Hot answers tagged

25

You don't need DNS names to be detectable. The entire IPv4 can be scanned in less than a day. And it has been done. And it is still going on. Therefore you must assume, that your IP address has been discovered. You can download all the certificates for all the IPv4's port 443 from Rapid7's Sonar project. -> Make this a nice demo. Download the ...


19

This might make very casual surfers move on, but anyone running any sort of scan on your server will discover the OS, web server version and running software. For example the nmap http-enum NSE script should detect that Outlook Web Access is running should anyone care to run it against your server. Yes, by all means replace the home page with something ...


7

I agree with you that security by obscurity should never be the primary defense, but I also agree that you should never make it easy for an attacker to detect the services you are running. An attacker would probably first try to figure out the version of your web server by banner grabbing. So you should make sure that IIS is not giving away such information ...


5

Yes. A Harris Stingray, Boeing DRT box, or other cell simulator can intercept SMS messages. These are monitoring devices that have secretly been used by police agencies for over a decade. They come with strict non-disclosure agreements where the agencies that purchase them are not even allowed to acknowledge their existence to the public, and certainly ...


5

SQRL certainly is not without flaws, but it's certainly superior to the primary authentication solutions widely used on the web today in terms of security and (and this is important) usability. Allow me to explain. Misconceptions First, let me clear up a few of the misconceptions present in some of the other answers on this question. Many of these answers ...


5

Is it possible for breaching google chrome and take my credit card information? Yes. As long as Chrome can use your number for auto completion, it has to be possible for Chrome to access it. If one program on your computer can do this, another program or a least humans can do it too. it's not stored with any type of encryption Even with ...


4

Option 1 From the basic understanding of the DDOS attacks is that the attacker is sending a lot of data to the web server. Not in every case, the slowloris and SYN flood attacks do not send tons of data yet they are classified as DDoS. Each host attacking the target sends just a little information, enough to clog the victim's network and prevent ...


4

From this support thread on the LastPass website: LastPass says they never receive my Master Password. Don’t I send it to the LastPass servers when I log in? No, when you login to LastPass, two things are generated from your Master Password using our code discussed previously before anything is sent to the server: the password hash and the ...


4

Most modern databases store metadata in regular tables (Information Schema) so if there is an SQL injection the attacker will eventually find out every necessary information for exploitation, including your naming schemes. In case of Wordpress and other popular software custom settings may help dodge some automated attacks, as primitive exploits may assume ...


3

For such a beginner and general subject (no offense! everybody has to begin somewhere!) such as iptables, any Linux distribution would be fine. Choose one with which you feel comfortable, does not cause incompatibilities with your hardware and provide a large choice of packages so you will not be limited when having to install new software. DistroWatch is a ...


3

I've never used much Ubuntu and never used BackTrack. But Kali is supposedly an improved distribution of BackTrack since it was (and is) developed by the same developers. (and BackTrack is no longer being maintained) And besides that Kali already comes with a lot of tools to test security, make penetration tests, and it comes with iptables also, so you can ...


3

Security is necessary in order to counteract "risks" to a system. You need to determine what those risks are and if "loss" in that area is acceptable. Presumably, this train set up is not public, but in a locked building where people need a key to enter, or if allowed in, are monitored by other people watching. Yes, it is possible for someone to come in ...


2

1) Yes, it is possible to breach Google Chrome. Even with the encryption, there would be somewhere password or private key. 2) It is not secure as not using autofill, however, you do not type in the autofill your CVV code, which is needed for a successful operation with the card. You can find more about CVV here: https://www.cvvnumber.com/


2

A common phishing website looks extremely similar to the website it is trying to impersonate, but is still a different website. One could develop a tool which examines any websites the user visits and alerts them when they look exactly identical to one of the websites is set $S$. Unfortunately there is a problem with this: A phishing website only needs to ...


2

It is improbable that a basic laser pointer will "burn out the CMOS" -- the power conveyed by a laser pointer, even though concentrated on a small surface, is small when compared to that would be achieved by pointing the camera towards the Sun, and I expect the camera to resist such occasional pointing. Unless, of course, you have decided not to stop at ...


2

As the very good posts above have mentioned, there is no perfect fit for 'the right distribution' to learn Linux. The good thing though, is all of them will be very helpful in learning Linux given their common foundation. The reason nobody is willing to recommend a flavor of Linux is not because we all do not have preferences, but rather because the ...


2

Really, the question you are linking to answers your question. These are very brief explanations of why these options wouldn't work. For more detail see the question linked to in your question. Option 1: Even that server has a limit to the number of users it can handle. A DDOS would have to reach that limit to be effective. Option 2: If the entire botnet ...


2

At least your server wouldn't show up in a simple evil crawler that looks just for these welcome pages. Or if you mask yourself as an Apache, following automatic attacks would hopefully fail. So for a dedicated attack on your server, this makes it maybe just a tiny bit harder. But for automatic attacks this can make the difference.


1

The digital world offers many things that don't apply in the physical world in most cases which make it more likely that a criminal will both (a) target you and (b) succeed: A high degree of anonymity Difficulty of law enforcement to catch you Ambiguity of the law surrounding your actions Nearly unlimited ability to try, with very little chance of being ...


1

It might be worth checking out Public and Private key Cryptography(asymmetric). I speculate, they could use asymmetric cryptography. When a you register a new device, create a keypair on said device send the public key to the old device, encrypt the original private key with the public key of the new device, send it to their servers and then to your new ...


1

At the very core, a denial of service (DoS) means using a service in such a way that disrupts other users use of the service. If a user that is uploading a big file causes the server to exhaust some resources and end up rejecting requests from other users, that's a DoS. A DoS does not require intent of malice. Any service disruptions counts as denial of ...


1

In general, any computer that has the capability to go online needs to be secured. This includes not only "laptops" and other things people consider to be computers, but thermostats, sprinkler controls, and any other programmable device. The problem may or may not be what the attacker can do to you, but also what the attacker can use your computer to do to ...



Only top voted, non community-wiki answers of a minimum length are eligible