text:
An Evaluation of the Google Chrome Extension Security Architecture
- Branden Bryant
- 3 years ago
- Views:
1 An Evaluation of the Google Chrome Extension Security Architecture Nicholas Carlini, Adrienne Porter Felt, and David Wagner University of California, Berkeley Abstract Vulnerabilities in browser extensions put users at risk by providing a way for website and network attackers to gain access to users private data and credentials. Extensions can also introduce vulnerabilities into the websites that they modify. In 2009, Google Chrome introduced a new extension platform with several features intended to prevent and mitigate extension vulnerabilities: strong isolation between websites and extensions, privilege separation within an extension, and an extension permission system. We performed a security review of 100 Chrome extensions and found 70 vulnerabilities across 40 extensions. Given these vulnerabilities, we evaluate how well each of the security mechanisms defends against extension vulnerabilities. We find that the mechanisms mostly succeed at preventing direct web attacks on extensions, but new security mechanisms are needed to protect users from network attacks on extensions, website metadata attacks on extensions, and vulnerabilities that extensions add to websites. We propose and evaluate additional defenses, and we conclude that banning HTTP scripts and inline scripts would prevent 47 of the 50 most severe vulnerabilities with only modest impact on developers. 1 Introduction Browser extensions can introduce serious security vulnerabilities into users browsers or the websites that extensions interact with [20, 32]. In 2009, Google Chrome introduced a new extension platform with several security mechanisms intended to prevent and mitigate extension vulnerabilities. Safari and Mozilla Firefox have since adopted some of these mechanisms for their own extension platforms. In this paper, we evaluate the security of the widely-deployed Google Chrome extension platform with the goal of understanding the practical successes and failures of its security mechanisms. Most extensions are written by well-meaning developers who are not security experts. These non-expert developers need to build extensions that are robust to attacks originating from malicious websites and the network. Extensions can read and manipulate content from websites, make unfettered network requests, and access browser userdata like bookmarks and geolocation. In the hands of a web or network attacker, these privileges can be abused to collect users private information and authentication credentials. Google Chrome employs three mechanisms to prevent and mitigate extension vulnerabilities: Privilege separation. Chrome extensions adhere to a privilege-separated architecture [23]. Extensions are built from two types of components, which are isolated from each other: content scripts and core extensions. Content scripts interact with websites and execute with no privileges. Core extensions do not directly interact with websites and execute with the extension s full privileges. Isolated worlds. Content scripts can read and modify website content, but content scripts and websites have separate program heaps so that websites cannot access content scripts functions or variables. Permissions. Each extension comes packaged with a list of permissions, which govern access to the browser APIs and web domains. If an extension has a core extension vulnerability, the attacker will only gain access to the permissions that the vulnerable extension already has. In this work, we provide an empirical analysis of these security mechanisms, which together comprise a state-of-the-art least privilege system. We analyze 100 Chrome extensions, including the 50 most popular extensions, to determine whether Chrome s security mechanisms successfully prevent or mitigate extension vulnerabilities. We find that 40 extensions contain at least one type of vulnerability. Twenty-seven extensions contain core extension vulnerabilities, which give an attacker full control over the extension.
5 Web Network Vulnerable Component Attacker Attacker Core extension 5 50 Content script 3 1 Website 6 14 Table 1: 70 vulnerabilities, by location and threat model. Vulnerable Component Popular Random Total Core extension Content script Website Any Table 2: The number of extensions with vulnerabilities, of 50 popular and 50 randomly-selected extensions. 3.2 Vulnerabilities We found 70 vulnerabilities across 40 extensions. The appendix identifies the vulnerable extensions. Table 1 categorizes the vulnerabilities by the location of the vulnerability and the type of attacker that could exploit it. More of the vulnerabilities can be leveraged by a network attacker than by a web attacker, which reflects the fact that two of the Chrome extension platform s security measures were primarily designed to prevent web attacks. A bug may be vulnerable to both web and network attacks; we count it as a single vulnerability but list it in both categories in Table 1 for illustrative purposes. The vulnerabilities are evenly distributed between popular and randomly-selected extensions. Table 2 shows the distribution. Although popular extensions are more likely to be professionally written, this does not result in a lower vulnerability rate in the set of popular extensions that we examined. We hypothesize that popular extensions have more complex communication with websites and servers, which increases their attack surface and neutralizes the security benefits of having been professionally developed. The most popular vulnerable extension had 768,154 users in June Developer Security Effort Most extension developers are not security experts. However, there are two best practices that a securityconscious extension developer can follow without any expertise. First, developers can use HTTPS instead of HTTP when it is available, to prevent a network attacker from inserting data or code into an extension. Second, developers can use innertext instead of innerhtml when adding untrusted, non-html data to a page; innertext does not allow inline scripts to execute. We evaluate developers use of these best practices in order to determine how security-conscious they are. We find that 31 extensions contain at least one vulnerability that was caused by not following these two simple best practices. This demonstrates that a substantial fraction of developers do not make use of optional security mechanisms, even if the security mechanisms are very simple to understand and use. As such, we advocate mandatory security mechanisms that force developers to follow best security practices (Section 7). 3.4 Author Notification We disclosed the extensions vulnerabilities to all of the developers that we were able to contact. We found contact information for 80% of the vulnerable extensions. 5 Developers were contacted between June and September 2011, depending on when we completed each review. We sent developers follow-up s if they did not respond to our initial vulnerability disclosure within a month. Of the 32 developers that we contacted, 19 acknowledged and fixed the vulnerabilities in their extensions, and 7 acknowledged the vulnerabilities but have not completely fixed them as of February 7, Two of the un-patched extensions are official Google extensions. As requested, we provided guidance on how the security bugs could be fixed. None of the developers disputed the legitimacy of the vulnerabilities, although one developer argued that a vulnerability was too difficult to fix. The appendix identifies the extensions that have been fixed. However, the fixed extensions are not necessarily secure despite our review. While checking on the status of vulnerabilities, we discovered that developers of several extensions have introduced new security vulnerabilities that were not present during our initial review. We do not discuss the new vulnerabilities in this paper. 4 Evaluation of Isolated Worlds The isolated worlds mechanism is intended to protect content scripts from malicious websites, including otherwise-benign websites that have been altered by a network attacker. We evaluate whether the isolated worlds mechanism is sufficient to protect content scripts from websites. Our security review indicates that isolated worlds largely succeeds: only 3 of the 100 extensions have content script vulnerabilities, and only 2 of the vulnerabilities allow arbitrary code execution. Developers face four main security challenges when writing extensions that interact with websites. We discuss whether and how well the isolated worlds mechanism helps prevent these vulnerability classes. 5 For the remaining 20%, contact information was unavailable, the extension had been removed from the directory, or we were unable to contact the developer in a language spoken by the developer.
6 Data as HTML. One potential web development mistake is to insert untrusted data as HTML into a page, thereby allowing untrusted data to run as code. The isolated worlds mechanism mitigates this type of error in content scripts. When a content script inserts data as HTML into a website, any scripts in the data are executed within the website s isolated world instead of the extension s. This means that an extension can read data from a website s DOM, edit it, and then re-insert it into the page without introducing a content script vulnerability. Alternately, an extension can copy data from one website into another website. In this case, the extension will have introduced a vulnerability into the edited website, but the content script itself will be unaffected. We expect that content scripts would exhibit a higher vulnerability rate if the isolated worlds mechanism did not mitigate data-as-html bugs. Six extensions content scripts contained data-as-html errors that resulted in web site vulnerabilities, instead of the more-dangerous content script vulnerabilities. Furthermore, we found that 20 of the 50 (40%) core extension vulnerabilities are caused by inserting untrusted data into HTML; core extensions do not have the benefit of the isolated worlds mechanism to ameliorate this class of error. Since it is unlikely that developers exercise greater caution when writing content scripts than when writing core extensions, we conclude that the isolated worlds mechanism reduces the rate of content script vulnerabilities by mitigating data-as-html errors. Eval. Developers can introduce vulnerabilities into their extensions by using eval to execute untrusted data. If an extension reads data from a website s DOM and evals the data in a content script, the resulting code will run in the content script s isolated world. As such, the isolated worlds mechanism does not prevent or mitigate vulnerabilities due to the use of eval in a content script. We find that relatively few developers use eval, possibly because its use has been responsible for well-known security problems in the past [8, 27]. Only 14 extensions use eval or equivalent constructs to convert strings to code in their content scripts, and most of those use it only once in a library function. However, we did find two content script vulnerabilities that arise because of an extension s use of eval in its content script. For example, the Blank Canvas Script Handler extension can be customized with supplemental scripts, which the extension downloads from a website and evals in a content script. Although the developer is intentionally running data from the website as code, the integrity of the HTTP website that hosts the supplemental scripts could be compromised by a network attacker. Click Injection. Extensions can register event handlers for DOM elements on websites. For example, an extension might register a handler for a button s onclick event. However, extensions cannot differentiate between events that are triggered by the user and events that are generated by a malicious web site. A website can launch a click injection attack by invoking an extension s event handler, thereby tricking the extension into performing an action that was not requested by the user. Although this attack does not allow the attacker to run arbitrary code in the vulnerable content script, it does allow the website to control the content script s behavior. The isolated worlds mechanism does not prevent or mitigate click injection attacks at all. However, the attack surface is small because relatively few extensions register event handlers for websites DOM elements. Of the 17 extensions that register event handlers, most are for simple buttons that toggle UI state. We observed only one click injection vulnerability, in the Google Voice extension. The extension changes phone numbers on websites into links. When a user clicks a phone number link, Google Voice inserts a confirmation dialog onto the DOM of the website to ensure that the user wants to place a phone call. Google Voice will place the call following the user s confirmation. However, a malicious website could fire the extension s event handlers on the link and confirmation dialog, thereby placing a phone call from the user s Google Voice account without user consent. Prototypes and Capabilities. In the past, many vulnerabilities due to prototype poisoning and capability leaks have been observed in bookmarklets and Firefox extensions [20, 32, 2]. The isolated worlds mechanism provides heap separation, which prevents both of these types of attacks. Regardless of developer behavior, these attacks are not possible in Chrome extensions as long as the isolation mechanism works correctly. Based on our security review, the isolated worlds mechanism is highly effective at shielding content scripts from malicious websites. It mitigates data-as-html errors, which we found were very common in the Chrome extensions that we reviewed. Heap separation also prevents prototype poisoning and capability leaks, which are common errors in bookmarklets and Firefox extensions. Although the isolated worlds mechanism does not prevent click injection or eval-based attacks, we find that developers rarely make these mistakes. We acknowledge that our manual review could have missed some content script vulnerabilities. However, we find it unlikely that we could have missed many, given our success at finding the same types of vulnerabilities in core extensions. We therefore conclude that the isolated worlds mechanism is effective, and other extension platforms should implement it if they have not yet done so.
