ICT Security-Sécurité PC et Internet

In its latest Hacker Intelligence Initiative report, Imperva analyzes remote and local file inclusion (RFI/LFI) attacks as favored by LulzSec.

===> Imperva suggests a number of ways to mitigate against RFI/LFI attacks. These include finding your own vulnerabilities using the same methods as the hackers: dorking (otherwise known as ‘Google hacking’, which uses the search engines to find hints of possible vulnerabilities); and the use of both commercial and free vulnerability scanners. <===

Also useful would be a web application firewall (WAF) and blacklisting known attacks IPs. The report also notes that the application code can be written to exclude RFI attacks, so detailed code review is advisable.

On the very last day of 2011, SANS published a story about automated SQL injection attacks affecting 1M plus websites. What will be different with SQL injection in 2012? Nothing. Perhaps more, perhaps some new attack tools.

Here's what any firm that has data flowing in web applications should do in order to protect themselves from SQL injection:

...

Imperva publie aujourd’hui son rapport sur les attaques d’applications web.