prevention of an attack vector (e.g. XSS, HPP, CSRF)
3
votes
1answer
464 views
What is the fail2ban default setting for SSH login attempts?
I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of ...
3
votes
3answers
88 views
Why is it necessary to validate data in a servlet obtained by calling HttpSession.getAttribute()?
I am new to WebApp programming and am trying to understand the security implications of not validating data obtained by calling the javax.servlet.http.HttpSession.getAttribute() interface method. I ...
3
votes
1answer
77 views
Vim Modeline Vulnerabilities
I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like:
# vim: set someoption=somevalue
and will then set those options. This is awesome if ...
3
votes
2answers
90 views
User privileges for unsanatized code
We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
3
votes
2answers
202 views
Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
Suppose you have a system whose OS drive is encrypted with bitlocker and uses TPM + PIN authentication to authenticate the boot path against tampering. As I understand it, this setup theoretically ...
3
votes
1answer
162 views
eBay account compromised/Credit Card used/Hosts files changed
To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if ...
3
votes
1answer
133 views
What useful security reports can be extracted from a Windows-based machine and its' related logs?
What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)?
Assuming I can aggregate them into a report what ...
3
votes
1answer
63 views
Where can I find articles about identity disclosure attack?
Where can I find more details about identity disclosure attack and it's prevention?
If the adversary tries to steal the identity of an individual like mobile patterns and start appears in various ...
3
votes
1answer
70 views
Is it possible to verify identity of site that sent request to you?
I'm developing a JS widget that can be embedded by 3rd party websites. When widget is shown, it sends request to my site. When this request is received, I know that it was shown to the user and pay ...
2
votes
7answers
792 views
Which forensic techniques should I use to identify intrusion or monitoring of my computer or cellphone
If I suspect my computer or cellphone is being monitored by an unknown attacker, what tools or techniques could I use to detect or identify such monitoring?
Currently I'm unable to detect the ...
2
votes
3answers
223 views
Securing dropdown boxes
I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured.
...
2
votes
3answers
208 views
How dangerous is game guard?
Game guard is an anti-cheating application used with MMORPGs . I have read that such applications acts as rootkit over the pc. How dangerous it is to play MMORPGs that uses this application? How ...
2
votes
3answers
70 views
Prevent request forgery attack
I don't know if I used the term correctly but basically this is the scenario:
I am working at an application witch on every computer install must make a request to a server notifying the server that ...
2
votes
3answers
143 views
is it safe to allow external images to be attached to Blog or any Web content?
I am filtering all images that attached to any content of my blog:
Check for file extension.
Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE);
I also save the image temporary on my ...
2
votes
2answers
2k views
IPTables DDoS protection working with per client IP address counter AND UDP
I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain.
...
2
votes
3answers
119 views
I want to implement a new type of security feature over several platforms
I want to make a security feature that will go farther in discouraging people from looking through a secure system or server than what I have seen being implemented.
Specifically, is there a way (or ...
2
votes
2answers
135 views
How to demo a new 0-day security product?
We are a development team working on a new 0-day protection security product.
We aim to protect against new unknown 0-days attacks against servers.
We have a very strong solution ready to demo.
The ...
2
votes
2answers
90 views
What is the disadvantage of using spoofing protected version of ARP protocol
I read this article about man-in-the-middle arp poisoning and how it works , it seems that arp poisoning programs exploits the fact that ARP protocols trusts any packet to be true and modify its ...
2
votes
4answers
1k views
Detecting or preventing process memory injections on Windows (anti-hack)
Standard hacking case. Hack injects into a started game process and writes over process memory using WriteProcessMemory call.
The situation is like this:
we are hosting a game server
clients join ...
2
votes
2answers
116 views
CSRF Login: can Attacker Login using valid credentials?
Considering this picture: taken from here:page21
Is this possible?
If so, How to prevent it?
2
votes
3answers
297 views
How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out:
Many of the websites severely restrict the size and ...
2
votes
2answers
369 views
External IP same as Internal IP security
Where I live my ISP does not give IP addresses out. My external IP address is the same as my external if I plug directly into the wall with no router. My ISP does give everybody a "router", that is ...
2
votes
1answer
2k views
How to Prevent This `Intrusion.Win.MSSQL.worm.Helkern`?
Sometimes my kaspersky Internet Security blocks this attack.
What is this and how can I prevent/solve it for ever?
2
votes
1answer
167 views
White-Box Cryptography Questions and References
I have recently started reading about White-Box Cryptography and looking at references/papers/web sites. A have a few questions I was hoping to get guidance on.
As far as I can tell, WBC has ...
2
votes
1answer
425 views
Detect a server supporting SPDY?
With my current interest in the CRIME attack, I am currently trying to check if there actually exits a way to "fingerprint" a server that supports SPDY?
My research lead me to believe only that the ...
