60

It's just part of the filename, just like letters, numbers, and other special characters can be part of the filename. It's conventional to create "backups" of files before editing them by appending a tilde, so in case you mess something up, you have a previous version to restore. In Bash this can be easily done with cp index.php{,~} which expands to cp ...


59

You're hurting yourself. The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't make them pay for traffic), but you will be billed for traffic and CPU/storage/memory, or your server's hoster has a "fair usage" clause, under which your server's ...


50

~ is a common suffix added to filenames for backup or temporary copies of files. This may be a manual backup or one created by an editor or other tool. Although most file systems don't have a concept of "file extensions", a lot of software uses the part of a filename after the first or last . to determine the file type and what to do with it. In this case, ...


41

This would be impossible. It is fundamental for your app to contain all the instructions necessary to use your API. Anyone with enough skill and time will be able to extract these secrets and create their own client.


39

Update: It seems like a Finnish man was able to demonstrate this "attack" by issuing a certificate for the domain live.fi by having the address hostmaster@live.fi. Last year, I made a bet with a friend that I can get a browser-trusted certificate with his domain name in order to launch a successful MiTM attack on his login form to steal his password. Long ...


35

Reverting the changes every 30 minutes is not a solution. You absolutely need to find out the root cause and stop this from happening by removing the vulnerability or the persistence. This may include monitoring the logs and other forensics, but also a fresh installation of WordPress (or in worst case the entire server) might be required.


29

My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to create a large number of fake posts or articles or whatever else the app does. Nothing Does the fact that the traffic to the service will eventually go via ...


28

Consider that serving anything other than HTTP 404 page for /administrator/index.php may get your server in the lists of potential targets, which means even more scans in the future. Since crackers who pay for such lists don't need to scan millions of IPs themselves, they can concentrate on you with much more sophisticated attacks than checking for the ...


26

I think I can help resolve your concerns. So what are we trying to protect? We're trying to protect ourselves from an attacker breaking into user accounts via our web services. Specifically, how might we protect ourselves from an attacker sufficiently motivated to reverse-engineer our mobile app in the wild? You can't. It's that simple. Trying to do the ...


25

The API should not expose any internal information, i.e stack traces or similar. As you really noticed they might leak information which might be used to attack the implementation. Moreover they are usually only relevant for the developer of the API and not the user of the API. These users expect proper error messages anyway and not some strange message ...


24

It’s pretty easy and straightforward to create one’s own client regardless of whether REST or SOAP is used, as long as your Existing Client is available for everyone in the Play Store. Just capture the HTTP traffic from an Android device using Fiddler, and engineer your own client based on the captured traffic. Even HTTPS traffic can be easily decrypted ...


21

doesn't use Https protocol The website you provided does support HTTPS, but not HSTS or HTTP to HTTPS redirect. That is why you could be directed to an unsecured HTTP site. SSL Labs analysis. Moreover your password can be at maximum 10 characters Oddly this is common of online banking. I have experienced a bank which defined the following rules for a ...


20

The only way to determine the other name based virtual host on the same IP address is to perform forward lookups to all domains and see the A records with the same IP addess. Only after that it's possible to see whether the server is responding to all these hostnames through the Host header or not, and is the reponse same for every hostname or are there ...


19

s3.amazonaws.com is an endpoint for a cloud file storage product offered by Amazon Web Services (AWS) and is used by many websites and apps (albeit usually behind the scenes, but you can serve files from it directly too). Seeing references to that domain is definitely not inherently malicious, however given that you can store just about any file in S3 there'...


18

From what you describe, what they do is that they tunnel data in some SSL (this is reasonable) but add an extra encryption layer in Javascript (this is not reasonable). The whole reasoning is faulty. Indeed, either the SSL ensures security of transmissions, in which case the extra layer is simply useless; or the SSL does not ensure security of transmission, ...


