Tag Info

New answers tagged

3

There are a few possible scenarios, even after assuming Man in the Middle is not happening. Missing patches: If your system is missing a patch that allows RCE, that is an easy win. There are plenty of remote exploits that exist, and new ones every so often. Mitigation: Patch your system! Are you on a domain? You didn't mention Windows 7 Home or ...


1

Security is a process, where new software bugs are discovered from time to time. Sometimes by good people, and sometimes by bad people. Software bugs can be discovered in both user software, like Excel, but also in OS network stack. Windows 7 is based on rather well tested code, in which hundreds of remote vulnerabilities were found and patched during last ...


1

Scan the infected machine using a virus scanner on a bootable dvd/usb stick (http://www.google.com/search?q=live+image+virus+scan) download and burn it via a not infected device. If the virus scan does not allow you to repair the MBR you can use the procedure outlined in https://support.microsoft.com/en-us/kb/927392/en-us for Windows 7 and Vista, probably ...


1

What browser does he use? I've had users that have experienced similar issues, and one of the first places I check is the extensions running on all installed browsers. You can find pretty good clues as to the name of the program you need to remove in order to stop the pop-ups. Check his installed programs for anything that might be out of place too. If my ...


2

The way you convert a jpg to a bmp would be to essentially decompress the jpg and write it as a bmp. To convert one archive format to another you'd have to decompress the original first and then compress in the new format. Whether this is "safer" or not depends on whether the tool you're using to automatically decompress has different vulnerabilities to the ...


3

Being able to convert an archive from one format to another without decompressing it is very rare. Different formats use different file structures and algorithms that are incompatible and you'll be forced to decompress the source format at some point. When conversion by decompression is done, many of the vulnerabilities could be exploitable. The attack ...


1

1) Yes, it is possible to breach Google Chrome. Even with the encryption, there would be somewhere password or private key. 2) It is not secure as not using autofill, however, you do not type in the autofill your CVV code, which is needed for a successful operation with the card. You can find more about CVV here: https://www.cvvnumber.com/


2

Is it possible for breaching google chrome and take my credit card information? Yes. As long as Chrome can use your number for auto completion, it has to be possible for Chrome to access it. If one program on your computer can do this, another program or a least humans can do it too. it's not stored with any type of encryption Even with ...


0

I use a tool from a vendor that does exactly this. It's basically a set of regex applied the the text of the domain name to permutate over variations. Can it be fooled? Of course. If you only use string manipulation, then one can figure out the manipulation patterns and devise domain names that meet the attack criteria. The trouble for the phishers here ...


0

If you're worried about giving your source code to a third party, then don't. Bring the third party on-site to perform the code review and don't permit them to take the source code away with them. This also means they can sit with a developer and have responses to any questions they have quite quickly. The developer will also have the opportunity to learn ...


2

If you're contracting with a company to pen test and audit your app, you will be wise to scope out exactly what is in the limits of said test, what will be tested and how (it appears you are giving them source to be able to white-box test as well). They will likely work with you to establish the legal agreements that indemnifies them. It should also spell ...


0

I'm not sure the answer to your actual question - for example whether it is possible for a tool to distinguish between www.google.com and www.gooogle.com and alert the user of a phishing attempt. The best protection would be a browser based password manager. This will only offer login credentials for matching sites. So if the user goes to www.google.com ...


0

As mentioned by curious_cat in the comments, https connections should help as the identity of the website is then validated. There are several client side tools that attempt to identify the content of the website by using a browser plugin: Phishtank, Web of Trust, Avast! Popular web browsers also come with some sort of mechanism to try to identify phishing ...


2

A common phishing website looks extremely similar to the website it is trying to impersonate, but is still a different website. One could develop a tool which examines any websites the user visits and alerts them when they look exactly identical to one of the websites is set $S$. Unfortunately there is a problem with this: A phishing website only needs to ...


0

I hope i understood your question. As for the first part, Normally, as the attacker will be on a different origin than your server, so the browser wont allow it to read the response thereby preventing it from 'parsing the response' and sending the token in a subsequent request. But you have explicitly allowed all origins which renders this protection ...



Top 50 recent answers are included