Hot answers tagged

79

Imagine a shopping mall. By definition, anybody can enter the mall and then browse the shops. It is public. The shops are expecting people to come by, look at the displays, maybe enter and then buy things. In the mall, there is a shopkeeper, who sells, say, computers. Let's call him Jim. He wants people to come by and see the computers and be enticed into ...


74

"No perfect defense is fundamentally possible." In chess, you have 64 squares, 2 people playing, and one set of immutable, commonly known rules. In server infrastructures, there are an untold number of assets and ways to approach those assets, an unknown number of people playing, and rules that change constantly with players purposely seeking to bend, ...


73

Physical access, in many, likely most, situations means a total loss of security - for a variety of reasons (this all assumes encrypted disks): Theft - An attacker could steal the server or disks, to attack at their pace. This allows an attacker to take their time, and you have no idea if they've actually gained access to data. Physical Modification - If I ...


45

When you host your data on other people's servers, then these people have full access to it. With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic. You could ...


37

It is fundamentally impossible to validate a client on a system you don't control. That doesn't mean it can't be done to a sufficient degree. eBook readers, for example, generally try to ensure the client is authentic. They (seem to) do so in a manner that is secure enough to defend against their threat. Good enough to protect nuclear secrets? No. But ...


32

You can use Match in sshd_config to select individual users to alter the PasswordAuthentication directive for. Enter these Match rules at the bottom of sshd_config file ( generally /etc/ssh/sshd_config ) Match User root,foo,bar PasswordAuthentication no Match User Rishee PasswordAuthentication yes This would give root, foo and bar key ...


32

Physical access is total access. Kinda. Give me physical access to a server with an encrypted disk and the first thing I'd do is plug a key logger into the keyboard to take care of that pesky encryption. Show up at my door with an encrypted hard drive and I'll format it and dump movies on it. Encryption is most commonly defeated not by breaking it but ...


28

Security can be proven, but you have to understand what is proved https://sel4.systems/FAQ/proof.pml Our proof statement in high-level natural language is the following: The binary code of the seL4 microkernel correctly implements the behaviour described in its abstract specification and nothing more. Furthermore, the specification and the seL4 ...


25

It's a lot of work. Not only that, but it's a lot of work that your (legitimate) users will never see or benefit from. Most people would be willing to trade off the nebulous risk of deterring a small subset of hackers (realize that APT hackers, in particular, wouldn't be dissuaded and might even find an extra way into your system if you do something wrong ...


23

Note: I like honeypots a lot but to answer your question some negative aspects include: You are not reducing your workload. You are increasing the amount of signals you have to process. You are increasing your operating costs. You are taking time away from other security activities which may otherwise help protect actual data & services. You may be ...


21

With recent Fedora and RHEL 6 releases, you can use RequiredAuthentications2 pubkey,password to require both pubkey and password authentication. Usually this is done to require pubkey and 2-factor authentication token, not the user's password. Update: Now on RHEL / CentOS 7, and any system with a recent version of OpenSSH, you can use: ...


21

There are a number of defenses you can use to help prevent and recover from theft. The first thing you should look into is full-disk encryption, e.g. LUKS, TrueCrypt, or PGP. This will prevent an attacker from reading any data on the disk, even if they steal the hardware. You will need to enter the password at boot, though, so for unattended remote hardware ...


19

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult. Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...


19

Despite what others are saying, yes you can. Many major corporates have very effective solutions, and even the recent Spamhaus battle, which used DNS DDoS at a scale that hasn't been seen previously was covered rapidly once CloudFlare were brought on board. The solutions I have tested are very effective at transferring DDoS traffic, even when it is a ...


19

It is fundamentally impossible to validate that an unmodified version of your client connects to your server. ... unless you do what is necessary to ensure it. This means client-side tamper-resistant hardware. When your code runs on the client's computer, the computer owner can run a debugger and modify the client code at any point with arbitrary values. ...


