Hot answers tagged web-service
18
Having worked with RESTful Web Services doing code-review and code-assisted app penentration-tests on RESTful apps that were over 3 MLOC, I can tell you that the problems outlined by John Wilander in REST and Stateless Session IDs is the dominant, growing problem. If you do not have this problem (which is a very big problem) in your RESTful Web Services, I ...
11
I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements,
Ahhh assumptions.. Have you seen the OWASP Top Ten project? SQL injections have always been a constant source of security issues.
I cannot see how changing any session state would effect the ...
10
Answer to the original question: No, it's not a security risk for your employees to use Disqus etc. -- at least, no more than any other form of communication.
Of course, if employees post sensitive corporate information on these systems, then that may harm the corporation's interests. But you could say the same of any other means of communication. ...
9
First of all, except flash you have to disable all other browser plugins, the most obvious one is Java. Java has been a target in browser exploitation as much as flash has been.
the website cannot use my email and send spam mails to my contacts
If you open it in incognito mode a malicious website can't steal your cookies or other data because those data ...
9
From what I can tell from that article it was an error with the Facebook "Connect" API.
This is the button on a site that says "Log in with Facebook". It is just a link the site owner puts on the page. When the user clicks it, you are redirected to Facebook's server. The site owners have no control over what happens after this.
It doesn't "bypass ...
9
A SIM card is a smart card. It follows all the relevant standards for smart cards, it is produced by smart card vendors.
A smart card is "just" a tamper-resistant computer. It has its own CPU, RAM, ROM, storage area (often EEPROM). Power and clock are provided from the outside. The device is supposed to be resistant to physical extraction of the internally ...
8
I dont see any flaws, but I do think you're overdoing it. It seems to me - I might be missing something - that you use a token because you think you should, not because there is a legitimate reason.
The best approach would be to first identify your (security) requirements and then look for the solutions.
One of the things you should think about with ...
8
If you're talking about SSL, the answer is why not? If I had the choice, I'd prefer that every site on the internet provided HTTPS. Is it strictly necessary? Of course not. Does it stop anyone from snooping on my content? Yes. Does it reduce the chances of an attacker injecting content into a page via man-in-the-middle? Yes. Are either of these scenarios ...
7
How concerned are you about an insider threat and how savvy would you expect insiders to be? That's your biggest factor. Almost any security mechanism you put on the machine's hard drive can be cracked if the attacker gets a hold of or too much access to the hard drive. How long that will take will be a factor of how well you've secured the drive.
I can ...
7
You need to define with high precision what it is that you exactly want.
Here, you want to allow accesses from you, personally. The business with the secret key means that access will be granted to whoever/whatever knows the secret key. Embedding the key in the application means that the application knows the key, not you; and, as you note, secrets embedded ...
6
I think you should just stick with https. If major parts are generated in client-side javascript (e.g., the sha1 of the token), how difficult would it be for a MITM attack, where an attacker leads people to a faked version of your site, where the javascript is altered to reveal the secret key to the server? (E.g., alter the DNS and spoof the site on a ...
6
OWASP (The Open Web Application Security Project) provides a lot of resources for developers and pen-testers.
OWASP is an open community dedicated to enabling organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested ...
6
Given that RSS feeds are simply summarised web pages then the requirement to encrypt the data would be driven by the general need to encrypt the original information hosted on the website.
However, you've got to be careful when using technology to drive a solution.
Is RSS the right technology to deliver secured content to a user?
Are there alternative ...
6
Well, let me put it that way. Your question, transposed to the domain of medecine, would be: "I just enrolled in an anatomy class. I would like to perform neurosurgery, but I don't know much about it. I do have a nice hammer and a knife. The knife is not very sharp, so it should be fine, no ?"
To get what could happen to you, imagine that you are the ...
5
Chrome has not yet been formally verified (nor has any program or OS that I'm aware of), so there are no guarantees.
That being said, unless you make yourself a target by someone equipped with a very powerful, underground, unbeknownst-to-all, weaponized, 0-day exploit -- you can probably give yourself a virtual high-five for being the most secure Win7 ...
5
This should be secure against man-in-the-middle attacks if your machine checks that it has received a valid certificate for Paypal from its correspondent.
