Hot answers tagged

76 votes

How do attackers use compromised computers to do things over the internet?

They can do a heck of a lot One of the most common misconceptions I hear people say about cyber security is, "Well, hackers have no reason to come after me/this." As long as you have some ...
user avatar
  • 1,799
39 votes

Is it insecure to display the number of characters when users enter a new passphrase?

Knowing how long a password is doesn't really make much difference to how easy it is to guess or crack it. If the password is something easily guessable or in a dictionary, then the length is ...
user avatar
  • 4,121
13 votes

Is it insecure to display the number of characters when users enter a new passphrase?

UIs with this behavior do exist. I've seen several that do not offer any visual feedback. I've also seen a few that do random feedback. Is it a security issue? Well, consider how long passwords ...
user avatar
  • 9,206
10 votes
Accepted

Is packet sniffing or other manipulation possible at a DSL or cable wire between my modem and the ISP?

Can a DSL or cable wire between my modem and the ISP be manipulated in any way at the hardware level to sniff the traffic data? In theory, yes - the data isn't encrypted and the line code isn't a ...
user avatar
  • 386
9 votes

Is it insecure to display the number of characters when users enter a new passphrase?

The threat scenario is extremely limited. One would have to be physically present and be able to count the "dots" to get a length. This is more difficult than being able to read the text ...
user avatar
  • 123k
6 votes

Is it insecure to display the number of characters when users enter a new passphrase?

In general, no, this provides only extremely limited security gains in exchange for a significant UX downside. Not showing typed characters has two advantages for security: It hides the password ...
user avatar
6 votes
Accepted

Are CSRF attacks a thing of the past?

Are CSRF attacks a thing of the past? No First of all, there are legitimate reasons to use SameSite=none. One obvious example is any site where the back-end serves multiple front ends via CORS, but ...
user avatar
  • 38.9k
5 votes
Accepted

How to prevent attacks due to Insufficient Logging & Monitoring?

There are a bunch of misunderstandings here about the OWASP Top 10 and what the different controls mean. The OWASP Top 10 is not a list of vulnerabilities but a list of risks Not all risks mean that ...
user avatar
  • 123k
4 votes

Any known SSH attacks/vulnerabilities other than brute force, dictionary attacks and compromising keys?

Short answer: The first thing is to find out which server is used. This can be done with banner grabbing. When you know the version, you can search for exploits. Most current servers like OpenSSH does ...
user avatar
4 votes
Accepted

How to bypass an XSS filter encoding single quotes?

I see at least 3 possible bypasses: Double quotes The most obvious one, which should work based on your post, is by using double quotes instead of simple quotes: <script>document.location="...
user avatar
4 votes

Is a 3-character password secure enough for a Macbook's login? Why or why not?

You haven't mentioned what you're concerned about here. If your concern is whether someone will be able to reformat and sell the laptop, then yes, that's possible regardless of the password. It's ...
user avatar
  • 6,915
3 votes
Accepted

Is there any type of cyber attack for which the geographical distance between the attacker and the target matters?

You are narrowing your scope down to attacks over the Internet, but the cyberspace is not that limited. Take a look at the definitions from, e.g., NIST SP 800-39: Cyber Attack An attack, via ...
user avatar
  • 15.9k
3 votes

What's the purpose of 'instagram password cracker tools/hacker tools' websites?

One word: traffic. There are a lot of people searching for this topic, and we even get people here looking to "recover their account" on various platforms. So, with all this traffic, people ...
user avatar
  • 123k
3 votes

Possible attacks using public key in a certificate

So, where exactly is the client's public key used? ... limited to only verification and has no contribution to key exchange and thus encryption? With modern key exchanges both the clients and the ...
user avatar
2 votes

Is it insecure to display the number of characters when users enter a new passphrase?

I do not consider seeing the number of characters in a password to be particularly telling. Any attacker can see the password given sufficient access to your browser (say with a rogue add-on) or OS (...
user avatar
  • 9,256
2 votes
Accepted

Defending against Wiegand sniffing (ESPKey) attacks in RFID card readers

On the topic of tamper sensors The tamper sensor built into an average card reader is a simple mechanical device intended to identify when the reader has been removed from the wall. Much like a ...
user avatar
  • 56
2 votes

Can an infected device within the LAN still be a threat if turned off?

The answer is generally no, but technically it is possible. While the other answer here focuses upon a scenario in which Wake-on-LAN is used to turn other machines on, in order to infect them, that ...
user avatar
  • 132k
2 votes
Accepted

Possible attacks using public key in a certificate

Beware that there are a few mistakes in what you think you know. You've probably been reading misinformed or outright wrong simplifications. I'll address a few below, but I recommend reading some good ...
user avatar
2 votes

Are there any known SSH (protocol or implementation) vulnerabilities which can be performed on a tor hidden service?

Depending on the SSH Server and the used version, there might some vulnerabilities, which can be used to compromise the server. If you want to do a man in the middle attack, you must not be in the ...
user avatar
2 votes

What is the need for firewall to be in "stealth mode"?

If the attacker knows the firewall model, it's easier to find exploits to it and bypass it. If the version is known, the job is even easier. On a stealth firewall, the attacker may not even suspect ...
user avatar
  • 50.3k
2 votes
Accepted

Determining threat when performing OSINT

It looks like you could use a dip into the Risk pool. Things are just things until they present a hazard. Whether or not they present a hazard depends on its context. Nothing is inherently a hazard. ...
user avatar
  • 123k
2 votes
Accepted

can these encryption methods for a text file protect against physical access to machine by adversary?

The information in the script should be sufficiently protected by the proposed encrypted provided that it is properly implemented and all access is done before the adversary gets access to the device ...
user avatar
1 vote

owasp crs 3.0 rule functuonalityconsult

CRS co-lead here. First, I would recommend to use the newest release of CRS 3.2.2: https://coreruleset.org/installation/ Usually you can just delete your old coreruleset files (maybe keeping your crs-...
user avatar
1 vote

Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA

I've been having this same issue: my problem wasn't so much getting back into the account it was more so that the hacker could always just lock me out again. Last night I tried steps from a video I ...
user avatar
  • 11
1 vote

Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA

Probably either its one of the problems that got already mentioned in the comments, or the source is hidden deeper and her phone or other devices have a virus or similar (spyware, keylogger, stealing ...
user avatar
1 vote
Accepted

Refresh token replay detection

Per request you will only hash what you get from the client, not the whole set in the db. Prevention: You do not need to store all refresh tokens of a user. You just store all valid tokens. Valid is „...
user avatar
  • 138
1 vote

Is a 3-character password secure enough for a Macbook's login? Why or why not?

Is a 3 character password secure enough for a macbook's login? Why or why not? Concern is theft. The vagueness of the question will make it difficult to answer clearly, if at all. For example, are ...
user avatar
  • 4,875
1 vote

How evil could an HDMI/VGA adapter be?

This question seems to come up about once a month, and the answer still has not changed. The bidirectional protocol in VGA and DVI is very very limited, and basically is only used to identify the ...
user avatar
  • 1,082
1 vote

Any known SSH attacks/vulnerabilities other than brute force, dictionary attacks and compromising keys?

Are you looking for attacks on SSH protocol or SSH implementation? If you're thinking about the protocol itself, that might be tricky; I don't recall anything major like the bunch of attacks on SSL or ...
user avatar
  • 261

Only top scored, non community-wiki answers of a minimum length are eligible