A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...
11
votes
1answer
1k views
REST specific security weaknesses
I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST.
What I would ...
7
votes
3answers
1k views
Any flaws in this security model for a REST web service?
I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
6
votes
3answers
375 views
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)
LivingSocial - 50 Million Users Exposed
Zappos - 24 Million ...
6
votes
2answers
171 views
Safe YAML parser?
I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
6
votes
2answers
283 views
Does anyone use XML Encryption?
The XML standard defines a mechanism for encrypting the data in a XML document. It's part of the standard.
Does anyone use this XML encryption format? Are there any significant deployed systems ...
6
votes
6answers
3k views
Securing an API for mobile access
I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
5
votes
4answers
317 views
What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled
as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages:
http://www.straightsectalk.com/?p=47
...
5
votes
3answers
419 views
Is it a security risk to embed a commenting service (like Disqus) into our site?
Can commenting services like Disqus, IntenseDebate, etc. pose a security risk for corporations?
Edit:
What risks could arise when embedding such services into corporate websites?
5
votes
4answers
1k views
HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
4
votes
4answers
503 views
Why would someone want to encrypt RSS feeds?
I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
4
votes
4answers
421 views
Ensuring a web-service only processes requests from specific computers
I'm in the process of designing a system that consists a client application and a single web-service. The client is distributed on several machines (installed by me or a colleague), and the ...
4
votes
3answers
247 views
February 7th 2013 Facebook integration error implications [duplicate]
What are the security, privacy, and overall availability implications of the Facebook event (link) yesterday? I was astonished to see site after site being redirected to a Facebook error page last ...
4
votes
1answer
1k views
Facebook page receiving improbable amount of likes from unknown users
A bit of an odd problem, but I'm not totally sure where to post this.
I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began ...
4
votes
2answers
81 views
How Secure are Authenticity Token in Rails
I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
4
votes
3answers
261 views
What are the risks of posting my email address to pwnedlist.com?
pwnedlist.com claims to have details of over 23 million accounts that have been hacked, and if you submit your email address they'll apparently tell you if you're in the database.
Are the people ...
4
votes
2answers
248 views
Webservices exploitation / axis/services/AdminService?Method=AdminService
I'm writing to get some stuff on hardening some web-services, but I'm looking also for some tool to test web-services.
I have a sandbox (can't post live URLs...)
I'm trying some stuff to try to ...
3
votes
3answers
249 views
web services: how prevent illegal accesses
As suggested by someone I post a question here (for the first time). I'm using web services from an Android application. I use https (I bought a SSL certificate).
I want to prevent unwanted accesses ...
3
votes
1answer
210 views
Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?
Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects.
I need to store (or use an existing) private key on a ...
3
votes
3answers
619 views
Paypal IPN, SSL and man-in-the-middle attacks
Okay, suppose I have been implementing paypal IPN, and my server will respond by verifying with "https://www.paypal.com/cgi-bin/webscr" and got the VERIFIED message back.
First, if my server connects ...
3
votes
1answer
220 views
What are the security risks when using free Content delivery networks (CDNs)?
I was doing some research on Content Delivery Networks. For those who don't know, a CDN is a large collection of servers that cache and quickly serve up static content such as images, css, js, etc, to ...
3
votes
3answers
100 views
Identifying and preventing execution of “any” function via Late-Bound commands
The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
3
votes
1answer
148 views
Payment security on Android App
I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs.
I know there are many payment services available. One of ...
3
votes
4answers
467 views
Is it okay for API secret to be stored in plain text or decrypt-able?
Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
3
votes
2answers
278 views
Securely expose WebService from Enterprise Network to Internet Client
(coming from stackoverflow)
Are there any standards (or certified solutions) to expose a (Web-)Service to the internet from a very security-sensitive network (e.g. Banking/Finance)?
I am not ...
3
votes
2answers
88 views
Securing Java web services called by web site in DMZ using web services for communication
Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
3
votes
3answers
183 views
Monitoring for security threats
I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
3
votes
5answers
588 views
How to secure a server backend
I am developing a server which serves two purposes: it is a CMS for people to use and maintain some data, and a Web Service for a mobile app to get this data. It runs on a Debian server running Tomcat ...
