Tag Info

New answers tagged

8

The first example is a normal SSL certificate meaning that it's a valid certificate issued by a trusted Certificate Authority, but there was no extended validation of the owner of the domain/site. This could mean that the certificate claims to be from Foo Inc. but the CA did not check that the person/entity applying for the certificate was indeed Foo Inc. ...


2

The difference is that the lower bar indicates an Extended Validation certificate, and the upper bar doesn't. See the support page.


1

No, this is definitely a scanner trying various URLs on the server to see which URL it can find. For example, if it finds "/phpmyadmin/scripts/setup.php" it knows you have phpmyadmin installed, and where it's installed. The attacker can then find the version, and run a known exploit to get access. As for how they found it, it could be several ways: ...


8

You can get a free class-1 certificate from https://startssl.com (I have no affiliation with them other than using them for my free SSL certificates). It's not the most user friendly experience, but it gets the job done for free -- note the free certificate will only last a year (and doesn't offer features like wildcard certificates for free). There are ...


0

Perhaps, but if there is a script performing attacks with the session cookie immediately after it is intercepted the damage will already be done. If a person is interacting with the session data they may not be able to act fast enough. Really, this means that you would be mitigating untargeted or unsophisticated attacks.


1

In Firefox, the HSTS set is shared between normal and private browsing mode, according to https://bugzilla.mozilla.org/show_bug.cgi?id=930638. Internet Explorer (11) does not support HSTS. In Chromium and Opera, the HSTS set is unique for each browsing profile (normal and incognito). This can easily be verified by visiting chrome://net-internals/#hsts: ...


2

using Fiddler and visiting a site with HSTS enabled honor HSTS in incognito if set previously in non-incognito (ie, immediately tunnel to HTTPS, do not request HTTP url) Chrome : YES Firefox : YES IE 11 : doesn't seem to honor HSTS honor HSTS in incognito if previously visited site in incognito only (ie, immediately tunnel to HTTPS, do not request HTTP ...


2

User-agent strings do provide the companies running web servers with useful information. If they're contemplating introducing web site features or content they want to know if the majority of their user base have browsers that support that technology. They can look at the user-agent strings logged in the past month or two and get a sense of what browsers ...


1

Since all the requests fail with the "404 Not Found" status, try to create a custom 404 error page that will log everything (all headers, the request, the user's session) and debug this, see if the actual requests come from just a few users with a busted web browser (virus, trojan etc. on the client machine), from all the users, just from users that are ...


0

makes me remember this: char shellcode[] = "\xeb\x2a\x5e\x89\x76\x08\xc6\x46\x07\x00\xc7\x46\x0c\x00\x00\x00" "\x00\xb8\x0b\x00\x00\x00\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80" "\xb8\x01\x00\x00\x00\xbb\x00\x00\x00\x00\xcd\x80\xe8\xd1\xff\xff" "\xff\x2f\x62\x69\x6e\x2f\x73\x68\x00\x89\xec\x5d\xc3"; void main() { int *ret; ret = (int *)&ret + 2; ...


2

Whether traditional "protections" for sensitive data in desktop RAM (e.g. SecureString) are really needed or not, is debatable. When attackers can read the RAM contents, they already have a lot of control on the machine. We can still justify some proactive measures in the following sense: RAM in a machine may leak to disk, through virtual memory. The ...


5

Yeah, if you are describing it accurately this is completely broken, to the point of useless. The initial AES key is compromised by being in the app, anyone with the app has access to the AES key. If this is global, then it is well and truly screwed, if it is unique to each application, there may be a small sliver of hope. The SHA-1 is completely ...


1

You seem to have the basic user data covered, but I'm not sure why try to isolate it like that. I would run each user's browser instances with an in-memory home directory/storage area. Then when the process terminates, all of the data is destroyed, no risk of leaving anything behind. Headless Webkit like PhantomJS provide flags specifically to move these ...


4

Well, the AES key embedded in the library is completely useless, and there seems to be no validation of the server side. I see many problems with this scheme. Anyone with access to the Android library can extract the AES key. Sending a hash of a static value over plain HTTP is the same as sending a password over plain HTTP. Anyone can grab it from ...



Top 50 recent answers are included