Web and Security 1 / 40
|
|
|
- Robert Ray
- 8 years ago
- Views:
Transcription
1 Web and 1 / 40
2 Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST 2 / 40
3 Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST Assume initial authentication is by password How is continuing authentication done? Two principal ways: cookies and hidden values Both have their limits Fundamental issue: both are sent by untrusted clients 3 / 40
4 Untrusted Clients Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST The web site is interested in identifying users (Some) users have incentive to cheat The goal of the web site is to make cheating impossible But the web site doesn t control the client software or behavior 4 / 40
5 Repeat: Untrusted Clients Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST You can never trust the client All input must be sanitized, scrutinized, etc. Solutions: server-side storage or cryptographic sealing 5 / 40
6 Server-Side Storage Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST Provide the client with an index to some server-side file Client sends back the nonce; server looks up the identity (or other session details) Caution: make certain that nonces are not guessable or findable by exhaustive search. Also make sure they re not (easily) stealable from other users Problem: server-side storage can be exhausted; sessions must be of finite duration 6 / 40
7 Cryptographic Sealing Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST After the user logs in (somehow), create a string that contains the userid Encrypt (optional) and MAC this string, using keys known only to the server; pass the string to the client When the string is sent to the server, validate the MAC and decrypt, to see who it is Only the server knows those keys, so only the server could have created those protected strings (similar to Keberos TGT) Optional: include (especially) timestamp, IP address, etc. 7 / 40
8 Hidden Values Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST Protected userid string can be embedded in the web page, and returned on clicks Embed in URLs but then they re visible in log files Make them hidden variables passed back in forms: <INPUT TYPE=HIDDEN NAME=REQRENEW> <INPUT TYPE=HIDDEN NAME=PID VALUE="2378"> <INPUT TYPE=HIDDEN NAME=SEQ VALUE=" <P><INPUT TYPE=SUBMIT VALUE="Renew Items"><INPUT </FORM> 8 / 40
9 Cookies Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST More commonly used Allow you to re-enter site Are sometimes stored on user s disks 9 / 40
10 Protecting Data Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST authentication data is frequently transmitted unencrypted! Most sites don t want the overhead of SSL for everything Credentials are easily stolen, especially in wireless hotpots (always use HTTPS with gmail) Usual defenses: lifetime; reauthenticate before doing really sensitive stuff 10 / 40
11 Sidebar: Cookies and JavaScript Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST IE trusts local content more than it trusts downloaded files Content is local if it s coming from a file on the user s disk Each cookie is stored as a separate file Suppose you put a script in a cookie, and then referenced it by filename? Now you know why browsers use random characters in some of their filenames... (Partially changed by Windows XP SP2) 11 / 40
12 Cross-Site Scripting (XSS) Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST Problem usually occurs when sites don t sanitize user input to strip HTML Example: chat room (or MySpace or blog sites) that let users enter comments The comments can include JavaScript code This JavaScript code can transmit the user s authentication cookies to some other site 12 / 40
13 Why It Works Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST A JavaScript program can only access data for the current web site But JavaScript from a site can access that site s cookies Because of the XSS bug, the JavaScript from that site contains malicious code It can therefore steal cookies and send them to some other site, via (say) an IMG URL 13 / 40
14 Sanitizing Input Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST Very hard to do properly Whitelist instead of blacklist accept <I> instead of blocking <SCRIPT> Watch for encoding: %3C Watch for Unicode: < or < or < or < or... Probably a way to write it in octal, too Unicode is tricky see RFC What do all of your users browsers understand? 14 / 40
