Actually, it does not seems 'that good' to gaze at a security firm with much reputation still persisting with a basic flaw in their web site.
The Flaw: 'iFrame injection'
The iframe injection is an kind of injection of one or more iframe tags into a page's content. The iframe can typically do many not-so-good things such as downloading an executable application that may contain a kind of malwares or so which may directly compromise a visitors system.
Its now one of the popular methods of loading malwares onto users PC's without having them going to a compromised website. An IFrame (stands for "inline frame") is just a way of loading one web page inside another, more commonly from a different server. Now this is one of those things which can be useful for building online applications. But malware writers can create the included page just 'one pixel square' - meaning you can't even see it's actually residing there - and obfuscate the JavaScript that will run automatically from that included page so that it looks something like %6D%20%6C%72%61%6D%65%62%6F - leaving no obvious clue that it's malicious.
Ways worms could inject, a class of iFrames aka hidden iframes to files
- Server's getting compromised : This is one of the most common way. Some of the websites residing in the same web server as your website may be compromised (or it may also be some vulnerabilities in ones web app. itself) that caused the web server to get compromised. Once the server is compromised, the worm automate itself spreading to rest other websites in the server.
- Compromising through client side FTP : The worm may be residing in some/any of the client computers one use's for accessing the ftp/control panel accounts of your hosting server. When you type in the credentials for the control panel or so the worm closemouthed reading the credentials access the portal and initiates infecting files found on the server. It adds the following code to all the index.* files.
To the html pages the following piece of code gets added:
Detecting iFrame Injections
To detect a kind of iframe injections, one should look through the HTML what your web server is sending. Open a page in your browser and then look for iframe tags. Injections usually insert iframes that point to raw IP addresses (something like “64.76.7.101″) instead of domain names. Treat these as suspicious. Once you’ve found an iframe and have determined that it’s not legitimate, you have to remove it from the page or database it’s coming from. On a WordPress blog you simply edit the page in question and look for the "&lgt;iframe>?" and remove it.
Alas! hope that LIGATT rectifies these kinds of basic flaws in their portal thus withstanding its reputation.
This post can also be viewed here.
The concept of cloud itself is one of those things that certainly get lot of hype, but no matter how one looks at it, the fact remains that it’s been used on greater and greater numbers and is becoming a more important topic for people to understand and with that certainty, the security aspect of it also playing an important role. Including what does that means and how do people deal with it, is the topic that people have talked about. Yet, it’s still confusing for some and there is lot of uncertainty in this space.
Another way to view Cloud is to think of the Spectrum. Many times its seen, lots of people querying around ‘how would they define Infrastructure as a Service’ (IaaS), ‘Platform as a Service’ (PaaS) & ‘Software as a Service’ (Saas)’ and as seen in today’s time they have just too many of ‘as a service’ acronyms, one of them being ‘XaaS’ which indicates ‘Everything as a service’. The best way to think about some of these things, or ways to identify what are you dealing with or making out which bucket it fits into, is to really look which layer of computing stack you are abstracting. Infrastructure guys (i.e. Infrastructure as a Service) really focus on core computing infrastructural level technologies. So looking at Amazon’s AWS, EC2 and S3, they are really taking a server and making that server into an abstracted entity that you can access over the wire as well as the disk drives. So, they are completely going after the compute ware and there are companies like ‘Gogrid’ who is doing the same thing lying within the Microsoft framework. We can see many other firms coming up into this category such as Linode, Rackspace etc. When we move up to ‘Platform as a Service’ , one is really making the decision of application framework, that one is looking at and actually people need to understand this, that when they approach ‘Platform as a Service’, they are making a very strategic decision about how they are going to architect whatever application they are going to run and if they make the choice to give it a ‘Force.com’ or ‘Azure’ or ‘AppEngine’ or an ‘Engine Yard’ it’s known they are really getting married to this platform. So, in a way we could call ‘Platform as a Service’ as one of the most interesting areas of cloud computing market. And the last area ‘Software as a Service’, clearly shows what these guys are bringing in, is that layer of business logic on top of the application framework, are really driving business values. It signifies that it really speaks to the fact that, this is where the translation of computing into value for the business occurs and that’s why tremendous action is seen with lot of excess marketplace. Moreover, if one lookup the startups as well some established players playing, the growth of this marketplace is pretty significant.
Above this, daily getting multiple queries on 'accounts getting hacked','identity thefts','spreading hoax aka spams' through the social networking portals... The sole thing i would like to say as a Security consultant as well as a, well versed Web 2/3.0 user is, *You could never get hacked by anyone, till you let it...*, as the techniques perpetrators use, to get through your account, is 'your' online published captivating content about yourselves and a bit of 'social engineering tactics' which informally means, "To indulge a user with fake identity, to gain user's 'trust' and aftermath getting valued information through continuous interaction from the user".