New answers tagged threat-mitigation
Rouge Key Identifiers would hinder unambiguous path finding. In the worst case several potential paths have to be checked for validity. But would you have a certificate with a rouge identifier in your trust store anyway? If you don’t trust it, no need to check that path. And if you do trust it, then that path would not validate.
Unfortunately, what is commonly done is simply to share account credentials. When possible, it is advised to have a super admin account with a manager who is not responsible for using the service directly (separation of duties) so that the active admins can come and go while management of the admins is done through a separate account. When not possible, a ...
Do nothing, it's probably a bot sending you that email anyway. They don't know your IP address and won't find out if you don't reply either. Even if they do, you might notice your connection starts lagging out. In that case, simply inform your ISP and request a new IP address, problem solved.
Pay and we will know its you. This is the thing: an empty threat looking exactly like what you have there has been going around, which always has the same bitcoin address in it. In other words: they can't know it's you if you pay, and therefore the threat must be a bluff. Still, hundreds of thousands of dollars have reportedly been sent to that address, ...
To be doubly safe, backup anything to off the network that matters. Better to be overly paranoid than to lose it. Apart from that, yeah it's just junk. They're preying on the known fear of actual ransomware (which has recently been getting a lot of media coverage) to make a quick buck.
Seems like a bluff for all the reasons given in other answers. If they're planning to DDoS you with sheer bandwidth then they aren't just DDoSing you, they'd be attacking the network connection of your VPS. Therefore, even though this attack seems unlikely, it's probably best to inform your VPS vendor that the threat has occurred. They might tell you to ...
This threatening email seems to be just that: a threat. You don't have to tolerate it, whatever they will do, this is plain extortion. Report it to: your hosting company, by sending them an original copy of the threatening E-mail (with all headers in their original form. Transfer as an attachment within any professional E-mail client), your national ...
Tell them that you don't negotiate with terrorists and sign up to Cloudflare. Then hope they are just script kiddies. You should inform your ISP so they can monitor it if you think it's a credible threat.
If you are in the UK please do this: Message sent by Action Fraud (Action Fraud, Administrator, National) Within the past 24 hours a number of businesses throughout the UK have received extortion demands from a group calling themselves ‘Lizard Squad’. Method of Attack: The group have sent emails demanding payment of 5 Bitcoins, to be paid by a certain ...
Ignore it. Cloudflare themselves have stated that these are fake - see https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/ I highly recommend that you read this article, as it is a very clear explanation from the front line. The armada collective is a real DDOS group, but some con artists are just using their name to try to scare ...
Based on the following article you may simply want to ignore it. Seems to be a common scam and your e-mail looks almost exactly like the one in this article. http://arstechnica.com/security/2016/04/businesses-pay-100000-to-ddos-extortionists-who-never-ddos-anyone/ Look up the source ISP of the service provider that sent the e-mail and contact their abuse ...
This article might be important for you: https://ca.news.yahoo.com/armada-collective-ddos-threats-were-212413418.html Someone has been copying the Armada Collective's email content to scare people into paying, but no attacks have been recorded. So, possibly, you don't have to do anything.
I would highly recommend Microsofts approach with the Threat Modeling Tool (https://www.microsoft.com/en-us/download/details.aspx?id=49168) it comes with some instructions and guidelines. Also consider playing some elevation of privilege (https://www.microsoft.com/en-us/SDL/adopt/eop.aspx) that gives some good insights into threat modeling. To get/make an ...
Top 50 recent answers are included