New answers tagged

0

Given that PDF uses postscript for its page layout while web pages use HTML and CSS, it would be exceedingly difficult to write javascript which would perform any useful function in both media. That is not to say that it might be possible to write javascript targeting the PDF conversion and deliver it via a web page, however it is good reason to exclude the ...


0

As I'm aware Google Chrome just provides "security" when you download a file. So answering your question, unless you actually download the file I don't think that Google will check for virus in that specific file. But Google does offer security in a way that prevents scripts that can send information to the server, so it may just do that.


1

I' not sure if this can be really called a vulnerability ... However, this behaviour could be possilby be unwanted. I would imagine a possible exploit like this: User is on a website Make the user click on a button on the left bottom on the screen (fix the position of the button so that it never changes its position on the screen) As soon as the user has ...


3

Yes, it can be a security vulnerability. To exploit it, consider the following scenario. The attacker somehow convinces the user to visit a website under attackers control. A DLL is automatically downloaded to the Downloads folder. The user downloads a legit installer/setup/whatever to the Downloads folder. It is possible that this software is vulnerable ...


0

This is not a security issue in Chrome. This is more of a mistake a user can make. In order for your "attack" to work you need the following steps: 1. Get a user to place your game 2. Download a file with out the user noticing 3. Get him to click close enough to the bottom download bar 4. Assume he made a mistake and clicked the downloaded file The likely ...


1

Ok so I eventually fixed the problem. I had to delete files under c:\Windows\System32\GroupPolicyUsers Checked all the files contained in GroupPolicyUsers and then deleted those that related to chrome and that was messing with my Registry. Restarted chrome and now all is fixed!


-1

The Chrome XSS Auditor can be bypassed using the following scripts: 1) http://vulnerable_site?pageTitle=<a href="data:text/html,your xss payload">xss 2) http://vulnerable_site?pageTitle=<a href="data:text/html;base64,base 64 encoded format of your xss payload">xss


6

Click on the 🔒 lock icon in the location bar Click on the “Details” link next to “Your connection to this site is private.” This opens the Security tab of the Developer Tools. Reload the page. The Security thing’s left column goes “🔒 Overview”, “Main Origin”… Click on the next one, “⚫ https://security.stackexchange.com”. Connection ...


0

Traditionally the web administration service for most routers is bound to the LAN facing interface with at least basic HTTP auth. So the is strange for Motorola. So they must have either too small a memory footprint so they went with a HTTP server that does not do auth or they went with a language that has a HTTP web server module without HTTP auth built in ...


2

functions such as reboot and factory reset ... why would a modern browser allow internal resources to be loaded from an external page Most of today's routers and other networked devices will be administrated through a web interface. This means that there is some web server with a web application running on the device and the user is using the browser to ...


2

What steps should I take next to protect myself in case? If you're really concerned that someone might be using your google account on a different Chrome (which would result in Chrome syncing their autofills to your Chrome), make sure you have 2-Factor Authentication enabled for your Google account. You can also set a "Sync Pass-phrase" for your Chrome ...


1

We can't give a definitive answer from the info you've given. That said, I wouldn't worry. Most identity theft attacks wouldn't type things into your Chrome browser. Once an attacker can type things into your browser, there are better attacks (eg: stealing financial info) than identity theft that they can perform. Most likely, this is a problem with auto ...


4

You're really asking the wrong question here Really what you should be asking is: Should I be worried that I can use tools to look at passwords stored in my Chrome browser? And the answer to that is... Kind of. Really the best way to prevent that from happening is to keep your systems hardened. If someone gets access to that data, you've already lost ...


1

If you have saved your passwords in the browser's password store, then they can be read from the browser's password store, and there's no way around that. The reason that Nir's tools works is that the browser makers have not given proper consideration to secure storage, and you can't fix that yourself. Your alternative is to switch to a real password ...


2

The short answer is: if your Firefox is compromised, it can do whatever it wants. It can modify whatever files it wants. It can even keylog and get root. But there are a few ways you can improve your security, like using a more secure browser, AppArmor or the NoScript plugin. The long answer is... Yes, if your Firefox process is compromised, it can do ...


1

Do they just appear to be more secure, or are they really? While this is always changing with Firefox's continual drive to improve their security, many of their add-on's appear more secure than they are. Mainly due to what problems haven't been discovered yet. Note the popular NoScript issues outlined in the following security article here. And other ...


0

I figured it out. To do this, you need to download the latest version of Wireshark source code. I ran my test on Wireshark 2.0.1 You need to make changes to the file - /epan/dissectors/packet-ssl-utils.c in the Wireshark source folder. Print the variables to a file from line 3179 - 3194. You can find the Client write key, Server write key, Client MAC ...


0

First of all, as @Steffen Ullrich suggests, a redirect is not automatically malicious, even if it is definitely possible. In particular, I analyzed the URLs you quoted with VirusTotal, and they don't seem to be malicious. It is not clear why the second URL includes parameters related to your IP address, ISP, browser version, etc. , but keep in mind that ...


0

Existence if such redirects by itself does not mean malware in all cases, but it can be. Very often you will find such redirects when ads gets served because ad-delivery is today usually a multi-step process with several parties involved. This is especially true with targeted ads and real-time ad-bidding networks. In such delivery chains each of the party ...


1

The six keys are derived from the master secret, the client random and the server random. You can get the master secret and the client random from the SSLKEYLOGFILE. I suppose you can sniff the server random with Wireshark from the server key exchange message. If you have those, you can call some library function or script on them to get the six keys. The ...



Top 50 recent answers are included