Software

Review of SolarWinds Impact and Brief Technical Summary

An image of the sun exploiding.

General Details SolarWinds is a publicly traded company worth $5.4B dollars that developing IT infrastructure management software products for small and medium-sized enterprises. Two separate pieces of malware known as SUPERNOVA and SUNBURST worked against vulnerabilities in SolarWind’s product Orion. The malware known as SUNBURST potentially allows an attacker to compromise the server on which the Orion products run. The manner in which SUNBURST malware was used against its victims resulted in it being labelled a “supply chain attack,” a technique in which an adversary uses malware to disrupt a companies ability to produce or deliver it’s products to customers. Although the term “supply chain attack” a broad term without a universally agreed upon definition, theoretically, the intended target of a supply chain attack is not necessarily the company whose network was breached and disrupted. For example, if an attacker wanted to disrupt operations of a large retail target such…

Read more

Security Of The Alexa Top Sites

Introduction The Alexa Top Websites (https://www.alexa.com/topsites) can be used to monitor the popularity trend of a website and compare the popularity of different websites (WikiPedia). In order to gauge the security posture of the internet as a whole mapping information from the Alexa Top Sites is useful. AlexaCheck.py assists by building a PostgreSQL database that stores header information from each website, the first listed resolved IP address, HTTP response code, and MX records. The header information also includes cookies that are passed during an initial connection. This approach was used to examine security of the Alexa Top Websites in a research paper CookiExt: Patching the Browser Against Session Hijacking Attacks. AlexaCheck.py can also accept a list of other domains you want to check for forced TLS encryption and inspect cookies and other header information. Specific HTTP Security Risks SSL/TLS Enforcement The Alexa Check database allows analysis of a particular website…

Read more

How to mitigate against session hijacking attacks with HTTP Security Headers

Futuristic Graphic logo of two people eating a cookie.

Session cookies constitute one of the main attack targets against client authentication on the Web. To counter these attacks, modern web browsers implement native cookie protection mechanisms based on the HttpOnly and Secure flags. … Our analysis of the Alexa-ranked top 1000 popular websites gives clear evidence that such risks are far from remote, as the HttpOnly and Secure flags appear as yet to be largely ignored by web developers. – CookiExt: Patching the Browser Against Session Hijacking, Journal of Computer Security (2015).   Summary of Session-hijacking attacks When you login into a website, the web-server creates a “session” to identify your identity by sending the client browser a session cookie. Cookies have functions other than sessions, but perhaps the most important use of cookies from a security perspective managing your “state” or “session-state”. This is because a single IP address may have many clients connecting to the server, so…

Read more

Safari Browser URL Spoof Vulnerability

cyber-criminal-graphic

Last week, Rafay blog wrote a short blog piece about the recently publicized browser URL spoofing vulnerability in Safari. To summarize, the browser bar is considered the only reliable security indicator to validate the authenticity of the website. Looking at the browser URL bar at the top of your browser, and checking that the domain contained in the URL matches the domain of the site you expect to be visiting. If it says “google.com” or “facebook.com” you should be able to reliably tell that you are on the correct website. However, in addition, all browsers include a symbol to show whether the SSL/TLS certificates have been properly validated to authenticate the identify of the server you are communicating with, as well as initialize an encrypted connection to protect your data as it transits the internet. Besides the recent publicized vulnerability in Safari, URL spoofing has been accomplished by attackers in…

Read more

Is A New Protocol The Best Solution to Web-Content Accessibility?

Graphic image of visual eye test and reading glasses

If you have been around the internet since the mid 1990’s you may have the same sense of I have. The internet was better then. Gillian Anderson… and other reasons. Mostly the web wasn’t so… bull-shitty. There were less advertisements. There were fewer user interface changes to websites so you didn’t have to search for the button that some psychometric web-design team lead decided to move because you would look at ads longer if they made it harder to find. The real content still changed. Websites still changed and were updated. It was just mostly the content that changed not the UI. I suspect that nobody has felt the wave of the new “bull-shitty” internet more than people with disabilities. Yes, accessibility features existed in the 1990’s for computers. They may have been even better than the state they are in today. Perhaps as Bill Hicks might say, it’s that…

