Tag Info

Hot answers tagged

208

IMPORTANT: this is based on data I got from your link, but the server might implement some protection. For example, once it has sent its "silver bullet" against a victim, it might answer with a faked "silver bullet" to the same request, so that anyone investigating is led astray. I have tried sending a fake parameter of cHVwcGFtZWxv to see whether it ...


27

This has to do with the concept of Certificate Transparency. The Problem Browsers currently trust certificates if four conditions are met: (a) the certificate is signed by a trusted CA, (b) the current time is within the valid period of the certificate and signing certs (between the notBefore and notAfter times), (c) neither the certificate nor any ...


26

There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a login popup for anyone visiting a page where your avatar appears. Lots of people will then attempt to log in with some username and password combination, probably ...


19

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with Google ...


14

After several hours trying to figure out how to do that in Google Chrome I've found it! You must add the following command line parameters in the shortcut: --cipher-suite-blacklist=0x0005,0x0004 The tricky part is that Google has not translated cipher strings so you must input each cipher in hex based on RFC 2246: 0x0004 = TLS_RSA_WITH_RC4_128_MD5 ...


14

This is a project by Google called Certificate Transparency that attempts to fix flaws with the SSL certificate system. It essentially has three main goals. (Lifted from http://www.certificate-transparency.org/what-is-ct) Make it impossible (or at least very difficult) for a CA to issue a SSL certificate for a domain without the certificate being visible ...


10

There are two vulnerabilities, each triggering a jump to address zero: The first, inside markContainingBlocksForLayout: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb09fdb70 (LWP 2039)] > 0x00000000 in ?? () (gdb) bt > #0 0x00000000 in ?? () #1 0x0194b82b in markContainingBlocksForLayout (this=0x2e29944, ...


9

Open source software is not necessarily better or more secure. Where open source has an advantage is the potential for independant security minded individuals to examine the source code and hopefully the conceptual model for a given software project. This advantage is contingent on: review by qualified individuals feedback from the reviewer to the ...


8

I install a plugin that allows me to click on any part of a page and it gives me the color of the clicked object For this to work, the plugin needs to register a click event handler and it needs to interact with the document object model of the current HTML page. HTML was originally designed to share scientific documents. And while we build complex web ...


8

The IMG tag will attempt to interpret the data as an image, so Javascript won't be executed. It will be possible to send an image that, once decoded, will require enormous amounts of memory ("PNG bomb"), and it is possible that the graphic routines themselves are vulnerable to malicious content (a carefully crafted image that, when decoded, triggers ...


7

Google Chrome has a Sync feature that synchronizes browsing history, configurations, bookmarks, etc. between Chrome browsers using the same Google Account. You've very likely used your Google/GMail account when starting Google Chrome the first time on both computers. You can change the sync settings on your home computer and disable the items you don't want ...


7

XSS prevention is not the responsibility of the browser, XSS holes arise because of flaws in a website, and it is up to the owners of websites to prevent such flaws. Some browsers have implemented attempts at mitigating XSS and CSRF holes in websites, but these are heuristics looking for typical patterns of attacks. They are in no way complete. There is ...


6

I'm pretty sure this is fairly benign. You can use the PSAPI functions to get the same details if you have sufficient privileges. I'm pretty sure this is the basis for the Task Manager built into Windows as well as the Process Explorer. Note that on Linux machines, you can generally see these details as well regardless of your permission set. Chrome is ...


6

As other answers have already covered, Blue coat (amonngst other security products) have the capability to intercept SSL sessions for users on the network, to inspect the traffic. What your company can and cannot do with this information depends on local laws and potentially the contract you signed when you joined the company. If you have sufficient ...


6

Safe Browsing API Google offers Safe Browsing, which uses URL lists as well as heuristics: Safe Browsing works in two ways to help protect you against phishing and malware. First, Google downloads a list of information to your browser about sites that may contain malicious software or engage in phishing. If the URL of the site you're on matches ...


