238

To understand the attack, one must recall Bleichenbacher's attack from the late 20th century. In that attack, the attacker uses the target server as an oracle. When using RSA-based key exchange, the client is supposed to send a secret value (the "pre-master secret") encrypted with the server's public key, using PKCS#1 v1.5 padding (called "type 2"). ...


237

Before I tear your idea apart, let me say that it's a really interesting idea and it was super fun to think about. Please continue to think outside the box and ask interesting questions! Alright, let's do this! Let's take a step back and ask why that baby monitor is running Linux in the first place? What if there was no operating system and the application ...


91

Mike's answer says basically everything I have to offer about why this is a bad idea from a development perspective (and, as Ghedipunk's comment says, an unusable security feature provides no security). So instead, I'm going to talk about why from a security perspective, you would never do this. The answer is actually surprisingly simple: it's a waste of ...


79

Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. On the other hand, not telling a user why their login failed is a potential usability disaster. If you don't clarify whether the user's IP was banned or the user instead used a wrong password, ...


78

The other answers mostly talk about attaching arbitrary code to images via steganographic techniques, but that's not very interesting since it requires that the user be complicit in extracting and executing that. The user could just execute malicious code directly if that's their goal. Really you're interested in whether there's a possibility of unexpected,...


73

According to the IBM X-Force Threat Intelligence Quarterly Report, fourth quarter 2015, the primary sources of ransomware attack are unpatched vulnerabilities, drive-by infections, and spear-phishing emails: Source: IBM X-Force How to prevent ransomware attacks User education Educate your users not to download files from unknown contacts. Usually ransomware ...


67

The answer to this question very much depends on the security posture of your site, which decides whether the risk of unauthorised access is greater or lower than the risk of Denial of Service for some users. For high risk sites, I might go with the blocking option, especially where most of the user base is likely to be home users and therefore is likely to ...


66

Welcome to the internet! This is the normal situation, business as usual. You don't have to do anything, but to harden your website. Probes like that occurs all the time, on every site, day and night. Some people call that "voluntary pen testing." Depending on your site, there are some tools that you can use to help you keep those kinds of probes out of ...


56

No Quarantine is nothing but a place to store the infected/suspicious files. When you quarantine a file it is deleted from the actual place and moved to the quarantine location (to the path that your anti-virus program has for them). This is something like keeping a zombie inside a jail. Obviously it is not a threat as long as you don't open the cage. In ...


54

Static or dynamic IP is a non-issue. But since you brought up cameras, you should know that many IP cameras have VERY poor security. Many of these cameras have a known bad firmware in them that allows unauthenticated download of the entire memory of the device via simply going to /proc/kcore, without the need to authenticate. This allows anyone to obtain ...


53

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs implement them and preferably the versions of those programs). To fingerprint a service, the attacker needs to know that there is one running on a publicly ...


45

While the measures you describe in your question are not wrong, they are not correct either: Documents are not safe to open either. Often times, exploits come in the form of interestingFile.txt.exe. Windows hiding the .exe by default leads users to think that's just a text file when indeed they execute code. There are other ways to keep executable code ...


44

Yes, barcode scanners present a potential vulnerability. You need to prevent attacks from this vector in the same way you'd prevent attacks from any input vector, such as a network connection or a keyboard. Validate inputs in the app, not the scanner. Do not rely on configuring the scanner to only deliver 12 digit UPC-A barcodes. As every web app developer ...


43

The answer by Thomas is wonderful. There is just one thing that seems understated: e-mail servers are broken security-wise... by default and by design. default: just look at the default postfix configuration for instance (hint: SSLv2 and 40-56bit ciphers are still a thing, and "no encryption" too). by design: have you ever heard of the StartSSL wonder? Well,...


42

I would consider another contractor, since that statement doesn't precisely increase my trust in his knowledge/skill. The correct way of setting up a security camera system so you are able to check them when you are away is to have port forwarding on your router exclusively for VPN or HTTP/TLS mapped to the machine recording data from the cameras. This will ...


