Tag Info

New answers tagged

2

The answer is that you don't know. This is the classic halting problem. Basically you should not allow users to set their own regexs wherever possible. If you do allow them to set their own regex, then you could mitigate it in other ways such as only allowing them to set regexs when it affect their own service, or by setting execution timeouts. You could ...


0

Can exit nodes eavesdrop on communications? Isn't that bad? Yes, the guy running the exit node can read the bytes that come in and out there. Tor anonymizes the origin of your traffic, and it makes sure to encrypt everything inside the Tor network, but it does not magically encrypt all traffic throughout the Internet. Also, JavaScript is enabled ...


0

Appart from the "100% anonymity" from your title, which seem to include government agencies and can therefore never be 100% ensured, as long as the "online communities" are concerned some of them implement special policies regarding Tor's exit nodes IPs. For instance you can check Wikipedia where by default Tor's users are prevented from editing articles to ...


0

If a user has good trade craft and implements good tor hygiene by doing all the things you listed, it would be very hard to UID them..if not impossible. I know one of the most common methods that is emerging is pattern recognition that can analyze things like how a user types and then UID them from that, but that relies on things like javascript so if it is ...


1

ToR and associated products (e.g. Tails) provide a technological capability which will, if used consistently, allow certain actions to be taken online without any easy way to track them back to the person executing them. So it's likely that the weak point in an anonymous browsing setup will be the person operating it. Good Operational Security (OpSec) ...


7

You got the report from your hosting provider. They would be able to tell whether the traffic originated from your server or if it was spoofed. So if your hosting provider is competent, then the report is most likely correct. If I was in your shoes, there are two things I would do. I would ask the hosting provider if they can send a packet capture of some ...


3

I don't have any advanced knowledge of security Thats the problem here. Do you have an outbound-filtering iptables/packetfilter (vulgo: firewall) installed? Is the information from my webhost strong evidence that my machine has been compromised and that I need to have them do a reinstall? Probably: yes (reinstall). Your server must be considered ...


2

I have found that these automated, undirected scans are usually scanning IPs randomly and do not include a Host: header or include a bogus Host: header. Filtering out requests with bad Host headers can reduce the nuisance logging a bit and possibly reduce the impact on your server, depending on the server's architecture. This doesn't make your server much ...


2

While all of them lead to a 404 Not Found, CPU cycles are wasted in processing these requests ... Somewhere CPU cycles "must be wasted" to filter out these requests. But it depends on the kind of requests and of your server and application setup how much cycles this will be and where exactly they will be needed. If there is a clear source of these ...


2

The reason why it's important and not critical is not because there are mitigating factors. The description of Important is: This rating is given to flaws that can easily compromise the confidentiality, integrity, or availability of resources. These are the types of vulnerabilities that allow local users to gain privileges, allow unauthenticated ...


0

I am ruling out multicast traffic as the source IPs seem to be available in the ip databases. port 13766 is not a commonly used port, i could not find any software that uses this specific port. i really find it odd for someone to target this port. This is NOT a SYN flood because it was only 22 packets per second. a real SYN flood will use thousands/ sec. ...


2

I sometimes hit this when googling technical matters fast (manually), and only looking for search results for a second or two (without following the links). This happens regardless of OS I'm currently on (Windows or Linux), and without any other machines behind my NAT (without dynamic IP changes in a while). There's no malware, browser plugins, or scraping ...


3

how can I mitigate and protect against such vulnerability warning Well, generally speaking, everybody knows that defending against DoS attacks -whatever their nature is- is a difficult and expensive thing to achieve. Coming back to your essential problem, it happens when an attacker overwhelms your server with secure connection requests leading it to ...


3

To put some hard numbers on it: it'll take forever. ping -t means "send one 'ICMP echo request' packet of 60 total bytes every second". Counting the 60-byte response, this works out to a bandwidth usage of 960 bits per second. You'll be able to DoS someone using a 1200 bps modem. You'll have a noticeable impact on anything less than a 9600 bps modem. ...


3

Short answer : It won't. Long answer : It can't because there is not enough data being sent to overload the network connection. Considering a lot of PCs have gigabit network cards, flooding a pc with ping requests only sends a few bytes at a time. It wouldn't even be considered a Denial of service attack (DoS) You would need something like a distributed ...


1

As was stated a secondary IP via the same gateway will not help. This text-based diagram shows why: {INTERNET} <---> [Hitron, the Gateway, 2xIP] <--IP Passthrough---(a) (a)---> [dd/wrt NightHawk, 2xIP] <---> Devices on the network IP Passthrough only works because the Hitron device sees all the traffic first, then it goes to the ...


1

Your Hitron device is still acting as a gateway. This means that any traffic targeted to your second device must be handled by the Hitron. When the Hitron device is running out of resources, every host which is using the Hitron as a gateway is affected. First of all, it's not very effective to work around this issue without a external gateway like VPN. ...


1

Read this article and get all of the answers thoroughly. enter link description here As described in the above paper: SIP message payload tampering: The first class of attacks is based on tampering with the actual SIP message or more specifically, the SIP payload. SIP is a text- based protocol and messages are transported usually in clear text. Attackers ...



Top 50 recent answers are included