I am using a program that I coded in C#.
All it does is use HttpWebRequest to request some pages and read info from them.
I tried running it through Tor. I installed the Vidalia Bundle and Widecap.
My program is definitely run through Tor because I checked my IP from within the program.
But I get...
There is no link between popular and non-popular software in terms of security in general.
All browsers can be exploited one way or another, which is happening a lot. It's even not safe to use wget on some websites without caging it.
He's not really asking about the code, but more about the security aspects, i.e. "why is it doing it, and why is the warning important?"
thankfully I know exactly why it's doing it. it's a pain in the ass bug in the .NET framework where DNS queries are done synchronously at unexpected times in the code, and it ignores the ability to just defer the DNS query to a SOCKS4a proxy.
@Polynomial one of the answers at that appeal question even states: It's difficult to keep this list up-to-date. In my opinion -- this is a BAD QUESTION..
and I agree with that.
not too many tools == small list is a fair point, but not the issue.
@Polynomial I agree. but look at the answers - one answer given to what you asked - list of tools. The other answer goes for the technique, how to do this.
which answer is great, and which one sucks (and should probably be made a comment)?
actually, in order to build a deathstar, they would have to invent a LOT of very cool incidental technologies. much like the cold war weapons tech that came along as a result of the space shuttles.
This is a very interesting article about the iMessage technology used in Apple's very popular communication devices. So far, there has not been much technical details released by Apple. Hopefully someone here is able to shed some light on it.
What security technologies and protocols are used?
H...
@AviD Oh, right, sorry. I was taking that joke in a totally different direction.
I had a guy ask my opinion on tools for, specifically, ColdFusion, PL/SQL, and Java. He's already got a call scheduled with HP to talk about Fortify SCA and said he's also looking at AppScan Source.
Is the suckage a function of the fact that noone cares enough to make decent tools, or because of the inherent difficulties of what they're trying to do?
partly, I'm pretty sure they have "support" for all those languages. not sure ounce does.
@ScottPack bit of both, really.
in fact, there is one that I'm familiar with - Checkmarx - which doesnt suck (though their tool still shows that they are a startup), because they went in a whole other direction.
@M'vy true, just trying to see if any other light can be shed on that topic. the bronze badge that comes with awarding a bounty on another persons question is nice as well. :P
My only experience in this area has been splint, which seemed to work kind of ok on small projects. What annoyed me about it was the fact that to really scale to anything it required a lot of tagging of the code so that you were, in essence, telling splint what this section of code did and whether it was ok to ignore it.
though splint is pretty much mostly text oriented, without real code-parsing, and the bigger tools do a lot more work. and, they look for a heck of a lot more than splint.
@RoryMcCune it depends. there is the list price, then there is the package price that HP/IBM can undercut to get a big client onto some of the other products.
@ScottPack I find checkmarx so much better than the others, its silly to compare.
unlike the others, where you have closed engines with very small customization points (read: meta-tagging), checkmarx is more of a static analysis platform - you can literally write queries to find almost anything you want in code.
if you want really good security, and long term (there is also better support for rescanning etc) - Checkmarx, but with no little investment.
btw, between hp and ibm - language support can tilt strongly in hp's favor. general level of non-crappiness goes to ibm.
@ScottPack ha! I wish.
so here's the thing.
it does come with, out of the box, a couple hundred vulnerability queries, which are very generic, and very useful.
e.g. XSS, SQLi, passwords, etc etc. the usual stuff.
you can also customize these existing queries - using a form of polymorphism - to fit your code/environment/infrastructure.
e.g. SQLi doesnt find anything, because you're using a special DB - with Cx you can customize just the part of the query that defines what a database is.
good luck with getting any sense out of any tool. Except maybe splint.
on top of that, you can tailor queries specific to your app, or special things that you want.
e.g. a custom authorization mechanism - find misuse, lack of use, etc.
so these customizations dont really make sense to share generically.
the company does tend to roll in any new vuln queries offered them, though.
good point on framework support, that was one thing that tripped me up when I started looking at static analysis. Java alone isn't enough if you're looking at a struts 2 app...
@AviD yeah initial release was tail end of this year I think, Android specific has been added recently too which is nice for mobile reviews...
I really enjoy when I get to use it for a client. way too pricey for me to get myself, but I've help custom develop queries for many clients after they buy it.
as opposed to when they insist I use their other tool, e.g. fortify. I tend to curse a lot when that happens.
@AviD one of the companies I work with is a reseller, so I get a lot of the sales docs. When I get some time really want to spend some more time looking at it. I've can get access to their on-line version for eval/training ...
@AviD yeah I think that's why pen. testing companies don't push white-box harder, 'cause having a tester who's fluent in multiple programming languages enough to do proper code review is tricky...
My ruby/rails is just about good enough but trying to do many languages is hard work!
@AviD it ended up being my language of choice for test automation, and I present on security at the local ruby conf. so ended up seeing quite a bit of the ecosystem.
rails devs love clever hacks tho' which makes reviewing it "interesting" .
over-riding default framework features to implement input validation is a favourite from what I've seen
I'm starting to think he might actually be a clever black hat, purposefully giving bad advice hoping some victim will use it, in some elaborate social engineering attack.
@AviD Yeah. Thanks to the way Ohio it setup we can really get good advantage of those types of contracts. The public universities size is disturbingly huge, not to mention official State and other state-wide organizations that do bargaining. It can be pretty insane.
Here are the things on my list, that I use for my clients (including some of those that you've mentioned):
Coverage (according to what the org requires today, and expects to use in the future)
Language
Architecture (e.g. some tools are great for web apps, but not so much for rich clients or e...
and @DW's answer there is also absolutely important.
I've actually bookmarked our conversation to include in my email. From the looks of it I think I was able to reasonably sum it up to 4 points, but hey, some people like unabridged versions.
Is it an online stalker fail, if you're able to find the business phone number, address, and Facebook page for an old friend you're trying to track down but can't dig up an e-mail address?
Actually, there's a fatal flaw in that plan. Sensing the emotions of others requires a semblance of social skills and empathy. Which, if you're Facebook-stalking people, I imagine you're rather lacking in ;)
There is no link between popular and non-popular software in terms of security in general.
All browsers can be exploited one way or another, which is happening a lot. It's even not safe to use wget on some websites without caging it.
This is a very interesting article about the iMessage technology used in Apple's very popular communication devices. So far, there has not been much technical details released by Apple. Hopefully someone here is able to shed some light on it.
What security technologies and protocols are used?
H...
Here are the things on my list, that I use for my clients (including some of those that you've mentioned):
Coverage (according to what the org requires today, and expects to use in the future)
Language
Architecture (e.g. some tools are great for web apps, but not so much for rich clients or e...
