XML Web Services provide a flexible API for building distributed systems as a collection of endpoints that can send and receive SOAP messages. These systems are secured using message-based cryptographic mechanisms defined in a series of specifications developed by Microsoft, IBM, and others. Such home-grown security protocols often go wrong; they are prone to a well-known class of attacks, formalized by Dolev and Yao, where an attacker can intercept, modify, and replay messages. The vulnerability is only increased by the flexible message formats and complex trust configurations allowed by the standards. Our goal is to verify the security of families of protocol configurations, such as those deployed for Microsoft’s WSE and Indigo web services implementations.
Read the rest of this entry »

• 0 Comments

Web sites today face many threats to the confidentiality and integrity of the data used and the functionality provided by the application. This problem is compounded by the fact that Web developers are simply lack of either adequate knowledge and skills in writing secure Web application codes (Huang et al., 2005) or sufficient testing methodologies for the audit and control of Web development (Mansouir and Houri, 2006). Works in the design and implementation of security measures for Web applications are greatly in need.
Read the rest of this entry »

• 0 Comments

Although traditional firewalls have effectively prevented network-level attacks, most future attacks will be at the application level, where current security mechanisms are woefully inadequate. Application-level security vulnerabilities are inherent in a Web application’s code, regardless of the technology in which the application is implemented or the security of the Web server and backend database on which it is built. A recent advisory published by Internet Security Systems (see the “Internet Resources” sidebar, p. 44) claims that 11 widely deployed shopping cart applications are vulnerable to a simple attack that lets hackers pur- chase goods for much less than their listed price. Worryingly, the attack does not require particular technical skill; it suffices to save the shopping cart’s HTML confirmation form to disk, use a text editor to modify the price of the goods (stored in a hidden form field), and load the HTML form back into the browser.
Read the rest of this entry »

• 0 Comments

The following document is intended as a guideline for developing secure web-based applications. It is not about how to configure firewalls, intrusion detection, DMZ or how to resist DDoS attacks. This is a task best addressed at system and network level. However, there is little material available today intended for developers. We have entered the dotcom age in which a web site is no longer an isolated site, but an extension of the internal business systems, yet there isn’t much about how to create this extension securely.
Read the rest of this entry »

• 0 Comments

Most Internet servers sit behind firewalls and use detection scripts to send alerts when break?ins are attempted. Some system administrators even run software to detect portscanners and denial?of?service attempts. However, many system administrators still overlook security problems in CGI scripts and web applications.
Read the rest of this entry »

• 0 Comments

Google Earth™ is Google’s satellite imagery-based mapping product that combines global coverage of imagery with new navigational features including integrated Google search capabilities. It is based on technology from Keyhole, a company acquired by Google in October 2004. Google Earth is a broadband mapping tool that enables users to fly from space to street level views to find geographic information, and to explore places around the world.
Read the rest of this entry »

• 0 Comments

Google Earth is a popular and widely used geographical browser. It is a standalone application that enables spatial data from a variety of sources to be displayed, explored and visually compared. Google Earth has the following important characteristics:
• Free
• Easy-to-use and intuitive user interface. Data are displayed on an interactive globe that can be rotated and zoomed to visually explore data in different regions of the world and at different spatial resolutions.
Read the rest of this entry »

• 0 Comments

Google Earth, a tool that combines satellite imagery, maps, terrain, and 3D buildings, has partnered with the United States Holocaust Memorial Museum (USHMM) to bring forth tangible proof of the devastation that is taking place in Darfur. It is a particularly good advocacy tool because it gives a clear visual representation of what is taking place in Darfur. Use this guide for tips on how to use Google Earth to move Darfur as a significant issue on your campus.
Read the rest of this entry »

• 0 Comments