Blog: A Blueprint to Stop Browser Attacks; defending against cross-site scripting attacks

A Blueprint to Stop Browser Attacks
Technology Review (05/14/09) Naone, Erica

University of Illinois at Chicago (UIC) researchers will present a new way of defending against cross-site scripting attacks at the upcoming IEEE Symposium on Security and Privacy. The new defense enables a Web site to control how user-generated content is transmitted to a Web browser, neutralizing cross-site scripting attacks before they reach the end user. White Hat Security founder Jeremiah Grossman says cross-site scripting is the most prevalent threat on the Internet, and although newer Web sites are better equipped to defend against these attacks, there are still millions of vulnerabilities on the Internet. The UIC solution involves a layer of software called Blueprint that can be inserted between user-generated pages and the browser. Blueprint is stored on a Web site's servers, reads user-generated HTML, and checks it against a white list of trusted code, removing any potentially harmful scripts and deciding how content should appear in a browser. The software then reformats the information and transmits it to the browser. For example, Blueprint eliminates characters and symbols that are sometimes used to send unauthorized scripting signals to a user's browser. The solution was tested against 94 types of cross-site scripting attacks and successfully prevented every attack. "What we want to do is to take away the ability for the browser's parser to make any script-identification decisions on the untrusted content that is supplied by the Web application," says UIC professor V. N. Venkatakrishnan.

View Full Article

Blog: Constantinos Daskalakis Wins ACM Award for Advances in Analyzing Behavior in Conflict Situations; "The Complexity of Nash Equilibria"

Constantinos Daskalakis Wins ACM Award for Advances in Analyzing Behavior in Conflict Situations
Association for Computing Machinery (05/14/09) Gold, Virginia

ACM has awarded Constantinos Daskalakis the 2008 Doctoral Dissertation Award for advancing the understanding of behavior in complex networks of interacting individuals, such as those created by the Internet. Daskalakis's dissertation, "The Complexity of Nash Equilibria," provides a novel, algorithmic perspective on Game Theory and the Nash equilibrium. Daskalakis, a postdoctoral researcher at Microsoft Research New England, was nominated by the University of California, Berkeley, and will receive the award at the annual ACM Awards Banquet on June 27 in San Diego. Daskalakis's dissertation explores whether rational, self-interested individuals can arrive, through their interactions, at a state in which no single one of them would be better off switching strategies unless others switched as well. This state is called a Nash equilibrium, and is traditionally used in Game Theory as a way of predicting the behavior of people in conflict situations. Daskalakis demonstrated that in complex systems the Nash equilibrium is computationally unachievable in some cases, suggesting the Nash equilibrium may not be an accurate prediction of behavior in all situations and emphasizing the need for new, computationally meaningful methods for modeling strategic behavior in complex systems, such as those found in financial markets, online systems, and social networks.

View Full Article

Blog: The A-Z of Programming Languages: Tcl; a powerful command language

The A-Z of Programming Languages: Tcl
Computerworld Australia (05/08/09) Edwards, Kathryn

John Ousterhout is the creator of the Tcl programming language. He says that its creation came about to meet the challenge of producing and deploying a powerful command language as a library package that can be embedded within diverse applications to form the core of the applications' command languages. Ousterhout says that his realization that he could construct a toolkit as an extension to Tcl led to the creation of the Tk framework. Ousterhout splits the Tcl ecosystem into two camps. "On the one hand are the Tk enthusiasts who believe that the Tcl/Tk's main contribution is its powerful cross-platform [graphical user interface] tools; they think of Tcl/Tk as a standalone programming platform, and are constantly pushing for more Tk features," he says. "On the other hand are the Tcl purists who believe the most unique thing about Tcl is that it can be embedded into applications." Ousterhout says the scope of activities encompassed by Tcl, rather than any single flagship application, has been the programming language's biggest advantage. He says the use of Tcl to build large programs took him by surprise, as he only anticipated that very short programs would be built with the language because it was originally designed as a command-line tool. Ousterhout thinks the migration of coding to scripting languages makes sense, as "scripting languages make it substantially easier to build and maintain certain classes of applications, such as those that do a lot of string processing and those that must integrate a variety of different components and services."

