Palisade Magazine

A Plynt Publication

Quiz

Proposal to amend Same Origin Policy

in July 2008

Same origin policy of browser prevents scripts loaded in one domain to access resource from another domain. However, this policy imposes several limitations to Web 2.0 apps and restricts interactivity between sites. A new proposal has been formed by W3C, to incorporate Web 2.0 developer’s demands, by allowing cross site requests. Which among the following is the said proposal?

Configuring Domain Authorization Rules on the application server side
Access Control for Cross-site Requests
Configuring Application level ACL

in June 2008

What is Cross Site Printing?

A typo for Cross Site Scripting
A new Printing technology from Microsoft
A new attack that prints to your internal printers when you visit a website
None of these

in June 2007

Which of the following is/are required as safe authentication controls at login page?

Enable SSL
Define acceptable Inputs
Use Salted Hash technique
Disable password save and AutoComplete/fill-in
All of them

in May 2007

Which of these is not a recommended best practice for implementing CAPTCHAs?

Have a fixed set of images with dynamic filenames
Send the CAPTCHA to the client with a random token
Invalidate the token after one use
None of the above

in March 2007

Which of these best describes an Anti-Phishing Measure?

Insert a Javascript in the website that records the number users visiting the website per day.
Insert a Javascript the website for customizing the website based on user’s browser type or version.
Insert a Javascript in the website which sends an alert whenever website is run under any URL other than the authentic.
Insert a Javascript in the website to protect email addresses from being harvested by spambots.

in February 2007

What sort of privilege on the log file does an application need to log transactions?

Read, Write
Read, Write, Append, Delete
Write, Append
Append

in December 2006

Your Internet Banking site is fully SSL enabled. Login-page, Account summary page and Fund transfer page are all HTTPS enabled. When you bank online - login, check your account summary and do a fund transfer, is SSL authentication and handshake happening separately for each page or is it one handshake for all the three pages?

HTTP is stateless, so is SSL. Full SSL handshake needed for each HTTP page.
SSL is stateful, only one full handshake for multiple HTTP pages in a session.
SSL is security at IP layer. One handshake for one set of source/destination IP address.

in November 2006

What is the average lifetime of a phishing site today?

< 1 hour
< 1 day
About 5 days
About 3 months

in October 2006

HTTP requests go through various applications like Cache, proxy, firewall etc. before reaching to the web server. An attacker sends multiple specially-crafted HTTP requests which cause the intermediate entities between the attackers browser and web server to see different sets of requests.What type of attack is this?

Cross Site Tracing attack
HTTP Request Smuggling attack
Cross site Request forging attack
SQL Injection attack

in September 2006

Which of the following is the most effective password?

XH#4@r4$8
Kate1980
Asterixh@sgoneHome

in August 2006

An attacker enters a long nasty looking string into the date field. The input overwrites parts of the running program and executes commands on the server. What type of attack just took place?

SQL Injection attack
Buffer Overflow attack
Cross Site Scripting attack

in July 2006

Which of these techniques helps in preventing passwords being stolen from the browser?

Using SSL for the authentication pages
Using salted hashing for transmitting passwords
Using an intermediate page after login
All of the above

in June 2006

It is very essential to control the access to web content for running a secure web server. Directory traversal is an exploit that takes advantage of the lack of controls on the web server to access restricted directories and execute commands. So how can we prevent these directory traversal attacks on the web servers?

Applying latest security patches
Turning off directory-browsing
Performing strong input validation with white lists
Placing web-root directories and virtual directories on a separate partition from the system files
Using tools
All of the above.

in May 2006

Buffer overflow is a common enough problem that most applications face. So how does a software developer ensure that his/her application is safe from buffer overflows?

Secure Designing and Coding
Configure non-executable stack
Use safer versions of functions
Use of safe libraries.
Use tools.
Any of the above.

in April 2006

Which of the following websites is least likely to be a target of phishing / pharming attacks?

An ecommerce-enabled website having SSL encryption, password authentication mechanism, and which sends customer account statements via email.
An internet banking website with SSL encryption, two-factor authentication and which does not send any customer information via email.
An ecommerce-enabled website with no SSL-based login and a simple password authentication mechanism.
An internet banking website with SSL encryption and multi-factor authentication. Additionally the website displays unique visual clues to each user.

in March 2006

Which is/are the secure methods, among given options, to prevent email addresses harvesting?

