NinjaSecurity Flame War on Twitter

I noticed that flame war about NinjaSecurity on Twitter today and was really shocked. But I didn't get into it, because such things are emotional nonsense. So I do a blog post now, trying to make some things clearer and maybe open someone's eyes. B)

First off:
As the developer of NinjaSecurity I see my person attacked and indeed, that's no good feeling. I don't want to distinguish myself, when developing software that might help to improve my clients security. I just want to do a good job and that's it. So I introduce myself a bit as a kind of statement about my knowledge base. I want you guys to realize, that I know what I'm writing about.

Next will then be to take a stand on the intension of NinjaSecurity, respectively those charges from Anthony and Daniel on Twitter that Stian and Steve were fighting with. And the last part of my post will exemplary show how NinjaSecurity can protect a web application from injection attacks. And certainly I will show that for the worst case an encrypted password is not the salt worth it is seeded with!

Follow up:

Me, Myself and I

I am a 36 year old geek and IT professional with a work experience of about 12 years. I got my first computer at an age of 14, my beloved Atari 800 XL with a 5¼" floppy drive. So my computer and basically programming experience now grows for about 22 years. I started in the mid 80's with Atari Basic, my first compiled language then was Turbo Pascal and during my education I had to learn this ugly ANSI COBOL 74. The language in itself is quite a big vulnerability, because it induced the programmers to leave software as is when they lost survey of their codes. That was really a great time, when no one cared for security. B)

Near the end 90's I hopped over to Linux and was reborn! Since then I am improving my skills in programming Perl and ANSI C, what gave me a complete different point of view. To become acquainted with OpenSource software was the best thing ever happened in my life!

I also gave Visual Basic a try, only to learn how the Windows API works and getting into the writing of VBS(VBA) and macro or IE exploits, but eh that's not my world. I am a shell junkie and need my xterm and vim like the air to breathe. Linux is so much easier to break into, because the sources are open and you can count on programming errors somewhere! With proprietary software you have to bother with reverse engineering and network sniffing, all that time consuming stuff. IDA is really a great tool, but as mentioned before: It is that annoying, so I focused myself on Linux and BSD.

I constructed my first local root exploit with Perl and a little shell code found on packetstorm. phrack was my first address for a long time and I decided to get a little deeper into that stuff. Over the time my private network became bigger and I started to explore it in any kind. Rootkits you can get en mass on the internet. A little changing here, a bit tweaking there and you get all your heart can desire. 0wning my several (?:w|l)in or bsd boxes made that much fun, I was nearly tempted to search the challenge in the OuterRim, but I am actually not a criminal and scared about being busted or jailed.

Then after a hard dispute with my Boss in 2001 I lost my job as a QUANTUM programmer at a market research institute, resulting in an awful situation namely not getting a new one. I think it's clear why? Every company is asking your last Boss in order to gain information about skills and your social behavior. So I had to decide what to do! Going the easy way in using my skills for criminal things, doing a bad and annoying job for low or founding my own "one man" company where I can work as I want and in a branch that I call my home.

That was my start as a self employed web developer and nowadays I'm so happy that our Oyabun Daniel gave me a chance to prove my trustworthy. I am Senior Developer, Site Administrator, Security Consultant and the first full time employee at the Ninja Media Group.

I'm proud to be a Ninja and being member of such a great team!

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS d-- s+:+ a C++++ UL+++ P++++ L+++ E--- W+++ N++ o-- K--- w--- 
O---- M+ V-- PS+++ PE- Y++ PGP+++ t++ 5 X R* tv- b+++ DI++ D- 
G++ e+ h+ r- y++ 
------END GEEK CODE BLOCK------

Pages: 1 · 2 · 3