security – Page 4 – Scriptingthewhy.com

Programming, Security, Tech

Understanding PWAs: Advantages, Security Challenges, and Best Practices

Key Takeaways

What are PWAs?

PWAs are web applications that offer a native app-like experience.
They work on any platform with a standards-compliant browser.
They leverage modern web capabilities for features like offline functionality and push notifications.

Benefits of PWAs:

Cross-platform compatibility.
Offline functionality.
Improved performance.
Cost-effective development.

Security Risks Associated with PWAs:

Service worker vulnerabilities.
Man-in-the-middle attacks.
Cookie hijacking.
Unverified sources.

Best Practices for Securing PWAs:

Implement HTTPS.
Use secure authentication.
Regular security testing.
Content Security Policy (CSP).
Secure service workers.

Overall:

PWAs offer a powerful tool for web development.
Security is a critical concern for PWAs.
Developers must adhere to best practices to mitigate risks.

You’ve checked the underhood of a car, this is under the hood of a website.
Photo by Markus Spiske, please support by following @pexel.com

Grasping Progressive Web Apps (PWAs) and Their Security Implications

The internet houses some of the most creative and problematic individuals since the movie “Animal House”. In an ever-evolving landscape of web development, Progressive Web Apps (PWAs) have emerged as a powerful tool, blending the best of web mobile applications and human intervention.

However, it seems like every day there’s a new threat online one should worry about. And if you’re still reading this, here’s another reason to keep a close eye on your accounts. Hackers are finding new/old and interesting ways to trick you into giving them money. This is strange because we’re harping on hackers when workplaces tend to do the same thing. How can we get more of your time and leave you with less money?

Okay, thinking about how to answer that question is scary on its own. In this script, we’ll go over the world of PWAs, exploring their benefits, potential security risks, and some best practices to mitigate their risks.

What are Progressive Web Apps (PWAs)?

Progressive Web Apps are web applications that offer a native app-like experience to users. They are designed to work on any platform that uses a standards-compliant browser, including both desktop and mobile devices. In simple terms, this would be also known as a web-based application.

The beauty is that PWAs leverage modern web capabilities to deliver an app-like experience, including offline functionality, push notifications, and fast loading times. The reason is that most native applications require the use of hardware to run whereas web-based ones do not.

Hey, it’s that chick I met in the bookstore.
Bro, you still read books?
Photo by BlackBoy Joy, please support by following @pexel.com

A Thought

Picture this, you’re sitting home watching television, and your phone goes off. You look at your phone thinking maybe it’s someone you might know. Like that person, you’ve been crushing on since meeting them in a bookstore, library, or some other location, and after viewing your phone you find it’s a notification saying, “Your banking app is outdated, and an update is required”.

You think to yourself, “This is strange, but sure, we’ll go ahead and do it.” Beginning the updating process, you’re prompted to give permission to download from a third party. You think, “This is also strange, but sure, maybe this multi-factor authentication in another form.”

After reaching back to the home screen on your phone – to those who grew up without this level of technology, uh yeah, never thought phones would have home screens – you find your banking application has been added.

Well, there’s nothing to worry about here, wait let me check my account while I’m here. While launching the banking applications, inputting your login information, and hopping through a series of hoops…the hacker is collecting all of your sweet, sweet information, and storing it for a later date and time.

This isn’t play-by-play how the attack is executed but this is to give you an idea of how it’s executed. Also, wait, do people still meet in locations with books? Is that still a thing?

Benefits of PWAs

Cross-Platform Compatibility: PWAs work seamlessly across different devices and operating systems.

Offline Functionality: Thanks to service workers, PWAs can function offline or on low-quality networks.

Improved Performance: PWAs load faster and provide a smoother user experience.

Cost-Effective: Developing a PWA is often more cost-effective than creating separate native apps for different platforms.

Security Risks Associated with PWAs

While PWAs offer numerous advantages, they also introduce new security challenges. Here are some key security risks:

Service Worker Vulnerabilities: Service workers, which enable offline functionality and background sync, can be a potential attack vector if not properly secured.

Man-in-the-Middle Attacks: Since PWAs rely on web technologies, they are susceptible to man-in-the-middle attacks if not served over HTTPS.

Cookie Hijacking: Attackers can hijack session cookies to impersonate users and gain unauthorized access to sensitive information.