3
votes
2answers
750 views
How can I prevent reflected XSS in my JSON web services?
I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response.
This is open to XSS if the response is rendered as HTML by the browser since someone ...
3
votes
1answer
191 views
Is there a spreadsheet/template for Mapping WebServices Authorization Rules?
I'm looking for a spreadsheet/template that allows the business-rules (i.e. 'who has access to what') to be mapped, visualized and analyzed.
In the past I have created a couple of these (some even ...
2
votes
2answers
128 views
Would a large prime service be useful?
The target users would be portable/embedded devices or resource limited code (i.e. javascript). The idea being that the devices could poll the service for validated primes and use them for encryption ...
2
votes
1answer
1k views
How to implement an API-Key-Mechanism
first of all: I am quite unsure about the questions title, so if you have a better idea, please feel free to tell (:
I would like to know about best-practise examples where services (like Twitter or ...
2
votes
1answer
125 views
Are these merchant integration instructions wrong about server-client interaction?
I'm working with a payment gateway that seems to have a fundamental misunderstanding of "clients" and how to protect sensitive data.
The integration instructions are mostly about a "redirect" mode of ...
2
votes
1answer
106 views
Services Like McAfee Secure
What do monitoring services like Mcafee Secure actually provide? It's about $1000 per year and I'm trying to judge what they actually do, as their benefits and technology pages might as well be the ...
2
votes
1answer
67 views
How to Verify the Identity of the Caller of a Web Service
I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.
Now, my question is, how do I ...
2
votes
1answer
94 views
What attacks are most likely against SSL/TLS web service sessionid?
I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
2
votes
2answers
333 views
How do I find .asmx files?
I have a web service (ASP.NET) running on my application server. It can be reached via
http://xxxxxx/Servercomponents/servercomp.asmx
Is possible to find this even if you don't know the file name ...
2
votes
1answer
99 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
2
votes
1answer
66 views
Best practices for setting up client connections to a server with app credentials
The question title is... ugly to say the least. Here's an overview of what I've got:
I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back.
...
2
votes
2answers
130 views
Is there any way to differentiate between a normal web request and a web service request?
I have a security layer for providing the security of the requests that come to my server. For all web request that come in a login page is shown if cookie is not present. I am now introducing web ...
1
vote
3answers
171 views
Task Manager and Keyloggers
I know that some of the best keyloggers can't be viewed from the Task Manager.
Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden ...
1
vote
1answer
116 views
WebServices Security [closed]
Do we have any good resources on WebServices Security? Any book, pdfs, articles and even the detail answers regarding the securing web services would be appreciated.
1
vote
4answers
142 views
Tracking a user who has posted abusive messages
A visitor to our site has posted abusive messages and I wish to block them but I'm not sure there's much I can do besides blocking their IP address (and even that won't help much).
After analysing ...
1
vote
2answers
540 views
What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?
I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
1
vote
2answers
104 views
Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?
I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
1
vote
2answers
113 views
How do I holistically protect a web service from network and MITM attacks?
I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
1
vote
3answers
110 views
RSS Feeds: restrict access
"We are a bunch of journalists and we share much of the information via e-mails. This has become tedious now. Hence we found out a way to share, by just having to share our private blog posts via ...
1
vote
1answer
180 views
How does a developer interact with Microsoft Certificate *Web Services*
Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
1
vote
2answers
83 views
How do private feeds get transferred between two different portals?
I have some doubts about how the RSS private feeds, get transferred between one portal to another.
The whole point is to allow private RSS feeds to be consumed by external clients, and in 99% of ...
1
vote
1answer
98 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
1
vote
1answer
114 views
Does an exposed XMLRPC API in a web application pose a threat?
I'm given the assignment of testing one of our web-servers in regards to security. One of the servers run IIS 7 and its application relies extensively on XMLRPC calls. I found the API for those calls ...
