Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Google Hands Out Web Security Scanner

Soulskill posted more than 4 years ago | from the like-giving-deodorant-to-your-special-friend dept.

Google 65

An anonymous reader writes "Apparently feeling generous this week, Google has released for free another of their internally developed tools: this time, a nifty web security scanner dubbed skipfish. A vendor-sponsored study cited by InformationWeek discovered that 90% of all web applications are vulnerable to security attacks. Are Google's security people trying to change this?"

Sorry! There are no comments related to the filter you selected.

I don't trust it (1, Troll)

For a Free Internet (1594621) | more than 4 years ago | (#31557492)

Google is one of the most anti-privacy, intrusive evil corporations out there, second only to Facebook. They make a living over promiscuous sharing of personal data. Why should I trust them?

Re:I don't trust it (0)

Anonymous Coward | more than 4 years ago | (#31557592)

You shouldn't.

Re:I don't trust it (1, Insightful)

Anonymous Coward | more than 4 years ago | (#31557696)

You shouldn't.

Same as anyone else, trust the code.
http://code.google.com/p/skipfish
It was linked in the article..?

Re:I don't trust it (0)

Anonymous Coward | more than 4 years ago | (#31557982)

What article?

Re:I don't trust it (2, Funny)

maxwell demon (590494) | more than 4 years ago | (#31558040)

What article?

"The" - is there another?

Re:I don't trust it (2, Funny)

Foofoobar (318279) | more than 4 years ago | (#31557628)

How's the weather under that tinfoil hat?

Re:I don't trust it (4, Insightful)

Tokerat (150341) | more than 4 years ago | (#31557686)

If you want the internet to remain free, you'll have to get off your lazy ass. Start by going and downloading the skipfish source - it's under an Apache license - and audit it for us. Tell us if it's got any phone-home reporting, if it leaves out any major items from it's scans, etc.

We all know we should question everything, including Google's intentions. We're pretty smart, we get that. Instead of offering blind, childish rhetoric, you could offer proof and/or solutions. Just sayin'; calling Google a major privacy invader doesn't stop them.

Re:I don't trust it (1)

Z00L00K (682162) | more than 4 years ago | (#31557802)

That would be great, and in the meantime I would say that a tool that does check the security of web applications is a great idea.

I'm working on a semi-public web application used to handle telecom services in hospitals so it would be a great tool for me to ensure that I have as few holes as possible where malicious persons can cause problems.

It's also a great tool to DoS a site with! (1)

tomhudson (43916) | more than 4 years ago | (#31558066)

... since it can hit you with up to a couple of thousand requests a second as it tries all sorts of tricks to see where you're vulnerable ...

As Spock would say ... (1)

ClosedSource (238333) | more than 4 years ago | (#31558544)

"At what rate of payment?"

Re:I don't trust it (1)

shoehornjob (1632387) | more than 4 years ago | (#31559376)

Get over it, privacy is dead (according to that asshole from facebook) and any website/app will mine/sell your data. Information is the new currency of the web. If you are going to be sold you might as well get something for it (enter Google Apps)

Re:I don't trust it (2, Interesting)

AnyoneEB (574727) | more than 4 years ago | (#31560788)

There's more to the internet than other people's web sites. The design of the web is intended for each server to control and serve its own information. This is broken by the fact that the vast majority of internet users want to share information via the web but do not run their own servers. The web was simply not designed for this use-case and cannot handle it sanely in the case of information that is private to a group of people who do not run their own servers.

That may be a good reason to assert that currently the prospects for privacy on the internet look rather bleak, but other methods for sharing information involving encryption and/or friend-to-friend networks, etc. could be developed. Even without key verification being commonplace, they could make spying on the everyday communications of ordinary citizens untenable.

Oh Please, GIVE IT A REST. (5, Insightful)

Frosty Piss (770223) | more than 4 years ago | (#31557714)

Google is one of the most anti-privacy, intrusive evil corporations out there, second only to Facebook. They make a living over promiscuous sharing of personal data. Why should I trust them?

Have they ever lied to you about what they do? I don't use Google under any misinformed idea that they *don't* track everything I do. I go into it knowing that this *is their business*.

