Lost+Found: SQL injection, Twitter, CarShark and PDF scanning
Too short for news, too good to lose; Lost+Found is a round up of useful security information. Today: SQL injection prevention, botnets via twitter, sniffers in cars and testing infected PDFs.
- SQL injection prevention of a special kind: The FAQ of US bank Sacramento Credit Union states that a secret security question must not include the words insert, delete, update, null and select. While the bank has since taken the FAQ offline, the file can still be found in the Google cache.
- A peculiar kind of humour can also be found at the reddit.com news site: If the site is accessed via tools such as curl or wget (wget -S), the server's returned headers will contain the server info "'; DROP TABLE servertypes; --" . Data collectors may get the shock of their lives.
- While the first botnet controlled via a Twitter account appeared in mid 2009, ready-made botnet toolkits are now available which apparently make easy work of configuring such a set-up.
- As part of a project, researchers have developed the CarShark tool which allows traffic on the CAN bus in cars to be monitored and manipulated.
- The JoeDoc.org service enables users to test suspicious PDF documents for potential infections. Unlike such services as VirusTotal, JoeDoc is also said to detect zero-day exploits and issue an alert. However, uploading files is only possible via email; if a file contains sensitive data it is advisable to use a different test method.