MS12-083 is being released to address a Security Feature Bypass, a class of vulnerability for which we do not frequently release security updates. This is the third such instance, with MS12-001 and MS12-032 previously having addressed Security Feature …
I’ve read that different databases (mysql, sql server,…) have different vulnerabilities and that they are vulnerable to some specific sql injections.
When attacker try to perform a database attack against a website (like SQL injection) …
It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms implemented within the firmware of the H…
When a machine has been infected with malware, most of us here immediately identify the appropriate action as “nuke it from orbit” – i.e. wipe the system and start over. Unfortunately, this is often costly for a company, especially if back…
I’ve seen OWASP Top 10 guides for web apps, native apps, etc., but never anything for embedded systems or hardware devices. These usually involve microcontrollers (e.g. Atmega / PIC) or small microprocessors which execute code and accept i…
I’m a moderator at a forum. We want to have a new style for the forum.
We’re thinking about announcing a competition to the users to come up with the best CSS design; we would adopt the best submission.
How dangerous would this be? How d…
I’m only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key agreement).
The actual operation in RSA…
Today we released MS12-074, addressing a Critical class vulnerability in the .NET Framework that could potentially allow remote code execution with no user interaction. This particular CVE, CVE-2012-4776, could allow an attacker on a local network to h…
Today we released six security bulletins addressing 19 CVE’s. Four of the bulletins have a maximum severity rating of Critical, one has a maximum severity rating of Important, and one has a maximum severity rating of Moderate. We hope that the table be…
For a REST-api it seems that it is sufficient to check the presence of a custom header to protect against CSRF attacks, e.g. client sends
“X-Requested-By: whatever”
and the server checks the presence of “X-Requested-By” and drops the req…
