ONLamp.com: Top Ten Tips to Make Attacker’s Lives Hell
Good stuff here. Articles like this often lack practical implementation info, but this gives you some specifics to follow. One app it mentions that I wasn’t aware of is URLScan, a free tool from MS to filter server requests. Not that I’d ever use a MS Server for anything that the public could access, but if you must, this seems like a requirement for your IIS box.
It always seemed like a bad idea to do some kind of server or client detection by checking for a short string anywhere in the fingerprint. This is a good example of why.
A new testing version of LameBrain is now available: 0.6.2b3. This adds a number of minor features and fixes. Please give it a spin and send feedback to the mailing list.
Speaking of which… I’ve set up a new mailing list for Lamebrain at my new host. This is where I will announce new non-public releases, can chat about bugs and feature requests, and the like. I wasn’t able to recover addresses from the old list, so you’ll need to re-subscribe:
Things I discovered tonight:
Also, Appleworks sucks.
dropTar is a Konfabulator widget I cooked up to quickly handle tarring and zipping of files. You just drop one or more files or folders on the icon, and dropTar does its thing. dropTar uses hfstar, so your resource forks are safe.
Ed Finkler is a web application developer, security expert, graphic designer, and dabbling musician. He works for CERIAS at Purdue University, and is a member of the PHP Security Consortium. His opinions expressed here do not necessarily reflect those of either group.
Photo by George Schlossnagle
RSS 2.0