7 5 Evaluation of Privilege Separation Privilege separation is intended to shield the privileged core extension from attacks. The isolated worlds mechanism serves as the first line of defense against malicious websites, and privilege separation is supposed to protect the core extension when isolated worlds fails. We evaluate the effectiveness of extension privilege separation and find that, although it is unneeded, it would be partially successful at accomplishing its purpose if the isolated worlds mechanism were to fail. 5.1 Cross-Component Vulnerabilities Some developers give content scripts access to core extension permissions, which removes the defense-indepth benefits of privilege separation. We evaluate the impact of developer behavior on the effectiveness of extension privilege separation. Vulnerable Content Scripts. The purpose of privilege separation is to limit the impact of content script vulnerabilities. Even if a content script is vulnerable, privilege separation should prevent an attacker from executing code with the extension s permissions. We identified two extensions with content script vulnerabilities that permit arbitrary code execution; these two extensions could benefit from privilege separation. Despite privilege separation, both of the vulnerabilities yield access to some core extension privileges. The vulnerable content scripts can send messages to their respective core extensions, requesting that the core extensions exercise their privileges. In both extensions, the core extension makes arbitrary XHRs on behalf of the content script and returns the result to the content script. This means that the two vulnerable content scripts could trigger arbitrary HTTP XHRs even though content scripts should not have access to a cross-origin XMLHttpRequest object. These vulnerable extensions represent a partial success for privilege separation because the attacker cannot gain full privileges, but also a partial failure because the attacker can gain the ability to make cross-origin XHRs. Hypothetical Vulnerabilities. Due to the success of the isolated worlds mechanism, our set of vulnerabilities only includes two extensions that need privilege separation as a second line of defense. To expand the scope of our evaluation of privilege separation, we explore a hypothetical scenario: if the currently-secure extensions content scripts had vulnerabilities, would privilege separation mitigate these vulnerabilities? Of the 98 extensions that do not have content script vulnerabilities, 61 have content scripts. We reviewed the message passing boundary between these content scripts Permissions Number of Scripts All of the extension s permissions 4 Partial: Cross-origin XHRs 2 9 Partial: Tab control 5 Partial: Other 5 Table 3: 61 extensions have content scripts that do not have code injection vulnerabilities. If an attacker were hypothetically able to compromise the content scripts, these are the permissions that the attacker could gain access to via the message-passing channel with the cores. and their core extensions. We determined that 38% of content scripts can leverage communication with their core extensions to abuse some core extension privileges: 4 extensions content scripts can use all of their cores permissions, and 19 can use some of their cores permissions. Table 3 shows which permissions attackers would be able to obtain via messages if they were able to compromise the content scripts. This demonstrates that privilege separation could be a relatively effective layer of defense, if needed: we can expect that privilege separation would be effective at limiting the damage of a content script vulnerability 62% of the time. Example. The AdBlock extension allows its content script to execute a set of pre-defined functions in the core extension. To do this, the content script sends a message to the core extension. A string in the message is used to index the window object, allowing the content script to select a pre-defined function to run. Unfortunately, this also permits arbitrary code execution because the window object provides access to eval. As such, a compromised content script would have unfettered access to the core extension s permissions. Example. A bug in the Web Developer extension unintentionally grants its content script full privileges. Its content script can post small notices to the popup page, which is part of the core extension. The notices are inserted using innerhtml. The notices are supposed to be text, but a compromised content script could send a notice with an inline script that would execute in the popup page with full core extension permissions. 5.2 Web Site Metadata Vulnerabilities The Chrome extension platform applies privilege separation with the expectation that malicious website data will first enter an extension via a vulnerable content script. However, it is possible for a website to attack a core extension without crossing the privilege separation boundary. Website-controlled metadata such as titles and URLs can be accessed by the core extension through browser
8 Type Vulnerabilities Website content 2 Website metadata 5 HTTP XHR 16 HTTP script 28 Total 50 Table 4: The types of core extension vulnerabilities. managers (e.g., the history, bookmark, and tab managers). This metadata may include inline scripts, and mishandled metadata can lead to a core extension vulnerability. Website metadata does not flow through content scripts, so privilege separation does not impede it. We identified five vulnerabilities from metadata that would allow an attacker to circumvent privilege separation. Example. The Speeddial extension replicates Chrome s built-in list of recently closed pages. Speeddial keeps track of the tabs opened using the tabs manager and does not sanitize the titles of these pages before adding them to the HTML of one of its core extension pages. If a title were to contain an inline script, it would execute with the core extension s permissions. 5.3 Direct Network Attacks Privilege separation is intended to protect the core extension from web attackers and HTTP websites that have been compromised by network attackers. However, the core extension may also be subject to direct network attacks. Nothing separates a core extension from code in HTTP scripts or data in HTTP XMLHttpRequests. HTTP scripts in the core extension give a network attacker the ability to execute code with the extension s full permissions, and HTTP XHRs cause vulnerabilities when extensions allow the HTTP data to execute. Direct network attacks comprise the largest class of core extension vulnerabilities, as Table 4 illustrates. Of the 50 core extension vulnerabilities, 44 vulnerabilities (88%) stem from HTTP scripts or HTTP XMLHttpRequests, as opposed to website data. For example, many extensions put the HTTP version of the Google Analytics script in the core extension to track which of the extensions features are used. Example. Google Dictionary allows a user to look up definitions of words by double clicking on a word. The desired definition is fetched by making a HTTP request to google.com servers. The response is inserted into one of the core extension s pages using innerhtml. A network attacker could modify the response to contain malicious inline scripts, which would then execute as part of the privileged core extension page. 5.4 Implications The isolated worlds mechanism is so effective at protecting content scripts from websites that privilege separation is rarely needed. As such, privilege separation is used to address a threat that almost does not exist, at the cost of increasing the complexity and performance overhead of extensions. (Privilege separation requires an extra process for each extension, and communication between content scripts and core extensions is IPC.) We find that network attackers are the real threat to core extension security, but privilege separation does not mitigate or prevent these attacks. This shows that although privilege separation can be a powerful security mechanism [23], its placement within an overall system is an important determining factor of its usefulness. Our study also has implications for the use of privilege separation in other contexts. All Chrome extension developers are required to privilege separate their extensions, which allows us to evaluate how well developers who are not security experts use privilege separation. We find that privilege separation would be fairly effective at preventing web attacks in the absence of isolated worlds: privilege separation would fully protect 62% of core extensions. However, in more than a third of extensions, developers created message passing channels that allow low-privilege code to exploit high-privilege code. This demonstrates that forcing developers to privilege separate their software will improve security in most cases, but a significant fraction of developers will accidentally or intentionally negate the benefits of privilege separation. Mandatory privilege separation could be a valuable line of defense for another platform, but it should not be relied on as the only security mechanism; it should be coupled with other lines of defense. 6 Evaluation of the Permission System The Chrome permission system is intended to reduce the severity of core extension vulnerabilities. If a website or network attacker were to successfully inject malicious code into a core extension, the severity of the attack would be limited by the extension s permissions. However, permissions will not mitigate vulnerabilities in extensions that request many dangerous permissions. We evaluate the extent to which permissions mitigate the core extension vulnerabilities that we found. Table 5 lists the permissions that the vulnerable extensions request. Ideally, each permission should be requested infrequently. We find that 70% of vulnerable extensions request the tabs permission; an attacker with access to the tabs API can collect a user s browsing history or redirect pages that a user views. Fewer than half of extensions request each of the other permissions.
