prevention of an attack vector (e.g. XSS, HPP, CSRF)
23
votes
6answers
1k views
Is there a difference between GET and POST for web application security?
I have 2 choices in sending data between 2 web applications.
I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters.
...
6
votes
2answers
171 views
Safe YAML parser?
I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
4
votes
3answers
1k views
How to protect myself against paid DDoS services?
I am domestic user and I am getting attacked regularly by a guy that hates me.
Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
1
vote
1answer
80 views
Guidelines on out-of-band server management via integrated Lights-out services (iLO, iDRAC etc.)
Several CVEs (CVE-2012-3271, CVE-2011-4158, and earlier) point out vulnerabilities in remote server administration firmware; what are the guidelines on hardening this extremely useful component of ...
5
votes
3answers
364 views
Who sells IP reputation data sets?
I know of many companies that will sell ability to lookup IP/URI reputation. Be it DNSBL, json/*, returnpath, threatstop, surbl, ..., will let me perform lookups for a reasonable fee but, in case of ...
1
vote
2answers
353 views
How is iptables useful to prevent attacks against a LAN?
I need some advice securing a LAN using iptables.
I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
3
votes
2answers
242 views
How effective is changing the MAC address?
Since every vendor has a MAC address range, and Apple has network card models that only they use (Airport), I suppose that it is very easy to identify a network package as coming from an Apple device, ...
16
votes
5answers
915 views
Designing in zero day attack mitigations
What are best practices / recommendations / strategies for mitigating zero day threats/attacks from a software development perspective?
2
votes
1answer
109 views
Reflection Attacks on Server
I was reading a research paper entitled "Steps to Defend Against DoS Attacks" when I came across this point:
"A reflection attack on a server would require server-client-server
communication, ...
3
votes
1answer
464 views
What is the fail2ban default setting for SSH login attempts?
I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of ...
1
vote
0answers
68 views
Are there any case studies for a large (think Twitter or Facebook) Web application vulvnerability so severe it caused a total shutdown of services? [closed]
I'm looking for either a case study, or an article from a news source that discusses the vulnerability and methods for recoverability.
4
votes
1answer
464 views
How does automated query compromise other Google users?
Sometimes when using TOR browser / tor proxy, Google refuses to process the request you issue, especially if it's in a different language (e.g. searching for Arabic word while using German proxy).
...
2
votes
2answers
2k views
IPTables DDoS protection working with per client IP address counter AND UDP
I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain.
...
4
votes
3answers
212 views
System time and certificates
Recently I accidentally changed the system time to a different month, and then I surfed to a secure site. I got a warning from Google Chrome that mentioned my system time and said the certificate ...
7
votes
3answers
453 views
Securing a laptop against attacks (article)
I came across this article when looking for ways of hardening my laptop, and this guide seemed extremely thorough. It is perhaps overly paranoid, but it will be good to have a guide I can trust should ...
2
votes
1answer
167 views
White-Box Cryptography Questions and References
I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on.
As far as I can tell, WBC has ...
5
votes
5answers
2k views
What kind of attacks against home router's NAT do exist?
I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
13
votes
3answers
4k views
Is there a way to mitigate BEAST without disabling AES completely?
It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like
...
3
votes
3answers
88 views
Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()?
I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I ...
0
votes
0answers
105 views
KDD CUP'99 flag feature's trouble with prevension [closed]
In KDD CUP'99 dataset, "flag" feature refers to "normal or error status of the connection",
which should changes as the TCP connection state changes. However in the training dataset it refers to the ...
6
votes
2answers
285 views
Design proposals for enhanced security for parts of Internet, e.g. for banking?
There is some recent discussion of some sort of "multilevel" internet, with e.g. a level defined for banking in which access is only granted after special authentication with "true names", special ...
6
votes
3answers
277 views
Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?
According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
0
votes
1answer
370 views
How to escape user input in a value of javascript object?
How to properly escape user-controlled input when it's inserted as a value in JSON object?
<script>
$(document).ready(function() {
new MyObject({
key1: "user_input",
key2: ...
4
votes
3answers
324 views
What are methods for preventing browser hooking / drive-by downloads?
This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this.
With the advent of BeEF and more and more of the computers in networks being infected just by ...
5
votes
4answers
2k views
How to harden an iPhone/Android app so its tough to reverse-engineer it?
These are the following objectives I have in mind:
Make the app hard to crack, as the binary will hold some secret tokens.
If it still can be cracked, is there any way the app can tell someone or ...
