Questions tagged [attack-prevention]
prevention of an attack vector (e.g. XSS, HPP, CSRF)
562
questions
0
votes
0
answers
78
views
+50
Kerberos protocol attacks?
I have a question in my mind regarding the inner workings of Kerberos protocol. If the generation of the session key is somehow insecure, does this compromise the security of the Kerberos protocol?
I ...
- 43
0
votes
2
answers
99
views
Protection against user session attacks (hijack, replay, tampering, CSRF, XSS...)
We develop a website in JAMStack, all URLs are static HTML page, and each interaction with the server are made by a fetch call on our REST API (micro-services).
When a user sign in, we want to ...
- 157
0
votes
1
answer
49
views
Does core isolation protect me against malware?
Does Windows 11 core isolation protect me against malware or does it have nothing to do with it? For example, an unsophisticated hacker with metasploit, nmap, msvenom or tools like that could create ...
1
vote
0
answers
78
views
Is someone accessing my win10 computer?
I have been wondering if someone is accessing my system and after doing using some basic assessment tools like netstat and event viewer, found some unusual open ports(12345) and special Logon! below ...
- 11
0
votes
1
answer
61
views
What are the security issues of being able to put anything into a website's URL and generate a 200 status code?
If I have a website where a user can add any string into the URL after the domain and have it return a 200 status code rather than 404, what are the security implications?
Is this something that can ...
- 1
0
votes
1
answer
31
views
Do devices that listen for wake words wright the detection samples to memory, if only briefly?
For devices that use wake words for voice assistants, like phones, smart watches, and smart speakers, the audio has to be a constant stream for these devices to compare to the properties of the wake ...
1
vote
0
answers
25
views
Pre-Hijacking Mitigation
I want to create a website with password login and social login (e.g. Google only.)
For password login, first I will send a verification email.
I want to prevent pre-hijacking.
For those who do not ...
- 11
0
votes
1
answer
86
views
How would you counter an email/honeypot mischief scenario?
I'm thinking through a mischief denial-of-service scenario that seems too easy to employ.
Your web-site validates email addresses for new users on sign-up.
A rogue party (a competitor) performs sign-...
- 103
2
votes
0
answers
285
views
Protection against JPEG compression bombs
There is a well-known threat named compression bombs. Such image formats as PNG and JPEG use compression methods, and therefore and in theory PNG/JPEG images might be a compression-bomb.
I've found an ...
- 33
-1
votes
1
answer
58
views
Cyber Security skills development advice [closed]
I'm looking to shift my job / skillset over to the cyber security field. I'm currently in the script kiddy stages of my knowledge and wanted to move past this and locate/identify vulnerabilities ...
- 9
1
vote
1
answer
188
views
Repeated DUP ACK and RST to same TCP SEQ and ACK
I started noticing this behaviour for more than a month. Whenever I connect my laptop to the WiFi router there are lots of RST and DUP ACKs up to the same TCP sequence, as given in the example below, ...
- 11
1
vote
0
answers
55
views
Does Google Update perform cryptographic checks against releases?
My company is looking to allow Google Chrome to self-update, a necessity as we are finding it difficult to keep up with their release cycle in order to mitigate vulnerabilities.
On the pro side, ...
- 169
4
votes
1
answer
656
views
What is the need for firewall to be in "stealth mode"?
There is a firewall deployment case called "transparent mode", when the firewall does its job without routing and having IPv4 addresses, i.e. it is invisible.
"Stealth mode" is ...
- 141
27
votes
7
answers
15k
views
Someone knows my IP and is threatening to DDoS me
Around 4 months ago, someone learned my IP, and is threatening to DDoS attack me if I am not his slave. He was breaking the Discord TOS with all kinds of stuff in my DMs. I blocked him, but one of his ...
- 447
0
votes
0
answers
132
views
No User SID in the sysmon event with id 1 (process creation)
Extend version of the question
I'm trying to figure out how to detect the launch of unwanted processes based on regular logging in Windows and sysmon. Sysmon event 1 allows you to get a significant ...
- 13
0
votes
1
answer
115
views
Is the "same-origin" implied when using "frame-ancestor" in the CSP header?
