Articles

Top 3 Chatbot Security Vulnerabilities in 2022

,

Article Image

Chatbots Are Here To Stay

Chatbots have been around for a long time and based on the global chatbot market size (and the expected growth), they will stick around for a long time and gain importance. In the past, they’ve rarely met customer expectations or provided much positive experience. However, over the last few years, advances in conversational AI have transformed how they can be used. Since chatbots offer a wide range of applications, in certain cases, they become responsible for collecting and protecting personal information as well. 
Consequently, they are a great attraction for hackers and malicious attacks too. The responsibility of ensuring chatbot security has become more evident after the introduction of GDPR in Europe. As statistics show that this technology will be a determining factor in our lives, security testing must also become part of our daily tasks, so that these chatbots can be used with confidence.

Security Risks, Threats, and Vulnerabilities                 

The words risk, threat, and vulnerability are often confused or used interchangeably when reading about computer security, so let’s first clarify the terminology:

  • Vulnerability refers to a weakness in your software (or hardware, or in your processes, or anything related). In other words, it’s a way hackers could find their way into and exploit your systems.
  • A threat exploits a vulnerability and can cause loss, damage, or destruction of an asset – threats exploit vulnerabilities.                
  • Risk refers to the potential for lost, damaged, or destroyed assets – threats + vulnerability = risk! 
The well-known OWASP Top 10 is a list of top security risks for a web application. Most chatbots out there are available over a public web frontend, and as such, all the OWASP security risks apply to those chatbots as well. Out of these risks, there are two especially important to defend against, as in contrast to the other risks, those two are nearly always a serious threat — XSS (Cross-Site Scripting) and SQL Injection.
In addition, for artificial intelligence-enabled chatbots, there is an increased risk for Denial of Service attacks, due to the higher amount of computing resources involved.

Vulnerability 1: XSS – Cross-Site Scripting

A typical implementation of a chatbot user interface:           

           

  • There is a chat window with an input box.
  • Everything the user enters in the input box is mirrored in the chat window.
  • Chatbot response is shown in the chat window.

The XSS vulnerability is in the second step — when entering text including malicious Javascript code, the XSS attack is fulfilled when the web browser is running the injected code:

 <script>alert(document.cookie)</script>              

Possible Attack Vector

For exploiting an XSS vulnerability the attacker has to trick the victim to send malicious input text. It can be done through one of the following ways:

/par

STRIDE Threat Modeling: What You Need to Know

,

Threat modeling is the ultimate shift left approach. It can be used to identify and eliminate potential vulnerabilities before a single line of code is written. Employing threat modeling methodologies should be your first step toward building networks, systems, and applications that will be secure by design.  STRIDE is a model of threats that can be used as a framework in ensuring secure application design.

STRIDE – Threat Modeling Methodology

STRIDE threat modeling

Source de l’article sur DZONE

/par

9 Must-Install Craft CMS Plugins

,

Craft CMS is increasing in popularity, and as it does, the previously relatively scant range of plugins is growing rapidly.

There are plugins for Craft ranging from simple field utilities to the full ecommerce solution provided by Pixel & Tonic — the makers of Craft.

An early decision that has borne fruit for Craft has been the plugin licensing model. Paid plugins for Craft charge an initial license fee and then a reduced annual renewal price for updates. This ongoing payment structure ensures plugin maintenance is economically viable for developers, and as a result, Craft plugins tend to be updated more often and are abandoned less.

The best plugins depend very much on the site you’re developing and what you’re trying to achieve. However, some are so universally useful that I install them on virtually every site I build; here’s a list.

1. Redactor

Installing Redactor is a no-brainer when it comes to picking your plugins. Maintained by Pixel & Tonic, it’s a rich text field that extends Craft‘s basic text input. It’s so useful it may as well be part of the core Craft code.

One of the best features is the ease with which Redactor can be customized. Just duplicate the settings file inside the config directory and edit its contents to alter what editing options are available; it’s simple to create anything from a field with a bold option to a full rich text editor. In addition, each Redactor field can be set to use any of the settings files.

Free

2. Retcon

When you’re outputting code from a rich text field like Redactor, you’ll get clean HTML output — which most of the time is what you want. However, if you’re using something like Tailwind, those classes are non-negotiable. I’m not a fan of Tailwind, but I am a fan of using classes in my CSS selectors instead of element names.

Retcon is an invaluable plugin that extends Twig filters to supply a host of options when you’re outputting content. It can add classes to elements, insert attributes, modify the element type, and tons more.

