Hot answers tagged

105

This article might be important for you: https://ca.news.yahoo.com/armada-collective-ddos-threats-were-212413418.html Someone has been copying the Armada Collective's email content to scare people into paying, but no attacks have been recorded. So, possibly, you don't have to do anything.


90

Based on the following article you may simply want to ignore it. Seems to be a common scam and your e-mail looks almost exactly like the one in this article. http://arstechnica.com/security/2016/04/businesses-pay-100000-to-ddos-extortionists-who-never-ddos-anyone/ Look up the source ISP of the service provider that sent the e-mail and contact their abuse ...


79

Imagine a shopping mall. By definition, anybody can enter the mall and then browse the shops. It is public. The shops are expecting people to come by, look at the displays, maybe enter and then buy things. In the mall, there is a shopkeeper, who sells, say, computers. Let's call him Jim. He wants people to come by and see the computers and be enticed into ...


52

(Note: This answer is from 2013. A lot has changed in Bluetooth since then, especially the sharp rise in BLE popularity, new attacks, deprecated features. Having that said, most of it is still applicable.) Introduction I'll try to the best of my knowledge to approach your questions without touching the technical parts of the Bluetooth technology itself. I'...


52

Actually most languages are "secure" with regard to buffer overflows. What it takes for a language to be "secure" in that respect is the conjunction of: strict types, systematic array bound checks, and automatic memory management (a "garbage collector"). See this answer for details. A few old languages are not "secure" in that sense, notably C (and C++), ...


52

The Ada language is designed to prevent common programming errors as much as possible and is used in critical systems where a system bug might have catastrophic consequences. A few examples where Ada goes beyond the typical built-in security provided by other modern languages: Integer range type allows specifying an allowed range for an integer. Any value ...


51

Ignore it. Cloudflare themselves have stated that these are fake - see https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/ I highly recommend that you read this article, as it is a very clear explanation from the front line. The armada collective is a real DDOS group, but some con artists are just using their name to try to scare ...


26

While browsing web pages, I can't seem to scroll down. My right hand was on my mouse, left eating food so I'm sure I'm not accidentally pressing any keys. I ran showkey and discovered that every now and then, I'd get spammed by keycode 104 events. 104 seems to be Pg Up. I try to log-in to Windows 8 and, when I enter my password, I seem to notice ...


24

This client behavior is prohibited by section 8.1 of the RFC: If an HTTP response is received over insecure transport, the UA MUST ignore any present STS header field(s). The spec prohibits severs from sending insecure HSTS directives and clients from processing insecure HSTS directives. This ensures that a faulty implementation in either a server or ...


21

In general: You need to trust the machine on which you are decrypting the files. This trust is usually only warranted if you have full control over this machine which also means that you can install software on it. So if you are really concerned about the contents of your files then use an offline encryption/decryption tool on a trusted machine and upload ...


19

The basics First, I assume you understand the most basic session ID security right: you are using an ID with sufficient entropy, and you use transport level security (HTTPS). Any approach to session ID (URL, cookies, whatever) that does not get those right is vulnerable, your question is specifically about ID in URL, so I will not discuss that further. ...


19

Despite what others are saying, yes you can. Many major corporates have very effective solutions, and even the recent Spamhaus battle, which used DNS DDoS at a scale that hasn't been seen previously was covered rapidly once CloudFlare were brought on board. The solutions I have tested are very effective at transferring DDoS traffic, even when it is a ...


17

No, it is not possible, in theory or practice. A well enough distributed DDoS attack is indistinguishable from legitimate traffic. Consider the "slashdot" or "reddit" or "digg" effects, where actual legitimate traffic takes down network services on the target website. Simply posting a link to the target website on slashdot is an effective DDoS in many cases....


17

If you are in the UK please do this: Message sent by Action Fraud (Action Fraud, Administrator, National) Within the past 24 hours a number of businesses throughout the UK have received extortion demands from a group calling themselves ‘Lizard Squad’. Method of Attack: The group have sent emails demanding payment of 5 Bitcoins, to be paid by a certain ...


15

A router misbehaving and trying to act as a fake server with regards to the client, and a fake client with regards to the true server, forwarding data in both directions, is the exact definition of a man-in-the-middle attack. Apart from routers (which act at the IP level), classic practical methods for MitM include: hijacking a HTTP proxy subverting the ...


