Questions tagged [attack-prevention]

prevention of an attack vector (e.g. XSS, HPP, CSRF)

Filter by
Sorted by
Tagged with
1
vote
0answers
36 views

Two persons-rule on MySQL databases for “manual fixes”

In order to "harden" our compliance, we wanted to enforce a two-persons rule on the MySQL production database for "manual fixes". Such "manual fixes" frequently arise due to: Bug in the application (...
1
vote
3answers
77 views

Is running bash script that is taking arguments from site dialog box a good idea?

I'm building a site that will use youtubeAPI to keep track of playlist changes. In order for 3rd party to use it I would supply a dialog box in which user would type his/hers playlistID - this would ...
1
vote
0answers
21 views

Creating a Secure Modern MMO From the Ground Up [closed]

MMOs have been around along time. As a result, there are lots of past attacks on MMOs that we can learn from and apply to a modern MMO. As a security novice, I was wondering if in today's climate you ...
0
votes
2answers
72 views

My VPS was used for DDOS Attacks [duplicate]

I got an email from my hosting provider telling me that my VPS was used to perform DDOS attacks on this website: cpanel4.vhosting-it.com. Unfortunately I haven't read their email sooner, so they ...
0
votes
1answer
59 views

Attacking through an open but not listened port [duplicate]

Let us say, we open a port, say port 123, so that upon listening, an application on the server can receive incoming packets through the port 123. If there is no way that an inside application on the ...
0
votes
1answer
104 views

Is there a way to lock down a network? [closed]

If supposing I discover that my network is being attacked by some hacker or is being compromised in any way and I am able to detect it. So, is there any software-oriented way of 'locking-down' the ...
3
votes
1answer
97 views

Making SQL/HTML Injection attacks programmatically impossible

Apparently having 100% prevention of SQL Injection and XSS attacks is easier said than done, but why? Can't static code analysis tools ensure that all user supplied input vectors (including user ...
1
vote
1answer
52 views

What technologies to use for the “front end” server to safely validate requests?

Imagine that I have a server made with technologies and programming language that are not secure for some reason, such as legacy versions with known vulnerabilities or anything else that may result in ...
1
vote
1answer
124 views

Attack that stops internet access for several minutes

I have a question that might sound a bit weird: A friend of mine (Person A) is being attacked by a former friend (Person B) and now person A asked me for help. Person A and Person B know each other ...
2
votes
0answers
474 views

TCP reset attack / forged TCP reset prevention

How do you prevent someone from doing an TCP reset attack between client and host without having acess to host? I am trying to solve a CTF for fun and learning purposes. In one of the challenges I ...
0
votes
1answer
46 views

Is a differentially private SQL database relatively more secure from an SQL injection?

I've been in security for a while now but I'm relatively new to privacy. I've been studying differential privacy and its application to databases. However I'm still a little confused about where ...
0
votes
2answers
175 views

Security risk of encrypting the same data with many public keys

I need to distribute a shared 256 bit key to 100's or 1000's of nodes (I have the public key of each node). There's no networking involved - this will all be done by loading a single file on to ...
156
votes
14answers
25k views

Why is the OS obfuscation defense against “It's a Unix system!” not widely implemented?

The Jurassic Park scene referenced in the title is infamous for how ludicrous it sounds to those who are tech literate. But it also illustrates what seems to me to be a glaringly huge hole in web ...
3
votes
0answers
64 views

Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri. Situation: I am looking at this in the context of implementing a Shopify ...
2
votes
0answers
122 views

How do I protect myself from Pegasus and alike malwares?

I recently came across reports in media that Whatsapp's services were exploited by a malware Pegasus for illegal surveillance of certain individuals. Pegasus, which exploits 0-day vulnerabilities, is ...
3
votes
2answers
216 views

How do attacks on web browsers succeed? [closed]

We all know that attacks on web browsers are entirely possible. This includes attacks such as drive-by downloads, MITB (man-in-the-browser) attacks and keylogger browser plugins/extensions. However, ...
1
vote
2answers
95 views

How to Prevent Access to Local Machine's Data

Please excuse the terminology as I'm no expert in information security. My question is pretty straightforward: How can I guarantee* that I am the only one with access to my local machine's data (...
1
vote
1answer
128 views

How to harden against credential stealing in EC2 via the http://169.254.169.254 API?

AWS has a feature called Instance Metadata, which on EC2 gives you access to the AWS credentials through HTTP calls: curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> ...
1
vote
4answers
204 views

Ransomware aversion and identification techniques

I don't think there's a need to go into the background here, but identification of the process may be better explored. From a developer pov, at a high level, the files are modified, by virtue of the ...
6
votes
2answers
211 views

How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?

