Tag Info

Hot answers tagged

38

Imagine a shopping mall. By definition, anybody can enter the mall and then browse the shops. It is public. The shops are expecting people to come by, look at the displays, maybe enter and then buy things. In the mall, there is a shopkeeper, who sells, say, computers. Let's call him Jim. He wants people to come by and see the computers and be enticed into ...


20

There are a number of defenses you can use to help prevent and recover from theft. The first thing you should look into is full-disk encryption, e.g. LUKS, TrueCrypt, or PGP. This will prevent an attacker from reading any data on the disk, even if they steal the hardware. You will need to enter the password at boot, though, so for unattended remote hardware ...


19

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult. Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...


17

Giving non-obvious names to things is akin to security through obscurity which is usually frowned upon in these parts. Problem with that kind of security is not that it does not work; indeed, it has some value, which was demonstrated many times through History (e.g. that's why a tank is called "tank" and not "armored chariot"). But you cannot quantify ...


15

No, it is not possible, in theory or practice. A well enough distributed DDoS attack is indistinguishable from legitimate traffic. Consider the "slashdot" or "reddit" or "digg" effects, where actual legitimate traffic takes down network services on the target website. Simply posting a link to the target website on slashdot is an effective DDoS in many ...


15

Your forum accepts posts from anybody. That is your core problem. Connecting to your site from various IP throughout the world is trivial, if only by using Tor. Tor provides "high anonymity" in that not only the user's identity is hidden, but each request is anonymous -- you cannot, from the outside, make sure whether two distinct requests are from the same ...


14

There are 13 root name server addresses, each corresponding to a separate root name server system. The name server systems are not single machines - rather a collection of physical servers connected together as a distributed system. Each collection of servers is geographically distributed (a technique known as multihoming) such that a natural disaster is ...


14

It is a myth. It used to be 13 servers yeah, and quite some years ago a hacker group almost succeeded in taking down all 13 of them. In the end, a few of the root DNS servers survived and the Internet was saved. Since then, the addresses have been changed from unicast to anycast and instead of 13 servers there are now 100s. Read more at ...


13

Despite what others are saying, yes you can. Many major corporates have very effective solutions, and even the recent Spamhaus battle, which used DNS DDoS at a scale that hasn't been seen previously was covered rapidly once CloudFlare were brought on board. The solutions I have tested are very effective at transferring DDoS traffic, even when it is a ...


13

Standards are general and consist of high level principles. Guides focus on practical security. Checklists are the most detailed documents. There are multiple agencies that produce security standards. One of the most widely used security standards today is ISO/IEC 27002 which started in 1995. This standard consists of three basic parts, BS 7799 part 1, ...


13

Not in any meaningful way: the only thing this might prevent is a malicious, physical attacker rebooting the computer from a liveUSB/liveCD (and thus gaining offline accesss to your data). If you want to protect sensitive data, you need to set up some sort of disk encryption (so that the data is only accessible when your system is running); note that this ...


12

Your server has been infected with a virus. Stop trying to hunt down the problem and just nuke it from orbit. Do a full reinstall of your system and restore from a known safe backup point.


12

The most common thing protected by the BIOS administrator-level password is the boot process. Someone with admin-level access to the BIOS (either by it being unprotected, or via password compromise) can set the computer to boot from whatever media he likes. This will allow an attacker to bypass access restrictions you have in place on any non-encrypted data ...


11

You can use match in sshd_config to select individual users to alter the PasswordAuthentication directive for. Match User root,foo,bar PasswordAuthentication no Match User Rishee PasswordAuthentication yes This would give root, foo and bar key authentication, and Rishee password authentication. An alternative is to match by negation, like this: ...


11

An attacker who can be physically present in front of the computer can also open the case with a screwdriver and have it his own way on the disk; or he can simply run off with the computer under his arm. No BIOS password will give you any protection against that. BIOS passwords offer any protection only against attackers who are assumed no to go physical at ...


