IBM Application Security Insider

Enhancing Web Application Security Testing with IBM Security AppScan Glass Box

I have already blogged about AppScan's Glass box (IAST / Runtime Analysis) capabilities a while ago, but I've recently recorded a short demonstration of how to install and run a Glass box scan with IBM Security AppScan Standard.

Here's the Youtube movie (don't forget to watch it in 720p/HD, full screen)

 

Android SQLite Journal Information Disclosure (CVE-2011-3901)

Recently we detected a security vulnerability in Android’s SQLite engine which can be exploited by a non-privileged application in order to disclose sensitive information. It enables a malicious application to eavesdrop on database activities performed by any other application using SQLite, allowing unauthorized access to information such as URL history, messages, and contacts.

The complete advisory can be found here.

Demo of the PoC:

 

We would like to thank the Android Security Team for the efficient and quick way in which they handled this security issue.