Christophe
Forum Replies Created
-
Awesome! Thanks for sharing @sechvn . I see their website also mentions hardware security and blockchain security. Please keep us posted on the rest of the book!
-
Thank you Alvin! Love the avatar, by the way.
We’ve had a few community members ask us that question recently, so I think there’s something very interesting there 😄
What kinds of boxes/practice would you like to see from us? Any in particular?
-
OK, yes there’s already been an issue opened with Mozilla for the geckodriver issue.
While we wait for a fix, there is a workaround:
- Launch ZAP
- Go to Tools -> Options
- Scroll down and click on Selenium
- Where it says “Binaries” add “/usr/bin/firefox-esr”
- Click OK to save the changes. It might give a warning box saying that it couldn’t save because of “null” but it should still have saved. You can double-check by closing and re-opening the Options window and make sure the changes are still there
- Try opening Firefox via manual exploration, and it should work
If you want to track the issue: https://github.com/zaproxy/zaproxy/issues/6115
-
Hey Aman, I noticed the same issue yesterday and found out that one of the ZAP add-on updates seems to have broken browsers.
The add-on is “Linux WebDrivers” going from version 18.0.0 to 19.0.0. As part of that update, they updated “geckodriver” to 0.27.0, and I’m guessing that’s what’s causing the issue.
I’m doing some more digging to see if there’s an open ticket for this already. If not, I’ll create one with the maintainers of the package.
-
My response:
For your first question about allowing access to your app from jailbroken devices: there are some mechanisms you can use to block the app from running if it detects a jailbroken device, but I don’t think there is a 100% full proof way of doing that. So, it should be a layer of defense, combined with other better layers. Because no, ideally, you should not allow jailbroken devices to run your, especially if it contains sensitive information app.
I found a good resource that discusses detecting jailbroken devices: https://www.cryptomathic.com/news-events/blog/application-hardening-for-mobile-banking-apps-root-and-jailbreak-detection. They have some other resources and blog posts that may be useful in answering some of your other questions.
Otherwise, I’m not sure if you’ve gotten to that part in my Intro to AppSec course yet or not (or if you already know of it), but the OWASP MASVS comes in very handy here. The level that you’ll want to aim for depends on your application and organization. For example, if you were dealing with a banking app, you’d probably want to aim for Level 2 + Resiliency.
Here are requirements recommended by the MASVS, some of which help answer your other questions:
- Resilience – https://mobile-security.gitbook.io/masvs/security-requirements/0x15-v8-resiliency_against_reverse_engineering_requirements
- Data storage – https://mobile-security.gitbook.io/masvs/security-requirements/0x07-v2-data_storage_and_privacy_requirements
- Cryptography – https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements
- Network communication – https://mobile-security.gitbook.io/masvs/security-requirements/0x10-v5-network_communication_requirements
They don’t necessarily provide all of the answers as to “how” you achieve the requirements, but at the very least it gives you a good checklist.
In terms of key management, hopefully these articles give helpful insights:
- https://www.cryptomathic.com/news-events/blog/secure-storage-and-key-protection-for-mobile-banking-and-payment-apps
- https://medium.com/hackernoon/they-reverse-engineered-16k-apps-heres-what-we-d-fix-67e9eeceefb5 (The idea: Using a 3rd party API proxy can help reduce the number of keys on the mobile device)
- https://hackernoon.com/mobile-api-security-techniques-682a5da4fe10
-
Glad it helps!
-
Welcome @kripar and thank you! We’re glad to have you here.
Let us know if you have any questions about the SQL injections course. By the way, we’ve just recently added an OS Command injections section to that course, so check that out!
-
Welcome, @sechvn ! We’re glad to have you here and we look forward to helping you find your path! It can definitely be an overwhelming field because there’s so much going on, so much to learn, and so many possible directions. Let’s keep the dialog open and take it one step at a time, and you’ll find your footing in no time 🙂
I’d personally love to hear about some of the projects you had difficulty with in school, and I have no doubt others would benefit from it too.
You mentioned having written a few tutorials — have you posted them publicly? If so, I would love to take a look. Otherwise, we’d love to have you consider posting them on our blog, since they could help others in similar shoes!
-
Thank you for the comment, @sechvn , and welcome to the community! Certifications used to carry a lot more weight, back when fewer people had them. They are still beneficial, especially in getting your foot through the door, but you’re right — hiring managers expect a certain level of experience instead of hiring and providing training for upskilling to that level.
I’d love to chat with you and your brother on ways we can bolster the experience level and resume to land those jobs. We’re currently thinking through different projects that may be good fits.
-
Welcome to the community, @MrSagarBedi ! We’d love to learn more about your learning goals — are you looking to get certified? Learn specific skills?