Hot answers tagged

96 votes
Accepted

Is serverless code immune to DDoS attacks?

There is always something that will break While, theoretically, serverless systems can scale up your application to very high levels, there is always something that will break. Likely candidates: ...
user avatar
69 votes
Accepted

More than three domains hosted on the same IP address

This is not a sign of a problem for your server. There's an important detail here, which is: 104.27.182.86 is not your server. That IP belongs to cloudflare. Cloudflare provides a large number of ...
user avatar
43 votes
Accepted

Pentesting against own web service hosted on 3rd party platform

In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection ...
user avatar
  • 60.6k
37 votes
Accepted

How critical is encryption-at-rest for public cloud hosted systems?

Your threat model is focused on external parties breaking in. But the threats are broader than that. Low-level hardware backups, VM snapshots, and disposed hardware can all contain data. And because ...
user avatar
  • 123k
35 votes
Accepted

Is starting an AWS instance with only ssh to port 22 significantly insecure?

The answer depends on your risk appetite. Restricting access to the SSH port to only known IP addresses reduces the attack surface significantly. Whatever issue might arise (private key leaks, 0-day ...
user avatar
  • 7,194
32 votes

More than three domains hosted on the same IP address

This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "...
user avatar
31 votes

Is starting an AWS instance with only ssh to port 22 significantly insecure?

The ssh key would be distributed to a small set of people. No, don't do that. Never share private keys. Have your folks generate key pairs on their own and collect their public keys. Take reasonable ...
user avatar
  • 1,378
31 votes

Is serverless code immune to DDoS attacks?

Theoretically speaking, there is no limit for resources that will be allocated to a Lambda function ... There is - it's the budget and the quotas. Lambda functions are not free to execute, so a DDoS ...
user avatar
24 votes
Accepted

Keeping AWS account ID secret

An AWS Account ID can be shared, when required. Like the documentation says, the main thing anyone can use your AWS Account Number for is to construct ARN's. For example, if I had an AWS Account ...
user avatar
22 votes

Is serverless code immune to DDoS attacks?

In short: all-in-all serverless is not a protection against any kind of attack. Note that "serverless" doesn’t mean servers are not involved. It only means that you have delegated server ...
user avatar
19 votes
Accepted

Hijacking stale DNS entry to point to your own website

This is a subdomain takeover. They typically happen in one of 2 ways: You have an A record pointing to an IP address that no longer exists and an attacker can gain control of the IP address in ...
user avatar
15 votes

Is an AWS "Access Key ID" a secret?

The Access Key ID is used for identifying the access key in logs, configuration, etc. It could in some environments be considered sensitive data if you're looking to not release who accesses which ...
user avatar
  • 38.1k
11 votes
Accepted

How can I kill minerd malware on an AWS EC2 instance?

I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script - On monkeyoto's ...
user avatar
11 votes

How to use AWS KMS securely?

Indeed you're right, anyone with access to the server can get plain-text key. Fundamentally your application needs to be able to get the plain-text key -- and hence any attack that fully compromises ...
user avatar
  • 3,536
11 votes

Is an AWS "Access Key ID" a secret?

While the AWS Access Key ID is like a username (and the Secret Access Key is like a password), the Access Key ID is also designed to be shared and AWS does this explicitly with the AWS Presigned ...
user avatar
  • 509
10 votes
Accepted

How to use AWS KMS securely?

If your server resides in EC2, you can use IAM to create a role for that server and allow it access to KMS without needing to have the AWS access keys on the server. http://docs.aws.amazon.com/kms/...
user avatar
  • 116
9 votes
Accepted

What does Spectre mean for public cloud computing?

Spectre is far harder to use than Meltdown. In a cloud hosting situation, an attacker needs to know: What software the target is using Where in memory that software is Where in memory the target ...
user avatar
  • 34.4k
9 votes

Keeping AWS account ID secret

Knowing an AWS account ID doesn't expose you to any attack in itself, but it can make it easier for an attacker to obtaining other compromising information. Rhino Security Labs demonstrate a ...
user avatar
  • 199
8 votes
Accepted

Is it insecure to expose private bucket names through signed URL?

tl/dr: As long as the bucket is not publicly accessible (i.e. you need access keys to read/write), then don't worry about the name. It isn't private because your employees probably know it and ...
user avatar
7 votes
Accepted

What is the threat model for AWS EBS volumes encryption?

tl;dr Auditors Many data security audits require data to be encrypted at rest. Often the threat model is an old hard drive ending up on eBay or picked out of the dump. If the data is unencrypted on ...
user avatar
  • 1,905
7 votes

How can I kill minerd malware on an AWS EC2 instance?

Your first goal is (if you don't want to reinstall) is to determine how it managed to get there in the first place. If the attacker was crafty, they'd of run "timestomp" to modify the dates of ...
user avatar
  • 8,652
7 votes

Pentesting against own web service hosted on 3rd party platform

You should also check with your ISP. Depending on government regulations and their own operating policies, they could be required to block your pentest actions if detected, or cancel your service ...
user avatar
7 votes
Accepted

Do Transient, Volatile Servers Require Antivirus Scanners?

You are asking yourselves the right questions but asking us the wrong one. Security controls, like AV, are meant to address threats in order to reduce the impact to an acceptable level. You have ...
user avatar
  • 123k
6 votes

How AWS access key id and secret access key are generated internally

From the documentation [0][1], we see that you prove to AWS that you know the Secret Access Key using HMAC, not using Digital Signatures. This means that when verifying the authentication, AWS must be ...
user avatar
  • 7,603
6 votes
Accepted

How to set up a pentesting lab in Amazon Web Services?

First, a word of caution: AWS requires that you inform them of any security related test you plan on running to their infrastructure [link]. Second, Kali is not a vulnerable operating system, it is ...
user avatar
  • 3,560
6 votes

Do Transient, Volatile Servers Require Antivirus Scanners?

I would not run antivirus on my servers, for a couple reasons: They are massive pieces of software The whole idea of a server is to execute one task, and only one, in the fastest way possible. There ...
user avatar
  • 50.5k
6 votes

More than three domains hosted on the same IP address

Looks like you just found out how a Load Balancer inside a CDN with SNI works You can also check others hosts (SANs) behind this particular CDN with OpenSSL, like so: echo | openssl s_client -...
user avatar
  • 886
6 votes
Accepted

Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?

It seems that it's not possible obtain a certificate from Lets Encrypt for a public IP address, without a domain name. See https://community.letsencrypt.org/t/certificate-for-public-ip-without-domain-...
user avatar
  • 19.3k
5 votes

Best practices for managing AWS EC2 Key Pairs

Regarding the general managment of private/public keys, there are already other answered questions here on SE: What is the best practice: separate ssh-key per host and user VS one ssh-key for all ...
user avatar
  • 1,069
5 votes

How can I kill minerd malware on an AWS EC2 instance?

The problem is that the minerd is probably the payload of some (other) malware, so you can't really tell what else has been compromised on the system. Possibly there isn't anything else resident on ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible