Share This [+]
January 13th, 2010 by Jeff P.
Here are some disturbing statistics:
- A recent Hotmail security breach revealed that an overwhelming number of users are using predictable, insecure passwords:
- 61% of passwords were either only lowercase letters or all digits (examples: iloveyou or 123456).
- 20% of passwords were six or fewer characters.
- An estimated 1 in 9 people use one of the Top 500 passwords posted on WhatsMyPass.com
- 1 in 50 people are estimated to use one of the Top 20 passwords, among which are password, 123456, and qwerty.
- Many of the Top 500 passwords are simple dictionary words, curse words, or common first names.
- 60% of web users only have one password that they use for all of their online accounts, including Facebook, PayPal, email, and banks, according to a recent study.
A typical strong password guide looks a little something like this:
- At least 8 characters long
- At least three of the following:
- lower case letter
- capital letter
- numeral
- special character
But this really seems to miss the point. For example, go to Microsoft’s password checker and type in this password: qwerty123456! The checker gives this password strength “Best.” But is it really?
Read the full post »
Tags: hacking, password policy, security
Share This [+]
December 16th, 2009 by Jason C.
What is URLScan? URLScan is a free tool provided by Microsoft that restricts certain kinds of HTTP requests that IIS will process. Though there are many different uses of URLScan, today I will only be covering SQL Injection blocking.
SQL Injections occur when attackers enter malformed SQL statements into data input fields. The attacker can modify or retrieve data from your database and, in some cases, they can even access data stored in your filesystem outside of SQL Server. If you find that you’re a victim of SQL Injection attacks and you’re not equipped to make all of the necessary changes to your application (or if the implementation of these changes could take a long time to implement) then URLScan may be a good fit for you until you can fix the root cause of the attack.
As of this writing, URLScan 3.1 is the latest edition and can be downloaded from Microsoft. A URLScan ISAPI filter is configured for all websites on your server after performing a default installation of URLScan. This ISAPI filter intercepts request for IIS and processes security rules defined in the URLScan.ini file against the requests.
The blocking of SQL injection attacks is handled by the DenyQueryStringSequences security rule. The rule matches IIS requests against a list of character sequences that you provide. If the request matches certain character sequences specified in the security rule, then the request is dropped, logged in the URLScan Logs, and a 404 status is returned. You can configure URLScan to only log requests that match your defined character sequences instead of blocking them. I would recommend starting off with the logging only mode so you can determine whether or not valid traffic may be blocked. If valid traffic is being blocked, you’ll need to modify the character sequences you are choosing to block.
Below is a configured DenyQueryStrinSequences security rule. I have added some of the most common SQL commands used in SQL Injection attacks:
Read the full post »
Tags: hacking, security, sql injection, urlscan, Windows
Share This [+]
December 9th, 2009 by Rich H.
Do you know who your internet neighbors are?
Would you buy a lot, build a house, and move your family in if the next-door neighbor was a notorious drug kingpin? Of course not!
It’s important to consider that “where” your business “lives” online is just as important. I’m not talking about your URL or domain name; I’m talking about the Net block your IP addresses are assigned from, and who the company providing them is.
Spam, adult-oriented sites, and gambling sites generate lots of revenue. They can afford the same servers, support, and bandwidth your business can. They also attract a lot of negative attention in the form of Distributed Denial Of Service (DDOS) attacks, hacking attempts, and probably the worst: blocking and filtering from legitimate networks and mail servers.
When network operators and email system administrators see lots of spam or non-legitimate traffic from a given network, they’ll often block it. Sure, some legitimate traffic is blocked along with the bad, but it’s typically impossible or too costly to differentiate the good from the bad. If the owner of a Net block has a reputation for continuing to do business with clients that generate “negative attention”, an administrator will often block/filter all of the net blocks owned or operated by that provider.
This all happens behind the scenes and often completely unknown to you.
Read the full post »
Tags: ddos, hacking, spam, web hosting
Share This [+]
May 27th, 2009 by Patrick M.
Are you familiar with white hat hacking? If you aren’t, you should be. White hat hacking is a planned attack that checks your systems for vulnerabilities. After the hacker successfully (and harmlessly) compromises your environment, they tell you what to do to fix it.
Even though most security loopholes are well-documented, I’m surprised how many open exploits are in applications that we security scan here at INetU. So stand by for a little White Hat Hacking 101, where I’ll teach you how to hack into your own site.
Hack One: Injection Attacks
I’ll start with injection exploits because most IT professionals, even though they have cursory basic understanding of the dangers, leave too many sites open to the vulnerability.
The Risk: Once a hacker knows they have an unprotected line to your database, the possibilities are endless: vandalism, data theft, or even total system compromise.
The Fix: There are two main ways to protect your site from injection: 1) always …
Read the full post »
Tags: hacking, list, security, sql injection, tutorial, xss
