A hacker gained access to an offsite backup server and then used information on that server to walk into the main live server. The hacker deleted the backup databases, and then deleted the live site. Apparently, they also covered their tracks and over wrote the drives so that no possibility of recovery was possible.

On a forum post a community member of WHT revealed the following:

This attack was very deliberate, sophisticated and calculated. The attacker was able to circumvent our security measures and access via an arcane backdoor protected by additional firewall. We are still investigating the situation, but we know the attacker infiltrated and deleted the backups first and then deleted three databases: user/post/thread. We have no record or evidence that private message data was accessed. Absolutely no credit card or PayPal data was exposed.

Unfortunately for WebHostingTalk, the last local offline copy of the system is from late last year. So expect them to be offline for a bit, while they rebuild their database.

It just goes to show how important offline backup is. Make sure you have the correct backup solution.

Adapted from: http://www.webmasterworld.com/community_building/3879428.htm

The worm is spreading through low security networks, memory sticks, and PCs without current security updates.

The malicious program – also known as Downadup or Kido – was first discovered in October 2008.

Although the spread of the worm appears to be levelling off, there are fears someone could easily take control of any and all of the 9.5m infected PCs.

Speaking to the BBC, F-Secure’s chief research officer, Mikko Hypponen, said there was still a real risk to users.

“Total infections appear to be peaking. That said, a full count is hard, because we also don’t know how many machines are being cleaned. But we estimate there are still more than 9m infected PCs world wide.

“It is scary thinking about how much control they [a hacker] could have over all these computers. They would have access to millions of machines with full administrator rights.

“But they haven’t done that yet, maybe they’re scared. That’s good news. But there is also the scenario that someone else figures out how to activate this worm. That is a worrying prospect.”

Experts say users should have up-to-date anti-virus software and install Microsoft’s MS08-067 patch. The patch is known as KB958644.

Speaking to the BBC, Graham Cluley, senior technology consultant with anti-virus firm Sophos, said the outbreak was of a scale they had not seen for some time.

“Microsoft did a good job of updating people’s home computers, but the virus continues to infect business who have ignored the patch update.

“A shortage of IT staff during the holiday break didn’t help and rolling out a patch over a large number of computers isn’t easy.

“What’s more, if your users are using weak passwords – 12345, QWERTY, etc – then the virus can crack them in short order,” he added.

“But as the virus can be spread with USB memory sticks, even having the Windows patch won’t keep you safe. You need anti-virus software for that.”

Method
According to Microsoft, the worm works by searching for a Windows executable file called “services.exe” and then becomes part of that code.

It then copies itself into the Windows system folder as a random file of a type known as a “dll”. It gives itself a 5-8 character name, such as piftoc.dll, and then modifies the Registry, which lists key Windows settings, to run the infected dll file as a service.

Once the worm is up and running, it creates an HTTP server, resets a machine’s System Restore point (making it far harder to recover the infected system) and then downloads files from the hacker’s web site.

Most malware uses one of a handful of sites to download files from, making them fairly easy to locate, target, and shut down.

But Conficker does things differently.

Anti-virus firm F-Secure says that the worm uses a complicated algorithm to generate hundreds of different domain names every day, such as mphtfrxs.net, imctaef.cc, and hcweu.org. Only one of these will actually be the site used to download the hackers’ files. On the face of it, tracing this one site is almost impossible.

Variant
Speaking to the BBC, Kaspersky Lab’s security analyst Eddy Willems said that a new strain of the worm was complicating matters.

“There was a new variant released less than two weeks ago and that’s the one causing most of the problems,” said Mr Willems

“The replication methods are quite good. It’s using multiple mechanisms, including USB sticks, so if someone got an infection from one company and then takes his USB stick to another firm, it could infect that network too. It also downloads lots of content and creating new variants though this mechanism.

“Of course, the real problem is that people haven’t patched their software,” he added.

Microsoft says that the malware has infected computers in many different parts of the world, with machines in China, Brazil, Russia, and India having the highest number of victims.

Original URL: http://news.bbc.co.uk/1/hi/technology/7832652.stm
Image: Sci-Tech Today

Microsoft issued a security advisory late Monday, saying that the bug could be exploited to run unauthorized software on systems running versions of Microsoft SQL Server 2000 and SQL Server 2005.

Attack code that exploits the bug has been published, but Microsoft said that it has not yet seen this code used in online attacks. Database servers could be attacked using this flaw if the criminals somehow found a way to log onto the system, and Web applications that suffered from relatively common SQL injection bugs could be used as stepping stones to attack the back-end database, Microsoft said.

