Monthly Archives: March 2009

Advisory: Lenovo/IBM ActiveX buffer overflow

CERT released the advisory for this, which I believe is not being fixed by Lenovo/IBM. http://www.kb.cert.org/vuls/id/340420 This ActiveX control comes preinstalled on many Lenovo systems, and is also downloaded from the main page of their support site. It’s a nasty … Continue reading

Posted in advisory | Tagged | Leave a comment

Detecting ill-formed UTF-8 byte sequences in HTML content

One issue I’ve come across, pretty infrequently, is the existence of ill-formed UTF-8 byte sequences in HTML content. As far as I can tell nobody’s every really tried to find this type of bug. Huh, so what’s up? UTF-8 is … Continue reading

Posted in Unicode | Tagged , , | Leave a comment

Watcher: a free web-app security vulnerability scanner

I announced Watcher at CanSecWest and I’m happy to say IE8 Security Program Manager and Fiddler author Eric Lawrence also announced our it at MIX09 yesterday. Check out his talk at http://videos.visitmix.com/MIX09/T54F it’s an eye opener for Web developers – … Continue reading

Posted in Web, security, testing | Tagged | Leave a comment

Unicode security attacks and test cases: character mappings and normalization for testing

Point: Normalizing strings after validation is dangerous Impact: filter evasion, enabling code execution Are you testing a Web or other application in attempt to bypass restrictions on domain names? For example, what if you were testing a phishing filter and … Continue reading

Posted in Web, testing | Tagged | Leave a comment

Uniview character lookup tool

Richard Ishida has an online character lookup tool which is very nice. It’s called Uniview and it’s comparable to Babelmap in some functionality but it’s available online if that’s useful to you. If you’re looking to use any of the … Continue reading

Posted in security | Leave a comment

Presenting IDN spoofing threats to ICANN’s security committee

I had the chance to present to the ICANN Security and Stability Advisory Committee during their ICANN Mexico conference. It was an opportunity to give a portion of my upcoming presentation on Exploiting Unicode-enabled Software, focusing just on IDN visual … Continue reading

Posted in Unicode, Web | Tagged , | Leave a comment