Questions tagged [countermeasure]

A countermeasure is an action, process, device, or system that can prevent, or mitigate the effects of, threats to a computer, server or network.

Filter by
Sorted by
Tagged with
0 votes
1 answer
75 views

DDoS throttling vs deny actions

Recently I saw the Google Report about the DDoS Attack that they managed to stop. In the report, they said, "They chose the ‘throttle’ action over a ‘deny’ action in order to reduce chance of ...
aidCoder's user avatar
2 votes
1 answer
926 views

How can a typical researcher protect against VM escapes?

I read a similar question here on how large companies protect themselves and became intrigued about how this would transfer over to less significant operation (ie security researcher, small company, ...
belkarx's user avatar
  • 1,326
0 votes
2 answers
463 views

Is there a way to completely disable all forms of microphones/audio recording devices?

There are a variety of anti-audio recording devices out there, including white noise generators which can block audio recording equipments especially phones. What specs should I be looking for if I ...
Albert Kinterman's user avatar
0 votes
1 answer
529 views

How exactly does the detection of a cloned FIDO2 credential work?

I am trying to understand the FIDO2 standard. I know that a Relying Party has to implement a mechanism that checks the counter of the respective credentials. Most of the time, a counter is stored in ...
Konsi's user avatar
  • 3
0 votes
2 answers
172 views

How to Prevent Copying of Device Source Code in Manufacturing

Suppose you are going to mass manufacture custom circuit boards and would like the manufacturer to upload the device firmware onto these boards before shipping them out. What are some security systems/...
Marzden's user avatar
0 votes
1 answer
185 views

Can bruteforce attacks be prevented with tables of valid inputs?

Can this method of encryption prevent bruteforce attacks? If I had a hypothetical table (or function) where every grammatically valid sentence (limited to some number of words) was given an ...
Some Dinosaur's user avatar
2 votes
0 answers
348 views

Preventing DoS Attacks on NFC

There are some attack scenarios on NFC. These include e.g. Data modification, data insertion, relay attacks and DoS attacks. Just to name a few. While some of these attack scenarios are more likely ...
P_Gate's user avatar
  • 121
1 vote
1 answer
146 views

How to protect file integrity and history containing counters

I would like to create a solution that would sign the data and will have a increasing counter so I can track the number of signatures. One of the requirement is to have an increasing order of ...
user1563721's user avatar
  • 1,119
3 votes
0 answers
984 views

How is it possible that the Metasploit meterpreter can take pictures without "notifying" the user?

Im curious how the Meterpreter can take pictures from my webcam without turning on the webcam LED? Ive read that you have to write/change a driver, or a firmware, or you just change some DLLs, but ...
tester's user avatar
  • 43
1 vote
2 answers
234 views

Classification of countermeasures for family of vulnerabilities

I would like to know if anyone of you has already read about some models that would classify a set of possible countermeasures against a family of vulnerabilities. What I mean by a 'family of ...
Ecterion's user avatar
  • 103
0 votes
1 answer
262 views

Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods?

When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the ...
kelalaka's user avatar
  • 5,559
0 votes
1 answer
821 views

What kind of attack sends strings like V\x00Y\x00z\x005 and how to protect the server against these?

Revising the file access.log in a server I've noticed the classic attacks, requesting for login.php, membersHandler.ashx, etc. but this is strange to me: 198.51.100.22 - - [02/Oct/2018:02:20:20] "...
Alcides's user avatar
  • 103
-2 votes
1 answer
222 views

Is the house being spied on? [closed]

A friend of mine noticed that her ex-husband seems to be spying on her. For instance he knows about vacations they are going to take without anyone else knowing and showing up there. She already ...
juergen d's user avatar
  • 107
2 votes
2 answers
267 views

How does Amazon prevent mischief in their AWS Lambda service if I am allowed to execute code on their machine?

AWS Lambda lets me execute a piece of code on a random Linux machine it provides to me, whenever I need to run my code. What is stopping me from executing OS level commands that let me take over the ...
turnip's user avatar
  • 795
0 votes
2 answers
3k views

How effective are timestamps as a countermeasure for Replay attacks?

I was reading the Wiki entry for Replay attacks. It mentions that timestamps can be used as a countermeasure against such attacks: Timestamping is another way of preventing a replay attack. ...
turnip's user avatar
  • 795
1 vote
1 answer
196 views

Visible anti counterfeiting in a mobile app?

