Tag Info

New answers tagged

0

Indeed the title of the article you linked to is misleading/confusing. Storing passwords in plain text is a very bad thing to do, yes; but storing them hashed in a DB is not a problem because, by principle, hashing functions are a one way process. It is better to deal with forgotten passwords as StackExchange websites do because: Hashed passwords are ...


3

As the linked article states, you should hash the password, and then store that in the database. bcrypt is the current standard recommendation in terms of password hashing, and has easily-used implementations in many languages. The intent behind "never store passwords in the database" is not "store it outside of the database"; the intent is "never store ...


0

Off the top of my head, one obvious reason is that it forces the scanner to take longer to determine whether a service is present on a given port or not. It doesn't know whether packets were dropped on the path, or the path to the server it's accessing just has a long RTT, or there's a default DROP firewall policy. And anything that slows down attackers, and ...


0

You understand the situation correctly; there is minimal benefit in dropping traffic to closed ports. However, it is still considered "best practice". I think the reason ShieldsUP would report this is that is could indicate a configuration error. If a firewall admin intends to block all the closed ports, and misses one for some reason, this is something ...


0

I would put it down to defence in depth. Yes, you could configure your services to listen to only localhost or your internal network. Even when properly configured, there is still a possibility that due to a bug in the code, it mistakenly accepts all traffic. Services which accept UDP packets may also be vulnerable to an IP spoofing attack. TCP is resistant ...


0

There's a couple of different spins that can be put on your question, but I'm going to address Is it better to DROP for non-allowed ports than to REJECT? Dropping packets - silently, no TCP RST or ICMP Prohibited - is preferable for at least two reasons. It slows down scanners that are trying to hit a large number of your ports, because they don't get ...


2

Employing a default DROP rule for all ports except the ones originally intended(for a website these are 80/443) reduces the attack surface of the given stations on the network. It's much more convenient(and cheaper) to drop packets instead of configuring a service so that it is secure with regards to a given policy.


9

There are security risk frameworks (STRIDE, DREAD and others) that you can apply to get a systematic approach to assessing risks and threats. TFS is a Microsoft solution that implements a sort of Git (from my experience, I don’t believe it’s a pure Git integration, but I may be wrong). They do offer valuable resources for security, so that’s worth checking ...


0

I'm assuming that because these spammers have my URL, they will keep hitting my site no matter what server I'm on, correct? That's correct. Those 60 visits a day should really not be a problem, either your page are doing some insanely heavy operations on each pageload or your host is trash. What steps should I take to prevent these unwanted ...


0

As far as DDoS mitigation goes, simply changing your domain name isn't going to help. It's kind of like playing a shell game, "whoops I moved here", and it won't take long for the bots to again hone in upon your new hosting provider. Essentially any open port on any public IP will be receive bot/scan traffic, so a security-through-obscurity solution is ...


1

Ok, in case of a VPS the ENTIRE server can be compromised, as one can clone and dump the state of the machine any time she wants. Even if you were to use encryption on disks, the keys would be in the memory and easy to retrieve. You could write your own patches to the system, but this would be StO. If, however you owned the box, and just co-located it, you ...


0

There are variety of attacks can be performed in the servers. So this is too broad to answer here. You can try out Xss,SQL injection etc.. For attacking you can go through OWASP Top 10 vulnerabilities that are still causing a huge damage to servers.


0

This question is really to broad to be answered. I will still make an attempt to answer it with a broad answer. If the hosting company is malicious, you can consider your system compromised. Having access to the physical server is considered having the control over the machine. As per the possible attacks, it is too vaste to be put here.


1

Full disclosure, I work for a DDoS mitigation company protects companies against DDoS attacks. A few ways you can dodge DDoSers can be through blocking the attackers by IP or country. Blocking by IP will block access from those specific attackers, so long as they're trying to access your site via that IP, they will be blocked. Blocking by country can also ...


0

KVM over IP is simply access to physical computer console (screen, keyboard, mouse, USB etc.). iLO is a kind of remote control interface, using which administrator can control the server below the operating system layer, and even below the physical console, BIOS/UEFI etc. If you give iLO access to someone, that person will have the complete control over ...


0

Working it out in the comments with @JulianKnight, we decided that invalidation and updating would be the best way to go about accomplishing this. To be more specific; the server invalidates the client frequently (but not enough to cause stress on the host machine), and the client must update itself each time it is invalidated in order to get a new md5sum ...


1

IF what you ask was possible, THEN there would be no software or video piracy whatsoever. You could have some playing software that simply plays the movie but refuses to dump the data in a file, and that playing software would "prove" its unmodified status to the server, thus allowing the download. This tells us that what you seek must be hard and would be ...


2

When I hear this question, my first response is don't. If you are at all concerned about your personal network and your personal data, don't expose any part of it directly to the internet by hosting services. If you feel you must, here are some steps: Host the website on an entirely separate machine with nothing else on it Put that machine on a DMZ (most ...



Top 50 recent answers are included