Tag Info

New answers tagged

1

Many systems have a standardized way of generating usernames (last name first initial, email address, etc) and other systems leave usernames completely public facing (WordPress, although you can hide then via plugins). So it is common to have little or no secrecy when it comes to the choice of usernames. This is the reason for passwords in the first place. ...


0

No one will going to hack you without not knowing your user name. Your password is the one which prevents you from brute force attacks. The spammers have a databases with email addresses and not just randomly send emails to all possible user names also. Looks like nothing is wrong with your system administrator.


23

The username is not a secret; any determined attacker will be able to find out the names of users on your system. What does improve your security, is if there is no remote access for "root", "guest", and similar account names found on many systems. In fact, Ubuntu explicitly disables the "root" account because it is such a favorite target.


6

one-letter is indeed a bit short, but a good IDS can quickly see if someone is messing with your network if 3 letter usernames are being used. But from a security standpoint one should assume the Username is known to an attacker since its often easy to guess or not protected at all (leaked at some other place) so short usernames are not so much an issue, ...


0

Let's take another look on this question: detecting malware purely on behaviour is very hard --- not only malware can try detect whether it is running in a virtualised enviorment, but it can (for example) wait some time before activating malicious behaviours (a kind-of-related example: some time ago a chrome extension that waited 7 days before activating ...


1

...practical, to build a sandbox that's identical to an actual computer... test every file and program in a sandbox before it is used... I think this is the wrong question to ask. The real challenge is not to build a sandbox which behaves like a real computer, but one which behaves like a real computer used by the targeted user. Malware actually uses ...


3

Put an actual computer in a physical sandbox environment. The computer itself isn't a sandbox and don't virtualize anything. Need active directory? Put active directory in the sandbox environment. Do your tests, verify what has changed, review computer and network logs. This is more practical than building a sandboxed OS which limits normal hardware ...


8

Actually lorenzo's answer does not quite cut it. The Church-Turing thesis only provides us with a model of computing, it can't tell us anything about virtualization because it is not concerned with other aspects of a machine. But there is theoretical analysis for the ability of a machine to be virtualized by Popek et al: ...


17

Yes, it can be done as (theoretically) every "computing device" is computationally equivalent to every other computing device. Look up the Church-Turing thesis if you are interested. However your question is grounded in practice and in this case the answer is "yes, but it would cost too much". Effort in virtualisation today aims at speeding up the virtual ...


4

This is a Parameter Tampering attack. Emphasis mine: The Web Parameter Tampering attack is based on the manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form ...


2

Usually referred to as payment bypass. A checksum based approach is often used where request details are hashed alongside a secret value on the merchant side and then validated on the payment processor side. Unfortunately a large number of these systems that I have observed in production do this incorrectly. I did a presentation on this at BH Asia last year ...


2

This is an attack on the integrity of your information, depending on how it's orchestrated it might be considered a man-in-the-middle attack or request tampering. Some common techniques to ensure integrity: Server side validation For example, if it's an online checkout then pass the list of products and calculate the total server side rather than sending ...


2

This attack is a variant of Shellshock, denoted by the bash code found at the beginning of the payload: () { :;} ;. The way you prevent your application from being scanning by bots is by disconnecting your server from the internet. Scans for remote code execution vulnerabilities like Shellshock are extremely common and are not going away any time soon. A ...


3

It may be that you need to narrow the scope a little in order to get started. Which aspect of security are you interested in. From the list of standards, you seem more interested in application security & especially in authentication and authorisation? That would be a much easier set of targets to learn at least to begin with. Also, you may need to be ...



Top 50 recent answers are included