Questions tagged [automation]
The automation tag has no usage guidance.
35
questions
1
vote
0
answers
9
views
Projects similar to SCAP Security Guide
Are there any other projects similar to what SCAP Security Guide (SSG) is doing? Automated security policy compliance using Ansible playbooks and Bash scripts.
I'm trying to put my systems in ...
- 11
0
votes
0
answers
75
views
Secure method of creating sudoer password through cloud-init
We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following.
users:
- name: myuser
groups: sudo
...
1
vote
0
answers
133
views
Is Arduino Mega Hackable Over The Air
I am collecting data (by reading input registers) from a machine by RS-485 protocol and Arduino Mega 2560 hardware.
I am also sending this data from Arduino Mega to a NodeMCU which is connected to the ...
0
votes
0
answers
241
views
SQLmap automation
I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)?
The tool doesn't support ...
- 11
1
vote
1
answer
100
views
Use linux firewall rules for windows too [closed]
I'd like to improve security on my home network.
I have a PC and a laptop with Microsoft Windows as well as a PC and a laptop with Linux
There are a few HTTP services installed in the network. The ...
- 539
1
vote
1
answer
100
views
Any campus email systems automatically testing links? [duplicate]
I heard that there are some university campus email systems that "click" all the links on incoming emails and thus inadvertently unsubscribe recipients from email distribution lists if the email ...
- 2,109
2
votes
2
answers
331
views
Fetching GPG private key from Linux server to decrypt files on a Win 10 computer in production
I have a need to fetch automatically the GPG private key from a Linux server to decrypt files on a Windows 10 computer in production.
There are a few challenges here:
How to assure SCP from the ...
- 121
1
vote
0
answers
76
views
There is a difference between malware detection using automata and family behavior graph?
Is there a difference between dynamic malware detection using automata and family behavior - graph?
I think that they are both relying on API function calls but I don't understand if there is any ...
10
votes
4
answers
4k
views
Do mail servers follow links in emails as part of a security scan before inbox delivery?
I've implemented a passwordless login using a magic link and email. The link can be used only once. One customer is complaining that once they click the link, the page reports that the link is already ...
- 211
2
votes
1
answer
438
views
Network with one possible unsecure device and one home assistant device
Background:
I have a google home and I plan to buy 1 or 2 cheap cameras to monitor my home when I'm not in it. I plan to have the camera connected to a wifi plug, so I can switch it off via the app ...
- 453
1
vote
1
answer
662
views
How to set autorunscript of core commands?
I'm trying to automate scripts of an Android Metasploit payload. I can successfully automate any script on the /post module, however, I'm trying to automate geolocate, dump_calllog and others that are ...
0
votes
0
answers
45
views
looking for computer readable lists of CVE to package name sources [duplicate]
Redhat has a very nice xml containing all known CVEs and the package version they are fixed in (https://www.redhat.com/security/data/metrics/rpm-to-cve.xml).
I would like to know if any other Linux ...
- 165
9
votes
1
answer
880
views
Automatically Open LUKS Container on System Boot in a safe manner
I have a linux system running at a cloud provider where I created an encrypted container using LUKS to store personal data.
The encrypted container is manually mounted at /srv; the rest of the ...
- 1,305
2
votes
2
answers
2k
views
Pros and cons of installing security updates automatically?
I recently got into a discussion regarding automatic installation of security updates. The system is used and managed by a small nonprofit organization—essentially one or two admins managing the ...
- 357
11
votes
2
answers
12k
views
Anti-bot JavaScript library identification
I'm doing a research on anti-bot measures that websites can use to prevent automation. I came across a JavaScript library and I'm trying to identify its origin. At first I thought it's a site specific ...
- 213
3
votes
1
answer
2k
views
Port-forwarding to a web server on Raspberry Pi
I've recently created a relatively simple smart Christmas tree which is a Raspberry PI Zero W powered LED strip.
In order to control it via IFTTT webhooks, I've started a lightweight flask server on ...
- 1,565
1
vote
1
answer
284
views
Give users a powershell script to run - Secure?
Is there a secure and practical way to give a group of users a powershell script to run on their laptops?
The users all have active directory accounts, but their computers are not joined to any ...
- 153
5
votes
2
answers
685
views
Incident Responders: Can you give some examples of Incidents / types of incidents that are suitable for fully or partly automated response? [closed]
You setup security monitoring - either a full commercial SIEM/SOC or something home-cooked (e.g., rsyslog -> OSSIM / MozDef / Splunk / ...).