Looking at New Haven Line Commuters Will Soon be able to Purchase Rail Tickets with Smartphone App: When a conductor walks through the train to ask for tickets, the commuter should have their ...
chx's user avatar
  • 605
4 votes
1 answer
826 views

Storing UK bank account and sort code in MongoDB database

The company I work for has to send monthly payments to 20 to 50 users at a time. These users can change from month to month. Generally, each user will receive money from us for 2-3 months. The users ...
Daniel San's user avatar
2 votes
0 answers
214 views

Prevent NFC token from being easily copied?

From my knowledge on NFC, which isn't a lot, it seems like it would be very easy to copy an NFC token. What methods can be used to prevent people from making unauthorised copies of the NFC tokens? ...
Terry's user avatar
  • 1,115
7 votes
3 answers
3k views

What countries are at highest risk of espionage on personal devices? [closed]

When co-workers travel internationally for business there seems to be risk of bringing a regular work laptop to some countries: the risk is that the government might try to spy on the dta stored on ...
pzirkind's user avatar
  • 747
7 votes
1 answer
586 views

What is the difference between cybersecurity and information security? [closed]

I'm trying to differenciate between those two themes : cybersecurity vs information security. Broadly speaking I'd say cybersec is about network security (TCP/IP, router, firewall,...) and infosec is ...
Jason Krs's user avatar
  • 379
0 votes
1 answer
165 views

What security threats do tradesmen face in their use of IT?

I'm designing a system for tradesmen and doing research into the security issues. I have the basics covered and am now looking for more specific threats. What threats or vulnerabilities may be ...
Amy's user avatar
  • 23
2 votes
2 answers
283 views

Possible countermeasure/fix for this php exploit code?

I found this privilege escalation exploit code on the exploit-db vulnerability website and as an assignment I need to determine what countermeasure I will use to correct this exploit. As part of the ...
Osiris93's user avatar
  • 123
4 votes
3 answers
4k views

Is there any way to safely examine the contents of an SD card?

I saw this question about reading a USB stick safely, and it made me wonder about SD and microSD cards. I've been told that SD/microSD cards are safer, and that I needn't worry as much about just ...
charliegreen's user avatar
2 votes
1 answer
217 views

Audio Streaming Server associated vulnerabilities

What vulnerabilities will I be facing with during using a server as a audio streaming server? Please explain all possibilities and all need-to-know stuff. The first thing made me think of ...
Parsa Samet's user avatar
0 votes
5 answers
369 views

Automatic Password Reset - is it a good idea?

I am designing a new web application. Each user of the application has an account bound to his e-mail address. The e-mail address is also the username of the user's account. Users log in using their ...
vojta's user avatar
  • 366
0 votes
6 answers
73k views

How can I remove an unknown device from my wifi network?

I have an OnHub (from Google), and there is a device I don't know on my wifi network. Is there some way for me to kick it, or DDoS it, whether through some command line command on windows or ubuntu, ...
Nate D's user avatar
  • 191
2 votes
2 answers
229 views

When is it worthwhile to pursue a hacker?

With respect to "interactive" attacks by individuals, wherein an attacker gains access to a remote system and an IP address is necessarily exposed to the target system, is it at reasonable to pursue ...
svidgen's user avatar
  • 723
1 vote
2 answers
137 views

What's going on in this visual render of an attacker and defender in Information Security?

I'm self taught programmer and therefore an info security enthusiast, and I saw this video but I dont quite understand what's going on.Can someone please explain what's happenning, step by step in ...
J.Todd's user avatar
  • 1,310
130 votes
11 answers
73k views

Is there any way to safely examine the contents of a USB memory stick?

Suppose I found a USB memory stick lying around, and wanted to examine its contents in an attempt to locate its rightful owner. Considering that USB sticks might actually be something altogether more ...
200_success's user avatar
  • 2,144
1 vote
2 answers
3k views

Is it possible to reset digital camera shutter counter? [closed]

This is such an important counter because a lot of people use it as the only way to tell if a camera is new or second hand. I have searched through google but it looks like no one can prove this can ...
Teemo's user avatar
  • 19
6 votes
4 answers
13k views

How can I handle open ports?

