Tag Info

Hot answers tagged

297

One thought is to not allow form submission if there is not a value in the password box. Generally if they accidentally entered the password in the username, then there likely isn't going to be anything in the password dialog. It is worth noting that this does not have to be simply done client side, but could also be done on a server as long as the ...


29

Assuming your backend application and SIEM needs to view failed login attempts to various applications (and thus show the "User P@$$w0rd is not valid" error message) then it is not going to be trivial to stop this. However, ensuring that all applications that send sensitive data including usernames and passwords implement HTTPS (encrypted HTTP using SSL) is ...


22

I don’t think that “legal” is the right term to use. It’s not wise, a lot of times “right” password is only one letter different from the “wrong” password (typo/capital letters/…). So if somebody evil will get this log he may easily guess the correct password. Other problem is that people re-use passwords, so they use same password for your ...


20

So the problem is that you don't want analysts to see the passwords in the sensitive log files? Caution: Even if you were to use Javascript it doesn't deal with the password data that is stored on your disk in plain text. A better solution is to preprocess the logs before the analysts see them and redact information in the logs. You can do this ...


19

HTTP 200s can be awesome for an attacker when he is requesting URIs that should be protected by authorization (http://cwe.mitre.org/data/definitions/862.html). Attackers pay notice to HTTP 500s – they often lead to offensive success. Observing lots of HTTP 500s can be interesting. If the app likes to redirect (HTTP 302) upon errors, then lots of HTTP 302s ...


18

This is an excellent and important question. There are several important techniques to know about: Remote logging. Rather than store the log entries on the webserver, the webserver should be configured to send each log entry over the network to a log server. The log server should be a custom machine, configured for a single use (log recording only), and ...


18

I can only identify three problems with what you're discussing. Users aren't inputting information correctly. Analysts can discern passwords from logs. Passwords are being sent in clear-text and are susceptible to man-in-the-middle eavesdropping. In my opinion, this is fairly simple to fix. Accept user error, grudgingly. Don't log invalid usernames, ...


16

Yes, log file injection can be useful in the exploitation process. For example, here is an exploit that uses a PHP Local File Include vulnerability to execute PHP code within Apache's access_log file. This exploit pattern is common in the LAMP world. Most systems lack protection against this attack pattern. Usually log files are protected by the ...


15

That would be a WHOIS lookup


15

This is a major problem when proving auditability, as IT folks tend to have access to servers and theoretically could alter logs. A common solution is to write logs to somewhere inaccessible to IT/Sysadmins etc in addition to the core syslog servers, for example offsite or to a WORM drive (Write Once - Read Many) This allows you to use your normal syslog ...


14

This is an entry from my access_log of what my coworker did to my test machine... : 10.11.12.13 - - [25/Sep/2014:16:00:00 -0400] "GET /cgi-bin/testing.cgi HTTP/1.0" 200 1 "-" "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/rm -rf /var/www/" In my error log I saw a lot of this: [Thu Sep 25 16:00:00 2014] [error] [client 10.11.12.13] ...


12

Bash history won't help you against a semi-competent attacker in the usual case. There's an alternative: The auditing subsystem. Install auditd and configure it, so it logs for example program executions and other things you configure. In basically logs the system calls that are made according to filters you have created. Now, if you really want to depend ...


12

There's a decent article on the BBC on this type of information here: http://www.bbc.co.uk/news/technology-17586605 In terms of what they'd get from an ISP, the likelihood is that it would be what they accessed and when, search results, search terms etc. However, the contents of online conversations wouldn't be available though they might be identified in ...


11

Generally, the most conservative answer comes in the form of something easily understood, and approachable by the general populous. Ignoring the hyperbole of that kind of response, there are two things you must really take into account. What logs should I retain How long should I retain said logs Log Retention The answer to 2 is simple and well ...


11

A solution I have seen a few banks implement, at least in web apps, is to have a two page login. On the first page accept only the username On the next page in the process request the password and only echo the username back so it is not an editable field Therefore the only input on the second page should be the password. Since the user knows they must ...


11

From the access logs of a service (nginx, Dovecot, etc.), you cannot see whether you were affected or not. Unless you have previously captured all SSL traffic, you cannot see whether you got attacked in the past either. The pattern to match in a packet capture is very simple: A malicious Heartbeat request is sent. An overly long Heartbeat response is ...


10

For tracking what is sent and received, you can use a packet sniffer. I use Wireshark (formerly Ethereal).


10

Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like. As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...


10

I love to answer these questions, and I feel a bit excited/proud that you'd choose Security.StackExchange to ask this question. According to The Data Retention (EC Directive) Regulations of 2009, Internet Service Providers (ISP) are required to keep some data for 12 months. This includes which IP address people have been assigned, plus log-in and log-off ...


9

Usually a large number of log entries from a honeypot are from one of two reasons: Your environment is getting scanned like a smudged barcode. You made the mistake of putting your honeypot on a non-dark network. You've configured your honeypot as a pretty typical Windows desktop, so lots of Windows service active, open sharing, etc. What you are likely ...


9

OSSEC is a great FOSS HIDS that works well to reduce the number of log events you need to check out to something potentially manageable. It supports all of the log sources you mentioned: http://www.ossec.net/main/supported-systems We built an in-house app that allows us to do a quick “daily check” of all the alerts OSSEC fires in a day; it typically ...


9

Simply put, the Integrity of the system is more valuable than its Availability. This rule ensures that the system is never running without logging, never running in an un-accountable state. It is preferable at certain high levels of security that the system stop running than the system run without provable security in place. The alternative would allow ...


9

You are expected to log: All individual accesses to cardholder data All actions taken by any individual with root or administrative privileges Access to all audit trails Invalid logical access attempts Use of identification and authentication mechanisms Initialization of the audit logs Creation and deletion of system-level objects These must be logged ...


8

Some ISPs force a connection reset every 24h and you get a new IP address assigned, others don't force you and yet others give you a fixed ip address. There are laws requiring the ISPs to log the User - IP association (which in turn is associated with your contract)... but e.g. in the EU there is the data retention directive that requires ISPs to even log ...


8

If you're dealing with HTTP (and/or HTTPS) on Windows, Fiddler might help you there: it hooks into Winsock, so it can tell you the program name it will show you all HTTP(s) requests and responses passing through it and it allows you to modify those, either manually or through scripts


8

it won't really help if you allow executing non-shell commands from the shell. For example - you can omit bash by running perl (or some other scripting language) and call commands from there - it will evade bash logging.


8

Here are a few different features you should consider, note that you might not need all of these, and one might not be better than the other - but they are points to consider: Coverage: Windows Event Log on servers, all current versions Windows Event Log on clients, all versions in your org (you'd be surprised how many Win98s there still are...) syslog on ...


8

Additionally to Adnan and AndyMac's answers, which focus mostly on access to logs, if the police decide to monitor an individual that has a high enough profile (think terrorists etc) then they can explicitly request a wiretap - which in this day and age is a little more advanced than the old line tap. The wiretap can be set up to pass every piece of traffic ...


8

While ACLs are indeed the main way that the event log is secured, it does implement some other security features. When the event log is cleared from the event viewer, a new event is added which contains the username of the user that cleared it. Windows also keeps event log files open while the operating system is running, locking the files in such a way ...


7

If you have no liability for what the users do with the laptop, then what is the benefit to you of monitoring the usage. In the absence of any legitimate benefit, that would leave anyone questioning your motives in doing so - so you would create liability by doing this. There are a lot of other security concerns you should be concerned about - primarily ...



Only top voted, non community-wiki answers of a minimum length are eligible