Desktop users running the Microsoft SQL Server 2000 Desktop Engine or SQL Server 2005 Express could be at risk in some circumstances, Microsoft said.

The bug lies in a stored procedure called “sp_replwritetovarbin,” which is used by Microsoft’s software when it replicates database transactions. It was publicly disclosed on December 9 by SEC Consult Vulnerability Lab, which said it had notified Microsoft of the issue in April.

“Systems with Microsoft SQL Server 7.0 Service Pack 4, Microsoft SQL Server 2005 Service Pack 3, and Microsoft SQL Server 2008 are not affected by this issue,” Microsoft said in its advisory.

This is the third serious bug in Microsoft’s software to be disclosed in the past month, but it is unlikely to be used in widespread attacks, according to Marc Maiffret, director of professional services, with The DigiTrust Group, a security consulting firm. “It is rather low risk given other vulnerabilities that exist,” he said via instant message. “There are a lot of better ways to currently compromise windows systems.”

After seeing the Internet Explorer flaw used in a growing number of online attacks, Microsoft rushed out an emergency patch for the issue last Wednesday. The company says it has also seen “limited and targeted attacks” exploiting a serious bug in the WordPad Text Converter for Word 97 files. As with the SQL bug, this WordPad converter vulnerability has not been patched, but is a prime candidate to be fixed in Microsoft’s upcoming January 13 security updates.

Original URL: http://www.pcworld.com/article/155940/microsoft_warns_of_sql_attack.html

If the complicated politics of internet governance continue to get in the way of upgrading the security of the net’s core technology, the internet could turn into a carnival house of mirrors, where no URL or e-mail address could be trusted to be genuine, according to Bill Woodcock, research director at the nonprofit Packet Clearing House.

“The National Telecommunications and Information Administration, an agency of the Department of Commerce, is the show-stopper here,” Woodcock said.

At issue is the trustworthiness of the domain name system, or DNS, which serves as the internet’s phone book, translating queries such as wikipedia.org into the numeric IP address where the site’s server lives.

Just weeks ago, security researcher Dan Kaminsky announced he’d discovered a way for hackers to feed fake info into DNS listings, which would allow hackers to redirect web traffic at will — for example, routing every person attempting to log in to the Bank of America to a fake site controlled by the attacker.

Kaminsky quietly worked with large tech companies to build patches for the net’s name servers to make the attack more difficult. But security experts, and even the NTIA, say those patches are just temporary fixes; the only known complete fix is DNSSEC — a set of security extensions for name servers.

Those extensions cryptographically sign DNS records, ensuring their authenticity like a wax seal on an letter. The push for DNSSEC has been ramping up over the last few years, with four regions — including Sweden (.SE) and Puerto Rico (.PR) — already securing their own domains with DNSSEC. Four of the largest top-level domains — .org, .gov, .uk and .mil, are not far behind.

But because DNS servers work in a giant hierarchy, deploying DNSSEC successfully also requires having someone trustworthy sign the so-called “root file” with a public-private key. Otherwise, an attacker can undermine the entire system at the root level, like cutting down a tree at the trunk. That’s where the politics comes in. The DNS root is controlled by the Commerce Department’s NTIA, which thus far has refused to implement DNSSEC.

The NTIA brokers the contracts that divide the governance and top-level operations of the internet between the nonprofit ICANN and the for-profit VeriSign, which also runs the .com domain.

“They’re the only department of the government that isn’t on board with securing the Domain Name System, and unfortunately, they’re also the ones who Commerce deputized to oversee ICANN,” Woodcock said.

“The biggest difference is that once the root is signed and the public key is out, it will be put in every operating system and will be on all CDs from Apple, Microsoft, SUSE, Freebsd, etc,” says Russ Mundy, principal networking scientist at Sparta, Inc, which has been developing open-source DNSSEC tools for years with government funding, He says the top-level key is “the only one you have to have, to go down the tree.”

A European networking group known as RIPE called in June 2007 for the root to be signed, with Swedish and British representatives echoing the call in October. But NTIA is not moving quickly enough to sign the root, given the looming threat, even after the final technical problems have been resolved, according to Woodcock and others.

“A few years ago, there were still technical hurdles to actually signing and using DNSSEC, but in the past few years, a lot of software tools, both commercial and open-source, have come out, and now it’s a completely solved problem,” Woodcock said. “All that’s left is the far less tractable, purely political problem.”