15 GET versus POST Untrusted Clients Repeat: Untrusted Clients Server-Side Storage Cryptographic Sealing Hidden Values Cookies Protecting Data Sidebar: Cookies and JavaScript Cross-Site Scripting (XSS) Why It Works Sanitizing Input GET versus POST Web requests can use GET or POST commands GET puts parameters in the URL; POST sends it as data after the command The nice thing about GET: you can reuse the URL But URLs are logged, by servers and sometimes proxies Don t put anything sensitive in the parameters! POST can t be reused, but doesn t cause sensitive data to be logged 15 / 40
16 Protecting the Server Standard Defenses Server-Side Scripts Injection Attacks Scrubbing Your Site Users ACLs SSL and Proxies 16 / 40
17 Protecting the Server Protecting the Server Standard Defenses Server-Side Scripts Injection Attacks Scrubbing Your Site Users ACLs SSL and Proxies Servers are very tempting targets Defacement Steal data (i.e., credit card numbers) Distribute malware to unsuspecting clients 17 / 40
18 Standard Defenses Protecting the Server Standard Defenses Server-Side Scripts Injection Attacks Scrubbing Your Site Users ACLs SSL and Proxies Check all inputs Remember that nothing the client sends can be trusted Scrub your site 18 / 40
19 Server-Side Scripts Protecting the Server Standard Defenses Server-Side Scripts Injection Attacks Scrubbing Your Site Users ACLs SSL and Proxies Most interesting web sites use server-side scripts: CGI, ASP, PHP, server-side include, etc. Each such script is a separate network service For a web site to be secure, all of its scripts must be secure What security context do scripts run in? The web server s? How does the server protect its sensitive files against malfunctioing scripts? This latter is a particular problem with server plug-ins, such as PHP Partial defense: use things like suexec 19 / 40
20 Injection Attacks Protecting the Server Standard Defenses Server-Side Scripts Injection Attacks Scrubbing Your Site Users ACLs SSL and Proxies Often, user-supplied input is used to construct a file name or SQL query Bad guys can send bogus data Example: a script that sends collects a username and executes /usr/bin/sendmail username The bad guy supplies foo; rm -rf / as the username The actual code executed is /usr/bin/sendmail foo; rm -rf / Oops / 40
21 Scrubbing Your Site Protecting the Server Standard Defenses Server-Side Scripts Injection Attacks Scrubbing Your Site Users ACLs SSL and Proxies What is really being served? Web servers often come with default scripts some of these are insecure Example: nph-test-cgi that used to come with Apache Example: proprietary documents; Google for them: filetype:pdf "company confidential" (By the way, many document have other, hidden data) Can Google for some other vulnerabilities, too 21 / 40
22 Users Protecting the Server Standard Defenses Server-Side Scripts Injection Attacks Scrubbing Your Site Users ACLs SSL and Proxies If your site permits user web pages this deparment? you have serious threats Are the user CGI scripts secure? Can users run PHP scripts in the browser s security context? Are all of these secure? 22 / 40
23 ACLs Protecting the Server Standard Defenses Server-Side Scripts Injection Attacks Scrubbing Your Site Users ACLs SSL and Proxies Web sites can block or permit certain IP addresses: Deny from Deny from phishers.example.com Deny from moreidiots.example Deny from ke Possible to allow just a few addresses, too: Order deny,allow Deny from all Allow from dev.example.com Caution: do not trust domain names 23 / 40
24 SSL and Proxies Protecting the Server Standard Defenses Server-Side Scripts Injection Attacks Scrubbing Your Site Users ACLs SSL and Proxies On proxied web connections, the proxy does not see the full URL It only sees the hostname and port: CONNECT HTTP/1.1 User-Agent: Mozilla/ Proxy-Connection: keep-alive Host: (SSL starts here) But the hostname (such as is seen and logged Performance note: SSL pages are not cached SSL-only site can be more expensive 24 / 40
25 The Usual Questions Assets Security at Rest In Motion versus at Rest Components 25 / 40
26 The Usual Questions The Usual Questions Assets Security at Rest In Motion versus at Rest Components What are we trying to protect? Against whom? 26 / 40
27 Assets The Usual Questions Assets Security at Rest In Motion versus at Rest Components Confidentiality people often discuss sensitive things via Authenticity who really sent the ? Anti-spam? Phishing? Authenticity has many motivations here 27 / 40
