Hot answers tagged

74

Country-based blocking is usually put in place as a result of some organisational policy whose intention is indeed to "block hackers". This sort of things fail on three points: Such a policy assumes that malicious people can be categorized by nationality. This is old-style, World-War-I type of thinking. Geographical position is immaterial for computers; a ...


64

The sniffing problem is about "confidentiality", which whitelisting does not cover, as the traffic can be intercepted and read. The MitM problem is about "authenticity", which whitelisting does not cover either, as an intercepted packet can be modified without evidence of tampering. I assume the whitelisting uses IP addresses, which can be arbitrarily ...


26

In my case, our expected customers come from predictable countries, and so to limit the "threat surface", other countries are blocked. This has limited value as any determined person can do what you did and simply re-route their traffic. The side benefit, though, is that the countries we permit are those with stringent cyber-laws and we can get law ...


13

If the data is unencrypted, anyone sniffing the packets between your server and their server can see it. A whitelist only lets their server verify that the source of the data. It doesn't assure that no one sniffed it during transfer, or that it wasn't intercepted and manipulated at any point during the process. In short, encrypt the data, keep the whitelist ...


7

That's why the character class [[:alnum:]] exists; it includes the characters which are considered valid alphanumerics in the currently active locale. Of course, that doesn't work well on a web server in the US when someone in Egypt is attempting to provide input through a form - and it doesn't work with punctuation. But it also doesn't include spaces, and ...


6

First off: This is absolutely the wrong way to solve CSRF problems. CSRF vulnerabilities are a problem in your site, not in the browser. Blacklisting certain browsers is not going to solve your CSRF vulnerabilities. CSRF is not browser-specific and cannot be prevented through browser blacklisting. Detecting browser versions: There are various ways to ...


6

Also, why is whitelist approach better than blacklist approach as mentioned by OWASP. Why not just block a handfull of characters used in XSS like < , > , etc Blacklists are static in the sense, they prevent 'known bad' from happening. The problem with this is, there are new attack vectors found everyday and you would need to constantly update ...


5

It is not just a block of handful characters that you need to blacklist. In security we go by this dogma: "There are things we know that we know. There are known unknowns. That is to say there are things that we now know we don't know. But there are also unknown unknowns. There are things we do not know we don't know." Blacklist might help you ...


5

If the customer is as security aware as the question imply's then they will understand that the only reliable way to perform the task would be to whitelist traffic to the IP address range for Amazon ELB service. If the worry is that this would allow other websites using the same service external access then a proxy server or secondary firewall would be ...


5

Assuming you're asking this in the context of Web Development... You can detect appropriate character sets with simple regex validation. However, you may also be falling victim to security theater: input sanitation is not the answer. If you are trying to validate for specific locales, and you don't want to accept any other locales, you can choose specific ...


4

Our answer is that for a truly international application, on general input such as people's names, you should accept everything and encode it at display time. Admittedly that (to some extent) passes the problem down to the guy writing the Encode algorithm. However, if you have an input that is a specific thing, such as a vehicle number plate, or a business ...


4

I think you might have rejected ESAPI too quickly. To defend against XSS, I recommend you do output escaping: any place where you insert data dynamically into an HTML document, escape the data (in a way suitable for that parse context). ESAPI provides libraries for the escaping and is very useful. This does not involve "changing your input". For more, ...


4

There are two things I can think of, neither fits the bill perfectly, and there's some assembly required. squid with sslBump and the SSL Server Certificate Validator This is basically an MITM SSL proxy configuration, and you get to provide an external "helper" that augments normal verification. Stumbling blocks include certificate trust and managing your ...


4

If you whitelist a directory, then sure, any malware in that directory can run. That's why you don't whitelist directories. Instead, you whitelist programs, and you take precautions to ensure those progrms aren't modified. For example, instead of whitelisting "c:\Program Files\Internet Explorer", you whitelist "c:\Program Files\Internet ...


