239 votes
Accepted

What is DROWN and how does it work?

To understand the attack, one must recall Bleichenbacher's attack from the late 20th century. In that attack, the attacker uses the target server as an oracle. When using RSA-based key exchange, the ...
user avatar
238 votes
Accepted

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

Before I tear your idea apart, let me say that it's a really interesting idea and it was super fun to think about. Please continue to think outside the box and ask interesting questions! Alright, let'...
user avatar
91 votes

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

Mike's answer says basically everything I have to offer about why this is a bad idea from a development perspective (and, as Ghedipunk's comment says, an unusable security feature provides no security)...
user avatar
  • 39.1k
83 votes
Accepted

Someone knows my IP and is threatening to DDoS me

ISP's have ways of dealing with DDoS attacks targeting one or more IP addresses on their network. See How can ISPs handle DDoS attacks? for some interesting reading on this subject. What you are ...
user avatar
  • 19.6k
79 votes
Accepted

Security implication of telling the user they can't login because of too many attempts from IP

Absolutely do not message end user telling them why login failed. You are giving a potential attacker critical information to aid them in attacking you application. On the other hand, not telling a ...
user avatar
  • 43.7k
74 votes
Accepted

How does ransomware get on people's computers?

According to the IBM X-Force Threat Intelligence Quarterly Report, fourth quarter 2015, the primary sources of ransomware attack are unpatched vulnerabilities, drive-by infections, and spear-phishing ...
user avatar
  • 808
68 votes
Accepted

Is it good practice to ban an IP address if too many login attempts are made from it?

The answer to this question very much depends on the security posture of your site, which decides whether the risk of unauthorised access is greater or lower than the risk of Denial of Service for ...
user avatar
  • 60.7k
66 votes

I detected someone probing my site for weaknesses, what can I do about it?

Welcome to the internet! This is the normal situation, business as usual. You don't have to do anything, but to harden your website. Probes like that occurs all the time, on every site, day and night....
user avatar
  • 50.3k
56 votes
Accepted

Can malware be dangerous even when quarantined?

No Quarantine is nothing but a place to store the infected/suspicious files. When you quarantine a file it is deleted from the actual place and moved to the quarantine location (to the path that your ...
user avatar
54 votes
Accepted

Why do hackers scan for open ports?

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs ...
user avatar
  • 48.8k
53 votes

Is it bad to have cameras using a static IP address?

Static or dynamic IP is a non-issue. But since you brought up cameras, you should know that many IP cameras have VERY poor security. Many of these cameras have a known bad firmware in them that ...
user avatar
  • 21.5k
47 votes

Someone knows my IP and is threatening to DDoS me

Contact your ISP’s security team and explain your situation. They should be able to help you change your IP to a new address.
user avatar
  • 33.6k
45 votes

How does ransomware get on people's computers?

While the measures you describe in your question are not wrong, they are not correct either: Documents are not safe to open either. Often times, exploits come in the form of interestingFile.txt.exe. ...
user avatar
  • 14.3k
44 votes
Accepted

Barcodes as an attack vector?

Yes, barcode scanners present a potential vulnerability. You need to prevent attacks from this vector in the same way you'd prevent attacks from any input vector, such as a network connection or a ...
user avatar
  • 33.6k
43 votes

What is DROWN and how does it work?

The answer by Thomas is wonderful. There is just one thing that seems understated: e-mail servers are broken security-wise... by default and by design. default: just look at the default postfix ...
user avatar
  • 664
42 votes
Accepted

Is it bad to have cameras using a static IP address?

I would consider another contractor, since that statement doesn't precisely increase my trust in his knowledge/skill. The correct way of setting up a security camera system so you are able to check ...
user avatar
  • 4,971
41 votes

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

What things can be done to prevent sudden rogue insiders from negatively impacting essential infrastructure using techniques they're privileged to do? In practice, very little. But to explain ...
user avatar
  • 71.8k
37 votes
Accepted

How can I publish data from a private network without adding a bidirectional link to another network

You can use a serial port. By default there are two data lines, one per each direction, plus a ground wire (which is irrelevant here). By disconnecting the appropriate line you can prevent ...
user avatar
  • 12.7k
33 votes
Accepted

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

Two-man rule - configure your systems so that all privileged access requires two people. This could be a physical control - privileged access can only come from the NOC, and inside the NOC people ...
user avatar
  • 32.6k
32 votes
Accepted

What are the security issues with "eval()" in JavaScript?

eval() executes a string of characters as code. You use eval() precisely because the string contents are not known in advance, or even generated server-side; basically, you need eval() because the ...
user avatar
31 votes
Accepted

How to prevent "cost attacks" on AWS?

AWS allows you to set budgets, and alarms based on your current rate of spending. Those would be useful to control your spending. In theory, you could also set billing-based automation to start ...
user avatar
  • 3,978
30 votes

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

If your objective is to deprive an attacker of ls and cat, there's an even better alternative to obfuscation: just don't install those utilities. While I wouldn't say this is a widely implement ...
user avatar
28 votes

NTP DDoS Attack on Home Servers

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be ...
user avatar
  • 34.4k
28 votes
Accepted

Fake UserAgent visitor attack?

Every computer with a public IP gets this kind of attention permanently. There's nothing you can do to stop it (I once tried to complain to the provider owning the offender's IP, never got a reply and ...
user avatar
27 votes

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

One approach is to accept that rogue actions cannot be prevented and focus on making sure the damage can be repaired. For example, make sure the routers have a separate control plane via which they ...
user avatar
27 votes

Someone knows my IP and is threatening to DDoS me

Not enough information for a qualified answer. I will make some assumptions and spell them out. Basic assumption: You actually care about being DDoS'ed (you earn money doing live streams or something)....
user avatar
  • 10k
26 votes
Accepted

Should I let a user know they have entered an unknown username or email address?

The answer is generally it depends. This is really based on the security of your system. Users can create new accounts without restriction If so, it is kind of meaningless to not tell them. You ...
user avatar
23 votes
Accepted

Are short usernames a security concern?

The username is not a secret; any determined attacker will be able to find out the names of users on your system. What does improve your security, is if there is no remote access for "root", "guest", ...
user avatar
  • 5,486
21 votes

Is it bad to have cameras using a static IP address?

The only difference between the static IP address your technician is referring to and a dynamic, changing address in this situation is that one never changes, and the other does (how frequently ...
user avatar
  • 652

Only top scored, non community-wiki answers of a minimum length are eligible