Unverified Sources: Unlike native apps that are vetted by app stores, PWAs can be distributed directly from the web, raising concerns about the authenticity and security of the source.

Let me double-check this link. Something is off here.
Photo by Olha Ruskykh, please support by following @pexel.com

Best Practices for Securing PWAs

To ensure the security and integrity of PWAs, developers must adhere to a set of best practices:

Implement HTTPS: Always serve PWAs over HTTPS to protect against man-in-the-middle attacks and ensure data integrity.

Use Secure Authentication: Implement robust authentication mechanisms, such as multi-factor authentication (MFA), to verify user identities.

Regular Security Testing: Conduct regular penetration testing and security assessments to identify and mitigate vulnerabilities.

Content Security Policy (CSP): Implement a strict Content Security Policy to prevent cross-site scripting (XSS) attacks and other code injection attacks.

Secure Service Workers: Ensure that service workers are properly secured and follow best practices to prevent unauthorized access.

Conclusion

Progressive Web Apps represent a significant advancement in web technology, offering a seamless and engaging user experience. However, as with any technology, they come with their own set of security challenges. By understanding these risks and implementing best practices, developers can harness the power of PWAs while ensuring the security and privacy of their users.

Sources: https://securityintelligence.com/articles/progressive-web-apps-cookie-crumbles/, https://www.koombea.com/blog/pwa-security/, https://hackernoon.com/9-pwa-security-practices-to-safeguard-from-cyber-threats

Love learning tech? Join our community of passionate minds! Share your knowledge, ask questions, and grow together. Like, comment, and subscribe to fuel the movement!

Don’t forget to share.

Every Second Counts. Help our website grow and reach more people in need. Donate today to make a difference!

Make a one-time donation

Make a monthly donation

Make a yearly donation

Choose an amount

$5.00

$15.00

$100.00

$5.00

$15.00

$100.00

$5.00

$15.00

$100.00

Or enter a custom amount

Your contribution is appreciated.

Donate Donate monthly Donate yearly

Security, Tech

Being able to phish is important, here’s how…

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

gentleman sitting down with breakfast at a laptop — A mail-order bride doesn’t sound like a bad idea after all.
Photo by Jack Sparrow, please show support by following @pexels.com

So you get an email from someone you don’t know, more likely they’re someone who promises you something that’s usually too good to be true, like in my case a nice comfy job that would pay six figures and all I had to do was work from home.

My start date is still pending. In other cases, it could be presenting you the opportunity to hold money for them because they claim to be a rich prince (or princess) with a lot of money, and they’ll reward you handsomely for completing such a task for them.

If you haven’t gotten any of these emails, you’re the lucky one out of the bunch because other people can attest to having their spam inboxes littered with these emails.

If you have ever been unfortunate enough to complete your interaction with any of these individuals, you’ll be sad to know, you’ve just been phished (and no, it’s not what you think it is).

Don’t know what I mean? Well, you’re in luck because I’ll be going over what, how, who, and more or less how you can be more aware when checking your DMs.

gentleman pointing a handgun — Hi, I’m Sarah69lover…and you’ve just been catfished.
Photo by cottonbro studio, please show support by following @pexel.com

Phishing with Dynamite

Phishing is not what the name states although it parallels and before you ask, no none of this happens with actual fish. Phishing is the act of contacting someone posing as a contact the victim may know or trust to extract money, and information, or to provide them with problematic malware.

Malware could be installed to either gather information without you knowing, wreak havoc on your computer, or simply a combination of the two.

There are a few various forms of phishing, all come with interesting versions of the original name. You have spear-phishing, whaling, smishing, vishing, and email-phishing.

Email phishing is the most common type of attack people fall victim to. In the other attacks, in a nutshell, an attacker is targeting you directly, an attacker is aiming for the most important individual in the company (more like CEO type person), an attacker tries contacting you via text with a link, and the last one is a voice call impersonating someone from a company like Microsoft.

There are two other types of attack which get even more interesting, there’s sextortion which is the attacker contacts you with a threat of revealing a recording from your webcam watching “adult time” material (been on the hub, I know that’s an actual brand, trust me I’m not proud) and search engine phishing (or SEO poisoning) where attackers prop themselves high up on the search engine only for you to click on their link and be redirected to emptying out your pockets or worse, releasing the hounds on your computer by downloading malware.