9 Permissions Times Requested Percentage tabs (browsing history) 19 70% all HTTP domains 12 44% all HTTPS domains 12 44% specific domains 10 37% notifications 5 19% bookmarks 4 15% no permissions 4 15% cookies 3 11% geolocation 1 4% context menus 1 4% unlimited storage 1 4% Table 5: The permissions that are requested by the 27 extensions with core extension vulnerabilities. None 15% Low 11% Medium 30% High 44% Figure 2: The 27 extensions with core vulnerabilities, categorized by the severity of their worst vulnerabilities. To summarize the impact of permissions on extension vulnerabilities, we categorized all of the vulnerabilities by attack severity. We based our categorization on the Firefox Security Severity Ratings [1], which has been previously used to classify extension privileges [4]: Critical: Leaks the permission to run arbitrary code on the user s system High: Leaks permissions for the DOM of all HTTP(S) websites Medium: Leaks permissions for private user data (e.g., history) or the DOM of specific websites that contain financial or important personal data (e.g., Low: Leaks permissions for the DOM of specific websites that do not contain sensitive data (e.g., or permissions that can be used to annoy the user (e.g., fill up storage or make notifications) None: Does not leak any permissions We did not find any critically-vulnerable extensions. This is a consequence of our extension selection methodology: we did not review any extensions with binary plugins, which are needed to obtain critical privileges. Figure 2 categorizes the 27 vulnerable extensions by their most severe vulnerabilities. In the absence of a permission system, all of the vulnerabilities would give an attacker access to all of the browser s privileges (i.e., critical privileges). With the permission system, less than half of the vulnerable extensions yield access to highseverity permissions. As such, our study demonstrates that the permission system successfully limits the severity of most vulnerabilities. We hypothesized that permissions would positively correlate with vulnerabilities. Past work has shown that many extensions are over-permissioned [12, 14], and we thought that developers who are unwilling to follow security best practices (e.g., use HTTPS) would be unwilling to take the time to specify the correct set of permissions. This would result in vulnerable extensions requesting dangerous permissions at a higher rate. However, we do not find any evidence of a positive correlation between vulnerabilities and permissions. The 27 extensions with core vulnerabilities requested permissions at a lower rate than the other 73 extensions, although the difference was not statistically significant. Our results show that developers of vulnerable extensions can use permissions well enough to reduce the privileges of their insecure extensions, even though they lack the expertise or motivation required to secure their extensions. Permissions are not only used by the Google Chrome extension system. Android implements a similar permission system, and future HTML5 device APIs will likely be guarded with permissions. Although it has been assumed that permissions mitigate vulnerabilities [10, 12, 14], our study is the first to evaluate whether this is true for real-world vulnerabilities or measure quantitatively how much it helps mitigate these vulnerabilities in practice. Our findings indicate that permissions can have a significant positive impact on system security and are worth including in a new platform as a second line of defense against attacks. However, they are not effective enough to be relied on as the only defense mechanism. 7 Defenses Despite Google Chrome s security architecture, our security review identified 70 vulnerabilities in 40 extensions. Based on the nature of these vulnerabilities, we propose and evaluate four additional defenses. The defenses are bans on unsafe coding practices that lead to vulnerabilities. We advocate mandatory bans on unsafe coding practices because many developers do not follow security best practices when they are optional (Section 3.3). We quantify the security benefits and compatibility costs of each of these defenses to determine whether they should be adopted. Our main finding is that a combination of banning HTTP scripts and banning inline scripts would prevent 94% of the core extension vulnerabilities, with only a small amount of developer effort to maintain full functionality in most cases.
10 In concurrent work, Google Chrome implemented Content Security Policy (CSP) for extensions. CSP can be used to enforce all four of these defenses. Initially, the use of CSP was wholly optional for developers. As of Chrome 18, extensions that take advantage of new features will be subject to a mandatory policy; this change was partially motivated by our study [5]. 7.1 Banning HTTP Scripts Scripts fetched over HTTP are responsible for half of the vulnerabilities that we found. All of these vulnerabilities could be prevented by not allowing extensions to add HTTP scripts to their core extensions [15] or to HTTPS websites. Extensions that currently violate this restriction could be easily modified to comply by packaging the script with the extension or using a HTTPS URL. Only vulnerable extensions would be affected by the ban because any extension that uses HTTP scripts will be vulnerable to man-in-the-middle attacks. Core Extension Vulnerabilities. Banning HTTP scripts from core extensions would remove 28 core extension vulnerabilities (56% of the total core extension vulnerabilities) from 15 extensions. These 15 extensions load HTTP scripts from 13 domains, 10 of which already offer the same script over HTTPS. The remaining 3 scripts are static files that could be downloaded once and packaged with the extensions. Website Vulnerabilities. Preventing extensions from adding HTTP scripts to HTTPS websites would remove 8 website vulnerabilities from 8 extensions (46% of the total website vulnerabilities). These vulnerabilities allow a network attacker to circumvent the protection that HTTPS provides for websites. The extensions load HTTP scripts from 7 domains, 3 of which offer an HTTPS option. The remaining 4 scripts are static scripts that could be packaged with the extensions. 7.2 Banning Inline Scripts Untrusted data should not be added to pages as HTML because it can contain inline scripts (e.g., inline event handlers, links with embedded JavaScript, and <script> tags). For example, untrusted data could contain an image tag with an inline event handler: <img onload="doevil();"...>. We find that 40% of the core extension vulnerabilities are caused by adding untrusted data to pages as HTML. These vulnerabilities could be prevented by not allowing any inline scripts to execute: the untrusted data will still be present as HTML, but it would be static. JavaScript will only run on a page if it is in a separate.js file that is stored locally or loaded from a trusted server that the developer has whitelisted. Banning inline scripts from extension HTML would eliminate 20 vulnerabilities from 15 extensions. All of these vulnerabilities are core extension vulnerabilities. Content script vulnerabilities cannot be caused by inline scripts, and we cannot prevent extensions from adding inline scripts to HTTPS websites because existing enforcement mechanisms cannot differentiate between a website s own inline scripts and extension-added scripts. However, banning inline scripts has costs. Developers use legitimate inline scripts for several reasons, such as to define event handlers. In order to maintain functionality despite the ban, all extensions would need to delete their inline scripts from HTML and move them to separate.js files. Inline event handlers (e.g., onclick) cannot simply be copied and pasted; they need to be rewritten as programmatically using the DOM API. We reviewed the 100 extensions to determine what changes would be needed to comply with a ban on inline scripts. Applying this ban breaks 79% of the extensions. However, all of the extensions could be retrofitted to work without inline scripts without significant changes to the extension. Most of the compatibility costs pertain to moving the extensions inline event handlers. The extensions contain an average of 7 event handlers, with a maximum of 98 and a minimum of 0 event handlers. 7.3 Banning Eval Dynamic code generation converts strings to code, and its use can lead to vulnerabilities if the strings are untrusted data. Disallowing the use of dynamic code generation (e.g., eval and settimeout) would eliminate three vulnerabilities: one core extension vulnerability, and two vulnerabilities that are both content script and core extension vulnerabilities. We reviewed the 100 extensions and find that dynamic code generation is primarily used in three ways: 1. Developers sometimes pass static strings to settimeout instead of functions. This coding pattern cannot be exploited. It would be easy to alter instances of this coding pattern to comply with a ban on dynamic code generation; the strings simply need to be replaced with equivalent functions. 2. Some developers use eval on data instead of JSON.parse. We identified one vulnerability that was caused by this practice. In the absence of dynamic code generation, developers could simply use the recommended JSON.parse. 3. Two extensions use eval to run user-specified scripts that extend the extensions. In both cases, their error is that they fetch the extra scripts over HTTP instead of HTTPS. For these two extensions, a ban on eval would prevent the vulnerabilities but irreparably break core features of the extensions.
15 0.13.1, AutoPager Chrome , RapidShare DownloadHelper Randomly Selected Extensions The 50 randomly selected extensions (and versions) that we reviewed are as follows: The Independent , Deposit Files Download Helper 1.2, The Huffington Post 1.0.5, Bookmarks Menu 3.4.6, X-notifier (Gmail, Hotmail, Yahoo, AOL...) 0.8.2, SmartVideo For YouTube 0.94, PostRank Extension 0.1.7, Bookmark Sentry 1.6.5, Print Plus , 4chan 4chrome , HootSuite Hootlet 1.5, Cortex 1.8.3, ScribeFire 1.7, Chrome Dictionary Lite 0.2.6, Taberareloo , SEO Status Pagerank/Alexa Toolbar 1.6, ChatVibes Facebook Video Chat! 1.0.7, PHP Console 2.1.4, Blank Canvas Script Handler , Reddit Reveal 0.2, Greplin 1.7.3, DropBox 1.1.5, Speedtest.or.th 1, Happy Status 1.0.1, New Tab Favorites 0.1, Ricks Domain Cleaner for Chrome 1.1.1, Fazedr 1.6, LL Bonus Comics First! 2.2, Better Reddit 0.0.4, (non-english characters) 1, turl.im url shortener 1.1, Wooword Bounce 1.2, ntust Library 0.7, me2mini , Back to Top 1.1, Favstar Tally shinn , ChronoMovie 0.1.0, AutoPagerize 0.3.1, Rlweb s Bitcoin Generator 0.1, Nooooo button 1, The Bass Buttons 1.95, Buttons 1.4, OpenAttribute 0.6, Nu.nl TV gids 1.1.3, Hide Sponsored Links in Gmail? 1.4, Short URL 4, Smart Photo Viewer on Facebook , Airline Checkin (mobile) , Democracy Now! 1.1, Coworkr.net Chrome 0.9.
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 mostMore information
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-More information
ADOBE AIR HTML Security
ADOBE AIR HTML Security Legal notices Legal notices For legal notices, see http://help.adobe.com/en_us/legalnotices/index.html. iii Contents The security challenges of RIAs.........................................................................................More information
Chrome Extensions: Threat Analysis and Countermeasures
Chrome Extensions: Threat Analysis and Countermeasures Lei Liu Xinwen Zhang Vuclip Inc. Huawei R&D Center Milpitas, CA 95035 Santa Clara, CA 95050 firstname.lastname@example.com email@example.com Guanhua Yan SongqingMore information
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White PaperMore information
Adobe Flash Player and Adobe AIR security
Adobe Flash Player and Adobe AIR security Both Adobe Flash Platform runtimes Flash Player and AIR include built-in security and privacy features to provide strong protection for your data and privacy,More information
Recent Advances in Web Application Security
Recent Advances in Web Application Security Author: Neelay S Shah Principal Security Consultant Foundstone Professional Services Table of Contents Introduction 3 Content Security Policy 3 Best PracticesMore information
Legal notices. Legal notices. For legal notices, see http://help.adobe.com/en_us/legalnotices/index.html.
