mr.spuratic
  • Member for 9 years
  • Last seen more than a week ago
  • Ireland
Can "cat-ing" a file be a potential security risk?
Accepted answer
78 votes

Yes, it's a potential risk, see CVE-2003-0063, or CVE-2008-2383 or CVE-2010-2713, or CVE-2012-3515 or OSVDB 3881, or CVE-2003-0020 or any of the similar ones listed here... Some more in comments below ...

View answer
What's an easy way to perform a man-in-the-middle attack on SSL?
Accepted answer
42 votes

Updated: For HTTP you can use Burp Suite's proxy (Java), or mitmproxy. tcpcatcher is a more general Java-based GUI capture and modify proxy which might be closer to your requirements, it includes ...

View answer
Decrypt from cipher text encrypted using RSA
Accepted answer
30 votes

Start with saving the three parts respectively to pub.b64, priv.b64 and blob.b64: $ base64 -d < pub.b64 | openssl asn1parse -inform DER -i 0:d=0 hl=3 l= 158 cons: SEQUENCE 3:d=1 hl=2 l= ...

View answer
How do I secure Apache against the Bash Shellshock vulnerability?
29 votes

Aside from CGI, one overlooked use of sh is in exec() calls, or through the use of system() and popen(), on most Linux systems this means bash. The exec() family of calls are often used with "/bin/sh -...

View answer
How can I protect against email tracking services?
Accepted answer
25 votes

It's all in the knowledgebase: https://web.archive.org/web/20140926051535/http://blog.bananatag.com/knowledgebase/how-opens-work/ We use the same technology as mass-email-marketing companies to ...

View answer
What is the best practice for placing database servers in secure network topologies
24 votes

Agree with Jeff Ferland, database servers should be on their own: you should have a clean network for replication & backup. Pardon my ASCII art, a quick overview of a reasonable ideal: [...

View answer
Credit card forms on HTTP pages a MITM risk?
Accepted answer
24 votes

Yes, that last someone is correct, in addition to encryption (confidentiality) HTTPS gives you the assurances that the form is coming from where you think it is (authentication), and that it has not ...

View answer
Brute force prevention: where and when?
Accepted answer
23 votes

Client side measures are only a partial (and mostly cosmetic) solution, this can only limit non-serious attempts. Any serious attempt will either hit your server directly because a login URL/API was ...

View answer
Is it possible to execute a php script in an image file?
21 votes

Yes, your server could run PHP code within an image file if it is not configured correctly: http://www.phpclasses.org/blog/post/67-PHP-security-exploit-with-GIF-images.html An example from that is ...

View answer
What to do after you get a CVE?
Accepted answer
16 votes

Given you have referenced Github, I will assume this related to some type of As an open source project, a note to oss-sec is a good idea. This will bring it to the attention of most upstream ...

View answer
Which security standards define the time of inactivity before locking the screen
Accepted answer
15 votes

The large standards (ISO, NIST) tend toward one-size fits all, the real intent is to promote careful consideration, and deliberate and informed decision making. Specific values such as these are a ...

View answer
How can SSL vendors limit the amount of servers they can be installed on?
Accepted answer
15 votes

There are no technical reasons for such a limit, it's purely licensing (i.e. revenue, and maintaining market segmentation). There are some considerations relating to the secure transfer of the key ...

View answer
Why OpenSSL can't use /dev/random directly?
15 votes

If you're asking why openssl rand or RAND_bytes() do not simply regurgitate /dev/random or /dev/urandom, it's because their function is to serve only as a PRNG, and they do exactly that: The rand ...

View answer
GHOST: which services are vulnerable, ssh, web server?
Accepted answer
14 votes

One can reasonably conclude (see below) that it will require some detailed analysis to determine if an arbitrary software package is vulnerable, and what configuration or mitigations may apply. Any ...

