prevention of an attack vector (e.g. XSS, HPP, CSRF)

learn more… | top users | synonyms

0
votes
1answer
305 views

How do I solve a lot of Failure Audit (529 680) which are appearing in event viewer “Security” tab?

was trying to consume an Web Services that I have published on the Web but I couldn't thing is that when I got into the server and check the "Event Viewer" I have a LOT of "Failure Audit" and they ...
1
vote
2answers
132 views

Forced to use using 2-Step Authentication to keep online profiles safe?

I am starting to see a majority of services, websites, and social networks offering the 2-step Authentication like crazy now to protect their users. Also, after reading how the Twitter Account N was ...
0
votes
1answer
487 views

How to combat and prevent a lpcloudsvr302 and bk-coretag.js Virus?

I recently came across a computer that was infected with a lpcloudsvr302 and a bk-coretag.js Virus. I did some research about the two Viruses and realized that their is no reliable source that helps ...
17
votes
7answers
7k views

Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
4
votes
4answers
8k views

Detecting or preventing process memory injections on Windows (anti-hack)

Standard hacking case. Hack injects into a started game process and writes over process memory using WriteProcessMemory call. The situation is like this: we are hosting a game server clients join ...
1
vote
1answer
380 views

Root/Naked domain and DDOS

Some services like Github has DDOS mitigation measures for their root/naked domain, but not other subdomain(s). What so special about the root domain concerning the DDOS attacks? [1] http://...
1
vote
4answers
148 views

Is it possible to block specific users that connect to the internet behind of same gateway with NAT?

Assume there are two internet users (A and B) that connect to the internet from the same gateway by using NAT. That means they use same IP address while passing through our firewall. Now assume we ...
16
votes
3answers
2k views

NTP DDoS Attack on Home Servers

After some half-good script kiddies found out about this exploit or DDoS method, they have been doing it like crazy to websites, game servers, and now my home servers which allows me to work on some ...
18
votes
5answers
1k views

Can you secure a web app from FireSheep without using SSL?

Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page. In this ...
0
votes
1answer
983 views

Detect possible router attack attemp

I have huge problem with my router: Sagem F@st 3202. Here are some Security log events: Inbound Traffic | Blocked - Default policy | TCP XX.XX.XX.XXX:80->XX.X.XX.XX:51707 on ppp0 [...
1
vote
2answers
211 views

How to know what personal information companies know about myself

I've been learning about Cyber Security and how to protect myself online after reading some books on the subject and I want to know how much Information i've handed out to companies.
1
vote
0answers
166 views

Neutralizing or Migitating ARP spoofing once detected

I've seen a few methods to detect ARP Spoofing attacks through code(such as this), and ways to defend against these attacks through software and switches (like arp spoofing protection on LAN). How ...
8
votes
3answers
850 views

Server side SSH keys compromised

I'm interested in knowing what could be the consequence if the server side SSH keys of a host were compromised. The situation would be: An attacker manages to read the SSH private keys of the ...
3
votes
1answer
248 views

3000 new contacts being added to gmail after receiving an email

Recently I realized that there are three thousand contacts with same name and email address in my Google contacts. The name belongs to an email that I have recently received and responded to, nothing ...
20
votes
8answers
4k views

How could someone exploit the OS an ATM is running?

As I'm sure many of you have heard, the end of support for Windows XP is the supposed apocalypse for ATM's worldwide. I am cognizant of the fact that this ensures that no more patches are issued, and ...
14
votes
4answers
1k views

How to react when under attack

Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I ...
6
votes
1answer
381 views

Isn't a HIDS, NIDS and WAF complementary?

Assume this scenario: Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script> A HIDS would see this attempt in Apache's access log, a NIDS would ...
0
votes
1answer
240 views

Employee Snooping [closed]

I just got hired at this SW tech company with a few IT gurus in it. There is a clever genius that is suspect. He obtained my personal home email address I use. It was obtained from company ...
6
votes
2answers
1k views

Are smart watches secure?

My Pebble smartwatch, like many (most?) other smart watches, uses Bluetooth Low Energy (Bluetooth Smart, BLE, BTLE, etc) to communicate with my smart phone. There's some security in the link, ...
1
vote
1answer
492 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
0
votes
2answers
148 views

CSRF prevention understanding

I was searching around about CSRF attacks and I am thinking about the "random form token" prevention concept. Let's say every form has a "hidden token" inside and the server checks the token before ...
2
votes
1answer
200 views

Why don't servers vulnerable to NTP and DNS reflection attacks get blacklisted immediately?

With these reflection attacks, the source IP should be the IP of the vulnerable server. So shouldn't nodes which see abnormal amounts of NTP data be able to add the source to a blacklist and therefore ...
1
vote
0answers
303 views

Disable HNAP on D-Link router [closed]

I'm concerned that Home Network Administration Protocol (HNAP) is a serious vulnerability that exposes consumer network routers to remote management by malicious entities such as government ...
0
votes
1answer
124 views

To what extend can a DOS attack succeed even if it was detected?

While reading DOS detection and prevention http://staffweb.cms.gre.ac.uk/~lg47/publications/LoukasOke-DoSSurveyComputerJournal.pdf I've asked myself: Even if a firewall detects a DOS attack and begins ...
1
vote
2answers
194 views

Which exploit types does software diversity have a benefit against?