Where you under some other impression?

BS - this is important (-1, Troll)

Anonymous Coward | more than 4 years ago | (#31557892)

Google goes with ' Do No Evil' - then makes dough in China until they have Chinese script kiddies tickling their code, and all the privacy and other violations.

Now - that only reminds me of Fox news saying Fair and Balanced - they are neither of those... ditto with Google.

So just cos they 'Tell you' under 3 pages of legalese, and then say we dont censor - when they censor in multiple countries, and then schmidt says if you are worried about being tracked maybe you should not do it.....

Saying they have told us - so they can do it, is like saying, banks can charge $20 for overdraft of 50c - no it is still evil and someone needs to regulate it and slap them down.

Re:BS - this is important (0)

Anonymous Coward | more than 4 years ago | (#31557910)

So just cos they 'Tell you' under 3 pages of legalese, and then say we dont censor - when they censor in multiple countries, and then schmidt says if you are worried about being tracked maybe you should not do it.....

I don't think they have *ever* said that about China or whereever. You might have *ASSumed* that, though.

Re:BS - this is important (4, Insightful)

Miseph (979059) | more than 4 years ago | (#31558396)

Google didn't start the censorship in China, it wasn't their idea, and they weren't the first group to comply with what is, in China, local law. They've also been pretty clearly repulsed by the rule, hence the issues they are now having with the Chinese government. They went into a crappy situation thinking that maybe they could improve things, or at least tolerate them until it had enough time to change (and it is just a matter of time, really)... apparently they were wrong, have seen the error of their ways, and are getting the heck out while they still can.

You seem to think that isn't good enough. So do you believe that because a nation makes laws which you don't agree with, private companies should be obligated to violate those laws in those countries? That failure to do so constitutes evil?

You can't possibly think that would end well.

Re:BS - this is important (0)

Anonymous Coward | more than 4 years ago | (#31558948)

Troll was declined a position @ google

Re:BS - this is important (2, Insightful)

Anonymous Coward | more than 4 years ago | (#31563610)

Wasn't script kiddies that attacked Google in China. It was, as they said, a "nation-state" attack. With plants/spies on the inside of Google China. That's why Google is getting consulting from the NSA now. Google can handle any script kiddie, any botnet, any DDoS, any virus. What they don't have skill in is handling nation-state attacks. Ones that rely on not just attacking from the outside via the internet, but also attacking simultaneously from the inside with pro spies. The NSA, being in the spook biz, has that experience.

All the focus about The Virus? That's virus' makers and virus researchers spin on the story. They only focus on that because that is what they sell. Yes, it was one part of the infiltration. But only one very, very small part. They (the people that actually deployed the virus, not that poor patsy Uni student that the Chinese gov chose as their scapegoat) had inside help. It wasn't the work of script kiddies. It was the work of pro spies. With government resources as their disposal.

While they do censor in countries in compliance with laws (for example, no Nazi stuff in Germany), the difference is that in China, you have to "self-censor" and self-police. The government doesn't tell you what's bad and what isn't. It lets you guess and if you guess wrong, they pull the plug and you lose money. Also, there's no legal process for the censorship. It's all guesswork.

Baidu invites government censors into their office and they sit and work there "as contractors." Google didn't allow that. Google.cn was the least censored of the Chinese search engines. Because all the other companies "self-policed" too much. Google.cn self-censored the least.

Don't get me started the corruption. Baidu and other domestic Chinese have connections with Chinese politicians. When a competitor does too well, they go through back doors to get the competitor censored or slowed down by the firewall, so their share of traffic goes down.

China will never let a foreigner win through free competition. They will rig the game (through the firewall) so that all the local Chinese companies are first. THEN the foreigners can compete for whatever spots are left over.

Re:Oh Please, GIVE IT A REST. (0, Troll)

Hurricane78 (562437) | more than 4 years ago | (#31558104)

That is like saying that you should’t badmouth Hitler, but just not to to Germany in 1942. ;)

Re:Oh Please, GIVE IT A REST. (0, Troll)

aflag (941367) | more than 4 years ago | (#31558260)

They didn't lie to me, but they tricked me into making my email part of a social network.