28 Security at Rest The Usual Questions Assets Security at Rest In Motion versus at Rest Components TLS protects data in motion during communication For , do we want that or do we want security at rest while the is stored somewhere Other terminology: transmission security versus object security Usual answer: both Security at rest is much harder 28 / 40
29 In Motion versus at Rest The Usual Questions Assets Security at Rest In Motion versus at Rest Components In Motion keys are transient Reject expired certificates Negotiate algorithms Decryption failures noticed immediately Restart communications on decryption failure At Rest keys must last as long as data must be provably valid Must store and accept old ones them for later use Assume known algorithms Decryption failures noticed much later Decryption failure unknown to sender 29 / 40
30 Components The Usual Questions Assets Security at Rest In Motion versus at Rest Components Mail User Agents (MUA): Outlook, Thunderbird, webmail sites, etc. Mail submission servers Mail Transfer Agents (MTAs) Mail Receivers Mail storage and retrieval systems (IMAP, POP, etc.) 30 / 40
31 Eavesdropping Password Theft Hacking Screen Dumps Subpoena Attacks Rubber Hose Cryptanalysis From Spoofing Systems Issues 31 / 40
32 Eavesdropping Eavesdropping Password Theft Hacking Screen Dumps Subpoena Attacks Rubber Hose Cryptanalysis From Spoofing Systems Issues Most obvious way to read eavesdropping The bad guy simply listens to the network Harder than it sounds, except for some wireless nets Frequently used by police and intelligence agencies, i.e., the FBI s Carnivore device 32 / 40
33 Password Theft Eavesdropping Password Theft Hacking Screen Dumps Subpoena Attacks Rubber Hose Cryptanalysis From Spoofing Systems Issues Most is retrieved by login and password Anyone who gets your password can read your It s much easier for an eavesdropper to pick those up passwords are usually sent each time someone polls for new 33 / 40
34 Hacking Eavesdropping Password Theft Hacking Screen Dumps Subpoena Attacks Rubber Hose Cryptanalysis From Spoofing Systems Issues The real threat to is while it s in storage This can be temporary storage, waiting for you to pick it up It can also be your personal machine, for you ve sent or received What if your laptop is stolen? Does it have plaintext copies of all the secure you ve sent and received? 34 / 40
35 Screen Dumps Eavesdropping Password Theft Hacking Screen Dumps Subpoena Attacks Rubber Hose Cryptanalysis From Spoofing Systems Issues Connect via X11 Use some other Trojan horse software to dump user s screen periodically Reflection off the back wall / 40
36 Subpoena Attacks Eavesdropping Password Theft Hacking Screen Dumps Subpoena Attacks Rubber Hose Cryptanalysis From Spoofing Systems Issues What if your records are subpoenaed? This is a legal issue; technical wiggling won t help! Even a search warrant is very disruptive 36 / 40
37 Rubber Hose Cryptanalysis Eavesdropping Password Theft Hacking Screen Dumps Subpoena Attacks Rubber Hose Cryptanalysis From Spoofing Systems Issues What if the local secret police want to know what some intercepted says? Protecting human rights workers was one of the original goals for PGP! It s public key-encrypted you can t read it If the signature is encrypted, they can t even prove you sent it Of course, people like that don t care much about proof, and they don t like to take no for an answer / 40
38 From Eavesdropping Password Theft Hacking Screen Dumps Subpoena Attacks Rubber Hose Cryptanalysis From Spoofing Systems Issues 38 / 40
39 Spoofing Eavesdropping Password Theft Hacking Screen Dumps Subpoena Attacks Rubber Hose Cryptanalysis From Spoofing Systems Issues Ordinary is trivial to spoof On timesharing machines and web mailers, the systems can tack on the userid On PCs, individuals set their own addresses No security if you need to authenticate , you have to use crypto 39 / 40
40 Systems Issues Eavesdropping Password Theft Hacking Screen Dumps Subpoena Attacks Rubber Hose Cryptanalysis From Spoofing Systems Issues Only read on secure machines Only connect to them securely Watch out for buggy mailers and systems But if the process of reading secure is too cumbersome, your will be insecure, because you ll never use the secure version Finding the right tradeoff is a difficult engineering choice 40 / 40
Web Server-Side Security
Protecting the Server Standard Defenses Server-Side Scripts Injection Attacks Example: Webmail Server Filtering Webmail Requests File Permissions Scrubbing Your Site Users 1 / 47 Protecting the Server