“Arguing over who gets to hold the cryptographic keys in the long run [should] wait until we’re not facing a critical threat,” Woodcock said.

But the NTIA insists it is moving at just the right pace.

“We are committed to taking no action that would have the potential to adversely affect the operational stability of the DNS,” says spokesman Bart Forbes. “While there is increasing pressure to secure the DNS, NTIA must work with all stakeholders and consider all possible solutions.”

Olaf Kolkman, a Dutch networking export, says there’s no time to waste. The only way for DNSSEC to work is for the top-level zone file — which lists the specifics for top-level domains like .gov — to be signed by a trusted authority.

“Currently DNSSEC is the only mechanism known to protect against the Kaminsky attack,” Kolkman said. “It is not clear that other solutions will provide the same level of protection as DNSSEC.”

Without such extensions, a hacker eager for trade secrets could hijack the DNS listing for Apple’s e-mail server and insert the number for a server he controls instead. He could then keep a copy of every message sent to the company and forward them all. No one would likely to be any wiser until a human looked closely at the mail headers.

Still, even DNSSEC’s most fervent backers admit that signing the root won’t instantly secure the net. Installing the extensions internet-wide will be costly and time-intensive, but proponents say that getting the root signed will turbocharge the process.

The Internet Assigned Numbers Authority — which coordinates the internet — has been prototyping a system to sign the root-zone file for the last year, but they can’t do the same for the internet’s top servers without approval from the Department of Commerce.

That’s where the rub is, according to Kolkman.

“Then the issue becomes political because there seems to be the perception that the introduction of a key guardian changes the current policies,” Kolkman said

That could also simplify how top-level zone files are created, according to Richard Lamb, a technical expert at IANA. Currently companies that manage top-level domains like .com submit changes to ICANN, which then sends them to NTIA for approval, before they’re forwarded to VeriSign. VeriSign actually edits the root file and publishes it to the 13 root servers around the world.

“We would want to bring the editing, creation and signing of the root zone file here,” to IANA, Lamb said, noting that VeriSign would likely still control distribution of the file to the root servers, and there would be a public consultation process that the change was right for the net.

But changing that system could be perceived as reducing U.S. control over the net — a touchy geopolitical issue. ICANN is often considered by Washington politicians to be akin to the United Nations, and its push to control the root-zone file could push the U.S. to give more control to VeriSign, experts say.

VeriSign did not respond to a request for comment, but its CTO said earlier this year that it was creating its own root-zone file-signing test bed.

The root-zone file, which contains entries for the 300 or so top-level domains such as .gov and .com, changes almost every day, but the number of changes to the file will likely increase radically in the near future, since ICANN decided in June to allow an explosion of new top-level domain names.

Woodcock isn’t buying the assurances of NTIA that it is simply moving deliberatively.

“If the root isn’t signed, then no amount of work that responsible individuals and companies do to protect their domains will be effective,” Woodcock said. “You have to follow the chain of signatures down from the root to the top-level domain to the user’s domain. If all three pieces aren’t there, the user isn’t protected.”

Original URL: http://blog.wired.com/27bstroke6/2008/08/experts-accuse.html

SearchScan uses security firm McAfee’s SiteAdvisor technology to warn users about “potentially risky sites”.

The service, which is switched on by default, produces an on-screen alert.

“Our goal is to protect users by allowing them to make a more informed decision about the sites they visit,” said Yahoo’s Priyank Garg.

Rival firm Google introduced similar technology in 2006.

Yahoo’s service will warn users about three types of risk:

• Browser exploits: Sites that can harm a user’s computer or install malware simply by visiting the site. Any such sites or pages included in McAfee’s data will be removed from search results automatically.
• Dangerous downloads: SearchScan will display warnings next to search results for sites that offer potentially dangerous software, such as viruses, spyware or adware.
• Unsolicited e-mail: SearchScan will alert users to scanned sites that send unsolicited e-mails or inappropriately share e-mail addresses with third parties.

Viruses, spyware and adware programs are often “hidden” inside innocuous-looking programs such as screensavers and toolbars.

Industry analysts IDC estimate that 67% of all computers have some form of spyware installed without a user’s knowledge.

Original URL: http://news.bbc.co.uk/1/hi/technology/7385285.stm

Nielsen is developing the system with Digimarc, a provider of digital watermarking technology. The service, which the companies plan to start rolling out in the second quarter of next year, would tap into technology Nielson currently uses in the services it sells to advertisers and TV networks.

