Nekkid Ninjas

A new extension has been published today. NinjaSecurity[1] is a system plugin, that monitors all incoming data. Once enabled it searches the so called GPC data for previously defined exploit patterns that can be modified at the plugin's admin interface. On a detected attack NinjaSecurity[1] bans the attackers IP address for a previously defined period of time.

Over the past week there was published the plugin JAntiHacker on the Joomla!™ Extension Directory, and as a Linux and security freak I directly downloaded and inspected this tool. What I found was horrible! And by the way: The JED team immediately took it off the directory.

Once the plugin was activated, the complete system was unusable. I had to disable the plugin directly at the MySQL database. Who of the non-professional users were able to put Joomla!™ in a stable state again?

I think I do not need to answer this question.

Next point was, if this plugin wouldn't have made Joomla!™ unusable, it would not really be protecting the system. Hey, there are also other ways I can go in order to inject my exploit code! This situation forced me to do a fork, because I hate leaving people in a security that is NOT given.

NinjaSecurity[1] is not a MagicBullet, but it can search all channels an attacker could frequent for his bad job, except injecting web server environment variables or performing remote file inclusions. Since a web application does its work on the HTTP layer there are also types such as NULL string attacks a web script can never protect from, but in any case the vulnerability for injection attacks is tremendously reduced.

Have A Lot Of Fun.

Best Regards
Uwe Walter

[1] Download NinjaSecurity Plugin 1.0.0

This should be Uwe's post but approximately half an hour before we became aware of that NinjACL was listed in the Joomla Extension Directory Uwe mentioned in the Team Ninja private chat that he was "leaving early" today. Today is his @;!*th birthday and he had celebrations planned!!

Because of that and because this is such a superb extension I thought that two things should be celebrated!!

So, first of all: Happy Birthday Uwe!!

And secondly; congratulations on releasing NinjACL for Joomla 1.0.15

If you're interested then NinjACL can be download from Ninja Forge!

...and, if that wasn't enough I think I might be right in suggesting that Uwe is already working on NinjACL's first patch and it might be for a much-used Joomla component; D**man

Nice one Uwe!!

I'm proud to announce today, that I've finished work on NinjACL to almost 90% and am able to set the extension on Alpha Status now. So we Ninjas can begin testing on this component from tomorrow on.

I recently read an article by Paul at Pseudorant expressing their disappointment at how Joomla Open Source Developers (OSDs)charge for their work, questioning their Open Source-ness (is that a word?), and calling them greedy because they wanted to receive a fair compensation for their work.

It was, sadly, filled with the sort of hypocritical entitlement syndrome thinking that permeates the Open Source consumer environment. Most OSDs themselves don't feel this way, it is typically only consumers who do so, though many of them are fellow developers themselves.

Now this isn't entirely the author's fault, as thousands, if not millions, of others feel the same way. But I personally feel that Open Source will never come into it's own and truly flourish unless this thinking is changed.

Every day I investigate all these security related sites, because I'm not only developer but a system administrator who wants to keep his systems as secure as possible. And every day I have to wonder how hard it must be, to simply add a null to incoming integer values.

Just a hop to: http://secunia.com/search/?search=Joomla

Isn't it a well known issue, that one cannot trust anyone? Specifically user supplied data? Dear colleagues: It's only PHP and MySQL, neither C/C#/C++ nor ASM! You don't need to worry about heap, stack or registers. You only need an adequate knowledge about data types, respectively type casting.

I'm really glad, to be member of a team, that does care for customers and their security. Thumbs up guys! We'll meet at the Dojo.

Best Regards
Uwe