Questions tagged [defense]

Defense is the use of security countermeasures to protect the integrity of the information assets in an IT system and/or infrastructure.

Filter by
Sorted by
Tagged with
0
votes
1answer
101 views

Is my Java code still vulnerable to SQL injection? [duplicate]

We have a Java web application that was vulnerable to blind SQL injection attacks. Our developers fixed the code by using the replaceAll() function to convert single quotes to two single quotes. I am ...
3
votes
3answers
233 views

Why is a fully-patched OS less important than AV?

How to explain to traditional people why they should upgrade their old Windows XP device? <- The interesting point made in the highest upvoted answer to this Q is that a fully patched OS is largely ...
1
vote
0answers
38 views

Name of security measure that shows user a personal word / phrase / drawing [duplicate]

I remember a security measure I've seen on a few sites in the past against phishing, but I don't know what it's called. When the user logs in, or just inputs their username, the site shows some kind ...
3
votes
1answer
134 views

How to detect backdoor/root shells?

Let's assume I'm a user with root access to a machine and I'm a legit user. My machine/server runs Linux. I'm not very familiar with defensive security (I mainly practice offensive). Sometimes, ...
2
votes
1answer
150 views

What do I do if I catch someone doing a physical pentest? [duplicate]

This question was primarily inspired by this (related) question, but is about the other side of the equation. I'm a security engineer at Medium Sized Company, Inc. We recently hired John for a ...
2
votes
2answers
241 views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
102
votes
19answers
15k views

How to explain to traditional people why they should upgrade their old Windows XP device?

This is an issue I'm recurringly facing: older people from my family (or people who my family members know) can be surprisingly reluctant to apply most basic security measures when they're using their ...
4
votes
1answer
357 views

How secure is connecting to the Internet via Windows XP (or even older) nowadays only for e-mail?

While trying (and failing) to convice a certain older person who wanted me to "fix" their ~20 years old PC that they should not be connecting to the Internet with whatever version of Windows they have ...
3
votes
2answers
142 views

How do attacks on web browsers succeed? [closed]

We all know that attacks on web browsers are entirely possible. This includes attacks such as drive-by downloads, MITB (man-in-the-browser) attacks and keylogger browser plugins/extensions. However, ...
1
vote
2answers
115 views

Most secure algorithms for KDF and Public Key Encryption [duplicate]

I'm developing an application which will need to derive a private/public key pair from a user provided password, and then use the public key to encrypt some text (up to 1000 characters in length) such ...
1
vote
0answers
38 views

OS and Password Manager - How to Manage Multiple Credentials

This question is about best practices, and not necessarily my how I manage my current setup. I have these two scenarios, macOS Mojave with KeepassXC, and Windows 7 + Android 8.0.0 with SafeInCloud. ...
2
votes
3answers
196 views

Ensuring all network services on a device use strong TLS cipher suites

(This is hypothetical, but based on a real-life problem I've had) Context: I am developing an (embedded) device which includes a few exposed network services. I'm responsible for security, not ...
-2
votes
1answer
153 views

How to block or stop redirection with window.location?

I need to block redirection using window.location on my site. Some hacker has injected a stored XSS script into my site: if(my_username != 'Name') window.location = 'https://the url'; Now each ...
0
votes
1answer
100 views

Preventing host discovery in network

With tools such as Fing (Android app) and netdiscover (Kali Linux tool) its possible to get all connected devices in network. How it's possible to prevent host discovery in a network?
-2
votes
1answer
167 views

How to protect my site from XSS

I own a chat site {https://trixac.com}. It uses BoomChat's code. Recently I banned a troll and now he is back and hes running XSS injections against my site and it's working for some odd reason. I've ...
2
votes
2answers
330 views

If I turn off Windows Defender Credential Manager off in Windows 10 so I can run a virtual machine in Virtual Box, is that a bad idea?

My processor is supposed to support virtualization: cpu.inf:5f63e534115a322c:IntelPPM_Inst.NT:10.0.17134.765:ACPI\GenuineIntel_-_Intel64 ACPI\GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_37_-_INTEL(R)_CORE(...
6
votes
2answers
231 views

Suppose antivirus provider turned malicious: What do we do?

It was recently reported that the hacking group Fxmsp "...claimed to have secured access to three leading antivirus companies," and that they "...extracted sensitive source code from antivirus ...
5
votes
2answers
766 views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
0
votes
0answers
158 views

How do hacking groups get a license anonymously for threat emulation software like Cobalt Strike?

I've seen that a lot of hacking groups replicate techniques and attacks from red teams using software like Cobalt Strike and Powershell frameworks for offensive security and red teaming like Nishang ...
2
votes
0answers
61 views

Is “active defense” against attackers a real thing, or an invention of movies? [closed]

In movies hacking is depicted as a weird sort of game. When you detect someone attacking your server, you face them head on. To me, it sounds like your best bet would be to just shut down the server ...
0
votes
1answer
84 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...
5
votes
3answers
225 views

How to do TLS on embedded devices in a home network?

If you have a router or webcam with a web interface on a home network, can the connection between the browser and the device be secured against a man in the middle attacker? What should device ...
2
votes
2answers
117 views

Does red-teaming encompass the entire skillset of a blue-teamer?

Currently I am potentially facing impostor syndrome in regards to the role and skillset of blue team members (defence) and red team members (attack). I personally specialise in defence capabilities, ...
1
vote
1answer
164 views

Explaining malware avoidance tactics

Most "how tos" regarding malware list this: Install Antivirus software. Install latest antivirus software. Run antivirus software regularly. Install latest operating system. Install any patches to ...
19
votes
4answers
5k views

Is strategic cyber-warfare feasible today?

