Re: [Full-disclosure] Absolute Sownage (A concise history of recent Sony hacks)

[Nick FitzGerald <nick@xxxxxxxxxxxxxxxxxxx>]

mrx wrote,

> I am a little frightened that my web app will be owned and user
> credentials exposed.  ...

Keep that attitude when you are no longer a "noob" web-app developer 
and the world will be a better place.

There are far too many "hack" web coders out there, and the evidence 
suggests that Sony employs quite a few of them...

> ...  I have read much on SQL injection, XSS, remote
> execution, session hijacking etc. I only think I have all bases
> covered, I am not 100% sure. Is there a definitive text/book/white
> paper on such matters and if so could someone please let me know
> where I can find this? 

I'm not a web-app expert at all -- I live and work in a niche 
necessitated by the appalling condition that is "web security" in 
general  (I'm a malware analyst who spends much of my time looking at 
the stuff the bad guys who break poorly configured servers, poorly 
configured and/or written web-apps, etc, etc put on those compromised 
machines to wreak havoc further down the food chain) -- but if you're a 
web-app developer and do not know about OWASP or what the OWASP "Top 
10" is, you're probably a shockingly bad web-app developer (but 
probably well able to get plenty of work at the likes of Sony).



Regards,

Nick FitzGerald


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/