Tag Info

Hot answers tagged

44

Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program. There is a discussion of a similar looking pop-up here , which seems to tie into what you're seeing, and also a thread here on the BT site which has a link to a process to turn off that setting. To test this theory you could log into ...


21

You are trying to fulfill something impossible. If it is that easy, web malware would be dead few decades ago. If you want to use mathematical tools to track malicious JavaScript code, you need first to know which features are employed by JS malware. Once you understood these features, you may guess that it will be impossible to factor anything meaningful ...


13

Wikipedia and big popular sites are mostly safe, as any security holes are found quickly, usually long before the site gets its momentum. Smaller blogs/forums which allow user content are more vulnerable. I used to visit a Russian tech blog several years ago, and the posting form allowed some HTML formatting. Someone managed to include JavaScript code from ...


5

To keep you up-to date, you can read about the freshly MFSA2015-78 where Firefox sandboxing mechanism is bypassed by violating the same origin policy. The problem fixed by Mozilla Firefox on the 6th of August 2015. This vulnerability allows attackers to bypass the same-origin policy and execute malicious JS code remotely that will be interpreted in the ...


5

So, how can I (the user) feed (spoof) the VPN IP address (which I have in a text file) to any JS that might run so that it all looks the same to the web server? The detection of local IP addresses you refer to depends on WebRTC. There is no way to spoof the addresses returned during the WebRTC discovery without changing either the browser code or ...


4

There are a number of local processes that will watch files and directories for any changes, writes, deletions, and accesses. When these events occur, the process creates an event log through syslog. This can happen in a second. If the syslog entries are sent to a remote server (as they should be) you will have nearly instant alerting to file changes, ...


3

Question 1:- assuming the polling interval is acceptable, is this a strong enough defense? Could the malicious code fool the polling code? No, its not a strong enough defense. Yes, the malicious code can identify the polling server/service by its IP, User Agent etc. and serve the clean file to your polling agent while continue to serve malicious files ...


2

This sounds fine, and seems like a good solution to protect the session cookie against XSS attacks by duplicating the value of username into a non-http only cookie. All your authorisation checks should be being made server-side anyway. So if your client wants to do something server-side, it sends the request and then the server makes the authorisation ...


2

As of 2015 this is how you prevent your website from sending the Referer header: Just add this to the head section of the web page: <meta name="referrer" content="no-referrer" /> This works both for links and for Ajax requests made by JavaScript code on the page. Other valid meta options include: <meta name="referrer" content="unsafe-url" ...


2

A mature wiki software like Wikimedia usually does not allow normal users to embed any scripts in wiki articles. But still, wikis are prime targets for search engine spammers. The structure of wikis is very search-engine friendly which means that wikis often get quite a lot of page rank which in turn exends to any websites linked from them. Also, anything ...


2

I've never before seen anything like this. Is this the only case or has this been known to happen? The scenario you experienced could be innocuous as highlighted in @RоryMcCune' answer as well as it can be a nefarious attempt/attack. Let me explain this last scenario. There is one interesting scenario about your question: as @RоryMcCune said, what ...


1

I don't see a risk for most of the cases. The JavaScript will return the address of the machine, which is useless if it is communicating behind something like proxy, router, Wifi AP or NAT.


1

Though this being an old question, I'm adding an answer for future viewers. "Cross-Frame Scripting" is basically data leakage that can happen when an attacker embeds a victim's website into a frame within their own website and monitor/spy on the activities does on the framed website. An attacker can register a JavaScript listener which listens to all key ...


1

Your attempt to recognize malicious JavaScript will certainly fail at character level. I doubt there is any difference in the first place, and even if there was, the author could easily obfuscate their code and get a mostly uniform distribution for the code's characters. I believe a more fructuous approach would be to detect combinations of particular ...


1

I found this page, but here the the fingerprint is only retrieved after a request has already been made. You need to do some kind of request to get information about the peer, because somehow it needs to collect these information. But of course you can do a dummy request (pre-flight) not containing any sensitive data. But note that a normal application ...


1

JavaScript itself is not dangerous, the complexity of modern browsers and consequentially the bugs introduce are. But of course JavaScript is one common way to exploit these bugs. Limiting the usage and/or execution of scripts increases the security, there are different ways to do that. Browser configuration allows you to completely deactivate scripts or ...



Only top voted, non community-wiki answers of a minimum length are eligible