11

From the access logs of a service (nginx, Dovecot, etc.), you cannot see whether you were affected or not. Unless you have previously captured all SSL traffic, you cannot see whether you got attacked in the past either. The pattern to match in a packet capture is very simple: A malicious Heartbeat request is sent. An overly long Heartbeat response is ...


10

You can have both public-key and password authentication on the same server. If public-key authentication fails, it will go to password authentication. As to requiring both, that's seems silly and counterproductive, and checking man sshd_config there isn't an option to do this. Your ssh private key should have a secure passphrase. So if an attacker ...


10

A firewall allows you to limit access to ports you specify, and you can specify sources as well. For example, you can prevent non-root users from creating services that accept connections, so an attacker can't create a new shell backdoor. You can even limit outbound connections to reduce the possibility of reverse shells. A not uncommon practice is to ...


9

Pascal's blog entry shows a few weaknesses, some of which being recalled in ownCloud's advisory, but they did not recall the worst. The storage of encryption keys as files in /tmp is already pretty bad, especially since /tmp is a true disk-based directory in many Linux and *BSD operating system (I usually configure my /tmp to be a memory-based filesystem, ...


9

There's no way to be certain that someone with physical access to your server can't get at your data. But you can take certain precautions: First of all, if the attacker gets access to your server while it's in its "running" state, so either through the console, through remote desktop, SSH, etc., then there's not a lot you can do. You're relying on your OS ...


8

Java is fine for servers. The security issues with Java are actually issues with the Java applet model, in which your JVM (in your browser) is meant to run potentially hostile code (i.e. code "from the Web") and yet somehow prevent that hostile code from doing bad thing. The applet model is a bit like running the applet code in a virtual machine, except that ...


7

Well, you can scale infrastructure to make it more difficult for a botnet to keep up enough traffic to disable the service, but ultimately, the only counter if a DDoS is using otherwise legit traffic to cause issues, all you can do is increase your bandwidth to be higher than theirs. If you can identify a source as rogue, then you can try to block the ...


7

This would be a prime example of Security Through Obscurity. While this does provide some security value, the gain is generally very minimal and it should never be relied upon as an ultimate defense. As with any security measure, how to balance security and usability here is one which your organization needs to decide. If you can come up with a convenient ...


7

Going by your threat model which is theft of the server, I would choose to go with full disk encryption in the form of LUKS or similar. For that threat model though, encryption shouldn't be your focus. Instead, make sure your datacentre has appropriate physical security in the form of access control, surveillance and the likes.


7

There are many other methods (of course) to attack web servers, but lets limit ourselves to the method you're interested in - getting some file onto the server, and making the server execute it. The major access control that prevents total destruction of web servers is file permissions, and an important secondary control is media-type instructions on the web ...


7

Netcat does not appear to have much bugs such as buffer overflows. Apparently it had one such bug, but a very minor one: if you invoked it as a client with a port number beyond 999999 (which makes no sense, since valid port numbers are in the 0..65535 range), then you could get a buffer overflow leading to a crash; bug report is there. However, there is ...


6

You don't. If a device is in your physical possession, then you can have unlimited access to it. If it is someone else's physical possession, then they have unlimited access to it. If you want to protect yourself from them, then don't let them have your server.


6

In a fight between a polar bear and a white shark, who will win ? Guess what, if this is a pool fight, the shark will munch through the bear in less than two minutes (this site makes unsubstantiated claims to the contrary, but there are strong clues that a shark eating a polar bear really happened). Now put them both on a land, and I will put my money on the ...


6

This could be bad if one machine was compromised and the attacker was able to steal the key. They would then be able to impersonate any of the other machines without tipping off the users with a host key change warning when they next attempted to log into the malicious host. If there are other security mechanisms in place on the network then this threat ...



Only top voted, non community-wiki answers of a minimum length are eligible