DevShed: Sessions and Cookies
620856
DevShed has a new book excerpt from a good standby security resource from O'Reilly - Chris Shiflett's "Essential PHP Security". This time, they focus on the chapter talking about sessions and cookie security.   This chapter discusses sessions and the inherent risks associated with stateful web applications. You will first learn the fundamentals of state, cookies, and sessions; then I will discuss several concerns - cookie theft, exposed session data, session fixation, and session hijacking-along with practices that you can employ to help prevent them.   The chapter talks about how the statelessness of HTTP causes problems, how cookies can be stolen because of it and what kinds of things you can do to keep you and your users safe (like session fixation).
39364
(InfoWorld) - What if there were a giant database that contained your hidden insecurities, embarrassing medical questions, and the fact that you still think from time to time about your high-school girlfriend? Well, such a data store does exist -- if you've ever plugged such private topics into a search engine. The fact is, search engines like Google, Yahoo, and Microsoft Live Search all record and retain in their vast data banks any term that you query in addition to the date and time your query was processed, the IP address of your computer, and a cookie-based unique ID that -- unless you delete it -- enables the search engine to continue to know if requests are coming from that particular computer, even if the connection changes. Microsoft Live Search also records the type of search you conducted (image, Web, local, etc.), while Google additionally stores your browser type and language. And when you click on a link displayed on Google, that may also be recorded and associated with your computer's IP address. While Google recently announced that it would make its search logs anonymous after 18 months' time by deleting part of the IP address and obfuscating cookies associated with search queries, Microsoft and Yahoo haven't yet made their retention policies public. AOL stores this data for just one month. The upshot: If someone were to ask one of these search engine companies to produce a list of IP addresses or cookie values that searched on a particular search term, they conceivably could. Or, conversely, given an IP address or cookie value, the search engine firm could produce a list of terms searched by the user of that address or cookie value. Don't worry; be happy Some people say there's not much to worry about because the server logs don't associate these search terms with personally identifiable information, such as your name or e-mail address. However, if you have an account with or have registered for any of the additional services on a search engine site -- e-mail, social networks, calendars, shopping lists -- it's feasible that that connection could be made, says Brad Templeton, chairman of the board at the Electronic Frontier Foundation, a group that protects liberties and privacy in cyberspace. In the case of Microsoft and Yahoo, that information can be extensive because of how much personal information these search engine firms ask for on their account registration forms, including your occupation, job title and marital status, and the number of children in your household. According to Whitney Burk, public relations manager at Microsoft, "There is no systematic way of identifying, isolating, or cross-referencing search data with personally identifiable information." Google also says it stores the two types of information separately. However, according to Templeton, "it would be very difficult to make it impossible for someone to make that correlation." Templeton emphasizes that he doesn't know exactly how any of the search engine systems are designed, but -- given typical designs -- there are many different ways that someone with the right access and knowledge could make a retroactive correlation between search terms and personally identifiable information. Considering that search terms can reveal personal information that ranges from medical prescriptions to religious beliefs and political preferences, that's not an association many of us would be happy to see. Even if you didn't provide any personal information, an IP address alone could be traced back through a reverse DNS lookup to the Internet service provider and city of the IP address, according to Danny Sullivan, editor in chief of Search Engine Land, a blog dedicated to search news. Contacting the ISP could result in a positive identification of the account holder by finding out which account accessed the search engine at the time recorded in the search log. Last year, reporters at The New York Times didn't even need an IP address to track down the identity of an AOL user when AOL published anonymous search logs of 500,000 users over a three-month period. The identification was made possible simply based on the specificity of the search terms the user queried, such as real estate searches in the small town where she lived. (If you have any question as to what collected search terms reveal about an individual -- accurate or not -- check out those AOL search logs.) Hello, George Orwell? If all this sounds Big Brother-ish to you, you're not alone. Individual users, consumer interest groups, government regulatory committees around the world, and privacy groups are growing increasingly worried about how much personal data search engine firms retain and what they could do -- or be forced to do -- with this information. In recent months, Google seemingly hasn't been able to make a move without drawing speculation and suspicion about its ability to construct personal portraits of user behavior. Several consumer interest groups have filed a complaint with the Federal Trade Commission regarding Google's acquisition of DoubleClick. The groups claim it would give Google unprecedented insight into consumer behavior because it could track both people's Internet searches and their Web site visits. And when Google released its History feature, which associates individuals' search and page visitation histories with their account information, some observers, such as veteran blogger Anil Dash, called it both "brilliant" and "scary." "With the release of Web History, especially in the context of its recent acquisitions and announcements, Google may have crossed the line where regular users start to react