Monthly Archives: September 2012

Surviving the Week 9/28/12

Passwords of 100k IEEE members lie bare on FTP server IEEE uses Akamai for content delivery. A FTP directory server was discovered which contained log files of username, password, IP addresses and HTTP request information. …

Full Article →

Surviving the Week 9/21/12

2012 HouSecCon, 10/11/2012 (in Houston) HouSecCon is coming up – October 11th in Houston. The agenda is shaping up with a bunch of hot topics and well-known speakers. I’ll (Dan Kuykendall) be speaking on mobile…

Full Article →

Surviving the Week 9/14/12

Surviving SQL Injection (link to free SQL Injection tool) SQLInjection continues to be in the news each week. Despite the fact that it the most well understood vulnerability, it remains the most popular attack technique…

Full Article →

Surviving the Week 9/7/12

A Number of Exploits Including SQL Injection, XSS, and Authentication Bypass This week, researchers found some remarkable vulnerabilities including Remote code execution, SQL Injection, and Cross-Site Scripting within bug tracking systems as well as in…

Full Article →

Surviving the Week 8/31/12

XSS: Gaining Access to HttpOnly Cookie Using the method getHeaderField in the Java HTTP API, any applet can access cookies with the HttpOnly flag set. This proves that enabling the HttpOnly flag does not protect…

Full Article →