Meet us at Acunetix Booth 3227 North Hall Celebrating its 25th Anniversary, RSA® Conference is the leading global info security event, where practical real-world experts discuss cutting-edge solutions and reveal their evolving techniques, practices and concepts on information security. As a proud participant in RSAC, we invite you to…
New attacks on SHA-1 and MD5 raise urgency for their obsolescence
A pair of researchers from INRIA, the French Institute for Research in Computer Science and Automation, have published an academic paper titled “Transcript Collision Attacks: Breaking Authentication in TLS, IKE, and SSH” in which they describe a series of transcript collision attacks against the ageing…
WordPress 4.4.1 security release patches XSS vulnerability
A high-severity Cross-site scripting (XSS) vulnerability has been fixed in WordPress’ new 4.4.1 release that is now available for download. In addition to the XSS vulnerability reported by security researcher ‘Crtc4L’, the release includes 51 other non-security bug-fixes. WordPress sites configured to receive automatic updates…
In the headlines: Juniper backdoor, BBC hack, Steam attack, UK surveillance bill, and more
Juniper backdoor mystery, NSA are at least partly to blame Last week, tech company Juniper Networks who sell corporate networking solutions, disclosed that they had discovered two unauthorised encryption backdoors in their firewalls. Encryption backdoors will immediately grab attention as one of the surveillance methods…
Authenticated scans more effective! How?
The majority of web applications today make use of a login mechanism where the user must supply a set of credentials in order to navigate to authenticated areas of the web application. This allows access to restricted content and content that is customised to the…
Website hack: Help, my website has been hacked! What to do now?
Here we identify 4 practical steps SMEs can plan for and implement when they become a victim of a website hack. With the massive growth in cyber-crime, it’s a sad fact that it’s highly likely to become a question of ‘when’ rather than ‘if’. Below…
Defence in Depth – Final Part – Update software, Isolate services
Update software and components Whether it’s a server’s operating system, a web server, a database server or even a client-side JavaScript library, an application should not be running software with known vulnerabilities. Updating, removing or replacing software or components with known vulnerabilities sounds obvious, but…
Defence in Depth – Part 4 – Validate everything, Parameterize SQL queries
Trust no one, validate everything Unfortunately, most vulnerabilities at the application layer can’t simply be patched by applying an update. In order to fix web application vulnerabilities, software engineers often need to correct mistakes within the application code. It’s therefore ideal for software engineers to…
New Acunetix update includes security checks for Joomla! Core RCE, improved XXE tests and more
New updates have been released that test for a new Joomla! remote code execution vulnerability affecting versions 1.5.0 through 3.4.5 CVE-2015-8562. Other updates also include improved XML External Entity (XXE) testing, multiple Cross-site Scripting tests in commonly used libraries and other improvements/bug fixes. Below is the…