Re:Oh Please, GIVE IT A REST. (0)

Anonymous Coward | more than 4 years ago | (#31558312)

They didn't lie to me, but they tricked me into making my email part of a social network.

What a load of bullshit. Pay attention. It's *free* Web mail.

Re:Oh Please, GIVE IT A REST. (0)

Anonymous Coward | more than 4 years ago | (#31558642)

Why did you click "yes" on the page asking you if you'd like to use it, then? It doesn't sound like they tricked you so much as you're just an idiot.

Re:Oh Please, GIVE IT A REST. (1)

aflag (941367) | more than 4 years ago | (#31618124)

I didn't click it. My name was suggested to a bunch of people I know, though. So, even though I'm not a "member" I come up as a possible member. I just didn't think it was nice of them. I didn't click it out of luck, anyway, because I had no idea what buzz is when it came up and, if I was in an exploring mood, I'd just accept it to see what was that thing. Which is also not really nice. Had they mentioned it was like a twitter that uses my e-mail address, I'd say no everytime. But they certainly didn't phrase things like that.

Re:Oh Please, GIVE IT A REST. (0)

Anonymous Coward | more than 4 years ago | (#31558398)

Google is one of the most anti-privacy, intrusive evil corporations out there, second only to Facebook. They make a living over promiscuous sharing of personal data. Why should I trust them?

Have they ever lied to you about what they do? I don't use Google under any misinformed idea that they *don't* track everything I do. I go into it knowing that this *is their business*.

Where you under some other impression?

Or the fact that any other company that does anything similar to google is also tracking everything you're doing there as well?

Re:Oh Please, GIVE IT A REST. (0)

Anonymous Coward | more than 4 years ago | (#31558402)

Bless their sugar coated, crunchy (yet, a little chewy) hearts. What will we do now that we won't be able to laugh at idiots and their insecure sites screw-ups?

Re:I don't trust it (4, Insightful)

gmuslera (3436) | more than 4 years ago | (#31557744)

They want to promote to use more their services. One way to make that is to make the web safer, helping more sites to flourish, and so compelling users to do more things online, what will only help them. So for this case, even if they are doing it by their own selfish motives, they are actually trying to helping you. So, in this particular case, your privacy won't get harmed and you will get a good tool. Why don't take it? Want that the real bad guys instead of google get your personal and job data instead?

Re:I don't trust it (5, Insightful)

Enderandrew (866215) | more than 4 years ago | (#31557840)

I could just bury your comment by modding you a troll, but I'd rather correct the misinformation.

Microsoft has patents on how to sell your personal information to the highest bidder. Microsoft, Yahoo, and AOL all handed over your personal search histories to the US government. They all play ball in China. Yahoo handed over bloggers to the Chinese government.

Google targets ads to you, but they don't share your personal data out to anyone. Google tracks your information to serve up ads, but this is all machine controlled. It isn't like Google employees sit around all day reading your email.

If you don't want Google to have your information, then don't use their services. I happen to really like their services. I want the convenience of being able to get to my mail from any device without having to try and run my own mail server (dealing with SSH attacks, whitelisting, backups, etc. can be a pain). Google provides me a free service I enjoy, and thusly I willingly accept the trade-off of targeted ads.

They are VERY upfront about what they do, and they also provide tons of great open source products. They are the primary funder of Firefox, and they fund a decent chunk of Linux development. I'm sick of people calling them evil every single day without providing one single piece of evidence.

Either provide some evidence, or stop spouting FUD and lies. Personally, I'm sick of it.

Re:I don't trust it (1)

hedwards (940851) | more than 4 years ago | (#31557926)

On top of that, if one feels that strongly, there're options. For instance blocking Google javascript and cookies goes a long way, as does not running flash.

One could also go through various proxies and firewalls, but blocking cookies, javascript and flash is enough for most people, anything beyond that is probably overdoing.

