Hot answers tagged

236

To understand the attack, one must recall Bleichenbacher's attack from the late 20th century. In that attack, the attacker uses the target server as an oracle. When using RSA-based key exchange, the client is supposed to send a secret value (the "pre-master secret") encrypted with the server's public key, using PKCS#1 v1.5 padding (called "type 2"). ...


147

I think the assumption here is wrong. They don't have physical access to the machine. They have supervised access to a very limited control panel for a machine which is built into a bomb-proof safe, bolted to the ground and hooked up to an alarm system with an armed response force. Get the machine out of the vault and away from supervision and then yes... ...


131

ATM are supposed to be tamper resistant, and to actively react upon any detected breach of physical security, notably by marking bills with some highly conspicuous and hard to remove ink, and also by committing honourable seppuku. For that matter, an ATM should be compared with HSM, payment terminals and smart card. You can imagine the ATM as a kind of Davy ...


114

Rainbow Tables are commonly confused with another, simpler technique that leverages a compute time-storage tradeoff in password recover: hash tables. Hash tables are constructed by hashing each word in a password dictionary. The password-hash pairs are stored in a table, sorted by hash value. To use a hash table, simple take the hash and perform a binary ...


68

According to the IBM X-Force Threat Intelligence Quarterly Report, fourth quarter 2015, the primary sources of ransomware attack are unpatched vulnerabilities, drive-by infections, and spear-phishing emails: Source: IBM X-Force How to prevent ransomware attacks User education Educate your users not to download files from unknown contacts. Usually ...


63

The Internet is a wild and scary place, full of malcontents whose motives range from curiosity all the way to criminal enterprise. These unsavories are constantly scanning for computers running services they hope to exploit; usually the more common services such as SSH, HTTP, FTP, etc. The scans typically fall into one of two categories: Recon scans to see ...


61

The answer to this question very much depends on the security posture of your site, which decides whether the risk of unauthorised access is greater or lower than the risk of Denial of Service for some users. For high risk sites, I might go with the blocking option, especially where most of the user base is likely to be home users and therefore is likely to ...


57

Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length about this issue. In brief, there's insufficient research. In long, here are some of his ideas for less painful account locking: Don't count duplicate password attempts (they probably thought they mistyped it) Make the password hint about the ...


51

No Quarantine is nothing but a place to store the infected/suspicious files. When you quarantine a file it is deleted from the actual place and moved to the quarantine location (to the path that your anti-virus program has for them). This is something like keeping a zombie inside a jail. Obviously it is not a threat as long as you don't open the cage. In ...


49

Static or dynamic IP is a non-issue. But since you brought up cameras, you should know that many IP cameras have VERY poor security. Many of these cameras have a known bad firmware in them that allows unauthenticated download of the entire memory of the device via simply going to /proc/kcore, without the need to authenticate. This allows anyone to obtain ...


44

These kinds of password entry systems are only good as long as the attackers do not adapt. It is a play in several acts: Bank Web sites use passwords which are entered the traditional way, with a keyboard. Key loggers appear, and harvest key strokes. After some cases of actual bank password theft, banks adapt. They implement "visual keyboards" in which the ...


44

The answer by Thomas is wonderful. There is just one thing that seems understated: e-mail servers are broken security-wise... by default and by design. default: just look at the default postfix configuration for instance (hint: SSLv2 and 40-56bit ciphers are still a thing, and "no encryption" too). by design: have you ever heard of the StartSSL wonder? ...


44

While the measures you describe in your question are not wrong, they are not correct either: Documents are not safe to open either. Often times, exploits come in the form of interestingFile.txt.exe. Windows hiding the .exe by default leads users to think that's just a text file when indeed they execute code. There are other ways to keep executable code ...


41

The adage is still accurate. Physical access to the machine is not the same as physical ability to interact with the machine. The vast majority of attacks against a physical box involve actually altering the hardware and there is a limited amount you can do to alter the hardware of an ATM as it is locked in a safe, away from the user. It is, however, ...


38

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs implement them and preferably the versions of those programs). To fingerprint a service, the attacker needs to know that there is one running on a publicly ...


