Questions tagged [defense]

Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

Filter by
Sorted by
Tagged with
-3
votes
1answer
84 views

How am I supposed to check Defender's capability when it trusts me blindly after I mark a test malware file as “allowed”?

With enormous amounts of fighting with Windows/Microsoft Defender, I finally managed to download the "test virus" file from https://www.ikarussecurity.com/en/private-customers/download-test-...
0
votes
1answer
47 views

How to guarantee only my client application can request a nonce?

I have a web site and a service in a server. I'm developing the "Register User" and "Login" components. I've searched on the internet and I've found two protocols to login user ...
0
votes
2answers
59 views

What is the best way to mitigate malicious bot traffic on a Node Express server?

My public website is getting a lot of get requests to endpoints like "wp-login.php", ".env", ".git/HEAD" and many others. This seems to be a non-trivial portion of my website's traffic and I'd like to ...
0
votes
1answer
103 views

How to store encrypted notes in a public git repository?

I save my notes in a git repository in plaintext (markdown). Currently, the remote repository is another computer in my appartment. I am thinking about moving this remote repository to a remote server....
1
vote
0answers
41 views

Whether ISPs provide path of Spoofed SYN Flood attack is the only way to trace the attack source?

The attacker spoofs SYN packets to attack a server. In this document: Spoofed Attack: A malicious user can also spoof the IP address on each SYN packet they send in order to inhibit mitigation ...
0
votes
1answer
122 views

Is my Java code still vulnerable to SQL injection? [duplicate]

We have a Java web application that was vulnerable to blind SQL injection attacks. Our developers fixed the code by using the replaceAll() function to convert single quotes to two single quotes. I am ...
3
votes
3answers
246 views

Why is a fully-patched OS less important than AV?

How to explain to traditional people why they should upgrade their old Windows XP device? <- The interesting point made in the highest upvoted answer to this Q is that a fully patched OS is largely ...
1
vote
0answers
38 views

Name of security measure that shows user a personal word / phrase / drawing [duplicate]

I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
3
votes
1answer
145 views

How to detect backdoor/root shells?

Let's assume I'm a user with root access to a machine and I'm a legit user. My machine/server runs Linux. I'm not very familiar with defensive security (I mainly practice offensive). Sometimes, ...
2
votes
1answer
159 views

What do I do if I catch someone doing a physical pentest? [duplicate]

This question was primarily inspired by this (related) question, but is about the other side of the equation. I'm a security engineer at Medium Sized Company, Inc. We recently hired John for a ...
2
votes
2answers
279 views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
102
votes
19answers
15k views

How to explain to traditional people why they should upgrade their old Windows XP device?

This is an issue I'm recurringly facing: older people from my family (or people who my family members know) can be surprisingly reluctant to apply most basic security measures when they're using their ...
4
votes
1answer
380 views

How secure is connecting to the Internet via Windows XP (or even older) nowadays only for e-mail?

While trying (and failing) to convice a certain older person who wanted me to "fix" their ~20 years old PC that they should not be connecting to the Internet with whatever version of Windows they have ...
3
votes
2answers
215 views

How do attacks on web browsers succeed? [closed]

We all know that attacks on web browsers are entirely possible. This includes attacks such as drive-by downloads, MITB (man-in-the-browser) attacks and keylogger browser plugins/extensions. However, ...
1
vote
2answers
182 views

Most secure algorithms for KDF and Public Key Encryption [duplicate]

I'm developing an application which will need to derive a private/public key pair from a user provided password, and then use the public key to encrypt some text (up to 1000 characters in length) such ...
1
vote
0answers
39 views

OS and Password Manager - How to Manage Multiple Credentials

This question is about best practices, and not necessarily my how I manage my current setup. I have these two scenarios, macOS Mojave with KeepassXC, and Windows 7 + Android 8.0.0 with SafeInCloud. ...
2
votes
3answers
208 views

Ensuring all network services on a device use strong TLS cipher suites

(This is hypothetical, but based on a real-life problem I've had) Context: I am developing an (embedded) device which includes a few exposed network services. I'm responsible for security, not ...
-2
votes
1answer
441 views

How to block or stop redirection with window.location?

I need to block redirection using window.location on my site. Some hacker has injected a stored XSS script into my site: if(my_username != 'Name') window.location = 'https://the url'; Now each ...
0
votes
1answer
113 views

Preventing host discovery in network

With tools such as Fing (Android app) and netdiscover (Kali Linux tool) its possible to get all connected devices in network. How it's possible to prevent host discovery in a network?
-2
votes
1answer
174 views

How to protect my site from XSS

I own a chat site {https://trixac.com}. It uses BoomChat's code. Recently I banned a troll and now he is back and hes running XSS injections against my site and it's working for some odd reason. I've ...
2
votes
2answers
400 views

If I turn off Windows Defender Credential Manager off in Windows 10 so I can run a virtual machine in Virtual Box, is that a bad idea?

My processor is supposed to support virtualization: cpu.inf:5f63e534115a322c:IntelPPM_Inst.NT:10.0.17134.765:ACPI\GenuineIntel_-_Intel64 ACPI\GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_37_-_INTEL(R)_CORE(...
6
votes
2answers
241 views

Suppose antivirus provider turned malicious: What do we do?

It was recently reported that the hacking group Fxmsp "...claimed to have secured access to three leading antivirus companies," and that they "...extracted sensitive source code from antivirus ...
5
votes
2answers
1k views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
0
votes
0answers
186 views

How do hacking groups get a license anonymously for threat emulation software like Cobalt Strike?