Re:I don't trust it (1)

correnos (1727834) | more than 4 years ago | (#31558004)

I agree with most of your points, and agree that idiot conspiracy theorists are way too hard on Google. However, I'm not quite sure that you're correct in saying that Google is the top sponsor for Firefox. I couldn't find any info on it, but it seems unlikely seeing as google has its own browser.

Re:I don't trust it (1)

LordThyGod (1465887) | more than 4 years ago | (#31558064)

Hmmm....a quick *google* search seems to turn up plenty of hits. And in fact, Google has been the primary benefactor for some time. The big question is now with Chrome, will they drop or reduce funding.

Re:I don't trust it (1, Flamebait)

mrjatsun (543322) | more than 4 years ago | (#31558098)

I like Google and their products. I use them all the time.

But I am concerned about them and every other company which keeps information
on me... It's total out of control.

While I don't have a lot of concern on what Google does with the information today..
I do worry about criminals getting a hold of the information (if they haven't, it's just a
matter of time). And I do worry that the company Google is today will not be the
same as the company Google is tomorrow.

I agree with your assertion that you are replying to FUD... But, in some ways,
your reply is FUD too.. While Google may be better than all those other
companies today, does that make the data collection they do OK. It's not
a question specific to them.

> and they also provide tons of great open source products.

I consider Google to be opensource neutral. They open source very little
of their code. I would like to know how much money, as a company, they
spend on open source software vs the money spent on all software they
write.. I would expect a very low percentage.

i.e. personally I would like to look through the code for the gmail client,
maps, reader, jabber client, calendar, etc. None of this is core to their income
stream. I believe it would help dramatically improve other websites on
the web over time.

What about their e-mail server, IM server, calendar, etc?

I understand why they would keep their search algorithm closed.
Their data and how they mine it is where their real value is.
It certainly is their prerogative to to keep everything else closed
too... But I certainly wouldn't call them open source friendly.

Re:I don't trust it (3, Informative)

symbolic (11752) | more than 4 years ago | (#31558334)

The ACLU has an interesting video regarding data retention and proliferation: http://www.aclu.org/ordering-pizza [aclu.org]

It's not quite all here yet, but it's definitely not outside the realm of probability.

Re:I don't trust it (1)

LordThyGod (1465887) | more than 4 years ago | (#31558102)

Amen. There is nobody out there doing anything near what Google has done to improve the internet for all of us by providing free tools. Nobody. Of course, its in their own self interests to do so. But its in mine too.

Re:I don't trust it (1)

YrWrstNtmr (564987) | more than 4 years ago | (#31558196)

If you don't want Google to have your information, then don't use their services

Realistically, we don't have that option. Someone sends me an email from a gmail acct, poof, there I am. And I can't reply without using gmail, because that is all they use.

I do use google products quite a lot, so I'm not trying to hide from them. But they have become so pervasive that it is hard to not use them, even tangentially.

Re:I don't trust it (4, Insightful)

SanityInAnarchy (655584) | more than 4 years ago | (#31558362)

Someone sends me an email from a gmail acct, poof, there I am. And I can't reply without using gmail, because that is all they use.

True, but not really relevant -- if they weren't using Gmail, they'd be using something else. Do you trust Yahoo or Hotmail any more than Google? How about some random ISP?

And it's not like they can track much from that, other than your conversations with someone who already keeps all their other conversations with Google.

Re:I don't trust it (1)

Xzallion (949882) | more than 4 years ago | (#31562966)

You can encrypt the text of your response where only gmail see's who sent it, or use any one of the many throwaway email services that will let you make an email account that only lasts for 24 hours. look into PGP, throwaway email addresses, and also just look at the text. If you say "Yes grandma I will be at the family reunion." or "Yes we will close the Jefferson Deal" what information does google have on you? That you expect to go to A family reunion out of the estimated thousands of them every day? Or that they somehow magically know what the Jefferson deal is about? All they can do is parse the text, and keep an internal record link to the email address that sent it. Just email them explaining you don't like unencrypted text over email (cause all public email will be parsed for keywords, how do you think yahoo and AOL make their money?). Then encrypt it and let them unencrypt it on their machine where google gets nothing. Stop blaming their system for your lack of effort.

