3 ms·
Great writeup. Impressive to be able to find and be able to jump through so manu hoops. Every time I see one of there I reflect on the fact that if a person is
by JoachimS 8y ago
Great writeup. Impressive to be able to find and be able to jump through so manu hoops.
Every time I see one of there I reflect on the fact that if a person is prepared to do all this work for either lulz or some kUSD, imagine what efforts people might be prepared to do to gain 1-10-100 MUSD.
- nickpsecurity 8y agoIt's why we say in high-assurance security to address each root cause as they're understood and mitigated. Then, build that into your languages, analyzers, etc. Ada and Rust do that for lots of code injection opportunities. For web apps, even PHP has Airship CMS to reduce risks. Jif/Sif languages track information flows to block leaks. Several OS's do secure-by-default configurations. And so on and so forth. We know these attackers may expend a lot of effort. They also have more education, tooling, and labor out there than at any time before. Might as well use technology that makes blocking them something we don't even think about vs a cat and mouse game where we must consider every detail for even common operations or apps.
- auiya 8y agoAt the same time, SQL injection was heavily leveraged for initial read/writes, and that's a problem which was solved decades ago. That it still exists in places today is almost mind-boggling.