Network Security - ISA 656 Email Security
Network Security - ISA 656 Angelos Stavrou November 13, 2007 The Usual Questions The Usual Questions Assets What are we trying to protect? Against whom? 2 / 33 Assets The Usual Questions Assets Confidentiality
The Case For Secure Email
The Case For Secure Email By Erik Kangas, PhD, President, Lux Scientiae, Incorporated http://luxsci.com Contents Section 1: Introduction Section 2: How Email Works Section 3: Security Threats to Your Email
How To Protect Your Email From Being Hacked On A Pc Or Mac Or Ipa From Being Stolen On A Network (For A Free Download) On A Computer Or Ipo (For Free) On Your Pc Or Ipom (For An Ipo
The Case for Email Security secure, premium by Erik Kangas, President, Lux Scientiae Section 1: Introduction to Email Security You may already know that email is insecure; however, it may surprise you
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications
1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities
CSE598i - Web 2.0 Security OWASP Top 10: The Ten Most Critical Web Application Security Vulnerabilities Thomas Moyer Spring 2010 1 Web Applications What has changed with web applications? Traditional applications
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
Check list for web developers
Check list for web developers Requirement Yes No Remarks 1. Input Validation 1.1) Have you done input validation for all the user inputs using white listing and/or sanitization? 1.2) Does the input validation
Web application security
Web application security Sebastian Lopienski CERN Computer Security Team openlab and summer lectures 2010 (non-web question) Is this OK? int set_non_root_uid(int uid) { // making sure that uid is not 0
Web-Application Security
Web-Application Security Kristian Beilke Arbeitsgruppe Sichere Identität Fachbereich Mathematik und Informatik Freie Universität Berlin 29. Juni 2011 Overview Web Applications SQL Injection XSS Bad Practice
Web Application Security Considerations
Web Application Security Considerations Eric Peele, Kevin Gainey International Field Directors & Technology Conference 2006 May 21 24, 2006 RTI International is a trade name of Research Triangle Institute
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
Introduction to Computer Security
Introduction to Computer Security Web Application Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Modern threat landscape The majority of modern vulnerabilities are found in web
Web Security. Crypto (SSL) Client security Server security 2 / 40. Web Security. SSL Recent Changes in TLS. Protecting the Client.
1 / 40 Crypto () Client security Server security 2 / 40 Trusting The Server s Client SET The Failure of SET Aside: The SET Root Certificate The Client s Server Who Issues Web Certificates? Mountain America
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
Application Design and Development
C H A P T E R9 Application Design and Development Practice Exercises 9.1 What is the main reason why servlets give better performance than programs that use the common gateway interface (CGI), even though
Why you need secure email
Why you need secure email WHITE PAPER CONTENTS 1. Executive summary 2. How email works 3. Security threats to your email communications 4. Symmetric and asymmetric encryption 5. Securing your email with
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
Email Security 1 / 43
Email Security 1 / 43 General Strategy Some Details Transit Issues Signing Headers General Flow Securing Transit Mail Steps MTA to MTA Security Traffic Analysis 2 / 43 General Strategy General Strategy
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
Figure 9-1: General Application Security Issues. Application Security: Electronic Commerce and E-Mail. Chapter 9
Figure 9-1: General Application Application Security: Electronic Commerce and E-Mail Chapter 9 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Executing Commands with the Privileges
E-commerce. Security. Learning objectives. Internet Security Issues: Overview. Managing Risk-1. Managing Risk-2. Computer Security Classifications
Learning objectives E-commerce Security Threats and Protection Mechanisms. This lecture covers internet security issues and discusses their impact on an e-commerce. Nov 19, 2004 www.dcs.bbk.ac.uk/~gmagoulas/teaching.html
Web Application Worms & Browser Insecurity
Web Application Worms & Browser Insecurity Mike Shema Welcome Background Hacking Exposed: Web Applications The Anti-Hacker Toolkit Hack Notes: Web Security Currently working at Qualys
