Tag Info

New answers tagged

0

You could/should reverse the situation, with Xubuntu as host, XP as client. I use Ubuntu as desktop, but sometimes need XP for Photoshop. Then I start up virtualbox, and use XP with the LAN connection disabled. This way, XP cannot connect to the internet, and you can still use it for those apps that only run under Windows. You could do the same with 7, but ...


0

XP is dead now.. So this is what I recommend: Never go online with XP and don't plug anything new/untrusted into that box again. Don't trust ANY software to help XP go online. Just during 1 session with XP online, it could infect your router, your memory, boot manager, bios and rip any passes you enter. It doesn't matter if you reboot with a fresh copy (VM ...


0

Php can determine what is browsers is running and other system detail by running a bit of code. Try to identify the MAC address of each computer by php, so only known computers can gain access.


0

There's a very interesting use case in this other answer, using client-side certificates: Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away? Another quick-and-dirty option might be implementing a VPN and shifting the domain of the problem from PHP to system administration. This might prove useful if, in the ...


0

thats long story, can't comment so leave as link here Using SSL Client Certificates with PHP also you may take look at apache SSLRequire Directive may a bit sorter story also PHP OpenSSL module php.net/openssl plenty of stuff around that question


0

You could setup SSL and create your own certificate. I believe there is an option to create something like client approved certificates. That means that you need to install the client part of the certificate on the client (the browser). If the client doesn't have this installed, it won't work. To be honest - this is something that I read about last week, ...


0

Limiting access for the web browser (user-agent) is something that is very easy to manipulate using a tool like Tamper data. You can change the header to make it look like the request is coming from any browser you want. If you want to make sure they can only access the website from the office (if this is one location) you could restrict access based on IP ...


0

If you are using PHP web application, you can use this function to check client browser.


0

On the server, it's easy to check the headers of each HTTP request (the User-Agent header, in your case) and redirect to a landing page that explains why the browser can't be used, and which browsers are supported. You'll need to install a form of authentication to validate requests originating from unauthorized clients. Installing an X.509 certificate on ...


1

this approach is already found in various frameworks and works (more or less) against basic attack-patterns. another, more elegant way is to use CSP, but you have some requirements when using this approach (no inline js/styles etc) the problem is, from defender-pov, an attacker might have other points), nasty stuff like encoding, nullbytes and different ...


38

You shouldn't really be worrying about this, the certificate contains only your public key, which is supposed to be public anyway. The only issue is the privacy concern of giving away the information in your certificate to any site that asks for it. Summary of the issue: The BBC weather page has a request to http://www.live.bbc.co.uk. HTTPS Everywhere is ...


0

Can you explain exactly how the other browsers fall back? I've seen the following scenarios with servers and middleboxes: try to connect with TLS 1.0 or higher, peer responds with SSLv3 and thus the connection continues with SSLv3. This usually succeeds. try to connect with TLS 1.0 or higher, peer closes connection and browser tries again with lower TLS ...


0

There's at least one proxy service (trendmicro) that sends occasional duplicates of GET requests as some sort of probe for malware. You shouldn't be alarmed, and your GET requests ought to be idempotent anyway.


3

Yes it can, for example using : Ajax A reference to an external JS or css file An iframe or even a HTTP 302 redirect. This can be used by online malware to generate trafic for a DDoS Attack. Note, all those are used for legitimate purpose on many (most) websites, and hence do not imply a malicious behavior. In response to your edit: Yes, Ajax can do ...


0

There is one risk that hasn't been mentioned here yet: when you're having both Tor Browser and a different browser open, you may accidentally confuse them and either enter identifying information in Tor Browser or perform activities which you wanted not to have tracked back to you in the other browser. There is no great technical risk, but you'll have to ...


0

It can affect any application web or otherwise which is complied with one of the vulnerable versions of openssl.. wget Linux command for example is vulnerable to client side exploits.


1

Good Question. TACK is a "dynamic pinning" solution to the broken Certificate Authority model we all depend on today. A competitor is Google's Certificate Transparency (CT). Status of TACK is No browsers currently support it. There are no browser extensions to enable it. The last posting from the developers (January, 2014) is that it is entirely up ...


2

The advice is usually in the context of avoiding phishing links: Don't click on links in emails! Bookmark your banking websites and always use the bookmark! I think using browsing history as a similar safeguard is probably fine also (within the parameters you described), as long as you've never clicked on a malicious link in the past. However, it's ...


1

This is a moving target, as there is a cat-and-mouse game as attackers discover new techniques and browsers implement new defences. In general, JavaScript: can access config information about your browser and plugins. The site you linked seems to be a good summary of the current techniques. cannot access your local files, at least, unless you explicitly ...


1

The theory, as exposed in the standard is that: server_version This field will contain the lower of that suggested by the client in the client hello and the highest supported by the server. In the ClientHello message, the client announces a single version, and this means "I support all versions up to that version". For instance, if the client says ...


2

I think I know what's happening with you. Actually, that's exactly what I do with the image in my "about me" section in my StackExchange profiles. It's a .php file that grabs some information about the visitor (IP address, browser type, whether the visitor made the smiley happy or not, etc.*). I simply rewrote the URL to show two different images that are in ...


