April 2011
Flawed Authentication System Implementation
by Jaideep Jha
There are various motivations and factors that drive the implementation of an authentication system in an organization… If authentication systems are implemented without putting thought to resultant side effects, then they may introduce security vulnerabilities. We will discuss two cases of such flawed implementations in this article.… more →
Implementing a Secure Forgot Password Solution
by Harshvardhan Parmar, GCIH
In the last article, we observed some of the common flaws in the implementation of the Forgot Password feature. This time we will take a look at one of the most common implementations of Forgot Password feature that we have seen in various banks and a drawback to this implementation that might very well be called as a chink in an otherwise impenetrable armor. We will also take a look at how we can implement a Forgot Password feature that addresses all possible threats.… more →
Watchful File Upload
by Ashish Rao
A file upload is a feature of a web application, which throws open the doorways of the entire file system of the server to end users. What more would an attacker want anyway! Applications that store the uploaded files on the server without any validation put their servers at a huge risk of being compromised. Files like harmful executables can cause considerable damage to the servers. However, it also depends on the way the uploaded files are being handled by the applications.… more →