Questions tagged [caching]

Cache is a component that transparently stores data so that future requests for that data can be served faster. The data that is stored within a cache might be values that have been computed earlier or duplicates of original values that are stored elsewhere. If requested data is contained in the cache (cache hit), this request can be served by simply reading the cache, which is comparatively faster.

Filter by
Sorted by
Tagged with
0
votes
0answers
29 views

removing fake login pages by CDN [closed]

Are there any services provided by CDN or others which hunt for fake bank pages cached in CDNs and scrub these pages - based on closely matching names, CSS styles, colors, etc.?
0
votes
0answers
56 views

protecting login pages of a bank using CDN and TLS [closed]

A bank claims that its customer login pages cannot be cached - apparently because there's some unique number associated with each instance of a page rendered on the client browser. Supposedly, a ...
1
vote
0answers
21 views

Websockets: Is it safe to allow tokens in url parameters?

For an API, I know that passing tokens in the url has the following security implications: They get saved in browser history They’re probably saved in your server’s logs and memory Users might post ...
1
vote
0answers
38 views

Can the cost factor be changed of Windows' credential cache?

I'm having a hard time finding relevant documentation from Microsoft (or any third party, for that matter) about any registry key that may change the cost factor of cached credentials. One can ...
0
votes
1answer
62 views

Exposing a version number through the assets urls

I just received a blackbox pentesting report where the security company recommended to hide the version number from the page (be it returned to the user as a text or used as a cache-buster in the css/...
1
vote
2answers
78 views

Can I alter the DNS cache on my Computer?

Can I alter the DNS cache of my computer. When I search online it only shows result to flush DNS cache and not how to alter it. The DNS cache saved on Windows consist of URL,serverIP and many other ...
2
votes
1answer
784 views

Smart cards and the behaviour of the browser. Is the PIN cached?

When using smart cards for certificate-based authentication, is the PIN entered by the user to authenticate his smart card to the browser is cached? OR does the certificate gets cached by the browser? ...
1
vote
0answers
38 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
0
votes
1answer
155 views

Suspicious Redirect to malicious website

While using a 3rd party platform my company is working with (e.g. platform.com) the following issue appeared. I clicked on a button in order to locally download an excel sheet (report) that was ...
1
vote
0answers
50 views

How does cache partitioning prevent covert/side-channel attacks? [closed]

In a report on an open-source separation kernel (Muen kernel) I was reading, in the future work section, it says that cache coloring can be implemented to prevent covert/side-channel attacks. It is ...
5
votes
1answer
130 views

What can stop a browser to cache data from ProtonMail conversations?

I think this question arises primarily from my insufficient understanding of browser caching. Let's log in to ProtonMail, and read a message. My understanding is that an encrypted 'blob' of data gets ...
1
vote
0answers
53 views

Can cache attacks be executed on a single thread architecture?

Despite an extensive research on the subject, I'm wondering if there exists side channel attacks based on cache use which are conducted on single threaded architecture, smart cards for instance. I'm ...
2
votes
1answer
787 views

Caching personal data: GDPR

There are requests in my web application that contain "personal data" (name, postal code, phone number, date of birth etc). I would like to know what caching controls are advisable. I am using HTTPS. ...
1
vote
0answers
144 views

Recommended caching headers

I am testing web application where some requests returns private data, which shouldn't be save in cache. Response contains headers: Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache ...
1
vote
1answer
1k views

Side channel attack with flush+reload

I have been reading about cache side channel attacks and the "Flush+Reload" method came up a decent amount. Before putting forth my question, this is what I understand about the Flush+reload technique....
12
votes
1answer
420 views

Browser cache information disclosure

Observing the time needed by a browser to load external resources such as images potentially discloses information about whether those resources have been accessed before. Explanation: For example, ...
0
votes
1answer
373 views

Does a RAM Disk Actually Help When Password Cracking a Small Hash

I've been reading up on RAM Disks and their roles in various uses. The role one no one talks much about is password cracking. I pulled the below quote from here "It's also important to know that hard ...
1
vote
0answers
279 views

Is access token saved in Cache.db-wal bad for iOS app?

tested iOS application probably uses special Token directive for authentication to server. This token was found in file Cache.db-wal. I can't understand, why it's just in this one file and not in ...
5
votes
1answer
142 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
6
votes
1answer
375 views

e-tags on sensitive information

Suppose we have a big JSON document that only certain users can see, but that rarely changes, but which, if it does change, users expect to see the change quite quickly. It makes sense to use etags ...
0
votes
1answer
2k views

POST request no-cache header

During security tests/assessments it is often said that you need to set the cache-control to no-cache (and some other things). But as I was looking at this I found that POST requests are not cached (...
26
votes
7answers
8k views

Why do we need HTTPS for static content? If we can have a checksum at the end signed by the private key, won't that prove the validity?

This method which I am talking about can improve caching of images, videos, and CSS by the ISP rather than just depending on the browser cache. And it also proves the validity of the sender. Is there ...
3
votes
1answer
876 views

Can I use CloudFlare if I want to avoid NSA and FISA secret orders? [closed]

We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware. We would like to use CloudFlare for DDoS protection and caching reverse proxy. ...
2
votes
1answer
301 views

FTP session opened from an unknown IP

I have a website made in Magento and hosted on an Ubuntu server and since a few months have been registering FTP connections open from unknown IP trying to open the file lic.php. In the proftpd.log ...
3
votes
1answer
673 views

In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)

There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently ...
10
votes
3answers
1k views

HTTP Content-Security-Policy Nonce and Caching

Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript? If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. ...
6
votes
2answers
2k views

Is it safe to use Memcached in a shared hosting environment?

