Vulnerabilities and Vulnerability management
Fix the problem, not just point at it – thoughts on the “bug hunting” initiatives etc.
I have been thinking a lot about the fact that the panetesting, sourco code reviews and all those security assurance problems just point out the problem. Fixing the discovered application security issue however is a prerogative of the developers which unfortunately are still lacking security expertise. Bug hunters and zero days discoverers have been long…
MITRE issued their perspective on most dangerous software errors
Software is everywhere those days, and unfortunately bad codding practices together with tight schedules and demanding market brings tones of vulnerabilities. Of course there are people that are happy to find out the holes and exploit them. CWE recently published their opinion regarding the software errors summarizing it in a document called “2011 CWE/SANS Top…
Long live GSM insecurity
During the second day of the 27th Chaos Communication Congress Karsten Nohl and Sylvain Munaut demonstrated why gsm calls and messaging should be considered insecure more than ever. For details visit the congress website. Enjoy!
Mozilla launches bug hunting program
Bug hunting programs seem to gain more and more popularity those days. The new kid on the block is the Mozilla one, which official guidelines can be find on https://www.mozilla.org/security/bug-bounty.html So for all of you hunters I would like to wish you good luck and happy hunting 😉 Enjoy!
Acrobat Reader under siege again or Why to update Acrobat Reader?
Adobe still fights the ripples from the vulnerability announced on 15.12.2009. All the versions prior 9.2 are vulnerable to malicious Javascripts that allow shell execution attack to be successfully performed. The colleagues from Trend Micro had spotted a new malware able to exploit this particular vulnerability. More info on: http://blog.trendmicro.com/unpatched-adobe-vulnerability-is-still-being-exploited-in-the-wild/
Recent Posts
Tags
bruteforce bug bounty bug hunting Burp Suite d3 data leak data recovery dictionary entropy pool fix fuzzing hackaday image processing Journalistic tools log analysis malware mindmap online courses Practical Reverse Engineering randomness sandbox skype SQL injection SSL technical visualisaiton visualisation Vulnerability Management Wanda the fish Zeus