1
vote
2answers
211 views
What are the risks of a rogue Access Point? What lessons can be learned from the Wifi Pineapple?
I'd like to educate colleagues and peers on rogue access points using the tool "Wifi Pineapple".
What are some specific security-related lessons I could demonstrate? If applicable, what are the ...
3
votes
1answer
70 views
Is it possible to verify identity of site that sent request to you?
I'm developing a JS widget that can be embedded by 3rd party websites. When widget is shown, it sends request to my site. When this request is received, I know that it was shown to the user and pay ...
4
votes
4answers
1k views
Using SYN cookies to perform a DOS attack
In my software security class, we had this question:
You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
2
votes
1answer
425 views
Detect a server supporting SPDY?
With my current interest in the CRIME attack, I am currently trying to check if there actually exits a way to "fingerprint" a server that supports SPDY?
My research lead me to believe only that the ...
1
vote
2answers
183 views
Is the following code vulnerable? [closed]
Is following code vulnerable? If yes, how it can be exploited?
<%
Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite");
String someSiteUrl = ...
8
votes
4answers
1k views
QR codes that can't be copied - possible?
I assume this is impossible, but I need to find a barcode (that can contain a url, i.e., a QR style one).
It has to be photographed by our smartphone app, but the image will not be changed over a ...
11
votes
2answers
6k views
Should I disable SSL compression because of CRIME?
I've read CRIME - How to beat the BEAST successor? and a few articles on the subject (linked below) and found no recommendations for system administrators.
As a web host, should I disable SSL ...
3
votes
2answers
318 views
Is Drupal's filter_xss enough for filtering HTML?
Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input?
If not, what should be used instead when using Drupal 7?
This questuion is a duplicate of Drupal's built-in ...
0
votes
2answers
190 views
How to verify correct, secure and test setuid?
I've been looking into setuid vulnerabilities. Particularly, I am looking on OS X (10.5+) but other modern *nix distos apply as well. For example, I found a world writable suid file installed by a ...
19
votes
2answers
2k views
How can a Software application defend against DoS or DDoS?
Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
-2
votes
1answer
138 views
What do I need to worry about when moving from a compromised system to a clean one?
As a result of a targeted attack, my computer was compromised? What should I be worried about when trying to move to a new system and prevent reinfection?
I purchased a new clean computer and am ...
5
votes
4answers
297 views
Automating Social Engineering Prevention
Being an advocate for DIO (defensive information operations), I have always been concerned about social engineering and its relation to server security. Giving administrative access to staff members ...
6
votes
5answers
2k views
Can I block based on Mac Address?
Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ?
I want to block at the Webserver level so that unwanted users ...
10
votes
3answers
2k views
How can I prevent someone from accessing a Windows XP system via boot disk?
Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one:
...
4
votes
4answers
750 views
Block all BotNets and TOR addresses from accessing our site
I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
2
votes
3answers
297 views
How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out:
Many of the websites severely restrict the size and ...
1
vote
1answer
53 views
Dangers of a vulnerability in a local installer?
I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code.
Other than the fact that if ...
2
votes
4answers
1k views
Detecting or preventing process memory injections on Windows (anti-hack)
Standard hacking case. Hack injects into a started game process and writes over process memory using WriteProcessMemory call.
The situation is like this:
we are hosting a game server
clients join ...
-3
votes
3answers
124 views
I use an online email provider - how can I test my password strength?
I want to test my password strength, is there a program out there that can crack my password relatively quickly? I am familiar with BackTrack 5, but I usually use it to test WEP password strength. I ...
10
votes
4answers
1k views
How can mini-computers (like Raspberry Pi) be applied to IT security?
It's no secret that thousands of $35 Raspberry Pi (Model B) computers have just shipped to people around the world. With these, and other similar types of computers becoming cheaper and more ...
-1
votes
1answer
285 views
MITM Attacks over SSL [duplicate]
Possible Duplicate:
How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?
If I have a server (call it server 1) set up to receive ...
6
votes
7answers
531 views
Should I prevent sending of GET requests for urls that are normally operated with POST request?
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
2
votes
1answer
2k views
How to Prevent This `Intrusion.Win.MSSQL.worm.Helkern`?
Sometimes my kaspersky Internet Security blocks this attack.
What is this and how can I prevent/solve it for ever?
6
votes
6answers
555 views
Implications of securing data in RAM
Someone told me that his company is storing all application data (at least the sensitive data I guess) in RAM for security. Their application runs for long periods of time, so data stays in memory for ...
16
votes
7answers
603 views
Protecting WordPress installations
How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome. Thanks.
...