CS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis deyannis@csd.uoc.gr 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application Penetration
Simon Fraser University. Web Security. Dr. Abhijit Sen CMPT 470
Web Security Dr. Abhijit Sen 95% of web apps have Vulnerabilities Cross-site scripting (80 per cent) SQL injection (62 per cent) Parameter tampering (60 per cent) http://www.vnunet.com/vnunet/news/2124247/web-applicationswide-open-hackers
External Vulnerability Assessment. -Technical Summary- ABC ORGANIZATION
External Vulnerability Assessment -Technical Summary- Prepared for: ABC ORGANIZATI On March 9, 2008 Prepared by: AOS Security Solutions 1 of 13 Table of Contents Executive Summary... 3 Discovered Security
WEB ATTACKS AND COUNTERMEASURES
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
Server Security. Contents. Is Rumpus Secure? 2. Use Care When Creating User Accounts 2. Managing Passwords 3. Watch Out For Aliases 4
Contents Is Rumpus Secure? 2 Use Care When Creating User Accounts 2 Managing Passwords 3 Watch Out For Aliases 4 Deploy A Firewall 5 Minimize Running Applications And Processes 5 Manage Physical Access
Application security testing: Protecting your application and data
E-Book Application security testing: Protecting your application and data Application security testing is critical in ensuring your data and application is safe from security attack. This ebook offers
OPENID AUTHENTICATION SECURITY
OPENID AUTHENTICATION SECURITY Erik Lagercrantz and Patrik Sternudd Uppsala, May 17 2009 1 ABSTRACT This documents gives an introduction to OpenID, which is a system for centralised online authentication.
Web Application Guidelines
Web Application Guidelines Web applications have become one of the most important topics in the security field. This is for several reasons: It can be simple for anyone to create working code without security
Is your data safe out there? -A white Paper on Online Security
Is your data safe out there? -A white Paper on Online Security Introduction: People should be concerned of sending critical data over the internet, because the internet is a whole new world that connects
Cyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
Finding and Preventing Cross- Site Request Forgery. Tom Gallagher Security Test Lead, Microsoft
Finding and Preventing Cross- Site Request Forgery Tom Gallagher Security Test Lead, Microsoft Agenda Quick reminder of how HTML forms work How cross-site request forgery (CSRF) attack works Obstacles
Thick Client Application Security
Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two
Magento Security and Vulnerabilities. Roman Stepanov
Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection
Webmail Using the Hush Encryption Engine
Webmail Using the Hush Encryption Engine Introduction...2 Terms in this Document...2 Requirements...3 Architecture...3 Authentication...4 The Role of the Session...4 Steps...5 Private Key Retrieval...5
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users.
system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be grouped
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
Web Application Attacks and Countermeasures: Case Studies from Financial Systems
Web Application Attacks and Countermeasures: Case Studies from Financial Systems Dr. Michael Liu, CISSP, Senior Application Security Consultant, HSBC Inc Overview Information Security Briefing Web Applications
Cryptshare for Outlook User Guide
Cryptshare for Outlook User Guide V1.6.2 Befine Solutions AG Werthmannstr. 15 79098 Freiburg i. Br. Germany Web: https://www.cryptshare.com E-Mail: info@cryptshare.com Tel.: +49 761 389 13 0 Fax: +49 761
Transport Layer Security Protocols
SSL/TLS 1 Transport Layer Security Protocols Secure Socket Layer (SSL) Originally designed to by Netscape to secure HTTP Version 2 is being replaced by version 3 Subsequently became Internet Standard known
Ruby on Rails Secure Coding Recommendations
Introduction Altius IT s list of Ruby on Rails Secure Coding Recommendations is based upon security best practices. This list may not be complete and Altius IT recommends this list be augmented with additional
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
Web Application Security. Srikumar Venugopal S2, Week 8, 2013
Web Application Security Srikumar Venugopal S2, Week 8, 2013 Before we start Acknowledgements This presentation contains material prepared by Halvard Skogsrud, Senior Software Engineer, Thoughtworks, Inc.
