Hot answers tagged

46

file piece ("chunk") hashing is actually an essential, core feature of BitTorrent (the downloaded pieces are immediately and automatically verified), and a part of the BT protocol - the .torrent file contains the hashes needed for verification. So, unless the .torrent file is altered by an attacker (which is a very different issue), the integrity of the ...


41

Because HTTPS is not very well suited to securing downloads of large public files. For this use case, it's slow and not that useful. There are reasons for not using HTTPS well beyond incompetence or unawareness. HTTPS requires more resources on the server. Google mail got it down to a 1% overhead and a 2% bandwidth overhead, but this is for a very different ...


40

For Windows binaries, I would suggest to digitally sign the file. Where you use certificates, almost the same technology of HTTPS. Introduction to Code Signing SignTool Then you should use Windows cryptographic APIs to verify the signature of loaded DLLs. I know that to get this done, you need lot of work. But, for Windows, this is the safest path. If ...


35

The HTTPS protocol is equivalent to using HTTP over an SSL or TLS connection (over TCP). Thus, first a TCP connection (on port 443) is opened to the server. This is usually enough to reveal the server's host name (i.e. www.mysite.com in your case) to the attacker. The IP address is directly observed, and: you usually did an unencrypted DNS query before, ...


30

With the low level of protection the MAC address offers, I wouldn't bother. It is less effort to change the MAC address than it is to exchange your DLL.


25

BitTorrent uses a method called Chunking, in which files are divided into 64 KB – 2 MB pieces. Each piece is hashed and the hashes (along with the piece size) are stored in the torrent's metadata (the small .torrent file, or the metadata you receive via DHT). That, along with the info_hash, makes BitTorrent quite resistant to intentional tampering (poisoning)...


23

The simple answer is: because it wants to! The web server can serve whatever it likes, either by configuration or coincidence. Right now, I get the same 75916c7b file over both HTTP and HTTPS and cannot confirm your theory that the web server is serving different content for HTTPS versus HTTP. However, if you managed to access the site near the time the ...


22

Use Process Monitor with a filter to watch the hosts file. Run it long enough and you will see everything that changes the file. http://technet.microsoft.com/en-us/sysinternals/bb896645


20

Compilation is a mostly one-way operation, and it is not deterministic, at least not in a robust way. You could recompile the source code and see if it yields the same binary. However, the exact binary can vary depending on a lot of parameters, including the compilation options and the exact version of the used compiler. Moreover, some compilers embed some "...


19

As @Paŭlo Ebermann and @Jeff Ferland have told you, the GET request is encrypted under SSL and so is safe. However, don't forget that many web servers log GET requests and parameters, and any credentials or other sensitive information you send via GET could be written to a log somewhere. For that reason, you should use POST (which will also be encrypted ...


18

It's the same reason as why not all login prompts are using https yet: people are too lazy, think a certificate is too expensive, or have hosting that charges more for using https. The real question is why downloads are served over a plain connection more often than login forms. And I think this is mostly because of unawareness. Checksums are often provided,...


18

This is impossible. Anyone who has the integer APK file can decompile it and make a malicious clone that behaves in exactly the same way towards the server.


17

It depends on whether you are talking about the concepts, the terminology, or the acronym. Concepts of confidentiality, integrity and availability of information have been used by war generals for quite some time; for instance, one can see Julius Caesar operating along these lines during the Gallic Wars and he was certainly not the first to grasp the ...


16

An SSL certificate protects users of your site from having their communications intercepted by a 3rd party. I think it is likely that when you say your site was hacked, this isn't what you're talking about. An SSL certificate does not validate the content of your site, nor does it prevent anyone from accessing it as intended or otherwise. Controls for these ...


16

I think there's something to be said for setting a bar, regardless of how low it is. Can Tripwire be bypassed? Sure. Will it catch things that you wouldn't otherwise? Yes it will. The main problem I've seen in a Tripwire installation is tuning it to where it isn't false-positive laden to the point of ignoring it. If it blows up every time someone ...


16

Hashes do not change between file systems. Check the SHA1 hash of the file against the known "good" value in your code and you should be away!


15

You should assume that the URL is not protected, i.e., that a passive eavesdropper may be able to learn what URL you are visiting. I realize this contradicts what some other folks are claiming, so I'd better explain. It is true that everything after the domain name is sent encrypted. For instance, if the url is https://www.example.com/foo/bar.html, then ...


13

The scenario you describe is very similar to the concept of "remote attestation". There has been a lot of research on this and there are two major results: You need a trust anchor, such as the TPM or a trusted system service, to securely measure your app and report the results to the server. Otherwise you can always build a simulator that generates the ...


13

Author of above referenced files here. The checksum of said files at the current state of things is normal to change when the build scripts are modified and a new build automatically triggered and uploaded. In case of curl 7.46.0, the build scripts (and consequently the downloadable packages) changed three times as of this writing: HTTP/2 support was ...


13

Use Android SafetyNet. This is how Android Pay validates itself. The basic flow is: Your server generates a nonce that it sends to the client app. The app sends a verification request with the nonce via Google Play Services. SafetyNet verifies that the local device is unmodified and passed the CTS. A Google-signed response ("attestation") is returned to ...


11

That "charter" is rather down-to-earth; it does not specify that "TLS should provide confidentiality and integrity" because this is taken to be obvious; instead, the charter is a roadmap to the future TLS 1.3 and thus documents the desirable changes from TLS 1.2. As for the mailing-list messages you are pointing to, I think you are over-interpreting them. ...


9

The MD5 hash algorithm has been demonstrated to be weak to collision attacks. This means that an attacker can generate two files which will produce the same hash value. This has no bearing on file integrity checks. To create a file that matches a previously known hash, the algorithm has to be weak against second preimage attacks. While MD5 has some ...


9

The reality is if other processes can access your process memory or features of your virtual machine, the game is probably over as your already compromised. If a process has access at this level, it can probably gain other information, such as the initial credentials used to authenticate prior to obtaining the token or just modifying results to make token ...


8

Yes and no. The url is encrypted properly, so query parameters should never be revealed directly. However, traffic analysis can get the length of the URL often - and knowing the server and the length of the url is often enough to eavesdrop what pages are being accessed, especially if assuming that links on a page are clicked. Google for "traffic analysis ...


8

TLS stacks are starting to send Server Name Indication (SNI, http://en.wikipedia.org/wiki/Server_Name_Indication; http://www.ietf.org/rfc/rfc3546.txt). That is sent in the clear, meaning eavesdroppers can see the server name you type into the address bar.


8

The following things will leak before your session starts: IP Address of the server Certificate of the server That will include the domain name published on the certificate, though that doesn't guarantee it will match what you used. You DNS queries No data or requests that aren't related to creating the SSL connection (GET ...) are sent to the server ...


8

Tripwires are very useful for defending against userland rootkits. Kernelland rookits do not need to replace binaries to subvert the behavior of the system, usually these rootkits are just a Linux Kernel Module (LKM). In fact when you control the kernel like this any executable's behavior can be influenced without needing to modify the binary its self. (...


8

Since injection attacks exploit control sequences in the way the output is interpreted, and since different output formats use different control sequences (think JavaScript versus SQL versus HTML), your sanitization technique needs to reflect where the output is going. If you sanitize for output upon input, you're making an assumption about where that output ...


7

If you have no liability for what the users do with the laptop, then what is the benefit to you of monitoring the usage. In the absence of any legitimate benefit, that would leave anyone questioning your motives in doing so - so you would create liability by doing this. There are a lot of other security concerns you should be concerned about - primarily ...



Only top voted, non community-wiki answers of a minimum length are eligible