I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack. I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
2
votes
1answer
177 views

How to stop my phone from secretly recording me? [duplicate]

I unplug my microphone from my computer when I am not using it. The same with my webcam. I am not using Alexa or similar. However, my smartphone has an included battery that I cannot take out. My ...
0
votes
1answer
527 views

Preventing Basic Directory Traversal Attack in Linux application

I have a Raspberry Pi connected to my network and keep getting this vulnerability warning from my security software. I turned off the apache2 web server on the Pi, which fixed my port 80 issue but ...
0
votes
1answer
244 views

Securing exec against executing adversary shell commands

I have to execute my .o or .out binary file pre-compiled with gcc, it should be intended to let the user execute the small program so an action is made that connects with the app installed on the user'...
-1
votes
1answer
68 views

Fundamentals of securing a web app? [closed]

I am trying to build an app that deals with finance, specifically crypto-currency. What are the fundamentals (preferably in point form, but I'd appreciate explanations too) of securing such an app ...
0
votes
1answer
105 views

Zero Day Policies implementation

I'm new here, and sorry if my english is a little bit broken it's not my main language. I'm trying to put together a document/ppt for my startup with a Zero Day policy structure. But I'm not finding ...
1
vote
1answer
47 views

Difference between local and central anti-spam

I'm attending a web security course whose slides, concerning techniques for protecting ourselves from spam, sometimes report the expressions "local anti-spam" (or "personal anti-spam") and "central ...
2
votes
1answer
2k views

Should I be worried by an email which said my account was under attack? [duplicate]

So, today I received an email in my Gmail account which landed automatically in the spam folder. This was the email content: Hi! As you may have noticed, I sent you an email from your account. ...
0
votes
1answer
63 views

Does a cyber-attack influence the occurrence of faults?

I am looking for opinions and point of view of experienced people on this question, as I am not able to find a lot of resources. Let me define the terms first, so that we all talk about the same ...
1
vote
1answer
341 views

How can we prevent and detect any unauthorized screen capture and recording applications?

We may all have come across capturing and recording our own screen to save some information for ourselves, but how about other people doing so without asking? Let's have an example here: an attacker ...
1
vote
2answers
114 views

File upload attack vectors when file is not saved to disk

I'm curious to know if there are any significant threats presented by files which are uploaded and read but are never saved to disk? I've read countless articles about file uploads regarding storage ...
1
vote
1answer
123 views

OpenSSL Padding Oracle. Specific Ciphers on apache2 seems a little limited

I've seen a lot of articles giving the official explanation on how to prevent OpenSSL Padding Oracles, Usually all of them state that its CBC cipher suites that leave you vulnerable. The following ...
4
votes
2answers
129 views

Is there any way to secure old unpatched Linux server?

I have to maintain very old CentOS server (not patched since 2013) for a year, until new software is developed to replace it. It holds HTTP server, mail server and many custom build apps (author gone ...
0
votes
1answer
506 views

Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?

I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails? Specially, can an attacker escape ...
1
vote
4answers
172 views

Volatile memory only computer?

I was wondering, is it possible to create a fully volatile computer, with no permanent memory at all (not even in the BIOS), that will be loaded on each boot from a read only live CD? Such that in ...
2
votes
1answer
760 views

OAuth 2 state token and protect CSRF

We are trying to build a set of REST APIs which will be authenticated by using attached ID token generated by an OAuth provider. I am trying to understand how to use the state token passed in with ...
2
votes
1answer
167 views

Unauthorized API Access Without Key Header

In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key. In order for me to send requests to this endpoint, I ...
1
vote
0answers
49 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
0
votes
2answers
197 views

Website is behaving strangely - was it attacked?

Our website was behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow. We checked apache logs and found the below ...
1
vote
1answer
121 views

What are security concerns of the predefined user in Web Application?

We use a predefined admin user in our web application. The configured password is very long and different for each installation and we have implemented brute force mitigations. What are the security ...
0
votes
0answers
36 views

How do you set private keys in putty enmasse in Windows?

In line with this question...if you have a large number of hosts, and a large number of users who service these hosts, how do you set the private keys for these hosts enmasse across the users who ...
0
votes
2answers
204 views

How to prevent buffer overflow attack?

int main(void) { char buff[15]; int pass = 0; printf("\n Enter the password : \n"); gets(buff); if (strcmp(buff, "thegeekstuff")) { printf("\n Wrong Password \n"); } ...
2
votes
1answer
72 views

Can non-malicious faults provoke malicious faults?

I am wondering about this for a long time. With the exponential raising of critical cyber-physical systems (CPS) in our all-day-life (cars, metro, UAVs, ships...), how would an attacker be able to ...
1
vote
0answers
32 views

SOP for an API specifically serving a single SPA [duplicate]

SOP (same origin policy) provides some security for the users against some attacks, but it is not very strict as it still allows you to send GET and POST requests from a different origin that APIs by ...
27
votes
4answers
9k views

I detected someone probing my site for weaknesses, what can I do about it? [duplicate]

My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
2
votes
1answer
233 views

Security implications of auto-submitting OTP?

So the question was originally asked as a part of the UX question here. My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
2
votes
1answer
688 views

Amazon EC2 Abuse Report

My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance. The email states: We observed machines under your control ...
6
votes
3answers
277 views

What is the (literally) lightest way to run a second secure system?

My goal is to have two separate systems where one is secure even if the second one is full of malware. My current approach is to have two separate laptops and the only way these two communicate with ...
1
vote
1answer
124 views

Block hex encoded requests using fail2ban

I have new web server running nginx. The default server is receiving 10K+ requests every day from Russian bots. They are clearly probing for something, but it's hard to say what since the requests ...
0
votes
1answer
723 views

How can Insertion attack ever work and fool an IDS on a TCP connection?

An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
1
vote
2answers
715 views

XSS prevention via JavaScript

I am working on a XSS prevention via Javascript. I am using the following JS-Code for that: (function () { /* XSS prevention via JavaScript */ var XSSObject = new Object(); XSSObject.lockdown = ...

1
2 3 4 5
11