Papers and Research
Presentations
Casaba's public discussions on current and emerging security practices:
| Unicode Transformations & Security Vulnerabilities (IUC 33) Web-applications are being exploited every day as attackers find new vectors for cross-site scripting attacks. This talk covers ways which latent character and string handling can transform clever inputs into malicious outputs, as well as the current state of visual spoofing attacks. |
Articles
We have published articles on the following topics:
Analysis of the Storm and Nugache Trojans: P2P Is Here
Since the advent of distributed intruder tools, defenders have striven to identify and take down as much of the attack network as possible, as fast as possible. This has never been an easy task. Among the differentials and knowledge that makes mitigation harder, there has grown a huge population of researchers, security vendors, and organizations focused on identifying and mitigating distributed attack networks.
Using IPSec in Windows 2000 and XP, Part 1
A brief overview of IPSec, as well as a look at the structure and interface for IPSec in Windows and a look at the two different modes of IPSec authentication methods for IKE in Windows.
Using IPSec in Windows 2000 and XP, Part 2
Discussing Security Associations, main mode authentication and IKE, Quick Mode Authentication Headers and ESP, this article also covers some of the tools available in 2000 and XP.
Using IPSec in Windows 2000 and XP, Part 3
A look at the integration of IPSec policies into Active Directory, attacks on IPSec and other security concerns, as well as a few properties of IPSec.
Since the advent of distributed intruder tools, defenders have striven to identify and take down as much of the attack network as possible, as fast as possible. This has never been an easy task. Among the differentials and knowledge that makes mitigation harder, there has grown a huge population of researchers, security vendors, and organizations focused on identifying and mitigating distributed attack networks.
Using IPSec in Windows 2000 and XP, Part 1
A brief overview of IPSec, as well as a look at the structure and interface for IPSec in Windows and a look at the two different modes of IPSec authentication methods for IKE in Windows.
Using IPSec in Windows 2000 and XP, Part 2
Discussing Security Associations, main mode authentication and IKE, Quick Mode Authentication Headers and ESP, this article also covers some of the tools available in 2000 and XP.
Using IPSec in Windows 2000 and XP, Part 3
A look at the integration of IPSec policies into Active Directory, attacks on IPSec and other security concerns, as well as a few properties of IPSec.
Papers
Casaba papers and security research either published or edited:
ActiveX Security Testing Methodology
ActiveX controls, like any other browser plugin, provide a ripe attack surface for the malicious. Finding an exploitable flaw in a popular control gets MSRC attention at Microsoft, and similar attention at other large companies. In this short testing article we’ll be covering the fundamentals of security testing an ActiveX control.
The Unexpected SQL Injection (Web Application Security Consortium)
A look at several scenarios under which SQL injection may occur, even though mysql_real_escape_string() has been used. There are two major steps at writing SQL injection resistant code: correct validation and escaping of input and proper use of the SQL syntax. Failure to comply with any of them may lead to compromise.
Short IIS7 Security Overview
A short guide for those who want to know some of the relevant security technology in the new IIS7 and ASP.NET. Featured topics: Integrated Request Processing Pipeline and WCF; ASP.NET integration, Request Filtering (replaces URLSCAN); IIS7 URL Authorization; Using Encryption to Protect Passwords; and The Stages of a Request/Response - Server Pipeline.
ActiveX controls, like any other browser plugin, provide a ripe attack surface for the malicious. Finding an exploitable flaw in a popular control gets MSRC attention at Microsoft, and similar attention at other large companies. In this short testing article we’ll be covering the fundamentals of security testing an ActiveX control.
The Unexpected SQL Injection (Web Application Security Consortium)
A look at several scenarios under which SQL injection may occur, even though mysql_real_escape_string() has been used. There are two major steps at writing SQL injection resistant code: correct validation and escaping of input and proper use of the SQL syntax. Failure to comply with any of them may lead to compromise.
Short IIS7 Security Overview
A short guide for those who want to know some of the relevant security technology in the new IIS7 and ASP.NET. Featured topics: Integrated Request Processing Pipeline and WCF; ASP.NET integration, Request Filtering (replaces URLSCAN); IIS7 URL Authorization; Using Encryption to Protect Passwords; and The Stages of a Request/Response - Server Pipeline.
Books
Casaba team members have authored, co-authored, or lead technical editing including the following books:
 |
 |
 |
 |
 |
Hunting Security Bugs
This in-depth, technical reference highlights up-to-date tools, technologies, and techniques for helping find and eliminate vulnerabilities in software. Written for testers by testers, it delivers practical, hands-on guidance on how to find, classify, and assess bugs. In addition, this book covers the thought process behind security testing, use of source code to help in testing, and ways to spot security design flaws.
