Tag Info

New answers tagged

0

I have not seen anything pivot between the browser and the user that can inform them before the connection is made. Any add-on or application would take a serious beating processing so many variables. Let's have a look: Requester (via browser whether initiated or not) --> browser --> Go get this malice.com/bad.cgi How far do you think you'd be able ...


0

Another solution is to build or modify a existing browser, to not allow any type of external URL typing. You could even have it to use a screen keyboard or such to prevent malicious programs from using SendKeys(); and you could have scrambling screen keyboard and much other security features, And user confirmation if the browser is called externally with a ...


0

I would suggest this: Use a Proxy, which initially blocks all requests. For each blocked request, to authorize them, you would have to type a captcha or Another challenging factor that the malicious program will NOT be able to pass. If the captcha is passed, then the site in question will be permanently added to a whitelist allowing it to pass everytime. Of ...


5

In addition to the existing answers, I'd like to add: it provides an attack vector. Host flagrantly malicious content at www.evilstuff.com Add to my domain records the IP addresses for: cnn.com IP addresses microsoft.com IP addresses stackexchange.com IP addresses Wait for Google to detect said content on my server and decide to blacklist the domain ...


3

Possibly because once the malware site is booted off its ISP or hosting company, the IP gets recycled to some other perfectly legitimate organisation. The domain name was clearly controlled by the malware owners, whilst the IP is owned by the ISP.


2

Many times (smaller) websites are run on shared servers which uses the same IP address but distinguish by path/URI instead - also, IP addresses change, it's not hard to re-direct what IP address a particular domain name points to, it's just a DNS update away.


0

Late to the party... You can use this fingerprint tool: https://www.grc.com/fingerprints.htm Go there, type in any website (URL) that you are interested in and compare the fingerprint displayed with the one your browser displays. If the fingerprints don't match, your employer's proxy does intercept your connection. This most likely even works, when the ...


2

There is no reason that this should not work as long as third party cookies are enabled in your browser. HTML form POSTs can be used, or in the case that the forms are a multi-stage process then this will be more useful to run as XHR requests as your attacking page can then control the requests and issue them in turn - just as your are doing. Make sure ...


0

I'll say yes, if Cryptoware 2.0 use a server listed in the list you use. https://easylist.adblockplus.org But it's not the primary job of AdBlock. If you want something to block adware, malware and spyware you should look something like disconnect.me or ghostery. You could also secure your lan by using Secure DNS like using those dns Comodo DNS DNS #1 : ...


1

It can't hurt. ABP (and similar software) blocks known ad providers and patterns that look like ad providers. If one of them gets popped and starts serving up malware, ABP will save you. If the site you're on is the compromised one, ABP can't help (unless the compromise is to point at a compromised ad network that's already blocked... seems complicated). ...


2

If you access a https:// page and the code is still there, then it's a local malware injecting code or a configured proxy. Your ISP can't inject it's own html-code into a https:// connection (unless for some very odd reason they act as a http-proxy of which you accepted the ssl certificate).


2

That's really interesting. I'd never seen this used by ISPs before. You sure any device connected to your LAN isn't compromised with malware? If it really is your ISP I would read over your TOS (Terms Of Service) like @Eric G recommended. If you're legally allowed to prevent it then: Method 1: Use proxy like @Eric G recommend. If your using port 80 and ...


4

Are you sure it's your ISP? Could it be a malicious program running on your system? You can try to get a Linux LiveCD somewhere, boot into it, and see if the code injection is still there. If you see the injected code, it's almost surely your ISP doing this. You could look at the contract you signed, and if you don't see anything related to code injection ...


1

If they are injecting scripts into every page, this would indicate that they may be tracking you, may be doing ads, etc. They are executing their code and since it loads dynamically they may change what they are doing and when at any time. On the blocking part, you would need to check with your ISP terms of service and possibly government regulations in ...


3

Firefox browser provides the easiest way to do such testing via the advanced settings in about:config where security.tls.version can be of the following values 0 - SSLv3 (set max and min value to this) 1 - TLSv1.0 2 - TLSv1.1 3 - TLSv1.2 What you will see when the website does not support SSLv3 is this: Please remember to set it back to max 3 and ...


3

It doesn't necessarily matter what your server uses by default - most servers and clients are configured to negotiate the highest protocol available. A major aspect of the POODLE attack is that an attacker can cause connection failures in a higher (non-vulnerable) protocol, and downgrade the victim to SSL3. Then they can exploit the vulnerability in SSL 3. ...


0

The error message you got is because the Cross-origin resource sharing (CORS) is not enabled on the server you try to attack. So all your AJAX requests will not be accepted by the server that host the web services. So if you enable CORS on your target server, the server will accept your AJAX requests. Do not use AJAX since if CORS is not enabled your ...


0

Try catching the error with nothing. The SOP error does raise an exception, which does stop your script execution. If you instead Catch the error, the request will be fired away, your response will be filtered, a exception is thrown that will catched, and your script will continue with the next request. So basically, now it works like this: attackstep1() ...


3

Normally you are forced to use a corporate proxy. This is necessary for the company to protect against the internet. But a side effect is, that the internet usage of every proxy user can be monitored by the company. This is something nobody wants. Technical details aside: what you are trying to do is to actively circumvent security systems which are ...


2

You are refering to proxy chaining, and it is not supported by any major browser that I know off. You can use some sofware like SocksCap or Proxifier to intercep Firefox network calls, and divert them to your corporate proxy, and configure Firefox to access the network through the second proxy.


