Hot answers tagged

36

Update: It seems like a Finnish man was able to demonstrate this "attack" by issuing a certificate for the domain live.fi by having the address hostmaster@live.fi. Last year, I made a bet with a friend that I can get a browser-trusted certificate with his domain name in order to launch a successful MiTM attack on his login form to steal his password. Long ...


24

The best practice is: The basic idea. Create an API key (a 128-bit symmetric key) for each separate user account. This key needs to be securely stored on the server, and also securely stored on the user's client. For each request made by the client, add an extra request parameter that has a "signature" on the entire request. The "signature" should be ...


23

Having worked with RESTful Web Services doing code-review and code-assisted app penentration-tests on RESTful apps that were over 3 MLOC, I can tell you that the problems outlined by John Wilander in REST and Stateless Session IDs is the dominant, growing problem. If you do not have this problem (which is a very big problem) in your RESTful Web Services, I ...


22

The API should not expose any internal information, i.e stack traces or similar. As you really noticed they might leak information which might be used to attack the implementation. Moreover they are usually only relevant for the developer of the API and not the user of the API. These users expect proper error messages anyway and not some strange message ...


16

I think I can help resolve your concerns. So what are we trying to protect? We're trying to protect ourselves from an attacker breaking into user accounts via our web services. Specifically, how might we protect ourselves from an attacker sufficiently motivated to reverse-engineer our mobile app in the wild? You can't. It's that simple. Trying to do ...


14

A SIM card is a smart card. It follows all the relevant standards for smart cards, it is produced by smart card vendors. A smart card is "just" a tamper-resistant computer. It has its own CPU, RAM, ROM, storage area (often EEPROM). Power and clock are provided from the outside. The device is supposed to be resistant to physical extraction of the internally ...


13

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements, Ahhh assumptions.. Have you seen the OWASP Top Ten project? SQL injections have always been a constant source of security issues. I cannot see how changing any session state would effect the ...


12

The class of malware which prevents itself or other programs from being seen is called rootkits. They work by replacing key system calls that are used to detect what is going on in the system. For example, when you go to Task Manager, Task Manager asks Windows for a list of programs running on the system, but suppose that another bad program was able to ...


10

Answer to the original question: No, it's not a security risk for your employees to use Disqus etc. -- at least, no more than any other form of communication. Of course, if employees post sensitive corporate information on these systems, then that may harm the corporation's interests. But you could say the same of any other means of communication. ...


10

No. The API keys need to be stored in cleartext. They are not passwords: they are cryptographic keys. These keys are used for things like authenticating requests (using SHA1-HMAC). The server needs to know the crypto key to apply the cryptographic algorithms. Therefore, the API key needs to be stored in cleartext on the server. If the server stored ...


10

Am I essentially giving scorecardresearch.com access to my users and user's cookies for my domain, since the script tag is on my page? Yes. Any script included in your page either directly or indirectly (via disqus) has full access to interfere with the user's experience for everything on the hostname it is included on. Stealing client-side ...


10

If you're talking about SSL, the answer is why not? If I had the choice, I'd prefer that every site on the internet provided HTTPS. Is it strictly necessary? Of course not. Does it stop anyone from snooping on my content? Yes. Does it reduce the chances of an attacker injecting content into a page via man-in-the-middle? Yes. Are either of these scenarios ...


9

First of all, except flash you have to disable all other browser plugins, the most obvious one is Java. Java has been a target in browser exploitation as much as flash has been. the website cannot use my email and send spam mails to my contacts If you open it in incognito mode a malicious website can't steal your cookies or other data because those data ...


9

Hashing is not storage; it irreversibly destroys data. We can get away with calling password hashing as "password storage" because when we actually need the password, we have a handy human operator to type it in. Indeed, when we hash the password we do not store the password, but only a token sufficient to verify the typed-in password. An API key must be ...


9

From what I can tell from that article it was an error with the Facebook "Connect" API. This is the button on a site that says "Log in with Facebook". It is just a link the site owner puts on the page. When the user clicks it, you are redirected to Facebook's server. The site owners have no control over what happens after this. It doesn't "bypass ...


