Sunday, 20. January 2008, 20:42:27
security
I'm giving a talk at the it-defense security conference in Hamburg next week with a colleague from Google. We're going to be talking about some interesting an often-overlooked sources of vulnerabilities. If anyone else is going to be there let me know :-)
http://www.it-defense.de/itdefense2008_com/pages/program.html
Sunday, 20. January 2008, 20:37:53
dns, web, security
For anyone interested in web application security, I posted a writeup of an interesting cross site scripting variant to bugtraq over the weekend. The problem is due to dns administrators commonly installing unqualified localhost records.
This might sound harmless at first, but in fact makes it impossible to access affected sites securely via http (assuming they make use of cookies) from multi-user systems. Under certain circumstances it can be exploited even from single-user systems.
The full post is available
here.
$ host localhost.opera.com
localhost.opera.com has address 127.0.0.1
Damn, and the machine I'm posting this from is indeed multi-user :-)
WIDGETIZE