A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

19
votes
3answers
2k views

What are the risks of using a CDN to speed up my website? How do I avoid them?

Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN. What ...
15
votes
4answers
848 views

If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?

We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
10
votes
2answers
2k views

CloudFlare benefits or drawbacks

Anyone running a webserver would agree, security can be a hustle and tedious job. Recently I came across a service claiming to help with that -- CloudFlare.com. There's plenty of benefits listed on ...
8
votes
5answers
796 views

Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?

In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
7
votes
3answers
439 views

Popularity of Anomaly based IDSes

I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...
4
votes
2answers
1k views

How helpful is rkhunter?

I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website. With these things already in place, do ...
4
votes
1answer
328 views

VPS Safety in the Cloud

Imagine you are running a web server on a Virtual Private Server (VPS) hosted in a datacenter. Could the people running the datacenter covertly read files from my VPS's hard disk? Could an attacker ...
3
votes
1answer
390 views

Mitigation Strategies for Response Spliting Attack

I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET ...
3
votes
4answers
2k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
2
votes
3answers
996 views

Reverse Proxy Secure Configuration

I have a Forefront TMG 2010 acting as a reverse proxy: I can force HTTP*S* between internet clients and TMG. I can force HTTP*S* between TMG and my web servers. From a security point of view, it ...
1
vote
1answer
2k views

WordPress Hacked - Found a suspicious “class-wp-style-table.php” [closed]

I recently had all of my WordPress accounts on my server hacked. The only suspicious files I found are listed below. These were the only files edited in the last 5 days (June 3, to be specific). ...
1
vote
3answers
450 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
0
votes
1answer
462 views

Data Retention Laws for ISPs in North America

I was reading an article on TorrentFreak where Private Internet Access claims the United States "is one of the only countries without a mandatory data retention law." According to the linked article ...
-5
votes
2answers
529 views

PHP injection on 777 file [closed]

Some one has modified a PHP file, which had permissions set to 777, on my VPS server. How can someone do that without administrative access to the server? What information I can give you? I know ...