-
Good mine of photos for Wikipedia articles among others.
-
Triangulating the “Media Bloggers Association.”
-
A proposal for detecting XPath injection vulnerabilities. Surely it can’t be that simple.
-
Privilege escalation appears to be the fault of the Apple Remote Desktop Agent, not specifically AppleScript.
-
TechCrunch picks up on the “MBA” mystery.
-
Recommendation for rearchitecting the stack to detect manipulated return addresses–claims to render buffer overflow vulnerabilities harmless. Interesting.
-
BSO office is warning listeners about the Amanda Palmer show. Um, I thought this was supposed to be an audience building move.
-
Fuzzy legal logic calls connecting to open wireless access points “theft.” Slashdot points out that a wireless access point is like asking someone to come in: http://hardware.slashdot.org/article.pl?sid=08/06/19/1411204&from=rss.
-
Dave takes a balanced look at the AP blogging coverage.
-
2009 budget interactive and wallchart infographic.
-
Oboy. You have to watch the video on Boston.com. (The one on the BSO site is, frankly, a little patronizing.)
-
Snark snark snark. Lovely. I enjoyed the film but this is dead on.
-
Oboy. Just as I finish listening to all my music collection, Doc Searls turns me on to another killer radio station. Get well soon, Doc.
Day: June 19, 2008
Resources for application security education
As I’ve been getting myself up to speed in learning about application security, a few resources have been extremely helpful.
A good general background on application security issues, unsurprisingly, is contained in The Art of Software Security Testing, co-authored by Veracode cofounder Chris Wysopal. The book goes beyond the basic description of classes of application security vulnerabilities into specific recommendations for testing strategies and ways to improve the software development lifecycle to avoid introducing vulnerabilities.
There have been a few pivotal written works about how certain classes of software vulnerability work. The canonical one is the Cult of the Dead Cow’s “The Tao of Windows Buffer Overflow,” written by veteran hacker Dildog. Written in a clear and easy to read (if profane) style, this work should scare the living bejeezus out of you.
There are some more business friendly summaries of other vulnerability classes available. One source for this information is Veracode’s own web site, which features clear explanations of SQL injection and cross-site scripting (XSS).
Serious new Mac OS X escalation of privilege vulnerability
Slashdot is reporting a new escalation of privilege vulnerability in Mac OS X 10.4 and 10.5. The details are a little sparse, but it appears that calling the Apple Remote Desktop Agent (ARDAgent) from AppleScript allows execution of arbitrary code with root privilege. Bad, for sure.
The mitigation is that it requires execution as the currently logged in user from the UI session, and apparently can’t be initiated over an SSH or other remote connection unless the attacker can log in as an account that is currently physically logged in on the machine. However, at a minimum it allows brute-forcing root access on any kiosk or other restricted machine that can be physically accessed. And one intelligent poster points out that all it takes is a phishing exploit that gets the user to execute the code on their own machine to open things wide up for a remote assailant–or a buffer overflow in (Safari, QuickTime, Flash, Firefox) that allows starting a shell.
Incidentally, simply disabling remote access is insufficient to prevent the attack. The ARDAgent.app must physically be removed from the machine. (For those interested, it’s usually found in /System/Library/CoreServices/RemoteManagement/.)
Apple needs to close this pronto.