37

Option 1 may introduce a number of non-security related issues anyway: The resulting URL may be cached by the browser, or bookmarked, causing users to resubmit. The resulting URL may be shared by users, causing third parties to submit. The URL may be sent to your browser vendor, who may hit the site. But this is about security, and it introduces a few ...


36

Today's ATMs may be more secure than yesterday's ATM's, but the track record has been spotty. fake ATMs have been set up by criminals and used to duplicate bank cards and collect PINs. This takes advantage of the fact that whereas ATMs authenticate users via cards and PINs, users simply trust that ATMs are real by their visual appearance and bank logos. ...


36

The other answers mostly talk about attaching arbitrary code to images via steganographic techniques, but that's not very interesting since it requires that the user be complicit in extracting and executing that. The user could just execute malicious code directly if that's their goal. Really you're interested in whether there's a possibility of unexpected,...


34

Any website that complies with PCI Data Security Standards has to adhere to sections 8.5.13 (Limit repeated access attempts by locking out the user ID after not more than six attempts) 8.5.14 (Set the lockout duration to thirty minutes or until administrator enables the user ID). This is unfortunately why a lot of sites accepting credit cards have ...


32

My experience of DoS and DDoS attacks is based from being a Cisco engineer for an ISP and later as a Security Manager for a very large Global. Based on this experience, I have found that to effectively deal with large scale and complex attacks requires a good partnership between the organisation under attack and their ISP or DDoS mitigation partner (Yes ...


32

I would consider another contractor, since that statement doesn't precisely increase my trust in his knowledge/skill. The correct way of setting up a security camera system so you are able to check them when you are away is to have port forwarding on your router exclusively for VPN or HTTP/TLS mapped to the machine recording data from the cameras. This will ...


29

Those are really two different, though similar, attacks. "Regular" DoS is based on trying crash the server/firewall, through some kind of bug or vulnerability. E.g. the well known SYN Flood attacks. The protection against these, are of course specific to the flaw (e.g. SYN cookies), and secure coding/design in general. However, DDoS simply attempts to ...


29

Logged out to post this just to be safe: I've worked with ATMs in the past. Our test machines are rather insecure indeed; the OS has to be running on verified hardware, but we can get admin rights to the OS easily enough and do whatever we like. We routinely lower the firewall and open the boxes to the network (they won't have internet) so we can run ...


28

This is a bad idea. To understand why, imagine there is no QR code, just a human-readable display of the URL. Now, would you base a security scheme around keeping this URL secret? Of course you wouldn't, it is the rankest security by obscurity. If you want to keep the url fairly confidential, do so without any advanced wizardry, but you need your ...


27

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be seeing the incoming requests, but your server won't be sending replies, so the overall traffic level should drop by 90% or more. Since you're running a home ...


27

Every computer with a public IP gets this kind of attention permanently. There's nothing you can do to stop it (I once tried to complain to the provider owning the IP, never got a reply and gave up). What you can do is to make sure you're well protected against a possible attack (this bot seemed to look for WordPress, but there are others looking for apache, ...


24

CERT recognizes this as a vulnerability in DNS. As it stands there are about 27 million misconfigured (read: Default!) DNS servers that can be used in this attack. Ideally you want to prevent these UDP packets from reaching their destination by filtering them at the edge router (which is your provider). Unfortunately not many providers offer this service. ...


23

Let's say I blacklisted the word <script> and replace it with nothing. Then <scr<script>ipt> becomes <script>. This is why well-written html sanitizers/purifiers apply the rules recursively. That is only when the last sanitation step made no changes to the content will it stop/not apply another round of the processing rules. (It ...


23

eval() executes a string of characters as code. You use eval() precisely because the string contents are not known in advance, or even generated server-side; basically, you need eval() because the JavaScript itself will generate the string from data which is available only dynamically, in the client. Thus, eval() makes sense in situations where the ...


22

Your question is subject to some subtleties. Fasten your seat belt, I am going to be verbose. Digital Medium You want a "digital" medium. What is that exactly ? In a hard disk, a bit is written by changing the orientation of some magnetic dipoles, created by the "movement" (inasmuch as it can be defined as per quantum mechanics) of electrons in some of the ...



Only top voted, non community-wiki answers of a minimum length are eligible