Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [library]

A library is a collection of software routines made available to other programs through a well-documented interface.

0
votes
1answer
18 views

Vulnerability in Composer/MeekroDB WhereClauseTest.php?

I have a development webserver for which the domain is not published or used (legitimately) by anyone other than me. However, I'm seeing hits in my access and error log for the following file from ...
1
vote
3answers
288 views

Test for OWASP Using Components with Known Vulnerabilities?

I'm trying to think how I would test an application for OWASP "Using Components with Known Vulnerabilities". If my understanding is correct, this deals a lot with out of date libraries/modules, but ...
8
votes
2answers
339 views

Restrict JS in SVGs

Does anyone know of a way to prevent JS from running inside of an SVG or stripping out JS from an SVG? In my use case I'd prefer to keep the image as an SVG and not convert it to a JPG. I've thought ...
1
vote
0answers
1k views

Is Crypto-JS AES library still considered secure?

My company has to send out passwords to employees. We want to do so by using the Crypto-JS AES library to locally create the encrypted message and then send the encrypted message to the employee so ...
3
votes
2answers
205 views

How are apps on the Play Store infected by malware?

I just read about the Xavier malware that has apparently "infected" some apps on the Google Play Store. As usual when there are news like this, they dumb it down to a level that most people can ...
1
vote
1answer
361 views

Malicious .so Library creation in CVE-2017-7494 Sambacry

I'm trying to understand the whole process behind the Sambacry exploit. The problem is that I'm having a little problem understanding how do you create the malicious .so library to be loaded by the ...
7
votes
2answers
628 views

Can I trust a security hash implementation after testing it with random inputs against another implementation?

Let's say I want to use a security hashing algorithm, like bcrypt, and I want to use a young bcrypt implementation, e.g. called libfancybcrypt, instead of an well established implementation. Of ...
4
votes
1answer
6k views

What software can be used to read data from smart cards? [closed]

I have recently got this smart card reader. In the description it says that it can be used to read data from fidelity smart cards, library cards, etc. The technical card compatibility support is as ...
8
votes
4answers
3k views

Do outdated Javascript libraries present a risk for my web application?

I have a small web application and I just realized that some of my JavaScript libraries are outdated. An example: <script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/...
2
votes
3answers
946 views

Is it safe to store VeraCrypt or TrueCrypt container inside RAR - could this method corrupt the file?

I need to split my container into smaller files. So plan is this: I create RAR archive and let it split into about 10 smaller archives, no compression and I also add password for extra security. Is ...
1
vote
2answers
74 views

Disclosing used Libaries in App

Me and a colleague were discussing the fact that due to licensing we need to disclose a couple of libraries we used in the development of an Android app we make. I said, from a security standpoint it ...
1
vote
0answers
36 views

How can I protect against cross-build injection and other dependancy management threats in Play Framework?

I am using Play Framework's inbuilt dependancy management to download a library (HTMLUnit), to do this I add the dependancy to the build.sbt file like so: libraryDependencies += "net.sourceforge....
2
votes
1answer
112 views

Trusting HTMLUnit with Banking Details

I figured this was a good place to learn a little about trusting libraries such as HTMLUnit with sensitive information. I want to build a service that categorises my spending, kind of like my own ...
1
vote
2answers
481 views

Static vs Dynamic Linking

I came across DJB's Curve25519 implementation site (https://cr.yp.to/ecdh.html) and noticed he states in reference to using it: You can and should include it in your own programs, rather than going ...
4
votes
0answers
108 views

Are there any C++ STL alternatives which is bulletproof against timing attack?

Just out of curiosity, I wonder if there are any packages of popular algorithm/data structures which are secure against timing attack. I think GNU libstdc++ std::string::compare(), std::unordered_map ...
6
votes
3answers
967 views

How much can we trust open source implementations of crypto (security) libraries?

In one of my projects I was choosing bcrypt or PBKDF2 for the KDF for passwords. I have read that bcrypt is generally more advanced and scrypt is even better. But I am using .NET platform where bcrypt/...
2
votes
3answers
255 views

Is there a more precise approach to generate signatures for ClamAV, than regex signatures?

Actually I generate signatures from libraries, to scan executables for beeing statically linked to that library. My actual approach is to read out the .text section and generate a byte sequence for ...
3
votes
1answer
658 views

LibTomCrypt weird ECC Keys

I recently started working with the LibTomCrypt Library because it claimed to be a well documented C Library to get started with Elliptic Curve Cryptography. In my first little program I created an ...
3
votes
0answers
961 views

Good Library for RSA-2048 in C with some restrictions [closed]

I'm looking for a C/C++ implementation of RSA with a 2048 bit key (preferably read from a file). My target is an embedded platform, so it comes with some odd restrictions. The hardware restricts us ...
19
votes
5answers
7k views

How can I ensure my dll has not been modified?

I have an old project in VB which created an unique pc code from MAC address and disc id. This was used to identify a pc so credentials cannot be used between pcs. This project migrated to C#, and I ...
1
vote
1answer
150 views

Is native app vulnerable to FREAK attack? If yes, how to detect it as a user?

When I research about FREAK attack, most of them explain about the server and browser vulnerability, but how about native apps (e.g. Windows executable program, mobile apps)? From Mark's answer on ...
1
vote
1answer
1k views

Is hashing a DLL useful to protect from DLL hijacking?

I want to make sure that the dynamic link libraries used by my application can't be replaced with other libraries of the same name, in order to inject malicious code. Therefore, I thought about ...
18
votes
7answers
4k views

Why are security-crucial software written in unsafe languages?

This may be a stupid question, but... Why are security-crucial software written in languages such as C and C++? I understand why, say, an embedded system might need a low-level language to make the ...
4
votes
1answer
1k views

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually). I'm trying to navigate the labyrinth of US export regualtions - something I ...
3
votes
1answer
483 views

Software library for 1-2 oblivious transfer?

I'm looking for software libraries that support 1-2 oblivious transfer of a single bit between two parties. Googling seems to bring up lecture notes, explanations, and research papers but not ...
8
votes
2answers
5k views

security implications of Java's System.load vs System.loadLibrary

Jumping from https://stackoverflow.com/questions/7016391/difference-between-system-load-and-system-loadlibrary-in-java What are the security implications of both approach ? System.loadLibrary("...
5
votes
1answer
1k views

Using OpenSSL as a library versus calling output from standalone command in a program being written

In another question about how to use OpenSSL programmatically a community member was writing, one suggestion was to use the system() command whereas another was to include the C headers and work with ...