How To Understand The History Of The Web (Web)
(World Wide) Web WWW A way to connect computers that provide information (servers) with computers that ask for it (clients like you and me) uses the Internet, but it's not the same as the Internet URL
Personal Secure Email Certificate
Entrust Certificate Services Personal Secure Email Certificate Enrollment Guide Date of Issue: October 2010 Copyright 2010 Entrust. All rights reserved. Entrust is a trademark or a registered trademark
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
Network Security - ISA 656 Review
Network Security - ISA 656 Review Angelos Stavrou December 4, 2007 Material Test Conditions 7:20pm - 9:30pm, Thursday, Dec 11th, in the Lab (STI-128) Same style of questions as the midterm I m not asking
Cross-Site Scripting
Cross-Site Scripting (XSS) Computer and Network Security Seminar Fabrice Bodmer (fabrice.bodmer@unifr.ch) UNIFR - Winter Semester 2006-2007 XSS: Table of contents What is Cross-Site Scripting (XSS)? Some
Authentication Types. Password-based Authentication. Off-Line Password Guessing
Authentication Types Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4:
(WAPT) Web Application Penetration Testing
(WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:
Last update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is to
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Session Management in Web Applications
Session Management in Web Applications Author: EUROSEC GmbH Chiffriertechnik & Sicherheit Tel: 06173 / 60850, www.eurosec.com EUROSEC GmbH Chiffriertechnik & Sicherheit, 2005 What is Web-based Session
Application Security Testing. Generic Test Strategy
Application Security Testing Generic Test Strategy Page 2 of 8 Contents 1 Introduction 3 1.1 Purpose: 3 1.2 Application Security Testing: 3 2 Audience 3 3 Test Strategy guidelines 3 3.1 Authentication
Cryptography for Software and Web Developers
Cryptography for Software and Web Developers Part 1: Web and Crypto Hanno Böck 2014-05-28 1 / 14 HTTP and HTTPS SSL Stripping Cookies Mixed content HTTPS content, HTTP images Many webpages use some kind
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
Testing the OWASP Top 10 Security Issues
Testing the OWASP Top 10 Security Issues Andy Tinkham & Zach Bergman, Magenic Technologies Contact Us 1600 Utica Avenue South, Suite 800 St. Louis Park, MN 55416 1 (877)-277-1044 info@magenic.com Who Are
Web Security: SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Web Security: SSL/TLS Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno,
E-Commerce Security. The Client-Side Vulnerabilities. Securing the Data Transaction LECTURE 7 (SECURITY)
E-Commerce Security An e-commerce security system has four fronts: LECTURE 7 (SECURITY) Web Client Security Data Transport Security Web Server Security Operating System Security A safe e-commerce system
SECURITY ADVISORY. December 2008 Barracuda Load Balancer admin login Cross-site Scripting
SECURITY ADVISORY December 2008 Barracuda Load Balancer admin login Cross-site Scripting Discovered in December 2008 by FortConsult s Security Research Team/Jan Skovgren WARNING NOT FOR DISCLOSURE BEFORE
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers
Web Application Security Guidelines for Hosting Dynamic Websites on NIC Servers The Website can be developed under Windows or Linux Platform. Windows Development should be use: ASP, ASP.NET 1.1/ 2.0, and
2.4: Authentication Authentication types Authentication schemes: RSA, Lamport s Hash Mutual Authentication Session Keys Trusted Intermediaries
Chapter 2: Security Techniques Background Secret Key Cryptography Public Key Cryptography Hash Functions Authentication Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application
Keep Yourself Safe from the Prying Eyes of Hackers and Snoopers!
