Tag Info

Hot answers tagged

132

I think the assumption here is wrong. They don't have physical access to the machine. They have supervised access to a very limited control panel for a machine which is built into a bomb-proof safe, bolted to the ground and hooked up to an alarm system with an armed response force. Get the machine out of the vault and away from supervision and then yes... ...


118

ATM are supposed to be tamper resistant, and to actively react upon any detected breach of physical security, notably by marking bills with some highly conspicuous and hard to remove ink, and also by committing honourable seppuku. For that matter, an ATM should be compared with HSM, payment terminals and smart card. You can imagine the ATM as a kind of Davy ...


75

Rainbow Tables are commonly confused with another, simpler technique that leverages a compute time-storage tradeoff in password recover: hash tables. Hash tables are constructed by hashing each word in a password dictionary. The password-hash pairs are stored in a table, sorted by hash value. To use a hash table, simple take the hash and perform a binary ...


55

The answer to this question very much depends on the security posture of your site, which decides whether the risk of unauthorised access is greater or lower than the risk of Denial of Service for some users. For high risk sites, I might go with the blocking option, especially where most of the user base is likely to be home users and therefore is likely to ...


50

Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length about this issue. In brief, there's insufficient research. In long, here are some of his ideas for less painful account locking: Don't count duplicate password attempts (they probably thought they mistyped it) Make the password hint about the ...


46

The Internet is a wild and scary place, full of malcontents whose motives range from curiosity all the way to criminal enterprise. These unsavories are constantly scanning for computers running services they hope to exploit; usually the more common services such as SSH, HTTP, FTP, etc. The scans typically fall into one of two categories: Recon scans to see ...


46

No Quarantine is nothing but a place to store the infected/suspicious files. When you quarantine a file it is deleted from the actual place and moved to the quarantine location (to the path that your anti-virus program has for them). This is something like keeping a zombie inside a jail. Obviously it is not a threat as long as you don't open the cage. In ...


43

These kinds of password entry systems are only good as long as the attackers do not adapt. It is a play in several acts: Bank Web sites use passwords which are entered the traditional way, with a keyboard. Key loggers appear, and harvest key strokes. After some cases of actual bank password theft, banks adapt. They implement "visual keyboards" in which the ...


40

The adage is still accurate. Physical access to the machine is not the same as physical ability to interact with the machine. The vast majority of attacks against a physical box involve actually altering the hardware and there is a limited amount you can do to alter the hardware of an ATM as it is locked in a safe, away from the user. It is, however, ...


35

Today's ATMs may be more secure than yesterday's ATM's, but the track record has been spotty. fake ATMs have been set up by criminals and used to duplicate bank cards and collect PINs. This takes advantage of the fact that whereas ATMs authenticate users via cards and PINs, users simply trust that ATMs are real by their visual appearance and bank logos. ...


34

Option 1 may introduce a number of non-security related issues anyway: The resulting URL may be cached by the browser, or bookmarked, causing users to resubmit. The resulting URL may be shared by users, causing third parties to submit. The URL may be sent to your browser vendor, who may hit the site. But this is about security, and it introduces a few ...


29

Logged out to post this just to be safe: I've worked with ATMs in the past. Our test machines are rather insecure indeed; the OS has to be running on verified hardware, but we can get admin rights to the OS easily enough and do whatever we like. We routinely lower the firewall and open the boxes to the network (they won't have internet) so we can run ...


27

Any website that complies with PCI Data Security Standards has to adhere to sections 8.5.13 (Limit repeated access attempts by locking out the user ID after not more than six attempts) 8.5.14 (Set the lockout duration to thirty minutes or until administrator enables the user ID). This is unfortunately why a lot of sites accepting credit cards have ...


26

This is a bad idea. To understand why, imagine there is no QR code, just a human-readable display of the URL. Now, would you base a security scheme around keeping this URL secret? Of course you wouldn't, it is the rankest security by obscurity. If you want to keep the url fairly confidential, do so without any advanced wizardry, but you need your ...


26

The other answers mostly talk about attaching arbitrary code to images via steganographic techniques, but that's not very interesting since it requires that the user be complicit in extracting and executing that. The user could just execute malicious code directly if that's their goal. Really you're interested in whether there's a possibility of ...


