SecurityFeed.info » Michael Howard's Web Log

Feeds

23797 items (23797 unread) in 97 feeds

• Aviv Raff On .NET (18 unread)
• Bugtraq (bugtraq) Mailing List (605 unread)
• CGISecurity.com: Your Web Site and Application Security Resource (74 unread)
• christian's weblog (25 unread)
• Irongeek's Security Site (125 unread)
• Jeremiah Grossman (74 unread)
• Heorot.net (11 unread)
• milw0rm.com (440 unread)
• Nmap Hackers (nmap-hackers) Mailing List (7 unread)
• Packet Storm Security Advisories (373 unread)
• Packet Storm Security Exploits (461 unread)
• Packet Storm Security Headlines (376 unread)
• Packet Storm Security Last 100 (1841 unread)
• Packet Storm Security Last 20 (833 unread)
• Packet Storm Security Last 50 (1441 unread)
• Packet Storm Security Last Files (544 unread)
• Packet Storm Security Miscellaneous Files (109 unread)
• Packet Storm Security Tools (113 unread)
• Rootsecure.net (691 unread)
• SecuriTeam.com (184 unread)
• Security Vulnerability Research & Defense (36 unread)
• SecurityFocus News (139 unread)
• SecurityFocus Vulnerabilities (802 unread)
• Securityvulns news channel (336 unread)
• SecWatch - Latest Exploit Alerts (10 unread)
• Taking Network Security to the Streets (28 unread)
• The One And Only Matt Parnell.com (34 unread)
• The Register - Security (388 unread)
• The Register - Software (456 unread)
• VulnWatch (vulnwatch) Mailing List (19 unread)
• Web App Security (webappsec) Mailing List (88 unread)
• IceСμbeς (15 unread)
• Linmagazine (186 unread)
• ‫netcraft Bytes :) (38 unread)
• Digg (4021 unread)
• Blonde 2.0 (51 unread)
• The Microsoft Security Response Center (MSRC) (40 unread)
• (IN)SECURE Magazine Notifications RSS (17 unread)
• 0x000000 Security (78 unread)
• ----- Anti-Malware ----- Analysis and Defense (15 unread)
• Apple Fun (25 unread)
• Technorati Search for: aviv.raffon.net (201 unread)
• C.I.S.R.T. (10 unread)
• Determina Zero-Day Protection (6 unread)
• Didier Stevens (47 unread)
• eEye Digital Security - Research Blog (10 unread)
• Ryan Naraine's Security Watch (96 unread)
• Security - RSS Feeds (179 unread)
• Exploit Prevention Labs (28 unread)
• Software Vulnerability Exploitation Blog (22 unread)
• F-Secure Antivirus Research Weblog (74 unread)
• Full Disclosure (290 unread)
• George Ou (10 unread)
• GNUCITIZEN Media Portfolio (65 unread)
• ha.ckers.org web application security lab (35 unread)
• heise security (342 unread)
• invisiblethings' blog (35 unread)
• Jeff Jones's blog (12 unread)
• JScript Blog (16 unread)
• Matasano Chargen (38 unread)
• McAfee Avert Labs (66 unread)
• Michael Howard's Web Log (26 unread)
• PandaLabs (35 unread)
• Zero Day (273 unread)
• SANS Internet Storm Center, InfoCON: green (231 unread)
• Latest Secunia Security Watchdog Blog Entries (24 unread)
• SecuriTeam Blogs (65 unread)
• Security Fix (115 unread)
• HP ASC Portal (30 unread)
• Strike Center (12 unread)
• Sunbelt Blog (216 unread)
• Sunnet Beskerming Security Advisories (29 unread)
• Technobabylon
• The Recurity Lablog (31 unread)
• Wired: Threat Level (454 unread)
• TrendLabs | Malware Blog - by Trend Micro (158 unread)
• Uninformed Journal (44 unread)
• WabiSabiLabi's blog (22 unread)
• WatchGuard Wire (48 unread)
• Latest Blog Entires From WebSense Security Labs (42 unread)
• Hackszine.com (151 unread)
• DVLabs: Blogs (63 unread)
• Errata Security (81 unread)
• Robert Hensing's Blog (71 unread)
• PaulDotCom Community Blog (10 unread)
• David LeBlanc's Web Log (20 unread)
• Billy (BK) Rios (19 unread)
• David Litchfield's blog (21 unread)
• Farfromr00tin (23 unread)
• aut disce, aut discede (17 unread)
• pwn* (16 unread)
• hackademix.net (42 unread)
• SecurityDot Vulnerabilities (421 unread)
• Vulnerabilities & Exploits (29 unread)
• Malicious Code (26 unread)
• Security Risks (21 unread)
• Digg / Security / upcoming (4162 unread)

Michael Howard's Web Log (10 unread)

• August 27, 2008
• 20:36

  SDL and the XSS Filter

   » ‎ Michael Howard's Web Log

  Close on the heels of David Ross' XSS defense in IE8 beta 2, my boss, Steve Lipner just posted an article looking at XSS filter from an SDL perspective.

