Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [attack-prevention]

prevention of an attack vector (e.g. XSS, HPP, CSRF)

0
votes
0answers
14 views

Using Referer/Origin request header to prevent CSRF [duplicate]

I'm testing a web application checking the Origin or Referer request header as a CSRF prevention mechanism. I could not find a way to bypass these checks and they seem to be implemented reasonably ...
1
vote
0answers
18 views

SOP for an API specifically serving a single SPA

SOP (same origin policy) provides some security for the users against some attacks, but it is not very strict as it still allows you to send GET and POST requests from a different origin that APIs by ...
27
votes
5answers
8k views

I detected someone probing my site for weaknesses, what can I do about it? [duplicate]

My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
-1
votes
1answer
86 views

Timing Attacks: Against PHP Server - Prevention/Tutorials [duplicate]

What is the most simple and effective way to Prevent the Timing attacks for the programmers who use PHP? I'm a high school student, I'm new to programming and I've been learning Security since few ...
2
votes
1answer
46 views

Security implications of auto-submitting OTP?

So the question was originally asked as a part of the UX question here. My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
2
votes
1answer
194 views

Amazon EC2 Abuse Report

My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance. The email states: We observed machines under your control ...
6
votes
3answers
242 views

What is the (literally) lightest way to run a second secure system?

My goal is to have two separate systems where one is secure even if the second one is full of malware. My current approach is to have two separate laptops and the only way these two communicate with ...
1
vote
1answer
52 views

Block hex encoded requests using fail2ban

I have new web server running nginx. The default server is receiving 10K+ requests every day from Russian bots. They are clearly probing for something, but it's hard to say what since the requests ...
0
votes
1answer
81 views

How can Insertion attack ever work and fool an IDS on a TCP connection?

An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
1
vote
2answers
211 views

XSS prevention via JavaScript

I am working on a XSS prevention via Javascript. I am using the following JS-Code for that: (function () { /* XSS prevention via JavaScript */ var XSSObject = new Object(); XSSObject.lockdown = ...
2
votes
1answer
130 views

Is this code vulnerable to a CSRF attack?

I am utilizing tokens to protect from a CSRF attack but to make the "back" button still work I reuse old tokens if they are set. Does this still provide CSRF protection or can an attacker just set ...
-1
votes
1answer
83 views

Attack Surface Analyzer report possible actions [closed]

I am using Microsoft's Attack Surface Analyzer, and I would like to get a better understanding of what would be the best way to mitigate the findings. For example if in my report I get Directories ...
3
votes
0answers
74 views

Attacks on RSA without knowledge of either key

All attacks on RSA seem to require knowledge of at least the ciphertext and the public key. However, has there ever been any evidence of an attack which simply uses a sufficiently large number of ...
1
vote
0answers
49 views

Review: Security model for sync service [closed]

I am working on a sync service for my desktop app. The app tracks (with the user's consent) some computer usage data (comparable in terms of sensitivity to their browser history), so I'd like for this ...
1
vote
2answers
124 views

How to protect the Shadow Stack?

I found out that many protection mechanisms are used in computer security to ensure control-flow integrity, one of these mechanisms is the Shadow stack: The principal is very easy it ensure the ...
0
votes
2answers
73 views

Which are the most common vulnerabilities for poor crafted IoT devices? [closed]

I'm learning about securing IoT devices and starting to learn how to develop my own software for them. I wanted to know which are the most common vulnerabilities that any scriptkiddie could exploit ...
5
votes
2answers
344 views

Avoid being hacked with brute-force attack

During the last week, our company website has been under a weird brute-force, this attack actually led to hacking an admin account. Our website is a wordpress site. The attacker keeps performing POST ...
29
votes
1answer
3k views

How to prevent “cost attacks” on AWS?

