The District of Columbia recently attempted to give the opportunity to number of people who live or work overseas to be able to cast their vote remotely. To do this a secure E-Voting website costing over $300,000 was built. On Tuesday, September 28 2010 the first public trial run was launched. Thirty-six hours later the voting system was hacked by a student. It took nearly three days for D.C officials to realize that their system was compromised. The trial was immediately suspended and red-faced engineers and politicians quickly scrambled to find out how this breach could possibly have happened.
Four skills that will make you a better Web security professional
People who are at the top of their games such as Formula One engineers, neurosurgeons, stunt pilots and so on have one thing in common: they all have finely-tuned technical skills. This is not just specific knowledge of what they do but knowledge about many…
Why all the hoopla over the Twitter onMouseOver flaw?
The recent publicity and ranting about Twitter’s onMouseOver flaw* got me thinking about our perception of software quality and expectations of risk. Why is there no room for error when Twitter makes a mistake yet we put up with so many bigger – and more…
Check if your application is vulnerable to ASP.NET Padding Oracle Vulnerability
Everybody’s talking about the ASP.NET Padding Oracle vulnerability released a few days ago at the ekoparty Security Conference. However, until now there wasn’t enough information on how do you check if your application is vulnerable or not. Yesterday, Duncan Smart from ASP.NET forums published some…
Why do so many people buy into "checklist" audits?
Probably my biggest pet peeve related to application security is the claim by many (typically management) that “We know we’re secure, we just had an audit”. I can’t tell you how many times I’ve seen this situation. Management will require their administrators to go down…
Directory Traversal in Axigen v7.4.1 running on Windows
Note: This article refers to an older version of Acunetix. Click here to download the latest version. We are continuing with the list of security vulnerabilities found in a number of web applications while testing our latest version of Acunetix WVS v7 . In this…
Ways to avoid email floods when running Web vulnerability scans
If you’ve ever ran a Web vulnerability scan you’ve likely experienced this situation. You fire up your scanner, tweak your settings, and click Start. The next thing you know people in customer service, marketing, IT, etc. are wondering why they’re getting hit with hundreds –…
SQL Injection and XSS vulnerabilities in CubeCart version 4.3.3
Note: This article refers to an older version of Acunetix. Click here to download the latest version. Note: This article refers to an older version of Acunetix. Click here to download the latest version. We are continuing with the list of security vulnerabilities found in…
Web Security problems in Zenphoto version 1.3
Note: This article refers to an older version of Acunetix. Click here to download the latest version. We are continuing with the list of security vulnerabilities found in a number of web applications while testing our latest version of Acunetix WVS v7 . In this…