If my Content-Security-Policy is set to the following:
Content-Security-Policy: frame-ancestors 'self'
Does it also imply:
Content-Security-Policy: default-src 'self'
Or is it a lot safer to put ...
- 927
0
votes
1
answer
151
views
How to prevent attacks due to Insufficient Logging & Monitoring?
A10:2017-Insufficient Logging & Monitoring
This is one of OWASP Top 10 vulnerabilities. Given that we log and monitor sufficiently, how can this prevent an attack for example - attack where ...
- 103
0
votes
3
answers
407
views
Should I have another domain name for my company internal tools
My company has a domain name that we use to serve our customers, say company.com for the main website, app.company.com for the web application and api.company.com. These are all public domains that ...
- 775
1
vote
1
answer
180
views
Protection against different attack vectors, password manager
I'm a software dev working on an open-sourced password manager(dev lib, gui and cli) for educational and eventually usefulness purposes. There doesn't seem to be all that much information regarding ...
- 11
0
votes
0
answers
256
views
How to protect API keys from malicious usage in Flutter with Parse
It is an obvious security vulnerability to have my API keys out in the open as such when initially developing my app. Parse is setup this way because it’s easy for development and learning I assume.
I’...
- 251
1
vote
1
answer
2k
views
How to properly deal with WPAD attacks?
I have already read those 3 topics about WPAD attacks but I'm still confused, so I'm here looking for a deeper explanation.
CONTEXT
I think a WPAD attack is happening in my home and I was not aware ...
- 758
1
vote
1
answer
85
views
DDoS might be very unlikely to happen to my website but in any case a CDN that should protect from it slows my website [closed]
I humbly assume that DDoS is very unlikely to happen to my website.
A CDN that should protect from it slows my website according to my personal experience and tests (perhaps only because of the ...
0
votes
0
answers
78
views
Display a token's expiration date to a user
We use multiple kinds of token in our system for :
Invitation to joint a group
Account creation (validate if the user possesses the email address)
Validate email address
The tokens are sent in a ...
1
vote
1
answer
202
views
How can I protect browser cached files to be accessed in a case of a stolen hard drive?
For the usual reasons we want to cache certain resources browser side, e.g. list of products bought in the past.
Context is a web application, accessed via the internet.
This list is confidential in ...
- 11
0
votes
2
answers
328
views
Is it possible to hack a database inside of local network by external attacker?
Can an attacker from global network hack a database located on office machine inside of local office network? For example after hacking a router, a gateway or the very machine? Or maybe there is ...
- 117
0
votes
0
answers
91
views
Backendly preventing database injections on simple web forms [duplicate]
I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
1
vote
0
answers
21
views
How do I use SYN cookies to perform a DOS attack [duplicate]
I am taking a computer security course but I have a question I am stuck on.
You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you ...
- 11
1
vote
1
answer
904
views
Layer7 DDoS Protection vs WAF, which should I use?
I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions;
...
- 113
0
votes
1
answer
106
views
Old operating system (offline computer) need to come online for a few minutes
OSX El Capitan
I have an offline computer running an old OSX operating system.
I would like to connect that computer to the web for a brief few minutes in order to install HomeBrew and install a newer ...
- 101
3
votes
0
answers
450
views
How plausible is this article on how SciHub acquires its papers? [closed]
Sci-Hub is a piracy website that provides free access to usually-paywalled academic papers & books. Sci-Hub's owner Alexandra Elbakyan says that many people with legitimate access to the papers/...
- 499
0
votes
0
answers
57
views
Is it possible to verify that a USB adapter is not malicious? [duplicate]
I have some generic USB C-to-A and A-to-C adapters that were bought cheaply.
I thought that if any of them had any advanced capabilities (other than being "dumb" adapters) such as mimicking ...
- 53
0
votes
1
answer
214
views
Can the sandboxing technique prevent a buffer overflow attack?
Buffer overflow Attack: Sample Authorization
void A( ) {
int authorized;
char name [128];
authorized = check credentials (...); /* the attacker is not authorized, so returns 0 */
printf ("...
