prevention of an attack vector (e.g. XSS, HPP, CSRF)
5
votes
3answers
394 views
Appropriate defense for 404s in my logs - persistent web scans from one region
This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I ...
3
votes
4answers
169 views
Attack where browser URL appears valid
I remember reading about an attack where the "location bar" in a user's browser displays a valid URL (e.g. https://www.paypal.com/), but the traffic is really being directed to or intercepted by an ...
0
votes
2answers
684 views
How do we protect our server from anonymous hacker? [duplicate]
Possible Duplicates:
Hardening Linux Server
How to best defend against Targeted Attacks?
I read this news: Anonymous hacker group hits Apple, publishes data
My question: How do we ...
7
votes
3answers
345 views
Virtualization as a layer of security for desktop computers?
Given the amount of 3rd party plugins required to browse the web, I've been compelled to virtualize my online habits to gain an additional layer of security.
There is of course some obvious ...
7
votes
4answers
668 views
How can I detect and block bots?
For example, if I am on stackoverflow and I refresh my page several times in a row, it starts to think I am a bot and blocks me.
How can I build something like this into my own site?
12
votes
4answers
489 views
How to protect off-the-shelf web applications?
As an exercise, please consider the following:
If you are faced with having to deploy off-the-shelf web applications that you are unsure about the vendors security coding practices, which techniques ...
5
votes
3answers
1k views
Resolving an IP address of a Remote machine to its MAC address
I wanted to know whether its possible to get the MAC address of remote node (computer/Access Point) if I know its IP address.
I have heard that if someone sends you an email (even through gmail), you ...
50
votes
13answers
7k views
Why do sites implement locking after 3 failed password attempts?
I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
10
votes
5answers
462 views
How to best defend against Targeted Attacks?
We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even ...
7
votes
1answer
2k views
SSL replay attack when client/server random is missing
Hey studying the SSL protocol, I'm wondering how can someone be able to do a replay attack if the server nonce is missing? All the material I find says that nonces prevent it, but theres no examples ...
7
votes
2answers
186 views
How do you compare risks from your websites, physical perimeter, staff etc
In assigning budget rationally - ie proportionally to the risk in a particular area, how can you calculate the relative risks?
I can think of examples where clients of mine have secured their ...
8
votes
2answers
510 views
MIME sniffing protection
As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...
9
votes
3answers
539 views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
-1
votes
2answers
357 views
What can one define as quality criteria for an XML Schema?
One of the usage of Input validation, is to be protect against XSS. In case one would need to define best practice for the functions validating the input, then some (which I am calling quality ...
17
votes
5answers
846 views
Can you secure a web app from FireSheep without using SSL?
Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page.
In this ...
4
votes
2answers
131 views
How can my country's legal/telecoms environment protect against cold-callers conning a remote-access session to the victim's computer?
My local region in Australia is being targeted by a scam whereby victims are cold-called and told that their computer is sending 'errors' to caller at 'Windows' which should be fixed ASAP, and they ...