Protect Your Privacy Online P 7/1 Keep Yourself Safe from the Prying Eyes of Hackers and Snoopers! With the information in this article you can: Find out what secret information your PC is sharing with
Still Aren't Doing. Frank Kim
Ten Things Web Developers Still Aren't Doing Frank Kim Think Security Consulting Background Frank Kim Consultant, Think Security Consulting Security in the SDLC SANS Author & Instructor DEV541 Secure Coding
CS 161 Computer Security
Paxson Spring 2013 CS 161 Computer Security Homework 2 Due: Wednesday, March 6, at 10PM Version 1.1 (02Mar13) Instructions. This assignment must be done on your own, and in accordance with the course policies
Lecture 11 Web Application Security (part 1)
Lecture 11 Web Application Security (part 1) Computer and Network Security 4th of January 2016 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 11, Web Application Security (part 1)
Network Security Web Security and SSL/TLS. Angelos Keromytis Columbia University
Network Security Web Security and SSL/TLS Angelos Keromytis Columbia University Web security issues Authentication (basic, digest) Cookies Access control via network address Multiple layers SHTTP SSL (TLS)
Lecture Notes for Advanced Web Security 2015
Lecture Notes for Advanced Web Security 2015 Part 6 Web Based Single Sign-On and Access Control Martin Hell 1 Introduction Letting users use information from one website on another website can in many
Configuring Single Sign-on for WebVPN
CHAPTER 8 This chapter presents example procedures for configuring SSO for WebVPN users. It includes the following sections: Using Single Sign-on with WebVPN, page 8-1 Configuring SSO Authentication Using
Web Application Report
Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 8.5.0.1 11/14/2012 8:52:13 AM 11/14/2012
Hushmail Express Password Encryption in Hushmail. Brian Smith Hush Communications
Hushmail Express Password Encryption in Hushmail Brian Smith Hush Communications Introduction...2 Goals...2 Summary...2 Detailed Description...4 Message Composition...4 Message Delivery...4 Message Retrieval...5
Hack Proof Your Webapps
Hack Proof Your Webapps About ERM About the speaker Web Application Security Expert Enterprise Risk Management, Inc. Background Web Development and System Administration Florida International University
Ethical Hacking as a Professional Penetration Testing Technique
Ethical Hacking as a Professional Penetration Testing Technique Rochester ISSA Chapter Rochester OWASP Chapter - Durkee Consulting, Inc. info@rd1.net 2 Background Founder of Durkee Consulting since 1996
ITSC Training Courses Student IT Competence Programme SIIS1 Information Security
ITSC Training Courses Student IT Competence Programme SI1 2012 2013 Prof. Chan Yuen Yan, Rosanna Department of Engineering The Chinese University of Hong Kong SI1-1 Course Outline What you should know
JOOMLA SECURITY. ireland website design. by Oliver Hummel. ADDRESS Unit 12D, Six Cross Roads Business Park, Waterford City
JOOMLA SECURITY by Oliver Hummel ADDRESS Unit 12D, Six Cross Roads Business Park, Waterford City CONTACT Nicholas Butler 051-393524 089-4278112 info@irelandwebsitedesign.com Contents Introduction 3 Installation
Network Security Workshop
Network Security Workshop Threat Pragmatics Fakrul (Pappu) Alam bdhub Limited fakrul@bdhub.com Targets Many sorts of targets: Network infrastructure Network services Application services User machines
Sichere Software- Entwicklung für Java Entwickler
Sichere Software- Entwicklung für Java Entwickler Dominik Schadow Senior Consultant Trivadis GmbH 05/09/2012 BASEL BERN LAUSANNE ZÜRICH DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. HAMBURG MÜNCHEN STUTTGART
Login with Amazon. Developer Guide for Websites
Login with Amazon Developer Guide for Websites Copyright 2014 Amazon Services, LLC or its affiliates. All rights reserved. Amazon and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates.