Criminals have many interesting ways of trying to get your money and that list continues to grow.

man looking with evil intentions — I never intended to rob people, but life insisted I do.
Photo by cottonbro studio, please show support by following @pexel.com

Emailing with Delicious Intent

Who are the people that do this and how could they do this to someone you might ask? Well, for one, it could be anybody, attackers come in all shapes and sizes.

That sweet old lady at the end of the street you live on who gives cookies to children with a smile and everyone in the neighborhood waves to could also be the same prince or princess seeking to pull money from your bank account.

And to the second part of your question, well, really, come on, the economy, might be a controversial thought but people would be less inclined to commit a crime if economic hardship wasn’t a thing.

Many people today are in the “have not” section of society and the cost of living rising each year applies pressure on people to venture into areas they wouldn’t have considered the year before, theft being one of them.

I’m not saying I condone it, but I understand it.

Woman seated in front of laptop — Can’t find me a date on tinder? Looks like it’s phishing time.
Photo by Dan Nelson, please show support by following @pexel.com

Two Times a Fool

You might be thinking to yourself, “who falls for this? I mean just how? Most of the emails I come across are poorly structured and or in bad English.” Well, just because you didn’t fall victim doesn’t mean your adolescent entrepreneur or Gam-gam won’t.

In fact, most victims are either in their 20s or in their mid-late 40s, so that’s either an “I’m still trying to figure it out, oh this link says it can make me rich” or “I’m about to hit a mid-life crisis and my Nigerian princess/wife is still not here.”

People who worked for big-name companies and even some big-name IT companies often become complacent and fall victim to these attacks.

So no matter what the target size is, the effects of phishing are felt around the world.

keyboard keys spelling the word "scam" — If you can read this, click the follow or subscribe button. It’s not a scam likely, promise.
Photo by Mikhail Nilov, please show support by following @pexel.com

Phishing Abroad

At this junction, you’re probably thinking, “I don’t want to fall victim to this, how do I protect myself or is there a career path to learn more so I can protect others?” You’re in luck, protecting yourself from phishing is possible but to quote Run-DMC, “it’s tricky”.

As mentioned earlier, attackers find interesting ways to pull money and information out of you. Some ways you could protect yourself are by double checking the email for grammar, misspelled words, and links that may seem fishy (saw what I did there) an example of this would be the word “google” spelled in the link as “go0g1e”, and finally double checking the person contacting you.

If they’re asking for information that they should have on hand and you’ve had no dealings with them or their company, swipe left because it’s a scam likely. Do you want to protect others?

There are countless entry-level cybersecurity jobs and for most of them, you don’t need a degree. An Information Security Analyst is one of the most common entry-level jobs, in which they are responsible for system and network security analysis.

You can learn the necessary skills on your own through a Bootcamp (which I wouldn’t recommend since they can get pricey) or by grabbing some online courses. I currently hold a certificate for Cybersecurity Analysis provided by IBM via Coursera.

It may be just a certificate that doesn’t hold much weight as a certification but passing the quizzes and projects wasn’t an easy ride.

It’s been over three paychecks and she’s still not here. I don’t know how much more money I can send her.
Photo by Andrea Piacquadio, please show support by following @pexels.com

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Think you have what it takes to enter the world of cyber security?

Script a comment below about a time when you got a suspect looking email.

Security, Tech

House Squatters and Typosquatters: Unwanted Intruders and Cyber Deception Unveiled

Key Takeaways

House Squatters

House squatting involves the unauthorized occupation of a property.
Evicting squatters can be a legal challenge for homeowners.
Property owners must often prove ownership and the squatter’s lack of legal claim.

Typosquatting

Typosquatting is the creation of websites with misspelled domain names to deceive users.
Cybercriminals use typosquatting to steal personal information or infect devices with malware.
The impact of typosquatting extends beyond individual victims, affecting businesses and online communities.

Protection

Both physical and digital security measures are essential.
Homeowners should invest in strong locks and security systems.
Online users should be cautious of typos, verify website URLs, and use strong passwords.
Staying informed about squatting tactics helps individuals and communities protect themselves.

