New answers tagged

0

When using CloudFlare (like mentioned in one of your comments. Two things happen. The server and application both are not aware that CloudFlare (a reversed proxy) is used. To fix this you need to tell the used software (WordPress and fail2ban) where to find this original visitors IP. Otherwise I'll be working with the CloudFlare IP's (since that's the new ...


3

RAP is very similar to a stack canary, except designed to prevent against ROP. EDIT: After speaking to spender from grsecurity, it turns out that what I'm describing here is a subset of the RAP functionality, specifically the return pointer protection. RAP is actually callled "Reuse Attack Protector", which is designed to protect against all forms of ...


1

I'm guessing you are getting many of the failed logins from other countries outside of the U.S. What I recommend for WordPress is to download an IP Blocker from the plugins and this gives you the ability to block certain countries or all the countries besides the ones you want. In my case I have a website that is only to be viewed in the U.S. so I blocked ...


0

If you have an access to the server then you can install fail2ban. You will need to set up jail for the wordpress /etc/fail2ban/jail.d/wordpress.conf [wordpress] enabled = true filter = wordpress logpath = /var/log/auth.log port = http,https $ service fail2ban restart For more details check here. Make sure that you are not using default username ...


0

I would like to know what else can I do to improve my security? First of all, you should make sure you use the newest firmware for your linksys device (if you use it). I wouldn't recommend to connect your Windows PC directly to the internet. Doing so allsows a potential attacker to directly "access" and gather information about the target machine ...


0

My recipe was and is : Portsentry Proper firewall Retailating NMAP Auto-mailing via Perl scripts to abuse@xxx from whois from reverse DNS Auto-reporting to blacklists for malicious IP's Enforcing a list of bad IPs to HTTPS/SMTPS/IMAPS/POP3S It worked and it works, but it took some time for assistance


1

Generally, no. Your computer should not be reachable from outside your local network, with the name or without. However, it can leak info like your real name, or allow people who know your computer name to match your online username to the real you. Whether this is a major concern is up to you.


2

The two concerns you've raised are: The server's copy of the server nonce can be altered by an attacker who doesn't know the password. As the server's list of client nonces grows without bounds, it can be used in a DoS. A common technique is to time-limit the nonces. Say, for M minutes for an appropriate M. For the first problem, by time-limiting the ...


0

2) Use private key to create a signature of the public key. 3) Upload the public key and its signature to the FTP server. 4) Mobile device downloads the public key and its signature. 5) Mobile device uses the public key to verify the signature. Why do this. Anyone who can create a keypair can sign the public key via the corresponding ...


0

This guy explains it well. An open port is an open door. Once one door is opened, the device in question can be used to target other devices in the same network. The linked document explains how the author got into the Hacking Team's internal network and leaked their data.


0

Have you ever tried to perform network communications with a rock? How about a network router that has no electricity? It's pretty boring, because you get no response. So attackers try to use the most common network protocols, like TCP and UDP, which use numbers that are called "port numbers", or "ports". (SCTP also uses ports.) If a port is closed, ...


1

As Girish points out, a port scan is like casing a house. Its a a very low noise activity when done from the internet, because you'll see dozens of port scans a day. It also gleans a small amount of information about the state of your machine, and that lets them tailor the next layer of the attack even more. It's also dirt cheap! Doing a port scan costs ...


4

Consider that I wanna rob your home ... Then I would look up for a way to get into. But your home has door locks that allows only your local(family) to access it so I will search for some other like way(ports) windows(other open public ports) to get into.And try to get some data. If ports will be open for ssh/ftp they try to exploit them. Try uploading files ...


38

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs implement them and preferably the versions of those programs). To fingerprint a service, the attacker needs to know that there is one running on a publicly ...


10

Are you safe from ransomware just by not downloading suspicious files? Unfortunately, it is a mistake to assume that you are safe from ransomware just by not downloading files from suspicious websites. As an example, just last month, the OS X version of the popular BitTorrent client Transmission (v2.90) was infected with ransomware. This infected version ...


5

The thing about brute forcing a TOTP token is that you have to guess right at the right time. So, if you don't want to lock a user out after x failed attempts (which is common practice) you can slow failed attempts down to the point where the odds of getting the TOTP right are statistically insignificant. For example: 6 digit TOTP token has 1,000,000 ...


3

None will protect against a replay attact. In the first case, all the attacker has to do is adjust the timestamp. In the second case, since H() is not supposed to be secret and since the timestamp is known, and attacker can also adjust the request by creating a valid H(timestamp). There is also the problem that you need to synchronize the client and ...


67

According to the IBM X-Force Threat Intelligence Quarterly Report, fourth quarter 2015, the primary sources of ransomware attack are unpatched vulnerabilities, drive-by infections, and spear-phishing emails: Source: IBM X-Force How to prevent ransomware attacks User education Educate your users not to download files from unknown contacts. Usually ...


11

The how it gets there part of your question has been well answered already, so I'll go for some ways to protect yourself, though the only way of truly being safe is not to use a computer connected to the internet, as even the below aren't 100% safe. Don't open any document from anywhere unless you've been expecting to receive it, and from that specific ...


44

While the measures you describe in your question are not wrong, they are not correct either: Documents are not safe to open either. Often times, exploits come in the form of interestingFile.txt.exe. Windows hiding the .exe by default leads users to think that's just a text file when indeed they execute code. There are other ways to keep executable code ...


1

The signature algorithm used in the root certificate is not used to establish trust against the root certificate because a root certificate is trusted by the virtue of a copy of the root certificate is installed in the browser, either included in the browser as part of the installation, or added later by the user to their certificate store. For the rest of ...


1

Independent of the quality of your 5 digit random number I would like to elaborate on your claim "Provided, the email can only be opened by the administrator of the website." We assume that the administrators email account is protected only by password. This way you combine one password (email password) with probably the password of the web admin interface. ...


1

There is unlikely to be a single answer to this question as each may cover different flaws. Here are some, only concerning token derivation and use of 404: The second part of the token can be directly calculated by any adversary as they know their own IP address. It can therefore be removed without reducing security. The use of a hash in the first part of ...



Top 50 recent answers are included