Read more

New Web-Accessibility Laws in Ontario

Graphic image with icon for each disability such as visual, hearing, and physical

In 2021 new laws will be enacted in Canada that demand web-content be accessible to people with disabilities. The law applies to any organization with 50 or more employees and fines can be up to $50,000. The new regulation sets the gold-standard for compliance at WCAG 2.0 “AA” (Web Content Accessibility Guidelines double A) standard. This is the second level of the three levels included in the WCAG. If you are a website owner and you want assitance makign your website compliant with the new regulations, please contact me by email at joseph@ripplesoftare.ca or contact me using the website contact form. web-developer or compliance officer tasked with making sure your website meets this standard, read on to find out what the standard is and how you can make your site compliant. Overview of Web-Accessibility Laws in Ontario By January 1, 2021, Ontario businesses must make their public-facing websites conformant with…

Read more

How to Prevent Attacks With Proper Input Handling (Part 2)

Part 2 of this article is aimed at demonstrating how to code a accept-list validation class in PHP. We will start with a classic example of request routing where a HTTP GET request will include a “page=” parameter which will instruct the server which page the user is requesting and an empty “?action” parameter which will instruct the sever-side application which HTTP POST data to expect in the request. However, this model of input validation can be modified to handle other forms of HTTP GET and POST attribution to specify the data request. Let’s start with the basics of compiling the accept-lists for GET and POST. This is specified as a config file as shown below. The configuration is setup as constants that hold arrays. This does a couple things. Firstly, it makes the values global and they can be access from anywhere in the application code. Secondly, it prevents…

Read more

How to Prevent Attacks With Proper Input Handling (Part 1)

Input handling is an key aspect of secure web-design.  But what makes a good data validation/sanitation engine? The implementation depends greatly on the language and framework that your site is build on.  However, best practices across IT security topics maintain that “whitelisting” or “strict checking” is a more secure way to validate.  The Open Web Application Security Project (OWASP) is an online community that produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security.  Below are some exerpts from their advisories on input validation .  After the quotes from OWASP, the article will use the terms “strict checking”  and “accept list”  to refer to whitelisting and “blocklist” to refer to blacklist . OWASP Input Validation Cheat Sheet Input validation is performed to ensure only properly formed data is entering the workflow in an information system, preventing malformed data from persisting in the database and triggering…

Read more

Building Your IT Security News Pipeline

If you are responsible for securing a network, you should know that monitoring reliable IT security news is now critical to mitigating threats on your precious goods. Prioritizing that news landscape and rolling out a timely response is also critical to a solid recipe for security. While it is not realistic to expect security architects to have that kind of response time, if you are ignoring IT security news, you  might need those backups you have been diligently maintaining or worse. Building a solid incoming information pipeline requires an analysis of the IT security news landscape.  The most fundamental elements of this landscape includes threat advisories & guidelines, updates to best-practices and standardization recommendations,  and changing legal requirements if they apply to your organizational assets. Threat analysis reports and newly released Common Vulnerability Exposure details (CVEs) are critical secondary elements that relay more detailed information about vulnerabilities affecting specific software. …

Read more

What is USPTO Global Dossier?

The UPSTO Global Dossier is a portal to accessing application data from the “IP5” global patent patent offices. Global Dossier functions include: Streamlined applications to multiple international patent offices. Streamline application data access from multiple international offices. Global Dossier integrates with the “IP5” (USPTO, EPO, JPO, KIPO, SIPO) and WIPO The IP5 is comprised of the U.S. Department of Commerce’s United States Patent and Trademark Office (USPTO), the European Patent Office (EPO), the Japan Patent Office (JPO), the Korean Intellectual Property Office (KIPO), and the State Intellectual Property Office of the People’s Republic of China (SIPO). Allow applicants to file a patent application to global patent offices through a single portal. Reduce redundant processes associated with global cross-filing Monitor application process across all offices in a single portal Online access to documents and legal action history of applications Search global patent families Watch the demo below on how to access the…

Read more