This classical paper of Paul van Oorschot: Revisiting Software Protection, mentions in section 3.4 that by employing software diversity "an exploit crafted to succeed on one instance will not ...
-3
votes
2answers
199 views

What kind of virus attack is this? And what do I do now?

I have just inherited a running wordpress installation from another agency and the theme (twentyeleven) they are using for my client has been corrupted. This is what most of the theme's php files ...
0
votes
1answer
3k views

What is the difference between SYN cookie, SYN cache, and SYN proxy?

I am trying to understand some techniques regarding SYN flood prevention and there are three terms I couldn't find a clear explanation of. The terms that are confusing me are: SYN Proxy SYN Cache ...
1
vote
2answers
1k views

Basic Security Knowledge [closed]

Perhaps I am being both naive and overly ambitious in my first post but I have a huge interest in learning about network and system security and am at a loss as to where to begin. I realize that stack ...
0
votes
1answer
137 views

How much is ASLR effectiveness impacted by different ABIs?

Linux has multiple x86 ABIs: ia32, x32 and x86_64. ia32 and x32 both use 32 bit addresses for addressing and x86_64 uses 64 bit. Now, the question: Since the size of the memory space should affect ...
1
vote
0answers
542 views

Possible exploits for PHPword/ PHPexcel

I'm trying to identify what exploits to guard against when anonymous users generate reports with PHPword and PHPexcel (or similar libraries). Specifically, I'm worried about textarea inputs where ...
1
vote
3answers
1k views

How to detect anomalous activity in web server traffic?

I'm wondering how to successfully detect malicious activity in my web server traffic? Could you point me out some popular solutions which can help me to detect attacks on my web application? I didn'...
2
votes
1answer
94 views

Risks and prevention methods associated with flagging or downvoting?

Similar to bots posting spam posts and blogs is it possible that bots with legible registered accounts go around the site flagging or downvoting everything on the site. If yes, what can I do to ...
3
votes
0answers
66 views

Arbitrary methods directly callable with Front Controller pattern

I'm working on converting an application that uses the traditional Page Controller pattern to start using the Front Controller pattern. One of the potential problems I'm thinking about is that with a ...
10
votes
2answers
414 views

How do you compare risks from your websites, physical perimeter, staff etc

In assigning budget rationally - ie proportionally to the risk in a particular area, how can you calculate the relative risks? I can think of examples where clients of mine have secured their ...
23
votes
7answers
1k views

How can I protect a WordPress installation?

How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
2
votes
3answers
873 views

What are the risks of a rogue Access Point? What lessons can be learned from the Wifi Pineapple?

I'd like to educate colleagues and peers on rogue access points using the tool "Wifi Pineapple". What are some specific security-related lessons I could demonstrate? If applicable, what are the ...
6
votes
1answer
10k views

What is packet drop, packet loss and how Packet drop attack works?

I confused with the three terms: Packet drop. Packet loss. Packet drop attack.
0
votes
1answer
4k views

What methods are there of protecting a VPS from DDOS attacks? [duplicate]

I was just wondering what would be the best way to stop a VPS from being attacked, bandwidth would be a problem in this case so methods that reduce the amount of incoming attacks and stop sending ...
8
votes
3answers
7k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
0
votes
1answer
139 views

File-structure when using token

I'm using a form-token to secure the validation process of my php-file. Basically the structure of the php-file looks like this: if ($_POST) {//form has been submitted? if (validateFormToken) { ...
2
votes
1answer
571 views

Submit form with token

I have a token that I want to use to prevent direct access of some php-files. Some of these php-files are loaded via AJAX. The token is used with a session to secure form submission AND to prevent ...
-2
votes
1answer
171 views

Commonly used url parameters [duplicate]

I'm working on a project that requires me to tamper with/rewrite url parameters. I'd also like to add in something that finds request parameters such as ?admin=false ?debugging=false ?page=example ...
2
votes
2answers
726 views

Attacks in SSL and SSH

Assume that we have two end-host A and B connected by two routers R1 and R2. A wants to send a large file to B. A decides to establish SSH connection with host B using public key authentication. ...
0
votes
2answers
912 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...
2
votes
4answers
316 views

How is “security word” safe from man in the middle attack?

In this bank site I read the following lines Item #2 - You will also need to create a "Security Word". This allows you to verify that you have reached our Internet Banking site, and not some other ...
-2
votes
2answers
1k views

Is this site vulnerable to sql injection? [closed]

I have my site build from a company. I read about website vulnerabilities on the internet and i did some test on my site. It throws these errors. QueryString key:TutorialId was expected to be of ...
4
votes
1answer
570 views

What steps need to do to identify security hole

I use VPS hosting. Installed CentOS 6 and ZPanel according to this tutorial http://www.zvps.co.uk/zpanelcp/centos-6 Received warning from hosting provider: This URL has been identified as a phishing ...
0
votes
1answer
2k views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
2
votes
1answer
1k views

Android, how do I prevent Confused Deputy Attacks?

In case that a malicious mobile app hasn't the appropriate permissions to e.g. download a file, it can invoke a browser to download sth. Concrete examples of such an attack are shown from page 27 to ...
6
votes
4answers
809 views

Who sells IP reputation data sets?

I know of many companies that will sell ability to lookup IP/URI reputation. Be it DNSBL, json/*, returnpath, threatstop, surbl, ..., will let me perform lookups for a reasonable fee but, in case of ...