Tag Info

New answers tagged

0

I like André's answer of having a switch or button to program the firmware. Some devices already have this, many motherboards for example have a jumper to protect the BIOS against writing. Forcing the device to not function properly in firmware program mode would allow a user to see if something was iffy. Like an audio device that output no audio, or a ...


0

The only way it could be completely prevented is to not have any type of writable non-volatile memory on the device. The problem with this is it would prevent the the firmware from ever being changed which could complicate things. The issue these days, from my understanding, is there needs to be low level read/write commands to access spaces in memory ...


3

One solution is to require all firmware to be signed and have the device check the signature before writing that firmware image to its memory; my current laptop has an option to enable this in its BIOS (the option is permanent - if I enable it now I can't disable it anymore, that's why I didn't enable it). There are many drawbacks however : induces a ...


0

* Use an authenficiation for apps that don't have their own. Otherwise anyone can use it. You can use HTTP basic auth for that. It's basic, like the name says. https://www.digitalocean.com/community/tutorials/how-to-set-up-http-authentication-with-nginx-on-ubuntu-12-10 * Restrict access to certain machines. I know Nginx can deny access based on IP ...


3

The attacker had access to all other virtualhosts (what you call "domains") because they all run under the www-data user, once he got this user's privileges he could access all the other domains. To mitigate this you can use mod_privileges on Apache to run each virtualhost under a different user account, and make each virtualhost use a different PHP-FPM ...



Top 50 recent answers are included