Be warned that some SSL libraries leave it up to you to implement/request this check, so you will need to carefully confirm that your code is performing that check. (Since your machine is initiating the ...
5
Since you are usually loading CSS, JavaScript and graphics from a CDN anyone with root-like permissions on the CDN servers (i.e. the company running the CDN) can:
replace your images with other ones, such as porn or other things you don't want your users to see on your website
replace your CSS to load said images, mess up the design, etc. - for IE and ...
5
Actually, the whole WCF/SOAP security stack in .NET is based around these sets of standards for encryption and signing (if you are referring to what Thomas linked to).
Message security with encryption uses it to encrypt the message. I have no hard evidence of it, but I believe its fairly well used in WCF-centric shops. We use it for our stuff. It's all ...
5
According to Jager's and Somorovsky's paper "How to Break XML Encryption" (PDF),
The W3C XML Encryption specification today marks the de-facto standard
for data encryption in complex distributed applications. The use of
XML as core data syntax, e.g. for major business, e-commerce,
financial, healthcare, governmental and military applications, has
...
5
Right there in that same Wikipedia article is the answer you're looking for:
Note that the ability to construct an arbitrary Python object may be dangerous if you receive a YAML document from an untrusted source such as the Internet. The function yaml.safe_load limits this ability to simple Python objects like integers or lists.
(emphasis added)
The ...
5
There is unfortunately no built-in safe mode for Ruby. I wrote the SafeYAML gem to plug this hole for now; and there is a discussion going on about adding this functionality to Psych, Ruby's YAML-parsing engine as of 1.9.2.
For now if you're a Ruby app developer, your best bet is likely to use SafeYAML or find a similar library to suit your needs.
4
Recommended approach. I recommend that you use SSL and authenticate the client using their password. Then you won't need any fancy MAC, hash, PBKDF2, etc.
Details. You asked how to authenticate the user. Here is a simple approach. Use SSL sitewide. When the user logs in (entering their password in via a web client), then set a session cookie that ...
4
There are definitely some bots out there, but it's entirely possible that it is real people who are clicking like. There are people who spend an inordinate about of time liking things on facebook, and it can have a viral effect. Some of them are new to FB and have poor English skills so they like everything everybody else likes for no good reason. It's what ...
4
Hacking is creativity. Applications are complex and when an attacker can look at the entire application he can see interesting ways of abusing it. In the light of a few sentences explaining some vague application I would consider the following:
1)The OWASP top 10
2)Make sure you verify the SSL certificate when connecting to the APIs you need.
3)Avoid ...
4
When you submit a contact form, the information is transmitted to the web server and the web server then takes care of handling either sending an e-mail or filing it away in some other way. All you can know locally is that the information you entered was sent from your computer to the server, but after that, it is entirely up to them to decide what to do ...
4
The class of malware which prevents itself or other programs from being seen is called rootkits. They work by replacing key system calls that are used to detect what is going on in the system. For example, when you go to Task Manager, Task Manager asks Windows for a list of programs running on the system, but suppose that another bad program was able to ...
3
I suggest that you elaborate more on what is the threat model that could cause a great loss. In general, I would question whether the web is the right technology to deploy this: failures of web security are commonplace, so if any security failure could truly cause a great loss of profits, maybe you should rethink the entire initiative. But perhaps you can ...
3
Some of the services offered (not especially by McAfee, but in general in this area):
checking the site is up
confirming the DNS records are correct
scanning email in and outbound
running your intrusion detection service
checking for spoof/malicious versions hosted elsewhere
checking for brand theft
checking your versions of OS/app etc against new ...
3
Probably not. If I need large prime numbers, I will want to pull them from a trusted source using a secure method. To do that, I'll either need pre-shared keys or I'll have to use something like SSL. If I'm using SSL, I'm probably consuming a fair bit of CPU...
A chicken and egg problem at the very least, and trust issues after that.
3
First of all, you need good session ID management in your Web Services.
Secondly, I'd recommend something like the Cookie Revolver Framework to tie the client-side certificate to machine IDs (e.g. MAC address of NIC and/or serial number from a hard drive) and static IP addresses. However, these can probably be faked using virtualized hardware in this day ...
Only top voted, non community-wiki answers of a minimum length are eligible
