This is really serious, last night full Researchers from Google have documented serious vulnerabilities in Adobe Flash content which leave tens of thousands of websites susceptible to attacks that steal the personal details of visitors. download the reef film in hd formats The security bugs reside in Flash applets, the ubiquitous building blocks for movies […]
Hey, this is pretty useful, SWF Intruder, a tool for analyzing and testing the security of Flash applications. is the hurt locker on dvd yet How many of you are still thinking of the security when you develop flash application? My experience with flash and Actionscript in particular is that i’m happy enought to see […]
Another planet you don’t want to miss, especially If you care enough about web apps security. Planet Web Security. full movie downloads super full movie Get the RSS feed here. buy the sucker punch film
The security hacks blog has a summary of top 15 free SQL injection scanners. I haven’t tested all, but i know it would be useful. about the 127 hours watching yip man 2 online download film red download full film faster the movie to buy
Alright, kids. Bookmark this, a useful SQL injection cheat sheet. Currently only for MySQL, Microsoft SQL Server, some ORACLE and some PostgreSQL. Good for your own protection. And please don’t try to do anything stupid to others, ok! movie little fockers on dvd psp tangled movie download download divx get him to the greek movie […]
Ilia once again shared his excellent article about web security here. This article talks about two well known security threats, CSRF and XSS, how malicious hackers do that, how to prevent them, and most importantly why our common solutions that we think has solved this problem doesn’t actually work. watch kingdom of heaven film in […]
“…big difference between the web and traditional well controlled collections is that there is virtually no control over what people can put on the web. Couple this flexibility to publish anything with the enormous influence of search engines to route traffic and companies which deliberately manipulating search engines for profit become a serious problem.“
But i don’t think even Brin nor Page would expect that their invention could bring another problem that emphasize what they meant with “no control over what people can put on the web”.
The idea is quite simple, all you have to do is to create a malicious website that contains links attacking web application (CSRF), like this:
and submit this to Google. When Googlebot comes to your website and find this link it will dutifully try to index the URL. And when it does .. bang! the robot do the job for you, attacking your target.
This is not a new idea though. Michal Zalewski wrote about this in 2001 in title “Against the System: Rise of the Robots“. His introduction tells us the whole idea,
Consider a remote exploit that is able to compromise a remote system without sending any attack code to his victim. Consider an exploit which simply creates local file to compromise thousands of computers, and which does not involve any local resources in the attack. Welcome to the world of zero-effort exploit techniques. Welcome to the world of automation, welcome to the world of anonymous, dramatically difficult to stop attacks resulting from increasing Internet complexity.
However, this kind of attack is not only Googlebot’s problem, other search engine bot have the same kind of ability to do the dirty job for you like MSN, Yahoo and dozen of others.
So who’s to blame? Surely, the bad guy who run the original website. Although you can also put the blame to the owner of the victim websites which ignore the security factor and leave all their pages open to any bot for higher pagerank.