- 3
1
vote
0
answers
66
views
How to prevent external magnet rotate a motor [closed]
A small DC motor working and moving a disc. When device/motor is powered off, a hacker with a strong magnet came and rotated the motor; without touching the motor, just moving the magnet near the ...
- 11
-1
votes
1
answer
1k
views
How to prevent someone from proxying your Websites
So i think someone is mirroring my site with a proxy and hides behind cloudflare (cloudflare already notified and google also) so i cant find out the real ip of the server to block it.
Is there anyway ...
- 1
1
vote
0
answers
91
views
Problems understanding the use of Distance Bounding against Man-In-The-Middle attacks
I currently have to write a paper for university in my Network Security lecture about methods of secure location verification. Therefore, I chose to write about several distance bounding protocols, e....
- 111
1
vote
2
answers
1k
views
SQL injection using brute force?
I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
- 13
1
vote
2
answers
354
views
Malicious payload in raw media file content
As with anything to do with software, there have been many documented security vulnerabilities that relate to media files. While many of these exploits take advantage of attributes or variables of ...
- 11
4
votes
2
answers
247
views
Ensuring that non-executable files are not malicious
Let's say that I have been sent some maliciously-crafted audio files by an attacker that use an unpatched security exploit somewhere in my system to compromise it. How can I reprocess the actual audio ...
- 41
1
vote
3
answers
471
views
JS challenge based on computational complexity
Assuming I have a website with a button that sends AJAX requests to my server which will be expensive to process.
I suppose that mostly cookie or JavaScript + cookie challenges are used to prevent (...
- 11
2
votes
0
answers
241
views
How good can X-Frame-Options HTTP header do against click-jacking?
X-Frame-Options HTTP header is used to tell if a webpage is allowed to be used in a frame/iframe.
Frames can be used for click-jacking/UI-redress attacks.
It is advised to set X-Frame-Options to '...
- 121
0
votes
1
answer
456
views
Security implications of a fixed vs relative pathname
What would be some security implications of a fixed pathname (although probably in a system directory when it would be deployed as a system service) rather than a relative (out of current directory)? ...
- 103
1
vote
1
answer
111
views
Getting an abnormal amount of firewall warnings on web server
I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website).
...
- 671
0
votes
0
answers
54
views
OpenSSH artifacts, remote system access? [duplicate]
After stumbling upon some unknown folders in my unused OneDrive (posted question), I did some digging arround and found some interesting logs. Apparently, OpenSSH had been used for remote access on my ...
- 101
20
votes
7
answers
6k
views
Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords
For the second time my website seems to be the target of a large automated attack. It seems complex enough and very well executed. I have the following systems in place:
Captcha on 3rd failed login ...
- 313
0
votes
1
answer
158
views
Insider threats vs. insider attacks
I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, ...
- 1
0
votes
1
answer
104
views
Booting 'live' form the hard disk
I use VeraCrypt for file-container level encryption for all of my files.
But being very paranoid, I am always worried about the OS1, Primary applications and non-primary applications leaking the data....
- 275
3
votes
3
answers
475
views
How to make sure that no one is watching you through webcam?
I have heard that intelligence agencies and hackers can illicitly gain access to a computer's webcam and microphone and keep a close eye on people using suspicious programs or malware.
Is there any ...
0
votes
1
answer
7k
views
How to prevent XSS attack on selected window.location in javascript
This is my code where i have a userId in a method SwitchUser_Click. I need to prevent or somehow encode the return value from the switchUser_Click as it includes the UserId of a user vulnerable to ...
- 101
0
votes
1
answer
470
views
Full disk encryption and remote unlocking a mail server in the hand of a possible attacker, what could go wrong?
Since I cannot receive email directly from my home server, I need an external device to receive messages for me and deliver them to my MTA via another port or via VPN. Instead of renting a VPS just ...
- 63
1
vote
0
answers
84
views
Two persons-rule on MySQL databases for "manual fixes"
In order to "harden" our compliance, we wanted to enforce a two-persons rule on the MySQL production database for "manual fixes". Such "manual fixes" frequently arise due to:
Bug in the application (...
- 595