149
votes
Accepted
Someone is trying to brute-force(?) my private mail server... very... slowly... and with changing IPs
What's the point of this kind of "attack"? The rate is much too slow to do any efficient brute-forcing, and I really doubt that someone would specifically target my tiny personal server.
...
- 66.5k
145
votes
Accepted
What is this kind of low-intensity, non-hacking attack on a web service?
This sounds like the behaviour of an uptime service. These connect from multiple locations at a regular interval, and are designed to alert the server owner in the event of problems.
In this case, it ...
- 27.4k
138
votes
Found suspicious, obfuscated PHP file. Is this a hack attempt on my website?
What will this code actually will do?
You have a backdoor that allows Remote Code Execution
Credit to borjab for the inital decode
<?php preg_replace("#(.+)#ie",
"@include_once(base64_decode("\1"...
- 22.6k
137
votes
Does it make sense to consider a triggerable server software crash a DOS attack?
Yes. Any attack which has as a goal to deny the normal usage of a service by legitimate users is by definition a DoS (Denial of Service).
- 2,691
136
votes
Accepted
Script Kiddies - how do they find my server IP?
You can't hide your IP address on the internet. They aren't secret.
Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean ...
- 22.6k
107
votes
How hard should I try to prevent a user from XSSing themselves?
This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it
Obviously Facebook is a ...
- 62.1k
106
votes
Accepted
Is divide-by-zero a security vulnerability?
At issue is that an exception handler will be invoked to handle the division by zero. In general, attackers know that exception handlers are not as well-tested as regular code flows. Your main logic ...
- 34.1k
100
votes
Accepted
Can malicious code fit in 14 bytes?
Yes, it can. It could be just the trigger vulnerability which would load data on specific areas of the movie in memory and execute.
The malicious part can be pretty small, and the payload could be ...
- 53.5k
99
votes
Accepted
How can ISPs handle DDoS attacks?
There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations):
blackholing
By blackholing traffic, you discard all traffic towards the ...
- 6,898
99
votes
My email address is being used to enroll for online services. Should I be concerned?
Should I be concerned about this?
Yes.
This should be of concern to you because an attacker was able to obtain the valid password for your Gmail account. From the details of warning you have ...
- 3,901
94
votes
Accepted
HTTPS web service switched to HTTP. What can go wrong?
You are right, the regression to HTTP is pointless.
Note that all your points apply to one particular kind of attack, where the adversary is able to access the data transport between client and ...
- 44.7k
92
votes
Accepted
Unusual mail headers show evidence of MTA attack. Have I been pwned?
This is an attempt to exploit the current remote code execution issue in the EXIM mail server, i.e. CVE-2019-10149. See The Return of the WIZard: RCE in Exim for details and also the kind of exploit ...
- 198k
80
votes
Found suspicious, obfuscated PHP file. Is this a hack attempt on my website?
The short answer is: if the code was added by someone you don't know, then it's malicious, doesn't really matter what it does.
Your server has been compromised and you need to perform a full clean ...
- 128k
76
votes
How do attackers use compromised computers to do things over the internet?
They can do a heck of a lot
One of the most common misconceptions I hear people say about cyber security is, "Well, hackers have no reason to come after me/this." As long as you have some ...
- 1,837
72
votes
What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?
Server Name Indication (SNI) is a TLS extension which allows a TLS client to indicate which host it is trying to reach. This is important for web servers with virtual hosts (i.e. multiple domains ...
- 135k
68
votes
Accepted
How to secure a mobile app against its user?
You cannot.
As soon as the user has the mobile device and your application, nothing stops him from decompiling your application, understanding how it works & what data it sends, and replicating ...
- 53.5k
66
votes
Accepted
What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?
What kind of vulnerability or attack vector is prevented by the error?
The attack is called "virtual host confusion" and in 2014 several CDN were found vulnerable against it. The main idea is that a ...
- 198k
66
votes
I detected someone probing my site for weaknesses, what can I do about it?
Welcome to the internet! This is the normal situation, business as usual.
You don't have to do anything, but to harden your website. Probes like that occurs all the time, on every site, day and night....
- 53.5k
60
votes
Does it make sense to consider a triggerable server software crash a DOS attack?
DDoS (Distributed DoS) is characterised by floods creating a DoS (in all available definitions). A single node causing a flood successfully is kind of rare.
But DoS can be caused by a broad range of ...
- 128k
58
votes
Script Kiddies - how do they find my server IP?
The IPv4 address space is limited to only 4,294,967,296 addresses.[note 1] Given enough bandwidth, it becomes trivial to scan every single IP address out there, especially if you're the owner of a ...
- 2,776
56
votes
Accepted
How are GPUs used in brute force attacks?
I'm choosing to assume you're asking why it's a risk rather than how to hack.
GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and ...
- 1,122
55
votes
How do you deal with massive port scans?
I ignore them. And if you have a reasonable security posture, you should too.
Your servers should have no ports open to the general public other than those that you use to serve the general public.
...
- 83.3k
54
votes
Accepted
Why do hackers scan for open ports?
To run an exploit, an attacker needs a vulnerability.
To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs ...
- 49.3k
54
votes
Accepted
What is the difference between "Incident", "Attack" and "event"?
Assuming that you have looked up the official terms and wanted further help:
An event is something that has triggered notice. An event need not be an indication of wrongdoing. Someone successfully ...
- 128k
50
votes
Is divide-by-zero a security vulnerability?
To add another contrived but based on real example:
Many (many) moons ago, my high school was running Novell Netware and had it configured so that students couldn't directly run an dos prompt (which ...
- 601
45
votes
I have just 4 hours a month to security check a cloud based application - How to use my time?
As mentioned in the comments, I too agree 4 hours in a month is way too low. Understand, and more importantly, make your stakeholders understand that with 4h they shouldn't expect much. Considering ...
- 873
44
votes
Accepted
Barcodes as an attack vector?
Yes, barcode scanners present a potential vulnerability. You need to prevent attacks from this vector in the same way you'd prevent attacks from any input vector, such as a network connection or a ...
- 34.1k
44
votes
Accepted
Should we keep logs forever to investigate past data breaches?
There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various ...
- 769
40
votes
Understanding HTTP GET attack requests
This looks like automated attacks to test for different injection vulnerabilities. As far as I can tell, there is no actual mallicious payload here. The attacks are instead design to detect if the ...
- 65.4k
Only top scored, non community-wiki answers of a minimum length are eligible