16

Attack is automated. You can inspect packets coming from attack vs packets coming from your customers. It can be as simple as the HTTP user agent string or can be some TCP header difference (e.g. some strange flag). Then filter out on the firewall level.


8

If, despite the implausibility of it, you are worried that the FBI has hacked your camera, then I'm afraid there won't be much you can do to gain back control of your camera. Therefore I can only suggest a low-tech solution: a camera cover. This is the sort of thing you are looking for: https://www.amazon.com/C-Slide-Sliding-Computers-Chromebooks-Consoles/...


7

My biggest concern is the DDOS element with regards to system load Then your defences are not appopriate - unless you are blocking the packets before they get to your webserver they are consuming resources (although even if you drop the packets inside your network they will use your bandwidth, but that is likely to be less of a problem). I've just ...


6

There is a new and growing technology area called Content Disarm and Reconstruction (CDR). This does what you are asking for in general, however not all CDR solutions tackle all file types (like audio and video). The idea is that the file is analysed and reconstructed to contain only the data and format, but nothing else. It's like a sanitised copy of the ...


5

Attacks generally have an end time- attackers don't spend unlimited time on any one target. You could temporarily blackhole route Arizona logins from that ip range coming in via the app to a "we're sorry" page. You could also leave them able to log in, but put captcha on first attempt vs letting them fail at all. For unique ip analysis, it can help ...


4

In general: an absolute path name is more clear than a relative one. It is not open to interpretation based on the context like a relative path name is. The actual meaning of a relative name depends on the current directory, on environment variables (like PATH) etc, while an absolute path name most times means the same thing. Therefore an absolute path name ...


3

If you control the system Besides cached files that you see there can be other places where browser data can be found: System swap file Temporary files (this is not the same as cache) Data in the deleted (some files can be restored after deletion) That's why, if you have some sensitive data in cached files, caring about cache files only is not sufficient. ...


3

It depends on the vulnerability. You can most likely remove the exploit by re-encoding or repacking the audio data. However, to do so, you must take care not to use the vulnerable library to decode the audio data. So, you must make sure that audacity (or ffmpeg, or whatever) does not use this library to decode your file before encoding it again. That means ...


3

As you described, those attempts are pretty much indistinguishable from real logins of your clients. Even if you can narrow them down to IPs from specific location or some peculiarity in payload, blackholing them outright, as suggested in other answers is not a good option if you have any real clients from that location or whose software can realistically ...


3

If you are connecting through a router and not browsing the Internet, your risks are minimal. The risks would be if the computer was directly exposed to the Internet or you started browsing, opening emails, etc. Your Mac will probably send a lot of traffic out to get updates, etc. But that's not a risk. If you have other programs running that might "...


3

It seems to be a Credential Stuffing Attack. If the attacker is not using a large set of IP addresses and you can find out the source country and/or service provider, you can block the IP set with a traditional firewall even in your machines, or use a WAF provided by Cloud and CDN providers. They can even block DDoS attacks. Some of them have a free tier. If ...


2

You are suffering a L7 attack based on your user email, so from my point of view you have the first option that is rate limiting how many times a URI can be called (by the client) per second, for example (if your backend supports that). The other option is to check on black lists, for example IPVoid, and check the reputation of the IPs that generate fails ...


2

When we look at basic definitions of the terms threat and attack, we assume that there are two different entities while most don't realize that one could very easily be the cause for the other. Meaning, a threat exists and hence an attack would be possible. So when you talk about a threat, you are automatically talking about all the possible attacks that the ...


2

If you want your service to be accessible to the public, then you cannot prevent the public from interacting with your service. Because of the nature of the web, you cannot prevent someone from accessing arbitrary resources on your site, even if they don't exist. So, you can't prevent the attacks. There are techniques to detect when someone is trying to ...


2

Another possible denial of service vector is the automatic account lockout. If they attempt five logins for a legitimate user, that user will be locked out from using your service for a few minutes, and might even have valid sessions terminated. Presumably, the attacker has a list of accounts they want to have service denied to, and they have stuffed that ...


2

1.What is other Layer7 DDos attacks, e.g FTP, DNS ? Application layer attacks or layer 7 (L7) DDoS attacks refer to a type of malicious behavior designed to target the “top” layer in the OSI model where common internet requests such as HTTP GET and HTTP POST occur. These layer 7 attacks, in contrast to network layer attacks such as DNS Amplification, are ...


2

If there was a standard, easily answerable way to make a local network "absolutely secure", most of the community here would not have jobs. It's not nearly that simple. Network security is incredibly complex. And the environment, the people using it, and the people attacking it are constantly changing, adapting, and evolving. Can an attacker from ...


1

I'm a little unclear about your last paragraph so I'll answer a bit broadly. If you're enabling DDoS protection on a shared hosting system, doing so will protect your site and potentially the other hosted sites from DDoS. If the other sites are not DDoS protected, an attack directed at them could potentially take your site down, even if your own site is ...


1

Your question is a bit "wide". The attack that you described is plausible. Of course and as you said there might be different ways of accessing: Deprecated software with available exploits exposed to the internet could open a door to attackers Phishing attacks could be another vector of attack It is hard to explain all the different alternatives ...


1

Can the sandboxing technique prevent attack? How? No, sandboxing will not prevent attacks designed to take advantage of this buffer overflow. To quote Wikipedia, In computer security, a sandbox is a security mechanism for separating running programs, usually in an effort to mitigate system failures and/or software vulnerabilities from spreading. It is ...


1

Your question is a bit confusing A mirror is usually a copy of the entire site, so I'm guessing you mean forwarding/proxying and not mirroring. Forwarding You could save the HTTP request header data for each incoming connection. There are several fields there which could give you useful information. Examine the value of the field named Forwarded. The ...


1

This is less a question about SQL Injection itself, and more about this particular ML based implementation. I had to look at the code to understand better what the author tried to say with this example. To the best of my understanding, this is actually a very poor example, let's remember this is a tool supposed to execute SQLi attacks, not to just run ...


1

Create the URL using the JavaScript URL API. dest = new URL("Default.aspx", window.location); dest.searchParams.append("uId", selecteduserId); window.location = dest.href; This provides a higher-level API, and it correctly encodes everything for you.


1

Ten immutable Laws of Security, Law #3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. You are susceptible to the Evil Maid Attack. He has the SD Card, he can clone it, change the initrd to log LUKS password, and with the LUKS password in hand it's game over. Shutdown your Pi, clone the card, replace the ...


1

Design your system such that incoming IPs involved in portscans directed to daemons end up in the drop zone of your firewall. There were tools like tcp_wrapper that do this for you, but I designed something myself to keep them away from reaching the daemon. The problem occurs when your system runs servers for http, ssh etc that respond to incoming requests. ...


1

Some interesting answers and many of them amounts to is eval lets you execute any code therefore is a security risk. That is true but actually points to a much bigger problem your website is insecure. Anything that can be done with eval is better done with (Ctrl+Shift+I) anything I can do with eval is even easier with the debugging tool. But there is one and ...


1

In addition to allowing potential attacker to fake the user interface to look like something else (e.g. make new forum message form look like login form) there's a possibility of side-channel data leak to external service. Some example attack vectors: https://portswigger.net/daily-swig/a-dangerous-blend-side-channel-attack-exploits-css-vulnerability https://...


Only top voted, non community-wiki answers of a minimum length are eligible