--- Gadi Evron <ge@xxxxxxxxxxxx> wrote: > David M Chess wrote: > > But many of us *love* to argue about taxonomies and word meanings (it's > > cheaper than booze anyway). *8) > 1. A user-assisted remote attack. > 2. A client-side remote attack. > > I.e., we can add "user assisted" as a class like "local" and "remote", > or add types (think ICMP here). > Vulnerability Types [Optional] > 1. Client-side > 2. User-assisted > Questions remain: > - How does one treat an SQL injection? I think essentially the problem of trojans, phishes and poisoned data is that of masquerading. For trojans, the problem is e.g. lack of system-attention key; for Phish, lack of authentication protocols etc; and for injection, the vulnerability is in the input data scrubbing. Injection requires a bug in one place: the (web-)application code. What follows is leveraged hijacking, with perhaps masquerading as an intermediate step. .02 john ___________________________________________________________ NEW Yahoo! Cars - sell your car and browse thousands of new and used cars online! http://uk.cars.yahoo.com/
