Application security beyond the scanner monkey

greggles — Fri, 13 Nov 2009 14:55:56 +0000

Matt Fisher of Piscis Security gave a discussion about security beyond the "scanner monkey" phase. Scanner monkeys being people who run a scanner tool, get the output, and think they are done with a vulnerability assessment. There are more and more scanners - commercial, proprietary, and open source - and yet they are no longer good enough.

The scanners only start the process, they don't end it.
The person running the scanner is likely not talented enough to configure it properly.

Perhaps the best quote from the presentation is "we don't fix cars by placing a screwdriver and wrench on the hood and hoping that things get fixed - we need talented people who use tools to fix things."

So, utlimately this presentation suggested that scanners are a part of the solution and that ultimately we need:
* Front end scanners, static code analysis
* Interviews with the developers
* Reviews with whomever manages the hardware/software of the application
And on and on.

It was clear what the takeaway was other than "you should work harder" which is certainly true, but not really motivating or useful to hear.

Using Watcher to make pen testing more efficient

greggles — Thu, 12 Nov 2009 19:47:11 +0000

The Watcher session was basically a sales pitch and demo for the Watcher tool, though it's a free tool so "sales pitch" is not exactly right. Watcher is an open source tool that sites inside of Fiddler which is a web proxy useful for debugging web applications.

The application is a windows only tool.

So, I left the room and went to see Social Media Zombies next door. I'm sure Fiddler and Watcher is pretty awesome, but Grendel is actually cross platform so it's much more interesting to me.

Basically they create a bot and control it with twitter. Turns out, this was actually used for evil after it was initially launched. Further, it's possible to use Facebook, Wave, MySpace, etc. to run XSS and get access to your private data. Overall, quite an interesting presentation with more good resources at Digi Ninja and Social Media Security.

Cracking Drupal - penetration testing

Application security beyond the scanner monkey

Using Watcher to make pen testing more efficient