ADOBE AIR Security Legal notices Legal notices For legal notices, see http://help.adobe.com/en_us/legalnotices/index.html. iii Contents Installing and updating desktop applications...........................................................................More information
What is Web Security? Motivation
email@example.com http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is WebMore information
Security features of ZK Framework
1 Security features of ZK Framework This document provides a brief overview of security concerns related to JavaScript powered enterprise web application in general and how ZK built-in features securesMore information
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application SecurityMore information
Hack Proof Your Webapps
Hack Proof Your Webapps About ERM About the speaker Web Application Security Expert Enterprise Risk Management, Inc. Background Web Development and System Administration Florida International UniversityMore information
Relax Everybody: HTML5 Is Securer Than You Think
Relax Everybody: HTML5 Is Securer Than You Think Martin Johns (@datenkeller) SAP AG Session ID: ADS-W08 Session Classification: Advanced Motivation For some reason, there is a preconception that HTML5More information
CommonSpot Content Server Version 6.2 Release Notes
CommonSpot Content Server Version 6.2 Release Notes Copyright 1998-2011 PaperThin, Inc. All rights reserved. About this Document CommonSpot version 6.2 updates the recent 6.1 release with: EnhancementsMore information
Application Security Testing. Indian Computer Emergency Response Team (CERT-In)
Application Security Testing Indian Computer Emergency Response Team (CERT-In) OWASP Top 10 Place to start for learning about application security risks. Periodically updated What is OWASP? Open Web ApplicationMore information
Security challenges for internet technologies on mobile devices
Security challenges for internet technologies on mobile devices - Geir Olsen [firstname.lastname@example.com], Senior Program Manager for Security Windows Mobile, Microsoft Corp. - Anil Dhawan [firstname.lastname@example.com],More information
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP TopMore information
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and SecurityMore information
Bug Report. Date: March 19, 2011 Reporter: Chris Jarabek (firstname.lastname@example.com)
Bug Report Date: March 19, 2011 Reporter: Chris Jarabek (firstname.lastname@example.com) Software: Kimai Version: 0.9.1.1205 Website: http://www.kimai.org Description: Kimai is a web based time-tracking application.More information
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, notMore information
WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY www.alliancetechpartners.com WEB SECURITY CONCERNS THAT WEB VULNERABILITY SCANNING CAN IDENTIFY More than 70% of all websites have vulnerabilitiesMore information
Security Research Advisory IBM inotes 9 Active Content Filtering Bypass
Security Research Advisory IBM inotes 9 Active Content Filtering Bypass Table of Contents SUMMARY 3 VULNERABILITY DETAILS 3 TECHNICAL DETAILS 4 LEGAL NOTICES 7 Active Content Filtering Bypass AdvisoryMore information
RTC-Web Security Considerations
RTC-Web Security Considerations IETF 80 Eric Rescorla email@example.com IETF 80 RTC-Web Security Issues 1 The Browser Threat Model Core Web Security Guarantee: users can safely visit arbitrary web sites andMore information
CS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis email@example.com 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.More information
Security Guide. BlackBerry Enterprise Service 12. for ios, Android, and Windows Phone. Version 12.0
Security Guide BlackBerry Enterprise Service 12 for ios, Android, and Windows Phone Version 12.0 Published: 2015-02-06 SWD-20150206130210406 Contents About this guide... 6 What is BES12?... 7 Key featuresMore information
The Weakest Link: Mitigating Web Application Vulnerabilities. webscurity White Paper. webscurity Inc. Minneapolis, Minnesota USA
The Weakest Link: Mitigating Web Application Vulnerabilities webscurity White Paper webscurity Inc. Minneapolis, Minnesota USA January 25, 2007 Contents Executive Summary...3 Introduction...4 Target Audience...4More information
Load testing with WAPT: Quick Start Guide
Load testing with WAPT: Quick Start Guide This document describes step by step how to create a simple typical test for a web application, execute it and interpret the results. A brief insight is providedMore information
Workday Mobile Security FAQ
Workday Mobile Security FAQ Workday Mobile Security FAQ Contents The Workday Approach 2 Authentication 3 Session 3 Mobile Device Management (MDM) 3 Workday Applications 4 Web 4 Transport Security 5 PrivacyMore information
Application Detection
The following topics describe Firepower System application detection : Overview:, page 1 Custom Application Detectors, page 7 Viewing or Downloading Detector Details, page 15 Sorting the Detector List,More information
Client vs. Server Implementations of Mitigating XSS Security Threats on Web Applications
Journal of Basic and Applied Engineering Research pp. 50-54 Krishi Sanskriti Publications http://www.krishisanskriti.org/jbaer.html Client vs. Server Implementations of Mitigating XSS Security ThreatsMore information
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTPMore information
Cross Site Scripting Prevention
Project Report CS 649 : Network Security Cross Site Scripting Prevention Under Guidance of Prof. Bernard Menezes Submitted By Neelamadhav (09305045) Raju Chinthala (09305056) Kiran Akipogu (09305074) VijayaMore information
Applications Performance Management
XO Technology Partner Applications Performance Management Browser and Java Support Best Practices Note: The following content is provided as-is and results from making these changes may vary dependingMore information
Recommended Practice Case Study: Cross-Site Scripting. February 2007
Recommended Practice Case Study: Cross-Site Scripting February 2007 iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for control system cyberMore information
Michael Seltzer COMP 116: Security Final Paper. Client Side Encryption in the Web Browser Mentor: Ming Chow
Michael Seltzer COMP 116: Security Final Paper Client Side Encryption in the Web Browser Mentor: Ming Chow 1 Abstract Web service providers generally look to encryption as a means of ensuring data privacyMore information
Web Vulnerability Assessment Report
Web Vulnerability Assessment Report Target Scanned: www.daflavan.com Report Generated: Mon May 5 14:43:24 2014 Identified Vulnerabilities: 39 Threat Level: High Screenshot of www.daflavan.com HomePageMore information
BYOD Guidance: BlackBerry Secure Work Space
GOV.UK Guidance BYOD Guidance: BlackBerry Secure Work Space Published 17 February 2015 Contents 1. About this guidance 2. Summary of key risks 3. Secure Work Space components 4. Technical assessment 5.More information
Anti-Phishing Best Practices for ISPs and Mailbox Providers
Anti-Phishing Best Practices for ISPs and Mailbox Providers Version 2.01, June 2015 A document jointly produced by the Messaging, Malware and Mobile Anti-Abuse Working Group (M 3 AAWG) and the Anti-PhishingMore information
FINAL DoIT 11.03.2015 - v.4 PAYMENT CARD INDUSTRY DATA SECURITY STANDARDS APPLICATION DEVELOPMENT AND MAINTENANCE PROCEDURES
Purpose: The Department of Information Technology (DoIT) is committed to developing secure applications. DoIT s System Development Methodology (SDM) and Application Development requirements ensure thatMore information
Web Application Security
Web Application Security A Beginner's Guide Bryan Sullivan Vincent Liu Mc r New York Chicago San Francisco Lisbon London Madrid Mexico City Milan New Delhi San Juan Seoul Singapore Sydney Toronto ContentsMore information
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...More information
MAXA-COOKIE-MANAGER - USER MANUAL - SW-Release V 5.0 / Document Rev. 1.1
MAXA-COOKIE-MANAGER - USER MANUAL - SW-Release V 5.0 / Document Rev. 1.1 Quick Start Once installed MAXA Cookie Manager goes to work immediately to gather information about the cookies on your system andMore information
Protecting Web Applications and Users
Protecting Web Applications and Users Technical guidance for improving web application security through implementing web browser based mitigations. Defence Signals Directorate February 2012 Contents 1More information
The Effectiveness of Application Permissions
The Effectiveness of Application Permissions Adrienne Porter Felt, Kate Greenwood, David Wagner University of California, Berkeley apf, kate eli, email@example.com Abstract Traditional user-based permissionMore information
Installation and Administration Guide
Installation and Administration Guide Release 8 This installation guide will walk you through how to install and deploy Conga Composer, including recommended settings for the application. Contact Support:More information
Project 2: Web Security Pitfalls
EECS 388 September 19, 2014 Intro to Computer Security Project 2: Web Security Pitfalls Project 2: Web Security Pitfalls This project is due on Thursday, October 9 at 6 p.m. and counts for 8% of your courseMore information
The Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions email@example.com Agenda Current State of Web Application Security UnderstandingMore information
How to break in. Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering
How to break in Tecniche avanzate di pen testing in ambito Web Application, Internal Network and Social Engineering Time Agenda Agenda Item 9:30 10:00 Introduction 10:00 10:45 Web Application PenetrationMore information
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. CurrentMore information
SmartGrant Web Browser Set-Up
SmartGrant Web Browser Set-Up TABLE OF CONTENTS SmartGrant Supported Web Browsers for Windows... 2 Configuring Your Web Browser for SmartGrant... 3 Internet Explorer... 3 Firefox... 10 Chrome... 15 Safari...More information
Five Tips to Reduce Risk From Modern Web Threats
Five Tips to Reduce Risk From Modern Web Threats By Chris McCormack, Senior Product Marketing Manager and Chester Wisniewski, Senior Security Advisor Modern web threats can infect your network, subvertMore information
Taking PDF security to a new level with Adobe Reader and Adobe Acrobat
Taking PDF security to a new level with Adobe Reader and Adobe Acrobat Acrobat X family of products raises the bar Table of contents 1: Improved application security 4: Tighter Integration with operatingMore information
Sophos Mobile Control Startup guide. Product version: 3
Sophos Mobile Control Startup guide Product version: 3 Document date: January 2013 Contents 1 About this guide...3 2 What are the key steps?...5 3 Log in as a super administrator...6 4 Activate SophosMore information
OFFICE OF THE CHIEF INFORMATION OFFICER OCIO-6013-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONSMore information
WompMobile Technical FAQ
WompMobile Technical FAQ What are the technical benefits of WompMobile? The mobile site has the same exact URL as the desktop website. The mobile site automatically and instantly syncs with the desktopMore information
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or inMore information
Thomas Röthlisberger IT Security Analyst email@example.com
Thomas Röthlisberger IT Security Analyst email@example.com Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 email@example.com www.csnc.ch WhatMore information
External Vulnerability Assessment. -Technical Summary- ABC ORGANIZATION
