Hot answers tagged

53 votes

How to deal with this fundamental problem with the advice: "Don't trust obscure PHP libraries that nobody uses!"?

You say that you don't have a choice, but that's not true. You could write all the code you need yourself. Or you could pay a trusted professional to write the code for you. Or you could could pay a ...
  • 15.5k
41 votes
Accepted

How can I ensure my dll has not been modified?

For Windows binaries, I would suggest to digitally sign the file. Where you use certificates, almost the same technology of HTTPS. Introduction to Code Signing SignTool Then you should use Windows ...
35 votes

How to deal with this fundamental problem with the advice: "Don't trust obscure PHP libraries that nobody uses!"?

I will first address the generic part of your question, and then the specific PHP part. Don't trust obscure PHP libraries that nobody uses! It is just the usual gain/risk question. If the risk is ...
30 votes

How can I ensure my dll has not been modified?

With the low level of protection the MAC address offers, I wouldn't bother. It is less effort to change the MAC address than it is to exchange your DLL.
16 votes

How can I ensure my dll has not been modified?

Hashes do not change between file systems. Check the SHA1 hash of the file against the known "good" value in your code and you should be away!
  • 1,168
14 votes
Accepted

Do outdated Javascript libraries present a risk for my web application?

Using any out of date software is inherently a security risk; any flaws patched between the version you're running and the latest version can be exploited. For example, maybe there's a specific ...
  • 5,724
12 votes

How to deal with this fundamental problem with the advice: "Don't trust obscure PHP libraries that nobody uses!"?

The advice is basically a mapping of trust principles one has in the "real" world into the world of software development: Don't blindly trust someone but check the reputation. It is better to trust ...
7 votes

How can I ensure my dll has not been modified?

If you goal is to prevent credentials from being used on other PCs, then take a look at Windows Data protection API. With it, you can encrypt your credentials, or any other data, and it will be ...
  • 171
7 votes

Do people even exist who actually vet all the updates to their open source software?

Reviewing diffs between versions of open-source libraries and packages seems very excessive to me. The amount of time that it takes to do it, along with the necessary knowledge of the architecture and ...
  • 1,042
6 votes

What software can be used to read data from smart cards?

In the past, i have used CardPeek for this. It is easily extensible through LUA and can therefore adapt to unknown cards. It presents the "files" on the card via a TreeView and offers annotations on "...
6 votes

Are devDependencies in Node.js exploitable?

It depends on the vulnerability, and on the threat environment (as is true for every component, not just development ones). Here are a few (generic) examples: A tool that fetches an external script ...
  • 41.3k
5 votes
Accepted

Restrict JS in SVGs

Does anyone know of a way to prevent JS from running inside of an SVG If you embed an SVG as an image, it's guaranteed to not run any contained JS: <img src="https://example.com/dangerous.svg">...
  • 44k
5 votes
Accepted

Can I trust a security hash implementation after testing it with random inputs against another implementation?

Assume the library author can be trusted. Given my random input test above: how likely is it, that the author accidentally introduces a bug with the effect that there are inputs for which a wrong hash ...
5 votes

How much can we trust open source implementations of crypto (security) libraries?

How much can we trust open source implementations of crypto (security) libraries? Much better than closed source implementation. When it comes to security that really matters, you have to follow the ...
  • 31.2k
5 votes
Accepted

LibTomCrypt weird ECC Keys

As you can see from https://github.com/libtom/libtomcrypt/blob/develop/src/pk/ecc/ecc_export.c it's ASN.1/DER encoded data you're printing, which contains the same data besides the 'k' parameter. So ...
  • 111
4 votes

Is there a more precise approach to generate signatures for ClamAV, than regex signatures?

It seems that ClamAV supports both YARA and OpenIOC. These two methods of writing signatures will let you take a much more specific look rather than just byte sequences. Check out this SANS paper for ...
  • 4,991
4 votes

Is it safe to store VeraCrypt or TrueCrypt container inside RAR - could this method corrupt the file?

Yes, this is risk free. Not using compression (as you plan to do) helps speed up the process as encrypted data cannot be compressed. However I would suggest you do not use an extra password. Any extra ...
  • 65k
4 votes
Accepted

Static vs Dynamic Linking

Using a shared library is a good idea for getting security fixes without having to recompile all the applications that use the library -- but this holds only if there is indeed a shared library that ...
  • 169k
4 votes

What to do when you simply cannot trust anyone or anything anymore?

Use audited and approved libraries. That's the answer. There are paid product/services (e.g. Sonatype, Black Duck) that will run automated tests on random libraries that you submit before using. And ...
  • 125k
4 votes
Accepted

SUID Priv Escalation - LD_LIBRARY_PATH versus ldconfig and /etc/ld.so.conf

Why did the first method fail in escalating my privilege to root? Any setuid binary that runs with elevated privileges will disable LD_LIBRARY_PATH and a number of other security-related ...
  • 65k
4 votes
Accepted

Are devDependencies in Node.js exploitable?

While running the npm start command and the dev env set to development or running a special command (like npm run dev, where dev is a special script which starts up a local development environment as ...
3 votes

Test for OWASP Using Components with Known Vulnerabilities?

Whilst it is sometimes possible to identify this issue whilst doing an external black-box web application review, for example by identifying outdated JavaScript libraries using retire.js, or ...
  • 61.3k
3 votes
Accepted

How can the validity and safety of a software library be checked?

You have basically two options (provided you can verify your download, e.g., using a PGP signature): Read the code yourself Find some way to trust the developer Reading the code yourself will not ...
  • 3,277
3 votes
Accepted

How much can we trust open source implementations of crypto (security) libraries?

You have three tradeoffs: PBKDF vs another algorithm, open source vs closed, and the availability of test vectors. SCrypt or BCrypt may give you somewhat more security than PBKDF2. On the other ...
3 votes
Accepted

Disclosing used Libaries in App

If someone were to find a vulnerability that would affect a specific library that could maybe pose a threat to our app The defense against that is not to use the library. Using the library and not ...
2 votes
Accepted

Is native app vulnerable to FREAK attack? If yes, how to detect it as a user?

Yes, it's the same for native apps. On Windows, you can simply assume that the application is using SChannel and be right 99% of the time; the same for MacOSX/iOS and Secure Transport. On Linux, you ...
  • 34.4k
2 votes

Vulnerability in Composer/MeekroDB WhereClauseTest.php?

Take a look at what that PHP script does: https://github.com/SergeyTsalkov/meekrodb/blob/master/simpletest/WhereClauseTest.php It's a way to open the door to the DB by adding known usernames and ...
  • 125k
2 votes

Do outdated Javascript libraries present a risk for my web application?

I say no, here's why. Libraries just run code that the browser lets them. They should never be able to do bad things. If a lib reveals a security problem you're either not using it correctly (ex user ...
  • 2,658
2 votes

Do outdated Javascript libraries present a risk for my web application?

That depends on the (known) vulnerabilities in the outdates JavaScript library. Often newer versions fix (minor) security issues as well. A great list to check your library against, is a tool called ...
  • 6,274
2 votes

Malicious .so Library creation in CVE-2017-7494 Sambacry

Here you can see the code of a poc library.so and the process to compile https://github.com/omri9741/cve-2017-7494/blob/master/payload/

Only top scored, non community-wiki answers of a minimum length are eligible