Category Archives: Security

Vulnerabilities in Adobe Flash Content

This is really serious, last night full Researchers from Google have documented serious vulnerabilities in Adobe Flash content which leave tens of thousands of websites susceptible to attacks that steal the personal details of visitors. download the reef film in hd formats The security bugs reside in Flash applets, the ubiquitous building blocks for movies …

Continue reading “Vulnerabilities in Adobe Flash Content”

SQL Injection Cheat Sheet

Alright, kids. Bookmark this, a useful SQL injection cheat sheet. Currently only for MySQL, Microsoft SQL Server, some ORACLE and some PostgreSQL. Good for your own protection. And please don’t try to do anything stupid to others, ok! movie little fockers on dvd psp tangled movie download download divx get him to the greek movie …

Continue reading “SQL Injection Cheat Sheet”

Dangers of CSRF and XSS

Ilia once again shared his excellent article about web security here. This article talks about two well known security threats, CSRF and XSS, how malicious hackers do that, how to prevent them, and most importantly why our common solutions that we think has solved this problem doesn’t actually work. watch kingdom of heaven film in …

Continue reading “Dangers of CSRF and XSS”

Against the System: Rise of the Robots

“…big difference between the web and traditional well controlled collections is that there is virtually no control over what people can put on the web. Couple this flexibility to publish anything with the enormous influence of search engines to route traffic and companies which deliberately manipulating search engines for profit become a serious problem.“

That was the quote from Sergey Brin and Lawrence Page’s paper about the prototype of Google search engine which then was in http://google.stanford.edu/.

But i don’t think even Brin nor Page would expect that their invention could bring another problem that emphasize what they meant with “no control over what people can put on the web”.

Yesterday post from Securiteam blog shows us that people can use Googlebot to attack other websites anonimously.

The idea is quite simple, all you have to do is to create a malicious website that contains links attacking web application (CSRF), like this:

http://the-target.com/csrf-vulnerable?url=http://maliciousweb.com/attackcode

and submit this to Google. When Googlebot comes to your website and find this link it will dutifully try to index the URL. And when it does .. bang! the robot do the job for you, attacking your target.

This is not a new idea though. Michal Zalewski wrote about this in 2001 in title “Against the System: Rise of the Robots“. His introduction tells us the whole idea,

Consider a remote exploit that is able to compromise a remote system without sending any attack code to his victim. Consider an exploit which simply creates local file to compromise thousands of computers, and which does not involve any local resources in the attack. Welcome to the world of zero-effort exploit techniques. Welcome to the world of automation, welcome to the world of anonymous, dramatically difficult to stop attacks resulting from increasing Internet complexity.

However, this kind of attack is not only Googlebot’s problem, other search engine bot have the same kind of ability to do the dirty job for you like MSN, Yahoo and dozen of others.

So who’s to blame? Surely, the bad guy who run the original website. Although you can also put the blame to the owner of the victim websites which ignore the security factor and leave all their pages open to any bot for higher pagerank.