11,887 reputation
744104
bio website security.stackexchange.com
location Florida
age 32
visits member for 3 years, 9 months
seen 42 mins ago

I'm not the droid you're looking for.


2h
comment Passwords in plaintext?
@marcomanzoni Different apps and OS's handle invalid certificates differently. Most desktop web browsers and Operating Systems are pretty good about warning the user of invalid certificates. Other desktop applications may not be so reliable. Mobile platforms, especially at the app level, are hit or miss. When an app fails to warn a user that a server it is contacting has presented an untrustworthy certificate (i.e.: one not signed by a CA the app or device has been configured to trust), that represents a vulnerability in the app.
2h
comment Passwords in plaintext?
Sounds to me like @marcomanzoni isn't very familiar with SSL proxies, and therefore possibly hasn't configured their phone with the BurpSuite CA. Given that, one of two things has probably happened: 1.) User ignored SSL warnings provided by the app. 2.) App ignored untrustworthy SSL certificate and proceeded without presenting warning or error. The former is a common end-user issue. The latter is a security vulnerability in the app.
1d
comment Is there a way to detect web server in case it's not present in HEADER?
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.
1d
comment AD account for authentication on an external system?
I suggest migrating this to Server Fault.
Sep
27
comment Vulnerability test for CVE-2014-7169 (Shellshock)
The part that includes sh is a piece of the payload, not the exploit.
Sep
26
comment Has CVE-2014-6271 Shell Shock been mitigated completely what is the latest?
There's also a seclists.org post which indicates CVE-2014-7169 might still not be the end of it.
Sep
24
comment Why are web servers ubiquitously configured by blacklisting inaccessible files instead of whitelisting the accessible ones?
Harder than maintaining security-hole-free blacklists? Perhaps not. Harder than maintaining a blacklist that provides some security while still allowing the website to function? I should think so. Unfortunately, most businesses still place higher value (and dollars) on usability/functionality than security.
Sep
24
comment Why are web servers ubiquitously configured by blacklisting inaccessible files instead of whitelisting the accessible ones?
Short answer: Because properly making and maintaining whitelists is hard.
Sep
24
comment Why should I separately backup my revoke certificate
If your private key and revocation certificate are both backed up to the same device, then the backup for both can be lost/stolen as one. This could allow an attacker to revoke your certificate and issue a new one claiming to be you, or leave you with an un-revokable certificate in the case that your primary storage and your all-in-one backup are lost. For the latter, at least, keeping the private key and revocation certificate on separate backups means you have to lose three things in order to not be able to revoke a lost/stolen key.
Sep
24
comment Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?
Isn't this a little like asking "is using a browser other than Safari on iOS fundamentally insecure"? Pretty sure the answer should be no - there's no inherent insecurity to using tools that the OEM doesn't themselves develop, so long as the tools you're using are actually made to be secure.
Sep
24
comment Which vulnerability scanners scan MariaDB servers?
@Xander The OS/service detection & script selection issue can really be a pain sometimes - it can generate false-positives as well as false-negatives for near matches (or non-matches). For example, if it detects MariaDB as equivalent to MySQL, it may run some checks for vulnerabilities that apply to MySQL but not really to MariaDB - these can produce unexpected responses and (for scripts not written to handle these properly) cause the scanner to flag things vulnerable which are not.
Sep
24
comment Which vulnerability scanners scan MariaDB servers?
@Xander That's somewhat dependent upon how MariaDB presents itself to the scanner, and how the scanner does its service detection and script selection. If the scanner doesn't properly recognize MariaDB as a MySQL-like product, it may de-select some vulnerability checks that it would otherwise run.
Sep
19
comment Is it possible to hack an Android App or an Android device without being root?
What you describe is a world where privilege escalation vulnerabilities do not exist within the operating system. While it is in theory possible, in practice it is extremely infeasible to achieve. Even if that was achieved however, many other exploits are still possible at the application level (and some at the OS level) which do not require privilege escalation at the OS level. These, however, are still dependent upon design or implementation flaws within the OS and/or application. In a "perfect world" similar to what you describe, these would not exist either.
Sep
11
comment Vulnerability exploitation in Java
As it is "how are exploits done in Java" is very broad. I'd suggest closing if it's staying as is. If the scope were to be narrowed to "how can I identify X-type exploits in Java", it might be more appropriate for the StackExchange format. I suggest expanding just a bit on your C programming experience, then asking about comparable methods in Java (e.g.: "In C, I'd look for buffer overflows or ROP based exploits like this... how do I do the same thing in Java?"), and completely nuking the last sentence - perhaps even nuke everything starting with "Is it even possible".
Sep
11
comment Mac OSX: What is the safest way to access an unknown USB storage?
@MatthewPeters Solution there, as I'm inferring the OP is trying to do (since they said "I HAVE to access it") is to hook it up in a safe environment and pull essential data off. Then, validate the data and environment are still not compromised by malware before extracting the data to a trusted environment.
Sep
11
comment Mac OSX: What is the safest way to access an unknown USB storage?
Clarification: In the earlier comment, I said "USB device" or "USB drive" where this question seems to be about SD cards. Same statements still apply, though.
Sep
11
comment Mac OSX: What is the safest way to access an unknown USB storage?
@MatthewPeters I have plenty of friends who might give me SD cards or USB devices which I do not trust. That has nothing to do with our friendship, and everything to do with their competency (or really, lack thereof) in maintaining secure systems.
Sep
11
comment Mac OSX: What is the safest way to access an unknown USB storage?
@MatthewPeters As noted in comments on your answer, a write blocker (or even mounting as read-only) is to protect the evidence (in this case, the SD card which may contain malware) not you. Additionally, protection of the evidence does not appear to be a major concern here - Honey Badger obviously just has some data they need to get off the drive without getting infected. To be properly protected, a LiveCD or VM should be used instead.
Sep
11
comment Mac OSX: What is the safest way to access an unknown USB storage?
I'm not following how a write blocker can "prevent a device from writing to you". The threat is not that malware resident on a USB device will "magically" write itself into the host system. The threat is that the host system will read the malware from the USB device and then write it to itself. Really, for the sole purpose of protecting oneself from a malware infection, a write blocker is excessive. The write blocker is there to keep your system from altering the contents of the USB drive. The risk here is that the system might be tricked by the USB drive's contents into writing to itself.
Sep
10
comment Contactless session on ATM?
@TildalWave Solution to the "can't eat card" concern: Each card has a different identifier/cert (even multiple cards on the same account should be different) which gets revoked server-side in the case of lost/stolen/locked. This is even more secure than eating the card, since it can be done without actually needing to have the card at an ATM and is also effective globally against any clones.