The shared hosting I am using had Memcached enabled, I searched some forums that using Memcached in a shared hosting environment, can cause security problems like view the cache of the other user, ...
3
votes
2answers
115 views

Is CacheBleed fixed in LibreSSL?

https://ts.data61.csiro.au/projects/TS/cachebleed/ Only thing I can find: http://undeadly.org/cgi?action=article&sid=20160301141941 Q: was CacheBleed fixed in LibreSSL?
4
votes
1answer
1k views

Is browser memory cache considered as security issue?

Came across an application that uses below header to prevent caching. cache-control: no-store, no-cache, must-revalidate, proxy-revalidate Expires: 0 Pragma: no-cache As per standards, with this ...
19
votes
2answers
2k views

Principles of cache attacks

There are many scientific publications that deal with cache attacks. Most recently, the CacheBleed attack was published which exploits cache bank conflicts on the Intel Sandy Bridge architecture. Most ...
4
votes
1answer
4k views

How to detect mimikatz usage on LAN

My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. ...
1
vote
0answers
402 views

Should I blur the cached snapshot of my app?

I recently ran a security scan on one of my iOS apps that suggested I modify my apps display as it enters the background so that the screenshot stored in the cache does not expose any sensitive data. ...
3
votes
1answer
770 views

Powershell and cached credentials

In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, ...
2
votes
1answer
127 views

Is DNS caching a security vulnerability?

In FireFox, for example, there are network.dnsCacheExpiration and network.dnsCacheEntries preferences in about:config. Is increasing the length of time and number of cached DNS entries a security ...
5
votes
2answers
879 views

Why use MD4 for caching?

ccache is a popular tool for speeding recompilation with GCC and other compilers. It works by caching previous compilations and detecting when the same compilation is done again. The detection is ...
7
votes
2answers
2k views

Are webcache pages more secure?

Whenever I see a suspicious looking URL I want to go to, I usually just search it up on Google's webcache and browse the site that way. But I just realized that I never really had evidence to support ...
3
votes
1answer
369 views

HTTP Response splitting - is it browser caching or server caching issue?

I am trying to wrap my head around HTTP Response splitting. Although using WebGoat etc. I was able to learn how to do it in practice, but I guess I am still confused with some very fundamental ...
1
vote
0answers
63 views

Is there a “smart cache” device which provides cache if authorized?

Is there an implementation of a HTTP (or decoded HTTPS) optimization device which would allow for "smart caching" - i.e. the ability to release some cached content (initially transferred by someone ...
0
votes
1answer
53 views

CDN information [closed]

If I have a website that is content based, and the web server accesses a CMS to determine what to display on the site for a particular page. This is not particularly fast and it requires computing ...
-3
votes
1answer
70 views

What threats involve in cache miss

What are the possible consequences of a cache miss? In other word, is it possible that a cache miss could cause a security threat? Thank you.
11
votes
1answer
42k views

Why does IE11 refuse to enable back navigation caching for HTTPS?

On my website, I get this error message in the console: DOM7011: The code on this page disabled back and forward caching. For more information, see: http://go.microsoft.com/fwlink/?LinkID=291337 ...
2
votes
0answers
391 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
11
votes
1answer
8k views

HTTP Caching Headers: private vs no-cache

We're currently reviewing our set of "no-cache" security headers: Cache-Control "no-cache, no-store, must-revalidate Pragma "no-cache" Expires 0 Besides the "standard" set above, I found this ...
3
votes
1answer
161 views

What kind of attacks can target static resources?

Static resources and their caching interests me from the security perspective. Let's say we have an .jpg file requisted from the origin -> going through a reverse proxy with caching -> reaching the ...
2
votes
3answers
1k views

What is risk of having memcache in public interface?

To what extent a hacker can potentially cause harm to a server? Can you please give few examples? Recently, there was a data breach in my website and I found out this interface was public-facing and ...
14
votes
1answer
2k views

Is there any evidence misusing the HTTP Pragma header in responses has any (unique) effect?

I've been investigating the Pragma header, since there are already two other cache-busting HTTP response headers (Cache-Control & Expires), and I was interested in which browsers use(d) the old ...
2
votes
0answers
643 views

How to get directly to text versions of Google cached pages [closed]

http://navigators.com/cached.html According to the bottom of that site, it seems the easiest way to view websites without giving them your IP is: "Edit the heck out" of google URLs like this: ...
3
votes
1answer
1k views

Does visiting cached pages disclose my IP address to site admin? [closed]

I know it discloses my IP to Google, but is my IP also disclosed to the owner of the site of which Google made cached pages that I'm looking at? And how about anything I do within the cached page - ...
3
votes
1answer
113 views

Understanding how openx cache was infected

I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in ...
1
vote
1answer
274 views

What's the typical approach to caching invalid authentication attempts?

Clients (actually software pieces developed by some random dudes all over the Internet) are authenticating on a web server using "basic" authentication scheme and to do so they are passing the ...