Free

3. Venveo Bulk Edit

During the life of a site, there’s a good chance that you’re going to have to alter fields and sections after the content is in. It’s a common problem if you’re importing data from another platform using FeedMe, or if you have an indecisive client, or even if the site is simply growing.

Venveo Bulk Edit is a plugin that integrates closely with the Craft UI and allows you to edit the contents of multiple entries at once. This plugin has saved me hundreds of hours that would otherwise have been spent painstakingly editing entries one at a time.

Free

4. Super Table

At some point, you’re going to need a configurable list of inputs. Maybe you’re creating a list of documents to download, building a directory, or even your site navigation. You could create a new channel and then add the entries as an entry field, or even set it up with a matrix field, but this is awkward to edit even with Craft 3.7’s new editing experience.

I’m a big fan of opting for the simplest solution, and in this case, the simplest option is a table field. Unfortunately, Craft’s built-in table field has limited field type support. Super Table, on the other hand, supports almost anything, giving you a powerful, orderable set of fields.

Free

5. No-Cache

Craft has a really powerful caching system. It allows you to cache whole or partial templates, and it‘s intelligent enough to know when you’ve edited content that has been cached so that it can be re-cached.

Understanding Craft’s caching is vital; as a very general guide, dynamic content benefits from caching, but static content does not.

However, you will regularly encounter situations where you want to opt out of the caching. A blog post, for example, could be cached, but the time since it was posted must not be, or every post would appear to have been published “today” until the cache is refreshed.

The No-Cache plugin adds a couple of Twig tags that allow you to temporarily opt-out of the cache. This means that you can cache larger sections of your templates, simplifying your caching decisions considerably while still being able to fine-tune what is cached.

Free

6. Retour

Sooner or later, you’re going to have users hitting 404 errors. If you’re restructuring a site and changing the architecture, it will be sooner. To avoid breaking the UX and SEO, you need to add redirects.

Retour is a helpful plugin that sits in your dashboard side menu. Anytime a user triggers a 404, Retour will flag it up, so you can decide how to redirect the URL in the future.

$59 for the first year; $29/year for updates after that

7. Sherlock

One of Craft’s big strengths is its security. A lot of attention has gone into making sure that the core installation uses best practices. However, as with any CMS, potential security vulnerabilities start to creep in as soon as you introduce 3rd-party code (WordPress’ biggest vulnerability by far is its plugins).

You only need to look at the size of the vendor directory in your installation to see how many 3rd-party dependencies your site has. Even a small site is a house of cards.

Sherlock is a security scanner that performs a number of different tasks to help you stay secure, from checking on security threats in 3rd-party scripts to checking directory permissions. The paid version will even let you limit IP addresses if your site comes under attack — although your hosting company may well do this for you.

Lite: Free
Plus: $199 for the first year; $99/year for updates after that
Pro: $299 for the first year; $149/year for updates after that

8. Imager X

Craft’s built-in image transforms are a little limited. For example, they only work with actual assets, not remote images.

Imager X is an excellent plugin that, among many benefits, allows you to transform remote images. In addition, its refined syntax is perfect for coding complex art direction.

Imager X isn’t cheap, but considering the enormous importance of image optimization, unless you have a straightforward set of images to manipulate, it’s an investment you’ll be glad you made.

Lite: $49 for the first year; $29/year for updates after that
Pro: $99 for the first year; $59/year for updates after that

9. SEOMatic

SEOMatic is the SEO solution most Craft developers default to, including Pixel & Tonic themselves.

You’ll need to define the basics in its settings, and you may find yourself creating extra fields specifically for it to pull data from, but the handy progress bars on its dashboard page will give you an overview of what’s set and what needs to be done.

SEOMatic is another premium plugin, but implementing it is far simpler and cost-effective than digging through all those meta tags and XML files yourself.

$99 for the first year; $49/year for updates after that

Must-Install Craft CMS Plugins

The Craft ecosystem is rapidly growing, and the diversity of the plugins available increases as Craft is utilized for more and more sites.

But despite the lure of shiny new plugins, there are some tools that I return to again and again either because they elegantly fill a gap in the core Craft feature set or because I’ve tried them, and I trust them to be robust.

These are the plugins that I have found most useful in the last couple of years, and installing them is the first thing I do when I set up a new Craft installation.

Source

The post 9 Must-Install Craft CMS Plugins first appeared on Webdesigner Depot.


Source de l’article sur Webdesignerdepot

/par

Killing Cloud Security Misconceptions: Common Vulnerabilities and Exposures (CVEs)

,

Background

The Common Vulnerabilities and Exposures (CVE) tells us the whole story just by its name — these are exposures and vulnerabilities that are common. But what happens when uncommon issues are discovered and exploited by attackers? What if attackers just want us to think they’d only exploit common issues and vulnerabilities?