41

What things can be done to prevent sudden rogue insiders from negatively impacting essential infrastructure using techniques they're privileged to do? In practice, very little. But to explain why, let me talk about what you can do. The issue here is that the user is "privileged" - they have been granted the power legitimately. There are some things ...


37

You can use a serial port. By default there are two data lines, one per each direction, plus a ground wire (which is irrelevant here). By disconnecting the appropriate line you can prevent communication in a certain direction. It's really easy to use it, at the very basic level I think you can run something like echo hello >> /dev/ttyS0 and receive it ...


33

Two-man rule - configure your systems so that all privileged access requires two people. This could be a physical control - privileged access can only come from the NOC, and inside the NOC people physically enforce the rule. More practical would be a scripting system. Sys-admins don't directly have root access, but they can submit scripts to be run as root....


32

eval() executes a string of characters as code. You use eval() precisely because the string contents are not known in advance, or even generated server-side; basically, you need eval() because the JavaScript itself will generate the string from data which is available only dynamically, in the client. Thus, eval() makes sense in situations where the ...


31

AWS allows you to set budgets, and alarms based on your current rate of spending. Those would be useful to control your spending. In theory, you could also set billing-based automation to start scaling down services to avoid a $10k bill at the end of the month. AWS Budgets Tutorial If your spending alarms go off, then you'd take a look and see why your ...


30

If your objective is to deprive an attacker of ls and cat, there's an even better alternative to obfuscation: just don't install those utilities. While I wouldn't say this is a widely implement approach, it is at least implement. For example consider distroless, a collection of docker images with pretty much nothing in them. Some of them (like the one for ...


28

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be seeing the incoming requests, but your server won't be sending replies, so the overall traffic level should drop by 90% or more. Since you're running a home ...


28

Every computer with a public IP gets this kind of attention permanently. There's nothing you can do to stop it (I once tried to complain to the provider owning the offender's IP, never got a reply and gave up). What you can do is to make sure you're well protected against a possible attack (this bot seemed to look for WordPress, but there are others looking ...


27

One approach is to accept that rogue actions cannot be prevented and focus on making sure the damage can be repaired. For example, make sure the routers have a separate control plane via which they can be brought back online. Make sure you have read-only backups (e.g. off-site tapes), so if someone wipes out all hard drives you can recover the data. Make ...


25

The answer is generally it depends. This is really based on the security of your system. Users can create new accounts without restriction If so, it is kind of meaningless to not tell them. You can't have intersecting usernames or email addresses, so you have to inform a new user if their username or email has already been used. An attacker would then be ...


23

The username is not a secret; any determined attacker will be able to find out the names of users on your system. What does improve your security, is if there is no remote access for "root", "guest", and similar account names found on many systems. In fact, Ubuntu explicitly disables the "root" account because it is such a favorite target.


21

The only difference between the static IP address your technician is referring to and a dynamic, changing address in this situation is that one never changes, and the other does (how frequently depends on many factors). There is nothing inherently more or less secure about either one. Both are a means to identify you and your home network on the Internet.


19

Packet checksums are not cryptographic measures, and are not intended to be a security feature. Anyone (even an attacker) can calculate the checksum for a packet containing anything, and there's no secrets/keys involved in the calculation. Checksums are intended to catch errors during the transmission of the packet: flipped bits, miscommunication, etc. ...


19

Why haven't other foreign powers hacked or DDoS attacked it in the past when it posted information they didn't want public? Attacking the Wikileaks website to withhold information is ineffective. The site's availability is just not crucial for making the leaks public. Instead of only hosting the documents centralized on their web servers, Wikileaks follows ...


17

Yes, it can be done as (theoretically) every "computing device" is computationally equivalent to every other computing device. Look up the Church-Turing thesis if you are interested. However your question is grounded in practice and in this case the answer is "yes, but it would cost too much". Effort in virtualisation today aims at speeding up the virtual ...


Only top voted, non community-wiki answers of a minimum length are eligible