  While I'm on the subject of XSS and Dave, if XSS is an area of interest to you, you really should follow his blog. He's a member of our group focused mainly on browser and desktop-related defenses.

  
• August 22, 2008
• 23:57

  Overlong UTF-8 Escapes Bite

   » ‎ Michael Howard's Web Log

  Every once in a while a security bug pops up that really piques my interest, and a new directory traversal bug that affects Apache Tomcat (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2938) most certainly made me take notice because I haven't seen this bug type in a lllooonnnggg time.

  It caught my eye because of these six little characters:

  %c0%ae

  Many people think these characters represent a 16-bit Unicode character. Wrong. They are an invalid sequence of characters that represent the ‘.' (%2e) character, it's often called an "overlong UTF-8 escape". You may be wondering why I know this little piece of trivia about UTF-8; IIS4 and IIS5 were bitten by the same class of bug eight years ago, and was an attack vector for the Nimda worm. The bulletin that fixed the bug is MS00-078.

  Thumbing to page 379 of Writing Secure Code 2^nd Edition, I am reminded that the canonical form of a UTF-8 character is the smallest number of bits that can represent that character. Remember, UTF-8 can encode characters wider than 8 bits. Without going into all the involved bit-manipulation, the correct form for a ‘.' character is a one-byte escape: %2e, not a two-byte escape: %c0%ae.

  RFC 3629 states that "Implementations of the decoding algorithm MUST protect against decoding invalid sequences."

  UrlScan for IIS6, and IIS7's Request Filtering detect and reject non-canonical UTF-8 URLs by default.

  A patch for Apache Tomcat is available at [tomcat.apache.org].
• August 18, 2008
• 19:18

  Matt Miller Joins the Security Science Team!

   » ‎ Michael Howard's Web Log

  Good news! Matt Miller, author of plenty of cutting-edge security research, including my fave “A Brief History of Exploitation Techniques and Mitigations on Windows” has joined the Security Science team to work on improved ways to find security vulnerabilities and better software defenses through mitigations. Most recently, Matt’s been focused on design review for Windows 7.
   
  Matt brings a massive amount of real-world exploit and defense experience to our team. Learn more about Matt here.

  It’s wonderful to see us hiring more talent like Matt.
   
  Welcome, Matt.
  

  
• 19:18

  Matt Miller Joins the Security Science Team!

   » ‎ Michael Howard's Web Log

  Good news! Matt Miller, author of plenty of cutting-edge security research, including my fave “A Brief History of Exploitation Techniques and Mitigations on Windows” has joined the Security Science team to work on improved ways to find security vulnerabilities and better software defenses through mitigations. Most recently, Matt’s been focused on design review for Windows 7.
   
  Matt brings a massive amount of real-world exploit and defense experience to our team. Learn more about Matt here.

  It’s wonderful to see us hiring more talent like Matt.
   
  Welcome, Matt.
  

  
• August 14, 2008
• 23:20

  Security is bigger than finding and fixing bugs

   » ‎ Michael Howard's Web Log

  I just wrapped up a post over on the SDL blog with some comments about an article on Google's security work.

  
• August 13, 2008
• 2:56

  How Very True

   » ‎ Michael Howard's Web Log
  [twitter.com]
• July 31, 2008
• 23:53

  Improve Security with "A Layer of Hurt"

   » ‎ Michael Howard's Web Log
  I just wrote a post  over on the SDL blog about how to get started with fuzzing,...
• July 29, 2008
• 22:51

  Insecure 3rd party software updaters

   » ‎ Michael Howard's Web Log
  Gotta love Robert's sarcasm.. but he's right.
• July 03, 2008
• 1:35

  SQL Server and the Windows Server 2008 Firewall

   » ‎ Michael Howard's Web Log
  SDL alum, Shawn Hernan (now in the SQL Server team), has written an excellent post about SQL Server 2008, Windows Server 2008 and the impact of the firewall being enabled by default in Windows Server 2008, the first time we have enabled a firewall by default in our server operating system. If you're a SQL Server admin, you really should read his post.
• June 07, 2008
• 7:31

  More on Heap Corruption and Process Termination

   » ‎ Michael Howard's Web Log
  I just added a post over on the SDL blog about heap corruption and process termination as well as some caveats you should be aware of if you use your own custom heap manager.