3

Sudo blocks environment variables that might be bash function definitions (2004-11-11 env.c: strip exported bash functions from the environment), even if the variable name is whitelisted. That's why sudo isn't included in the list of common attack vectors for Shellshock. A bash script invoked by su to a restricted account can be an attack vector. But there ...


3

It's true, if a hacker would like to get access to your page, it will not help, he can simply use a vpn or proxy. But if you think about all the bots out there which attack every page they find to test exploits and/or passwords, you will be able to block a lot of them. This will also help you against ddos attacks, if you block every country except the one ...


3

I'm not sure if this is really an information security question per se or more of one about general networking; but here goes: If you have a number of dynamic IPs connecting to a client that requires whitelisting, this will lead to constantly having to ping the client to update the ACLs to allow IPs as they change. While on modern residential connections ...


3

IP spoofing only works for incoming, UDP traffic. If you need the return trip to work, network layer IP spoofing doesn't work any more. While white-listing is a good defence in depth strategy and mitigates against many attack vectors, some attack vectors still remain, like MITM attack. The traffic between the two servers can still be intercepted and ...


3

If you are getting your network assessed for the first time I would suggest giving the pentesters complete access. You will get a report that is comprehensive which would include all the vulnerabilities that exists in your assets. This will give you the complete understanding to plan upgrading the security of your network. Moreover, during a pentest, the ...


3

When talking about security (in general), it is important to think about what problems you are attempting to solve, and what tools you are using to solve them. These have to align. If the problem you are attempting to solve is general attacks from the internet, then whitelisting may be a useful tool - to overcome whitelisting, you have to be somewhere on ...


2

Many systems support the use of alias with a character such as +. So, makerofthings7+c6201404b8efbe@invalid-email.com would be equivalent to makerofthings7@invalid-email.com for the MDA (ie. they would end up in the same mailbox). Then, you keep a list of whitelisted tokens (maybe paired with the From header they must use): ...


2

As long as there are not any other services that are vulnerable to exploit it should be sufficient. I would personally recommend placing a firewall between server 1 and server 2 to ensure that only server 1 can communicate with server 2, but if that isn't possible, a whitelist and locking down services on server 2 is your next best bet.


2

This method is sufficient to protect against Apache serving this directory, but a configuration error may disable this: If your main Apache configuration contains AllowOverride None (or similar), then .htaccess files are ignored. Thus your IP whitelist does not apply. Depending on the hostname or directory, different configuration might be set. If you have ...


2

In a corporate environment the purpose of whitelisting is that an administrator can authorise programs to run, but a regular user cannot. In that case it is ok to whitelist a directory that a regular user does not have write access to. In fact, there is a standard AppLocker profile that allows execution from C:\Program Files and C:\Windows, but excludes ...


2

tl;dr: different things, both usefull for different szenarios, IP whitelisting in not a bad sign You are indeed comparing apples and oranges. IP-based filtering happens at the network layer of the OSI model, whereas certificate validation happens on the transport (and/or application) layer. Allowing access only to/from specific IP addresses reduces the ...


1

This really isn't useful or effective, it only specifically protects against shellshock (and with the amount of publicity it received I am fairly confident that a similar attack will not happen again. ) I should also point out that your whitelist would not actually protect a system which is effected by shellshock either.


1

Some websites block countries for business reasons. Traffic from some countries doesn't generate enough revenue to warrant the resources to serve them. Sometimes companies don't want to expand into a country until they can "do it right." It's likely not a security issue. This can be circumventing by using TOR and VPNs. Of course, they can also block traffic ...


1

I did a similar thing a while ago and my solution was that I set the environment to the math functions and that is all there is. If any other function is called, it will error with attempt to index nil.


1

I would recommend spending a little effort writing a parser for the arithmetic expressions in the input rather than dynamically executing it as Lua code. Even if you haven't got a third party parsing library available, it's not too difficult to write a lexer that splits up a string in relevant symbols, and then traversing those with a state-machine or ...



Only top voted, non community-wiki answers of a minimum length are eligible