Ok, so I'm using AWS and with a serverless architecture, it's very practical since AWS Lambda will run functions as microsservices and I don't have to deal with servers. Not only that, but it's also ...
1
vote
1answer
193 views

Is this usage of AES-CBC dangerous

Imagine that an attacker knows: A correct ciphertext. The algorithm: AES-256-CBC. The implementation: openssl CLI. The IV. The HMAC-SHA-256 of the ciphertext. But does not know the key (let's assume ...
4
votes
3answers
205 views

I want to hire someone on Upwork to install a bitcoin trading bot on a cloud server. What vulnerabilities should I watch out for?

Context I tried installing Tribeca (a bitcoin trading bot) myself yesterday, but messed it up somehow, as I'm not very familiar with Docker/Git/NPM/mongoDB technologies (a little knowledge is ...
1
vote
0answers
68 views

Protecting an api-token with cookie authentication only

I have a webpage that will provide an JSON object of an api-token if a valid session cookie of a logged in user is provided. If an attacker gets this api-token then they now have full control over ...
1
vote
2answers
90 views

Veracrypt - Encrypted USB Partition - Does it Pass the Key Over USB?

Looking in to Veracrypt to use it in some spaces, but more for encrypting an entire USB partition. I was curious as to how the key would be passed though. I don't want someone to be able to intercept ...
1
vote
0answers
66 views

Invalid certificate error appears on my web server for 10 minutes and then disappears

I have a raspberry pi that hosts a web server and has a DDNS registered through no-ip. I just had an issue connecting to my webserver because a certificate appeared to be installed on this server that ...
0
votes
1answer
64 views

Can an attacker add malicious instructions to a cracked Password Manager app to exfiltrate credentials ? (1Password, oneSafe, etc.)

(In OSX) Would it be possible for an attacker to add into a password manager app (cracked illegal version, downloaded from a pirate website), instructions to make the program send credentials over the ...
1
vote
0answers
226 views

Replay attack in Wi-Fi (802.11) network

I am trying to create a small smartphone activated lock for my house via Wi-Fi. The setup is like this: The solenoid of the lock is connected to an esp8266 that acts as an access point, and has an ...
6
votes
2answers
3k views

What is the best practice to store private key, salt and initialization vector in database?

I am working on java application to create a digital signature to sign a document. I already created private key and public key using (Elliptic-curve cryptography) ECC, and now I want to store both ...
3
votes
1answer
822 views

Malicious script through sql-injection

One of my customers had a problem making a post at his blog, and when I looked into the database I found out that the newsletter table (which sends emails about the blog posts) had a malicious script. ...
2
votes
2answers
479 views

Web Attack: CCTV-DVR Remote Code Execution (Node.js - Swedish string.js URL)

I have been using node.js and running live-server package in my project for a while with the following command: node node_modules/live-server/live-server.js . --ignore=\"css/sass\" --open=./ --cors ...
-3
votes
1answer
151 views

What hackers do in the darknet? [closed]

What do hackers do in the darknet? I know that there are some "hacker services" that they can make some money, but I wonder if there are more interesting things, like forums about specific targets. I'...
0
votes
0answers
35 views

Measures to prevent a email attack that happened in Debian Server [duplicate]

Recently my server started running at 100% cpu, when I barely had anything running on it. When I checked the processes, an application called atd (at daemon) was running. Everytime I killed the ...
1
vote
1answer
638 views

“Flow” between computers (Logitech mouse)

Logitech (and possibly other) mice offer a feature called "flow": mouse can pair with uop to 3 devices (PC, handheld, ...), and can mark, copy & paste content (even files) between these 3 devices (...
0
votes
1answer
80 views

Is malware altering my destination ip

Something strange is happening to my internet requests and I don't have the knowledge to know why it's happening. I've suddenly started to be directed to google france whenever I do internet ...
6
votes
1answer
232 views

What are the security measures taken on websites that allow online scripting such as jsfiddle and codepen?

As asked in the title, I have been wondering this for a while. These sites allow the user to write scripts and store them too. Are they not vulnerable to attacks such as cross-site scripting or any ...
1
vote
2answers
394 views

Intrusion Detection System (IDS / IPS) useful for Linux home users?

