239 votes
Accepted

What is DROWN and how does it work?

To understand the attack, one must recall Bleichenbacher's attack from the late 20th century. In that attack, the attacker uses the target server as an oracle. When using RSA-based key exchange, the ...
Thomas Pornin's user avatar
239 votes
Accepted

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

Before I tear your idea apart, let me say that it's a really interesting idea and it was super fun to think about. Please continue to think outside the box and ask interesting questions! Alright, let'...
Mike Ounsworth's user avatar
91 votes

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

Mike's answer says basically everything I have to offer about why this is a bad idea from a development perspective (and, as Ghedipunk's comment says, an unusable security feature provides no security)...
CBHacking's user avatar
  • 47.6k
82 votes
Accepted

Someone knows my IP and is threatening to DDoS me

ISP's have ways of dealing with DDoS attacks targeting one or more IP addresses on their network. See How can ISPs handle DDoS attacks? for some interesting reading on this subject. What you are ...
mti2935's user avatar
  • 23.4k
78 votes
Accepted

Security implication of telling the user they can't login because of too many attempts from IP

Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. On the other hand, not telling a ...
Arminius's user avatar
  • 44.7k
74 votes
Accepted

How does ransomware get on people's computers?

According to the IBM X-Force Threat Intelligence Quarterly Report, fourth quarter 2015, the primary sources of ransomware attack are unpatched vulnerabilities, drive-by infections, and spear-phishing ...
brcsp's user avatar
  • 818
66 votes

I detected someone probing my site for weaknesses, what can I do about it?

Welcome to the internet! This is the normal situation, business as usual. You don't have to do anything, but to harden your website. Probes like that occurs all the time, on every site, day and night....
ThoriumBR's user avatar
  • 53.9k
54 votes
Accepted

Why do hackers scan for open ports?

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs ...
Philipp's user avatar
  • 49.4k
46 votes

Someone knows my IP and is threatening to DDoS me

Contact your ISP’s security team and explain your situation. They should be able to help you change your IP to a new address.
John Deters's user avatar
  • 34.2k
46 votes
Accepted

Does rebooting a phone daily increase your phone's security?

Rebooting a phone regularly helps cleaning non-persistent malware, i.e., malware that only exist in memory – and non-persistent malware alone, as explained in Paul Ducklin's Sophos blog article on the ...
Esa Jokinen's user avatar
  • 18.9k
44 votes

How does ransomware get on people's computers?

While the measures you describe in your question are not wrong, they are not correct either: Documents are not safe to open either. Often times, exploits come in the form of interestingFile.txt.exe. ...
Tobi Nary's user avatar
  • 14.4k
44 votes
Accepted

Barcodes as an attack vector?

Yes, barcode scanners present a potential vulnerability. You need to prevent attacks from this vector in the same way you'd prevent attacks from any input vector, such as a network connection or a ...
John Deters's user avatar
  • 34.2k
43 votes

What is DROWN and how does it work?

The answer by Thomas is wonderful. There is just one thing that seems understated: e-mail servers are broken security-wise... by default and by design. default: just look at the default postfix ...
JPatta's user avatar
  • 674
41 votes

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

What things can be done to prevent sudden rogue insiders from negatively impacting essential infrastructure using techniques they're privileged to do? In practice, very little. But to explain ...
gowenfawr's user avatar
  • 72.9k
38 votes
Accepted

How can I publish data from a private network without adding a bidirectional link to another network

You can use a serial port. By default there are two data lines, one per each direction, plus a ground wire (which is irrelevant here). By disconnecting the appropriate line you can prevent ...
André Borie's user avatar
  • 12.8k
33 votes
Accepted

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

Two-man rule - configure your systems so that all privileged access requires two people. This could be a physical control - privileged access can only come from the NOC, and inside the NOC people ...
paj28's user avatar
  • 33.4k
32 votes
Accepted

How to prevent "cost attacks" on AWS?

AWS allows you to set budgets, and alarms based on your current rate of spending. Those would be useful to control your spending. In theory, you could also set billing-based automation to start ...
nbering's user avatar
  • 4,028
30 votes

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

If your objective is to deprive an attacker of ls and cat, there's an even better alternative to obfuscation: just don't install those utilities. While I wouldn't say this is a widely implement ...
Phil Frost's user avatar
27 votes

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

One approach is to accept that rogue actions cannot be prevented and focus on making sure the damage can be repaired. For example, make sure the routers have a separate control plane via which they ...
Daniel Darabos's user avatar
27 votes

Someone knows my IP and is threatening to DDoS me

Not enough information for a qualified answer. I will make some assumptions and spell them out. Basic assumption: You actually care about being DDoS'ed (you earn money doing live streams or something)....
Tom's user avatar
  • 10.3k
19 votes
Accepted

Vim Modeline Vulnerabilities

Although in theory modelines shouldn't allow you to do anything bad, sanitizing modeline functions input is hard. There have been several security issues in the past that allowed arbitrary command ...
Calimo's user avatar
  • 475
19 votes
Accepted

Why is the Wikileaks site still accessible? How come it hasn't been hacked?

Why haven't other foreign powers hacked or DDoS attacked it in the past when it posted information they didn't want public? Attacking the Wikileaks website to withhold information is ineffective. The ...
Arminius's user avatar
  • 44.7k
18 votes

How can I publish data from a private network without adding a bidirectional link to another network

I love how much my search performance increases as soon as I am done posting my question ;D Wikipedia to the rescue: "Sneakernet is an informal term describing the transfer of electronic information ...
Klamann's user avatar
  • 513
16 votes

Barcodes as an attack vector?

Many barcode scanners are treated by the operating system as a type of keyboard. This gives them exactly the same attack surface as somebody typing in the barcode's information at the keyboard. As ...
Mark's user avatar
  • 34.6k
16 votes
Accepted

How to protect unauthorized logins in case DB server gets compromised?

Effectively, all the attacker is doing is changing users' passwords. This would enable the attacker to login to those users' accounts. As for how you protect against this, I'm not sure you should ...
TTT's user avatar
  • 9,202
16 votes
Accepted

Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords

Attack is automated. You can inspect packets coming from attack vs packets coming from your customers. It can be as simple as the HTTP user agent string or can be some TCP header difference (e.g. some ...
akostadinov's user avatar
15 votes

Security implication of telling the user they can't login because of too many attempts from IP

There is a security benefit to providing generic messages that hasn't been mentioned. Alice is attempting to brute force an account on Bob's server. For the first few attempts Alice gets back the ...
Jon Bentley's user avatar
  • 2,071
15 votes

Someone knows my IP and is threatening to DDoS me

The worst this person can do is interfere with your internet speed. They won't be able to "hack you" or do anything to your computer, nor will they be able to obtain any sensitive ...
forest's user avatar
  • 66.6k
13 votes

Security implication of telling the user they can't login because of too many attempts from IP

Yes, technically you are returning information which could be used by an attacker to fine tune a brute force botnet. In addition, I'm not sure how useful the "To many login attempts from this IP" ...
Dan Landberg's user avatar
  • 3,322

Only top scored, non community-wiki answers of a minimum length are eligible