Re:I don't trust it (1, Informative)

Anonymous Coward | more than 4 years ago | (#31559092)

Here's your evidence: *.doubleclick.net (e.g., g.doubleclick.net, ad.doubleclick.net) still infests the web with its ads and cookies on a great majority of websites.

They are still using Doubleclick technologies on the web in parallel with their own technologies. Doubleclick was considered as "evil" long before they were acquired by Google, and that doesn't change as long as the Doubleclick presence persists on those websites. Check it for yourself--enable your cookies and turn off your ad-blocker--Doubleclick still serves various types of animated ads and Flash ads just like several other ad providers in existence (Burstnet, Fastclick, etc.) that the ad-blockers have been designed to block.

Re:I don't trust it (0)

Anonymous Coward | more than 4 years ago | (#31560912)

An interesting stat which has shot up in the past 6 months actually makes it really hard to not use "Google Services". If you're the admin type for a reasonable organisation, take a look at the growth in bandwidth use for *google-analytics.com (that you! pay for). Sure, it's nifty for the sites who include it "for free" but all the information goes back to Google first. Suffice to say for an organisation of around 3600 people, I saw a growth from 505MB per month July last year, to more than 20GB monthly now. If you've got the rights, check it out, I now have to try and figure out how to block it on a corporate level, without breaking the user experience which sounds quite tricky from all accounts... Remember, it's not just to serve up ads, these "free" services are collecting other things for both other websites and Google.

Re:I don't trust it (0)

Anonymous Coward | more than 4 years ago | (#31571440)

If your users are going through a proxy, then just drop the google analytics domain into either the hosts file and pointing it at localhost or somewhere other than google, or drop the domain into the proxy's block list.

Should do the trick.

Google API (4, Interesting)

Tokerat (150341) | more than 4 years ago | (#31557624)

Considering how many web apps use Google APIs in some form or another these days, I'd say it's in their best interests to ensure those sites don't all become a liability to eachother by way of their centralized cloud.

Re:Google API (5, Interesting)

girlintraining (1395911) | more than 4 years ago | (#31557846)

I'd say it's in their best interests to ensure those sites don't all become a liability to eachother by way of their centralized cloud.

Given how most websites still use homebrew code and database interactions, and that's the most common route of infection (injected code), this only covers a small range of possible attack vectors.

2 side sword (2, Interesting)

gmuslera (3436) | more than 4 years ago | (#31557962)

Is VERY fast, been observed 500 request/seconds against responsive internet servers, 2000/sec when in the same lan, and of course, is targetted against dynamic apps, not exactly static images/content. With that speed the first vulnerability that they will find is vulnerability to DoS attacks. The good news: when the bad guys try to find your application vulnerabilities using this tool, that will be the only one that they will find. Worst case scenario: the code gets included in a botnet,

Re:2 side sword (1, Funny)

Anonymous Coward | more than 4 years ago | (#31558806)

Is VERY fast, been observed 500 request/seconds against responsive internet servers, 2000/sec when in the same lan...

Wow, it's almost like you read the FAQ [google.com] or something:

500+ requests per second against responsive Internet targets, 2000+ requests per second on LAN / MAN networks...

Re:2 side sword (1)

Nicolay77 (258497) | more than 4 years ago | (#31574124)

Yeah, because no one else can write a C web client any more, only Google.

</sarcasm>

Really, do you work for Fox News or something?

Can someone explain this (1)

Yvan256 (722131) | more than 4 years ago | (#31558282)

When I click on "View a sample screenshot", my browser downloads the damn PNG file instead of simply displaying it like it should. Is it something wrong on Google's side or is it my browser?

Re:Can someone explain this (0)

Anonymous Coward | more than 4 years ago | (#31558328)

From the HTTP headers:

    Content-Disposition: attachment; filename="skipfish-screen.png"

This makes your browser treat it as an attachment to be downloaded.

Re:Can someone explain this (1)

SanityInAnarchy (655584) | more than 4 years ago | (#31558348)

That is weird. Given Google Chrome does it, too, I'd assume it's something wrong on their side.