External Vulnerability Assessment -Technical Summary- Prepared for: ABC ORGANIZATI On March 9, 2008 Prepared by: AOS Security Solutions 1 of 13 Table of Contents Executive Summary... 3 Discovered SecurityMore information
WEB BROWSING PL Y IT SMART DON T BE PLAYED! 1. 2. The Great Leap of Web Browsers These days, web browsers are no longer mere messengers between client and server. They are full-fledged programs capableMore information
APPLICATION SECURITY: FROM WEB TO MOBILE. DIFFERENT VECTORS AND NEW ATTACK John T Lounsbury Vice President Professional Services, Asia Pacific INTEGRALIS Session ID: MBS-W01 Session Classification: AdvancedMore information
A Tale of the Weaknesses of Current Client-Side XSS Filtering
Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering Martin Johns, Ben Stock, Sebastian Lekies About us Martin Johns, Ben Stock, Sebastian Lekies Security Researchers at SAP, UniMore information
Portal Recipient Guide
Portal Recipient Guide Lindenhouse Software Limited 2015 Contents 1 Introduction... 4 2 Account Activation... 4 3 Forgotten Password... 9 4 Document signing... 12 5 Authenticating your Device & Browser...More information
Secure Email Client Guide
PRESIDIO BANK 33 Secure Email Client Guide THE BUSINESS BANK THAT WORKS 8/2013 Table of Contents Introduction.....3 Our Responsibility to Protect Confidential Information....4 Registering and AccessingMore information
Application security testing: Protecting your application and data
E-Book Application security testing: Protecting your application and data Application security testing is critical in ensuring your data and application is safe from security attack. This ebook offersMore information
Introduction to the AirWatch Browser Guide
Introduction to the AirWatch Browser Guide The AirWatch Browser application provides a safe, accessible and manageable alternative to Internet browsing using native device browsers. The AirWatch BrowserMore information
Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008
Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter firstname.lastname@example.com information
HTTPS Inspection with Cisco CWS
White Paper HTTPS Inspection with Cisco CWS What is HTTPS? Hyper Text Transfer Protocol Secure (HTTPS) is a secure version of the Hyper Text Transfer Protocol (HTTP). It is a combination of HTTP and aMore information
Sophos Mobile Control Startup guide. Product version: 3.5
Sophos Mobile Control Startup guide Product version: 3.5 Document date: July 2013 Contents 1 About this guide...3 2 What are the key steps?...5 3 Log in as a super administrator...6 4 Activate Sophos MobileMore information
S E C U R I T Y A S S E S S M E N T : B o m g a r A p p l i a n c e s
S E C U R I T Y A S S E S S M E N T : B o m g a r A p p l i a n c e s During the period between November 2012 and March 2013, Symantec Consulting Services partnered with Bomgar to assess the securityMore information
Blue Coat Security First Steps Solution for Deploying an Explicit Proxy
Blue Coat Security First Steps Solution for Deploying an Explicit Proxy SGOS 6.5 Third Party Copyright Notices 2014 Blue Coat Systems, Inc. All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER, CACHEFLOW,More information
2009-12-26 PST_WEBZINE_0X04. How to solve XSS and mix user's HTML/JavaScript code with your content with just one script
ACS - Active Content Signatures By Eduardo Vela Nava ACS - Active Content Signatures How to solve XSS and mix user's HTML/JavaScript code with your content with just one script Eduardo Vela Nava (email@example.com)More information
Penetration Test Report
Penetration Test Report Acme Test Company ACMEIT System 26 th November 2010 Executive Summary Info-Assure Ltd was engaged by Acme Test Company to perform an IT Health Check (ITHC) on the ACMEIT SystemMore information
EVALUATING COMMERCIAL WEB APPLICATION SECURITY. By Aaron Parke
EVALUATING COMMERCIAL WEB APPLICATION SECURITY By Aaron Parke Outline Project background What and why? Targeted sites Testing process Burp s findings Technical talk My findings and thoughts Questions ProjectMore information
Infor Xtreme Browser References
Infor Xtreme Browser References This document describes the list of supported browsers, browser recommendations and known issues. Contents Infor Xtreme Browser References... 1 Browsers Supported... 2 BrowserMore information
Internet Banking System Web Application Penetration Test Report
Internet Banking System Web Application Penetration Test Report Kiev - 2014 1. Executive Summary This report represents the results of the Bank (hereinafter the Client) Internet Banking Web ApplicationMore information
OWASP Top Ten Tools and Tactics
OWASP Top Ten Tools and Tactics Russ McRee Copyright 2012 HolisticInfoSec.org SANSFIRE 2012 10 JULY Welcome Manager, Security Analytics for Microsoft Online Services Security & Compliance Writer (toolsmith),More information
Manual. Netumo NETUMO HELP MANUAL WWW.NETUMO.COM. Copyright Netumo 2014 All Rights Reserved
Manual Netumo NETUMO HELP MANUAL WWW.NETUMO.COM Copyright Netumo 2014 All Rights Reserved Table of Contents 1 Introduction... 0 2 Creating an Account... 0 2.1 Additional services Login... 1 3 Adding aMore information
Securing Privileges in the Cloud. A Clear View of Challenges, Solutions and Business Benefits
A Clear View of Challenges, Solutions and Business Benefits Introduction Cloud environments are widely adopted because of the powerful, flexible infrastructure and efficient use of resources they provideMore information
HTML5. Eoin Keary CTO BCC Risk Advisory. www.bccriskadvisory.com www.edgescan.com
HTML5 Eoin Keary CTO BCC Risk Advisory www.bccriskadvisory.com www.edgescan.com Where are we going? WebSockets HTML5 AngularJS HTML5 Sinks WebSockets: Full duplex communications between client or serverMore information
End User Devices Security Guidance: Apple ios 8
GOV.UK Guidance End User Devices Security Guidance: Apple ios 8 Published Contents 1. Changes since previous guidance 2. Usage scenario 3. Summary of platform security 4. How the platform can best satisfyMore information
Presto User s Manual. Collobos Software Version 1.1. 2013 Collobos Software, Inc! http://www.collobos.com
Presto User s Manual Collobos Software Version 1.1 2013 Collobos Software, Inc! http://www.collobos.com Welcome To Presto! 3 AirPrint! 3 Google Cloud Print! 3 System Requirements! 3 How It Works! 5 PrintKitMore information
Nuclear Regulatory Commission Computer Security Office Computer Security Standard
Nuclear Regulatory Commission Computer Security Office Computer Security Standard Office Instruction: Office Instruction Title: CSO-STD-1108 Web Application Standard Revision Number: 1.0 Effective Date:More information
Software Vulnerability Assessment
Software Vulnerability Assessment Setup Guide Contents: About Software Vulnerability Assessment Setting Up and Running a Vulnerability Scan Manage Ongoing Vulnerability Scans Perform Regularly ScheduledMore information
Server-Side JavaScript Injection Bryan Sullivan, Senior Security Researcher, Adobe Secure Software Engineering Team July 2011
Server-Side JavaScript Injection Bryan Sullivan, Senior Security Researcher, Adobe Secure Software Engineering Team July 2011 Abstract This whitepaper is presented in support of the BlackHat USA 2011 talk,More information
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework email@example.com keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.More information
Evolutions in Browser Security
ANALYST BRIEF Evolutions in Browser Security TRENDS IN BROWSER SECURITY PERFORMANCE Author Randy Abrams Overview This analyst brief aggregates results from NSS Labs tests conducted between 2009 and 2013More information
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary IntroductionMore information
WebView addjavascriptinterface Remote Code Execution 23/09/2013
MWR InfoSecurity Advisory WebView addjavascriptinterface Remote Code Execution 23/09/2013 Package Name Date Affected Versions Google Android Webkit WebView 23/09/2013 All Android applications built withMore information
Data Breaches and Web Servers: The Giant Sucking Sound
Data Breaches and Web Servers: The Giant Sucking Sound Guy Helmer CTO, Palisade Systems, Inc. Lecturer, Iowa State University @ghelmer Session ID: DAS-204 Session Classification: Intermediate The GiantMore information
Cloud Security:Threats & Mitgations
Cloud Security:Threats & Mitgations Vineet Mago Naresh Khalasi Vayana 1 What are we gonna talk about? What we need to know to get started Its your responsibility Threats and Remediations: Hacker v/s DeveloperMore information
Christchurch Polytechnic Institute of Technology Information Systems Acquisition, Development and Maintenance Security Standard
Christchurch Polytechnic Institute of Technology Information Systems Acquisition, Development and Maintenance Security Standard Corporate Policies & Procedures Section 1: General Administration DocumentMore information
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? A Typical Attack Scenario
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? Drive-by Downloads are a common technique used by attackers to silently install malware on a victim s computer. Once a target website has been weaponized withMore information
Cross-site site Scripting Attacks on Android WebView
IJCSN International Journal of Computer Science and Network, Vol 2, Issue 2, April 2013 1 Cross-site site Scripting Attacks on Android WebView 1 Bhavani A B 1 Hyderabad, Andhra Pradesh-500050, India AbstractMore information
Grandstream Networks, Inc. UCM6100 Security Manual
Grandstream Networks, Inc. UCM6100 Security Manual Index Table of Contents OVERVIEW... 3 WEB UI ACCESS... 4 UCM6100 HTTP SERVER ACCESS... 4 PROTOCOL TYPE... 4 USER LOGIN... 4 LOGIN TIMEOUT... 5 TWO-LEVELMore information
Online Data Services. Security Guidelines. Online Data Services by Esri UK. Security Best Practice
Online Data Services Security Guidelines Online Data Services by Esri UK Security Best Practice 28 November 2014 Contents Contents... 1 1. Introduction... 2 2. Data Service Accounts, Security and FairMore information
Gateway Apps - Security Summary SECURITY SUMMARY
Gateway Apps - Security Summary SECURITY SUMMARY 27/02/2015 Document Status Title Harmony Security summary Author(s) Yabing Li Version V1.0 Status draft Change Record Date Author Version Change referenceMore information
Reparing HTTP authentication for Web security
Reparing HTTP authentication for Web security Yutaka OIWA 1 Overview This position paper proposes improvement efforts for HTTP authentication/authorization mechanisms, to solve various current problemsMore information
Project OWASP and two most frequent vulnerabilities in web applications
Project OWASP and two most frequent vulnerabilities in web applications Filip Šebesta, Wilson Tuladhar 2010 Abstract With the rapid use of the Internet, there has been a rapid growth in websites and webMore information
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry EnterpriseMore information
Basic & Advanced Administration for Citrix NetScaler 9.2
Basic & Advanced Administration for Citrix NetScaler 9.2 Day One Introducing and deploying Citrix NetScaler Key - Brief Introduction to the NetScaler system Planning a NetScaler deployment Deployment scenariosMore information


text:
A former Ticonderoga High School exchange student is among those fighting for Ukrainian sovereignty. Asan Kenzhametov, third from left, attended Ti High during the 2000-2001 academic year as an exchange student from Ukraine.
