96
votes
Accepted
Is serverless code immune to DDoS attacks?
There is always something that will break
While, theoretically, serverless systems can scale up your application to very high levels, there is always something that will break. Likely candidates:
...
- 29.7k
69
votes
Accepted
More than three domains hosted on the same IP address
This is not a sign of a problem for your server. There's an important detail here, which is:
104.27.182.86 is not your server. That IP belongs to cloudflare.
Cloudflare provides a large number of ...
- 29.7k
43
votes
Accepted
Pentesting against own web service hosted on 3rd party platform
In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection ...
- 60.6k
37
votes
Accepted
How critical is encryption-at-rest for public cloud hosted systems?
Your threat model is focused on external parties breaking in. But the threats are broader than that.
Low-level hardware backups, VM snapshots, and disposed hardware can all contain data. And because ...
- 123k
35
votes
Accepted
Is starting an AWS instance with only ssh to port 22 significantly insecure?
The answer depends on your risk appetite. Restricting access to the SSH port to only known IP addresses reduces the attack surface significantly. Whatever issue might arise (private key leaks, 0-day ...
- 7,194
32
votes
More than three domains hosted on the same IP address
This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "...
31
votes
Is starting an AWS instance with only ssh to port 22 significantly insecure?
The ssh key would be distributed to a small set of people.
No, don't do that. Never share private keys. Have your folks generate key pairs on their own and collect their public keys. Take reasonable ...
- 1,378
31
votes
Is serverless code immune to DDoS attacks?
Theoretically speaking, there is no limit for resources that will be allocated to a Lambda function ...
There is - it's the budget and the quotas. Lambda functions are not free to execute, so a DDoS ...
- 181k
24
votes
Accepted
Keeping AWS account ID secret
An AWS Account ID can be shared, when required.
Like the documentation says, the main thing anyone can use your AWS Account Number for is to construct ARN's. For example, if I had an AWS Account ...
- 421
22
votes
Is serverless code immune to DDoS attacks?
In short: all-in-all serverless is not a protection against any kind of attack.
Note that "serverless" doesn’t mean servers are not involved. It only means that you have delegated server ...
- 691
19
votes
Accepted
Hijacking stale DNS entry to point to your own website
This is a subdomain takeover.
They typically happen in one of 2 ways:
You have an A record pointing to an IP address that no longer exists and an attacker can gain control of the IP address in ...
- 29.7k
15
votes
Is an AWS "Access Key ID" a secret?
The Access Key ID is used for identifying the access key in logs, configuration, etc. It could in some environments be considered sensitive data if you're looking to not release who accesses which ...
- 38.1k
11
votes
Accepted
How can I kill minerd malware on an AWS EC2 instance?
I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script -
On monkeyoto's ...
- 289
11
votes
How to use AWS KMS securely?
Indeed you're right, anyone with access to the server can get plain-text key.
Fundamentally your application needs to be able to get the plain-text key -- and hence any attack that fully compromises ...
- 3,536
11
votes
Is an AWS "Access Key ID" a secret?
While the AWS Access Key ID is like a username (and the Secret Access Key is like a password), the Access Key ID is also designed to be shared and AWS does this explicitly with the AWS Presigned ...
- 509
10
votes
Accepted
How to use AWS KMS securely?
If your server resides in EC2, you can use IAM to create a role for that server and allow it access to KMS without needing to have the AWS access keys on the server.
http://docs.aws.amazon.com/kms/...
- 116
9
votes
Accepted
What does Spectre mean for public cloud computing?
Spectre is far harder to use than Meltdown. In a cloud hosting situation, an attacker needs to know:
What software the target is using
Where in memory that software is
Where in memory the target ...
- 34.4k
9
votes
Keeping AWS account ID secret
Knowing an AWS account ID doesn't expose you to any attack in itself, but it can make it easier for an attacker to obtaining other compromising information.
Rhino Security Labs demonstrate a ...
- 199
8
votes
Accepted
Is it insecure to expose private bucket names through signed URL?
tl/dr: As long as the bucket is not publicly accessible (i.e. you need access keys to read/write), then don't worry about the name. It
isn't private because your employees probably know it and
...
- 29.7k
7
votes
Accepted
What is the threat model for AWS EBS volumes encryption?
tl;dr Auditors
Many data security audits require data to be encrypted at rest. Often the threat model is an old hard drive ending up on eBay or picked out of the dump. If the data is unencrypted on ...
- 1,905
7
votes
How can I kill minerd malware on an AWS EC2 instance?
Your first goal is (if you don't want to reinstall) is to determine how it managed to get there in the first place. If the attacker was crafty, they'd of run "timestomp" to modify the dates of ...
- 8,652
7
votes
Pentesting against own web service hosted on 3rd party platform
You should also check with your ISP. Depending on government regulations and their own operating policies, they could be required to block your pentest actions if detected, or cancel your service ...
- 71
7
votes
Accepted
Do Transient, Volatile Servers Require Antivirus Scanners?
You are asking yourselves the right questions but asking us the wrong one.
Security controls, like AV, are meant to address threats in order to reduce the impact to an acceptable level. You have ...
- 123k
6
votes
How AWS access key id and secret access key are generated internally
From the documentation [0][1], we see that you prove to AWS that you know the Secret Access Key using HMAC, not using Digital Signatures. This means that when verifying the authentication, AWS must be ...
- 7,603
6
votes
Accepted
How to set up a pentesting lab in Amazon Web Services?
First, a word of caution: AWS requires that you inform them of any security related test you plan on running to their infrastructure [link].
Second, Kali is not a vulnerable operating system, it is ...
- 3,560
6
votes
Do Transient, Volatile Servers Require Antivirus Scanners?
I would not run antivirus on my servers, for a couple reasons:
They are massive pieces of software
The whole idea of a server is to execute one task, and only one, in the fastest way possible. There ...
- 50.5k
6
votes
More than three domains hosted on the same IP address
Looks like you just found out how a Load Balancer inside a CDN with SNI works
You can also check others hosts (SANs) behind this particular CDN with OpenSSL, like so:
echo | openssl s_client -...
- 886
6
votes
Accepted
Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?
It seems that it's not possible obtain a certificate from Lets Encrypt for a public IP address, without a domain name. See https://community.letsencrypt.org/t/certificate-for-public-ip-without-domain-...
- 19.3k
5
votes
Best practices for managing AWS EC2 Key Pairs
Regarding the general managment of private/public keys, there are already other answered questions here on SE: What is the best practice: separate ssh-key per host and user VS one ssh-key for all ...
- 1,069
5
votes
How can I kill minerd malware on an AWS EC2 instance?
The problem is that the minerd is probably the payload of some (other) malware, so you can't really tell what else has been compromised on the system. Possibly there isn't anything else resident on ...
- 1,949
Only top scored, non community-wiki answers of a minimum length are eligible