Tag Info

New answers tagged

1

No, it isn't secure. Signing a application does only provide traceability and unmodifiability - the created application can be traced back to the person who signed it, and the application cannot be modified without invalidating the signature. Anyone who has the Money and possibility to go through the process of getting a code signing certificate will get ...


0

let me give you a short answer to start a discussion, potentially with a bias, from someone works who works for a company selling RASP. I have seen that nobody has answered for a while. We understand RASP as something that becomes part of the binary of the app. Using code scanning you develop a secure app but in order to keep it secure you have to harden ...


2

SecureString doesn't protect you if you already have malware running with high privilege. It's not possible to do so, for SecureString or anything else. You can't protect your software from this kind of attack; if you can't trust your copy of mscorlib or anything else running in your process, you've already lost. What SecureString does is ensure that if a ...


0

Another aspect: would Zend base their enterprise targeted PHP stack that is more vulnerable than competition? It is not the language that to be blamed for insecurity. It is the design. Bad design can be implemented in every language. Security is not a state, it's a process. And the massive contributor base of PHP does a pretty good job.


1

The main issues are the default configuration and the low barrier of entry. The easiest way to deploy a PHP app is to install the inefficent horror called "Apache" with mod_php, throw the poorly-developed app into /var/www and watch the world burn. That will work, but is a security disaster. For example, a Node.js app runs as its own process, in its own ...


0

The use case you are describing is perfect for a White Listing application. In the past I have use Savant Protection and have had good success. Savant allows you to specify what applications are allowed to execute though either a configuration file or by "training" it. Savant will take all of the white listed applications, calculate their hash values and ...


0

If I include a Forgot Password service, then what's the point of using a password? Because if a user can log into their account with their known password they know that an attacker hasn't used a password reset link and changed their password. Password resets create noise. In logs on the target system (which can sometimes be viewed by the user), and in ...


1

Usually, the first step is finding and scanning that which port are open , second one(because here is not for learning hack just talk in general): using some application for finding which program are installed on that computer, then finding the exploits on those application and at the end run a specific script on that, such as buffer over-fellow and get ...


1

Let's suppose a >10mb file opened in notepad causes a buffer overflow and somehow the instruction pointer is set to a location inside that buffer. Somebody could create a maliciously crafted text file which contains shell code at that location inside the text file. You download the text from the internet, put it in notepad and then the malicious program ...


2

Whom should I save the pc from? If the desktop application is not listening on a port, it means if there is a potential vulnerability, it can only be exploited locally. The attacker might have exploited another vulnerability and now looking for privilege escalation or persistence. Don't always assume a vulnerable desktop application would result in ...



Top 50 recent answers are included