A former Ticonderoga High School exchange student is among those fighting for Ukrainian sovereignty.
Asan Kenzhametov attended Ti High during the 2000-2001 academic year as an exchange student from Ukraine. He lived with the Arzberger family on Lake George Avenue.
He's now active in his country's efforts to repel Russian involvement in his native land. Russia has taken control of Ukraine's Crimean peninsula, prompting international condemnation.
"Friends! I ask everybody to take a minute aside and pray for Crimea in Ukraine and peace in Ukraine!," Kenzhametov posted on Facebook. "I'm here in Crimea, Ukraine. And, unlike before, there's a smell of war in the air that's becoming more and more vivid... Dear sweet friends, this war has all chances to go global and effect all of us. What can ordinary people like us do to influence the situation? PRAYER is the best."
Kenzhametov also posted several photos of himself and others protesting against the Russian incursion.
Kenzhametov didn't seem particularly interested in politics while in Ticonderoga, said Steve Arzberger, who hosted him.
"He was a quite kid, a good guy," Arzberger said. "He liked living here. At the end he wanted to stay in the U.S., but that wasn't part of the program. He was very bright."
After pro-Western protesters forced the pro-Russian government out of office earlier this month, the Russian military moved into Ukraine's Crimean peninsula. The peninsula is Russia's primary access to the Black Sea and home to Russian naval forces.
Russian leader Vladimir Putin claims the majority of Crimean residents favor becoming part of Russia. Putin supports a March 16 public referendum planned by Crimea's regional assembly on splitting from Ukraine and joining Russia.
Kenzhametov believes that vote is a sham.
"Latest facts indicate that over the last days thousands of citizens of Russia have come to Crimea 'to work' (some of them sincerely) by going around the city centers and waving flags of Russia and organizing provocations, and the main goal of all of this is to create an image of Crimea 'begging to join Russia'..." Kenzhametov said via Facebook. "While polls in January 2014 indicated that 41 percent of Crimeans were in favour of joining Russia. Now that percentage has decreased because many were disgusted by the amount of lies and falsehood by Russian side and the military occupation of Crimea.
"Putin has organized a big theater play in Crimea, don't believe the liar!," he said. "Crimea is a part of the free democratic UKRAINE forever!"
Leaders of Ukraine have vowed not to cede any part of their nation's territory to Russia.
Pro-Russian forces tightened their grip on Crimea by laying siege to the last military airfield under Ukrainian control there this week and trying to seize control of other military installations in the strategically important region, a Ukrainian defense spokesman said. Residents proclaimed their loyalty to Ukraine or Russia in competing rallies, which produced some scuffles.
In Kiev, the Ukrainian capital, thousands of people clutching blue-and-yellow national flags poured onto the streets to mark the bicentennial of the birth of Taras Shevchenko, their country's most famous poet and an ardent nationalist. Laying flowers at a statue of Shevchenko, acting Prime Minister Arseny Yatsenyuk declared that he would not give up "one centimeter of Ukrainian land."

subset: commoncrawl


text:
City Jobs
Human Resources: City of Stamford Employment
- View Open Jobs in the City of Stamford & Get Application for Open Jobs - View job openings, salary, required skills, duties. Application materials are available with each job listing to print, fill out at home and send in.
- The City of Stamford is an equal opportunity employer, committed to workforce diversity. Accordingly, as it relates to employment opportunities, The City will provide reasonable accommodation to applicants with disabilities in accordance with the law. Applicants requiring a reasonable accommodation for any part of the application and hiring process should contact the Human Resources Division and request a Human Resources Generalist for the position to which he or she is or has applied at (203) 977-4070.
- General Conditions for Job Announcements - Please Read First
- FAQ's about Seeking Employment with the City
- Board of Education Jobs (Teaching, Administrative, Security or Educational Assistant Positions)
- Follow @SPSRecruit on Twitter for the latest information on job postings and recruitment events


text:
Transgenic rice research
C002/1718 Rights Managed
530 pixels on longest edge, unwatermarked
Request/Download high-res file
Uncompressed file size: 50.6MB
Downloadable file size: 1.6MB
Please login to use the price calculator
Credit: PASCAL GOETGHELUCK/SCIENCE PHOTO LIBRARY
Release details: Model release not available. Property release not required.
Keywords: 21st century, adult, analysing, analysis, analytical, biochemical, biochemist, biochemistry, biological, biologist, biology, biotechnology, botanical, botany, caucasian, cirad, crop, cultivated rice, europe, european, food, food science, france, freezing, french, frozen, genetic, genetic engineering, genetic modification, genetically modified organism, geneticist, genetics, gm, gmo, handling, human, ice bath, laboratory, laboratory equipment, montpellier, oryza sativa, people, person, phial, plant, plants, protein extract, research, researcher, sample, scientist, second generation, second-generation, test, testing, transgenic, vial, vials, white
Licence fees: A licence fee will be charged for any media (low or high resolution) used in your project.


text:
HideShow resource information
- Created by: Jessica Bolus
- Created on: 27-04-15 10:25
View mindmap
- Major characters of the Old Testament
- ABRAHAM: The word of God came to Abram in a vision and repeated the promise of the land and descendants as numerous as the stars
- God told of the future ******* of Israel in Egypt.
- God described to Abram the land that his offspring would claim: the land of the Kenites, Kenizzites, Kadmonites, Hittites, Perizzites, Rephaims, Amorites, Canaanites, Girgashites, and Jebusites.
- Sarah couldn't have children so she offered up her handmaiden (Hagar) in order for Abraham to have a child.
- Abraham and Hagar's child was named Ishmael.
- God declared Abram's new name: "Abraham" – "a father of many nations"
- God declared Sarai's new name: "Sarah" and blessed her and told Abraham, "I will give thee a son also of her".
- Immediately after Abraham's encounter with God, he had his entire household of men circumcised.
- His son whom he named Isaac was born; and he circumcised him when he was eight days old.
- Abraham was commanded by God to offer his son up as a sacrifice in the land of Moriah.
- The patriarch traveled three days until he came to the mount that God told him of.
- Isaac carried the wood upon which he would be sacrificed.
- Along the way, Isaac asked his father where the animal for the burnt offering was, to which Abraham replied "God will provide himself a lamb for a burnt offering".
- Just as Abraham was about to sacrifice his son, he was interrupted by "the angel of the LORD", and he saw behind him a "ram caught in a thicket by his horns", which he sacrificed instead of his son.
- For his obedience he received another promise of numerous descendants and abundant prosperity.
- MOSES: Moses' Hebrew mother,Jochebed, secretly hid him when the Pharaoh ordered all newborn Hebrew boys to be killed
- Through the Pharaoh's daughter the child was adopted as a foundling from the Nile river and grew up with the Egyptian royal family.
- fter killing an Egyptian slavemaster Moses fled across the Red Sea to Midian, where he encountered the God of Israel speaking to him from within a "burning bush which was not consumed by the fire" on Mount Horeb
- God sent Moses back to Egypt to demand the release of the Israelites from slavery.
- commanded him to return to Egypt and bring his Chosen People (Israel) out of ******* and into the Promised Land (Canaan).
- After the Ten Plagues, Moses led the Exodus of the Israelites out of Egypt and across the Red Sea, after which they based themselves at Mount Sinai, where Moses received the Ten Commandments.
- he could destroy Pharaoh and his army at the Red Sea Crossing as a sign of his power to Israel and the nations.
- Amos
- one of the Twelve Minor Prophets.
- reign of Jeroboam II
- from the southern Kingdom of Judah but preached in the northern Kingdom of Israel.
- Amos was a sheep herder and a sycamore figfarmer
- "I am not a prophet nor a son of a prophet"
- Two of his teachings are: Prayers and sacrifices do not make up for bad deeds .Behaving justly is much more important than ritual
- Samuel
- literally meaning "Name of God" in Hebrew
- last of theHebrew Judges and the first of the major prophets who began to prophesy inside the Land of Israel.
- he also anointed the first two kings of the Kingdom of Israel: Saul and David
- A seer, based at Ramah
- Samuel initially appointed his two sons as his successors; however, the Israelites rejected them and insisted on having a king rule over them.
- Samuel, who is opposed to a king, warns them of the potential negative consequences of such a decision, but a#t the people's insistence, asks God for a king.