The system would first be used for policing the use of TV programs, clips of which are often posted on user-generated content sites, such as YouTube, which is owned by Google. Much of that content is uploaded without authorization or compensation to the content provider, which has led to tension between Internet companies and Hollywood studios. These tensions reached a peak in March whenViacom filed a $1 billion lawsuit against Google, accusing the company of massive copyright infringement.

The Nielsen/Digimarc system would be offered as a way to quickly discover unauthorized content on sites. To do that, the system would leverage Nielsen’s existing watermark technology, which is used on more than 95% of TV programming distributed today. The watermarks are used by the meters installed in people’s home to identify the programs they watch. Nielsen sells data from people’s viewing habits to TV networks and advertisers.

Besides watermarking, Nielsen also tags over-the-air TV programs intercepted by 700 installations across the nation. For those programs without watermarks, Nielsen creates a digital signature based on unique patterns in the audio signal.

Nielsen’s watermarks and digital signatures are stored in a database that would be used in the copyright-protection system. When a clip is posted on a Web site, the system would search for the watermark. If one doesn’t exist, then the system would create a digital signature. In either case, the identifier would be compared to what’s in the database to find a match. Once the program is identified, the Nielsen system could notify site operators and content providers when a clip is being shown without authorization.

While the system wouldn’t automatically delete unauthorized material, Web site owners could configure their systems to take that step. “The purpose of this system is not to be a policeman on the Internet, but to provide a system where the content provider can have confidence and knowledge of where their programming is being distributed,” Dave Harkness, senior VP of strategy and business development at Nielsen, told InformationWeek. “They also can develop a business relationship with the content distributor, which in this case is the Web site.”

Nielsen is confident it can convince many TV producers to buy into the system, since the company already has relationships with most of these businesses. Convincing Web sites may be more difficult, since many already have some kind of copyright-protection system in place or are developing one. Google, for example, is developing a system for YouTube. In general, most sites take down unauthorized content as soon as the owners notify them.

Nielsen believes it can turn many sites into customers by offering a system that’s ready to plug into their infrastructure, saving them the cost of building a copyright-protection system themselves, Harkness said. Besides generating revenue from the service, Nielson could also use it to track the use of video on the Web and sell the gathered data to advertisers.

If Nielsen launches its service it will have competitors, albeit smaller businesses. Those companies that provide services for policing the use of copyrighted content online include Audible Magic, Vobile, and BayTSP.

Original URL: http://www.informationweek.com/news/showArticle.jhtml?articleID=204701360

A large gap exists between what employees say about computer security and how they practice it at work, according to the Information Systems Audit and Control Association, which polled 301 white-collar workers at companies of at least 100 employees.

For example, 15 percent of workers had shared files over a peer-to-peer network, which “is opening a big door at a large corporation,” says Kent Anderson, a consultant who serves on ISACA’s Information Security Management Committee. “Most of these file-sharing programs by default scan available files and serve those out to anybody who wants them.”

Eleven percent of workers had e-mailed confidential documents to the wrong person—yet only 60 percent considered the behavior risky. And 35 percent had knowingly violated a corporate IT policy.

“They think, even if I make a mistake, nothing bad is going to happen,” Anderson says.

One reason for the risky behaviors may be that employees tend to take workplace IT security for granted. More than 90 percent told ISACA they considered their offices secure. While they worry about the security of their home machines, they feel somebody else has taken care of security on their work computers, Anderson says.

Another reason may be that employees don’t understand the risks they’re taking with what may seem routine tasks and use. Anderson says corporate IT departments tend to write overly long or technical IT policies, then stick those policies on a shelf and leave them unenforced.

Security policies must be simple, he says, and employees must be able to follow them and still do their jobs.

ISACA recommends corporate IT departments make security training routine. They should train new hires, update training frequently, and let employees know when there are specific threats.

ISACA’s recommendations reflect the results of a recent Computer Technology Industry Association (CompTIA) survey that found 68 percent of businesses have no security training program, even though most are seeing an increasing number of security threats and incidents.

This is the first time ISACA has surveyed security practices at work, and Anderson wants to follow up on the results. He’s especially interested in how and why people knowingly violate corporate IT policies.

Checking personal e-mail at work may not seem like a problem, he says, but when you consider that 49 percent of workers clicked on a URL in an external e-mail and one-third downloaded files or software from friends, the risks grow quickly.