2
votes
3answers
78 views
How good is validating source with request.referer than checksum?
I have 2 portals(both are under my control & domain names are different)
In 1st portal, there is a link on click of which User can directly get logged into 2nd portal.
Link which will be hit in ...
2
votes
1answer
109 views
Reflection Attacks on Server
I was reading a research paper entitled "Steps to Defend Against DoS Attacks" when I came across this point:
"A reflection attack on a server would require server-client-server
communication, ...
2
votes
1answer
373 views
Token Based Authentication & Pass-the-hash Attacks
Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
2
votes
1answer
96 views
External network DNS spoofing
I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios:
1. ...
1
vote
2answers
448 views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
1
vote
5answers
193 views
How to replace a constant identifier, for a resource on a network, with a variable one?
I guess the example can make it easier.
Assume each Client on a network has an identifier(some alphanumeric sequence) which identifies it uniquely on the network. Each time the Client corresponds ...
1
vote
2answers
183 views
Is the following code vulnerable? [closed]
Is following code vulnerable? If yes, how it can be exploited?
<%
Boolean redirectToSomeSite = (Boolean)request.getAttribute("redirectToSomeSite");
String someSiteUrl = ...
1
vote
2answers
198 views
Is the OData Protocol susceptible to Insecure Direct Object References?
The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention ...
1
vote
2answers
353 views
How is iptables useful to prevent attacks against a LAN?
I need some advice securing a LAN using iptables.
I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
4answers
290 views
How password hashing is useful in MITM attack?
Even though I read a lot about hashing and how passwords are protected, I am still confused about it.
If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
1
vote
2answers
512 views
how an iframe can cause xsrf?
I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
1
vote
2answers
126 views
How to stop a (malicious) endless loop
Few days ago someone tried to crack my site using a Remote File Inclusion attack.
The attack was blocked by my Web Application Firewall, but I was curious about the file.
So I downloaded it started to ...
1
vote
1answer
75 views
Compromised server with psyBNC - what are our next steps?
One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
1
vote
1answer
81 views
Guidelines on out-of-band server management via integrated Lights-out services (iLO, iDRAC etc.)
Several CVEs (CVE-2012-3271, CVE-2011-4158, and earlier) point out vulnerabilities in remote server administration firmware; what are the guidelines on hardening this extremely useful component of ...
1
vote
2answers
211 views
What are the risks of a rogue Access Point? What lessons can be learned from the Wifi Pineapple?
I'd like to educate colleagues and peers on rogue access points using the tool "Wifi Pineapple".
What are some specific security-related lessons I could demonstrate? If applicable, what are the ...
1
vote
1answer
53 views
Dangers of a vulnerability in a local installer?
I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code.
Other than the fact that if ...
1
vote
1answer
54 views
How non-executable are implemented? [duplicate]
In the "Hacking the art of Exploitation" its said that the basic idea of stack overflows attacks is that the operating system can't differentiate instructions from data inside the stack ,and the ...
1
vote
2answers
44 views
Will using SSL to secure Wordpress admin area only still actually be secure?
The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas.
There ...
1
vote
1answer
143 views
CSRF with OAuth or Bearer Authorization headers
I am designing a RESTful API which is to be accessible from a web browser. The API is protected by Basic authentication.
I understand the concept of CSRF, and the mitigations proposed (I found both ...
1
vote
0answers
68 views
Are there any case studies for a large (think Twitter or Facebook) Web application vulvnerability so severe it caused a total shutdown of services? [closed]
I'm looking for either a case study, or an article from a news source that discusses the vulnerability and methods for recoverability.
0
votes
2answers
191 views
How to verify correct, secure and test setuid?
I've been looking into setuid vulnerabilities. Particularly, I am looking on OS X (10.5+) but other modern *nix distos apply as well. For example, I found a world writable suid file installed by a ...
0
votes
3answers
354 views
Are Facebook, Yahoo, Google, etc. hackable?
Just to be clear, I am not asking how to hack in these services, I am just curious. Let me try to explain.
Since I know a little bit about computers, people automatically assume I know how to have, ...
0
votes
1answer
258 views
Wordpress online pharmacy hack? [duplicate]
Possible Duplicate:
Protecting WordPress installations
anybody knows how to protect your WordPress website from online pharmacy spam, even after deleting all spam files and deleting spam ...
0
votes
2answers
685 views
How do we protect our server from anonymous hacker? [duplicate]
Possible Duplicates:
Hardening Linux Server
How to best defend against Targeted Attacks?
I read this news: Anonymous hacker group hits Apple, publishes data
My question: How do we ...
0
votes
2answers
135 views
How can I encrypt something user provided without risk of the key being exposed?
So, let's say I have a theoretical service. User has some text they want to encrypt. They pass it to me, and I encrypt it. Then, only I should be able to decrypt it afterwards. Another kicker, it must ...