The first bed in this house was trash, but this one is just right.
Photo by Ron Lach, please support by following @pexel.com

The Unwanted Guests of Our Digital and Physical Worlds: House Squatters and Typosquatters

The term “squatter” often conjures images of unwanted individuals occupying an abandoned building. But did you know there’s a digital equivalent to this real-world nuisance? Buckle up, because we’re diving into the world of squatters, both physical and digital, and how they can disrupt our lives.

House Squatters: Uninvited Guests in the Brick-and-Mortar Realm

Let’s address the elephant in the room (or rather, the unwanted squatter in your house). House squatting, thankfully, doesn’t involve fitness fanatics breaking into your home to pump some iron. It refers to the unlawful occupation of a property by someone who has no legal right to be there. While some might picture dramatic scenes of forced entry, squatters often gain access through more subtle means, like exploiting security vulnerabilities or taking advantage of vacant properties during periods of owner absence.

Now, here’s where things get a little interesting (and frustrating for homeowners). The legal process of evicting squatters can be surprisingly complex. The burden of proof often falls on the rightful owner, who needs to demonstrate their ownership, and the squatter’s lack of legal claim. This means providing documentation and potentially navigating lengthy court proceedings. So, while you might be the rightful owner gazing upon an uninvited guest in your living room, the law demands a more structured approach to reclaiming your property.

There’s google.com already, so I’ll make gooogle.com. Clever, me thinks.
Photo by Tima Miroshnichenko, please support by following @pexel.com

The Digital Squatters: Typosquatting and the Web of Deception

The digital world isn’t immune to squatters either. Enter typosquatting, a cunning trick employed by cybercriminals. These digital squatters register domain names that are deliberate misspellings of popular websites. Imagine searching for “paypaal.com” instead of “paypal.com.” A typosquatter might own the former domain, creating a website that looks eerily similar to the real PayPal. Unsuspecting users, after a quick typo, could land on this fake website and unwittingly enter their login credentials. This is a classic phishing scam, where the goal is to steal personal information or infect your device with malware (malicious software).

Malware itself is a broad term, encompassing a variety of malicious programs. While Trojans might be one type you’ve heard of, there are many others. Viruses can replicate themselves and spread throughout your system, while spyware gathers your data without your knowledge. Keyloggers capture your keystrokes, potentially revealing passwords and other sensitive information. The type of malware a typosquatter might unleash depends on their specific aim, but the result is always disruptive and potentially damaging.

Beyond Malware: The Broader Impact of Typosquatting

The impact of typosquatting goes beyond individual victims. Imagine a company struggling to maintain its online reputation because a typosquatted website is spreading misinformation or tarnishing its brand image. This can damage customer trust and lead to financial losses. Even worse, a typosquatted website could be used for illegal activities, further harming the legitimate website and its users.

Protecting Yourself from Squatters: Real and Digital

Whether you’re a homeowner or a web user, vigilance is key. Here are some tips to safeguard yourself from both physical and digital squatters:

Physical Security: Invest in strong locks and security systems for your home. Keep an eye out for suspicious activity and report it to the authorities promptly.
Digital Security: Be mindful of typos when entering website addresses. Double-check the URL before hitting “enter.” Look for security certificates on websites when making online transactions. Utilize strong passwords and regularly update your software and antivirus programs.

You gonna learn to stay out of my house!
Photo by Ketut Subiyanto, please support by following @pexel.com

The Importance of Awareness: Fighting Back Against Squatters

By understanding the tactics of both house squatters and typosquatters, we can be better equipped to protect ourselves. Sharing this information with friends and family can create a ripple effect of digital and physical security awareness. Additionally, supporting organizations that advocate for stronger anti-squatting legislation and cybersecurity measures plays a crucial role in combating these malicious practices.

Remember: Squatters, whether physical or digital, thrive on our vulnerabilities. With a little knowledge and preventative action, we can reclaim control of our homes and online experiences, keeping these unwanted guests at bay.

Love learning tech? Join our community of passionate minds! Share your knowledge, ask questions, and grow together. Like, comment, and subscribe to fuel the movement!

Don’t forget to share.

Every Second Counts. Help our website grow and reach more people in need. Donate today to make a difference!

Make a one-time donation

Make a monthly donation

Make a yearly donation

Choose an amount

$5.00

$15.00

$100.00

$5.00

$15.00

$100.00

$5.00

$15.00

$100.00

Or enter a custom amount

Your contribution is appreciated.

Donate Donate monthly Donate yearly