Hot answers tagged

137

Yes. Any attack which has as a goal to deny the normal usage of a service by legitimate users is by definition a DoS (Denial of Service).


60

DDoS (Distributed DoS) is characterised by floods creating a DoS (in all available definitions). A single node causing a flood successfully is kind of rare. But DoS can be caused by a broad range of triggers. CVSS even has an example of a software crash classified as DoS for you: Due to a flaw in the handler function for RPC commands, it is possible ...


56

This is relevant but doesn't necessarily answer 100% of your question: https://security.stackexchange.com/a/166798/149676 The short of it is that as long as authentication isn't automatic (typically provided by the browser) then you don't have to worry about CSRF protection. If your application is attaching the credentials via an Authorization header then ...


36

Indeed, Math.random() is not cryptographically secure. Definition of Math.random() The definition of Math.random() in the ES6 specification left a lot of freedom about the implementation of the function in JavaScript engines: Returns a Number value with positive sign, greater than or equal to 0 but less than 1, chosen randomly or pseudo randomly with ...


27

Generally, CSRF happens when a browser automatically adds headers (i.e: Session ID within a Cookie), and then made the session authenticated. Bearer tokens, or other HTTP header based tokens that need to be added manually, would prevent you from CSRF. Of course, but sort of off-topic, if you have a XSS vulnerability, an attacker could still access these ...


24

I've taken a quick look, and this appears to be completely benign, if somewhat annoying. It's not an attack as Michael suggested in his answer. What has happened is that someone purchased a domain (canadaehtees.com) and pointed the DNS records for that domain at the IP address that currently hosts your website (fastslots.co). Why? It could be a simple ...


22

You can attack these using the Z3 theorem prover. I've implemented such an attack in Python in order to predict values in a lottery simulator. As mentioned previously, XorShift128+ is used in most places now, so that is what we are attacking. You begin by implementing the normal algorithm so you can understand it. def xs128p(state0, state1): s1 = ...


18

Here's is one approach I've used in this situation: path.normalize() handles all . and .., so you can be sure that if either one is present, it will be at the front of the path. Remove any ../../ from the front of your path. So: var safeSuffix = path.normalize(unsafeSuffix).replace(/^(\.\.(\/|\\|$))+/, ''); var safeJoin = path.join(basePath, safeSuffix); ...


17

I created the Node Scrypt module. HMAC adds additional security. Using it also lends the scheme to be used as a header in an encrypted file format (like it is done in tarsnap) and not just in an authentication server's database. Also, Colin Percival (who created scrypt) uses this scheme to verify (I actually just copied it from him). To explain why HMAC is ...


15

You are correct that Math.random() is not secure. If you want a CSPRNG in Node.js, crypto.randomBytes() is what you're looking for.


11

Previous answers are rock solid. I'll jump in here to provide a more context and little caveat. There are lots of ways to using JWT; session management is one of them. Although it presents a few drawbacks when dealing with timeouts and advanced requirements like re-authentication. Also, I've seen JWT placed in Cookies. As other's have stated, CSRF ...


10

Could malicious code be pushed to NPM? Most certainly. If a package is to become compromised (or a new one is published), installed, and used any code provided with that package could be executed. So if they run it in the node.js context for example, the attack has access to many machine level features such as the file system, system information, file ...


10

Quite often security is looked at as providing three properties: Availability Integrity Confidentiality In your case, you've found something that allows a user to affect the availability of the service. Depending upon what the service provides, that might be annoying or it might be catastrophic. Quite often failed services will be automatically restarted. ...


10

Public key: that's the easy part, it can be almost anywhere (known URL, some type of file store like S3/GCS/..., even source control). The only concern is to make sure it is not modified, but it can be read by anyone. Private key: this is where it gets tricky. The private key should be as safe as possible with access as limited as possible. If someone reads ...


9

I wanted to add one more important detail not explicitly stated in the other answers. You said this: It works by sending the server some crafted payload, which makes the server code throw an error, and due to lack of error handling - It crashes (until someone runs it again). (emphasis mine). That caveat is important because the way such services ...