with skepticism and caution instead of unabashed enthusiasm," Dash says in his blog (see "Google hostile to privacy, group says"). The creepiness factor surrounding online search data was also upped by the revelation in early 2006 that the U.S. Justice Department had subpoenaed Google, Yahoo, Microsoft, and AOL to turn over a random list of Web queries conducted over the course of a week, divorced from the names of those submitting them. AOL, Microsoft, and Yahoo turned over some of the requested information, but Google resisted. Although Google set a good precedent by doing so, "Governments can and will do things that companies have to comply with," says Chris Sherman, executive editor of Search Engine Land, referring to the Chinese government pressuring Yahoo to turn over the name of a user who posted to an online forum. "The [U.S.] government is a growing concern because over the last several, years it's been expanding its power to ask for such information, especially as the political climate has changed," Templeton says. For instance, he points out, warrants have been easier to get since the USA Patriot Act was enacted. "It's something we should worry about more than in the past," he says. Of course, some in the government are trying for more, not less, protection for online data. Congressman Edward Markey (D-Mass.) introduced a bill in early 2006 (H.R. 4731) to require owners of Internet Web sites -- not just search engine firms --- to destroy obsolete data containing personal consumer information. Putting aside the government, there are other ways for private data to be revealed, Templeton says, in the form of internal employees. "Everyone knows the history of most large database [breaches] comes down to a story of corrupt employees who sell access to private records," he says. "In the private investigation world, they can use bribes to get people's tax returns." Brass tacks All of this raises the question: Why do search firms store all this data? Google offers three reasons: It can help the company improve its services, maintain security and prevent abuse by looking for patterns indicating fraudulent activity, and comply with legal obligations to retain data. The company asserts that it can use this information to determine how often users are satisfied with the first result of a query and how often they proceed to later results. Or it can determine how many times an advertisement is clicked in order to calculate how much the advertiser should be charged. In his blog, Sullivan is more direct. "Google is big on personalization," he writes. "Big, big, big. For Google, getting up close and personal with individuals is seen as a big leap forward on many fronts -- and 2007 is the year Google is going all out after it." The more Google can know about you, Sullivan explains, the more it believes it can deliver you a better experience, not to mention more targeted ads. "But in particular," he says, "personalization is seen as the next generational step in delivering better search results." But Templeton questions whether the search firms need to store as much information as they do and for as long as they do. "We regularly advise [Google] that they're keeping too much information," he says. While some people, such as Sullivan, applaud Google's move to limit the amount of time it retains search logs, saying that will make it nearly impossible to trace any query back to a particular computer, Templeton thinks total destruction of the data would be far better. "History is full of [incidents] where people thought they could anonymize or destroy data, but people find a way to recover it," he says. "You have to be more thorough in their destruction -- you have to eventually destroy the connection between the IP address and the searches." Plus, Google's move may or may not address backup data, which Sullivan notes is not as easily accessible or altered. And the 18-month window also doesn't address data stored via its Web History feature. That information, Sullivan says, is not being destroyed or anonymized over time. "If you want it wiped out," he says on his blog, "Google says you have to do that separately." On the positive side, Web History lets users know exactly what data pertaining to them is stored, and they can take it into their own hands to delete those histories at any time. The same is true of Yahoo's MyWeb feature, which stores user searches if it's been switched on. With all the focus on user privacy, the search engine firms say they are taking measures to increase the anonymity of users. Google has said it will build privacy protections into its nonsearch products, including Google Talk's "off the record" feature, as well as Google Desktop's "pause" and "lock search" controls. It has also said it will provide easy-to-understand privacy policies for users on its Web site. For its part, Microsoft says it's actively engaged with data protection authorities around the world on what user information is collected and for what purposes as well as policies around notice and consent. "There is no universal consensus on the 'right' policies," Burk says. "However, we will continue to be active with privacy advocates and authorities as these decisions are made." In the end, Sherman says, it's up to individual users to decide whether they trust search engine firms with their personal information. "It's something everyone has to decide -- at what level am I comfortable with the reality of improving my search results vs. my identity being connected with the types of queries I do?" he says. And he's careful to note that the question extends way beyond Google, which in his eyes takes strong measures to secure user data. "When you go to Google, you can't get anywhere near their data centers," he says. "There are levels of security in the company where few people are cleared to get into areas where people can see personally identifiable information." But to Templeton, that's not enough. "Even when people try to do a good job, things happen, and data still gets out," he says. "If it's collected and in a place that can be accessed, it can get out." Furthermore, Sherman points out, it's not just search engines that store personal data. "Your ISP knows more about you than any search engine -- not just what you're searching on but every Web site you've visited," he says. On his blog Sullivan adds, "Google may be anonymizing its records, but your ISP might not be."