Customer Reviews
Windows(R) XP Professional Security
Get comprehensive security coverage of Windows XP Professional--the most security-focused Microsoft OS yet--from this definitive resource. Learn how default security has been strengthened and how familiar security features from Windows 2000 have been completely reworked, including options to restrict anonymous access, redefine the "Everyone" group, force Guest network logons, utilize blank password restrictions, and much more. Also, the new and enhanced security features of Windows XP, including Software Restriction Policies, Internet Connection Firewall, Group Policy, and wireless networking are covered in detail. This comprehensive reference will be invaluable in your daily work with Microsoft's newest security technologies.
Customer Reviews
Hacking Exposed: Web Applications
Defend against the latest Web-based attacks by looking at your Web applications through the eyes of a malicious intruder. Fully revised and updated to cover the latest Web exploitation techniques, Hacking Exposed Web Applications, Second Edition shows you, step-by-step, how cyber-criminals target vulnerable sites, gain access, steal critical data, and execute devastating attacks. All of the cutting-edge threats and vulnerabilities are covered in full detail alongside real-world examples, case studies, and battle-tested countermeasures from the authors' experiences as gray hat security professionals.
Customer Reviews
Assessing Network Security (Pro-One-Offs)
How secure is your network? How resilient are your systems to hackers? And how can you be sure? This book delivers the information and tools you need to take charge of your critical IT assets through advanced networking testing strategies, including vulnerability scanning and penetration testing. Written by members of the Microsoft Security Team, this practical guide shows you how to perform security assessments, uncover security vulnerabilities, and apply appropriate countermeasures to help beat the hackers at their own game. The companion CD features time-saving tools and scripts that you can use to discover and help correct security vulnerabilities in your own network.
Customer Reviews
Privacy Defended: Protecting Yourself Online
A comprehensive book that melds detailed, how-to information on PC hardware and operating system security within the context of protecting one's privacy in a digital world. Best for individuals who are serious about their privacy and who also want an accessible, one-stop source of practical information. Unique features include: systematic evaluation of privacy weaknesses in hardware/software. In-depth coverage of all PC OS's. Extended coverage on securing a PC.
This in-depth, technical reference highlights up-to-date tools, technologies, and techniques for helping find and eliminate vulnerabilities in software. Written for testers by testers, it delivers practical, hands-on guidance on how to find, classify, and assess bugs. In addition, this book covers the thought process behind security testing, use of source code to help in testing, and ways to spot security design flaws.
Customer Reviews
Windows(R) XP Professional Security
Get comprehensive security coverage of Windows XP Professional--the most security-focused Microsoft OS yet--from this definitive resource. Learn how default security has been strengthened and how familiar security features from Windows 2000 have been completely reworked, including options to restrict anonymous access, redefine the "Everyone" group, force Guest network logons, utilize blank password restrictions, and much more. Also, the new and enhanced security features of Windows XP, including Software Restriction Policies, Internet Connection Firewall, Group Policy, and wireless networking are covered in detail. This comprehensive reference will be invaluable in your daily work with Microsoft's newest security technologies.
Customer Reviews
Hacking Exposed: Web Applications
Defend against the latest Web-based attacks by looking at your Web applications through the eyes of a malicious intruder. Fully revised and updated to cover the latest Web exploitation techniques, Hacking Exposed Web Applications, Second Edition shows you, step-by-step, how cyber-criminals target vulnerable sites, gain access, steal critical data, and execute devastating attacks. All of the cutting-edge threats and vulnerabilities are covered in full detail alongside real-world examples, case studies, and battle-tested countermeasures from the authors' experiences as gray hat security professionals.
Customer Reviews
Assessing Network Security (Pro-One-Offs)
How secure is your network? How resilient are your systems to hackers? And how can you be sure? This book delivers the information and tools you need to take charge of your critical IT assets through advanced networking testing strategies, including vulnerability scanning and penetration testing. Written by members of the Microsoft Security Team, this practical guide shows you how to perform security assessments, uncover security vulnerabilities, and apply appropriate countermeasures to help beat the hackers at their own game. The companion CD features time-saving tools and scripts that you can use to discover and help correct security vulnerabilities in your own network.
Customer Reviews
Privacy Defended: Protecting Yourself Online
A comprehensive book that melds detailed, how-to information on PC hardware and operating system security within the context of protecting one's privacy in a digital world. Best for individuals who are serious about their privacy and who also want an accessible, one-stop source of practical information. Unique features include: systematic evaluation of privacy weaknesses in hardware/software. In-depth coverage of all PC OS's. Extended coverage on securing a PC.