14

You are right in asking the question. The situation as you describe it allows for both alternatives an attack and a hardware failure (i.e. keyboard failure). if you had some copies of /etc/shadow before the occurence and after you could see if the salted hash was different, which would have been a good indication that the password was indeed changed and ...


12

Short answer. The benefit is from an unpredictable serial number, not from any old serial number. Indeed, a sequential serial number adds no security, as it is easily predictable. But randomizing the serial number (so it is hard to predict) does make it harder to exploit the known collision attacks on MD5 to get a forged certificate. Let me explain. ...


12

There was a presentation at BlackHat yesterday where they used a Arduino to open hotel rooms that are using a certain kind of lock: http://www.h-online.com/security/news/item/Arduino-used-as-master-key-for-hotel-rooms-1652281.html As devices get smaller and more powerful, that are getting better suited to be used as pentesting drop boxes. Examples are: ...


12

Most programming languages higher level than C are much more secure when it comes to programming errors like Heartbleed's. Examples that primarily compile to machine code include D, Rust and Ada. It's not interesting to talk about just memory safety, in my opinion. Here is a list of additional programming language features that (I think) make it much harder ...


10

The Subject Key Identifier does not play a role in validation, at least not in the algorithm which makes up section 6 of RFC 5280. It is meant to be an help for path building, the activity which takes place before validation: this is when the entity who wants to validate a certificate assembles potential certificate chains that will then be processed through ...


9

Many phones allow you charge with only power and ground connected. Some phones (looking at you, Apple) use the data lines to determine whether or not the charger is "permitted" to charge your phone. Other phones still (some Android phones in particular) explicitly ask you to decide what to do with the USB connection -- e.g. charge only, or mount as usb drive,...


9

This answer may be incomplete or incorrect as my knowledge on the topic is limited, but my understanding of Bluetooth is that it is a fairly loose stack on which different protocols (called profiles) can be developed. A lot of the particulars of security are going to depend on the particular Bluetooth stack and profile that you have on your hardware. ...


9

Device security is limited to the type of device. What are the security risks of Bluetooth and what technologies and best practices should be used to protect my device? Each device provides a level of services. The services provided create the restrictions or limitations to access and exploit. The best protection is to keep Bluetooth turned off (if ...


8

After going through the code, I'm not sure that it is supposed to exploit or attack anything. It looks like its only purpose is to encode a payload using barcodes. It would be a nice way to import code into a system using a barcode reader when all other routes may be blocked. After you locate a vulnerability in a system, you can "upload" a payload using one ...


7

This is going to be an annoyingly trivial answer, BUT... The only way to perform a Response Splitting attack on an updated ASP.NET (or MVC) server, is if the application itself is writing back raw HTTP responses. Yes, of course no programmer in their right mind would do that... but in the case of the 60% of programmers that are not in their right mind, it ...


7

Well, you can scale infrastructure to make it more difficult for a botnet to keep up enough traffic to disable the service, but ultimately, the only counter if a DDoS is using otherwise legit traffic to cause issues, all you can do is increase your bandwidth to be higher than theirs. If you can identify a source as rogue, then you can try to block the ...


7

This is really a matter of each CA's policies. Most of them require proof of ownership of a domain before issuing a certificate. Even with cheap CAs this usually involves either verifying an e-mail can be received by a WHOIS contact or making entries in the DNS records for the domain.


7

Pay and we will know its you. This is the thing: an empty threat looking exactly like what you have there has been going around, which always has the same bitcoin address in it. In other words: they can't know it's you if you pay, and therefore the threat must be a bluff. Still, hundreds of thousands of dollars have reportedly been sent to that address, by ...


7

This is remarkably similar to attacks like SQLi, and the remediation is the same. Wherever you allow a barcode to be scanned as input, validate it in the scanner and only allow input that matches the requirements. If you expect a field of 20 digits, only allow 20 digits and strip off anything after 20. If you expect 8 alphanumerics, limit it to that. ...


6

As a rule, the returns on this type of defense are nearly zero. There are exceptions, but even then this technique may offer only a small amount of security. Exhaustive vulnerability scans of randomly-chosen hosts offer extremely low returns on scanning resources. Instead, successful attackers generally choose one of the following two options to increase ...



Only top voted, non community-wiki answers of a minimum length are eligible