Skip to main content

Questions tagged [exposure]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
13 votes
6 answers
7k views

Is it impossible to protect an API from data redistribution?

Say there is a frontend mobile app and a backend server (let's call this service MyApp) which hosts an API for the mobile app to connect to. The backend server makes any needed requests to third party ...
Jiehfeng's user avatar
  • 233
0 votes
1 answer
566 views

Is having hard-coded API keys such as the SafetyNet API key considered a vulnerability?

I have a scenario where the developers are using SafetyNet API to protect their Android apps. I observed that the SafetyNet API key has been hard-coded within the apk file. This is the first time I ...
Syntillations's user avatar
0 votes
0 answers
128 views

trying to test the vulnerability CVE 2015-0205 for university project

I'm trying to establish a TLS client-server connection with openssl 1.0.1x on ubuntu-14.04 in order to create a fix for CVE-2015-0205 for learning purposes. I found this explanation of CVE-2015-0205: ...
OpenSSL_learner's user avatar
3 votes
0 answers
243 views

What is the Meow Attack and how can I guard my databases against it?

Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
MDMoore313's user avatar
0 votes
0 answers
142 views

How to prevent configuration of Public IP on an interface

I have recently identified a security risk with some of the machines (primarily Windows 10 and MacOS laptops) my company issues to users. Specifically, a small subset of the users are regularly ...
khantext's user avatar
3 votes
1 answer
214 views

How do applications such as password managers check leaked credentials and how can I get more results?

I have been using LastPass for a while and I have just seen an option to generate an exposure report. By its output, I assume it checks various sources containing credentials dumps from hacked web ...
Alexei's user avatar
  • 2,193
0 votes
0 answers
250 views

Securing Clipboard Memory

Sometimes sensitive data is copied from/to processes and external devices like (long)passwords, usernames and so forth , but also often people don't get this always in mind and forget to clean that ...
user avatar
8 votes
1 answer
1k views

Employer stores plain text personal data in a 'data warehouse' [closed]

I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, ...
nopassport1's user avatar
0 votes
1 answer
2k views

Is it safe to upload videos in cloud tools like video editors? [closed]

What I have is a video file(with delicate pieces of frames in it) that I want to be edited using cloud apps, without looking further in site maps and that's not always possible too, if you have to ...
user avatar
1 vote
1 answer
543 views

Risk assessment Struggling with scenario

I have been given a situation (see below),The question i need to answer to complete the task is: What is the ALE for phishing emails for the company, in pounds; e.g. 203,760? When i multiply the ...
Luke Costello-Watkins's user avatar
2 votes
1 answer
2k views

Big insurance website exposing StackTrace of Java JSON Parser

Recently I coincidentally have discovered that an api endpoint of an insurance company is sending a StackTrace of a JSON parser as response to a http POST message with bad formatted JSON in the ...
Matthias Herrmann's user avatar
1 vote
1 answer
126 views

Exposing internal, rental web app for multiple shops/employees [closed]

I'm creating a web application for internal use at work. Mostly basic relational database structure (customers, orders, movies, etc.). It will be used in a multiple shops across town. What is the ...
paldave's user avatar
  • 13
2 votes
1 answer
401 views

How likely is an attack for a known OTA ring 0 vulnerability in mobile devices?

Following on from this question about a WiFi OTA vulnerability: assume a popular computing platform has a known vulnerability that would allow creation of a worm with access to ring 0 (kernel). Then, ...
z0r's user avatar
  • 333
1 vote
1 answer
113 views

Where to expose flaws in security? [duplicate]

Some websites have ridiculous security flaws. Thankfully the public is slowly becoming more aware, and many sites are fixing the more obvious ones, like lack of HTTPS, poor password creation ...
Academiphile's user avatar
1 vote
2 answers
197 views

Does an image showing exception error on my site pose a prominent security risk?

I wrote a small website in PHP and ZF2. Had a friend test it out by posting a link to it on Facebook. Apparently I forgot to turn off ZendFramework reporting and he find an error. Posted a photo ...
dennismv's user avatar
  • 123
21 votes
3 answers
8k views

Is exposing exception information in web service a security risk? [duplicate]

It is a known fact that exposing the exception information to the end user provides security risks since an adversary can user that to figure out how things work internally and attack it. But what ...
Ilya Chernomordik's user avatar
7 votes
1 answer
507 views

Is exposing website performance data a security risk?

I am currently adding a subsite to some websites that allows me to monitor performance data live as the server software perceives it. The data is mostly stuff like amount of memory used, memory ...
MarLinn's user avatar
  • 228
1 vote
2 answers
252 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
Calculus Knight's user avatar
3 votes
1 answer
203 views

Is a newly installed server with no services running (but connected to the web) at risk?

A new server has just been installed but literally has nothing else running on it, no services setup to SSH in or anything yet (it's a Linux server). However, it is hooked up to the web so I can ...
Arlix's user avatar
  • 1,489
9 votes
2 answers
3k views

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...
vartec's user avatar
  • 259
0 votes
1 answer
122 views

Listing technologies/languages in LinkedIn Project History a Security Issue?

In my LinkedIn Profile, when I list my past projects as a Software Developer, I think it to be beneficial to list the technologies/languages used. My question is, does this impose a security risk/...
EternalWulf's user avatar
2 votes
4 answers
1k views

Anonymity through Tor over VPN [closed]

I want to do some research on network anonymity. Assume that I am careful enough not to disclose any personal information while connected to an anonymous network. If I run a system that uses Tor over ...
user2554749's user avatar
4 votes
4 answers
1k views

Safari downloaded my php source once. Should I worry?

I uploaded via ftp, then typed in the URL of the script to Safari; Safari downloaded the source!! This hosting site has never done that before - .php scripts have always executed. I can't duplicate ...
Bobbi Bennett's user avatar
3 votes
2 answers
3k views

Securely expose WebService from Enterprise Network to Internet Client

(coming from stackoverflow) Are there any standards (or certified solutions) to expose a (Web-)Service to the internet from a very security-sensitive network (e.g. Banking/Finance)? I am not ...
hotzen's user avatar
  • 131
4 votes
1 answer
502 views

Can I safely post the output of lspci, lsusb, lshw?

I'm having trouble with my SD card, and have been asked to inspect the output of tail -f /var/log/syslog, sudo lspci -v -nn, sudo lsusb, and sudo lshw. tail shows nothing when I insert the card, so ...
lofidevops's user avatar
  • 3,610
6 votes
2 answers
4k views

Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data

I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the ...
jvff's user avatar
  • 61
15 votes
3 answers
5k views

Bruteforce attack on my FTP server

I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", "...
18bytes's user avatar
  • 885