Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [attack-prevention]

prevention of an attack vector (e.g. XSS, HPP, CSRF)

0
votes
0answers
59 views

How do I assess the difficulty of brute-forcing combinations of some public information?

I'm designing a piece of software whose information will be public, but I'm wondering how resistant this information might be to external analysis, without using any specific security mechanisms to ...
0
votes
1answer
58 views

Does a cyber-attack influence the occurrence of faults?

I am looking for opinions and point of view of experienced people on this question, as I am not able to find a lot of resources. Let me define the terms first, so that we all talk about the same ...
1
vote
1answer
61 views

How can we prevent and detect any unauthorized screen capture and recording applications?

We may all have come across capturing and recording our own screen to save some information for ourselves, but how about other people doing so without asking? Let's have an example here: an attacker ...
1
vote
2answers
56 views

File upload attack vectors when file is not saved to disk

I'm curious to know if there are any significant threats presented by files which are uploaded and read but are never saved to disk? I've read countless articles about file uploads regarding storage ...
1
vote
1answer
31 views

OpenSSL Padding Oracle. Specific Ciphers on apache2 seems a little limited

I've seen a lot of articles giving the official explanation on how to prevent OpenSSL Padding Oracles, Usually all of them state that its CBC cipher suites that leave you vulnerable. The following ...
4
votes
2answers
105 views

Is there any way to secure old unpatched Linux server?

I have to maintain very old CentOS server (not patched since 2013) for a year, until new software is developed to replace it. It holds HTTP server, mail server and many custom build apps (author gone ...
0
votes
1answer
46 views

Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?

I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails? Specially, can an attacker escape ...
1
vote
4answers
135 views

Volatile memory only computer?

I was wondering, is it possible to create a fully volatile computer, with no permanent memory at all (not even in the BIOS), that will be loaded on each boot from a read only live CD? Such that in ...
1
vote
1answer
55 views

OAuth 2 state token and protect CSRF

We are trying to build a set of REST APIs which will be authenticated by using attached ID token generated by an OAuth provider. I am trying to understand how to use the state token passed in with ...
2
votes
1answer
77 views

Unauthorized API Access Without Key Header

In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key. In order for me to send requests to this endpoint, I ...
1
vote
0answers
42 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
0
votes
2answers
137 views

Website is behaving strangely - was it attacked?

Our website was behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow. We checked apache logs and found the below ...
0
votes
0answers
52 views

What are security concerns of the predefined user in Web Application?

We use a predefined admin user in our web application. The configured password is very long and different for each installation and we have implemented brute force mitigations. What are the security ...
0
votes
0answers
31 views

How do you set private keys in putty enmasse in Windows?

In line with this question...if you have a large number of hosts, and a large number of users who service these hosts, how do you set the private keys for these hosts enmasse across the users who ...
0
votes
2answers
120 views

How to prevent buffer overflow attack?

int main(void) { char buff[15]; int pass = 0; printf("\n Enter the password : \n"); gets(buff); if (strcmp(buff, "thegeekstuff")) { printf("\n Wrong Password \n"); } ...
2
votes
1answer
35 views

Can non-malicious faults provoke malicious faults?

I am wondering about this for a long time. With the exponential raising of critical cyber-physical systems (CPS) in our all-day-life (cars, metro, UAVs, ships...), how would an attacker be able to ...
1
vote
0answers
24 views

SOP for an API specifically serving a single SPA [duplicate]

SOP (same origin policy) provides some security for the users against some attacks, but it is not very strict as it still allows you to send GET and POST requests from a different origin that APIs by ...
27
votes
5answers
8k views

I detected someone probing my site for weaknesses, what can I do about it? [duplicate]

My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
-1
votes
1answer
194 views

Timing Attacks: Against PHP Server - Prevention/Tutorials [duplicate]

What is the most simple and effective way to Prevent the Timing attacks for the programmers who use PHP? I'm a high school student, I'm new to programming and I've been learning Security since few ...
2
votes
1answer
62 views

Security implications of auto-submitting OTP?

So the question was originally asked as a part of the UX question here. My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
2
votes
1answer
327 views

Amazon EC2 Abuse Report

My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance. The email states: We observed machines under your control ...
6
votes
3answers
247 views

What is the (literally) lightest way to run a second secure system?

My goal is to have two separate systems where one is secure even if the second one is full of malware. My current approach is to have two separate laptops and the only way these two communicate with ...
1
vote
1answer
63 views

Block hex encoded requests using fail2ban

I have new web server running nginx. The default server is receiving 10K+ requests every day from Russian bots. They are clearly probing for something, but it's hard to say what since the requests ...
0
votes
1answer
231 views

How can Insertion attack ever work and fool an IDS on a TCP connection?

An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
1
vote
2answers
313 views

XSS prevention via JavaScript

I am working on a XSS prevention via Javascript. I am using the following JS-Code for that: (function () { /* XSS prevention via JavaScript */ var XSSObject = new Object(); XSSObject.lockdown = ...
2
votes
1answer
170 views

Is this code vulnerable to a CSRF attack?

I am utilizing tokens to protect from a CSRF attack but to make the "back" button still work I reuse old tokens if they are set. Does this still provide CSRF protection or can an attacker just set ...
-1
votes
1answer
135 views

Attack Surface Analyzer report possible actions [closed]

I am using Microsoft's Attack Surface Analyzer, and I would like to get a better understanding of what would be the best way to mitigate the findings. For example if in my report I get Directories ...
3
votes
0answers
75 views

Attacks on RSA without knowledge of either key

All attacks on RSA seem to require knowledge of at least the ciphertext and the public key. However, has there ever been any evidence of an attack which simply uses a sufficiently large number of ...
1
vote
0answers
61 views

Review: Security model for sync service [closed]

I am working on a sync service for my desktop app. The app tracks (with the user's consent) some computer usage data (comparable in terms of sensitivity to their browser history), so I'd like for this ...
1
vote
2answers
208 views

How to protect the Shadow Stack?

