Hot answers tagged

322

One thought is to not allow form submission if there is not a value in the password box. Generally if they accidentally entered the password in the username, then there likely isn't going to be anything in the password dialog. It is worth noting that this does not have to be simply done client side, but could also be done on a server as long as the ...


95

I highly doubt it. You didn't press enter but Google will sometimes send the information to quickly present your results. This is forced over HTTPS. Your information was likely encrypted and not exposed. According to most sources Google processes on average 3.5 billion searches per day. There is no additional information to prove your query is a password. ...


41

What are the strengths of each team member that I will work with regularly? (i.e. programming, linux, networking, regulations, etc.) Where is our documentation? You hopefully have a wiki, a knowledge base, or set of documents somewhere that explain your processes and policies. If you don't, be a hero and get started on one. What are the current projects the ...


38

I recommend that you change your password. The fact is, that your password has been sent to their servers, even if you didn't press enter. You can test that on your own, open your browser, Ctrl + Shift + I, select network, start typing and monitor traffic. Here is an example, writing the keyword "test", and not pressing enter. Pay attention to the letter ...


32

Assuming your backend application and SIEM needs to view failed login attempts to various applications (and thus show the "User P@$$w0rd is not valid" error message) then it is not going to be trivial to stop this. However, ensuring that all applications that send sensitive data including usernames and passwords implement HTTPS (encrypted HTTP using SSL) is ...


25

It has been sent (encrypted) to Google. Change your password It has probably been logged somewhere, along with many search terms and other junk people have typed there. While it's unlikely it will be used for anything you care or that endangers your account, why bear the risk? Simply changing it will solve it. PS: I recommend using a browser search bar, ...


23

I don’t think that “legal” is the right term to use. It’s not wise, a lot of times “right” password is only one letter different from the “wrong” password (typo/capital letters/…). So if somebody evil will get this log he may easily guess the correct password. Other problem is that people re-use passwords, so they use same password for your ...


23

The short answer is that it is very, very likely that your concatenated username and password exist on an unencrypted log somewhere that a larger group of people would conceivably have access to than the restricted logs. You are not paranoid to change your password and should change it when this happens.


21

This is an excellent and important question. There are several important techniques to know about: Remote logging. Rather than store the log entries on the webserver, the webserver should be configured to send each log entry over the network to a log server. The log server should be a custom machine, configured for a single use (log recording only), and ...


21

HTTP 200s can be awesome for an attacker when he is requesting URIs that should be protected by authorization (http://cwe.mitre.org/data/definitions/862.html). Attackers pay notice to HTTP 500s – they often lead to offensive success. Observing lots of HTTP 500s can be interesting. If the app likes to redirect (HTTP 302) upon errors, then lots of HTTP 302s ...


20

So the problem is that you don't want analysts to see the passwords in the sensitive log files? Caution: Even if you were to use Javascript it doesn't deal with the password data that is stored on your disk in plain text. A better solution is to preprocess the logs before the analysts see them and redact information in the logs. You can do this ...


19

I can only identify three problems with what you're discussing. Users aren't inputting information correctly. Analysts can discern passwords from logs. Passwords are being sent in clear-text and are susceptible to man-in-the-middle eavesdropping. In my opinion, this is fairly simple to fix. Accept user error, grudgingly. Don't log invalid usernames, ...


19

The key word is properly. Properly logging HTTP requests when there is a need for it is not bad practice. I am a pen tester and I log all the HTTP requests that I make as part of a test; doing so is expected. I also work on a server system that integrates with a number of complex legacy systems. Logging full HTTP requests on error is a necessary feature. It ...


16

Generally, the most conservative answer comes in the form of something easily understood, and approachable by the general populous. Ignoring the hyperbole of that kind of response, there are two things you must really take into account. What logs should I retain How long should I retain said logs Log Retention The answer to 2 is simple and well ...