-1

if someone is able to change the htaccess - entries on your server you're probably hacked. the png might contain malicious code; can you paste the output of $ string strangefile.png when executed on the server? might be interesting What's the worst they can do with .htaccess masking? Any way to prevent it? they have access to your server, it is ...


2

Although running Google chrome on top of Windows XP seems secure but the reason it isn't is that exploiting vulnerabilities on Windows XP is easy (many orders of magnitude) compared to Windows 7. Windows XP is lacking common memory corruption protections such as DEP and ASLR. This means that a vulnerability that might be just a denial of service for the ...


3

It's a risk. XP has had enough holes over the years that it's hard to imagine there aren't some un-found holes in what remains. I'd recommend getting off XP if possible. If not, at least keep your ear to the ground. If a researcher finds more vulnerabilities that Microsoft is now unwilling to fix, you can bet they're going to hit the tech news media. ...


0

The "HOST" header is part of the http protocol, vulnerable applications are vulnerable because they insert the value of this header into the application code without proper validation, this means not only applications hosted on Apache/Nginx can be vulnerable. In short, the answer is yes, your application could be vulnerable no matter what kind of ...


1

You are on the right track realizing that the Xclient (in this case Firefox) will not be able to access an Xserver running under a different user (by default). The simplest solution would be to ssh -X webuser@localhost firefox (note I would explicitly NOT use the 'nobody' account - this should not be used for this purpose) - which automatically deals with ...


2

paranoid mode: install a different linux on a different machine, better, use a ro-mounted distro from cd like knoppix or so (virtualbox and kvm is your friend) run your browser from that other machine, using x-forwaring or x2go (free and good linux terminalserver/client-solution, works very nice on debian) harden this browser with noscript, adblockplus, ...


2

Have you thought about using something like Tails(https://tails.boum.org/)? As was suggested above you could use it with a Vm, but based on what it is fundamentally for you wouldn't need to keep an instance on your machine for it. There are also things like sandfox(http://igurublog.wordpress.com/downloads/script-sandfox/) that allow you to run firefox in a ...


3

AppArmor or SELinux is probably a better solution than running Firefox as a different user. As you mention, running any kind of new software (including Mandatory Access Controls like these) potentially introduces new vulnerabilities (I'm fairly sure some have been found for SELinux) but I think most agree that the tradeoff is worth it.


0

You could create account, without any privileges and used it for browsing but there are exploits that may obtain root privileges. There's nothing that can secure you.


1

THE THREAD-STARTER WROTE: But what if I'm just reading a news site? Everyone has access to that, it's all over newspapers even. What's the point of encrypting such easily accessible information? MY RESPONSE: Yes, everything on the news site is public; but would you feel comfortable with someone standing over your shoulder while your with your computer at a ...


2

Because you don't really know what can be infered from the data you emit. Since the whole NSA fuss surfaced in the news, lot of people think : "yeah, right, the NSA knows about the emails I send to my little cousin and my buying habits ? So what ?". Unfortunately we've entered the age of BigData and machine learning. This isn't just about crunching huge ...


2

Some background before I get to my answer: I find telephones fascinating and one of the most interesting phones I came across was the STU or Secure Telephony Unit which basically consisted of an a/d-d/a some audio codecs a digital encryption module and a modem and a bypass circuit all stuffed inside a telephone and was for the most part connected to ...


0

To which I would add that ubiquitous encryption makes all snooping on and interference with ordinary traffic harder and more expensive. It's a good thing to do.


0

That's correct; and you did well not clicking the link. user2675345's recommendation is very good if you know what you are doing; judging by what you said, it seems that you are not so experienced in this, and thus the safest recommendation is simply not click the link at all. However if your curiosity is too great, then I would recommend you firstly ...


1

I usually make use of VirusTotal to scan suspicious URL's or files. Just paste the link in the space provided or upload the suspicious file and they will analyse the site/file against their comprehensive database of malicious software signatures and run it through most popular anti-virus programs and then give you a report on what was found. Please note ...


0

In this specific case, could be a phishing site. It asks you to register or login to the (supposed) game in that site. If you input the same information as you use in other sites, they can login as if they were you, wherever you used that same information.


2

Some quick general advice for visiting strange links: Turn off Javascript and any browser plugins, especially Java and Flash, these are the most attacked. This alone will save you from most malicious content. Additionally make sure your browser is up to date. If you use Linux then your package manager will take care of this for you. If you are using a ...


1

All the main points have been covered but I thought it's worth covering this particular scenario: It was/is popular to encrypt a login page, then allow the authenticated user to continue browsing the site on an unencrypted connection (to save CPU cycles on the server). This seemingly efficient and parsimonious use of encryption is actually next to useless. ...


1

The certificate is not necessarily fraudulent (though it does expire on the 28th of March) as much as it is that the name being used to access the resource doesn't match what is on the certificate. It's common for companies to have aliases or CNAMES for services/hosts. The problem is that unless you generate a UCG or SANS cert to handle all the names then ...



Top 50 recent answers are included