Tag Info

New answers tagged

0

According to the latest report the Vulnerability is in ZynOS and is trouble for the users of the router from the D-Link, TP-Link, ZTE and other manufacturers which allow remote hackers in changing the DNS settings and hijacks the user traffic. This vulnerability has a "backdoor-type" function "built" into the router suggests a deliberate implementation. ...


0

What you might want to have is a passwordless access to the ssh service. This will stop brute force attempts on the ssh service. Of course if your machine is compromised to begin with, then you'll need a larger proverbial boat.


1

This is mainly an addition to armani's answer. As Win98 has not been maintained for years, you cannot expect the OS TCP/IP stack to be exempt of bugs. But you certainly can find a recent (decent) OS accepting to run on an old computer. NanoBSD for example declares that it can be customized to low requirements : it is possible to cut the system down, so it ...


2

This is simply a bad idea unless you just want to try it for fun. Anyone who suggests it could be done is making too many assumptions. There isn't enough information to make a call. Probably the main issues include Win98 is old, is no longer patched and is likely vulnerable to many existing penetration techniques which were not even thought of back ...


2

Get rid of that old box! It's too much hassle. Buy a Raspberry Pi B+. It's fast for your needs, cheap to buy, and within five to ten months it will earn the investment back by saving electricity. That old box maybe uses up to $10 a month for electricity, the RPi maybe $1.


1

Considering that a modern computer (or even a smartphone) can compute circles around a 15 year old laptop one would need to ask "why?", esp. as the old hardware is expected to fail more-or-less anytime. If this is a "because I can" project, then have at it and good luck. If you simply want your own webserver, it is very easy to set one up on your current ...


13

Do you have experience with CLI (command line interface), like Windows command prompt? If so, why not get a Raspberry Pi? The Pi is going to be smaller, faster, and more efficient than your old laptop. You can get a Pi for ~$50. Then you download (or get pre-installed SD card with ) their NOOBS software and install Raspbian OS, which is a Debian fork, ...


8

I also am questioning how this machine can run Win98 (which wasn't exactly an efficient OS in its day), but it cannot run Linux. How about taking a Linux Live CD (bootable "frozen" OS), editing the ISO to include the web pages you want to serve, removing local storage (pull out the hard drive), then boot off of the Linux Live CD and reboot daily? Even if ...


1

How about KolibriOS and write your own web-server? Or Tinfoil Hat Linux and maintain it? (shouldn't take too long, just upgrade everything to the latest versions and hack around with dependencies until you get it to compile) Most importantly before I can provide other suggestions, what are you hardware specifications; and personal skill level?


2

In the end, it's not the OS that's the issue, but the application and the service running it. If your firewall is locked down tight, if the computer is physically secured, and the ONLY thing you are doing to serving a static page, then it comes down to the web server and what "else" the static page could do. It CAN be done, but the web server you choose to ...


32

Probably not. In order to respond to HTTP requests, the operating system must be able to run a TCP/IP stack, process packets, and complete a TCP handshake, all requiring the system to utilize or spawn threads in memory, call libraries, etc. Therefore, the system would still be susceptible to protocol attacks it may not be patched for (TCP sequence ...


1

There are a couple of advantages. If your host sits behind a reverse proxy, you are implementing the "defence in depth" model. Let's say your web server has an exploitable vulnerability which you have not patched yet. If your web server was directly accessible without being behind a reverse proxy, your host's vulnerability can be exploited, resulting in ...


1

I think it is fine to have a web facing panel as long as: Its not guessable, for example, www.example.com/admin. U don't want notorious users to attempt brute-forcing for two reasons: Incase the brute-force succeeds. If u have an account lockout policy in place, which you should, u don't want to be locked out by notorious users. Use strong passwords ...


0

For low value sites, username and password is ok. There are a lot of sites that are just not worth hacking into, and where the risk/cost of compromise to you is fairly minimal compared to the cost of securing it. For most sites though, you should require the use of HTTPS or VPN when doing administrative functions. There are now some SSL certificate ...


0

Lot of applications relies on a simple username/password combination. This is not the technique that you should worry about, but how you implement it. You need to make sure that passwords are strong enough not to be guessed. They should not be stored in plain-text in your database in case it gets compromised. Furthermore, you want to avoid interception of ...


0

Yes, it appears optional. According to http://daniel.haxx.se/blog/2015/03/06/tls-in-http2/, it was originally part of the HTTP/2 specification, but was later moved into its own spec as an extension of HTTP/2, http://tools.ietf.org/html/draft-ietf-httpbis-alt-svc-06. It would appear that it was finally implemented in Mozilla in late 2014, and was finally ...


1

Whereas Jari's answer correctly states measures against some MITM attacks, ARP spoofing is a specific MITM attack which is not prevented by enabling DHCP snooping or port-security, (which protect against DHCP race and CAM table attacks respectively). ARP spoofing in particular can be protected against by setting static ARP values deploying dynamic ARP ...


0

ARP spoofing is a layer 2 attack so harden your network by enabling features like DHCP Snooping and port-security on your switches.


1

Your question is a little vague, so I would advise that you consider what threat models you're trying to protect yourselves from. The first thing to do is to define that a DMZ is a region in your network which is considered wholly or partially untrusted, because it is attached to the Internet (or some other untrusted and hostile network). The DMZ defines a ...


-3

It is better to NOT use a DMZ at all. but if you must, assume everything in the DMZ is compromised and should be distrusted and assumed leaked to others. therefor the best solution would be to move your DB and webservice outside of the DMZ, and employ a reverse proxy inside your dmz. (and make sure the webserver can only talk with the proxy, and the DB only ...


2

Yes, all your assumptions are correct there. As you are including content from addthis.com, your client-side Origin is fully trusting this domain. If there was any compromise to addthis.com, or if addthis.com decided to change the script to do something more invasive then your site would be vulnerable. For example, addthis.com may suddenly decide they want ...


1

The first place to look is the server header. Depending on the server configuration it may report all enabled modules. Alternately you can use a specially formulated request which will provide a less reliable detection. The AddHandler directive allows a script to answer with a non 501 response to incorrect HTTP verbs. I'm using this technique in my Apache ...


1

Depending on the privileges the mysql user (the system-level account used to run MySQL) has and how MySQL is configured, the traces could be anything from a full audit trail in the MySQL log files, to no trace whatsoever. Assuming the mysql user can't do anything but read and write files, your bet bet is to search the drive for files owned by that user. ...


0

These look like the results of an automated scan such as one offered by Nikto or a directory brute-force discovery tool such as DirBuster. This is an attempt to identify/discover files and directories on your server and possibly provide a better fingerprint of the application or reveal sensitive files. This reveals information about what modules u might be ...


0

I wouldn't use Apache - you won't get much benefit there. nginx can be used alongside node, as it will serve static files much more efficiently than node can. Haproxy in front of node can give you better load balancing, rate limiting, than you can get with node. You can also offload SSL (and SPDY / HTTPv2) to dedicated tools (stunnel, stud) or use modules ...


0

I would not be using node for production but that's a different topic. The use of ngnix or Apache as a reverse proxy will provide little if no benefit security wise due to the fact that almost everything is being passed through transparently


1

Well-tested code helps to reduce the risk, but even PHP keeps issuing patches to remedy security issues. The problem is not with "newcomers" but with appropriate protections and controls over any type service that you expose. PHP/Apache/etc. behave (and fail) in predictable ways, but we can predict their behaviours because we have experience with them and ...



Top 50 recent answers are included