Bugfix Release for NinjaSecruity

Today we released a new version of our system plugin NinjaSecurity. It is a bug fix and improvement release. Under certain circumstances the Backend User Groups were wrongly blocked from writing articles and then banned, respectively locked out from the admin panel. They are now excluded from pattern matching by default.

I also added Frontend User Group Control, so the site admin now can decide which of the Frontend User Groups are supposed to be trustworthy members and can exclude them from pattern matching.

Second new feature is a Component Control for also excluding them from pattern matching. This can be useful when you run a component such as JComment or JoomComment, where non-registered users are allowed to post data. This can also be useful, when you publish articles regarding security relevant topics and want the user give the ability to search specific articles via the search component "com_search".

And last but not least I added the secure login mechanism, inspired by the
"jSecure Authentication" system plugin.

Best Regards
Uwe Walter

Ninja Theme launches:

Want to design a template?



Our sister site, Ninja Theme, home to the Ninja's Joomla Template club has finally come out of soft launch mode and has now officially launched. As you would expect from us, NT is a not your
standard Template Club as we have been listening to the complaints and suggestions at other template clubs and have decided to try something different that
we hope people will like.

 
Every month, in addition to a regular template, we will crowdsource a design which we will
then produce. What does crowdsource mean? We want community members to submit
designs, and then the rest of the community will vote on those
designs, and then we will develop the winner as chosen by the
community. 
 
All you need to submit is a template design in a decent sized .jpg
file. If you are the winner then we will need either a PSD or,
preferably, a layered Fireworks PNG file and the NT team will take care of all the
PHP, HTML, CSS, and Javascript required.


We also have a nice pile of prizes for the winner. Thanks to generous sponsorship of Mauritius Connection
this month, the cash portion of this month's prize will be $300 USD,
plus $500 in life memberships at Ninja Forge and Ninja Theme. Then we also have a free one year SEO Club members forum access at Alledia, valued at $99 to give away to our winner. To top it all off, the good folk at Joomla Training have thrown in a ticket to a Joomla training class worth $349. If that wasn't enough we also have thrown in a year of hosting at Ninja Hosting, with the package of your choice worth up to $480. So we have over $1700 in cash and prizes for the winner.
 
Then on top of that is the brag factor of being able to point to a few hundred or
even thousand sites around the web and say 'that's my design', you will also get an entry
in our leader board, and a full page on the demo site for you to
advertise your blog, business or services, or just put up a big photo of your Mum
if you like, whatever you like. You will even get a link in the footer of the template
itself. So lots of SEO and link love as a nice bit of icing on top for
a designer to get their name out there.


The above mentioned  Crowdsourcing Design Competition, our first for 2009, and in fact first ever, is sponsored by Mauritius Connection a great place for Mauritius deals and holidays, and also their sister site, Caribbean Connection, an equally fantastic place for information about the Caribbean. As a result the Theme for the design is a holiday, or holiday services site, preferably a tropical theme, but others may be acceptable.
 
We will also be making this template a free template, so anyone
can make use of it if they wish.  So we can expect this one to be seen
far and wide.


The competition is open to anyone who wants to try,  even people from other template
clubs or extension developers.  We don't mind at all. We are just
looking for quality designs.


If your design doesn't make the cut, don't worry, as you can fine tune
it, and resubmit it into as many competitions as you like until you do
win. So no efforts are wasted.


Entries for this month close on the last day of January, a scant 2 weeks away. But remember you ONLY need the design, no coding is necessary, just an image.


We will then hold voting on the first week of February (and announce
the next theme), and produce the winning design for a March 1st
release, or earlier.
 
So let's all get our design hats on, and see what we can come up with!

NinjaSecurity Flame War on Twitter

I noticed that flame war about NinjaSecurity on Twitter today and was really shocked. But I didn't get into it, because such things are emotional nonsense. So I do a blog post now, trying to make some things clearer and maybe open someone's eyes. B)

First off:
As the developer of NinjaSecurity I see my person attacked and indeed, that's no good feeling. I don't want to distinguish myself, when developing software that might help to improve my clients security. I just want to do a good job and that's it. So I introduce myself a bit as a kind of statement about my knowledge base. I want you guys to realize, that I know what I'm writing about.

Next will then be to take a stand on the intension of NinjaSecurity, respectively those charges from Anthony and Daniel on Twitter that Stian and Steve were fighting with. And the last part of my post will exemplary show how NinjaSecurity can protect a web application from injection attacks. And certainly I will show that for the worst case an encrypted password is not the salt worth it is seeded with!

Read more

Pages: 1 · 2 · 3

The Ultimate Injection Guard

A new extension has been published today. NinjaSecurity[1] is a system plugin, that monitors all incoming data. Once enabled it searches the so called GPC data for previously defined exploit patterns that can be modified at the plugin's admin interface. On a detected attack NinjaSecurity[1] bans the attackers IP address for a previously defined period of time.

NinjaSecurity Plugin

Over the past week there was published the plugin JAntiHacker on the Joomla!™ Extension Directory, and as a Linux and security freak I directly downloaded and inspected this tool. What I found was horrible! And by the way: The JED team immediately took it off the directory. :>

Once the plugin was activated, the complete system was unusable. I had to disable the plugin directly at the MySQL database. Who of the non-professional users were able to put Joomla!™ in a stable state again?

I think I do not need to answer this question.



Next point was, if this plugin wouldn't have made Joomla!™ unusable, it would not really be protecting the system. Hey, there are also other ways I can go in order to inject my exploit code! This situation forced me to do a fork, because I hate leaving people in a security that is NOT given.

NinjaSecurity[1] is not a MagicBullet, but it can search all channels an attacker could frequent for his bad job, except injecting web server environment variables or performing remote file inclusions. Since a web application does its work on the HTTP layer there are also types such as NULL string attacks a web script can never protect from, but in any case the vulnerability for injection attacks is tremendously reduced.

Have A Lot Of Fun.

Best Regards
Uwe Walter

[1] Download NinjaSecurity Plugin 1.0.0

Black Belt in Image Management.

Today we published our new extension Ninjimage[1]. It's a module for image handling images, logos or modules on a web page. Images can be positioned relative, that is they are displayed at Ninjimage's module position, but also can be placed anywhere on the site by absolute positioning.

Ninjimage Module

Ninjimage is a merge of our popular Joomla!™ 1.0.x extensions:

  • Ezee Logo
  • Ezee Image
  • Ezee Dragger

But we improved almost all available features. The biggest innovation (I think) is the possibility to display draggable modules on the page. And since it is available in two languages, English and German, this is our monthly piece for our German community I promised at the nearly end of the last year 2008.

Don't miss to throw an eye on the module[1] that has the Black Belt in Image Management.

Best Regards
Uwe Walter

[1] Download Ninjimage 1.0.0