Security

Here’s a scary stat for you: last year was the most hacked year ever. According to Risk Based Security [https://www.riskbasedsecurity.com/reports/2013-DataBreachQuickView.pdf], we saw 823M records exposed via data breaches: Nasty stuff right? Yeah, but it gets worse. As of mid 2014, we’re already looking at 502 million records exposed [http://datalossdb.org/incident_highlights/66-hacking-exposed-78-of-all-records-compromised-in-first-half-of-2014] . Bugger. These breaches keep on coming and w...

It’s six days since I wrote about Shellshock [https://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html] and the response has been massive. There’s clearly a lot of interest in this bug and indeed there have been some pretty dire warnings about the impending “Bashpocalypse” which ultimately, hasn’t really happened. I’m sure it’s made life tricky for some sysadmins and I’m also sure there have been many servers that have suffered from what by all objective measures, remains a pretty...

Did I mention that we have some terrible security flaws with our APIs behind rich client apps? Pretty sure I did’; oh and I did just write a Pluralsight course that shot to the top of the charts [http://pluralsight.com/training/Courses/TableOfContents/hack-your-api-first] so yeah, there’s that! There are a few reasons why vulnerabilities in APIs are the new black: 1. They’re that much less obvious than vulnerabilities in browser-based apps; you don’t see the URL, you don’t get browser war...

This content is now available in the Pluralsight course "Understanding the Shellshock Bash Bug" [http://www.pluralsight.com/courses/shellshock-bash-bug]Remember Heartbleed [https://www.troyhunt.com/2014/04/everything-you-need-to-know-about.html]? If you believe the hype today, Shellshock is in that league and with an equally awesome name albeit bereft of a cool logo (someone in the marketing department of these vulns needs to get on that). But in all seriousness, it does have the potential to be...

I’ve got 174,451,409 breached accounts in Have I been pwned? [https://haveibeenpwned.com/] (HIBP) as of today which probably sounds like a lot, but it’s not. Why is it not a lot? Because whilst that list spans a lot of the big breaches I could get my hands on, as of the middle of this year (now a couple of months ago already), there were over half a billion accounts breached in just six months [https://www.riskbasedsecurity.com/2014/08/hacking-exposed-78-of-all-records-compromised-in-first-half-...

You may not know this, but an HTTP 403 response when browsing to an empty directory is a serious security risk. What the?! You mean if I go to my website which has a “scripts” folder where I put all my JavaScript and I have directory browsing disabled (as I rightly should) and the server returns a 403 “Forbidden” (which it rightly should), I’m putting my internet things at risks of being pwned?! Yes, because it discloses the presence of a folder called “scripts” which is a common directory. W...

I’ve long held the view that passwords should consist of as many crazy things as the owner deems fit. If I want to create a password that looks like a dog just ate the keyboard and threw up all the keys, then good for me. (Chances are that Fido is going to cough up a pretty unique password too but before PETA gets on my case, try using a password manager like 1Password [https://www.troyhunt.com/2011/03/only-secure-password-is-one-you-cant.html] instead.) Now I’m used to seeing all sorts of ridi...

A few years ago I was taking a look at the inner workings of some mobile apps on my phone. I wanted to see what sort of data they were sending around and as it turned out, some of it was just not the sort of data that should ever be traversing the interwebs in the way it was. In particular, the Westfield iPhone app to find your car caught my eye [https://www.troyhunt.com/2011/09/find-my-car-find-your-car-find.html]. A matter of minutes later I had thousands of numberplates for the vehicles in th...

I will not run web security analysers without first understanding web security. I will not run web security analysers without first understanding web security. I will not run web security analysers without first understanding web security. Are we clear now? Good, because as neat as tools like I’m about to discuss are, nothing good comes from putting them in the hands of people who can’t properly interpret the results and grasp the concepts of what dynamic analysis scanners can and cannot cover....

I know I’ve shared this a number of times now, but no matter how much I see it, it still cracks me up: [https://www.troyhunt.com/2012/07/lessons-in-website-security-anti.html] Make sense? Of course it doesn’t and therein lies the insanity of it all! But let us not single out Tesco alone, there are plenty of British companies that construct responses like this (sorry English people, I don’t know why, they just seem to feature disproportionately to the rest of the world). In fact earlier this w...