Google Online Security Blog: юни 2011

Introducing DOM Snitch, our passive in-the-browser reconnaissance tool

21 юни 2011 г.

Posted by Radoslav Vasilev, Security Test Engineer
(Cross-posted from the Google Testing Blog)SkipfishRatproxyDOM Snitchseveral approachesamong otherssame-origin policy for DOM access

Here are the benefits of DOM Snitch:

Real-time: Developers can observe DOM modifications as they happen inside the browser without the need to step through JavaScript code with a debugger or pause the execution of their application.
Easy to use: With built-in security heuristics and nested views, both advanced and less experienced developers and testers can quickly spot areas of the application being tested that need more attention.
Easier collaboration: Enables developers to easily export and share captured DOM modifications while troubleshooting an issue with their peers.

DOM Snitch is intended for use by developers, testers, and security researchers alike. Click here to download DOM Snitch. To read the documentation, please visit this page.

*Developers and testers should be aware that DOM Snitch is currently experimental. We do not guarantee that it will work flawlessly for all web applications. More details on known issues can be found here or in the project’s issues tracker.

Protecting users from malware hosted on bulk subdomain services

17 юни 2011 г.

Posted by Oliver Fisher, Google Anti-Malware Team

Webmaster Tools lets webmasters find examples of URLs under their domains that may be distributing malware.

Google Safe Browsing Alerts for Network Administrators allows owners of Autonomous Systems to get notifications for hosts that are involved in malware delivery.

Trying to end mixed scripting vulnerabilities

16 юни 2011 г.

Posted by Chris Evans and Tom Sepez, Google Chrome Security Teamripting” vulnerability is caused when a page served over HTTPS loads a script, CSS, or plug-in resource over HTTP. A man-in-the-middle attacker (such as someone on the same wireless network) can typically intercept the HTTP resource

Your website won’t work as well in other modern browsers (such as IE9 or FF4) due to click-throughs and ugly modal dialogs.

You may have a security vulnerability that could compromise the entire HTTPS connection.

this Chromium bug

Tools that can help website owners

enable debugging to the command-line console--no-running-insecure-content--no-displaying-insecure-content

Security Blog

Introducing DOM Snitch, our passive in-the-browser reconnaissance tool

Protecting users from malware hosted on bulk subdomain services

Trying to end mixed scripting vulnerabilities

Етикети

Archive

Feed