17

From a security perspective, no, there's no way to do this. No matter how much obfuscation you put on the code and protocols, the fact is that the code to access the API and the network traffic produced when the API is accessed is in the hands of your users, and they can use whatever reverse-engineering tools they want on it. From a business perspective, ...


16

As already said, its probably not worth it, but it is a very interesting topic to think about. There was a very good talk on that topic at DEF CON 21 called "Making Problems for Script Kiddies and Scanner Monkeys" which you can find here: https://www.youtube.com/watch?v=I3pNLB3Cq24 Several ideas are presented, and some are very simple and effective like ...


13

There seems to be a bit of confusion here and other places, so I'm adding this answer in hopes that it will clarify the situation for other users. There are two types of API secrets that might be used. The use case that most of the answers on this page are discussing is a secret key that is used to sign and verify messages using an algorithm such as HMAC. ...


12

The class of malware which prevents itself or other programs from being seen is called rootkits. They work by replacing key system calls that are used to detect what is going on in the system. For example, when you go to Task Manager, Task Manager asks Windows for a list of programs running on the system, but suppose that another bad program was able to ...


12

RESTful services are "stateless", except when it comes to authentication. Authentication is a state that cannot be avoided and so it is allowed in a RESTful design. In RESTful services, this state is often implemented as a authentication token or in the case of OAuth: an authentication-bearer token. This token should be unknown to the attacker and is ...


12

Forget the gigabytes. Use minutes or hours of delay. Many web servers have modules that introduce artificial delays (aka tarpits). It occupies a thread/process on your server, but it comforts a few other servers on the Internet who would have been probed during the time. Of course other bots and other threads of this bot continue their work, so the annoyance ...


12

My question is what prevents users from intercepting their regular post form the app Nothing. Does the fact that the traffic to the service will eventually go via TLS make this a non-issue? If you make it for an mobile platform (Android/iOS), that makes it much harder (but not impossible). If you make it for the browser, this doesn't add much ...


11

@ThiefMaster's answer does a great job of enumerating the risks of using an externally controlled Content-- which basically fall under the category of executing or displaying arbitrary code and content on a user's browser. I will mainly focus on your last question: How are those risk mitigated? which was unaddressed-- a lot has since changed (in 4 years). ...


11

Yes, you should absolutely hash your API keys. In effect, they are your passwords and should be treated as such. And note that's hashed - not encrypted. You never need to decrypt the API keys, hence you should not be able to. As saghaulor says, you need to make sure you use a version 4 UUID (a random one, that is) and that you use a cryptographically secure ...


10

Attacker can use to auto submittable remote form with the default values. like this : <form name="x" action="http://site/index" method="post"> <input type="hidden" name='search' value='<script>alert(/XSS/)</script>'> </form> <script>document.x.submit();</script> <form name="x" action="http://site/index" method="...


10

The ETag header is used for effective caching of server side resources by the client. The server send an ETag header in the HTTP response to some string and the client caches the response content and associates the string given in the ETag header with it. If the client wants to access the same resource again it will send the given string within some If-None-...


10

Presuming that is the actual login page: Yes, this is very insecure by modern standards, and even more so for anything involving actual monetary transactions. There is always the slim possibility that the page loads on HTTP but then submits to a server protected by HTTPS. That would still be bad but would at least be "better". However, I confirmed that ...


10

Generally speaking, you shouldn't ask and hold user data (especially PII) that you don't need, this is even more true now under GDPR (if it applies in your scenario) but it's always been the case in security. The lesser the data, the lesser the risk. When you hash passwords, you lose knowledge about its plaintext version and the fact that you're asking ...


9

In order to hide your IP address from users you need to make sure that they don't access your server directly, i.e. put some kind of reverse proxy in between. For public sites this can be done by putting a CDN like Cloudflare in front of it. For internally hosted sites this can by done by using services like ngrok or similar.


Only top voted, non community-wiki answers of a minimum length are eligible