622987
Close on the heels of the SimpleTest 1.0RC1 release, is a new article titled "Coding a Login Box Shouldn't Hurt". Web sites can be fiddly to test, especially when it includes functionality like cookie handling and form filling. While manual testing is error prone and tedious, using a Web testing tool can automate the process, making development fast, accurate, and even fun. In this new article , Marcus Baker, helps you solve this tricky problem of authenticating users, by using test driven development.
761635
There's a tutorial over on mpwebwizard.com that's been updated and talks about using a mirror to handle hits from a popular website (like digg or slashdot).   caching services such as coral content distribution network provide an alternative for when your site goes down, but why wait until it gets to that stage? why not just send all your hits from high-end websites to the coral cache version? well, there isn't a good reason not to, so i'll show you how to do it automatically.   He provides the simple script that looks for certain sites in the "HTTP_REFERER" value of incoming calls and pushes them off to the cached location with a header() redirect. The whole thing is only 12 lines, not counting the $sites array.
762869
DevShed wraps up their look at databases in PHP (a excerpted from "Programming PHP, Second Edition") with this new tutorial showing how to insert and work with PDO prepared statements.   Concluding our discussion of databases and PHP, we'll finish building the [administration portion of the website] example that we started last week.    They start with the code for the administration page for adding a new record to the table - in this case, a business. They give the code to handle the submit and how to display a list of the current businesses. They wrap it up with a look at working with PHP Data Objects (PDO) and using them to create prepared statements.
184845
The WordPress.com blog-hosting service suffered a DoS (denial-of-service) attack that began Saturday and was still preventing users from logging in or posting to their blogs on Tuesday.Matt Mullenweg, spokesman for Automattic, confirmed that the service experienced a DoS attack with spikes of up to 6 gigabits of incoming traffic, which was making some blogs inaccessible for about five to 15 minutes on Tuesday. Though service had mostly been restored, Automattic, which maintains WordPress.com, was still working on returning service to normal levels on Tuesday afternoon, he said.&quot;Obviously that [is not good] and is pretty unusual for our service,&quot; he said. &quot;All our people who can are working on the issue.&quot;However, an employee at a New York-based company that has blogs hosted by WordPress.com suggested that some users were experiencing outages for longer than 15 minutes. The source, who asked not to be identified, said on Tuesday afternoon that users there were unable to log in to their blogs and post comments for &quot;most of the day.&quot; However, the blogs were still able to be viewed publicly.&quot;It&#39;s starting to come back to life now, slowly,&quot; said the source on Tuesday afternoon.WordPress.com users were notified via e-mail about the DoS attack. In the e-mail, the service provider said that the attack was affecting user log-in and causing some forums to be offline.Mullenweg said that the main Wordpress.com page was down longer than some blogs because &quot;we sacrificed it in order to keep blogs and our users up.&quot; However, the site&#39;s home page and Web site were up and running on Tuesday.He also provided a link to a graph that shows the traffic spikes to WordPress.com on the graph, where the service&#39;s traffic is displayed in a brown line.A DoS attack is an attempt to make a Web site or service unavailable to intended users by flooding the service or site with incoming data requests, such as e-mails. Motives for DoS attacks vary, but perpetrators mostly target companies with high-profile, highly trafficked Web sites.Joris Evers, a spokesman for security research and software company McAfee, said DoS attacks are still fairly common, although they have tapered off in recent years because technology has been developed that can head off such attacks before they affect service.Though he had not heard specifically of the WordPress attack, Evers said that it&#39;s possible the attack was mounted by someone &quot;who was upset about something that was written on a WordPress blog, and they decided to take action against that.&quot;
444294
DevShed launches a new tutorial series today with this new article, an introductory look at using the PDO objects in PHP5.   As you may have seen at first glance, the PDO extension looks really useful in certain situations. In this three-part series, I'm going to introduce its most important features, by accompanying the corresponding theoretical concepts with numerous hands-on examples, in this way facilitating the respective learning curve.   They start the series off with a look at using the extension and connecting to a resource (in their case, a MySQL database). Then, it's on to performing queries and grabbing the last inserted IDs for the rows your script just put in.
