61

It's just part of the filename, just like letters, numbers, and other special characters can be part of the filename. It's conventional to create "backups" of files before editing them by appending a tilde, so in case you mess something up, you have a previous version to restore. In Bash this can be easily done with cp index.php{,~} which expands to cp ...


59

You're hurting yourself. The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't make them pay for traffic), but you will be billed for traffic and CPU/storage/memory, or your server's hoster has a "fair usage" clause, under which your server's ...


50

~ is a common suffix added to filenames for backup or temporary copies of files. This may be a manual backup or one created by an editor or other tool. Although most file systems don't have a concept of "file extensions", a lot of software uses the part of a filename after the first or last . to determine the file type and what to do with it. In this case, ...


40

Update: It seems like a Finnish man was able to demonstrate this "attack" by issuing a certificate for the domain live.fi by having the address hostmaster@live.fi. Last year, I made a bet with a friend that I can get a browser-trusted certificate with his domain name in order to launch a successful MiTM attack on his login form to steal his password. Long ...


40

This would be impossible. It is fundamental for your app to contain all the instructions necessary to use your API. Anyone with enough skill and time will be able to extract these secrets and create their own client.


37

The best practice is: The basic idea. Create an API key (a 128-bit symmetric key) for each separate user account. This key needs to be securely stored on the server, and also securely stored on the user's client. For each request made by the client, add an extra request parameter that has a "signature" on the entire request. The "signature" should be ...


31

My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to create a large number of fake posts or articles or whatever else the app does. Nothing Does the fact that the traffic to the service will eventually go via ...


28

Consider that serving anything other than HTTP 404 page for /administrator/index.php may get your server in the lists of potential targets, which means even more scans in the future. Since crackers who pay for such lists don't need to scan millions of IPs themselves, they can concentrate on you with much more sophisticated attacks than checking for the ...


25

I think I can help resolve your concerns. So what are we trying to protect? We're trying to protect ourselves from an attacker breaking into user accounts via our web services. Specifically, how might we protect ourselves from an attacker sufficiently motivated to reverse-engineer our mobile app in the wild? You can't. It's that simple. Trying to do ...


24

It’s pretty easy and straightforward to create one’s own client regardless of whether REST or SOAP is used, as long as your Existing Client is available for everyone in the Play Store. Just capture the HTTP traffic from an Android device using Fiddler, and engineer your own client based on the captured traffic. Even HTTPS traffic can be easily decrypted ...


23

The API should not expose any internal information, i.e stack traces or similar. As you really noticed they might leak information which might be used to attack the implementation. Moreover they are usually only relevant for the developer of the API and not the user of the API. These users expect proper error messages anyway and not some strange message ...


21

doesn't use Https protocol The website you provided does support HTTPS, but not HSTS or HTTP to HTTPS redirect. That is why you could be directed to an unsecured HTTP site. SSL Labs analysis. Moreover your password can be at maximum 10 characters Oddly this is common of online banking. I have experienced a bank which defined the following rules for a ...


19

From what you describe, what they do is that they tunnel data in some SSL (this is reasonable) but add an extra encryption layer in Javascript (this is not reasonable). The whole reasoning is faulty. Indeed, either the SSL ensures security of transmissions, in which case the extra layer is simply useless; or the SSL does not ensure security of transmission, ...


18

A SIM card is a smart card. It follows all the relevant standards for smart cards, it is produced by smart card vendors. A smart card is "just" a tamper-resistant computer. It has its own CPU, RAM, ROM, storage area (often EEPROM). Power and clock are provided from the outside. The device is supposed to be resistant to physical extraction of the internally ...


17

No. The API keys need to be stored in cleartext. They are not passwords: they are cryptographic keys. These keys are used for things like authenticating requests (using SHA1-HMAC). The server needs to know the crypto key to apply the cryptographic algorithms. Therefore, the API key needs to be stored in cleartext on the server. If the server stored ...