I found out that many protection mechanisms are used in computer security to ensure control-flow integrity, one of these mechanisms is the Shadow stack: The principal is very easy it ensure the ...
0
votes
2answers
77 views

Which are the most common vulnerabilities for poor crafted IoT devices? [closed]

I'm learning about securing IoT devices and starting to learn how to develop my own software for them. I wanted to know which are the most common vulnerabilities that any scriptkiddie could exploit ...
5
votes
2answers
466 views

Avoid being hacked with brute-force attack

During the last week, our company website has been under a weird brute-force, this attack actually led to hacking an admin account. Our website is a wordpress site. The attacker keeps performing POST ...
31
votes
1answer
3k views

How to prevent “cost attacks” on AWS?

Ok, so I'm using AWS and with a serverless architecture, it's very practical since AWS Lambda will run functions as microsservices and I don't have to deal with servers. Not only that, but it's also ...
1
vote
1answer
235 views

Is this usage of AES-CBC dangerous

Imagine that an attacker knows: A correct ciphertext. The algorithm: AES-256-CBC. The implementation: openssl CLI. The IV. The HMAC-SHA-256 of the ciphertext. But does not know the key (let's assume ...
4
votes
3answers
216 views

I want to hire someone on Upwork to install a bitcoin trading bot on a cloud server. What vulnerabilities should I watch out for?

Context I tried installing Tribeca (a bitcoin trading bot) myself yesterday, but messed it up somehow, as I'm not very familiar with Docker/Git/NPM/mongoDB technologies (a little knowledge is ...
1
vote
0answers
94 views

Protecting an api-token with cookie authentication only

I have a webpage that will provide an JSON object of an api-token if a valid session cookie of a logged in user is provided. If an attacker gets this api-token then they now have full control over ...
1
vote
2answers
107 views

Veracrypt - Encrypted USB Partition - Does it Pass the Key Over USB?

Looking in to Veracrypt to use it in some spaces, but more for encrypting an entire USB partition. I was curious as to how the key would be passed though. I don't want someone to be able to intercept ...
1
vote
0answers
122 views

Invalid certificate error appears on my web server for 10 minutes and then disappears

I have a raspberry pi that hosts a web server and has a DDNS registered through no-ip. I just had an issue connecting to my webserver because a certificate appeared to be installed on this server that ...
0
votes
1answer
65 views

Can an attacker add malicious instructions to a cracked Password Manager app to exfiltrate credentials ? (1Password, oneSafe, etc.)

(In OSX) Would it be possible for an attacker to add into a password manager app (cracked illegal version, downloaded from a pirate website), instructions to make the program send credentials over the ...
1
vote
0answers
308 views

Replay attack in Wi-Fi (802.11) network

I am trying to create a small smartphone activated lock for my house via Wi-Fi. The setup is like this: The solenoid of the lock is connected to an esp8266 that acts as an access point, and has an ...
6
votes
2answers
4k views

What is the best practice to store private key, salt and initialization vector in database?

I am working on java application to create a digital signature to sign a document. I already created private key and public key using (Elliptic-curve cryptography) ECC, and now I want to store both ...
5
votes
1answer
1k views

Malicious script through sql-injection

One of my customers had a problem making a post at his blog, and when I looked into the database I found out that the newsletter table (which sends emails about the blog posts) had a malicious script. ...
2
votes
2answers
619 views

Web Attack: CCTV-DVR Remote Code Execution (Node.js - Swedish string.js URL)

I have been using node.js and running live-server package in my project for a while with the following command: node node_modules/live-server/live-server.js . --ignore=\"css/sass\" --open=./ --cors ...
-3
votes
1answer
159 views

What hackers do in the darknet? [closed]

What do hackers do in the darknet? I know that there are some "hacker services" that they can make some money, but I wonder if there are more interesting things, like forums about specific targets. I'...
1
vote
1answer
1k views

“Flow” between computers (Logitech mouse)

Logitech (and possibly other) mice offer a feature called "flow": mouse can pair with uop to 3 devices (PC, handheld, ...), and can mark, copy & paste content (even files) between these 3 devices (...
0
votes
1answer
84 views

Is malware altering my destination ip

Something strange is happening to my internet requests and I don't have the knowledge to know why it's happening. I've suddenly started to be directed to google france whenever I do internet ...
6
votes
1answer
290 views

What are the security measures taken on websites that allow online scripting such as jsfiddle and codepen?

As asked in the title, I have been wondering this for a while. These sites allow the user to write scripts and store them too. Are they not vulnerable to attacks such as cross-site scripting or any ...
1
vote
2answers
479 views

Intrusion Detection System (IDS / IPS) useful for Linux home users?

Can an Intrusion Detection System or Intrusion Prevention System (IDS / IPS) increase the security of home users using Linux? Or is an IDS / IPS even less useful than antivirus for Linux? Is an IDS /...
2
votes
1answer
150 views

Unescaped data in div or p tags, but unable to exploit

A web application takes user input and displays the data, without any escaping or encoding, in div or p tags. So if I provide <script>alert(1)</script> as input, the source would look ...
7
votes
4answers
333 views

Should I be concerned about a very slow dictionary attack?

I have installed fail2ban on my mail server, and the logs show 4-5 IPs regularly hitting my server at large intervals (so not often enough to trigger the fail2ban rules): 2017-10-04 06:29:04,705 ...