In particular, the headers for that URL are:

200 OK
Cache-Control: public, max-age=604800
Connection: close
Date: Sun, 21 Mar 2010 11:57:00 GMT
Accept-Ranges: bytes
Age: 18380
Server: DFE/largefile
Content-Length: 146941
Content-Type: image/png
Expires: Sun, 28 Mar 2010 11:57:00 GMT
Last-Modified: Thu, 18 Mar 2010 19:13:33 GMT
Client-Date: Sun, 21 Mar 2010 17:03:20 GMT
Client-Peer: 209.85.225.82:80
Client-Response-Num: 1
Content-Disposition: attachment; filename="skipfish-screen.png"
X-XSS-Protection: 0

In other words, the server is deliberately telling your browser to treat it as an opaque attachment to be downloaded (and saved with that filename), and not something to be displayed.

Re:Can someone explain this (1)

Yvan256 (722131) | more than 4 years ago | (#31561030)

Is there any way to work around websites that do that for files that you know your browser can display by itself, such as PDF files?

Re:Can someone explain this (1)

amRadioHed (463061) | more than 4 years ago | (#31561174)

The Open in Browser plug-in for Firefox works for files that Firefox supports natively, not sure if it can help with PDFs.

Re:Can someone explain this (1)

SanityInAnarchy (655584) | more than 4 years ago | (#31561176)

Yes, but it's annoying enough to be pointless. Your options are pretty much to patch your browser or to set up a proxy that filters that header. Either way, you need to think about how you're going to identify it -- with content-type, or with the filename extension? (I'd suggest content-type.)

Besides which, it actually makes sense to have this functionality. Sometimes, you have a button that says "download" explicitly. In this case, some idiot put the screenshot in the "files" area, which is intended for downloads. These are all cases where you want to force the browser to treat it as a separate file anyway.

Re:Can someone explain this (1)

shird (566377) | more than 4 years ago | (#31563264)

Well, they are linking to the "downloads" section (check out the downloads section, its the same url). It makes sense that the "downloads" should be serving stuff up as downloaded rather than embedded content.

Re:Can someone explain this (1)

SanityInAnarchy (655584) | more than 4 years ago | (#31563562)

Yeah, it just doesn't make sense that they put the screenshot in the downloads section.

Re:Can someone explain this (1)

gilgongo (57446) | more than 4 years ago | (#31558692)

Ironically, when I clicked that link, I thought "Woah! The server's trying to send me a file that's not an image! It's must be 0wned!"

But I carried on anyway because of my blind faith in all things Google, and was greeted by a rather ugly screenshot. And maybe an infected desktop or something...

The 90% figure is wrong (1)

Anonymous Coward | more than 4 years ago | (#31558610)

I peeked at the report, out of curiosity. They don't claim that 90% of web applications are vulnerable, they DO claim that 90 (well, 89%) of all the web vulnerabilities are in web applications (which is quite a different thing).

Skipfish vulnerability scanner (3, Informative)

Anonymous Coward | more than 4 years ago | (#31558794)

We configured skipfish and pointed it at our custom platform with full administrator rights. Entered our systems custom file extensions into the skipfish dictionary.

Overall the performance is quite good (>3k HTTP requests per second) after tweaking concurrent connection count. Orders of magnitude better than any scanner we have ever used.

The report UI seemed polished and provided quite a bit of useful data with summaries and drill down to detail. It would really help if instead of simply posting raw request/response data it would highlight sections of the response that lead it to make an assumption WRT a particular vulnerability.

In terms of scan results they look for quite a number of common vulnerabilities, some of the checks are quite creative. I especially liked the check for "interesting" contents. Some of our test data tripped them - this was perfectly reasonable given content.

Aborted the scanner at the 5 million http request mark ~20mins later.

In terms of actual results against our system out of the several dozen possible vulnerabilties reported from XSRF, injection..etc there were no actual problems discovered - 100% false alarms.

There is something really odd about some of the requests being made .. I don't know if its intentional to discover bugs but the folder/file parsing looks to be broken and its building stupid path names with the filename /subfolder.. This seems to be causing most of the UI not to crawl as it seems to be ending up in the 404 category. Maybe this is my fault on dictionary configuration but the system wastes way too many requests throwing the dictionary at each resource and not nearly enough time crawling the site and discovering whats available for expliot.