18

Giving non-obvious names to things is akin to security through obscurity which is usually frowned upon in these parts. Problem with that kind of security is not that it does not work; indeed, it has some value, which was demonstrated many times through History (e.g. that's why a tank is called "tank" and not "armored chariot"). But you cannot quantify ...


18

Nobody has found any particular reason to believe they have found such a system. You mention Chess, which is a nice game on a 8x8 grid. Consider that a modern server is slightly more complicated than that. Let's instead play in a 65536x65536 board, to make it more realistic. Also, in Chess, the more you play, the fewer positions are possible. Instead, a ...


17

Your forum accepts posts from anybody. That is your core problem. Connecting to your site from various IP throughout the world is trivial, if only by using Tor. Tor provides "high anonymity" in that not only the user's identity is hidden, but each request is anonymous -- you cannot, from the outside, make sure whether two distinct requests are from the same ...


17

No, it is not possible, in theory or practice. A well enough distributed DDoS attack is indistinguishable from legitimate traffic. Consider the "slashdot" or "reddit" or "digg" effects, where actual legitimate traffic takes down network services on the target website. Simply posting a link to the target website on slashdot is an effective DDoS in many ...


15

There are 13 root name server addresses, each corresponding to a separate root name server system. The name server systems are not single machines - rather a collection of physical servers connected together as a distributed system. Each collection of servers is geographically distributed (a technique known as multihoming) such that a natural disaster is ...


15

It is a myth. It used to be 13 servers yeah, and quite some years ago a hacker group almost succeeded in taking down all 13 of them. In the end, a few of the root DNS servers survived and the Internet was saved. Since then, the addresses have been changed from unicast to anycast and instead of 13 servers there are now 100s. Read more at ...


14

Standards are general and consist of high level principles. Guides focus on practical security. Checklists are the most detailed documents. There are multiple agencies that produce security standards. One of the most widely used security standards today is ISO/IEC 27002 which started in 1995. This standard consists of three basic parts, BS 7799 part 1, ...


13

Not in any meaningful way: the only thing this might prevent is a malicious, physical attacker rebooting the computer from a liveUSB/liveCD (and thus gaining offline accesss to your data). If you want to protect sensitive data, you need to set up some sort of disk encryption (so that the data is only accessible when your system is running); note that this ...


13

The most common thing protected by the BIOS administrator-level password is the boot process. Someone with admin-level access to the BIOS (either by it being unprotected, or via password compromise) can set the computer to boot from whatever media he likes. This will allow an attacker to bypass access restrictions you have in place on any non-encrypted data ...


13

Most things of importance placed in a data center have a sister installation in a physically separate data center, and if there was a reason to "fail over" from the live to the backup site, it's completely plausible that things like data shipping will occur as part of it. It also will result in a flurry of manual and semi-automatic administrative activity, ...


12

You can have both public-key and password authentication on the same server. If public-key authentication fails, it will go to password authentication. As to requiring both, that's seems silly and counterproductive, and checking man sshd_config there isn't an option to do this. Your ssh private key should have a secure passphrase. So if an attacker ...


12

Your server has been infected with a virus. Stop trying to hunt down the problem and just nuke it from orbit. Do a full reinstall of your system and restore from a known safe backup point.


12

An attacker who can be physically present in front of the computer can also open the case with a screwdriver and have it his own way on the disk; or he can simply run off with the computer under his arm. No BIOS password will give you any protection against that. BIOS passwords offer any protection only against attackers who are assumed no to go physical at ...


11

From the access logs of a service (nginx, Dovecot, etc.), you cannot see whether you were affected or not. Unless you have previously captured all SSL traffic, you cannot see whether you got attacked in the past either. The pattern to match in a packet capture is very simple: A malicious Heartbeat request is sent. An overly long Heartbeat response is ...


11

You could try Cryptographic Obfuscation when it exists Cryptographic Obfuscation is were, in certain senses, you make a programs source code unreadable. What you can then do is hardcode a cyrptographic key into the program. You would also want the server to supply a random seed to your program since the computer could not be trusted. The only problem with ...



Only top voted, non community-wiki answers of a minimum length are eligible