The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

138

Yes. Any attack which has as a goal to deny the normal usage of a service by legitimate users is by definition a DoS (Denial of Service).


60

DDoS (Distributed DoS) is characterised by floods creating a DoS (in all available definitions). A single node causing a flood successfully is kind of rare. But DoS can be caused by a broad range of triggers. CVSS even has an example of a software crash classified as DoS for you: Due to a flaw in the handler function for RPC commands, it is possible ...


35

Indeed, Math.random() is not cryptographically secure. Definition of Math.random() The definition of Math.random() in the ES6 specification left a lot of freedom about the implementation of the function in JavaScript engines: Returns a Number value with positive sign, greater than or equal to 0 but less than 1, chosen randomly or pseudo randomly with ...


29

This is relevant but doesn't necessarily answer 100% of your question: https://security.stackexchange.com/a/166798/149676 The short of it is that as long as authentication isn't automatic (typically provided by the browser) then you don't have to worry about CSRF protection. If your application is attaching the credentials via an Authorization header then ...


24

I've taken a quick look, and this appears to be completely benign, if somewhat annoying. It's not an attack as Michael suggested in his answer. What has happened is that someone purchased a domain (canadaehtees.com) and pointed the DNS records for that domain at the IP address that currently hosts your website (fastslots.co). Why? It could be a simple ...


20

You can attack these using the Z3 theorem prover. I've implemented such an attack in Python in order to predict values in a lottery simulator. As mentioned previously, XorShift128+ is used in most places now, so that is what we are attacking. You begin by implementing the normal algorithm so you can understand it. def xs128p(state0, state1): s1 = ...


19

Generally, CSRF happens when a browser automatically adds headers (i.e: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that need to be added manually, would prevent you from CSRF. Of course, but sort of off-topic, if you have a XSS vulnerability, an attacker could still access these ...


17

I created the Node Scrypt module. HMAC adds additional security. Using it also lends the scheme to be used as a header in an encrypted file format (like it is done in tarsnap) and not just in an authentication server's database. Also, Colin Percival (who created scrypt) uses this scheme to verify (I actually just copied it from him). To explain why HMAC is ...


14

Here's is one approach I've used in this situation: path.normalize() handles all . and .., so you can be sure that if either one is present, it will be at the front of the path. Remove any ../../ from the front of your path. So: var safeSuffix = path.normalize(unsafeSuffix).replace(/^(\.\.(\/|\\|$))+/, ''); var safeJoin = path.join(basePath, safeSuffix); ...


11

You are correct that Math.random() is not secure. If you want a CSPRNG in Node.js, crypto.randomBytes() is what you're looking for.


10

Could malicious code be pushed to NPM? Most certainly. If a package is to become compromised (or a new one is published), installed, and used any code provided with that package could be executed. So if they run it in the node.js context for example, the attack has access to many machine level features such as the file system, system information, file ...


10

Quite often security is looked at as providing three properties: Availability Integrity Confidentiality In your case, you've found something that allows a user to affect the availability of the service. Depending upon what the service provides, that might be annoying or it might be catastrophic. Quite often failed services will be automatically restarted. ...


9

I wanted to add one more important detail not explicitly stated in the other answers. You said this: It works by sending the server some crafted payload, which makes the server code throw an error, and due to lack of error handling - It crashes (until someone runs it again). (emphasis mine). That caveat is important because the way such services ...


8

Previous answers are rock solid. I'll jump in here to provide a more context and little caveat. There are lots of ways to using JWT; session management is one of them. Although it presents a few drawbacks when dealing with timeouts and advanced requirements like re-authentication. Also, I've seen JWT placed in Cookies. As other's have stated, CSRF ...


7

Stripping out HTML tags is not a sufficient approach to protecting yourself from XSS. Consider the following input: <scri<script>pt> If you strip out the <script> tag, another script tag is created. This is just one example - there are many other attacks that could be used. You should look into protecting yourself from XSS on the ...


