Tag Info

New answers tagged

0

The question itself relies on an invalid assumption - that "the attacker can't do a 0-day attack". The very nature of zero-day vulnerabilities is that nobody knows what they are except for the attacker. Therefore, defenders have had "zero days" to develop patches or apply configuration changes necessary to resist them. If you don't know about a ...


0

I wouldn't consider this a major security issue as the values are limited to only your system's access to the third party sites. It is less desirable, but the values can be easily invalidated without any bleeding in to other systems that access the same services. It certainly doesn't hurt, and is even wise, to encrypt it, but you would have to encrypt it ...


2

From your question and comments it seems that the business leadership of your company have no interest in security. This is the fundamental thing you're going to have to fix before you do anything else. Implementing security controls is inevitably going to a) cost some money and b) cause some pain. Without support from your leadership, you won't get over ...


10

You could try Cryptographic Obfuscation when it exists Cryptographic Obfuscation is were, in certain senses, you make a programs source code unreadable. What you can then do is hardcode a cyrptographic key into the program. You would also want the server to supply a random seed to your program since the computer could not be trusted. The only problem with ...


19

It is fundamentally impossible to validate that an unmodified version of your client connects to your server. ... unless you do what is necessary to ensure it. This means client-side tamper-resistant hardware. When your code runs on the client's computer, the computer owner can run a debugger and modify the client code at any point with arbitrary values. ...


37

It is fundamentally impossible to validate a client on a system you don't control. That doesn't mean it can't be done to a sufficient degree. eBook readers, for example, generally try to ensure the client is authentic. They (seem to) do so in a manner that is secure enough to defend against their threat. Good enough to protect nuclear secrets? No. But ...


5

I too have approached an issue such as this with the company I work for. after weeks of working it out, the answer is its not really possible. And here is why: You're basically encountering a "Trusted Client" problem. The client code runs on the user's PC, and the user has full control over the PC its originating from. The user can change the bytes of the ...


0

This is most likely a botnet trying the "doors" as Bob has suggested. From time-to-time, vulnerabilities appear in standard software that allows attackers access via supposedly innocuous entry points. If you don't already have it installed, I would recommend something like fail2ban which will automatically ban source IP's that make attempts to get to ...


2

If any of the pages you've archived on your server contain malicious code targeting webkit vulnerabilities (remember, wkhtmltopdf runs on webkit), it's theoretically possible this will result in a security breach on your server upon running the page through wkhtmltopdf. The implication here being that malicious code that would normally target your users' ...



Top 50 recent answers are included