never-ever-****-with-my.net

At Hack.lu 2006, "a three days conference in the center of Europe for bridging ethics and security in computer science," Wietse Venema (author of Postfix, etc.) did a presentation on secure programming traps and pitfalls: he analyzed "a very small program that appears to be obviously correct, yet completely fails to perform as expected, for more reasons than many people can think of."

Wietse took the example of a broken file shredder, which is defeated by operating systems and hardware optimizations (e.g., caches, journaling file systems, etc.). The last three slides of his presentation (PowerPoint) are a must read.

According to the Web Application Security Consortium (WASC), XSS and SQL injection remain the most popular attack vectors being exploited in public incidents. Further details can be found in the Web Hacking Incidents Database (WHID), which was updated today.

The chart below illustrates the number of public incidents registered per year:

A broader list of vulnerabilities is listed in OWASP Top Ten, which ranks the most critical web application security flaws.

Microsoft released an anti-cross site scripting library for its .NET Framework. It can be freely downloaded here.

This interesting article (in French) warns webmasters about the "latest" spammers' techniques to exploit e-mail forms (i.e. FromMail.pl).  It consists in injecting recipients in the From: field.  We told you before: you shall never trust user input. :-)