- ABRAHAM: The word of God came to Abram in a vision and repeated the promise of the land and descendants as numerous as the stars
No comments have yet been made


text: Select an international website Zoover.at Zoover.be Zoover.ch Zoover.com Zoover.com.tr Zoover.com.ua Zoover.cz Zoover.de Zoover.dk Zoover.es Zoover.fr Zoover.gr Zoover.hu Zoover.it Zoover.lt Zoover.nl Zoover.no Zoover.pl Zoover.pt Zoover.ro Zoover.ru Zoover.se Home Destinations Accommodations Add review Add review Add photos Add videos Add new accommodation Add attraction Home Add review Greece Saronic Islands Poros reviews Poros Reviews (3) Photos & videos (116) Accommodations (54) Weather forecast Map Tips (0) Question and Answer (0) 8.7 51 reviews See all reviews See all reviews Find Hotel Deals From € 36 Find the best deal View all photos Would you like to know what other people thought of their holiday in Poros? Then take look on this page at the reviews written by other travellers. Did you spend your holiday in Poros? Then you can add your review here. Poros scores a 8.7 out of 10, based on 51 reviews read more Would you like to know what other people thought of their holiday in Poros? Take a look at the reviews of other travellers about Poros. Have you been on a holiday in Poros yourself? Add your review here. - - - - - Less text 3 English reviews about Poros 9 3 Reviews Appreciation 9 Nightlife 9 Culture 9 Surroundings 9.3 Beaches 9 Atmosphere 10 Care for nature 10 Language: English (3) All (51) ------------ Dutch (48) German (9) Polish (3) French (2) Italian (2) Swedish (1) Party types: All (3) ------------ Group trip (1) Sort by: Date of visit Contribution date Poros! A dream! 10 Mary, 05 November 2013 Nightlife 10 Culture 10 Surroundings 10 Beaches 10 Atmosphere 10 Care for nature 10 AMAZING DESTINATION! Poros is an amazing island for couples or families. It offers a host of amazing tavernas, beaches, artists and watersports. Very close to other Saronic Islands and to Athens! _._ 8 Martine Beijk, 15 October 2007 Nightlife 8 Culture 8 Surroundings 8 Beaches 8 Atmosphere - Care for nature - A lot of entertainment and restaurants in Poros town. The Greeks are very friendly. Absolutely worth repeating! _._ 8 Trudy, 29 July 2007 Nightlife 8 Culture 8 Surroundings 9 Beaches 8 Atmosphere - Care for nature - Nice island, real vacationing between the Greek. Lovely for those who like rest. Actions for Poros Add review Add photos Add videos Add new accommodation Add attraction Print reviews Information about Poros Weather Poros Map Poros Photos Poros Videos Poros Question and Answer Poros Destinations nearby Iria Palea Epidaurus / Archaia Epidaurus Porto Heli Egina Hydra Agistri Aghia Marina Zoover link on your website Click here for all Zoover widget options


text:
The messages are flying thick and fast in these final days of the 2000 presidential race.
The airwaves are choked with advertisements, especially in battleground states. Telephones ring with auto-dialed, taped messages. Surrogates for each candidate - Barbara Bush, Bill Clinton, governors, wives, children, movie stars, whoever will catch the public's attention - are ricocheting across the country, aiming pitches at senior citizens and African-Americans, gun owners and college students.
But the words that matter most are the ones coming from the candidates themselves. And in these frenetic last days of this too-tight-to-breathe contest, when every vote matters, Al Gore and George W. Bush are back to hammering their core messages. In essence, it's prosperity versus values.
For Mr. Gore, it comes down to the economy. He asks: Do you want to go forward or backward? A Bush vote, the Democrat says, amounts to a vote for "big tax giveaways to the wealthy, big deficits, big debt, and repeat recessions," while a vote for Gore means "affordable tax cuts for families" and continued balanced budgets and prosperity.
For Bush, his candidacy is all about values. One is the two-way street called "trust" - that he can be trusted personally to uphold the honor of the presidency, and that he trusts the American people, and not Washington, to know what to do with their money.
Another is leadership. Over and over, the Republican tells voters, "this nation needs somebody to bring us together." It's time, he says, to stop the partisan bickering in Washington.
But at this late stage, Gore's challenge from Green Party candidate Ralph Nader - who is costing him votes in crucial Democratic-leaning states - has forced him to muddy his message and fight the battle on two fronts.
"The problem with Gore today is his message isn't as unified as Bush's," says John Green, a political analyst at the University of Akron in Ohio. "It may be that it can't be, given all the hoops he has to jump through."
In his appearance Tuesday night on "The Tonight Show," Gore defended his environmental record against Mr. Nader's, without referring to the consumer advocate by name. The fact that Gore is defensive even on the environment - given his authorship of the weighty environmental manifesto, "Earth in he Balance" - is just one sign that the vice president's campaign isn't going according to plan.
Democratic activists in strong Nader states sound almost desperate in their efforts to persuade voters that a vote for Nader amounts to a vote for Bush. In Minnesota, a state Gore must win to become president, Democratic spokeswoman Karen Louise Boothe wants Nader supporters to become "Nader-Traders": Vote for Gore in Minnesota, and get a friend in a nonbattleground state to vote for Nader.
The Nader camp is keen to cross the 5 percent threshold nationwide, so that the Green Party will qualify for federal matching funds in 2004. So another worry in the Gore camp is that, by election day, if voters think Gore is going to lose anyway, they may vote for Nader to help him get his 5 percent. In a tight race, that perception could help defeat Gore on election day, analysts say.
Still, Nader isn't posting his biggest polling numbers in the four most closely fought states: Michigan, Florida, Pennsylvania, and Missouri. In those states, Bush's and Gore's messages are finely tuned to appeal directly to the demographics of those voters.
In Florida and Pennsylvania, it's all about the senior citizens, and the message from each camp - backed by millions of dollars' worth of TV ads, millions of phone calls, and millions of pieces of direct mail - will center on Social Security and Medicare.
"Both parties have money to burn in Florida, and burn it they have," says Susan MacManus, a political scientist at the University of South Florida in Tampa.
All this focus on Social Security and Medicare, she adds, may produce a backlash in the central part of the state, the heart of the Florida battleground. "The younger population is sick of hearing about senior issues."
In Michigan, still too close to call, message-mongers also need to consider the law of unintended consequences. The pro-gun lobby, backed by actor Charlton Heston, has worked hard to peel votes from the traditionally Democratic union membership.
But, says independent Michigan pollster Ed Sarpolus, Mr. Heston is hurting Bush, because he's reminding Republican women about guns - and 3 of 5 Republican women agree with the Democratic position favoring greater gun control.
The latest polls out of Michigan show Gore gaining among seniors, as he pushes on their issues, and Bush gaining among voters under 50, as he focuses on education. Among another sought-after demographic - the more than 650,000 voters who went for Sen. John McCain in the Republican primary here - Gore is beating Bush, 60 percent to 40 percent, when the undecideds are factored out, says Mr. Sarpolus.
(c) Copyright 2000. The Christian Science Publishing Society


text:
Montreal Canadiens' General Manager Bob Gainey Resigns.
The Montreal Canadiens' General Manager, Bob Gainey, invited the press today to announce his departure.
A sigh of relief could almost be heard among the team's followers as Gainey announced his intention to leave the organization.
Many of us, followers and fans, have waited for a long time for this to happen and many thought that Mr Gainey and his daily thoughts were away from the game since the tragic death of his daughter Laura a few years ago.
The club's direction is now assumed by Gainey's assistant, Pierre Gauthier until a new General Manager is hired. The club has important decisions to make before and also after the trade deadline. Also, many important contracts are to be negociated this summer.
The club is now at the crossroads once again. Which direction will be taken by the Molson administration?
(Picture: Bob Gainey.)
Labels: hockey, montreal canadiens


text:
Tagged: Sunrise
FIFA 16 Soundtrack – Interview with Slaptop
An artist featured in the up and coming title Fifa 16 soundtrack is DJ-Producer Slaptop. You may recognize the name as his previous track Sunrise was featured in the Fifa 15 soundtrack. As well as his new song Walls being added into Fifa 16, Slaptop will also feature in this years 'Goals of the week' series as the Audio Curator. The guys over at EA we fortunate enough to catch up with Slaptop and asked him about his interest in Fifa, involvement within the game and of course, his music. In the past, artists and bands featured on past FIFA games … Read More »


text:
The contribution of inland fisheries to the livelihoods and food security of the peoples of Asia has long been achnowledged. Inland fisheries are one of the last open access natural resources and provide both income and food to some of the poorest rural inhabitants of the region. In Asia, inland fisheries are mostly rural, artisanal activities catering to rural populations and providing an affordable source of animal protein, employment and household income.
In more recent years, Asian inland fisheries have been seen to decline as environmental degradation, increasing fishing and population place pressure on these resources. This review looks at the resources and practices of management and enhancement of some key inland fisheries and how these resources can be enhanced to continue to provide food and income. Stock enhancement is an integral component of many inland fisheries. Indeed, new avenues of production such as culture-based fisheries are being increasingly adopted and are seen as a way forward in most countries. Inland fishery activities also have a distinct advantage in that their development is usually less resource intensive than is conventional aquaculture.
This review provides suggestions and recommendations on what needs to be done to improve current enhancement practices and the institutional and practical issues that relate to this. The effect of enhancement on wild fish stocks and the implications for hatchery management of stocks and stocking strategies are also covered.
Attention is now returning to inland fisheries as we increasingly appreciate their often hidden values to rural livelihoods. This review contributes to a better understanding of what needs and can be done and will hopefully serve as a catalyst for further work on the enhancement of inland fisheries.
He Changchui
Assistant Director-General and
Regional Representative for Asia and the Pacific


text:
- I laugh more freely - One the first things that struck me about the people of Tanzania was how eager they were to laugh, to simply enjoy the moment. As I climbed Kilimanjaro and porters passed me carrying heavy loads they always took a few moments to joke with me and share a laugh. Even under the burden of 60-80 pound loads these men took the time to laugh and joke.
- I enjoy life more fully - Almost every person I met in Tanzania seemed to live life fully. Yes, there was poverty and challenges beyond my ability to appreciate. But that didn't stop people from sharing a laugh and enjoy the few things they did have access to.
- I welcome new friends more openly - At one point on our travels Lisa (the beautiful brunette) and I ended up traveling on a local bus across Tanzania. We were the only white people on a bus packed to overflowing. At first I have to admit, I felt a bit intimidated and out of place. But as the bus cruised down the road we began to feel welcomed by these people; these strangers. We were all on a journey together, so why not enjoy each other's company? Smiles slowly emerged and we were welcomed as a fellow traveler, not a stranger or foreigner.
