Tag Info

New answers tagged

1

An historical example of such a poor algorithm is Microsoft's LM hash. As you said Felipe, in order to create a strong password, you need among other things to mix uppercase and lower case letters. Why? Because by doing so there can be 52 different possible letters constituting each character of the password: 26 lowercase + 26 uppercase. By converting the ...


2

I also could not find any password storage policies that mention that passwords should not be upper-cased. But I also didn't find any guides which told me not to set every password to "password", not to remove all special characters, or not to shorten them to 4 characters. It's just obvious. You should not change the password that the user supplied. This ...


0

User's Security You are missing one extremely important thing: CSRF mitigation. Be sure to fully understand the related problems. Tldr: in addition to the authorization token (e.g. session cookie), you need a challenge per action to identify if the action is intended by the user or unintended. Fix JSONP leaks. X-Content-Type-Options: nosniff, on all ...


15

From reading the disclosure, it seems what happens is that the open port isn't actually just a random port, but rather it is a port where a certain internal service that had never been designed to be exposed directly to the external world was listening on. If there is a vulnerability in that internal service, that might have allowed a possible attacker to ...


2

Protecting the root account makes cleanup much easier: if an attacker can't tamper with the kernel or most of the programs, it's much harder to hide malicious code. It also means they can't tamper with the antivirus and other protection systems.


1

The string provided does appear to be an attempt to exploit the Shellshock vulnerability. With cgi disabled your attack surface should be reduced. With regards to countermeasures, patching to address the issue would be the most effective approach. The following links provides guidance on assessing whether your installation is vulnerable, as well as steps ...



Top 50 recent answers are included