I then took a cursory glance at the source code.. all of the rule checking is hard-coded in C. (See analysis.c) ... which to me seems quite stupid and useless.

The tool is a start already better than many freebie tools I have used over the years.

My advice is to first and foremost abstract the analysis details out of C code. Focus more on walking even if its dynamic content and bolt in some intelligence/expert system to direct activities.

Re:Skipfish vulnerability scanner (0)

Anonymous Coward | more than 4 years ago | (#31560980)

Yes, they should use a slower, higher level language so that idiots can code for it too? Face it, most of the real coders out there (no I don't mean the tools that write webapps and VB.net interfaces to the same database tailored 800 times) are fluent in C. So you're the community college coder type. Get over yourself.

Re:Skipfish vulnerability scanner (0)

Anonymous Coward | more than 4 years ago | (#31563426)

I guess I'm sorry for not making my point clear. Its not that they used "C" its that the rule engine cannot be abstracted to its own file or database so that it can be easily extended. There are too many matches for crap like "SELECT * " "UPDATE ..." "hidden" "submit" ..etc hard-coded thats the real issue..not a choice of language.

For example virus scanners don't hard code signature tests into binary executables..they have languages and databases that are application specific to handle the requests to provide better decoupling and extensibility of the system.

BTW this AC loves C/C++ :)

Re:Skipfish vulnerability scanner (1)

ladadadada (454328) | more than 4 years ago | (#31569072)

No, he wants the rules moved out of the source code for the same reason that anti-virus definitions are not compiled-in to anti-virus products and Nessus plugins are not compiled-in to Nessus.

New attacks are developed all the time, new vulnerabilities are discovered all the time. Having to write C code for this and re-compile the entire scanner is a massive pain and waste of time. Writing a rule should be quick and easy. And yes, even non-coders (say, sysadmins who may have never touched C or maybe anything other than Perl) should be able to do it successfully.

Even changing it to be a compiled-C plugin would be better than having it compiled in to the main application.

I see this being an improvement for the near future.

Nothing Is Free (0, Troll)

re_organeyes (1170849) | more than 4 years ago | (#31559818)

Including skipfish. While I haven't downloaded it, I have no doubt that something is being reported back to Google. Just as with any business practice, there is always a light at the end of the tunnel. Google advertising maybe? Possibly, whatever the reason, I doubt "Free" in this case really isn't "Free".

Re:Nothing Is Free (0)

Anonymous Coward | more than 4 years ago | (#31560170)

Here's the advantage to Google: More secure web sites. What is Google selling to its users? Website access. If sites people visit through Google aren't secure, people will stop trusting Google (rightly or wrongly), and stick to sites they know only. If Google's usage goes down, they lose potential advertising money.

There's also a secondary advantage. If these secure sites are less available to hackers/spammers to link to their own sites, they can't as easily throw off Google's ranking mechanisms.

Go Away Idiot (0)

Anonymous Coward | more than 4 years ago | (#31560776)

Fucking moron.

90% is probably low (1)

Geek of the Week (845) | more than 4 years ago | (#31562132)

I wouldn't be surprised if the actual number is much, much higher. This has always been a problem with software development, I'm not sure why anyone thought it got better when apps became web-based. When your business depends on apps being up and running (or running the newest, coolest features) security is usually not the highest priority.

As a vendor I sit in meetings all the time with app architects and even security people (up to and including CISOs) at some of the biggest corporations in the world who freely admit to the horrid security holes in their apps. Worse, a lot of them think their packet inspection firewall will protect them. Layer 7 attacks are still not very well understood or appreciated by a lot of IT people.

Many people are working to help App insecurity. (2, Insightful)

workie (1754464) | more than 4 years ago | (#31563252)

I just wanted to point out that many organizations and people are trying to resolve the global web-insecurity issue caused by many things including application insecurity. Google is just one participant in this effort. What is frustrating is that when Google talks people call it news. When these other organizations make contributions, nothing is heard.
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?