I've seen that a lot of hacking groups replicate techniques and attacks from red teams using software like Cobalt Strike and Powershell frameworks for offensive security and red teaming like Nishang ...
2
votes
0answers
62 views

Is “active defense” against attackers a real thing, or an invention of movies? [closed]

In movies hacking is depicted as a weird sort of game. When you detect someone attacking your server, you face them head on. To me, it sounds like your best bet would be to just shut down the server ...
0
votes
1answer
88 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...
5
votes
3answers
257 views

How to do TLS on embedded devices in a home network?

If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
2
votes
2answers
138 views

Does red-teaming encompass the entire skillset of a blue-teamer?

Currently I am potentially facing impostor syndrome in regards to the role and skillset of blue team members (defence) and red team members (attack). I personally specialise in defence capabilities, ...
1
vote
1answer
176 views

Explaining malware avoidance tactics

Most "how tos" regarding malware list this: Install Antivirus software. Install latest antivirus software. Run antivirus software regularly. Install latest operating system. Install any patches to ...
19
votes
4answers
5k views

Is strategic cyber-warfare feasible today?

Cyber attacks that target a nation's infrastructure are a documented fact and as such a danger that political and military leadership across the world needs to worry about and act proactively. These ...
0
votes
1answer
123 views

SSH: Best practice for PublicKey Authentication from multiple Devices

I have a Server I want to access via ED2559 PublicKey Authentication. How would one do it so it is as safe as possible from multiple devices? Should I add multiple PublicKeys to my Server or should I ...
2
votes
3answers
1k views

Is it better to rate limit API requests based on UserId or IP address for authenticated users?

I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP ...
27
votes
4answers
9k views

I detected someone probing my site for weaknesses, what can I do about it? [duplicate]

My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
2
votes
1answer
116 views

Is there any defense against this kind of attacks? (key comparison attack, or something)

is there any defense against this kind of attack? https://youtu.be/7U-RbOKanYs?t=974 I know someone who uses a password encryption hashing that generates the same length of keys as in this video and ...
1
vote
2answers
2k views

Trip to China - safeguarding phone and laptop

I am going to China for a 2 week vacation in a month I will be taking a Google Pixel with a Verizon SIM and using it while there. I assume that if I don't use a local SIM, it would be difficult for ...
1
vote
1answer
54 views

Is there any way to estimate the safety of arbitrary binaries, which are usually released with unofficial patches?

Frequent scenario: An old game is released on GOG / Steam. It proves to be incompatible with new Windows systems. (Crashes, game breaking bugs, fps of 0.5 and the likes) An unofficial patch is ...
4
votes
3answers
477 views

How much of a visible deterrent is IT security?

While looking at this question, one of the comments made me think. In the comment, the user asserted that "one must invest a lock that cost $40, the insurance company just want to make sure that it ...
91
votes
10answers
22k views

Does it improve security to use obscure port numbers?

I recently started a job at a small company where the CTO prefers to host SSH services at obscure, high numbered ports on our servers rather than the well known port 22. His rationale is that "it ...
5
votes
3answers
5k views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
3
votes
1answer
160 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
1
vote
2answers
494 views

encryption - how to secure files - decrypting exposes them on ssd

Let's say I have an encrypted file. Now I decrypt it but since my computer only has ssd, i decrypt it on the ssd drive. Say, I make changes or I finish using the decrypted file so I encrypt it again. ...
13
votes
1answer
5k views

Is my iPhone being targeted by the US Department of Defense?

Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious ...
23
votes
2answers
4k views

Rude neighbor with PineAP or something similar

For the past week or so I've been having problems with wifi in my house, and it appears that my neighbor set up a Pineapple or something similar that is running a known beacon attack and/or Karma/...
0
votes
1answer
326 views

With an IPS in place, do we really need firewalls?

I was reading the article "Do you need an IDS or IPS, or both?" on TechTarget. While reading the author's explanation of IPS this question hit me. If an IPS is a control tool that uses a set of ...
1
vote
1answer
2k views

Do I need to disable TLS 1.0 altogether? [duplicate]

We recently went through a third party review of our systems where the consultants have reported a finding that we have TLSv1.0 enabled. In the report they are referring to this NIST document which ...
0
votes
2answers
115 views

Is restricting access to file content a way of securing sensible but day to day needed information from 3rd party software?

To clarify this directly. I mean what if every (even malicious) 3rd party software running on this OS gets never access to its data and rather 'describes' what to do with? So for example 'here at ...
12
votes
2answers
4k views

Is there a test for KRACK (devices and routers)?

After Heartbleed was announced, a number of tests popped up that let me test if a server I was connecting to was patched, unpatched or unknown. For example, https://filippo.io/Heartbleed/ Is such a ...
-1
votes
1answer
88 views

Why aren't more wifi points compromised? [closed]

Especially in light of the recent KRACK problem. Wifi has been compromised before; and undoubtedly it will again. So I have to wonder, why don't criminal organizations travel around major cities, ...
1
vote
6answers
309 views

What is the best way to defend against an already comprised computer with a keylogger that is active?

I'm curious to what are the possible solutions to defending against a comprised computer with a key logger installed. Assume you had to login to a site with a user / password and there's no way to ...
4
votes
2answers
64 views

Is There an Analogous Agency to OSHA but for Bad Data/Security Practices?

I ran into an old coworker and we were both discussing some of the bad practices our old workplace(that dealt with very sensitive data) had and looking back some of them are really bad and probably ...

1
2 3 4 5