Skip to main content
238 votes
Accepted

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

Before I tear your idea apart, let me say that it's a really interesting idea and it was super fun to think about. Please continue to think outside the box and ask interesting questions! Alright, let'...
Mike Ounsworth's user avatar
91 votes

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

Mike's answer says basically everything I have to offer about why this is a bad idea from a development perspective (and, as Ghedipunk's comment says, an unusable security feature provides no security)...
CBHacking's user avatar
  • 49.6k
81 votes
Accepted

Someone knows my IP and is threatening to DDoS me

ISP's have ways of dealing with DDoS attacks targeting one or more IP addresses on their network. See How can ISPs handle DDoS attacks? for some interesting reading on this subject. What you are ...
mti2935's user avatar
  • 23.7k
78 votes
Accepted

Security implication of telling the user they can't login because of too many attempts from IP

Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. On the other hand, not telling a ...
Arminius's user avatar
  • 44.9k
65 votes

I detected someone probing my site for weaknesses, what can I do about it?

Welcome to the internet! This is the normal situation, business as usual. You don't have to do anything, but to harden your website. Probes like that occurs all the time, on every site, day and night....
ThoriumBR's user avatar
  • 54.6k
46 votes

Someone knows my IP and is threatening to DDoS me

Contact your ISP’s security team and explain your situation. They should be able to help you change your IP to a new address.
John Deters's user avatar
  • 34.3k
46 votes
Accepted

Does rebooting a phone daily increase your phone's security?

Rebooting a phone regularly helps cleaning non-persistent malware, i.e., malware that only exist in memory – and non-persistent malware alone, as explained in Paul Ducklin's Sophos blog article on the ...
Esa Jokinen's user avatar
  • 19.1k
44 votes
Accepted

Barcodes as an attack vector?

Yes, barcode scanners present a potential vulnerability. You need to prevent attacks from this vector in the same way you'd prevent attacks from any input vector, such as a network connection or a ...
John Deters's user avatar
  • 34.3k
41 votes

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

What things can be done to prevent sudden rogue insiders from negatively impacting essential infrastructure using techniques they're privileged to do? In practice, very little. But to explain ...
gowenfawr's user avatar
  • 73k
38 votes
Accepted

How can I publish data from a private network without adding a bidirectional link to another network

You can use a serial port. By default there are two data lines, one per each direction, plus a ground wire (which is irrelevant here). By disconnecting the appropriate line you can prevent ...
André Borie's user avatar
  • 12.8k
33 votes
Accepted

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

Two-man rule - configure your systems so that all privileged access requires two people. This could be a physical control - privileged access can only come from the NOC, and inside the NOC people ...
paj28's user avatar
  • 33.8k
32 votes
Accepted

How to prevent "cost attacks" on AWS?

AWS allows you to set budgets, and alarms based on your current rate of spending. Those would be useful to control your spending. In theory, you could also set billing-based automation to start ...
nbering's user avatar
  • 4,028
30 votes

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

If your objective is to deprive an attacker of ls and cat, there's an even better alternative to obfuscation: just don't install those utilities. While I wouldn't say this is a widely implement ...
Phil Frost's user avatar
27 votes

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

One approach is to accept that rogue actions cannot be prevented and focus on making sure the damage can be repaired. For example, make sure the routers have a separate control plane via which they ...
Daniel Darabos's user avatar
26 votes

Someone knows my IP and is threatening to DDoS me

Not enough information for a qualified answer. I will make some assumptions and spell them out. Basic assumption: You actually care about being DDoS'ed (you earn money doing live streams or something)....
Tom's user avatar
  • 10.6k
23 votes
Accepted

Vim Modeline Vulnerabilities

Although in theory modelines shouldn't allow you to do anything bad, sanitizing modeline functions input is hard. There have been several security issues in the past that allowed arbitrary command ...
Calimo's user avatar
  • 505
19 votes
Accepted

Why is the Wikileaks site still accessible? How come it hasn't been hacked?

Why haven't other foreign powers hacked or DDoS attacked it in the past when it posted information they didn't want public? Attacking the Wikileaks website to withhold information is ineffective. The ...
Arminius's user avatar
  • 44.9k
18 votes

How can I publish data from a private network without adding a bidirectional link to another network

I love how much my search performance increases as soon as I am done posting my question ;D Wikipedia to the rescue: "Sneakernet is an informal term describing the transfer of electronic information ...
Klamann's user avatar
  • 513
16 votes

Barcodes as an attack vector?

Many barcode scanners are treated by the operating system as a type of keyboard. This gives them exactly the same attack surface as somebody typing in the barcode's information at the keyboard. As ...
Mark's user avatar
  • 34.7k
16 votes
Accepted

How to protect unauthorized logins in case DB server gets compromised?

Effectively, all the attacker is doing is changing users' passwords. This would enable the attacker to login to those users' accounts. As for how you protect against this, I'm not sure you should ...
TTT's user avatar
  • 9,222
16 votes
Accepted

Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords

Attack is automated. You can inspect packets coming from attack vs packets coming from your customers. It can be as simple as the HTTP user agent string or can be some TCP header difference (e.g. some ...
akostadinov's user avatar
15 votes

Security implication of telling the user they can't login because of too many attempts from IP

There is a security benefit to providing generic messages that hasn't been mentioned. Alice is attempting to brute force an account on Bob's server. For the first few attempts Alice gets back the ...
Jon Bentley's user avatar
  • 2,061
14 votes

Someone knows my IP and is threatening to DDoS me

The worst this person can do is interfere with your internet speed. They won't be able to "hack you" or do anything to your computer, nor will they be able to obtain any sensitive ...
forest's user avatar
  • 67k
13 votes

Security implication of telling the user they can't login because of too many attempts from IP

Yes, technically you are returning information which could be used by an attacker to fine tune a brute force botnet. In addition, I'm not sure how useful the "To many login attempts from this IP" ...
Dan Landberg's user avatar
  • 3,322
13 votes

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

Because obfuscation isn't security and because OS obfuscation is basically nonsense. There's only so many common OSes, and so many ways to make educated guesses. If you detect that I'm running IIS or ...
Tom's user avatar
  • 10.6k
12 votes

What are rainbow tables and how are they used?

Purpose and relevance Rainbow tables help crack difficult passwords, i.e. those that can not even be found in a large dictionary. Passwords were historically stored as plain hashes in databases, and ...
Luc's user avatar
  • 33k
12 votes

What is a Zero Day attack?

The term Zero Day or Zero Hour can apply to any type of attack. It's really just a classification given to the time period at which a vulnerability has just been discovered by a person or organization ...
Trey Blalock's user avatar
  • 14.2k
10 votes

Is BCP38 enough to stop DDOS attacks?

There are types of DDOS attacks which don't use source spoofing and where thus BCP38 does not help. For example the current IoT based DDOS attacks against Dyn, OVH, etc did not use source spoofing at ...
Steffen Ullrich's user avatar
10 votes

What is the best practice to store private key, salt and initialization vector in database?

I will answer your question in two parts since you asked it in two parts: Question 1: Is it secure to store salt and vector in database same table with private key? Currently I encode public and ...
dFrancisco's user avatar
  • 2,761

Only top scored, non community-wiki answers of a minimum length are eligible