Tag Info

New answers tagged

1

This is a great question! Never thought about this until you asked. Firstly, code running inside a secure enclave runs in ring 3. So all restrictions that apply to untrusted non enclave ring 3 code apply. So an enclave cannot write to MSR's. Next, the specs don't explicitly mention anything about MSR's but it does tell you about interaction with IA32 ...


0

Authenticate using SMS is pretty typical in mobile apps.


3

Most security folks are rather cynical about certifications. We get sold a LOT of certs, and we also validate that many of cert holding folks of the world aren't paying very close attention. (CCNA, you know default creds are bad!) My advice: Only get certs your employer pays for If compliance is a concern, go that route first Try not to go vendor ...


5

Your question is well written, and you clearly understand the issues well. There is nothing fundamentally wrong with the crypto token approach you describe. Some things to be aware of: Most sites these days are database intensive, so storing a password reset token is little additional overhead. You should throttle the number of password reset emails that ...


1

Consider FIDO as a standard that's being backed by a lot of large organizations, and has already seen deployments.


1

Consider SQRL. It's a quite new, free, token based authentication system, using a client application. To authenticate, the client signs a cryptographic challenge with a per-domain private key. Thus it offers per-domain pseudonymity. From Wikipedia: SQRL or Secure, Quick, Reliable Login (pronounced "squirrel") is a draft open standard for secure ...


2

Since everything from the CLR to 3rd party libraries will be distributed via NuGet in ASP.NET vNext, the NuGet team has committed to supporting signed packages by, I believe, the time Visual Studio 2015 is released. See the blog announcement: http://blog.nuget.org/20150203/package-signing.html Also, see the signing spec: ...


0

Generate a string which incorporates upper case, lower case, numeric and special characters of a minimum length of 12 characters and a maximum length of 25 characters, with random truncation within the parameters described. Additionally, the string's algorithm would ideally contain a randomized pattern such that the algorithm used comes from a set of ...


7

One of the articles you link to -- If the NSA has been hacking everything, how has nobody seen them coming? -- makes an assumption in posing the question: "If the NSA was owning everything in sight (and by all accounts they have) then how is it that nobody ever spotted them?" The premise for this question is incorrect, because for all we have found out ...


0

As far as I got your question, you need to know if your code is secure to sql injection or not. For that you need to use tools like sqlmap or havij or you can try vulnerability assessment tools like Acunetix,OWASP ZAP or burp-suite, so with them you can inject check if your database is vulnerable to this attack. Read more about secure coding on OWASP and ...


8

Actually, you cannot. Even without speaking of an actual compromise, from a security perspective you may assume that your application already contains bugs which can be at least be as effective than a software compromise. That's why, when building a secure system, your security must not rely on a single tool. Instead, you must use a layered security ...


0

Not sure if this covers exactly what you ask for, but here is something at least. Using a vulerability discovery tool like Nikto, Nessus, Nexpose, MSF or others to scan for injections will probably discover some injectable pages, but it's likely it won't be able to detect security issues as well. Using tools + manuel testing seem to be the best option for ...


1

Not sure I understand the question completely, but I'll try to answer. How to check for sql injection attack The de-facto standard tool is sqlmap. It is a very powerful tool and is thoroughly documented. which IDE or tool we used? bcoz netbeans and other type of IDE are more secured? NetBeans (or any other IDE) has absolutely nothing to do with ...


2

In my department, I am involved in mobile device security, and have looked into a product that does just what you're looking for. The product that I am familiar with is FireEye Mobile Threat Prevention. https://www.fireeye.com/products/mobile-threat-protection-mobile-security-products.html I have experienced some of the capabilities of this threat ...


5

I am posting another answer, because the two answers here, although both correct, miss an important point of the question in my oppinion. The question is about the information leak concerning memory layout. The presented memcpy might always have a correctly sized output buffer, so even if the attacker controls the size, there might be no risk of stack ...


0

TL:DR Same Origin Policy mainly prevents retrieval of information, not sending. Same Origin Policy stops malicious.com from using cookies for bank.com to retrieve sensitive information from bank.com. The key thing to note is that the Same Origin Policy tries to prevent a script from malicious.com from every seeing any data from bank.com. Once a script from ...



Top 50 recent answers are included