9

RESTful services are "stateless", except when it comes to authentication. Authentication is a state that cannot be avoided and so it is allowed in a RESTful design. In RESTful services, this state is often implemented as a authentication token or in the case of OAuth: an authentication-bearer token. This token should be unknown to the attacker and is ...


9

s3.amazonaws.com is an endpoint for a cloud file storage product offered by Amazon Web Services (AWS) and is used by many websites and apps (albeit usually behind the scenes, but you can serve files from it directly too). Seeing references to that domain is definitely not inherently malicious, however given that you can store just about any file in S3 ...


8

I dont see any flaws, but I do think you're overdoing it. It seems to me - I might be missing something - that you use a token because you think you should, not because there is a legitimate reason. The best approach would be to first identify your (security) requirements and then look for the solutions. One of the things you should think about with ...


8

I work at Disqus and I feel the answers above are misinformed about how our application works. Basically, our application is loaded almost entirely inside an iframe. This dramatically changes how your site is exposed to both our code and 3rd-party code. Am I essentially giving scorecardresearch.com access to my users and user's cookies for my domain, ...


8

You need to define with high precision what it is that you exactly want. Here, you want to allow accesses from you, personally. The business with the secret key means that access will be granted to whoever/whatever knows the secret key. Embedding the key in the application means that the application knows the key, not you; and, as you note, secrets embedded ...


8

You are talking about rootkits which work by integrating themselves into the kernel of the operating system; they can do keylogging entirely transparently, they can also do many other things. If a rootkit is competently written, you cannot detect it from within the running system. Only careful forensic examination of hard drives and other areas of permanent ...


8

You are not communicating directly with MySQL, you're communicating with REST server (presumably over HTTPS), and therefore need an SSL certificate, not for MySQL, but for your REST API. If the REST service is your own, then you need to make it SSL-enabled by installing a certificate on the web server that runs it. If it's run by someone else, then they ...


7

How concerned are you about an insider threat and how savvy would you expect insiders to be? That's your biggest factor. Almost any security mechanism you put on the machine's hard drive can be cracked if the attacker gets a hold of or too much access to the hard drive. How long that will take will be a factor of how well you've secured the drive. I can ...


7

Your question is "Can this be stopped?", but I get the feeling that anything significant about the system can't/won't really be changed. If I understand correctly, you are asking (simplified): I have many clients sharing the same username and password. Can I stop misuse? The answer to that is no. You must decide if you can afford to ignore the ...


7

Arguably if there's enough entropy in the folder name then it may provide some benefit in a layered security approach (ie. one of many controls you have implemented). Doing so may help to cut down "noise" from attackers who don't really pose a significant threat, however you cannot depend on an attacker not finding the folder name because it can be leaked ...


7

From what you describe, what they do is that they tunnel data in some SSL (this is reasonable) but add an extra encryption layer in Javascript (this is not reasonable). The whole reasoning is faulty. Indeed, either the SSL ensures security of transmissions, in which case the extra layer is simply useless; or the SSL does not ensure security of transmission, ...


7

Identification and tracking become important but surprisingly difficult. First, tag the accounts in the directory so you can identify them as non-user IDs. Each non-user account needs to be associated with an account owner, someone responsible for securing the system it accesses. Store the owner's identity in the non-user ID's directory entry, so if ...


7

Usually, there are two kinds of exceptions: Expected exceptions, like invalid input values; or authentication failure; or asking for non-existing object. So you can (and should) be prepared to deal with this kind gracefully, with descriptive and documented error code and message. There is no point of stack trace in this case. Internal (or unexpected) ...


6

I think you should just stick with https. If major parts are generated in client-side javascript (e.g., the sha1 of the token), how difficult would it be for a MITM attack, where an attacker leads people to a faked version of your site, where the javascript is altered to reveal the secret key to the server? (E.g., alter the DNS and spoof the site on a ...


6

OWASP (The Open Web Application Security Project) provides a lot of resources for developers and pen-testers. OWASP is an open community dedicated to enabling organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested ...



Only top voted, non community-wiki answers of a minimum length are eligible