After port scanning my company's network, I found a lot of open ports. What are the risks that will result out of these ports, if I left them open? And is there any way to handle them without ...
user78389's user avatar
1 vote
2 answers
696 views

Reconnaissance countermeasures

I have a lot of XMAS/NULL/SYN packets (+-1000 packets/day/server) from same IPs (+-120 differents IPs from anywhere) on multiple servers. Logs and firewalls are checked daily and servers are updated. ...
hotips's user avatar
  • 589
1 vote
1 answer
157 views

Scan interpreted code for long lines to detect code injection?

As https://security.stackexchange.com/a/11935/35886 states: the best protection against code injection is to prevent it but often you see posts on SO or here that goes like I found "long line of ...
Samuel's user avatar
  • 728
4 votes
1 answer
462 views

Why are countermeasures against control-flow hijacking attacks mostly implemented in software?

I wonder why countermeasures against code-injection and control-flow hijacking attacks (e.g. stack-based buffer overflows and heap-based buffer overflows) are mostly implemented in software. Examples ...
user3171258's user avatar
-1 votes
2 answers
238 views

Precise measurement of password complexity

I am thinking on a system, which measures the complexity of a password not based on its entropy or compressibility, but with a simply sophisticated method. The measurement of the entropy/...
peterh's user avatar
  • 3,023
1 vote
0 answers
282 views

Neutralizing or Migitating ARP spoofing once detected

I've seen a few methods to detect ARP Spoofing attacks through code(such as this), and ways to defend against these attacks through software and switches (like arp spoofing protection on LAN). How ...
Dylan Katz's user avatar
8 votes
2 answers
10k views

Best practices for verifying a users identity for helpdesk

I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted, I know ...
user2041774's user avatar
2 votes
3 answers
4k views

Have the police placed a bug on my line [closed]

As a pretty dedicated anarchist, rule-breaker and malcontent, I often find myself at odds with the British police. I have been the subject of 3 searches (that I know of) over the last 8 months (...
Under Surveillance's user avatar
3 votes
4 answers
2k views

If an ATM is stolen, how easy can the personal information of the users be recovered?

ATMs get occasionally stolen. How easy would be for the thiefs to retieve the PINs and other information of the users that have previously used the ATM? Is there a periodic wipe of all records/logs/...
Drew Lex's user avatar
  • 2,023
2 votes
2 answers
357 views

YouTube channel gone crazy!

OK, I use youtube just for listening music and watching videos. I don't upload, and I don't comment. Sometimes I do like some videos/comments. But today I accessed my channel and I saw like 20 ...
ttwis's user avatar
  • 173
0 votes
0 answers
47 views

How can I tell if I've been hacked? [duplicate]

Possible Duplicate: How can I know if I my PC is getting infected? I'm a home computer user and a programmer by profession. But my knowledge of security is embarrassingly slight. What ...
nameWithheld's user avatar
36 votes
5 answers
8k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
Tom's user avatar
  • 461
4 votes
2 answers
196 views

Automated browser-level countermeasures to look-alike login pages

For example, say an unsuspecting visitor gets a link security.stackexchange.com/.... Then it re-opens the login page, with or without an explanation as to why they have to log in again. (this is more ...
700 Software's user avatar
5 votes
3 answers
306 views

What alternatives do email services provide when an account is hacked?

I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised. For example, I have seen that if ...
user avatar
5 votes
1 answer
962 views

SQL Injection on URL, not on parameters

Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
Ihab's user avatar
  • 51
5 votes
6 answers
534 views

Spam fighting idea

I have this crazy idea that spam e-mail would not be worth the time of the senders. This is how it's going to work. Someone sets up a reputation-based site, much like stackexchange sites, where ...
Steinbitglis's user avatar
12 votes
4 answers
5k views

How should I secure a contact form that appears on every page of a website?

My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
Eric Belair's user avatar
6 votes
3 answers
611 views

Is Content Security Policy an approach that is worth to support?

Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
Hendrik Brummermann's user avatar
1 vote
2 answers
801 views

AntiXSS for ASP.NET 1.1

Unfortunately, a client of mine still has an application based on ASP.NET 1.1. Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them. ...
AviD's user avatar
  • 73.3k
1 vote
4 answers
656 views

Safely changing text links to HTML anchors

I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>. Since this is a user given ...
Andreas Arnold's user avatar