Application Development – Page 2 – Computer Security Articles

Credit to Author: Lucian Constantin| Date: Mon, 27 Feb 2017 10:41:00 -0800

A recently announced SHA-1 collision attack has the potential to break code repositories that use the Subversion (SVN) revision control system. The first victim was the repository for the WebKit browser engine that was corrupted after someone committed two different PDF files with the same SHA-1 hash to it.

The incident happened hours after researchers from Google and Centrum Wiskunde & Informatica (CWI) in the Netherlands announced the first practical collision attack against the SHA-1 hash function on Thursday. Their demonstration consisted of creating two PDF files with different contents that had the same SHA-1 digest.

To read this article in full or to leave a comment, please click here

ComputerWorld Independent

Why you need a bug bounty program

February 21, 2017February 21, 2017 admin Application Development, IDG Insider, Security

Credit to Author: Mary Branscombe| Date: Tue, 21 Feb 2017 12:50:00 -0800

Every business needs to have a process in place for handling security vulnerability reports, but some organizations take a much more proactive approach to dealing with security researchers.

To read this article in full or to leave a comment, please click here

ComputerWorld Independent

Java and Python FTP attacks can punch holes through firewalls

February 21, 2017February 21, 2017 admin Application Development, Java Development, Security

Credit to Author: Lucian Constantin| Date: Tue, 21 Feb 2017 10:11:00 -0800

The Java and Python runtimes fail to properly validate FTP URLs, which can potentially allow attackers to punch holes through firewalls to access local networks.

On Saturday, security researcher Alexander Klink disclosed an interesting attack where exploiting an XXE (XML External Entity) vulnerability in a Java application can be used to send emails.

XXE vulnerabilities can be exploited by tricking applications to parse specially crafted XML files that would force the XML parser to disclose sensitive information such as files, directory listings, or even information about processes running on the server.

Klink showed that the same type of vulnerabilities can be used to trick the Java runtime to initiate FTP connections to remote servers by feeding it FTP URLs in the form of ftp://user:password@host:port/file.ext.

To read this article in full or to leave a comment, please click here

ComputerWorld Independent

JavaScript-based attack simplifies browser exploits

February 15, 2017 admin Application Development, Application Security, Security, Web Browsers

Credit to Author: Lucian Constantin| Date: Wed, 15 Feb 2017 10:13:00 -0800

Researchers have devised a new attack that can bypass one of the main exploit mitigations in browsers: Address space layout randomization (ASLR). The attack takes advantage of how modern processors cache memory and, because it doesn’t rely on a software bug, fixing the problem is not easy.

Researchers from the Systems and Network Security Group at Vrije Universiteit Amsterdam (VUSec) unveiled the attack, dubbed AnC, Wednesday after having coordinated its disclosure with processor, browser and OS vendors since October.

ASLR is a feature present in all major operating systems. Applications, including browsers, take advantage of it to make the exploitation of memory corruption vulnerabilities like buffer overflows more difficult.

To read this article in full or to leave a comment, please click here

ComputerWorld Independent

Accenture wants to help businesses secure their blockchains

February 8, 2017 admin Application Development, encryption, Security

Accenture wants to help businesses use blockchain technologies more securely by locking away the encryption keys they use to sign transactions.

It’s built a system that blockchain developers can use to store credentials in specialized cryptoprocessors called hardware security modules (HSMs).

HSMs are typically used by banks to store the PINs associated with payment cards or the credentials used to make interbank payments over the SWIFT network, and are much more secure than storing the credentials, even in encrypted form, on network-connected servers from where attackers could steal them.

The PINs or credentials never leave the HSMs, and their use within them is strictly controlled.

To read this article in full or to leave a comment, please click here