You also setup some rules so that some event triage is ...
- 2,648
3
votes
1
answer
339
views
IFTTT maker channel and Security Concerns
This is about IFTTT Maker Channel and security around it. They announced a new Maker Channel recently where you can receive and make web requests for automation.
For example, I can turn ON/OFF my ...
- 1
1
vote
2
answers
2k
views
How safe are the password prompts of the SafeNet eToken 5110 or similar cryptographic hardware tokens?
I'll need to use an hardware token, specifically the SafeNet eToken 5110 that comes with DigiCert's EV certificates, for code-signing on Windows.
I know that they issue a prompt to manually enter the ...
- 260
0
votes
1
answer
163
views
About Wikipedia section about Malware for AutoHotKey [closed]
I would appreciate your advice about the Wikipedia section about malware for AutoHotkey, please.
Because AutoHotkey contains many powerful automation tools, it is sometimes used to create malicious ...
- 101
1
vote
2
answers
744
views
Wireshark decrypt and save wireless packets from command line [closed]
I have a question that I can't seem to find a complete answer for. This may not be something that is possible, but I am hoping someone will have a solution.
At my work, we process wireless sniffs in ...
user143532
2
votes
3
answers
2k
views
How to tell if human is using website or automated script?
I know some websites say in their terms and services that the website can only be accessed by humans and not bots or scripts. How do they tell who is accessing? Especially with tools such as ...
- 10.1k
3
votes
3
answers
262
views
Did information technology had a increase or decrease in security with the introduction of automatic update features?
For obvious reasons we teach users
Always update... updates are good... never forget updates, et cetera!
Apart from the danger of malicious advertisements that make use of that showing users ...
- 6,337
2
votes
1
answer
581
views
What security considerations should I keep in mind when setting up home automation using IFTTT?
My next personal project is going to be setting up some basic home automation for my parents (not very tech savvy but have a potential to learn). This involves some thermostat, lighting and ...
- 3,236
2
votes
1
answer
154
views
What are proper methods to automatically detect malware and are current methods reliable? [duplicate]
What I have seen so far is the ability to automate signing hashes and string offsets as a way for an AV-engine to detect possible malware. Does this prove to be a good strategy for malware detection? ...
- 21
4
votes
1
answer
13k
views
How can I list all self-signed certificates in my stores on a Windows client?
I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
- 43
2
votes
1
answer
120
views
How can I improve and secure automated signing?
Automated signing of files, such as software packages or file backups, is inherently risky if a certain level of trust is given to it. Having signing be an automated process means that there's no user ...
- 6,745
1
vote
2
answers
1k
views
Application that uses USB token to assign user on a server
I have the following situation:
One user with a USB token certificate access a site and log-in using this certificate, the logging process ask for the USB token password;
When the user is logged he ...
- 111
3
votes
1
answer
1k
views
Automate certificate signing in Linux
In a private network I wish to automate signing for new clients/servers.
Something like this:
New client is created (dockers & etc)
The client create a new private key and a CSR
The client send ...
- 203
5
votes
1
answer
5k
views
How to detect whether a GnuPG private key has passphrase on it from a script?
I've written a script to help our developers store a copy of their private keys without a passphrase inside our Puppet tree (not committed to Git) so our Vagrant boxes can use Hiera with eyaml + gpg (...
- 151
0
votes
2
answers
3k
views
Getting the uploaded file path without knowing the uploading destination
Imagine a scenario that we are able to upload a PHP file on the server. However, we are not aware of the uploading path. I simply mean that, we are able to upload the file but we don't know where it ...
- 113
0
votes
1
answer
427
views
Automated server security testing best practices?
Is there a standard way of automatically testing the basic security of my web server? I've found a couple on-line services, (e.g. http://hackertarget.com/), and they seem ok, but I'd like to start off ...
- 131
2
votes
3
answers
134
views
How do to keep programs updated
We all know we should keep our programs up to date, after all each of them could have an unlatched security hole that was fixed in the latest update. However the average computer easily contains 200+ ...
- 353
5
votes
1
answer
616
views
Security in automated systems using Puppet and Chef
In an extremely interesting presentation at Puppet Camp London, Tomas Doran suggested a pretty radical approach for keeping everything automated by managing tons of Docker containers with Puppet.
As ...
- 6,745