Secure Web Development Teaching Modules 1. Threat Assessment
Secure Web Development Teaching Modules 1 Threat Assessment Contents 1 Concepts... 1 1.1 Software Assurance Maturity Model... 1 1.2 Security practices for construction... 3 1.3 Web application security
The Hidden Dangers of Public WiFi
WHITEPAPER: OCTOBER 2014 The Hidden Dangers of Public WiFi 2 EXECUTIVE SUMMARY 4 MARKET DYNAMICS 4 The Promise of Public WiFi 5 The Problem with Public WiFi 6 MARKET BEHAVIOR 6 Most People Do Not Protect
External Network & Web Application Assessment. For The XXX Group LLC October 2012
External Network & Web Application Assessment For The XXX Group LLC October 2012 This report is solely for the use of client personal. No part of it may be circulated, quoted, or reproduced for distribution
NeoMail Guide. Neotel (Pty) Ltd
NeoMail Guide Neotel (Pty) Ltd NeoMail Connect Guide... 1 1. POP and IMAP Client access... 3 2. Outlook Web Access... 4 3. Outlook (IMAP and POP)... 6 4. Outlook 2007... 16 5. Outlook Express... 24 1.
Web Application Firewall on SonicWALL SSL VPN
Web Application Firewall on SonicWALL SSL VPN Document Scope This document describes how to configure and use the Web Application Firewall feature in SonicWALL SSL VPN 5.0. This document contains the following
The basic groups of components are described below. Fig X- 1 shows the relationship between components on a network.
Elements of Email Email Components There are a number of software components used to produce, send and transfer email. These components can be broken down as clients or servers, although some components
An Insight into Cookie Security
An Insight into Cookie Security Today most websites and web based applications use cookies. Cookies are primarily used by the web server to track an authenticated user or other user specific details. This
Essential IT Security Testing
Essential IT Security Testing Application Security Testing for System Testers By Andrew Muller Director of Ionize Who is this guy? IT Security consultant to the stars Member of OWASP Member of IT-012-04
APWG. (n.d.). Unifying the global response to cybecrime. Retrieved from http://www.antiphishing.org/
DB1 Phishing attacks, usually implemented through HTML enabled e-mails, are becoming more common and more sophisticated. As a network manager, how would you go about protecting your users from a phishing
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks. Whitepaper
Application Layer Encryption: Protecting against Application Logic and Session Theft Attacks Whitepaper The security industry has extensively focused on protecting against malicious injection attacks like
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER XSS-BASED ABUSE OF BROWSER PASSWORD MANAGERS Ben Stock, Martin Johns, Sebastian Lekies Browser choices Full disclosure: Ben was an intern with Microsoft
EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke
EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions Project
CMP3002 Advanced Web Technology
CMP3002 Advanced Web Technology Assignment 1: Web Security Audit A web security audit on a proposed eshop website By Adam Wright Table of Contents Table of Contents... 2 Table of Tables... 2 Introduction...
OWASP Top Ten Tools and Tactics
OWASP Top Ten Tools and Tactics Russ McRee Copyright 2012 HolisticInfoSec.org SANSFIRE 2012 10 JULY Welcome Manager, Security Analytics for Microsoft Online Services Security & Compliance Writer (toolsmith),
Advanced Web Security, Lab
Advanced Web Security, Lab Web Server Security: Attacking and Defending November 13, 2013 Read this earlier than one day before the lab! Note that you will not have any internet access during the lab,
Objectives. Security. Fixing Our JSTL Problem. Web Application Architecture. Web Security. A few lines of code can wreak more havoc than a bomb.
Objectives JSTL Review Designing for Security JSTL Review What is the purpose of JSTL? What is the goal of JSTL? What is JSTL? What are some common tags in the JSTL Core library? How do they work? What