Tag Info

New answers tagged

0

To be frank: There is no such thing like an unpublished web site. There are bots routinely crawling all IP numbers and looking for webservers on the usual ports. When they found a web server, they may try out some well-known misconfigurations or other vulnerabilities to take over the server. In case of success they may send spam emails or attack other ...


-1

my recent history from my client. if you have got locked droplet the D.O will give you booted to the recovery environment. so you must have and ask the D.O to active your private droplet and migrate all data to new droplet


1

In the case of Mega we should look at (recent) history to see what their motivation for end-to-end encryption is. The founder, Kim Dotcom, previously ran Megaupload which was continuously under attack by governments for "digital piracy." After about 7 years of operation, in 2012 an international police force arrested Dotcom and seized his assets. In 2013 ...


1

From time to time there is such question popping-up in this site, "How can trust this company?", because it is what your question is up to: can you trust Mega (or put here any other company name, even a not IT-related one). As long as it just you and this company, I will call it the provider from now on, then you just cannot trust them. They may tell you ...


2

You don't know what Mega (or any other cloud service) is actually doing on their servers. There is rarely any way to verify the security claims of a cloud service unless they let you examine their internal systems.


4

If you're using CloudBerry backup, enable the client-side encryption so that the files are encrypted before they reach Amazon S3. Encrypted Data outside of HIPAA scope You do not need a Business Associate Agreement (BAA) if you are sending encrypted data to a third party provider. Note this encryption must be done with FIPS 140-2 compliant ciphers such as ...


0

I'm not familiar with Cryptree, but from reading the first page of the PDF I can see that it's basically a file encryption library. (Actually directory-tree encryption.) So the answer to your question is: it depends on where the decryption happens and where the keys are stored. If the provider uses Cryptree internally but holds the keys and does the crypto ...


2

Ichilov's answer is more relevant. Two non-vulnerable SSL Attacks Send garbage data in place of pre-master secret (SSL Handshake flood) Continuously re-negotiate the per-master secret from the handshake again & again Hope Ichilov's explination is quite enough Mitigation: Client puzzle can help to mitigate DDoS attacks. The client puzzle mechanism ...


2

From the perspective of an attacker who wants to update the app on the Google Play Store without the knowledge of the developer (or bending Google's arm to accept the malicious app, for that matter): One hurdle is getting victim Android devices to accept the update as an update, instead of as a completely new app. App upgrade: When the system is ...


1

This is a hard question to answer. If law enforcement knew of a vulnerability that would allow them to replace apps in Google Play, they could use it (with varying degrees of legality). Perhaps they could get a court order forcing Google Play to allow them to update other people's apps (but I suspect that Google would fight this as best they could). Law ...


0

Full disclosure, I work for Incapsula, we are a cloud-WAF provider. To answer your questions To pass TCP handshakes with a spoofed IP you`ll need to be in control of the router, which means you need to be in an ISP-like position. For more info, please see the @gowenfawr answer in this discussion (also linked in the OP). In short, while theoretically ...


1

I try not to do this but this is very much a yes and no answer. Tools like FTK Remote Agent run as a service on the system. An investigator can connect to those tools and perform tasks (such as pulling a remote image of that particular system.) If you were to walk into the data center of AWS and could get console level access and installed than ran your ...



Top 50 recent answers are included