Tuesday, October 30th, 2007
Joe Walker on Web Application Security
Category: Security
Joe Walker gave a standout talk on Web Application Security at The Ajax Experience.
I love to watch people leaving this talk as they are usually gasping as they realise that we are not secure :)
Joe has posted the slides from his talk, and has provided some great resources:
4.5 rating from 24 votes
Some interesting points, though I didn’t really see where he tried to go with the whole DNS story…
Awesome little presentation, especially when pointing out the difficulties of detecting scripts hidden in your user inputs.
@Ultimer:
What part of the DNS pinning did you not understand?
is there a video of the presentation?
@Brad
I understand the attack well, but compared to the rest of the presentation it stands out for not giving a lot of info on the attack.
It for example doesn’t state it only works if the victim-server doesn’t check the “http host ” prop-erty, which seems like an effective way to block this attack. I’m aware most intranet servers will not do this, but not giving a solution at all, seems odd to me.
Other parts of the presentation give far more information on prevention, where the DNS-part does not. It simply went into the next subject, leaving someone to think there is no solution.
See http://www.securityfocus.com/archive/1/443209/30/0/threaded, for more info on the attack though. (Maybe he said it during the presentation, but I can’t know by only going by the sheets)