Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [countermeasure]

A countermeasure is an action, process, device, or system that can prevent, or mitigate the effects of, threats to a computer, server or network.

0
votes
1answer
44 views

How to protect file integrity and history containing counters

I would like to create a solution that would sign the data and will have a increasing counter so I can track the number of signatures. One of the requirement is to have an increasing order of ...
3
votes
0answers
113 views

How is it possible that the Metasploit meterpreter can take pictures without “notifying” the user?

Im curious how the Meterpreter can take pictures from my webcam without turning on the webcam LED? Ive read that you have to write/change a driver, or a firmware, or you just change some DLLs, but ...
1
vote
1answer
32 views

Classification of countermeasures for family of vulnerabilities

I would like to know if anyone of you has already read about some models that would classify a set of possible countermeasures against a family of vulnerabilities. What I mean by a 'family of ...
0
votes
1answer
52 views

Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods?

When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the ...
0
votes
1answer
300 views

What kind of attack sends strings like V\x00Y\x00z\x005 and how to protect the server against these?

Revising the file access.log in a server I've noticed the classic attacks, requesting for login.php, membersHandler.ashx, etc. but this is strange to me: 198.51.100.22 - - [02/Oct/2018:02:20:20] "...
-2
votes
1answer
160 views

Is the house being spied on? [closed]

A friend of mine noticed that her ex-husband seems to be spying on her. For instance he knows about vacations they are going to take without anyone else knowing and showing up there. She already ...
2
votes
2answers
171 views

How does Amazon prevent mischief in their AWS Lambda service if I am allowed to execute code on their machine?

AWS Lambda lets me execute a piece of code on a random Linux machine it provides to me, whenever I need to run my code. What is stopping me from executing OS level commands that let me take over the ...
0
votes
2answers
402 views

How effective are timestamps as a countermeasure for Replay attacks?

I was reading the Wiki entry for Replay attacks. It mentions that timestamps can be used as a countermeasure against such attacks: Timestamping is another way of preventing a replay attack. ...
1
vote
1answer
128 views

Visible anti counterfeiting in a mobile app?

Looking at New Haven Line Commuters Will Soon be able to Purchase Rail Tickets with Smartphone App: When a conductor walks through the train to ask for tickets, the commuter should have their ...
4
votes
1answer
339 views

Storing UK bank account and sort code in MongoDB database

The company I work for has to send monthly payments to 20 to 50 users at a time. These users can change from month to month. Generally, each user will receive money from us for 2-3 months. The users ...
2
votes
0answers
76 views

Prevent NFC token from being easily copied?

From my knowledge on NFC, which isn't a lot, it seems like it would be very easy to copy an NFC token. What methods can be used to prevent people from making unauthorised copies of the NFC tokens? ...
7
votes
3answers
3k views

What countries are at highest risk of espionage on personal devices? [closed]

When co-workers travel internationally for business there seems to be risk of bringing a regular work laptop to some countries: the risk is that the government might try to spy on the dta stored on ...
6
votes
1answer
419 views

What is the difference between cybersecurity and information security? [closed]

I'm trying to differenciate between those two themes : cybersecurity vs information security. Broadly speaking I'd say cybersec is about network security (TCP/IP, router, firewall,...) and infosec is ...
0
votes
1answer
110 views

What security threats do tradesmen face in their use of IT?

I'm designing a system for tradesmen and doing research into the security issues. I have the basics covered and am now looking for more specific threats. What threats or vulnerabilities may be ...
2
votes
2answers
164 views

Possible countermeasure/fix for this php exploit code?

I found this privilege escalation exploit code on the exploit-db vulnerability website and as an assignment I need to determine what countermeasure I will use to correct this exploit. As part of the ...
3
votes
2answers
225 views

Is there any way to safely examine the contents of an SD card?

I saw this question about reading a USB stick safely, and it made me wonder about SD and microSD cards. I've been told that SD/microSD cards are safer, and that I needn't worry as much about just ...
3
votes
1answer
126 views

Audio Streaming Server associated vulnerabilities

What vulnerabilities will I be facing with during using a server as a audio streaming server? Please explain all possibilities and all need-to-know stuff. The first thing made me think of ...
0
votes
5answers
207 views

Automatic Password Reset - is it a good idea?

I am designing a new web application. Each user of the application has an account bound to his e-mail address. The e-mail address is also the username of the user's account. Users log in using their ...
0
votes
6answers
28k views

How can I remove an unknown device from my wifi network?

I have an OnHub (from Google), and there is a device I don't know on my wifi network. Is there some way for me to kick it, or DDoS it, whether through some command line command on windows or ubuntu, ...
3
votes
2answers
164 views

When is it worthwhile to pursue a hacker?

With respect to "interactive" attacks by individuals, wherein an attacker gains access to a remote system and an IP address is necessarily exposed to the target system, is it at reasonable to pursue ...
1
vote
2answers
85 views

What's going on in this visual render of an attacker and defender in Information Security?