17

s3.amazonaws.com is an endpoint for a cloud file storage product offered by Amazon Web Services (AWS) and is used by many websites and apps (albeit usually behind the scenes, but you can serve files from it directly too). Seeing references to that domain is definitely not inherently malicious, however given that you can store just about any file in S3 there'...


17

From a security perspective, no, there's no way to do this. No matter how much obfuscation you put on the code and protocols, the fact is that the code to access the API and the network traffic produced when the API is accessed is in the hands of your users, and they can use whatever reverse-engineering tools they want on it. From a business perspective, ...


16

As already said, its probably not worth it, but it is a very interesting topic to think about. There was a very good talk on that topic at DEF CON 21 called "Making Problems for Script Kiddies and Scanner Monkeys" which you can find here: https://www.youtube.com/watch?v=I3pNLB3Cq24 Several ideas are presented, and some are very simple and effective like ...


13

Hashing is not storage; it irreversibly destroys data. We can get away with calling password hashing as "password storage" because when we actually need the password, we have a handy human operator to type it in. Indeed, when we hash the password we do not store the password, but only a token sufficient to verify the typed-in password. An API key must be ...


13

My question is what prevents users from intercepting their regular post form the app Nothing. Does the fact that the traffic to the service will eventually go via TLS make this a non-issue? If you make it for an mobile platform (Android/iOS), that makes it much harder (but not impossible). If you make it for the browser, this doesn't add much ...


12

The class of malware which prevents itself or other programs from being seen is called rootkits. They work by replacing key system calls that are used to detect what is going on in the system. For example, when you go to Task Manager, Task Manager asks Windows for a list of programs running on the system, but suppose that another bad program was able to ...


12

RESTful services are "stateless", except when it comes to authentication. Authentication is a state that cannot be avoided and so it is allowed in a RESTful design. In RESTful services, this state is often implemented as a authentication token or in the case of OAuth: an authentication-bearer token. This token should be unknown to the attacker and is ...


12

Forget the gigabytes. Use minutes or hours of delay. Many web servers have modules that introduce artificial delays (aka tarpits). It occupies a thread/process on your server, but it comforts a few other servers on the Internet who would have been probed during the time. Of course other bots and other threads of this bot continue their work, so the annoyance ...


11

Since you are usually loading CSS, JavaScript and graphics from a CDN anyone with root-like permissions on the CDN servers (i.e. the company running the CDN) can: replace your images with other ones, such as porn or other things you don't want your users to see on your website replace your CSS to load said images, mess up the design, etc. - for IE and ...


11

If you're talking about SSL, the answer is why not? If I had the choice, I'd prefer that every site on the internet provided HTTPS. Is it strictly necessary? Of course not. Does it stop anyone from snooping on my content? Yes. Does it reduce the chances of an attacker injecting content into a page via man-in-the-middle? Yes. Are either of these scenarios ...


11

Generally speaking, you shouldn't ask and hold user data (especially PII) that you don't need, this is even more true now under GDPR (if it applies in your scenario) but it's always been the case in security. The lesser the data, the lesser the risk. When you hash passwords, you lose knowledge about its plaintext version and the fact that you're asking ...


10

Answer to the original question: No, it's not a security risk for your employees to use Disqus etc. -- at least, no more than any other form of communication. Of course, if employees post sensitive corporate information on these systems, then that may harm the corporation's interests. But you could say the same of any other means of communication. ...


10

Am I essentially giving scorecardresearch.com access to my users and user's cookies for my domain, since the script tag is on my page? Yes. Any script included in your page either directly or indirectly (via disqus) has full access to interfere with the user's experience for everything on the hostname it is included on. Stealing client-side (non-httponly) ...


10

Presuming that is the actual login page: Yes, this is very insecure by modern standards, and even more so for anything involving actual monetary transactions. There is always the slim possibility that the page loads on HTTP but then submits to a server protected by HTTPS. That would still be bad but would at least be "better". However, I confirmed that ...


Only top voted, non community-wiki answers of a minimum length are eligible