Rub yourself in bacon and throw yourself in the wolf-pen

I thought the use of ActiveX had been banned in most civilized countries.

[This] Novell story is sad bad tale of You Can't Teach Some Dogs Anything At All. I quote:

Secunia, which reported the bugs to Novell, counted at least eight vulnerabilities in the ActiveX control included with the Windows Vista version of the iPrint client, as well as several other flaws in another Windows Vista iPrint component...iPrint is Novell's implementation of the Internet Printing Protocol (IPP), and lets users use, install and manage printers through the browser.

First of all, iPrint sounds like Apple, but it is some kind of Frankensteinian CUPS mutation. But that's a minor nit compared to using ActiveX in a printer client. Do these people feed and dress themselves competently? Is there anyone on the planet who doesn't know that ActiveX is a finely-engineered pestilence that cannot be trusted under any circumstances? ActiveX has one purpose in life: allowing the installation and execution of remote code on a Windows system via Internet Explorer.

ActiveX controls have unfettered access to the entire operating system. Using ActiveX is like rubbing yourself with bacon and flinging yourself into a hyena pack. There is no safe way to use ActiveX. Why it is even necessary for a printer client? The CUPS Web interface for Linux doesn't need ActiveX and it's worked fine for years. There is one for Mac too, which also doesn't need ActiveX, and both of them work in pretty much any Web browser. You don't need the match+flame duo of ActiveX and IE. In fact smart people avoid them like the toxins that they are.

Lest anyone think I am being too mean to poor old defenseless Novell and Microsoft, I recall ActiveX security advisories almost from its inception back in 1996 or so. What has changed since then, twelve years later? Nothing, as this random recent security bulletin shows:

Microsoft has released Security Advisory (955179) to describe attacks on a vulnerability in the Microsoft Office Snapshot Viewer ActiveX control. Because no fix is currently available for this vulnerability, please see the Security Advisory and US-CERT Vulnerability Note VU#837785 for workarounds.

So we need to revise the popular "fool me once" saying:

Fool me once, shame on you
Fool me twice, shame on me
Fool me thousands of times over many years...let's get married!"

Now why is it again that corporate participation is important to FOSS?

Continue Reading »

Most pathetic phishing attempt of all time

• Misspellings in the subject line? Check.

• Sender is an anonymous Yahoo account, not the financial institution? Check.

• Link you're supposed to click is an IP address? Check.

• Odd phrasing, as if authored by a non-English speaker? Check.

Anyone falling for this phish needs their own chapter in Guinness.

Continue Reading »

That ain't a captcha, baby, that's just text!

Check out the "captcha" on the Broadcasting & Cable Online website:

Doesn't it look a bit... well... simplistic? It doesn't even look like a JPG or GIF. And since I was able to highlight the individual characters... harrumph! A View Source revealed:

</style><script type="text/javascript">
document.write('<div id="kphgathsyfwf">');
document.write('<span class="nmphehxddlno">K</span>');
document.write('<span class="sepbxvbjrcva">C</span>');
document.write('<span class="brtdrtazqxkk">I</span>');
document.write('</div>');
</script>
<p><b><span class="ihtfw">Before submitting this form, please type the characters displayed above:</span></b></p>

Heh. I'm sure the spammers will never figure that one out.

Continue Reading »

Google releases its open-source RatProxy web app scanner

Last week, Google open-sourced one of its web development tools -- RatProxy. The company describes it as:

A semi-automated, largely passive web application security audit tool, optimized for an accurate and sensitive detection, and automatic annotation, of potential problems and security-relevant design patterns based on the observation of existing, user-initiated traffic in complex web 2.0 environments.

Detects and prioritizes broad classes of security problems, such as dynamic cross-site trust model considerations, script inclusion issues, content serving problems, insufficient XSRF and XSS ([Ed: cross-site request forgery and cross-site scripting, respectively]) defenses, and much more.

But what's it really do?

At heart, it's designed specifically for web 2.0 applications (as opposed to full-blown security proxies like WebScarab and ProxMon, which are more general purpose in nature). WebScarab, for instance, supports automated parameter fuzzing in order to detect SQL injection and XSS, but also supports a zillion other features.

Conversely, RatProxy is designed specifically for assessment of cross-site vulnerabilities with little effort. As opposed to more active scanning tools, it also can run against production systems without fear of DOSsing (denial-of-service) them. RatProxy hones in on five specific types of weaknesses:

• MIME type mismatches: does the reported MIME type match the actual content?
• How do apps behave when cookie-based authentication data is removed from requests?
• Are security tokens sufficiently strong (e.g., can they be guessed) and will they resist replay attacks?
• Are parameters of a request echoed back in the response such that XSS is possible?
• MIME type mismatches: does the reported MIME type match the actual content?
• Can boundary conditions be exploited such that trust mechanisms are spoofable or information disclosure is possible?

The doc is pretty good reading and covers more of the details.

RatProxy should run under most Linux, FreeBSD, MacOS X, and Windows (via Cygwin) configurations.

Continue Reading »