- I try more new things - Traveling through Tanzania and up Kilimanjaro we got lost, were confronted by "strange" people, tasted new foods and even got sick on the top of the African continent. But in the end, it all worked out. We tried something new, something a lot bigger than Lisa and I had ever tried before. And it was wonderful. Thanks to the warmth and generosity of the Tanzanian people we got through all the tough times and had a life-changing experience. We learned to be brave and try a few new things, even something as big as a mountain.
- Appreciate things more - As an American watching the news, my view of East Africa was pretty bleak. But my experience in Tanzania was quite different. I know there is plenty of poverty and problems in Tanzania. But I was struck by how much people appreciated the few things they did have, and how they appreciated each other more than anything. These weren't a "poor" people waiting for people like me to give them a hand out. They were proud, hopeful and lots of fun. They were my teachers and I learned to appreciate all the little things I had and the people in my life.
Must Read Topics
Share Your Opinions & Stories
- Climber Community | Share your own experience or Read what other climbers have to say.
- Outfitter Reviews | Post your opinion about an outfitter or recommend we list a new one.
Hot TopicsAltitude altitude sickness Attitude Climber Community climbing climbing routes concert contest Cost Culture Equipment fund raising gear Geology Helping Out History hypothermia lemosho Life Changing Experience Maasai machame Malaria marangu outfitter outfitters photo planning Porters rongai Routes Safari Safety seasons Serengeti shira success rate summit Tanzania training travel umbwe Weather western breach Wildlife
Follow Us On


text:
Two weeks ago, Netflix members were dealt a disheartening blow when the company announced it would be discontinuing the unlimited streaming and unlimited DVD rental option for $9.99 per month. Instead, the options will be split into two separate plans, each running $7.99 per month.
Now, to you and I, that may only amount to a few cents each day. But when you're waiting for just the right moment to devote your complete attention to getting caught up with Breaking Bad, those few cents can add up to quite a few Iced Venti Soy Lattes at Starbucks.
In response, subscribers took to the streets (i.e. Twitter) to express their frustration. But apparently, their grief was far too overwhelming, which prevented a larger outcry -- as Netflix CEO Reed Hastings noted.
"Believe it or not, the noise level was actually less than we expected, given a 60% price increase for some subscribers," Hastings cruelly remarked. "We knew what we were getting into, we tried to be as straightforward as we could, and that has worked out very well for us."
Oh sure, but what about that trust fund kid in Brooklyn unable to choose between streaming The Larry Sanders Show or waiting for the DVD to arrive? Have you no decency?!
But relief is on its way. Duckman's Jason Alexander -- with the help of Funny or Die -- has taken it upon himself to launch a relief fund for those who can't afford Netflix's new pricing structure.
In the interest of upper-middle-class twentysomethings everywhere, please give.
(See also: Best Reactions to Netflix's Price Hike and Netflix Expected Much Worse)
For an investment angle on these and many more tech stocks, take a FREE trial to the TechStrat Report by Sean Udall.


text:
I have a life proof and otter box but honestly otter box is good life proof I tried to take my case of and it broke I got an otter box and it was amazing great protection it is a very good case to buy for people who drop their phones
The Otterbox is a much more protective case in the event of falls and shocks. This is the unavoidable damage a phone must endure. All phones, all users. With the exception of a very few professions which require introducing submersion into the phone's environment, there is no good reason to surrender the far superior protection of the Otterbox for the novelty of waterproofing. I don't use my phone on the toilet or in the shower (behaviors most people would consider mental illness a few years ago), so this feature is irrelevant to me.
The Otterbox is a much more protective case in the event of falls and shocks. This is the unavoidable damage a phone must endure. All phones, all users. With the exception of a very few professions which require introducing submersion into the phone's environment, there is no good reason to surrender the far superior protection of the Otterbox for the novelty of waterproofing. I don't use my phone on the toilet or in the shower (behaviors most people would consider mental illness a few years ago), so this feature is irrelevant to me.
So yea, maybe i broke my phone in both types... . But still Otterbox has lasted me, what? 2 years? And Life-proof lasted maybe 2 months. Better yet, life-proof may protect from shocks, rain, dust, water. But somehow it managed to break my phone and i didn't do anything! With otterbox... I managed to drop it from 50 feet up and it not break. So OTTERBOX RULES!
I've no doubt the Lifeproof case is good and that it can protect the item well enough but having used one now I still feel as though I had to baby it due to the lack of protection around the screen of my 6s plus. I may sacrifice a bit of water protection with Otterbox but I still feel it's better served in the Defender.
My son has an ipad mini with a broken inner screen. He has dropped it and the inner screen broke. The outer screen is perfect. I have ALWAYS used Otterbox on my iphones, and have dropped them many many times...Never have had a screen (outer or inner) break. Not very impressed. Anyone know if LifeProof covers breakage on an ipad?
My phone got run over because I accidently dropped it without knowing and my dad ran it over. When I got home from school I saw my phone without its otter box on and the back was cracked but my front phone screen is perfectly fine. IF AN OTTERBOXX CAN KEEP MY PHONE SAFE EVEN WHEN BEING RUN OVER BY MY DAD'S CAR THEN IT CAN DO ANYTHING
LifeProof cases are designed to protect against water, correct? Well, it does a horrible job at it. Being that I am a life guard, a LifeProof case seemed like a smart option; however my iPhone 5C is now broken because of some moisture. OtterBox has never failed me in the past and I intend on purchasing OtterBoxes from now. If water is a factor in what product you wish to purchase, LifeProof is NOT better than OtterBox as far as I'm concerned.
There was a post on here that stated that otter box's rubber gets all stretched out and has to be replaced. Well if you read into a life proof case it will eventually get stretched out. They both get stretched out but are easily replaced. Otter Box is better at defending the phone, no doubt about it!
The otter box is the best all around case for protection! If protection isn't your primary concern then go with the Lifeproof case as it is less bulky and an amazing case however, the screen is less protected and can get scratched with the lifeproof case. With the equivalent otter box case, the screen is better protected and the phone is better protected from drops, bangs and crushes.
For an great waterproof case that is sleek you might want the lifeproof case but for the ultimate protection agains water, abuse and life then the otter box is the best choice
I've been using life proof cases for 4 years now and have dropped much time and yet to see a scratch or crack on the screen, and I've done some pretty bad drops. Second Life proof is waterproof I've dropped my phone in the pool, pond, and puddles and its still lived. I can also bring my phone surfing to catch those really cool shots or take underwater videos. Let me just say it simple LIfe proof cases are actually LIFEPROOF
Lifeproof cases are waterproof, snow proof, dirt proof, and dust proof. Otterbox is just drop proof. How can you take your phone in the water if it isnt waterproof. Also, the lifeproof case is much thinner and lighter with almost as much protection. All in all, the lifeproof is just a better choice, hands down.
Lifeproof is a case that easily surpasses otter box. The main thing that I love about Lifeproof is it being water proof! My friend dropped her phone (with a Lifeproof case) in the toilet by accident, and the phone was perfectly fine!! I have dropped my phone with this case a TON, and my case and phone is in perfect condition. Otter box, you can't drop your phone in water and in some case models are breaking/peeling really quick. I totally support #teamlifeproof
Ndndiabsnixanbsjznsbsjx s am z z six. And. Basis. Is no. I I bob. K. Knbovji bk k l o k knj j. Ok j k k k k k k k j j n j b b j h h h h. B b be. Bob. Be b h h h b b b
This is my first life proof case. I was hesitant to buy it because of the expense. However, I've owned nothing but Otter box cases in the past and although they did last the life of my phones, they are very bulky and not dust proof. Plus, the rubber wears off. I now own a life proof case and although the jury is still out, I'm loving the style and less bulk. Hoping it remains dust free.
The life proof case is slimmer and better is at handling spills and condensation. On the other hand the otter box is better for the complete clutz offering better protection against dunks and drops but the port flaps are incredibly weak against multiple uses. Overall if you have a habit of breaking you phone constantly go with the otter box. Now on to the astetics the lifeproof is slimmer and the built in screen protector is perfect against scratches and mild glare. The otter box how ever is bulky and the screen protector has a sensitivity issue meaning you'll probably have to apply slightly more pressure or be very patient. So overall if you have a habit of breaking your phone go with the otter box, but if you want something that offers a slight increase in durability and water resesistance with out sacraficing useablity life proof is the way. So the decision is yours
I've had the lifeproof and the otter box defender. The otter box has different cases for different reasons but the lifeproof is the whole package in one case. My defender cannot stand water, snow, dirt, or shocks but can only stand long drops. Don't just go after the brand. Otter box may be expensive, but it doesn't work as good as the lifeproof Fre.
I always had a life proof on my iPhone it protects against EVERYTHING my son also has life proof he dropped his phone and then accidently ran over the phone with the life proof case on it the phone came through with no problem and still worked :) I've seen my friends with a otter box on their phone and the rubber stuff on it stretches out and yes it gets replaced but what a headache I've never had to do that with my life proof case :)
As a boater I am around water all the time. Occasionally it drops in the drink or is the the pocket of your wet shorts. Never a problem. I have had a lifeproof case on my 4s for a few years and works great. I will say though that if you put it in your back pocket a lot the edges of the lifeproof case wears out. It is made out of softer material than the Otter Box and wears more easily. But the slimness of the LifeProof case and the protection it affords is still my preferred choice. Just waiting for the iPhone 6 case to come out now. Surprising it is taking this long for them to get the 6 to market.
I love lifeproof! I have one and I have dropped my phone countless times. I've dropped it in my pool, it's got snowed on,rained on, covered in mud. And my phone is perfectly working and not one scratch on my phone. I HIGHLY suggest the Lifeproof. My friend had a otter box and the case has torn and got super dirty. Lifeproof just looks better too. Without lifeproof my phone would have been long gone by now. !