SecureDev

Mobile Screenshot prevention Cheat Sheet – Risks and Scenarios

The following article will try to analyze and explain risks and attack scenarios affecting mobile applications without any implemented prevention mechanism against screenshotting. Briefly, what is the problem? Extremely summarizing, mobile applications need to implement screenshot prevention mechanisms in order to avoid an attacker to steal sensitive data, such as credentials or private information, that […]

Implementing Secure Biometric Authentication on Mobile Applications

Nowadays, almost every mobile device has a biometric sensor that allows developers to implement local authentication and also store sensitive data securely through dedicated APIs. Biometric authentication is generally more secure than classic username/password approach. Anyway it must be considered that a wrong implementation could allow an attacker to easily bypass authentication mechanisms by using […]

Behave! A monitoring browser extension for pages acting as “bad boi”.

Browsing: What Could Go Wrong? There’s so much literature about client side attacks, but most of the focus is usually about classical malware attacks, exploiting software vulnerabilities. Malicious scripts happen to be executed every day by thousands of people and most of the times Malware/Virus/Malvertising try to exploit vulnerabilities or to lure the user to […]

Remote Working – Web Chats: Threats and countermeasures

Introduction With recent worldwide events, a sharply increasing number of companies are offering remote services to their customers. Even traditional businesses are implementing new features or pushing the migration of existing features to new needs of dematerialization of human-to-human relationships. Web chats are an example of such trends. Web chats Rich messages web chats are […]

OWASP SAMM v2: lessons learned after 9 years of assessment

OWASP SAMM v2 is out! OWASP SAMM (Software Assurance Maturity Model) is the OWASP framework to help organizations assess, formulate, and implement, through our self-assessment model, a strategy for software security that can be integrated into their existing Software Development Lifecycle (SDLC). The new OpenSAMM The original model OpenSAMM 1.0 was written by Pravir Chandra […]

How to Path Traversal with Burp Community Suite

Introduction A well-known, never out of fashion and highly impact vulnerability is the Path Traversal. This technique is also known as dot-dot-slash attack (../) or as a directory traversal. It consists in exploiting an insufficient security validation/sanitization of user input. It is used by the application to build pathnames to retrieve files or directories from […]

A practical guide to testing the security of Amazon Web Services (Part 3: AWS Cognito and AWS CloudFront)

This is the last part of our 3 posts journey discussing the main Amazon Web Services and their security. In the previous two parts we discussed two of the most used Amazon services, namely AWS S3 and AWS EC2. If you still haven’t checked them, you can find them here: Part 1 and Part 2. […]

Secure Development Lifecycle: Part 1

Observability and metrics paradox It is also about observability: ”If a tree falls in a forest and no one is around to hear it, does it make a sound?” …or… What is the return value (in dollars number) of having a better SDL in place if your company wasn’t shaken by cybersecurity incidents? I see a […]

Secure Development Lifecycle – Part 2

Evolution of SDL practices: from custom to product to service The increasing visibility trend discussed in Part 1, of course, is impacting the current cybersecurity practices, in terms of maturity of evolution, also toward a “service”. Organisations consist of value chains that are comprised of components that are evolving from genesis to more of a […]

How to prevent Path Traversal in .NET

Introduction A well-known, never out of fashion and highly impact vulnerability is the Path Traversal. This technique is also known as dot-dot-slash attack (../) or as a directory traversal, and it consists in exploiting an insufficient security validation/sanitization of user input, which is used by the application to build pathnames to retrieve files or directories […]

From Path Traversal to Source Code in Asp.NET MVC Applications

Introduction Model-View-Controller web applications may be difficult to pentest, since they strongly depend -for almost any aspect- on the technology they are developed and deployed with. From the attacker perspective, interacting with a complex multi-layer web application means dealing with very technology-dependent configuration files and implementations; on the contrary, classic web applications (such as WebForms) […]

Pentesting IoT devices (Part 2: Dynamic Analysis)

This is the second part of our Pentesting IoT devices guide. In the previous post it was provided an overview on firmware static analysis showing how it can help to find many security issues. In this article it will be discussed the so called dynamic approach for device pentesting. It will be described how it is […]

A practical guide to testing the security of Amazon Web Services (Part 2: AWS EC2)

This is Part 2 of 3 on our practical guide to testing the security of Amazon Web Services. We are tackling the main services provided by Amazon for its cloud-based platform to support web applications and we started by discussing AWS S3 buckets and their security. You can get a little overview of AWS and […]

A practical guide to testing the security of Amazon Web Services (Part 1: AWS S3)

Back in the days, the word Amazon used to refer to over half of earth’s rainforests. While this is still true, it isn’t what most people think of when they hear the word Amazon. Nowadays, people refer to the word Amazon as a place where they can order goods from the confort of their couches.  […]

Pentesting IoT devices (Part 1: Static Analysis)

Introduction Intelligent dishwashers, smart factories, connected sensors and Wi-Fi fridges, these are only a few examples of everyday objects that now are connected to the Internet. All these “brainless” objects have been upgraded to become Internet of Things devices and now they’re changing our lifestyle communicating with us at anytime and in any place. As […]