Cyber attacks that target a nation's infrastructure are a documented fact and as such a danger that political and military leadership across the world needs to worry about and act proactively. These ...
0
votes
1answer
118 views

SSH: Best practice for PublicKey Authentication from multiple Devices

I have a Server I want to access via ED2559 PublicKey Authentication. How would one do it so it is as safe as possible from multiple devices? Should I add multiple PublicKeys to my Server or should I ...
1
vote
3answers
784 views

Is it better to rate limit API requests based on UserId or IP address for authenticated users?

I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP ...
27
votes
4answers
9k views

I detected someone probing my site for weaknesses, what can I do about it? [duplicate]

My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
2
votes
1answer
102 views

Is there any defense against this kind of attacks? (key comparison attack, or something)

is there any defense against this kind of attack? https://youtu.be/7U-RbOKanYs?t=974 I know someone who uses a password encryption hashing that generates the same length of keys as in this video and ...
1
vote
2answers
2k views

Trip to China - safeguarding phone and laptop

I am going to China for a 2 week vacation in a month I will be taking a Google Pixel with a Verizon SIM and using it while there. I assume that if I don't use a local SIM, it would be difficult for ...
1
vote
1answer
54 views

Is there any way to estimate the safety of arbitrary binaries, which are usually released with unofficial patches?

Frequent scenario: An old game is released on GOG / Steam. It proves to be incompatible with new Windows systems. (Crashes, game breaking bugs, fps of 0.5 and the likes) An unofficial patch is ...
4
votes
3answers
470 views

How much of a visible deterrent is IT security?

While looking at this question, one of the comments made me think. In the comment, the user asserted that "one must invest a lock that cost $40, the insurance company just want to make sure that it ...
91
votes
10answers
21k views

Does it improve security to use obscure port numbers?

I recently started a job at a small company where the CTO prefers to host SSH services at obscure, high numbered ports on our servers rather than the well known port 22. His rationale is that "it ...
5
votes
3answers
4k views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
3
votes
1answer
160 views

Duo Security forgot password workflow

I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking ...
1
vote
2answers
426 views

encryption - how to secure files - decrypting exposes them on ssd

Let's say I have an encrypted file. Now I decrypt it but since my computer only has ssd, i decrypt it on the ssd drive. Say, I make changes or I finish using the decrypted file so I encrypt it again. ...
13
votes
1answer
4k views

Is my iPhone being targeted by the US Department of Defense?

Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious ...
23
votes
2answers
4k views

Rude neighbor with PineAP or something similar

For the past week or so I've been having problems with wifi in my house, and it appears that my neighbor set up a Pineapple or something similar that is running a known beacon attack and/or Karma/...
0
votes
1answer
316 views

With an IPS in place, do we really need firewalls?

I was reading the article "Do you need an IDS or IPS, or both?" on TechTarget. While reading the author's explanation of IPS this question hit me. If an IPS is a control tool that uses a set of ...
1
vote
1answer
2k views

Do I need to disable TLS 1.0 altogether? [duplicate]

We recently went through a third party review of our systems where the consultants have reported a finding that we have TLSv1.0 enabled. In the report they are referring to this NIST document which ...
0
votes
2answers
115 views

Is restricting access to file content a way of securing sensible but day to day needed information from 3rd party software?

To clarify this directly. I mean what if every (even malicious) 3rd party software running on this OS gets never access to its data and rather 'describes' what to do with? So for example 'here at ...
12
votes
2answers
4k views

Is there a test for KRACK (devices and routers)?

After Heartbleed was announced, a number of tests popped up that let me test if a server I was connecting to was patched, unpatched or unknown. For example, https://filippo.io/Heartbleed/ Is such a ...
-1
votes
1answer
88 views

Why aren't more wifi points compromised? [closed]

Especially in light of the recent KRACK problem. Wifi has been compromised before; and undoubtedly it will again. So I have to wonder, why don't criminal organizations travel around major cities, ...
1
vote
6answers
270 views

What is the best way to defend against an already comprised computer with a keylogger that is active?

I'm curious to what are the possible solutions to defending against a comprised computer with a key logger installed. Assume you had to login to a site with a user / password and there's no way to ...
4
votes
2answers
64 views

Is There an Analogous Agency to OSHA but for Bad Data/Security Practices?

I ran into an old coworker and we were both discussing some of the bad practices our old workplace(that dealt with very sensitive data) had and looking back some of them are really bad and probably ...
0
votes
1answer
70 views

Best practices with respect to hard drive reconstruction

I would like to be able to store encrypted information on my computer, that no one else is able to read without the right password, even if they have complete access to the computer. There are of ...
1
vote
1answer
464 views

IAT Hooking questions?

I have researched IAT hooking by malware and i still have a few questions: If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a ...
19
votes
4answers
3k views

What lessons can be learned from the latest spate of Ransomware attacks? [closed]

I'm not sure this is the right place, but figured people would find it useful if they aren't too familiar with security policies and general best practices. There is a lot of information out there, ...
2
votes
1answer
898 views

SIEM Alien Vault recommended method for muting noise

I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that ...
0
votes
1answer
83 views

How to enforce software updates on workstations?

There are many workstations on the company network with various kind of software installed: web browsers, OpenVPN clients, remote management agents, encryption utilities and other tools. Some of the ...

1 2 3 4 5