7

Stripping out HTML tags is not a sufficient approach to protecting yourself from XSS. Consider the following input: <scri<script>pt> If you strip out the <script> tag, another script tag is created. This is just one example - there are many other attacks that could be used. You should look into protecting yourself from XSS on the ...


7

The client-side socket.io library does not have the ability to .join() a room. That ability is only in the server-side library (because that's where the rooms are maintained) and thus the only place it can actually be processed. So, the only way to join a room is to make your own message for a join request from client to server and process that message ...


6

What I would say about the options that you outline is that HTTP Auth with SSL is a simpler but less flexible option and Oauth2 is more complex but has more flexibility in what you can achieve with it. One example, as you've noted in your ASCII art diagram, with OAuth2 it is possible to create a token which can be used in place of the password to ...


6

This looks a lot like a cross-site request forgery website, trying to lure visitors in executing requests to your site without them knowing they are actually sending requests to your domain. Imagine for example that 'https://canadaehtees.com' has a button on his site 'place free bet'. In case a visitor clicks that button (or automatically triggers the ...


6

It's an attempt at command injection. IFS is basically a space in this situation, and && executes multiple commands. So you have: /language/Swedish && echo 610cker > qt && tar /string.js Which tries to execute three commands: /language/Swedish <-- where the injection takes place echo 610cker > qt <-- write 610cker ...


6

The main concept of your flow (magic links) is one of the more well known password-less alternatives for authentication. The general consensus seems to be that the security of such schemes (as has been noted in comments) is not any worse than that of a system that allows 'forgot password' email reset mechanisms. This does make sense considering that the ...


5

It's a malicious bot, that is trying to scan web application for security vulnerabilities. Look at these links for more information about blocking it: https://serverfault.com/questions/700404/huge-traffic-from-post-123-249-24-233-post-ip-port-php https://gist.github.com/renancouto/0ad35842f1c536c1dbbe


5

Socket.io creates a WebSocket, and WebSockets follow the normal Same-Origin Policy rules. However, it is possible to make a WebSocket into a cross-origin resource using the Access-control-allow-origin HTTP header, which commonly known as CORS. If for some reason CORS was being used to create a cross-origin WebSocket, then it is possible that this ...


5

If an OAuth 2.0 token is compromised, you only need to concern yourself for the TTL of the token. If an HTTP Basic Auth header is compromised, the credentials do not expire. You would manually need to change your client_id and secret, and that's if you even knew or thought they were compromised. And it's likely you would need to change your client code ...


5

You are correct this implementation of constant-time string comparison will leak information about the length of some string that is being compared against an attacker controlled string. However, if this is checking strings for authentication purposes, you never should be comparing raw strings. You would first hash (preferably with a salted key-...


4

If you are allowing shell commands to be executed from the browser, then what you are effectively doing is allowing the user to log-in and execute commands on your system as the user that the web-server is running as. Ask yourself if that is what you want to do? The answer is definitely no. No-way. No, not never. In fact, hackers spend a lot of time trying ...


4

Math.random() is usually seeded from the current time of day. Therefore there is a chance that collisions will happen for objects that are generated around the same time each day. From a security perspective, this means that these "random" values will be predictable by an attacker. Even if seeded with something else, a non cryptographically secure pseudo ...


4

What you want is something that ensures integrity of your data. The most common solution for this is to use an HMAC, that is a keyed digest. NodeJS has an API that calculates HMACs. Compared to a "salted" hash, where you would keep the salt private, HMACs are designed to be secure even against some additional attacks, such as length extension attacks. As ...


4

Sounds like you need to authenticate the device, rather than a user. Also sounds like you have complete control over what is installed on the kiosk. I would approach this problem using client certificates. You would simply need to install a client cert on the kiosk (in the machine store, if it's Windows) and configure the web server to map the client ...


4

Three words: Supply Chain Management. Except that in our case the "supply" is dependency or "third party libraries". This isn't a unique problem to npm. This a general problem in software development. It's the equivalent of googling for a manufacturer of "screws" then use the first manufacturer of "screws" you see, don't ask about the specs of the "screws",...


Only top voted, non community-wiki answers of a minimum length are eligible