Slashdot Mirror
Google Hands Out Web Security Scanner
An anonymous reader writes "Apparently feeling generous this week, Google has released for free another of their internally developed tools: this time, a nifty web security scanner dubbed skipfish. A vendor-sponsored study cited by InformationWeek discovered that 90% of all web applications are vulnerable to security attacks. Are Google's security people trying to change this?"
Google is one of the most anti-privacy, intrusive evil corporations out there, second only to Facebook. They make a living over promiscuous sharing of personal data. Why should I trust them?
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
Considering how many web apps use Google APIs in some form or another these days, I'd say it's in their best interests to ensure those sites don't all become a liability to eachother by way of their centralized cloud.
CAn'T CompreHend SARcaSm?
Google is one of the most anti-privacy, intrusive evil corporations out there, second only to Facebook. They make a living over promiscuous sharing of personal data. Why should I trust them?
Have they ever lied to you about what they do? I don't use Google under any misinformed idea that they *don't* track everything I do. I go into it knowing that this *is their business*.
Where you under some other impression?
If you want news from today, you have to come back tomorrow.
Google goes with ' Do No Evil' - then makes dough in China until they have Chinese script kiddies tickling their code, and all the privacy and other violations.
Now - that only reminds me of Fox news saying Fair and Balanced - they are neither of those... ditto with Google.
So just cos they 'Tell you' under 3 pages of legalese, and then say we dont censor - when they censor in multiple countries, and then schmidt says if you are worried about being tracked maybe you should not do it.....
Saying they have told us - so they can do it, is like saying, banks can charge $20 for overdraft of 50c - no it is still evil and someone needs to regulate it and slap them down.
Is VERY fast, been observed 500 request/seconds against responsive internet servers, 2000/sec when in the same lan, and of course, is targetted against dynamic apps, not exactly static images/content. With that speed the first vulnerability that they will find is vulnerability to DoS attacks. The good news: when the bad guys try to find your application vulnerabilities using this tool, that will be the only one that they will find. Worst case scenario: the code gets included in a botnet,
... since it can hit you with up to a couple of thousand requests a second as it tries all sorts of tricks to see where you're vulnerable ...
When I click on "View a sample screenshot", my browser downloads the damn PNG file instead of simply displaying it like it should. Is it something wrong on Google's side or is it my browser?
"At what rate of payment?"
I peeked at the report, out of curiosity. They don't claim that 90% of web applications are vulnerable, they DO claim that 90 (well, 89%) of all the web vulnerabilities are in web applications (which is quite a different thing).
http://github.com/spinkham/skipfish
We configured skipfish and pointed it at our custom platform with full administrator rights. Entered our systems custom file extensions into the skipfish dictionary.
Overall the performance is quite good (>3k HTTP requests per second) after tweaking concurrent connection count. Orders of magnitude better than any scanner we have ever used.
The report UI seemed polished and provided quite a bit of useful data with summaries and drill down to detail. It would really help if instead of simply posting raw request/response data it would highlight sections of the response that lead it to make an assumption WRT a particular vulnerability.
In terms of scan results they look for quite a number of common vulnerabilities, some of the checks are quite creative. I especially liked the check for "interesting" contents. Some of our test data tripped them - this was perfectly reasonable given content.
Aborted the scanner at the 5 million http request mark ~20mins later.
In terms of actual results against our system out of the several dozen possible vulnerabilties reported from XSRF, injection..etc there were no actual problems discovered - 100% false alarms.
There is something really odd about some of the requests being made .. I don't know if its intentional to discover bugs but the folder/file parsing looks to be broken and its building stupid path names with the filename /subfolder.. This seems to be causing most of the UI not to crawl as it seems to be ending up in the 404 category. Maybe this is my fault on dictionary configuration but the system wastes way too many requests throwing the dictionary at each resource and not nearly enough time crawling the site and discovering whats available for expliot.
I then took a cursory glance at the source code.. all of the rule checking is hard-coded in C. (See analysis.c) ... which to me seems quite stupid and useless.
The tool is a start already better than many freebie tools I have used over the years.
My advice is to first and foremost abstract the analysis details out of C code. Focus more on walking even if its dynamic content and bolt in some intelligence/expert system to direct activities.
Including skipfish. While I haven't downloaded it, I have no doubt that something is being reported back to Google. Just as with any business practice, there is always a light at the end of the tunnel. Google advertising maybe? Possibly, whatever the reason, I doubt "Free" in this case really isn't "Free".
Fucking moron.
I wouldn't be surprised if the actual number is much, much higher. This has always been a problem with software development, I'm not sure why anyone thought it got better when apps became web-based. When your business depends on apps being up and running (or running the newest, coolest features) security is usually not the highest priority.
As a vendor I sit in meetings all the time with app architects and even security people (up to and including CISOs) at some of the biggest corporations in the world who freely admit to the horrid security holes in their apps. Worse, a lot of them think their packet inspection firewall will protect them. Layer 7 attacks are still not very well understood or appreciated by a lot of IT people.
I just wanted to point out that many organizations and people are trying to resolve the global web-insecurity issue caused by many things including application insecurity. Google is just one participant in this effort. What is frustrating is that when Google talks people call it news. When these other organizations make contributions, nothing is heard.