Tag Info

New answers tagged

-4

Everything will be vulnerable since you are plugged to the network. But a good password with some characters will slow down the ways of brute force methods for braking into your security.


8

Other answers have been given to answer whether routers are secure: your router likely has unpatched vulnerabilities. A recommendation for making things more secure would be to put a real Linux box in front of your router. Configure it for automatic security updates every 10-30 minutes so your patches come quickly. For kernel vulnerabilities, you could use ...


14

TL:DR - Yes, routers CAN be vulnerable. Misconfigured/Unconfigured routers - A ton of people just install their routers and leave the default accounts turned on without modification. Thus allowing attackers easy access. Vulnerable built in scripts - http://www.reddit.com/r/netsec/comments/1xy9k6/that_new_linksys_worm/ See: What is the ...


6

A router is actually a small computer; most of them use the same kind of software as full-fledged servers (typically some Linux variant). As such, it has security holes, that should be patched promptly when discovered. Vulnerabilities that are not fixed might be exploitable and yield remote control to attackers, at which point they can do what they want with ...


3

SSL certificates provide two things: Authentication of the organization to whom the visitor is connecting (the organization is verified to be www.foobar.com) Confidentiality of the communication (data is encrypted using the public keys in the certificate) Concerning point 2, there's no difference in using a self-signed cert, a certificate issued from a ...


-2

No, it is even less safe. If you have no knowledge of security or of certificates you should not roll your own. (luckily its not as bad as running your own CA without knowledge) CACert helps you to get the proper values in your certificates so your safe from misuse. the web of trust also means the CAcert will be on par with a face 2 face audit form a ...


0

According this explanation, it seems it might have to do with what your url looks like. From the text: Web servers receive requests that are URL encoded. This means that certain characters may be replaced with a percent sign (%) followed by a particular number. For example, %20 corresponds to a space, so a request for ...


6

No, having keys for your root user does not impact your security profile. It is wise though to disable root login in ssh and NOT have an authorized_keys in your /root/.ssh/ folder. However. I got the feeling your going about this the wrong way. Personally, I would not use the root user in this manner (but a system user like www-data) and make several ...


0

To what extent a hacker can potentially cause harm to a server? Can you please give few examples? A few examples are XSS and data ex-filtration. For more information on the XSS scripting exploit, please review: http://niiconsulting.com/checkmate/2013/05/memcache-exploit/ For more information on the data ex-filtration, please review: ...


0

First thing that comes to mind is Script injection (for Cross-site scripting(XSS) or phishing purposes) Secondly all 'private' cached data is readable to the world. (this could mean e-mails / passwords / keys / etc... were / are accessible for anyone who wants them.)


1

This is an attempt to exploit CVE-2014-6271 (the “shellshock” vulnerability, if we must). Its appearance in this message is no indication that it was successful; any client can include any string in the Referer: header and have it included in logs here. The attempt didn't succeeded in this specific case, because the log message is telling you there was no ...


1

So it looks like someone is trying to use the shellshock vulnerability which was recently discovered in the bash shell. The key give-away is the part of the log which reads: referer: () { :;}; /bin/bash What the attacker (or unknowing participant) has done is to set their web browser's http referer header to everything you see after the word "referer" in ...


1

While Linux has a file security model similar to that of early Unix, I think there has been a change in how the computers are used. In the 70's and 80's, Unix was run on large computers hosting many concurrent users. For example, a single computer could be used by all students in a computer science program. With that type of usage, protecting machine ...


0

Based on your comments it sounds like S is passing some encrypted or signed access token to P that it passes to H. H can decrypt or verify the token is authentic and use the information contained within to determine of P is allowed to perform the app. That sounds great. I'm not sure that you need a nonce here if all you are trying to do is prevent replay. ...


6

Yes, this is rogue. This script will execute any PHP code passed as plm12345plm POST parameter. This means, an attacker can execute arbitrary PHP and -- depending on the server configuration -- further code on your server. The first GIF89a line is likely placed to bypass basic file verification during upload of the script as a GIF image. If the file could ...


4

Yes, this is a PHP web shell. Eval should be the red flag. Basically, if the user can access this file on your server, they may be able to execute OS commands. If you have properly implemented your site, the attacker should not be able to trick PHP into executing the code in what I am assuming is a .GIF file. However, if I were you I would batten down ...


1

It is really important that you provide viable alternative solutions and not just rely on arguments that it is a bad technical solution. For example, could using a VPN setup be a better choice rather than re-developing the code to use a non-privileged user? Can you generalise the solution? For example, would a VPN solution provide increased and more secure ...


2

With enough traffic from your internal users, an attacker could map the internal networks of an organization. There might be very low value in this data, however, if DHCP expires IPs quickly, or if the internal network is predictable (or uninteresting) on its own. It would also require a lot of traffic from the network's users to be helpful.



Top 50 recent answers are included