69
This is not a sign of a problem for your server. There's an important detail here, which is:
104.27.182.86 is not your server. That IP belongs to cloudflare.
Cloudflare provides a large number of services to websites and sits in between the public internet and a server. Someone who uses Cloudflare doesn't point their DNS to their own server - they point ...
43
In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection Systems are aware that it's an authorised scan.
Both AWS and Azure have policies detailing the process and what's acceptable to test. The AWS one is here and the ...
32
This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "extended" in many ways. One of them, which has actually been around for a very long time, is to host multiple domains on a single server with a single IP address.
A ...
12
The Access Key ID is used for identifying the access key in logs, configuration, etc. It could in some environments be considered sensitive data if you're looking to not release who accesses which systems and when, but it is not secret.
10
I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script -
On monkeyoto's suggestion, I blocked all communication with the mining pool server - iptables -A INPUT -s xmr.crypto-pool.fr -j DROP and iptables -A OUTPUT -d xmr.crypto-pool....
9
An AWS Account ID can be shared, when required.
Like the documentation says, the main thing anyone can use your AWS Account Number for is to construct ARN's. For example, if I had an AWS Account which held an AWS Lambda function, and someone on another account, who I had explicitly granted permission to, wanted to manipulate it, they would use by account ...
8
Spectre is far harder to use than Meltdown. In a cloud hosting situation, an attacker needs to know:
What software the target is using
Where in memory that software is
Where in memory the target data is
The behavior of the host CPU's branch predictor
The behavior of the host CPU's speculative execution system
and possibly some other things I'm forgetting
...
7
tl;dr Auditors
Many data security audits require data to be encrypted at rest. Often the threat model is an old hard drive ending up on eBay or picked out of the dump. If the data is unencrypted on these drives and they are not properly handled/destroyed there could definitely be data loss. There is also the classic "truck backing up into the datacenter" ...
7
Your first goal is (if you don't want to reinstall) is to determine how it managed to get there in the first place. If the attacker was crafty, they'd of run "timestomp" to modify the dates of binaries. You minimizing SSH does little if you're running a vulnerable version of Wordpress, or Joomla, or something different. For example, there was a Nagios ...
7
You should also check with your ISP. Depending on government regulations and their own operating policies, they could be required to block your pentest actions if detected, or cancel your service completely. They may even be required to report you to law enforcement agencies.
7
While the AWS Access Key ID is like a username (and the Secret Access Key is like a password), the Access Key ID is also designed to be shared and AWS does this explicitly with the AWS Presigned Object URL feature as mentioned by John Hanley in a previous comment. This is an expanded response.
AWS Presigned Object URLs are shareable links designed to be ...
7
You are asking yourselves the right questions but asking us the wrong one.
Security controls, like AV, are meant to address threats in order to reduce the impact to an acceptable level. You have identified the threats and the likely impact of those threats. Great! Now you need to see if signature-based AV addresses those threats and reduces impact to an ...
6
From the documentation [0][1], we see that you prove to AWS that you know the Secret Access Key using HMAC, not using Digital Signatures. This means that when verifying the authentication, AWS must be able to generate the exact Secret Access Key for your Access Key ID.
Thus, their promise to never show you the Secret Access Key again is a matter of policy, ...
6
First, a word of caution: AWS requires that you inform them of any security related test you plan on running to their infrastructure [link].
Second, Kali is not a vulnerable operating system, it is an operating system that comes with pre-installed tools so you can perform security tests on other machines.
And third, an AWS EC2 is already a virtual machine, ...
6
I would not run antivirus on my servers, for a couple reasons:
They are massive pieces of software
The whole idea of a server is to execute one task, and only one, in the fastest way possible. There are some accessory tasks that you need to run, but the idea is the same. AV engines slows down your service.
They usually run with root permissions
Your ...
6
Looks like you just found out how a Load Balancer inside a CDN with SNI works
You can also check others hosts (SANs) behind this particular CDN with OpenSSL, like so:
echo | openssl s_client -showcerts -servername arturofm.com -connect arturofm.com:443 2>/dev/null | openssl x509 -inform pem -noout -text
...or you can use your browser's certificate ...
