prevention of an attack vector (e.g. XSS, HPP, CSRF)
128
votes
12answers
18k views
How is an ATM secure?
I'm curious why an ATM computer is considered secure. The general adage of "If an attacker has physical access to my machine, all bets are off," seems to not apply in this circumstance (since ...
54
votes
13answers
7k views
Why do sites implement locking after 3 failed password attempts?
I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
44
votes
2answers
5k views
What are rainbow tables and how are they used?
Where can I find one? Is there a pot of gold at the end?
How do I protect against them?
From the Area51 proposal
This question was IT Security Question of the Week.
Read the Sep 09, 2011 blog ...
32
votes
6answers
6k views
What techniques do advanced firewalls use to protect againt DoS/DDoS?
It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
23
votes
6answers
1k views
Is there a difference between GET and POST for web application security?
I have 2 choices in sending data between 2 web applications.
I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters.
...
20
votes
6answers
312 views
User input data, is filtering enough or should it be parsed?
In a webapplication there could be two approaches to migate XSS attacks. All the input data could be filtered (removing all 'bad' data), or the input could be parsed, tokenized and output with only ...
20
votes
2answers
2k views
How can a Software application defend against DoS or DDoS?
Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
19
votes
3answers
994 views
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number ...
19
votes
2answers
522 views
How is “<scrscriptipt>” or “selselectect” used to avoid filtering?
A technique for avoid filtering of common words is the one I described in the title.
However, why does this technique work? SELECT isn't the same as SELSELECTECT for example.
17
votes
8answers
838 views
Ways to secure yourself from Firesheep kiddies and other sniffing
Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions:
In exactly what ...
17
votes
5answers
856 views
Can you secure a web app from FireSheep without using SSL?
Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page.
In this ...
17
votes
5answers
927 views
Designing in zero day attack mitigations
What are best practices / recommendations / strategies for mitigating zero day threats/attacks from a software development perspective?
17
votes
7answers
615 views
Protecting WordPress installations
How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome. Thanks.
...
15
votes
8answers
2k views
Any comprehensive solutions for binary code protection and anti-reverse-engineering?
Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
15
votes
3answers
1k views
DNS Amplification DDOS attack
During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
14
votes
3answers
693 views
Rails - protection against code injection and XSS
I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS?
I know Rails tries to prevent ...
13
votes
4answers
4k views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
13
votes
3answers
4k views
Is there a way to mitigate BEAST without disabling AES completely?
It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like
...
13
votes
3answers
448 views
What prevents people getting charged over NFC in crowded places?
I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
12
votes
4answers
500 views
How to protect off-the-shelf web applications?
As an exercise, please consider the following:
If you are faced with having to deploy off-the-shelf web applications that you are unsure about the vendors security coding practices, which techniques ...
12
votes
3answers
741 views
Bypassing Address Space Layout Randomization
How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?
12
votes
9answers
572 views
What do you see as the emerging threats for 2011
As we move in to the new year, what do you see as the emerging threats for organisational security?
I see more chat around;
Advanced Persistent Threat (APT) from foreign states.
More fines from the ...
11
votes
6answers
2k views
Why is ARP poisoning killing all network activity?
Using ettercap and ARP poisoning, I was able to eavesdrop on other connections, but suddenly I was unable to make any connection to the Internet. To restore Internet connectivity, I had to restart my ...
11
votes
2answers
6k views
Should I disable SSL compression because of CRIME?
I've read CRIME - How to beat the BEAST successor? and a few articles on the subject (linked below) and found no recommendations for system administrators.
As a web host, should I disable SSL ...
11
votes
2answers
191 views
Why do browsers allow public websites to attack intranet sites?
When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
11
votes
2answers
380 views
Detecting website attack attempts
I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to attacker, when he tries to break into my website. Is there any resource ...
10
votes
3answers
2k views
How can I prevent someone from accessing a Windows XP system via boot disk?
Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one:
...
10
votes
6answers
2k views
How can mini-computers (like Raspberry Pi) be applied to IT security?