16

Yes, log file injection can be useful in the exploitation process. For example, here is an exploit that uses a PHP Local File Include vulnerability to execute PHP code within Apache's access_log file. This exploit pattern is common in the LAMP world. Most systems lack protection against this attack pattern. Usually log files are protected by the ...


15

That would be a WHOIS lookup


15

This is a major problem when proving auditability, as IT folks tend to have access to servers and theoretically could alter logs. A common solution is to write logs to somewhere inaccessible to IT/Sysadmins etc in addition to the core syslog servers, for example offsite or to a WORM drive (Write Once - Read Many) This allows you to use your normal syslog ...


14

This is an entry from my access_log of what my coworker did to my test machine... : 10.11.12.13 - - [25/Sep/2014:16:00:00 -0400] "GET /cgi-bin/testing.cgi HTTP/1.0" 200 1 "-" "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/rm -rf /var/www/" In my error log I saw a lot of this: [Thu Sep 25 16:00:00 2014] [error] [client 10.11.12.13] ...


13

Bash history won't help you against a semi-competent attacker in the usual case. There's an alternative: The auditing subsystem. Install auditd and configure it, so it logs for example program executions and other things you configure. In basically logs the system calls that are made according to filters you have created. Now, if you really want to depend ...


13

A solution I have seen a few banks implement, at least in web apps, is to have a two page login. On the first page accept only the username On the next page in the process request the password and only echo the username back so it is not an editable field Therefore the only input on the second page should be the password. Since the user knows they must ...


12

There's a decent article on the BBC on this type of information here: http://www.bbc.co.uk/news/technology-17586605 In terms of what they'd get from an ISP, the likelihood is that it would be what they accessed and when, search results, search terms etc. However, the contents of online conversations wouldn't be available though they might be identified in ...


11

From the access logs of a service (nginx, Dovecot, etc.), you cannot see whether you were affected or not. Unless you have previously captured all SSL traffic, you cannot see whether you got attacked in the past either. The pattern to match in a packet capture is very simple: A malicious Heartbeat request is sent. An overly long Heartbeat response is ...


10

Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like. As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...


10

You are expected to log: All individual accesses to cardholder data All actions taken by any individual with root or administrative privileges Access to all audit trails Invalid logical access attempts Use of identification and authentication mechanisms Initialization of the audit logs Creation and deletion of system-level objects These must be logged ...


10

OSSEC is a great FOSS HIDS that works well to reduce the number of log events you need to check out to something potentially manageable. It supports all of the log sources you mentioned: http://www.ossec.net/main/supported-systems We built an in-house app that allows us to do a quick “daily check” of all the alerts OSSEC fires in a day; it typically ...


10

For tracking what is sent and received, you can use a packet sniffer. I use Wireshark (formerly Ethereal).


10

Simply put, the Integrity of the system is more valuable than its Availability. This rule ensures that the system is never running without logging, never running in an un-accountable state. It is preferable at certain high levels of security that the system stop running than the system run without provable security in place. The alternative would allow ...


10

I love to answer these questions, and I feel a bit excited/proud that you'd choose Security.StackExchange to ask this question. According to The Data Retention (EC Directive) Regulations of 2009, Internet Service Providers (ISP) are required to keep some data for 12 months. This includes which IP address people have been assigned, plus log-in and log-off ...


10

But if this happens my password would be stored in some unencrypted log somewhere, right along with my username. Is this a reasonable concern? Yes. Am I being too paranoid? It depends. If your worry is about the password being stored, then absolutely you're not. Your password will get stored in the clear to a near certainty. Being aware of ...


9

Here are a few different features you should consider, note that you might not need all of these, and one might not be better than the other - but they are points to consider: Coverage: Windows Event Log on servers, all current versions Windows Event Log on clients, all versions in your org (you'd be surprised how many Win98s there still are...) syslog on ...



Only top voted, non community-wiki answers of a minimum length are eligible