5
The problem is that the minerd is probably the payload of some (other) malware, so you can't really tell what else has been compromised on the system. Possibly there isn't anything else resident on the system, and you are just getting re-infected each time you kill the miner.
Alternatively there is some management/dropper process which has opened a back-...
5
Regarding the general managment of private/public keys, there are already other answered questions here on SE: What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts? and What's the common pragmatic strategy for managing key pairs?
Regarding AWS specific details: you can and should create your own key pairs outside of AWS ...
5
If your server resides in EC2, you can use IAM to create a role for that server and allow it access to KMS without needing to have the AWS access keys on the server.
http://docs.aws.amazon.com/kms/latest/developerguide/control-access.html
5
The preferred way to go is to generate a presigned POST request (your backend server asks for it with your own admin credentials).
Then from client-side you upload using this pre-signed POST.
It's effectively a way to have temporary credentials, but much more easy & secure to deploy as it can be restricted to the exact file you need to have uploaded.
...
5
First, it is perfectly normal for content delivery networks to have such certificates. And given the IP address this looks like Amazon AWS, possible their CloudFront service which serves as a TLS termination point and load balancer which then forwards the traffic to the appropriate system. This is actually typical behavior which you will also see at ...
5
The first point to observe is that if you click one of the above addresses you shouldn't be able to open it. They all point (clearly in the case of Azure) to a link-local IP address. These are reserved addresses in the space 169.254.0.0/16 that are not forwarded by routers, and crucially are only accessible from a given instance.
The second point to note ...
4
MFA is not designed to prevent any file deletion or change. It's only goal is to make stealing user's credentials much more difficult.
Also, you don't setup MFA for S3 bucket (or object), you setup it for a user. Permissions to that user are specified by ACL's and policies.
So in a way you can "enable MFA for S3". Create users, enable MFA, assign policies. ...
4
Your intuition is correct in the most important way -- this is not, in any meaningful sense, "secure."
But the way it's defeated is not quite what you envision.
When you click a link on a web page, or your browser loads an image embedded in a page, your browser connects to the web server and sends a request. In the request are the HTTP headers, including ...
4
Other Places are:
TPM
CPU Register (implementation: Tresor)
HSM
Security Tokens
many other Hardware based storages
4
That is not the source IP of the request, it's the value of what the user agent set in the Host header.
When I make a HTTP request to StackExchange to fetch this question page, it looks like this:
GET /questions/169836/http-requests-from-server-itself HTTP/1.1
Host: security.stackexchange.com
...
The Host header indicates that I wish to load from the ...
4
Simply, the environment within which you are executing your commands is sandboxed and is unable to affect the host OS or other users' commands. Unless there's a vulnerability, of course. From https://aws.amazon.com/lambda/faqs/:
Q: Can I access the infrastructure that AWS Lambda runs on?
No. AWS Lambda operates the compute infrastructure on your ...
4
which is harder: finding the private key from the public key, or decrypting the 40 character string? How different would this be if the SSH key were 4096 bits?
I believe you are asking the wrong question. Mandatory XKCD:
For all practical purposes, hacks are the result of hackers getting root access to the server or data due to weak passwords or unpatched ...
4
Yes, you need authorisation for a penetration test of any service running on the AWS infrastructure, whether or not it’s a service directly managed by Amazon themselves. Source: personal experience and discussion with my AWS account manager. Remember, your pen test will be testing things like AWS security groups and network ACLs as well as your own service.
4
The EC2 findings refers to: AWS Security Group for your EC2 instances have an unknown or too permissive CIDR origin allowed for inbound/outbound traffic. This audit rule expects another Security Group reference as originator or destiny of the traffic that pass through it.
When an unknown CIDR is found, the Unknown CIDR caption is added to the report, which ...
Only top voted, non community-wiki answers of a minimum length are eligible
