Push to Secure Rails
548392
Two deadly railroad accidents in the last month have sparked debate about government efforts to secure the nation's rail system and ensure that such accidents do not provide new opportunities for terrorists.
9540
The Hardened-PHP Project has released a new vulnerability for the PHProjekt groupware software.    While searching for applications that are vulnerable to a new class of vulnerabilities inside PHP applications we took a quick look into the current PHProjekt source code and discovered that a (remote) include vulnerability had been (re)introduced.   By overwriting a variable with user input it is possible to inject and execute arbitrary PHP code. Overwriting this variable is possible regardless of the register_globals setting.    They give a few more details further down the posting and note that users should download and install the latest version (at the time of this post, 5.1.2).
672660
Sam blogs about his wiki spam problems  and implements a posting throttle.  With new spam-capable zombie PCs and with wikis that aren't updated very often this isn't a solution.  If I were to go back to my wiki after a month it would be covered with spam links.  One strong solution is emergent and distributed social whitelists (AKA my FOAFKey  proposal).  With a FOAFKey enabled wiki/weblog you could allow a whitelist of a few hundred thousand users to post to the wiki without any problems.  All they would need to enter is their email address for confirmation (or the SHA1 hash of their email).  For the rare times when the user isn't within the original whitelist we can just have the user uplo ...
542636
New software securely adds devices to wireless networks with the push of a button.
251027
Doors to manual Ryanair's online check-in service fails to ensure users submit confidential details across a secure connection. As a result, travellers are invited to send confidential data across an unencrypted link.â¦
416880
VeriSign and RSA Security intro security tools that could help combat the upswing in E-commerce threats. By Thomas Claburn. It&#39;s hard to say what&#39;s growing faster, security threats or security solutions.
247413
OS security fix is being rolled out to users who have enabled Automatic Updates.
759924
Chris Hartjes is taking on what he calls his "next foolish project" - a console for the CakePHP framework.   On the CakePHP mailing list, somebody familiar with Ruby on Rails' console functionality asked "why isn't there one of these in Cake?" [...] So I got to thinking about how to do this. On the surface, it seems the easiest way to do this is to write a PHP script that takes entries on the command line, run the input through an 'eval' statement. Sounds easy enough, and I could write that in a hurry. I think the trickiness comes in figuring out how to hook it into CakePHP so that you can access Models that already exist.   For those attending the Vancouver PHP Conference, attend his talk and you might get  amention of how far he's come with the idea. Otherwise, stay tuned to his blog for updates.
437201
One of the things that can go overlooked when setting up a web server is the security if the web server instance itself. Sure, you can work to make your code secure all day long, but if there's an exploit in your server, none of that matters. Well, here to help you along on this path is this new article from DevShed.com.
466917
This third and final article in the Metasploit series covers the msfcli scripting interface as well as the intuitive web interface to the Framework. The article also discusses what's new with version 2.2, and then introduces the exploit development process through an example.
753808
I've not made much of a secret of the fact that I've been working on a new product, and am getting close to offering it as a public pre-alpha thing for Mac users only.  It's fairly Flickr-centric, sucking photos down from Flickr in a variety of ways and pushing up photos in others. Like Radio 8 and Google Reader, it has the ability to maintain an output feed of stuff you want to pass on to friends and associates. As I was developing this I wished that Flickr had the ability to store simple text files, because I needed a place to put an RSS 2.0 feed with enclosures on behalf of each user. Of course I used Amazon S3, but I had to implement my own lightweight identity system so that Juan couldn't accidentally or intentionally replace Alice's feed. If only every user had a place where they could store stuff that's net accessible so that once and for all we could stop inventing new places. I was inspired to write about this when I read an Uncov review of Pownce where they reminded me that they were reselling S3 storage at a big markup. What if the users had their own S3 storage that they paid for themselves?  Then it occurred to me to ask if people thought S3 could be an end-user thing. I'd like to find out, so if some non-technical users who have Amazon accounts would like to try setting up an S3 account, I'd be interested in hearing how it goes. Here's an idea of how you get started. 1. You must already have an Amazon account. Nothing special about it, if you buy shirts or books or stereo equipment from Amazon, you use the same account for S3 storage. Already that's pretty easy, millions of people have Amazon accounts, right? 2. Visit this page on Amazon, ignore all the stuff about objects and buckets. In the right margin is a big button that says "Sign up for this web service." Click the button. A very familiar page appears, asking you to sign into your Amazon account as if you were going to buy something (you are!). 3. From there, I'm not sure what you see, because I have already enabled my account. But the end result of signing up is that you get two strings with weird names: Your Access Key ID and Your Secret Access Key. Any software that would save a document in S3-space on your behalf would need these two strange strings. In return each document would have a URL just like any other document on the web. Nothing strange about that.  4. You could also use the space to store stuff using an FTP-like app that runs in Firefox called S3 Organizer. It's about as hard to use as the Mac Finder or the Windows Explorer, i.e. it's no challenge for a moderately geeky user. The cool thing about it is that you're able to share anything you upload into S3 space with anyone else. You can even use BitTorrent to access any file to save you bandwidth bills and distribute the load round the net. It's all very easy to do, imho. As a developer who has to pay for his users' storage needs I would very much like to see users learn how to use S3 to store their stuff, so I can focus on writing software and fixing bugs instead of paying to store your stuff.
449182
Multiple vulnerabilities have been reported in version five of the widely-used Kerberos authentication protocol. The most serious could be exploited by crackers to gain root control to authentication servers.
32966
Dave Dash has posted a configuration that he had shared with him for getting nginx and the symfony framework to work happily together.   I almost gave up on nginx and was going to settle on lighttpd or Apache, but I decided to check the symfony list and in minutes Kiril Angov (Kupokomapa) answered with a working nginx configuration. This is why I like the symfony community.   He includes the config in an easy to use/c&p kind of format so you can drop it into your install and get it up and running quick.
446342
Lee Blue has posted something looking to bridge yet another gap between Ruby on Rails and PHP - a method for adding before_filter functionality to PHP.   I often use this when implementing a simple login screen for a password protected section of my application. In a Zend Framework application you can implement a preDispatch() function in a Zend_Controller_Action which will run before an action is dispatched. This lets you setup your filter to check to see if the visitor is logged in or not. If the visitor is not logged in, you can redirect them to the login screen of your application.   He includes example code to show its usefulness - checking to see two things: is a user is logged in and to see if they're allowed to use a certain resource.
710524
In this new post on the Northclick blog, Soenke talks about the stream wrappers included in PHP and some of the magic that can happen when they're applied correctly. In this case, it's an application of the ssh2 library (by Sara Golemon).   The new system must be very stable with a strict error checking and has to support several ways of file transports (FTP, SCP/SFTP). SCP is faster then FTP and secure by nature. It's going to be the standard way for deployment.   After finding and loading the extension, things flowed along swimmingly - the code shows a simple transfer method of transfer over a secure ftp connection, complete with a few performance stats at the end.
16648
Opt-out button in spam used to run exploit
728050
According to this security release from Secunia, there's a cross-site scripting vulnerability with the Travelsized CMS package (PHP-based) in the main index file.   David Vieira-Kurz has discovered some vulnerabilities in Travelsized CMS, which can be exploited by malicious people to conduct cross-site scripting attacks.   The problem comes from the input parameters "page" and "langauge" not being verified and sanitized. Users are encouraged to go in and manually edit the source to correct the problem as there is no patch currently posted as of yet. You can get complete information about this issue from the full Secunia report.