Original URL: http://www.baselinemag.com/article2/0,1540,2222215,00.asp

Google won’t disclose numbers, but the company says that spam attempts, as a percentage of e-mail that’s transmitted through its Gmail system, have waned over the last year. That could indicate that some spammers have gotten discouraged and have stopped trying to get through Google’s spam filters.

Other experts disagree with Google, pointing out that overall spam attempts continue to rise. By most estimates, tens of billions of spam messages are sent daily. Yet for most users, the amount of spam arriving in their inboxes has remained relatively flat, thanks to improved filtering.

Brad Taylor is on the front lines of the war on spam. He has served as the chief watchdog of Google’s spam filter since 2004, when Gmail first launched. His history with spam goes back much further, though: He’s been fascinated with it since 1994, when he received his first spam e-mail at a work account. Before he joined Google, he worked at an anti-spam startup.

Taylor denies he’s obsessed with junk mail, but his actions speak otherwise: For his own amusement, he Googles the gobbledygook at the bottom of spam messages to see where the text comes from. (Some are from Harry Potter books, he says. He also found one that was an English translation of a Russian science-fiction novel).

“It’s fun,” he says of catching spammers. “Sometimes I think, ‘Oh, wow, that guy’s really clever.’”

The chase may be exciting, but Taylor’s real dream is to return e-mail to the “pristine experience it used to be.”

Chenxi Wang, an analyst at Forrester Research, scoffs at the idea that spam attempts could be on the decline.

“I’m seeing that the overall trend is up,” Wang says. “We’re not seeing a drastic increase, though. And we’re also seeing an increase of targeted spam instead of blanket spam that hits everybody in a large population. Today, for instance, you see spam messages on saving (on) prescription drugs targeted to seniors.”

For its part, Yahoo, too, says the overall amount of spam transmitted is on the rise, but the percentage of spam that reaches its users’ inboxes is down. (Yahoo would not disclose specific numbers.)

Regardless of the overall spam attempts, David Daniels, vice president of Jupiter Research, predicts the number of spam messages that actually reach a typical inbox will remain roughly flat over the next three years. And for most people, that’s what really matters.

“We’re forecasting that the number of spam messages that annually reach the average inbox will hit 4,351 in 2007. For 2010, we think that number will essentially be flat at 4,403. The growth will be very, very small,” Daniels says.

There are a couple of reasons for the lack of growth in spam deliveries. For one, e-mail providers like Google, Yahoo, AOL and Microsoft’s Hotmail use sophisticated filtering algorithms that are constantly updated based on spam reports from individual users. Google says it can delete all instances of a single spam message across the Gmail network in seconds.

New anti-spam technologies are also always under development, and there are already countless anti-spam services and technologies available to consumers, including disposable e-mail addresses.

It’s by no means a perfect system, though. And spammers are, if nothing else, persistent.

In a bizarre twist, Daniels thinks that instead of receiving spam offers from penny-stock pushers, mailboxes will increasingly be filled with marketing messages that we choose to receive, such as promotional e-mails from a favorite clothing store or a bank. He thinks the average number of messages from marketers that individuals receive annually will grow from 2,715 in 2007 to 3,335 in 2010.

“We expect people to spend as much time on e-mail as they have, but we think people will receive more e-mail from legitimate marketers. So there will be more competition to get consumers’ attention in the inbox, but it will be more like competition between The Gap and J.C. Penney as opposed to The Gap and a Viagra salesman.”

Original URL: http://www.wired.com/techbiz/it/news/2007/11/google_spam

DNS has been with us since 1983 ??? nearly as long as the Internet. And although DNS RFCs have come and gone, DNS is still very similar to its original specifications. Certainly it has grown in feature set and complication, but it still has the same underlying security problems it did when it was invented by Paul Mockapetris. The biggest problem is the lack of default authentication. Several security mechanisms have been created for DNS with varying degrees of success (and failure) to solve the authentication problem, but it is still relatively easy to fake a DNS packet to either a DNS server or an unwitting client.

Klein’s last find involved two discoveries, both of which allow important parts of a DNS server packet to be forged with trivial effort. The first implementation error involves the DNS UDP source port. Although it should be randomized to prevent forging, it turns out that the source port never changes the whole time the DNS server is up and running. The second, and more important, problem is the trivial predictability of the transaction ID value. Both errors allow DNS server packet information to be predicted and forged.

