
−
; [[Image:Database_security_comparison.jpg|right|200px]]'''Nov 28 - [http://www.databasesecurity.com/dbsec/comparison.pdf Litchfield slams Oracle lack of SDL]'''
 
−
: David Litchfield presents some very compelling evidence that Microsoft's SDL is paying off. A very interesting read. Not surprisingly, Microsoft is [http://blogs.msdn.com/michael_howard/archive/2006/11/22/microsoft-beats-oracle-in-security-showdown.aspx gloating] a little.
 
−
 
−
; '''Nov 28 - [http://link Foreign software - threat or xenophobia?]'''
 
−
: Ira Winkler - "If there is one line of code written overseas, that’s one line too many. Developing it in the U.S. is not perfect, but we are talking about an exponential increase in risk by moving it overseas." John Pescatore - the focus on offshore developers is "xenophobia" but said the software security concerns raised by the DOD should serve as a useful wake-up call for all organizations that buy software.
 
  
 
; [[Application Security News|Older news...]]
 
; [[Application Security News|Older news...]]

Revision as of 15:50, 13 December 2006


Dec 13 - UCLA spins massive breach
Why not just say what measures you've really taken? Are all developers trained? Do you do code review and security testing? "Jim Davis, UCLA's chief information officer, said a computer trespasser used a program designed to exploit an undetected software flaw to bypass all security measures and gain access to the restricted database that contains information on about 800,000 current and former students, faculty and staff, as well as some student applicants and parents of students or applicants who applied for financial aid. 'In spite of our diligence, a sophisticated hacker found and exploited a subtle vulnerability in one of hundreds of applications,' Davis said in the statement."
Dec 10 - MySpace and Apple mess
MySpace and Apple show how NOT to handle security incidents (see also How Not to Distribute Security Patches)
Nov 28 - JBroFuzz 0.3 Released
This version adds a more stable core, length updating for fuzzed POST requests and allows you to specify your own fuzz vectors in a separate file.
Dec 2 - Oracle blames security researchers
"We do not credit security researchers who disclose the existence of vulnerabilities before a fix is available. We consider such practices, including disclosing 'zero day' exploits, to be irresponsible." So the question on everybody's mind - is the Oracle Software Security Assurance program real? Or are David Litchfield and Cesar Cerrudo right that Emperor has no clothes?
Older news...
Retrieved from "https://wiki.owasp.org/index.php?title=Template:Application_Security_News&oldid=14313"