IIS Rounds the Security Corner
473309
Opinion: There are only two Web servers that matter. While two-thirds of domains run Apache, Web server share numbers show that Microsoft&#39;s IIS is also a respectable choice.
38008
Vulnerabilities could allow attackers to gain remote control of a system, security company says.
648643
This article discusses current trends in penetration testing for web application security, and in particular discusses a framework for selecting the best tool or tools to use for these increasingly common type of application.
396953
Though Microsoft&#39;s new security update package is all about protecting systems from worms, viruses and spyware, it can&#39;t do much about what&#39;s already on computersâand that could pose a problem.
310902
Multibillion-dollar security initiatives have given rise to a new industry seemingly overnight. A News.com special report.
178847
A bug in Microsoft&#39;s Internet Security and Acceleration (ISA) Server 2000 and Proxy Server 2.0 can let hackers spoof Web content, such as a trusted site, with their own fake content, the Redmond
94093
An intruder could manipulate a flaw in how the browsers handle image files to see where the user has been surfing.
560755
The risky security holes are in tools commonly provided by software makers and ISPs to provide remote tech support.
383169
Grid architecture aims to protect corporate networks from interior security threats.
46795
HypervisorShield, a new service of Catbirdâs V-Security suite, extends security protections to the hypervisor layer in a virtual environment.
620094
roundup Free-roaming source code breeds new Netsky pest. Also: From IE to Opera, browsers are a likely prey.
1796
Symantec's identity-protection software is designed to make Web surfing safer.
635724
In a new post on his blog, Christian Wenz mentions the latest results of the SANS Institute's Top 20 Internet Security Attack Targets list which both includes a new entry ("Users") and several mentions of PHP and PHP-related applications.   Of course you can debate how such a Top list came together and what the real value behind that is, but there are two specific points in this year's list that I found quite interesting.   There's two targets for the PHP community to worry about - sysadmin/hosting and things developers need to keep in mind. Items on these lists include:  Always test and deploy patches and new versions of PHP as they are released Use Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests. Consider using Apache's mod_security to block known PHP attacks If you use PHP, migrate your application to PHP 5.2 as a matter of urgency. Encode all output using htmlentities() or a similar mechanism to avoid XSS attacks  You can check out the full information over on the SANS Institute website.
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
522864
Security researchers say Google may be on to something with its research on whether IIS servers are more likely to be vulnerable to malware. But there could be a plethora of reasons why that's the case.
143995
A sophisticated hacking scheme seen early last year appears to be affecting an increasing number of Web servers.
163448
Jon Oltsik explains why a new computing security conundrum presents CIOs with a problem that's not given to an easy solution.