Re-format/ munging address
Substitute ASCII codes in address
Obscure address through javascript
Hide address in image
Options 3 and 4

in February 2006

Which of these is not a good strategy for handling secrets in .Net?

Use SecureZeroMemory to clear secrets in the memory
Use aspnet_setreg to encrypt passwords in the registry
Use .Net’s isolated storage to store secrets safely

in January 2006

Which of the following is/are best practices for logout in .net applications?

Using FormsAuthentication.SignOut method
Set the requireSSL attribute for the AuthCookie
Set the HttpOnly cookies attribute for the AuthCookie
Implement Short Timeout for the AuthCookie
All of the above

in December 2005

What’s the best strategy to validate the inputs in our application?

Look out for malicious input during validation and filter that out
Specify what’s good, and allow only that
I love a combination of both

in November 2005

Our applet implements an algorithm that’s proprietary and a trade secret. How do I protect the algorithm from getting stolen at the browser?

Digitally sign the applet
Encrypt the applet using RSA
Use Code Obfuscation
None of the above

in October 2005

Which logging mechanism is best to trace back to the culprit in case of an application fraud, for example, when a fraudster may have illegally transferred money from somebody else’s account to his own account?

Web-Server error logs
Application logs
W3C logs
System logs

in September 2005

When is the best time to assign session ids?

Have a single session id for a complete browser instance.
Assign a session ID to a user on the login page.
On logout change the session ID to a new value.
Assign a session id after authentication, change it at logout.

in August 2005

What kind of attacks does SSL prevent?

SQL Injection
Sniffing
Variable Manipulation
Phishing Attacks

in July 2005

What is the best method for transmitting session IDs?

Sending the session ID in plain text in the URL.
Sending hashed session ID in the URL.
Sending the session ID as a hidden value in the form.
Embed the session ID in the Cookie.

in June 2005

Which is the best method to protect my customers from phishing attacks?

Have strong authentication mechanisms like Hardware Tokens, E-mail Signing etc.
Include personalized web pages to make it hard to impersonate the site
Creating awareness among customers about phishing

in May 2005

How should I mask my web server’s banners to get enhanced security?

Edit the server’s source code or the binary to change the default string
Edit configuration files or install a plug-in to mask the banner of your server
Never mind, obscuring banners doesn’t enhance security!

in April 2005

How can I prevent Cross Site Scripting attacks on my application?

Ensure no input is reflected in an output page
Use HTTP Only cookies to protect cookies from scripts
Escape all special characters when preparing the output

in March 2005

Which is the best method for implementing the Forgot Password feature?

Displaying the old password after asking a reminder question
Displaying a new password after the reminder question
Sending a temporary password by mail
Sending a temporary link to a ‘Change Password’ page by mail

in December 2004

I want to encrypt sensitive documents in my application. What is the best approach to take while designing a cryptographic solution?

Develop a proprietary encryption algorithm that only I know about
Learn how to implement a standard algorithm like AES or 3DES
Use my platform’s Crypto API classes that implement well-known algorithms
Learn how to manage keys used in the encryption

in November 2004

How can I protect my application from SQL Injection attacks?

Check all user inputs for special characters like " ‘ "
Use Database stored procedures
Use parametrized queries instead of dynamic SQL statements
All of the above

in October 2004

How can an application ensure that its pages are not cached or left on the client after a user has logged out?

Set pragma: no-cache
Set page expire = -1
Set cache-control: no-cache, no-store
Set cache-control: must-revalidate

in September 2004

How should I protect the session cookie in my web application from getting stolen?

Use strongly random strings for the session token.
Set the “secure” attribute for the session cookie.
Set the “httponly” attribute for the cookie.
All of the above.

in August 2004

An online banking application lets the user export account statements as text files or Excel spreadsheets. How should the application generate, store and dispatch these non-HTML content to the user’s browser?

Maintain these files in the web server’s file system, and redirect the user to the correct file when requested.
Store the data in a database, and create the files temporarily in the local file system when a user requests it. Then redirect the user to this temporary file.
Store the files in a database, read it with a server program and dispatch the files directly to the browser by setting the content-type directive.

in July 2004

The cryptographic technique to use for transmitting passwords during authentication is:

Digital signature
Symmetric encryption
Hashing
Salted Hash

Write To Us

All flowers, brickbats and suggestions are welcome. You can put in yours on the feedback page.