Hot answers tagged

26

but the implication in the other question is that videos in question have been downloaded and played by media software on the target computer. No it is not. The implication is that there need to be a bug in the code handling the data. For instance the ffmpeg library is used in browsers like Chrome or Firefox and it had several serious bugs in the ...


11

A web browsers video system is just another video player, so the same problems apply which were mentioned in the linked question. The smaller set of supported video codecs greatly reduces the attack surface, but doesn't make bugs in the decoders for these formats inconceivable. The Adobe Flash plugin is renowned for its plethora of security bugs in the past ...


6

The reason you see that message is Article 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC, according to which users have to give consent for the storing of information (read cookies) or retrieval of information already stored. Some cookies are exempt from this rule, namely when the cookie is needed for carrying your data over the ...


6

From their product page, we can infer a lot about how their system works. Here are the key points: Can be used with Windows XP and Windows 7 Comes with: VirtualBox 4.0.16, hardened Linux Debian 6 and SELinux and Firefox Browser execution takes place in separated virtual machine with own operating system Downloaded files are first scanned and ...


5

I doubt that this has anything to do with google. According to your description google maps was only your starting point and from there you've opened the different websites for the various business. Some of these sites might be either infected or they contained ads and through these direct infections or the malvertising you got served some Scareware which ...


4

You're really asking the wrong question here Really what you should be asking is: Should I be worried that I can use tools to look at passwords stored in my Chrome browser? And the answer to that is... Kind of. Really the best way to prevent that from happening is to keep your systems hardened. If someone gets access to that data, you've already lost ...


3

The reason this limitation is enforced, is that the SOP policy does not apply to window.close(), instead, you can actually close any window. It would be impossible to apply the SOP policy to window.close() as normally, each window in a browser process is isolated from each other to prevent certain cross-boundary attacks, thus even your "own windows" would be ...


3

In short: the intermediate certificates have to be sent within the TLS handshake (needs proper configuration of the server) and only the CA local at the client will be considered as trust anchors. In detail: ... see that it does not have the issuing ca (intermediate ca's public key), will it automatically download those intermediate cert (e.g. ...


3

Wouldn't that require Browser Providers to implement a massive backdoor in browsers? (or ISPS?) There is no need to implement anything in the browser to block internet access. This can be fully implemented at the ISP level, similar to how capture portals at public hotspots deny access until the user provided some sort of login, payment or acknowledgment ...


3

There is always a trade off between the level of security and the amount of time and effort that you're willing to put into a project. For a personal blog I would reccomend you keep these things in mind. Always update your CMS. No matter if you choose wordpress, drupal, django, or something else make sure that you always check for security updates. The ...


3

Yes, it can be a security vulnerability. To exploit it, consider the following scenario. The attacker somehow convinces the user to visit a website under attackers control. A DLL is automatically downloaded to the Downloads folder. The user downloads a legit installer/setup/whatever to the Downloads folder. It is possible that this software is vulnerable ...


2

If you have your system set up so that only connections to your bank (eg. www.bank.com and www.bankcompany.net IPs) were possible, a redirect to a third site wouldn't load. The exploiit would need to be hosted on the same site as your bank (which is admittedly rare). As with many security solutions, it's possible that some bank update makes the website not ...


2

First, you should read through the most famous question on this site: How does SSL/TLS work?, having a good understanding of TLS will clear up a lot of your questions. Answering your questions: a) When a browser visit my site ... will prompt the end-user (using the browser) whether he/she wanted to install those certs? No, visiting a site in a ...


1

Hi I am a working student at Sirrix AG and responsible for the QA of BitBox. You are actually surfing more secure, considering that if you infect BitBox with malware from the web, your host system will not be effected. The Microphone is also disabled by default, so it cannot be activated by malware to spy on you. Also all interactions between Host and ...


1

This could give rise to an information leakage vulnerability. Say your whole site is served over HTTPS, without DNS prefetching disabled. There may be certain pages on your site that reference other external resources. For example, imagine a banking website that customers can login to, and that the page for managing mortgages has some external links unique ...


1

I' not sure if this can be really called a vulnerability ... However, this behaviour could be possilby be unwanted. I would imagine a possible exploit like this: User is on a website Make the user click on a button on the left bottom on the screen (fix the position of the button so that it never changes its position on the screen) As soon as the user has ...


1

Would BD Safepay avoid this problem with its enforced virtual keyboard ? Not completely: It would mean that actual keyloggers would no longer be able to intercept your keystrokes. In fact, this is why some banks require you to enter your password by clicking on-screen buttons. However, keyloggers have adapted, and some have also become "mouseloggers", ...


1

If you have saved your passwords in the browser's password store, then they can be read from the browser's password store, and there's no way around that. The reason that Nir's tools works is that the browser makers have not given proper consideration to secure storage, and you can't fix that yourself. Your alternative is to switch to a real password ...


1

Do they just appear to be more secure, or are they really? While this is always changing with Firefox's continual drive to improve their security, many of their add-on's appear more secure than they are. Mainly due to what problems haven't been discovered yet. Note the popular NoScript issues outlined in the following security article here. And other ...


1

All browser exploits do not necessarily use Javascript to reach their needs. A browser plugin can be used to escape a browser sandbox for example. This means that a malicious person could create a website, knowing that his victim uses vulnerable plugin X (that parses the text of each visited page), and display text on his website that, once parsed by the ...



Only top voted, non community-wiki answers of a minimum length are eligible