2

as the website service panopticlick puts it "How unique and trackable is your browser?" there are many things that especially via scripting can be found out about your machine. This uniqueness estimation can include browser type browser version geometrics (screen size) average cpu usage / calculation power via script trial fonts (are a especially neat way ...


1

There are number of different ways that this can be accomplished. IP Addresses Typically, most host machines stay within a family of IP addresses. These addresses are assigned to your ISP, who in turn, assigns you an IP address when you purchase a subscription. If you login to your account from a different block of IP addresses, then they may know you ...


1

Contrary to some answers here, I'd say it could be extremely dangerous. If you're a target, I'd love to sit in your browser and watch you as you reveal your accounts, passwords, thoughts etc. It's almost as good as taking over your computer, because 90% of your communications with external world would probably go through your browser(s). It's even easier to ...


1

The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain. I don't think so, because I think the user itself is the weakest link: The user can often be convinced to follow insecure links, even if the browser explicitly warns against it. The user can be convinced to install any other software, like dubious ...


4

It isn't good to install any untrusted software, but the browser is obviously the holiest of holys. And I've seen quite a few applications begin to implement 'native' by using WebKit and local WebSockets. That itself isn't too terrible, yes technically the application could be used to open Facebook as well because it is using WebKit, but as long as it ...


15

It is very dangerous. You are correct in pointing out that the browser decides whether or not the connection is secure (HTTPS). The browser not only initiates the connection, it also chooses the symmetric key that will be used for the secure connection (assymetric keys are only used to set up the connection). Hypothetically, a browser could use a ...


1

I'll have a shot at addressing this one. Is this acceptable, first of everything, from a security standard (i.e. accepting an unsigned software)? Accepting unsigned software that is trusted for some other reason in itself isn't an issue. Accepting ActiveX isn't considered acceptable at all. I'd suggest running the browser that uses ActiveX within its own ...


-1

I'm fairly certain SHA-1 will be deprecated by most OS's by 2017. Especially with browsers taking the initiative and flagging certificates secured by SHA-1 by mid 2016 and Google's project Zero cracking the whip on implementing encryption over the web. The issue here isn't about connectivity. It's about pressuring network administrators/device ...


0

Fresh Installation will definitely be a solution. Also restoring network devices will further kill any infection possibility. If you don't want to enable 'noscript', then try disabling unwanted browser plugins, specially Java. Most of the web attacks from browsers exploit these plugins to drop malwares. Disabling plugins will keep you safe from such ...


0

Wiping your system and restoring from trusted media is definitely a good idea. At that point your system should be safe. However, I'd also suggest rotating your passwords on online services as well as using new passwords when you reinstall Linux. If you have ssh keys in use it wouldn't be a bad idea to rotate them as well. It may seem a little excessive but ...


7

Yes: CSS can contain malware, though in my experience, its usually been tied to a vulnerability, e.g. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3971 As far as it containing JavaScript, that's certainly a vector, though successful exploitation should generally be limited by vulnerabilities within the Browser, the OS and the JavaScript engine. ...


1

There are two different types of issues with untrusted data: It can contain malicious code to be executed directly (malware) It can be crafted in such a way that it will cause your legitimate applications to behave erratically (exploit) and perform something bad (payload) JavaScript really is in the first category. When browser or PDF writer vendors (or ...


5

CSS rules can actually contain JS code (supported by at least some browsers), so from that perspective CSS can be "as bad as" JS. This SO answer might be helpful if you want more detail. http://stackoverflow.com/a/482088


1

Chrome and Firefox seem to no longer support UTF-7 in any format. The HTML5 specification says: User agents must support the encodings defined in the WHATWG Encoding standard. User agents should not support other encodings. User agents must not support the CESU-8, UTF-7, BOCU-1 and SCSU encodings. [CESU8] [UTF7] [BOCU1] [SCSU] Support for ...


1

Yes it would increase security, as (malicious) cross-domain information leaks aren't possible between browser instances. You can also minimise the use of plug-ins and add-ons in high security browser environments, as they expose additional attackable surface. Another way to mitigate the risk of malicious code running in your browser are ad blockers and ...


1

Let's get into the details of what a guest session is on Ubuntu. You've asked 'is it more secure for the system to use a guest session rather a normal account?', and the answer is yes, but only slightly. Guest sessions use a tmpfs instead of a home, so data does not get written to disk but stays in RAM. This means a prolongated session with important ...


-1

Yes, it wipes the whole session (more concretely, the $HOME of the guest user). An attacker would need to enter into another account (either root or eg. a normal user with a weak password). Unless it manages to do so, any change will disappear on logout, which is nice for security, but inconvenient for users. However, that things are wiped doesn't mean ...


1

These are not PCI requirements. You should read the PCI DSS E-commerce Guidelines. Section 3.4 describes "Common E-commerce Implementations" such as: 3rd party API with Direct Post iFrame embedding 3rd party payment page in Merchant's site Redirection to 3rd party payment page and, to quote, These examples are intended to be representative of only ...


2

Opening a new window or iframe does not change the protections provided by the Same-Origin Policy. The origin inherit ice rules for iframes prevents two different domains from accessing each-others data. There is no security or PCI-DSS requirement that would require a redirect from/to a payment gateway. This maybe a usability requirement mandated by a ...



Top 50 recent answers are included