7

The client-side socket.io library does not have the ability to .join() a room. That ability is only in the server-side library (because that's where the rooms are maintained) and thus the only place it can actually be processed. So, the only way to join a room is to make your own message for a join request from client to server and process that message ...


6

This looks a lot like a cross-site request forgery website, trying to lure visitors in executing requests to your site without them knowing they are actually sending requests to your domain. Imagine for example that 'https://canadaehtees.com' has a button on his site 'place free bet'. In case a visitor clicks that button (or automatically triggers the ...


6

What I would say about the options that you outline is that HTTP Auth with SSL is a simpler but less flexible option and Oauth2 is more complex but has more flexibility in what you can achieve with it. One example, as you've noted in your ASCII art diagram, with OAuth2 it is possible to create a token which can be used in place of the password to ...


6

It's an attempt at command injection. IFS is basically a space in this situation, and && executes multiple commands. So you have: /language/Swedish && echo 610cker > qt && tar /string.js Which tries to execute three commands: /language/Swedish <-- where the injection takes place echo 610cker > qt <-- write 610cker ...


5

It's a malicious bot, that is trying to scan web application for security vulnerabilities. Look at these links for more information about blocking it: https://serverfault.com/questions/700404/huge-traffic-from-post-123-249-24-233-post-ip-port-php https://gist.github.com/renancouto/0ad35842f1c536c1dbbe


5

If an OAuth 2.0 token is compromised, you only need to concern yourself for the TTL of the token. If an HTTP Basic Auth header is compromised, the credentials do not expire. You would manually need to change your client_id and secret, and that's if you even knew or thought they were compromised. And it's likely you would need to change your client code ...


5

You are correct this implementation of constant-time string comparison will leak information about the length of some string that is being compared against an attacker controlled string. However, if this is checking strings for authentication purposes, you never should be comparing raw strings. You would first hash (preferably with a salted key-...


4

Socket.io creates a WebSocket, and WebSockets follow the normal Same-Origin Policy rules. However, it is possible to make a WebSocket into a cross-origin resource using the Access-control-allow-origin HTTP header, which commonly known as CORS. If for some reason CORS was being used to create a cross-origin WebSocket, then it is possible that this ...


4

Math.random() is usually seeded from the current time of day. Therefore there is a chance that collisions will happen for objects that are generated around the same time each day. From a security perspective, this means that these "random" values will be predictable by an attacker. Even if seeded with something else, a non cryptographically secure pseudo ...


4

What you want is something that ensures integrity of your data. The most common solution for this is to use an HMAC, that is a keyed digest. NodeJS has an API that calculates HMACs. Compared to a "salted" hash, where you would keep the salt private, HMACs are designed to be secure even against some additional attacks, such as length extension attacks. As ...


4

Sounds like you need to authenticate the device, rather than a user. Also sounds like you have complete control over what is installed on the kiosk. I would approach this problem using client certificates. You would simply need to install a client cert on the kiosk (in the machine store, if it's Windows) and configure the web server to map the client ...


4

The main concept of your flow (magic links) is one of the more well known password-less alternatives for authentication. The general consensus seems to be that the security of such schemes (as has been noted in comments) is not any worse than that of a system that allows 'forgot password' email reset mechanisms. This does make sense considering that the ...


4

Your attack is basically the definition of DOS, it literally denies service and you are using the term correctly. Consuming bandwidth is a naive approach that does not require the sever to have a specific vulnerability, but is certainly not the only one. Here is a real CVE about Apache describing a similar DOS attack (crashes with segfault) using that ...


3

The test you have: if (!username || !password) Checks if either username and password values are javascript falsey values. A falsey value in javascript is any one of these : null, undefined, 0, false, NaN or an empty string. An empty string in javascript is a zero length string so if it has at least one character in it (any character will suffice), then ...


3

If you are allowing shell commands to be executed from the browser, then what you are effectively doing is allowing the user to log-in and execute commands on your system as the user that the web-server is running as. Ask yourself if that is what you want to do? The answer is definitely no. No-way. No, not never. In fact, hackers spend a lot of time trying ...


Only top voted, non community-wiki answers of a minimum length are eligible