title: Escrow: A large-scale web vulnerability assessment tool

authors: Delamore, Baden

abstract: The reliance on Web applications has increased rapidly over the years. At the same time, the quantity and impact of application security vulnerabilities have grown as well. Amongst these vulnerabilities, SQL Injection has been classified as the most common, dangerous and prevalent web application flaw. In this paper, we propose Escrow, a large-scale SQL Injection detection tool with an exploitation module that is light-weight, fast and platform-independent. Escrow uses a custom search implementation together with a static code analysis module to find potential target web applications. Additionally, it provides a simple to use graphical user interface (GUI) to navigate through a vulnerable remote database. Escrow is implementation-agnostic, i.e. It can perform analysis on any web application regardless of the server-side implementation (PHP, ASP, etc.). Using our tool, we discovered that it is indeed possible to identify and exploit at least 100 databases per 100 minutes, without prior knowledge of their underlying implementation. We observed that for each query sent, we can scan and detect dozens of vulnerable web applications in a short space of time, while providing a means for exploitation. Finally, we provide recommendations for developers to defend against SQL injection and emphasise the need for proactive assessment and defensive coding practices.

text: Escrow: A large-scale web vulnerability assessment tool The reliance on Web applications has increased rapidly over the years. At the same time, the quantity and impact of application security vulnerabilities have grown as well. Amongst these vulnerabilities, SQL Injection has been classified as the most common, dangerous and prevalent web application flaw. In this paper, we propose Escrow, a large-scale SQL Injection detection tool with an exploitation module that is light-weight, fast and platform-independent. Escrow uses a custom search implementation together with a static code analysis module to find potential target web applications. Additionally, it provides a simple to use graphical user interface (GUI) to navigate through a vulnerable remote database. Escrow is implementation-agnostic, i.e. It can perform analysis on any web application regardless of the server-side implementation (PHP, ASP, etc.). Using our tool, we discovered that it is indeed possible to identify and exploit at least 100 databases per 100 minutes, without prior knowledge of their underlying implementation. We observed that for each query sent, we can scan and detect dozens of vulnerable web applications in a short space of time, while providing a means for exploitation. Finally, we provide recommendations for developers to defend against SQL injection and emphasise the need for proactive assessment and defensive coding practices.

year: 2015-01-15

title: Teaching evolution in New Zealand’s schools—Reviewing changes in the New Zealand science curriculum

authors: Campbell, Alison

subjects: evolution

abstract: New Zealand has had a national school science curriculum for more than 80 years. In the past the evolution content of this document has varied, and has at times been strongly influenced by creationist lobby groups. The ‘new’ science curriculum, to be fully implemented in 2010, places much greater emphasis than before on understanding evolution, and also on teaching the nature of science. Interplay between the two can potentially improve student understanding of the culture and processes of science in general and evolutionary theory in particular. While the explicit use of the word ‘evolution’ highlights its significance, it is necessary to provide both resources and pedagogical guidelines to support teachers in dealing with this important topic.

text: Teaching evolution in New Zealand’s schools—Reviewing changes in the New Zealand science curriculum New Zealand has had a national school science curriculum for more than 80 years. In the past the evolution content of this document has varied, and has at times been strongly influenced by creationist lobby groups. The ‘new’ science curriculum, to be fully implemented in 2010, places much greater emphasis than before on understanding evolution, and also on teaching the nature of science. Interplay between the two can potentially improve student understanding of the culture and processes of science in general and evolutionary theory in particular. While the explicit use of the word ‘evolution’ highlights its significance, it is necessary to provide both resources and pedagogical guidelines to support teachers in dealing with this important topic.

year: 2011

title: Iwi sex ratios in the New Zealand population census: Why are women so dominant?

authors: Kukutai, Tahu

abstract: Recent census-based studies of iwi (tribal) population growth have revealed a high degree of volatility that cannot be explained by demographic factors alone. Although focused on a small number of iwi, these studies have shown that changing patterns of identification are an important driver of iwi population growth, and that the propensity to identify with an iwi appears to be much stronger among Māori women than men. Thus, the vast majority of iwi in the census have far more females than males, and female domination has increased over time. This paper describes the key features of female-favoured iwi sex ratios in the census and explores possible explanations. Focusing on sex ratios for the ten largest iwi, we find that female domination is highest in the 25–44 age group, and that this pattern is consistent over time. Further analysis shows that Māori women aged 25–34 years are more likely than their male counterparts to know detailed aspects of their pepeha (tribal identity), to explore whakapapa (genealogy) and to speak te reo Māori. Our results underscore the importance of Māori women as cultural connectors within their whānau, as well as in a broader iwi context.

text: Iwi sex ratios in the New Zealand population census: Why are women so dominant? Recent census-based studies of iwi (tribal) population growth have revealed a high degree of volatility that cannot be explained by demographic factors alone. Although focused on a small number of iwi, these studies have shown that changing patterns of identification are an important driver of iwi population growth, and that the propensity to identify with an iwi appears to be much stronger among Māori women than men. Thus, the vast majority of iwi in the census have far more females than males, and female domination has increased over time. This paper describes the key features of female-favoured iwi sex ratios in the census and explores possible explanations. Focusing on sex ratios for the ten largest iwi, we find that female domination is highest in the 25–44 age group, and that this pattern is consistent over time. Further analysis shows that Māori women aged 25–34 years are more likely than their male counterparts to know detailed aspects of their pepeha (tribal identity), to explore whakapapa (genealogy) and to speak te reo Māori. Our results underscore the importance of Māori women as cultural connectors within their whānau, as well as in a broader iwi context.

year: 2017