6

BEAST attack Vulnerable INSECURE (more info) RC4 Yes PROBLEMATIC (more info) These warnings are not directly related to your certificate. They're more about your SSL configuration. When a client connects to your server over SSL, the client and server will negotiate which protocols they want to use to exchange keys and encrypt data. BEAST is a ...


6

There are two issues here which make me say no you can't trust them 100%. Now the reason being is that you haven't reviewed the code on one side. It might contain some malicious code which was slipped in by a rogue developer or intentionally by the organization. For standard organisations this is normally very uncommon, but there have been cases such as ...


6

Typically a site gets blocked because it either contains malicious code or, more often, links to another site that contains malicious code. Google has several sources for this information; stopbadware.org is their primary partner in this, and of course they get most of their direct knowledge through their GoogleBot indexing. Chrome has a built-in feature ...


5

I think the confusion here lies in that 1e100.net appears to be owned by MarkMonitor. Actually, MarkMonitor have registered (and "protect") this domain for Google. You can see here that Google own 1e100.net: What is 1e100.net? So Google Chrome is phoning home but to Google's servers.


5

Yes Yes Yes Updated, See the comment from George Bailey for this one. No - like you say the sandbox will prevent that. Read (and send) data on all the pages you visit. Some more details on why this is often needed, but not always is discussed in this question Why need Chrome plugins access to 'all my data' and 'browsing activity'?


5

Sounds like its an google's echo test for chrome. The whois (below) points back to Google, Inc. It seems that it is used to send back network connectivity stats to a google server for ~0.5% of users.. An echo in this context just means whether if you send a simple message to a remote computer if you hear back. (Similar to ping/ICMP message). EDIT: See ...


5

Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.


5

Yes, you are safe. Of course, the page you get served when you Right click > View Image could be malicious, but no script will be executed in the context of your website. Moreover, don't forget that the owner of the website of the image can track your visitors on all pages where the image is embedded.


5

JavaScript itself won't be executed, even if the remote server changes MIME Content-Type to text/javascript, because the browsers will aready expect certain MIME types within the IMG tag. That doesn't really mean they're safe to use, though. One thread I suggest you read is is it safe to allow external images to be attached to Blog or any Web content?. In ...


5

You can see the same effect on https://www.comodo.com/ They have an EV certificate signed by themselves. Firefox trusts it: but Chrome doesn't. Chrome works fine with Verisign: The problem here is likely that your browser doesn't trust your SSL certificate vendor. It's possible that you have messed up the configuration somewhere (chain ...


5

Google Chrome Version 28.0.1500.95 chrome.exe --cipher-suite-blacklist=0xc007,0xc011,0x0066,0xc00c,0xc002,0x0005,0x0004 0xc007 = ECDHE-ECDSA-RC4128-SHA 0xc011 = ECDHE-RSA-RC4128-SHA 0x0066 = DHE_DSS_WITH_RC4_128_SHA 0xc00c = ECDH_RSA_WITH_RC4_128_SHA 0xc002 = RSA-RC4128-SHA 0x0005 = RSA-RC4128-SHA 0x0004 = RSA-RC4128-MD5 Source list of cipher names ...


5

It is not a true sandbox. It is more a way to keep several "profiles" in a way similar to what Mozilla/Firefox have always done: basically, each such "user" will have his own set of cookies and browsing history, but, at the OS level, there is just one Chrome and one user account. The normal Chrome "sandboxing" is active in the following sense: code within ...


5

Firefox's Sync is a locally AES-256-CBC encrypted database of your stuff (which can include passwords), stored on Mozilla's servers. The key does not leave your browser. But it can be found in every browser you Sync with. The Sync key is stored locally in your passwords. If you don't have a Firefox Master Password, it's not encrypted on your machine. If ...


4

Google Chrome has been "hacked", here is a POC of an exploit that manage to pass the sandbox- VUPEN_Pwning_Chrome btw - the exploit is private, and as far as we know the lastest version of chrome is still vulnerable to this code execution method.



Only top voted, non community-wiki answers of a minimum length are eligible