It's no secret that thousands of $35 Raspberry Pi (Model B) computers have just shipped to people around the world. With these, and other similar types of computers becoming cheaper and more ...
10
votes
6answers
314 views
Should we configure all devices to never request SSL 2.0, and reject it if offered?
In an effort to reduce man in the middle attacks, when will it be (or was it) an industry accepted practice to reject SSL 2.0 connections on the client and server side?
Is configuring this on a proxy ...
10
votes
5answers
468 views
How to best defend against Targeted Attacks?
We have seen this attack method grow as part of Advanced Persistent Threats (operation Aurora against Google or the G20 French Finance ministry attacks come to mind) but I have no doubt that even ...
10
votes
3answers
602 views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
9
votes
2answers
2k views
How to address XSS security issues in FCKeditor / CKeditor?
A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application.
They pointed out that accessing URLs such as:
...
9
votes
2answers
180 views
Should I prevent user from operating with site during some first seconds?
Imagine the following scenario: User is at attacker.com and plays a game there. Just before he clicks at some point he is rerouted to victim.com using browser's history. User thought that he clicked ...
8
votes
7answers
925 views
Whitelisting DOM elements to defeat XSS
As we know, developers are responsible for correctly escaping/validating data provided by the user before rendering or storing them. However, we must agree that it's relatively easy to forget a single ...
8
votes
4answers
1k views
QR codes that can't be copied - possible?
I assume this is impossible, but I need to find a barcode (that can contain a url, i.e., a QR style one).
It has to be photographed by our smartphone app, but the image will not be changed over a ...
8
votes
3answers
410 views
How does an attacker approach a website?
What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
8
votes
3answers
438 views
What is sandboxing?
In security discussions, the topic of sandboxing often comes up. What is application sandboxing? How does it work, and what security vulnerabilities does it prevent?
8
votes
7answers
507 views
IP address black list
My website has a black list of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address. ...
8
votes
2answers
807 views
How to defend against SSL-Exhaustion attacks?
The problem of SSL-Exhaustion attacks is well known for years, but nobody really cared until THC released their exploit-tool recently. THC talks about counter measurements in their release:
No real ...
8
votes
4answers
232 views
Staying safe, but still connected, at security conferences
If one is to spend some time away from home and work in a hotel environment where neighboring users can at least be presumed to be mischievous (if not actually malicious), what are some measures that ...
8
votes
3answers
265 views
What are the pros/cons of using a threat detection system?
What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)?
What does a properly implemented threat detection system do and how does it behave when it detects ...
8
votes
1answer
2k views
SSL replay attack when client/server random is missing
Hey studying the SSL protocol, I'm wondering how can someone be able to do a replay attack if the server nonce is missing? All the material I find says that nonces prevent it, but theres no examples ...
8
votes
2answers
549 views
MIME sniffing protection
As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...
7
votes
3answers
518 views
Securing a laptop against attacks (article)
I came across this article when looking for ways of hardening my laptop, and this guide seemed extremely thorough. It is perhaps overly paranoid, but it will be good to have a guide I can trust should ...
7
votes
4answers
711 views
How can I detect and block bots?
For example, if I am on stackoverflow and I refresh my page several times in a row, it starts to think I am a bot and blocks me.
How can I build something like this into my own site?
7
votes
4answers
584 views
Gmail account hack prevention and recovery
I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back.
The associated phone number and recovery email can be changed, in fact I ...
7
votes
2answers
193 views
How do you compare risks from your websites, physical perimeter, staff etc
In assigning budget rationally - ie proportionally to the risk in a particular area, how can you calculate the relative risks?
I can think of examples where clients of mine have secured their ...
7
votes
2answers
200 views
What to add to a repeating security checklist?
I work in a smallish company (100-200 computers and a handful of servers) and I am trying to come up with a checklist of things to check at a regular basis, such as weekly, monthly, etc. We use ...
7
votes
3answers
350 views
Virtualization as a layer of security for desktop computers?
Given the amount of 3rd party plugins required to browse the web, I've been compelled to virtualize my online habits to gain an additional layer of security.
There is of course some obvious ...
