New answers tagged

-1

I assume you're saying 1.1.1.1 is forwarding all requests to 2.2.2.2 in an attempt to keep the 2.2.2.2 server IP/location anonymous. Correct? In that case, the user would think they were communicating with 1.1.1.1. As long as you were only serving static html or documents that should be fine. The problem occurs when you throw something which does backend ...


4

It would be easy to sniff data using tools like WireShark from someone who can access the data path between your client and the server. This isn't something anyone on the Internet could do per se but if your device uses wireless and there are people nearby they could grab this data if they wanted it. As for finding your UDP service on-line that is easy to ...


0

Typically services are co-hosted based on levels of trust. Using the military as an example, this would be like hosting all "classified" services in the same environment and "top secret" services in a separate environment. If there's a vulnerable service in one area then only that area is immediately impacted. The idea is to mitigate vertical agility during ...


1

I think you could just use the security concept of least privilege to drive these concepts. For example, I would imagine you would not want your Sharepoint admins to have access to the DC's running on the same box. The other design problem for combining multiple services on a single host is if say an Exchange exploit takes the host down then you lose all of ...


1

In order to get information from most providers in China and Russia you need their equivalent of a subpoena. Both Russian and Chinese courts are not known to be very willing in giving these out to foreign governments or businesses.


0

Set the file permissions to 0440 that hold the credentials. Set the script doing the heavy lifting to 0741. Setup a non privileged user and group. The script doing the heavy lifting as a scheduled task will be executed as a root user just long enough to open and read the credential file before dropping privileges to the non-privileged account. While it ...


1

I use this nmap script, it's convenient and gives scores similar to Qualys SSL Labs: https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html


5

I see some sites have blocked there port 80 (or 443) to be accessed by IP. My guess is that you mean that access to http://hostname works while http://ip-adress/ does not work. At the TCP level the host is still accessed by IP address but the HTTP request looks different because the name given in the URL is contained in the HTTP request, e.g. GET ...


1

The best way to store passwords in a retrievable way would probably be to encrypt them with a symmetric cipher. Have the passwords stored on the device that intends to use them only in their encrypted form and then perhaps on startup of the service have the key to be used to decrypt the API passwords be derived through external methods (You yourself ...


0

Security of a database system, or any system for that matter, is about more than simply which type you use. Who has access, is remote access possible, can root login remotely, is there a web interface, and if so, is it secure against injection attacks? There's hundreds of factors. You could try asking a more specific question.



Top 50 recent answers are included