731797
This is really cool!  I finally get my own comment spam!  For some reason I felt left out of the party.  I just wasn't cool enough for the spammers to consider me worthy of their spam.  Anyway.  I implemented my own little turing test.  Now the comments say:  {{{  Turing Test: Are you a human? (required. Just type yes... this is for automated spam prevention)  }}}  While this wouldn't work for all blogs in the wild I'm sure it will work just fine here in my little corner of the blogosphere.  If spammers really want my blog enough then I'll deploy a captcha.  If they solve the captcha I'll deploy a sentient robot  which will traceroute packets back to the host and then terminate with prejudic ...
377359
Digital tracks may help pinpoint Potter leaker &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
90155
Based off of a previous article from Mike Willbanks, Stuart Herbert has posted some of his own thoughts on tuning and tweaking your applications for the best performance you can get out of them.   There's some good advice in there, and I thought it'd be a good idea to quickly add a bit more detail about the separate approaches that Mike raises.   He goes over the APC caching, memcache, the "gzip trick", the "Not Modified" header and optimized SQL statements.   He also mentions one thing that Mike didn't mention - a split between static files (no PHP needed) and their dynamic cousins. Having a more pure Apache (no PHP installed) can help give a minute jump in speed that, depending on the size of the site, could really add up from a user's perspective.
520652
Will a nonprofit-driven browser tackle the behemoth from Redmond?
504112
Be careful, kids Firefox suffers from a flaw that allows attackers to manipulate the authentication cookies of virtually any website, a vulnerability Bugzilla has deemed severe. It's the second major security lapse for the open-source browser in as many days.â¦
747113
On the devthatweb blog, there's a new post from Pat Nakajima with a recipe for deploying a PHP application with the help of Capistrano (the Ruby on Rails tools for deploying web applications).   Recently though, I was working on a PHP project, and I decided that the time had come to rewrite my Mint recipe to allow deployment of any PHP project, totally independent of Rails. I set to work, and I'm happy to share the result.   The example makes it a simple matter of using the command "cap deploy:php" to use the recipe and push out your PHP application.
720529
Yet another new series is starting over at DevShed today with part one of a look at the creation of a blogging application in PHP 5.   Assuming that building a blogger with PHP is really an interesting topic for you, let's learn together how this useful application can be developed in a few easy steps.   These easy steps include:  defining the structure of the application creating the insertBlog method creating the updateBlog method creating the deleteBlog method  Each of the above functions provides just the basics of the functionality needed to make a more fully-developed blogging system, but there's more to come in future parts of the series. You can download a zip file of the current code here.
431197
DevShed continues its look at the Decorator pattern with this new article today talking about working with MySQL result sets inside of the structure of the Decorator pattern.   Definitely, the pattern in question can be used for generating different types of outputs (or views) based on a returned result set, by using a few decorator classes that I'll define in the course of this tutorial. Hopefully, when you finish reading these lines, you should have a clear idea of how to include decorator classes in your object-based PHP applications.   They start off by showing how they're going to handle the MySQL result sets normally with a class and how to use that class in an example. Finally, they tie all of that in with the Decorator pattern, creating multiple Decorator classes to handle the various MySQL result set types.
72073
Security is becoming a more and more popular topic among PHP developers, and Joseph Crawford has followed the trend and written up his own look at the way PHP handles session and session information as it relates to the security for both the user and the server admin.   One aspect that I dislike about the internal PHP sessions is that they are stored in files on the hard disk (usually /tmp/) by default. This means anyone with access to the machine has access to read the session data. I prefer to store my session information in the database to add an extra layer of security.   He looks at the pitfalls of using this kind of setup (among them, multiple users being able to use one IP) and a simple method for creating a custom sessions handler to replace PHP's built-in one. His example works with a local database to handle saving and retrieving the session information. And, to make things unique, he generates a "fingerprint key" for each user's information to serve as a unique identifier rather than handling it on the connection.
349398
The Hardened-PHP Project has issued another advisory today, this time effecting the popular database administration package phpMyAdmin.    During an audit of phpMyAdmin's protection against CSRF: Cross Site Request Forgeries we discovered that there were multiple ways to bypass the protection.   The failure of phpMyAdmin's CSRF protection obviously means that a potential attacker can use CSRF attacks to trick the browser of a phpMyAdmin user to execute any kind of SQL queries on the victims database server.    The advisory mentions the source of the problem - a random token that is in the user's session that could be exploited to gain unauthorized access to an account. Their recommendation is to update to the latest version of phpMyAdmin (2.9.0.1 as of the time of this post) to help resolve the issue.