It is a new year and time for some new ways for all of us to communicate. We appreciate all that have read the posts and listened to the podcast. Both of these will continue to move forward in 2017 with some new material on the way. We are happy to announce we have started a Slack channel. You can find it at developsec.slack.com. The blog and podcasts have been great in providing information in a read-only manner. Slack is an opportunity to open up more conversation and create more … [Read more...] about Introducing our Slack channel
developers
Verizon Email API Insecure Direct Object Reference Thoughts and Takeaways
It was recently announced that there was a flaw identified (and since fixed) in the Verizon API that allowed access to Verizon customer email accounts. The way this worked was that there was an ID parameter with the email account's user ID specified. If a user supplied a different user's ID name, that user's email account would be returned. This is known as an Insecure Direct Object Reference. It was also found that the attacker could not only read another user's email, but also send email … [Read more...] about Verizon Email API Insecure Direct Object Reference Thoughts and Takeaways
OneStopParking Breach Thoughts and Takeaways
It was recently announced that OneStopParking.com suffered from a data breach exposing customer credit card data. According to the report, the breach occurred due to missing patches in the application’s Joomla install. Apparently the patches caused some problems with the application so they were pushed back. The patches in question were released in September of 2014. Take-Aways Implement a patch management program Use a web application firewall (WAF) for extended coverage It is common … [Read more...] about OneStopParking Breach Thoughts and Takeaways