Can an Intrusion Detection System or Intrusion Prevention System (IDS / IPS) increase the security of home users using Linux? Or is an IDS / IPS even less useful than antivirus for Linux? Is an IDS /...
2
votes
1answer
130 views

Unescaped data in div or p tags, but unable to exploit

A web application takes user input and displays the data, without any escaping or encoding, in div or p tags. So if I provide <script>alert(1)</script> as input, the source would look ...
7
votes
4answers
323 views

Should I be concerned about a very slow dictionary attack?

I have installed fail2ban on my mail server, and the logs show 4-5 IPs regularly hitting my server at large intervals (so not often enough to trigger the fail2ban rules): 2017-10-04 06:29:04,705 ...
0
votes
1answer
48 views

Attacks on email validity service

In order to have a better user experience during registration on mobile apps, I had added a web service to check if email ID exists before submitting the form. Based on the error logs, it looks like ...
1
vote
1answer
134 views

What is MCO Attack

I have received an email from the Data Center that we might have been under an MCO attack, we didn't know what that meant and all they could tell is that MCO stands for "Multiple Client Outage" and ...
0
votes
2answers
306 views

Should we prevent this login XSS attack?

Setup Restful API and thin JS web client Login POST Endpoint using parameters email and password Access-Control-Allow-Origin is set, so responses can only be retrieved from non attacker website. ...
0
votes
3answers
4k views

My computer was being remotely controlled by someone. Can find no viruses

Walking back to my computer (Windows 10), I noticed that my browser's history tab had just opened without me touching it and I thought I saw my cursor moving around. I had no control over my mouse ...
1
vote
7answers
1k views

How to protect unauthorized logins in case DB server gets compromised?

Generally what happens when an user registers to a web app is that their passwords get hashed well, so even if a DB leak happens, getting the original password is not feasible. But what happens if an ...
3
votes
2answers
363 views

UDP flood 300 Kbps + SYN probes / other attacks. Flood or DDoS at low rate?

So for over 2 weeks, Im receiving what appears a combination of attacks non-stop 24/7. First this UDP flood at a strangely small rate of 280 Kbps / 110 pps (360 bytes length) 02:29:41.978484 IP (tos ...
1
vote
2answers
198 views

Is it common to be audited for security, but not be given access to the audit results?

When does it make sense, or is it common to not be given access to security audit resuts/reports when dealing with large companies who use your software? How can a case be made for the benefits of ...
1
vote
2answers
182 views

What can I do to find out who is remotely accessing my PC? [duplicate]

Twice now I have left my home laptop active and logged in on my desk to return and find the mouse moving around the screen, the first time browsing through Xbox smartglass and the second time in the ...
0
votes
3answers
194 views

Is there a way to know when the microphone is recording? (Windows 10)

Is there an open source windows 10 trick (or a tweak/app) that would just turn ON/OFF the microphone or at least shows when it records? (For instance when it will record, it will show a red icon on ...
0
votes
0answers
90 views

Protect unauthenticated interface from guessing attacks

I am currently encountering a publically available interface; accessible at least via web form/webviews and some stateless protocol (presumably REST). In the past this form allowed you to view your ...
3
votes
2answers
246 views

Is SSH with key authentification safe in untrusted network?

Setup: OpenSSH running on my server and JuiceSSH on client mobile device. Password authentication is disabled and private key is stored encrypted inside JuiceSSH dedicated memory. Situation: I want ...
0
votes
0answers
69 views

Hiding computers behind redis pub/sub?

I have a problem which is 1 http service i'm developing will receive user sensitive data ( 3rd party API KEYS ) and i need to store the keys somewhere where i can retrieve them in clear text. One of ...
42
votes
5answers
8k views

Security implication of telling the user they can't login because of too many attempts from IP

On Code Review stack exchange, in response to code that informs the user when their login attempt failed because of too many login attempts from an IP, I was told "Absolutely do not message end ...
0
votes
1answer
85 views

DDos prevention systems behavior for corporate networks [closed]

I asked this question on stackoverflow but couldn't get any answers and I even got a down vote as a present so that I'll try my luck out here. I did some research about this problem and couldn't find ...