Securing CVEs sounds like it should be the right place to start from. Exploring common vulnerabilities and exposure is where script kiddies start from, that’s what bots are exploiting, and none of us want to end up in the security hall of shame, set aside for organizations that were exploited and affected by ransomware, thanks to an unpatched CVE from months ago.

Source de l’article sur DZONE

/par

5 Web Application Security Threats and 7 Measures to Protect Against Them

,

Data privacy and protection are two imperative aspects for all businesses today as they could be prone to security breaches. Many small and medium organizations tend to ignore application security as they believe only large enterprises are targeted by hackers. However, statistics tell a different story, 43% of cybercrimes happen against small businesses.

There are several reasons behind a cyber-attack against these organizations; from old, unpatched security vulnerabilities to malware or human errors which make take them a lucrative target for attackers. So, ignoring Cyber Security can bring you on the radar of hackers even if you are a startup.

Source de l’article sur DZONE

/par

API Security Weekly: Issue #105

,

This week, we take a look at API vulnerabilities in HashiCorp Vault, Azure App Services, and more. There is also an introductory video on finding information disclosure in JSON and XML API responses, and another cheat sheet and a webinar on OWASP API Security Top 10.

Vulnerability: HashiCorp Vault

Felix Wilhelm from Google’s Project Zero has written a very detailed write-up on an authentication bypass he found in the Amazon Web Services (AWS) and Google Cloud Platform (GCP) integration of HashiCorp Vault. As a central storage of credentials, Vault makes an attractive target for attackers, and therefore a vulnerability in it is also very bad news. Looking for the silver linings, this attack was definitely quite advanced, and thus not easily exploitable.

Source de l’article sur DZONE

/par

The Importance of Machine Learning Security for Chatbots

,

Artificial Intelligence is a growing industry powered by advancements from large tech companies, new startups, and university research teams alike. While AI technology is advancing at a good pace, the regulations and failsafes around machine learning security are an entirely different story.

Failure to protect your ML models from cyber attacks such as data poisoning can be extremely costly. Chatbot vulnerabilities can even result in the theft of private user data. In this article, we’ll look at the importance of machine learning cyber security. Furthermore, we’ll explain how Scanta, an ML security company, protects Chatbots through their Virtual Assistant Shield. 

Source de l’article sur DZONE

/par

What Role Should Social Media Play in Discovering Vulnerabilities?

,

New research from the Pacific Northwest National Laboratory (PNNL) Data Sciences and Analytics Group shows that 25% of vulnerabilities appear on social media before the National Vulnerability Database (NVD). And it takes an average of nearly 90 days between a vulnerability being discussed on social media and the time it shows up in the NVD.

Vulnerabilities on Social Media

The reasons application vulnerabilities show up this often on social media before they get logged in the NVB are multiple. For developers just starting out in their career or those learning about a specific piece of software, they may not know that something is a vulnerability, that vulnerabilities need to be treated differently, and/or how to report vulnerabilities. In some cases, they may not know if the “issue” they found is a true vulnerability. Naturally, they look to the tools they regularly use when connecting with other developers—social media channels like GitHub, Twitter, and the various forums and discussions housed on Reddit.

Source de l’article sur DZONE

/par

AppSec in the Age of DevSecOps

,

Awhile back, I had a conversation with a friend that I went to school with (currently a senior member of the engineering team at a large retail chain) who was tasked with the job of identifying potential application security partners (he addressed vendors as partners, which I personally liked) that they could collaborate with on various areas as part of their product security initiative. The following piece emerged as an extension of my immediate thoughts when he shared his views of what could have made his experience of interacting with front line sales and marketing folks better.

In the context of DevSecOps, much has been said about the need for engineering to speak security, security to speak code, DevOps to speak security, etc. But, as a Technology Service Provider (TSP), riding the current wave of application security, its almost mandatory for the Sales and Marketing teams to speak relevant tech!

Source de l’article sur DZONE

/par

Nancy, on a Boat! (Announcing Nancy for Docker)

,
Nancy has arrived.
You may also enjoy:  Integrating Docker Solutions Into Your CI/CD Pipeline

Nancy is now wrapped up as a Docker image for execution in a pipeline or via an alias in a terminal.

Nancy is a tool to check for vulnerabilities in your Golang dependencies, powered by Sonatype OSS Index. docker-nancy wraps the nancy executable in a Docker image.

Source de l’article sur DZONE

/par