View Full Article

Blog: US Power Grid Infiltrated

SANS NewsBites Vol. 11 Num. 28 (4/10/2009)

US Power Grid Infiltrated (April 8 & 9, 2009)

US national security officials said that the computer networks of the country's electrical grid and other utilities have been infiltrated and seeded with tools that could potentially be used to disrupt communications, electricity, and other elements of the country's critical infrastructure. As yet, there have been no attempts made to use the software to cause damage. Most of the intrusions were not detected by the companies responsible for the systems, but by US intelligence. In light of this report, cyber security experts have begun urging the Federal Energy Regulatory Commission (FERC), the Nuclear Regulatory Commission (NRC) and the Energy Department to push for legislation that would grant them more oversight and authority to manage grid (cyber) security. Earlier this week, before reports of the intrusions, the North American Electric Reliability Corporation (NERC) recommended that energy companies look closely at how they identify critical assets and critical cyber assets. A link to NERC Vice President and Chief Security Officer Michael Assante's letter regarding a compliance survey on critical cyber asset identification can be found below.

http://online.wsj.com/article/SB123914805204099085.html

http://fcw.com/Articles/2009/04/08/FERC-needs-to-step-up-oversight-to-safeguard-grid.aspx

http://www.nextgov.com/nextgov/ng_20090408_1423.php

http://www.washingtonpost.com/wp-dyn/content/article/2009/04/08/AR2009040803904_pf.html

http://www.cnn.com/2009/TECH/04/08/grid.threat/index.html

http://www.eweek.com/c/a/Security/Before-Grid-Hack-Reports-NERC-Advises-Industry-on-Cyber-Assets-479748/

Q&A About Grid Intrusions:

http://lastwatchdog.com/chinese-russian-cyberspies-lurk-us-electrical-grid/

Assante Letter:

http://online.wsj.com/public/resources/documents/CIP-002-Identification-Letter-040609.pdf

[Editor's Note (Schultz): Over the years there have been many indications that security within electrical companies is deficient. The recent discovery of widespread malware ostensibly installed by agents of foreign countries should leave no doubt that this problem exists and that is is extremely serious given the critical role of the energy sector in the US critical infrastructure. I am thus appaled that all NERC is doing is recommending "that energy companies look closely at how they identify critical assets and critical cyber assets."

Recommendations in this arena abound, but they have been largely ignored. Mandates are now clearly necessary.]

Blog: Microsoft's intelligence security report: The top 5 takeaways

Microsoft's intelligence security report: The top 5 takeaways

Posted by Larry Dignan; April 8th, 2009 @ 2:15 am

Microsoft on Wednesday will unveil its sixth Security Intelligence Report and the tome—all 184 pages of it—has a lot of interesting data points culled from the software giant's antivirus applications. Microsoft concludes that rogue security software is a big threat, lost and stolen equipment is a bigger issue than hacking and PDF and Office extensions are leading vectors.

Blog: Quantum Computers Will Require Complex Software to Manage Errors

Quantum Computers Will Require Complex Software to Manage Errors
National Institute of Standards and Technology (04/07/09) Boutin, Chad

National Institute of Standards and Technology (NIST) theorists have demonstrated that a type of software operation, believed to be a solution to the fundamental problems with computer hardware, will not function as originally hoped, adding additional complexity to the development of quantum computers. If quantum computers are ever realized, they will use effects associated with atomic physics to solve enormously complicated problems. Prototype quantum processors have proven to be prone to errors caused by noise from stray electric or magnetic fields. To make error correction more efficient, researchers are designing quantum computing architectures to limit errors, including creating software that does not permit qubits to interact if their errors could compound one another. Quantum software with this property is called "transversal encoded quantum gates." However, the NIST team has proven that this software, which is heavily studied due to its simplicity and robustness against interfering noise, is insufficient for performing arbitrary computations, meaning any software that quantum computers use will have to be far more complicated and resource-intensive to ensure devices work properly. The NIST researchers mathematically proved that transversal gates cannot be used exclusively and that more complex solutions for error management and correction need to be found and deployed.

View Full Article

Blog: Microsoft and Facebook Team Up to Put the Kibosh on Koobface

SANS NewsBites Vol. 11 Num. 27 (4/7/2009)

Microsoft and Facebook Team Up to Put the Kibosh on Koobface (April 6, 2009)

Microsoft and Facebook are working together to protect users from the Koobface worm. Koobface spreads through Facebook and MySpace social networking sites and infects users who run vulnerable versions of Windows. It steals login information so it can hijack accounts and spam users' contact lists. The spam usually contains a link to what is billed as a video, but users who click the link are told they must download a program to watch the clip. If users agree to the download, their machines become infected with malware. Microsoft has added Koobface to its Malicious Software Removal Tool (MSRT), which removed nearly 200,000 instances of Koobface from more than 133,000 computers in two weeks.

http://www.informationweek.com/news/security/vulnerabilities/showArticle.jhtml?articleID=216403016

http://www.scmagazineuk.com/Microsoft-and-Facebook-join-forces-to-battle-and-crush-Koobface-worm/article/130153/

http://www.theregister.co.uk/2009/04/06/koobface_clean_up/