Jail Authorities Mistakenly Early Released 3,200 Prisoners due to a Silly Software Bug

Washington State Department of Corrections (DoC) is facing an investigation after it early released around 3,200 prisoners per year, since 2002, when a bug was introduced in the software used to calculate time credits for inmates' good behavior.

The software glitch led to a miscalculation of sentence reductions that US prisoners were receiving for their good behaviour.

Over the next 13 years, the median number of days of those released early from prison was 49 days before their correct release date.

"This problem was allowed to continue for 13 years is deeply disappointing to me, totally unacceptable and, frankly, maddening," Washington State Governor Jay Inslee said in a statement. "I've [many] questions about how and why this happened, and I understand that members of the public will have those same queries."

What's the Bug and How did it Remain Undetected for 13 Years?

The issue lies in DoC software that is used for calculating the release date for prisoners who showed good behavior while imprisoned.

The software bug was introduced in 2002, when the state's supreme court implemented a change to the "good time" credit system, allowing prisoners to claim credits for good behaviour while they are in:

• State Prisons 
• County jails

These credits are then used to shorten the length of prisoner’s sentence. To apply these changes, DoCs around the United States released the new versions of software but unfortunately, the code that calculated prison sentences was faulty.

DoC First Informed of the Issue 3 Years Ago

What's even more disappointing is that the authorities first learned of the bug in December 2012, when the family of an assault victim alerted DoC that the attacker was going to be set free too soon.

At that time, DoC filed a request, labelling the error as "time sensitive" and to be implemented as quickly as possible.

However, the Washington DoC hired a new IT manager in November, who alerted the authorities of how serious the bug had become. Inslee assures that a full fix for the bug is expected to be rolled out by 7th January.

Until then the DoC has been ordered not to release any prisoner without manually checking their actual release date.

Read more

These Top 10 Programming Languages Have Most Vulnerable Apps on the Internet

A new research showed that Scripting languages, in general, give birth to more security vulnerabilities in web applications, which raised concerns over potential security bugs in millions of websites.

The app security firm Veracode has released its State of Software Security: Focus on Application Development report (PDF), analyzing more than 200,000 separate applications from October 1, 2013, through March 31, 2015.

The security researchers crawled popular web scripting languages including PHP, Java, JavaScript, Ruby, .NET, C and C++, Microsoft Classic ASP, Android, iOS, and COBOL, scanning hundreds of thousands of applications over the last 18 months.

Researchers found that PHP – and less popular Web development languages Classic ASP and ColdFusion– are the riskiest programming languages for the Internet, while Java and .NET are the safest.

Here's the Top 10 List:

The Veracode research report used a unique metric, Flaw Density per MB, which means the number of security bugs in each MB of source code.

Here's the list of unlucky winners:

• Classic ASP – 1,686 flaws/MB (1,112 critical)
• ColdFusion – 262 flaws/MB (227 critical)
• PHP – 184 flaws/MB (47 critical)
• Java – 51 flaws/MB (5.2 critical)
• .NET - 32 flaws/MB (9.7 critical)
• C++ – 26 flaws/MB (8.8 critical)
• iOS – 23 flaws/MB (0.9 critical)
• Android – 11 flaws/MB (0.4 critical)
• JavaScript - 8 flaws/MB (0.09 critical)

Web Apps in PHP are Most Vulnerable, Here's Why:

PHP, which is on third, is actually leading the ranking because ColdFusion is a high-end niche tool and Classic ASP is almost dead.

Taking a closer look at PHP:

• 86% of applications written in PHP contained at least one cross-site scripting (XSS) vulnerability.
• 56% of apps included SQLi (SQL injection), which is one of the dangerous and easy-to-exploit web application vulnerabilities.
• 67% of apps allowed for directory traversal.
• 61% of apps allowed for code injection.
• 58% of apps had problems with credentials management
• 73% of apps contained cryptographic issues.
• 50% allowed for information leakage.

From above issues, SQLi and XSS are among the Open Web Application Security Project's (OWASP) Top 10 most critical web application security risks.

SQL injection bugs – which allow hackers to directly interact with a Web site's database – are the ones that have been blamed for the massive data breaches at kiddie toymaker VTech and telecom firm TalkTalk.

According to the report, the risk size of the above vulnerabilities can be measured by the volume of PHP apps developed for the Top 3 CMS (Content Management Systems) – WordPress, Drupal and Joomla – that represent over 70% of the CMS market.

Choose Your Scripting Language Wisely

Less than a quarter of Java applications contain SQL injection flaws, compared to more than three-quarters of those applications written in PHP.

"When organizations are starting new development projects and selecting languages and methodologies, the security team has an opportunity to anticipate the types of vulnerabilities that are likely to arise and how best to test for them," Veracode's CTO Chris Wysopal advised.

Read more