View answer
Deference Between EAL 1-7 in Common Criteria Standard?
13 votes

The EAL levels are: EAL1 - functionally tested EAL2 - structurally tested EAL3 - methodically tested and checked EAL4 - methodically designed, tested, and reviewed EAL5 - semi-formally designed and ...

View answer
Downsides to using HTTPS
Accepted answer
13 votes

HTTPS gets you confidentiality (encryption), authentication (identity), and integrity (tamper-evident connections). You don't care about so much about the first one in your case, but you should care ...

View answer
Black-box fuzzing a TCP Port running an unknown applicaiton
Accepted answer
12 votes

You are correct: technically, fuzzing is usually regarded as sending invalid or random requests/data, it's implied that you know what you're testing in order to "break" the input. In some terminology (...

View answer
One Time Password Algorithm for Humans
Accepted answer
12 votes

There are some commercial schemes, e.g. GridGuard from SyferLock that claim to do this, but I have never used them (I have no affiliation). This relies on the user choosing correctly from multiple ...

View answer
openssl enc uses md5 to hash the password and the salt
Accepted answer
12 votes

The OpenSSL apps need to be used carefully, they often have old and possibly insecure defaults, at least by contemporary standards. In this case openssl enc defaults to using a digest of MD5 (apps/enc....

View answer
Certificate Chain checking
12 votes

The server will provide its own certificate, and optionally (but recommended) all intermediate CA certs in the chain (aka the CA bundle). It need not provide the root CA cert of the chain, and the ...

View answer
Does a TLS interception proxy present the user's browser with the end server's certificate?
11 votes

As noted by sneak, the client will receive a certificate generated by the proxy, not the original site certificate. The reason being that the proxy cannot impersonate a site with its certificate alone,...

View answer
Documented Best Practices for Reverse Proxy Implementation
11 votes

NIST SP 800-44 Guidelines on Securing Public Web Servers is a good starting point, though it's no magic bullet (and it's a few years old now). In my experience some of the most important requirements ...

View answer
SMIME email decryption key with OpenSSL
Accepted answer
11 votes

Yes you can. This example uses openssl smime with the default RC2 CBC with a 40-bit key. The newer cms sub-command behaves slightly differently, and uses 3-DES by default. You probably shouldn't be ...

View answer
Need to access old forgotten router that only supports SSLv3
10 votes

Three of the answers presently contributed require lowering the security level of your browser, possibly leaving you open to various attacks if you do this in your primary browser, subsequently use ...

View answer
What does chacha20-poly1305@openssh.com mean for me?
10 votes

Two things that it means to me are: it's a stream cipher, therefore not parallelizable. Although it's a stream cipher, it has a randomly accessible output stream (PDF), so it can be parallelized (...

View answer
Security of pronounceable passwords
Accepted answer
9 votes

Hard question to answer exactly. I'm going to refer to Theodore T'so's pwgen (v2.07) implementation exclusively here (pwgen -A0) These pronounceable passwords use "phonemes" as "symbols&...

View answer
Is it appropriate to use haveged as a source of entropy on virtual machines?
9 votes

(Updated, with thanks to gwuertz the current author/maintainer of haveged, I missed the separation between HAVEGE and haveged.) haveged is a distinct implementation of the HAVEGE method for ...

View answer
What are the security risks associated with PDF files?
8 votes

One PDF-specific risk is that Adobe and third-party reader extensions are supported: your PDF viewer may have extra modules loaded, or may require them to open certain documents. Examples include: ...

View answer
Is STARTTLS a security-vulnerability?
8 votes

SMTP with STARTTLS itself is not a vulnerability, though it offers a larger attack surface given the complexity of the typical TLS implementation. If you don't need it, turn it off (NIST SP800-123 §4....

View answer
Why does the RFC 5280 dictate the CAs not to issue certificates with negative serial numbers?
Accepted answer
8 votes

Short answer: because RFC 3280, its predecessor, says so. Longer answer: because historically ASN.1 encoders/decoders have had problems with properly encoding and decoding integers. X.509 uses DER ...

View answer