I'm self taught programmer and therefore an info security enthusiast, and I saw this video but I dont quite understand what's going on.Can someone please explain what's happenning, step by step in ...
121
votes
11answers
38k views

Is there any way to safely examine the contents of a USB memory stick?

Suppose I found a USB memory stick lying around, and wanted to examine its contents in an attempt to locate its rightful owner. Considering that USB sticks might actually be something altogether more ...
1
vote
2answers
2k views

Is it possible to reset digital camera shutter counter? [closed]

This is such an important counter because a lot of people use it as the only way to tell if a camera is new or second hand. I have searched through google but it looks like no one can prove this can ...
4
votes
4answers
6k views

How can I handle open ports?

After port scanning my company's network, I found a lot of open ports. What are the risks that will result out of these ports, if I left them open? And is there any way to handle them without ...
1
vote
2answers
362 views

Reconnaissance countermeasures

I have a lot of XMAS/NULL/SYN packets (+-1000 packets/day/server) from same IPs (+-120 differents IPs from anywhere) on multiple servers. Logs and firewalls are checked daily and servers are updated. ...
1
vote
1answer
85 views

Scan interpreted code for long lines to detect code injection?

As https://security.stackexchange.com/a/11935/35886 states: the best protection against code injection is to prevent it but often you see posts on SO or here that goes like I found "long line of ...
4
votes
1answer
368 views

Why are countermeasures against control-flow hijacking attacks mostly implemented in software?

I wonder why countermeasures against code-injection and control-flow hijacking attacks (e.g. stack-based buffer overflows and heap-based buffer overflows) are mostly implemented in software. Examples ...
-1
votes
2answers
148 views

Precise measurement of password complexity

I am thinking on a system, which measures the complexity of a password not based on its entropy or compressibility, but with a simply sophisticated method. The measurement of the entropy/...
1
vote
0answers
216 views

Neutralizing or Migitating ARP spoofing once detected

I've seen a few methods to detect ARP Spoofing attacks through code(such as this), and ways to defend against these attacks through software and switches (like arp spoofing protection on LAN). How ...
7
votes
2answers
5k views

Best Practices for verifying a users identity for helpdesk

I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted I know these ...
2
votes
3answers
4k views

Have the police placed a bug on my line [closed]

As a pretty dedicated anarchist, rule-breaker and malcontent, I often find myself at odds with the British police. I have been the subject of 3 searches (that I know of) over the last 8 months (...
3
votes
4answers
1k views

If an ATM is stolen, how easy can the personal information of the users be recovered?

ATMs get occasionally stolen. How easy would be for the thiefs to retieve the PINs and other information of the users that have previously used the ATM? Is there a periodic wipe of all records/logs/...
0
votes
2answers
221 views

YouTube channel gone crazy!

OK, I use youtube just for listening music and watching videos. I don't upload, and I don't comment. Sometimes I do like some videos/comments. But today I accessed my channel and I saw like 20 ...
0
votes
0answers
40 views

How can I tell if I've been hacked? [duplicate]

Possible Duplicate: How can I know if I my PC is getting infected? I'm a home computer user and a programmer by profession. But my knowledge of security is embarrassingly slight. What ...
35
votes
5answers
7k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
3
votes
2answers
131 views

Automated browser-level countermeasures to look-alike login pages

For example, say an unsuspecting visitor gets a link security.stackexchange.com/.... Then it re-opens the login page, with or without an explanation as to why they have to log in again. (this is more ...
4
votes
3answers
252 views

What alternatives do email services provide when an account is hacked?

I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised. For example, I have seen that if ...
5
votes
1answer
786 views

SQL Injection on URL, not on parameters

Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
5
votes
6answers
430 views

Spam fighting idea

I have this crazy idea that spam e-mail would not be worth the time of the senders. This is how it's going to work. Someone sets up a reputation-based site, much like stackexchange sites, where ...
12
votes
4answers
2k views

How should I secure a contact form that appears on every page of a website?

My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
6
votes
3answers
536 views

Is Content Security Policy an approach that is worth to support?

Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
1
vote
2answers
685 views

AntiXSS for ASP.NET 1.1

Unfortunately, a client of mine still has an application based on ASP.NET 1.1. Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them. ...
1
vote
4answers
364 views

Safely changing text links to HTML anchors

I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>. Since this is a user given ...
1
vote
2answers
4k views

Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?

I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match. That seems to be somewhat of a risk, as the ...
17
votes
7answers
3k views

Best practises for preventing SQL injection?

SQL injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL injection within any web ...
19
votes
3answers
3k views

Does an ORM framework such as Hibernate completely mitigate SQL injection?

I know that to prevent all or most SQL injection attacks that you should use parametrized queries. I've been using Hibernate for a while instead of hand writing my SQL statements. Are there any known ...
22
votes
8answers
2k views

How to protect against brute forcing

How do you properly implement defenses against brute forcing? Is it best to store how many times someone tried to log in and block them after X attempts? And how would "someone" be identified? With ...