Although traditional firewalls have effectively prevented network-level attacks, most future attacks will be at the application level, where current security mechanisms are woefully inadequate. Application-level security vulnerabilities are inherent in a Web application’s code, regardless of the technology in which the application is implemented or the security of the Web server and backend database on which it is built. A recent advisory published by Internet Security Systems (see the “Internet Resources” sidebar, p. 44) claims that 11 widely deployed shopping cart applications are vulnerable to a simple attack that lets hackers pur- chase goods for much less than their listed price. Worryingly, the attack does not require particular technical skill; it suffices to save the shopping cart’s HTML confirmation form to disk, use a text editor to modify the price of the goods (stored in a hidden form field), and load the HTML form back into the browser.
Read the rest of this entry »

• 0 Comments

The security of information systems is a wide area. Its development followed that of information systems, whose development in turn followed advances in hardware. As computers and software have developed real fast: “To put it quite bluntly: as long as there were no machines, programming was no problem at all; when we had a few weak computers, programming became a mild problem, and now we have gigantic computers, programming had become an equally gigantic problem.” [1], so have developed the possibilities for security breaches.
Read the rest of this entry »

• 0 Comments

With Windows Vista, Microsoft shifted from the development path of Windows XP wide open to tampering with zero reaction, and has integrated an anti-piracy infrastructure into the platform. In direct correlation with the Windows Genuine Advantage and the Activation mechanisms, Windows Vista will be able to detect and blacklist non-genuine product keys, crack attempts, and identify the expiration of the initial 30-day grace period. The operating system will react to all by moving first into a non-genuine state and then into Reduced Functionality Mode.
Read the rest of this entry »

• 0 Comments

How does Google decide which web sites are important? It uses an ingenious algorithm that exploits the structure of the web and is resistant to hacking. Here, we describe this PageRank algorithm, illustrate it by example, and show how it can be interpreted as a Jacobi iteration and a teleporting random walk. We also ask the algorithm to rank the undergraduate mathematics classes offered at the University of Strathclyde. PageRank draws upon ideas from linear algebra, graph theory and stochastic processes, and it throws up research-level challenges in scientific computing. It thus forms an exciting and modern application area that could brighten up many a mathematics class syllabus.
Read the rest of this entry »

• 0 Comments

The tone of recent news stories about the dangers of Facebook has been quite hysterical and many IT directors can be forgiven for feeling under threat from the phenomenon. But is a blanket ban for the site the best approach or merely a knee-jerk reaction, perhaps a more tailored approach with network management tools is appropriate?
Read the rest of this entry »

• 0 Comments

Everyday I receive an email from somebody about how their account was hacked, how a friend tagged them in the photo and they want a way to avoid it, as well as a number of other complications related to their privacy on Facebook. Over the weekend one individual contacted me to let me know that he would be removing me as a friend from Facebook because he was “going to make a shift with my Facebook use - going to just mostly family stuff.”
Read the rest of this entry »

• 0 Comments

There are many distinct pleasures associated with computer programming. Craftsman-ship has its quiet rewards, the satisfaction that comes from building a useful object and making it work. Excitement arrives with the flash of insight that cracks a previously intractable problem. The spiritual quest for elegance can turn the hacker into an artist. There are pleasures in parsimony, in squeezing the last drop of performance out of clever algorithms and tight coding.
Read the rest of this entry »

• 0 Comments

The definition of Web 2.0 is still being debated despite extensive discussion. Its staunchest advocates proclaim it a complete philosophical and technological reworking of how the web functions. Others declare that it is meaningless. However, most agree on common characteristics of a Web 2.0 application, such as increased interactivity, the acceptance of user input for building community and a reliance on client-side functionality. Additionally, Web 2.0 applications can be more vulnerable to exploitation by hackers than their predecessors. Hackers spend most of their time gathering information. When Web 2.0 applications push functionality and code to users, they provide hackers with information that can be used for formulating attacks. Often, old attacks such as cross-site scripting become more dangerous when used against Web 2.0 applications. This white paper defines some of the common technological components of Web 2.0 applications and discusses ways of securing them against exploitation.
Read the rest of this entry »

• 0 Comments