26

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be seeing the incoming requests, but your server won't be sending replies, so the overall traffic level should drop by 90% or more. Since you're running a home ...


23

Let's say I blacklisted the word <script> and replace it with nothing. Then <scr<script>ipt> becomes <script>. This is why well-written html sanitizers/purifiers apply the rules recursively. That is only when the last sanitation step made no changes to the content will it stop/not apply another round of the processing rules. (It ...


22

Those are really two different, though similar, attacks. "Regular" DoS is based on trying crash the server/firewall, through some kind of bug or vulnerability. E.g. the well known SYN Flood attacks. The protection against these, are of course specific to the flaw (e.g. SYN cookies), and secure coding/design in general. However, DDoS simply attempts to ...


22

My experience of DoS and DDoS attacks is based from being a Cisco engineer for an ISP and later as a Security Manager for a very large Global. Based on this experience has shown to effectively deal with large scale and complex attacks requires a good partnership between the organisation under attack and their ISP or DDoS mitigation partner (Yes there are now ...


21

CERT recognizes this as a vulnerability in DNS. As it stands there are about 27 million misconfigured (read: Default!) DNS servers that can be used in this attack. Ideally you want to prevent these UDP packets from reaching their destination by filtering them at the edge router (which is your provider). Unfortunately not many providers offer this service. ...


19

The answer is generally it depends. This is really based on the security of your system. Users can create new accounts without restriction If so, it is kind of meaningless to not tell them. You can't have intersecting usernames or email addresses, so you have to inform a new user if their username or email has already been used. An attacker would then be ...


18

From most of my clients (generally Fortune 100 companies) I can say that most attackers they notice (lets exclude the wide range of scans and script kiddie attacks dropped at the perimeter and DMZ) are very experienced, have extensive resources and follow pretty much the same methodology as the white hats. An example: Discovery - from public sources ...


18

I agree with @Jorn's answer about the validation. However, you're still forgetting a very important step here, and that is output encoding. E.g. HTML encoding (or Attribute encoding, or Javascript encoding, etc) before outputting anything... In fact, this is arguably even more important than the input validation (arguably, not absolutely, and definitely ...


18

The real issue here is that the attacker only needs physical access to your hard drive in order to read or manipulate the files which contain your password hashes. There is already a thread on SuperUser which has some recommendations, which I will likely repeat here. How to secure my Windows 7 PC? As security compromises of a PC go, physical access is ...


17

My experience is lock out mechanisms are diminishing in popularity (at least for web apps). Instead of locking accounts out after a series of failed attempts, you begin to ask for additional information for successful authentication.


17

To a large degree, how safe varies with the attack vector. For instance, they're typically not safe at all from having a skimmer installed, allowing a thief to collect card information from unsuspecting users. They're getting better by added intricately molded fascias that make installing skimmers more difficult, but even that can be overcome by a good ...


17

Packet checksums are not cryptographic measures, and are not intended to be a security feature. Anyone (even an attacker) can calculate the checksum for a packet containing anything, and there's no secrets/keys involved in the calculation. Checksums are intended to catch errors during the transmission of the packet: flipped bits, miscommunication, etc. ...


16

The best way to build CSRF protection properly: Don't. Most common frameworks have this protection already built in (ASP.NET, Struts, Ruby I think), or there are existing libraries that have already been vetted. (e.g. OWASP's CSRFGuard). Another option, depending on your context, is to enforce reauthentication of the user, but only for specific, ...


15

First, my condolences. That sounds like a real bummer - having to bolt on security after the fact with little or no analysis time, with a black box commercial product, no way to get fixes and a forced hand in terms of what product is chosen and when it's deployed is something like a security nerd nightmare. I'm sorry if this is a real situation - it's not ...


15

Your question is subject to some subtleties. Fasten your seat belt, I am going to be verbose. Digital Medium You want a "digital" medium. What is that exactly ? In a hard disk, a bit is written by changing the orientation of some magnetic dipoles, created by the "movement" (inasmuch as it can be defined as per quantum mechanics) of electrons in some of the ...



Only top voted, non community-wiki answers of a minimum length are eligible