An attacker can send a malicious Web page link and induce an end-user to click on the link. The clicked link sends off a DNS client query, which can be forged, sending the end-user to a bogus location. DNS has been found vulnerable in the same way before. In fact, Klein laments, “It is saddening to realize that 10-15 years after the dangers of predictable DSN transaction ID were discovered” that DNS software is still susceptible to transaction ID exploitation.

Klein reported his findings to BIND’s caretakers, the Internet Software Consortium (ISC), in late May and to Microsoft in April. Both the ISC and Microsoft have released patches or updated software. Thanks are due to Amit Klein for his research and responsible disclosure.

Overall, Microsoft’s DNS implementation has been relatively secure. The last major security update to Windows DNS was in Windows 2000 SP2 and SP4, as well as Windows Server 2003 (nearly five years ago). BIND is the most popular version of DNS server software used on the Internet, and its overall security track record has been a bit more active over the years, as one would expect with more popular software. BIND versions 8.x and 9.x have had at least six different vulnerabilities published.

The most secure version of DNS is considered djbdns, named after its author, Dr. Dan J. Bernstein, one of the most prominent voices for security over functionality in computer software. Although djbdns (also known as tinydns for one of its daemons) is not nearly as functional as Windows DNS or BIND, it is run by some of the world’s largest companies. Dr. Bernstein claims that more than 1.8 million .com addresses use djbdns. And though Dr. Bernstein has been offering a $500 reward to anyone who can find an error in its 7,000 instructions, there has yet to be a successful claim. Unfortunately, djbdns is built only for Unix and could not be used efficiently to support an Active Directory domain.

Besides making sure your DNS servers are running up-to-date versions of DNS, I think Klein’s findings bring up another interesting point. Open source advocates are always touting how open source software allows programming and security bugs to be found faster than with closed source software. It certainly makes sense ??? there’s source code to review, and more eyeballs to review it. But as Klein’s research shows, it doesn’t make that much of a difference. In the 10 to 15 years that have gone by, nobody (publicly) found the bugs in either the closed source or open source versions inherently faster. Both errors went undetected for more than a decade until one person got interested in the research.

There are dozens of cases just like this, where open source bugs remained unfound for a decade or more, until one lone individual on their own personal quest did some digging. You can look at any of the popular protocols (such as SMTP, SNMP, HTTP, FTP, ASN.1, and so on) and find vulnerabilities that went undiscovered for over a decade. Heck, people are still finding problems in IPv4 packets that have been around for 20-odd years. And as far as I can tell, whether or not the product was open source didn’t really play a part in the finding or the fix, albeit the open source fixes are consistently coded faster when the problem is located. What mattered most was a single person (or company) that cared enough to investigate. To the responsible bug disclosure people, I salute you!

Original URL: http://news.yahoo.com/s/infoworld/20071123/tc_infoworld/93597

The Secure Programming Council unveiled Tuesday a proposed standard for companies to test their software developers’ knowledge of secure programming. The aim is to create a situation in which companies can ensure that their developers, whether in-house or outsourced, have a base level of knowledge about wrapping security into software applications.

The council is rolling out its “Essential Skills for Secure Programmers Using Java/JavaEE” (PDF), the first of six standards initiatives. It plans to later add skills tests for C and C++, as well as languages .Net, PHP, and PERL.

The council is opening up the Java/JavaEE proposed standard for public comment via e-mail over the next 60 days.

Some of the proposed areas of testing will include data handling, authentication, and session management and access control. For example, under the data handling task, Java programmers must be able to write programs that read input from interfaces, properly validate the data, then disseminate it. The programmers would also need to be familiar with such malicious-attack scenarios as cross-site scripting and SQL injections.

The skill testing is designed to not only ask developers whether they know what encryption is but whether they understand the differences between PKI encryption and other forms of encryption, said Ryan Berg, co-founder of Ounce Labs and a member of the Secure Programming Council’s Java and JavaEE steering committee.

More than 40 companies, government agencies, and security firms have participated in helping to establish the standards, largely coming from the financial services, manufacturing, aerospace, military, and outsourcing industries, said Alan Paller, director of research at SANS Institute.

“One large financial institution has told its developers that they had to pass the test by August 1, or they won’t touch a line of code,” Paller said. “The financial industry is taking the lead because they have the most to lose.”

SANS will administer the tests, which are scheduled to begin on December 5 in London and continue for the next eight months in cities through out the United States and Europe.

The tests, which don’t actually require a No. 2 pencil, cost between $50 and $450, for participants ranging from students to employees of large corporations.

Original URL: http://www.news.com/8301-10784_3-9822104-7.html