Important Rules About Staying Safe On The Social Web

 Staying Safe On The Social Web

Think about the scenario – “You are sharing details about your family, work, life and interests to a stranger. Adding onto this, you also share your personal photos.”

Would you do this in real course of life? Obviously NO. But, this is exactly what majority of us do on social media – “Giving away more than what we think and that too to strangers.”

Social Media, although in virtual space, has acquired a major part of our real life. It’s in vogue and has fun element attached to it. We get instigated by its charm and the nature of such platforms is that we tend to reveal our personal details to the public with ease.

The dark side of such acts is that the Security of our Public Profile is at loss and online reputation is compromised.

Don’t put your safety and future at risk. The posts/images you post on the Internet at publicly available for years. Follow the below measures to keep away from impersonators, spammers and stalkers.

• Know your online friends – It’s alluring to accept many friend requests and witness a hug friend circle and followers. It’s a rage that makes you feel popular. Word of Caution – Unknown Friends and Followers can be anyone. Would you prefer unknown people to see your pictures, videos or comments? Hence, stop accepting friend requests from unknown people and followers.
• Share with Care – Maintain extreme caution of what you post online since that will be available for years to come and anyone with viewing rights will have access to it. The posts can be copied, shared and edited. This brings “Caution for Images” at the forefront. They can be misconstrued by anyone on your network. Judge if the posts/images can be the potential grounds for your embarrassment and severely damage your reputation or career.
• Create Strong passwords – Choose a complex password for your social networking profile that no-one will be able to guess. It should be atleast 8-10 characters long by mixing letters, symbols and numbers. Avoid obvious passwords such as your children’s or pet’s name or your birthday and use different passwords for different websites. If you’re using a public or shared computer to access your social networking site, cancel any auto login or ‘remember me’ functions and always make sure you log out at the end of your session. If you’re accessing your profile from your mobile, set the phone’s PIN code or activate the security lock, if you have one.
• Use the Built in Privacy Settings Comprehensively – Each web site provides different levels of privacy settings to control access to your profile page and your interaction with others. Identity theft is at large on the Internet and information extracted from social networking sites is used by criminals to spam e-mails and for targeted attacks using sophisticated social engineering techniques. You should always judge which information that you put in while registering for new account should be made public and that which should be made private. If you have a public profile, it can be seen by anyone searching the social networking site and might also be available to people searching for profiles using a search engine, such as Google. On the other hand, a private profile allows only invited friends and members of chosen networks to view your content. 

• Beware of Spam Messages – It could be an e-mail impersonated from somebody’s known account disclosing your personal details. It doesn’t look like a spam message and it can trap you into revealing more sensitive information. Use the Security Settings to enable secure browsing and login notification whenever you login to create passwords for your account. There are numerous applications available. Avoid using Facebook password and Login approvals for applications. Specially create separate passwords for them.
  
  
• Act and React on Concerns at the earliest – If you think your account may have been compromised, immediately change your password. If status updates are appearing on your Facebook page that you didn’t make, you may have a rogue application. Remove the suspicious application from your Facebook profile as well as the related message from your status, News Feed, and your Likes and Interests in the “Edit my Profile” menu. Don’t suffer in silence if you’re concerned about content on, or contact made via, a social networking site. Many of the leading social networking providers have reporting mechanisms and contact details on their websites so that you can report what has happened easily and quickly. Just look for the ‘Help’, ‘Customer Care’ or ‘Report Abuse’ buttons on the social networking site.

Social networking is a global revolution. It has altered the ways of traditional socializing enabling people worldwide to stay in touch with their friends, share experiences, photographs and exchange personal content. It has become a way of life. Everything comes with pros and cons. If this is the brighter side, the darker side has ways to damage one’s online reputation. People can unintentionally or purposely use your personal information to harm you and or even steal your identity. The Security of our Social Media Profile is in our hands. Implementing simple security measures and considering social security at every step can mend ways to appear graceful online.

By: Ankit Kumar

XML Injection and XPath Injection

XML and XPath Injection

Most sites have a way to store data, the most common of which is a database. However some sites use XML to store data, and use a method of looking at the data known as XPath. When using SQL Databases to store site data, a site owner has to beware of SQL Injection attacks which can steal or alter data. Similarly, sites which store information using XML and XPath have to beware XPath injection to prevent data theft or modification.

XML and XPATH Injection

Applications which return different results based on user input (such as logging a user in based on username/password) may not properly filter all user input.

Imagine that you have user data stored in an XML file, and that XML file looks something like this:

<users>

        <user ID =1>

               <username>Admin</username>

               <password>MyPassw0rd</password>

               <role>admin</role>

        </userid>

</users>

Looking at the code the site uses to log in, it dynamically builds an XPath query in PHP, after a user has given username and password in a form (with user and pass variables):

<?php

$login = simplexml_load_file("users.xml");

$result=$login->xpath("//User[username/test()='".$_POST['user']." AND password/text()='".$_POST['pass']."'";

?>

The main problem above is that data from the user is not sanitized; the POST variable is being used to pull data directly from the login form, and placing it into the XPATH query. At this point, an attacker could try putting in a special string for username:

' or 1=1 or '

Now the query always returns the first user (admin in our case) and the attacker is logged in as an administrator!

Other attacks are possible using similar logic. Instead of logging in as an administrator, an attacker could use other special strings to request data from the document they should not have access to, potentially gathering all the data in the XML file.

How Does this Impact my Security?

A successful attack would allow an attacker to steal the entire database, including all sensitive data, and log in with administrative privileges in the application.

This is one of the most high risk vulnerabilities an application can have.

Preventing XML Injection

XPath injection can be prevented in a similar way to SQL Injection. The best way is to carefully sanitize user input. Any data received from a user should be considered unsafe. Removing all single and double quotes should remove most types of this kind of attack.

Beware that removing quotes can have side effects, such as when usernames might contain valid quotes. Imagine common names such as Admin, which contains a legitimate quote and may be input on a name request form. In these cases, the input should be escaped, often by adding a \ in front of quotes. Check with your specific library and XML software for the proper syntax.

Most programming libraries contain functions to help escape user input for the sake of queries. Check your specific documentation for the correct way to automatically escape data for querying XML documents.

Find XML Injection Vulnerabilities in Your Web Application

Goggle Technologies includes numerous different server setting scans to help you reduce your exposure to attack with thorough security scanning, including XML injection and Xpath Injection.