Questions tagged [defense]

Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

Filter by
Sorted by
Tagged with
2
votes
3answers
145 views

Ensuring all network services on a device use strong TLS cipher suites

(This is hypothetical, but based on a real-life problem I've had) Context: I am developing an (embedded) device which includes a few exposed network services. I'm responsible for security, not ...
-2
votes
1answer
114 views

How to block or stop redirection with window.location?

I need to block redirection using window.location on my site. Some hacker has injected a stored XSS script into my site: if(my_username != 'Name') window.location = 'https://the url'; Now each ...
0
votes
1answer
62 views

Preventing host discovery in network

With tools such as Fing (Android app) and netdiscover (Kali Linux tool) its possible to get all connected devices in network. How it's possible to prevent host discovery in a network?
-2
votes
1answer
141 views

How to protect my site from XSS

I own a chat site {https://trixac.com}. It uses BoomChat's code. Recently I banned a troll and now he is back and hes running XSS injections against my site and it's working for some odd reason. I've ...
1
vote
2answers
164 views

If I turn off Windows Defender Credential Manager off in Windows 10 so I can run a virtual machine in Virtual Box, is that a bad idea?

My processor is supposed to support virtualization: cpu.inf:5f63e534115a322c:IntelPPM_Inst.NT:10.0.17134.765:ACPI\GenuineIntel_-_Intel64 ACPI\GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_37_-_INTEL(R)_CORE(...
6
votes
2answers
221 views

Suppose antivirus provider turned malicious: What do we do?

It was recently reported that the hacking group Fxmsp "...claimed to have secured access to three leading antivirus companies," and that they "...extracted sensitive source code from antivirus ...
5
votes
2answers
353 views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
0
votes
0answers
115 views

How do hacking groups get a license anonymously for threat emulation software like Cobalt Strike?

I've seen that a lot of hacking groups replicate techniques and attacks from red teams using software like Cobalt Strike and Powershell frameworks for offensive security and red teaming like Nishang ...
2
votes
0answers
59 views

Is “active defense” against attackers a real thing, or an invention of movies? [closed]

In movies hacking is depicted as a weird sort of game. When you detect someone attacking your server, you face them head on. To me, it sounds like your best bet would be to just shut down the server ...
0
votes
1answer
79 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...
5
votes
3answers
165 views

How to do TLS on embedded devices in a home network?

If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
2
votes
2answers
87 views

Does red-teaming encompass the entire skillset of a blue-teamer?

Currently I am potentially facing impostor syndrome in regards to the role and skillset of blue team members (defence) and red team members (attack). I personally specialise in defence capabilities, ...
1
vote
1answer
145 views

Explaining malware avoidance tactics

Most "how tos" regarding malware list this: Install Antivirus software. Install latest antivirus software. Run antivirus software regularly. Install latest operating system. Install any patches to ...
19
votes
4answers
5k views

Is strategic cyber-warfare feasible today?

Cyber attacks that target a nation's infrastructure are a documented fact and as such a danger that political and military leadership across the world needs to worry about and act proactively. These ...
0
votes
1answer
106 views

SSH: Best practice for PublicKey Authentication from multiple Devices

I have a Server I want to access via ED2559 PublicKey Authentication. How would one do it so it is as safe as possible from multiple devices? Should I add multiple PublicKeys to my Server or should I ...
1
vote
3answers
501 views

Is it better to rate limit API requests based on UserId or IP address for authenticated users?

I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP ...
27
votes
4answers
9k views

I detected someone probing my site for weaknesses, what can I do about it? [duplicate]

My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
2
votes
1answer
89 views

Is there any defense against this kind of attacks? (key comparison attack, or something)

is there any defense against this kind of attack? https://youtu.be/7U-RbOKanYs?t=974 I know someone who uses a password encryption hashing that generates the same length of keys as in this video and ...
1
vote
2answers
862 views

Trip to China - safeguarding phone and laptop

I am going to China for a 2 week vacation in a month I will be taking a Google Pixel with a Verizon SIM and using it while there. I assume that if I don't use a local SIM, it would be difficult for ...
1
vote
1answer
48 views

Is there any way to estimate the safety of arbitrary binaries, which are usually released with unofficial patches?

Frequent scenario: An old game is released on GOG / Steam. It proves to be incompatible with new Windows systems. (Crashes, game breaking bugs, fps of 0.5 and the likes) An unofficial patch is ...
4
votes
3answers
451 views

How much of a visible deterrent is IT security?

While looking at this question, one of the comments made me think. In the comment, the user asserted that "one must invest a lock that cost $40, the insurance company just want to make sure that it ...
89
votes
10answers
20k views

Does it improve security to use obscure port numbers?

I recently started a job at a small company where the CTO prefers to host SSH services at obscure, high numbered ports on our servers rather than the well known port 22. His rationale is that "it ...
5
votes
3answers
3k views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
3
votes
1answer
142 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
0
votes
2answers
276 views

encryption - how to secure files - decrypting exposes them on ssd

Let's say I have an encrypted file. Now I decrypt it but since my computer only has ssd, i decrypt it on the ssd drive. Say, I make changes or I finish using the decrypted file so I encrypt it again. ...
13
votes
1answer
4k views

Is my iPhone being targeted by the US Department of Defense?

Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious ...
23
votes
2answers
3k views

Rude neighbor with PineAP or something similar

For the past week or so I've been having problems with wifi in my house, and it appears that my neighbor set up a Pineapple or something similar that is running a known beacon attack and/or Karma/...
0
votes
1answer
294 views

With an IPS in place, do we really need firewalls?

I was reading the article "Do you need an IDS or IPS, or both?" on TechTarget. While reading the author's explanation of IPS this question hit me. If an IPS is a control tool that uses a set of ...
1
vote
1answer
2k views

Do I need to disable TLS 1.0 altogether? [duplicate]

We recently went through a third party review of our systems where the consultants have reported a finding that we have TLSv1.0 enabled. In the report they are referring to this NIST document which ...
0
votes
2answers
115 views

Is restricting access to file content a way of securing sensible but day to day needed information from 3rd party software?

To clarify this directly. I mean what if every (even malicious) 3rd party software running on this OS gets never access to its data and rather 'describes' what to do with? So for example 'here at ...
12
votes
2answers
4k views

Is there a test for KRACK (devices and routers)?

After Heartbleed was announced, a number of tests popped up that let me test if a server I was connecting to was patched, unpatched or unknown. For example, https://filippo.io/Heartbleed/ Is such a ...
-1
votes
1answer
87 views

Why aren't more wifi points compromised? [closed]

Especially in light of the recent KRACK problem. Wifi has been compromised before; and undoubtedly it will again. So I have to wonder, why don't criminal organizations travel around major cities, ...
1
vote
6answers
241 views

What is the best way to defend against an already comprised computer with a keylogger that is active?

I'm curious to what are the possible solutions to defending against a comprised computer with a key logger installed. Assume you had to login to a site with a user / password and there's no way to ...
4
votes
2answers
63 views

Is There an Analogous Agency to OSHA but for Bad Data/Security Practices?

I ran into an old coworker and we were both discussing some of the bad practices our old workplace(that dealt with very sensitive data) had and looking back some of them are really bad and probably ...
0
votes
1answer
69 views

Best practices with respect to hard drive reconstruction

I would like to be able to store encrypted information on my computer, that no one else is able to read without the right password, even if they have complete access to the computer. There are of ...
1
vote
1answer
429 views

IAT Hooking questions?

I have researched IAT hooking by malware and i still have a few questions: If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a ...
19
votes
4answers
3k views

What lessons can be learned from the latest spate of Ransomware attacks? [closed]

I'm not sure this is the right place, but figured people would find it useful if they aren't too familiar with security policies and general best practices. There is a lot of information out there, ...
2
votes
1answer
829 views

SIEM Alien Vault recommended method for muting noise

I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that ...
0
votes
1answer
82 views

How to enforce software updates on workstations?

There are many workstations on the company network with various kind of software installed: web browsers, OpenVPN clients, remote management agents, encryption utilities and other tools. Some of the ...
0
votes
2answers
2k views

How to detect if someone is using airmon-ng [Aircrack-ng] in my wi-fi network

Using the Linux Kali distribution, I was able to get the password from my wifi network using the airmon-ng [Aircrack-ng] tool. However, how can I find out if someone is doing this on my network?
2
votes
1answer
115 views

Ads on Checkout a Bad Idea™?

Is it a categorically bad practice to run third-party aggregated ads on a checkout page where sensitive information is entered? This sends of all kinds of alarm bells for me, but I've had a ...
1
vote
1answer
63 views

Best practice / Risk Assessment payment websites

I have two websites which do both accept payments on a subdomain. The subdomain is an independent system from the main website. I have a question regarding the best practice to decide which of the ...
1
vote
1answer
93 views

How to use encrypted internal strings and config? [duplicate]

I was reading the CIA leaked documents on wikileaks, I saw in their "best practices" section that it was advised to encrypt all strings and config information and to de-crypt in memory when needed. ...
0
votes
1answer
100 views

Network Defense- White listing IPs/Ports

If I had a typical home user machine (google, email, youtube, no ssh/ftp, etc...) that had a dynamic iptables white-list that was dynamically updated with IP addresses that have been legitimately been ...
-1
votes
1answer
472 views

How many security questions should be asked? [closed]

We currently use 5 security questions but Operations team is asking us if we could lower down to 3. With that,What is the best practice for this one? How many security questions should be asked?
9
votes
5answers
334 views

Could ransomware be stalled while encrypting?

I have been reading about ransomware, and I was wondering if it could be defended against by having certain "trap" files on a drive. Sometimes I look through Code Golf and am thoroughly impressed by ...
1
vote
1answer
105 views

How to convince someone to use layered security?

Layered security, also known as layered defense, describes the practice of combining multiple mitigating security controls to protect resources and data. How to convince someone to use layered ...
1
vote
2answers
340 views

Relay attack against Captcha

I am implementing a website that included my own text Captcha (I do not use any Captcha service - like reCaptcha). the Captcha code serves each challenge (i.e. image) only once for both display and ...
2
votes
1answer
417 views

Potential HTTP Host header attack from malicious IP, what does it mean in practical terms for me? Should I be concerned?

I'm asking about an error I've got a few times in the past day, outside of the theoretical. I'm wondering what may be actually happening in my case. The error comes from Sentry, on my ubuntu/nginx/...
0
votes
1answer
173 views

Locking down Ubuntu

A competition is coming up at my school for securing computers and my OS for this challenge is Ubuntu. I'm trying to think of things to add to my list of security measures and things to look out for. ...