full-disclosure - Re: Absolute Sownage (A concise history of recent Sony hacks)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 11 Jun 2011 12:04:22 +1200
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Absolute Sownage (A concise history of recent
 Sony hacks)

mrx wrote,

> I am a little frightened that my web app will be owned and user
> credentials exposed.  ...

Keep that attitude when you are no longer a "noob" web-app developer 
and the world will be a better place.

There are far too many "hack" web coders out there, and the evidence 
suggests that Sony employs quite a few of them...

> ...  I have read much on SQL injection, XSS, remote
> execution, session hijacking etc. I only think I have all bases
> covered, I am not 100% sure. Is there a definitive text/book/white
> paper on such matters and if so could someone please let me know
> where I can find this? 

I'm not a web-app expert at all -- I live and work in a niche 
necessitated by the appalling condition that is "web security" in 
general  (I'm a malware analyst who spends much of my time looking at 
the stuff the bad guys who break poorly configured servers, poorly 
configured and/or written web-apps, etc, etc put on those compromised 
machines to wreak havoc further down the food chain) -- but if you're a 
web-app developer and do not know about OWASP or what the OWASP "Top 
10" is, you're probably a shockingly bad web-app developer (but 
probably well able to get plenty of work at the likes of Sony).

Regards,

Nick FitzGerald

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/