Skip to main content
97 votes
Accepted

Is serverless code immune to DDoS attacks?

There is always something that will break While, theoretically, serverless systems can scale up your application to very high levels, there is always something that will break. Likely candidates: ...
Conor Mancone's user avatar
69 votes
Accepted

More than three domains hosted on the same IP address

This is not a sign of a problem for your server. There's an important detail here, which is: 104.27.182.86 is not your server. That IP belongs to cloudflare. Cloudflare provides a large number of ...
Conor Mancone's user avatar
43 votes
Accepted

Pentesting against own web service hosted on 3rd party platform

In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection ...
Rory McCune's user avatar
  • 62.4k
36 votes
Accepted

Is starting an AWS instance with only ssh to port 22 significantly insecure?

The answer depends on your risk appetite. Restricting access to the SSH port to only known IP addresses reduces the attack surface significantly. Whatever issue might arise (private key leaks, 0-day ...
Demento's user avatar
  • 7,465
36 votes
Accepted

How critical is encryption-at-rest for public cloud hosted systems?

Your threat model is focused on external parties breaking in. But the threats are broader than that. Low-level hardware backups, VM snapshots, and disposed hardware can all contain data. And because ...
schroeder's user avatar
  • 131k
32 votes

More than three domains hosted on the same IP address

This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "...
manassehkatz-Moving 2 Codidact's user avatar
31 votes

Is starting an AWS instance with only ssh to port 22 significantly insecure?

The ssh key would be distributed to a small set of people. No, don't do that. Never share private keys. Have your folks generate key pairs on their own and collect their public keys. Take reasonable ...
iBug's user avatar
  • 1,368
31 votes

Is serverless code immune to DDoS attacks?

Theoretically speaking, there is no limit for resources that will be allocated to a Lambda function ... There is - it's the budget and the quotas. Lambda functions are not free to execute, so a DDoS ...
Steffen Ullrich's user avatar
24 votes
Accepted

Keeping AWS account ID secret

An AWS Account ID can be shared, when required. Like the documentation says, the main thing anyone can use your AWS Account Number for is to construct ARN's. For example, if I had an AWS Account ...
Stephen Sennett's user avatar
23 votes

Is an AWS "Access Key ID" a secret?

The Access Key ID is used for identifying the access key in logs, configuration, etc. It could in some environments be considered sensitive data if you're looking to not release who accesses which ...
Jeff Ferland's user avatar
  • 38.3k
22 votes

Is serverless code immune to DDoS attacks?

In short: all-in-all serverless is not a protection against any kind of attack. Note that "serverless" doesn’t mean servers are not involved. It only means that you have delegated server ...
Alexey Kamenskiy's user avatar
18 votes

Is an AWS "Access Key ID" a secret?

While the AWS Access Key ID is like a username (and the Secret Access Key is like a password), the Access Key ID is also designed to be shared and AWS does this explicitly with the AWS Presigned ...
Grokify's user avatar
  • 599
18 votes
Accepted

Hijacking stale DNS entry to point to your own website

This is a subdomain takeover. They typically happen in one of 2 ways: You have an A record pointing to an IP address that no longer exists and an attacker can gain control of the IP address in ...
Conor Mancone's user avatar
17 votes
Accepted

Understanding ssh-rsa not in PubkeyAcceptedAlgorithms

The name ssh-rsa has two different meanings here. There's the key type ssh-rsa which you can see in the first column of your authorized_keysfile. RSA keys are perfectly fine and widely supported. ...
Ja1024's user avatar
  • 9,170
13 votes

How to use AWS KMS securely?

Indeed you're right, anyone with access to the server can get plain-text key. Fundamentally your application needs to be able to get the plain-text key -- and hence any attack that fully compromises ...
keithRozario's user avatar
  • 3,711
11 votes
Accepted

How to use AWS KMS securely?

If your server resides in EC2, you can use IAM to create a role for that server and allow it access to KMS without needing to have the AWS access keys on the server. http://docs.aws.amazon.com/kms/...
grook5's user avatar
  • 126
11 votes
Accepted

How can I kill minerd malware on an AWS EC2 instance?

I found the solution to removing minerd. I was lucky enough to find the actual script that was used to infect my server. All I had to do was remove the elements placed by this script - On monkeyoto's ...
Anish Sana's user avatar
10 votes

Keeping AWS account ID secret

Knowing an AWS account ID doesn't expose you to any attack in itself, but it can make it easier for an attacker to obtaining other compromising information. Rhino Security Labs demonstrate a ...
nikobelia's user avatar
  • 209
9 votes
Accepted

What does Spectre mean for public cloud computing?

Spectre is far harder to use than Meltdown. In a cloud hosting situation, an attacker needs to know: What software the target is using Where in memory that software is Where in memory the target ...
Mark's user avatar
  • 34.7k
9 votes

Differences between the Root user and users with AdministratorAccess in AWS

There a few things that the root account can do that an Admin IAM user cannot but you're unlikely to run into them on a daily basis: Account management, particularly things like closing an account or ...
mibr's user avatar
  • 166
8 votes
Accepted

What is the threat model for AWS EBS volumes encryption?

tl;dr Auditors Many data security audits require data to be encrypted at rest. Often the threat model is an old hard drive ending up on eBay or picked out of the dump. If the data is unencrypted on ...
John Downey's user avatar
  • 1,975
8 votes
Accepted

Is it insecure to expose private bucket names through signed URL?

tl/dr: As long as the bucket is not publicly accessible (i.e. you need access keys to read/write), then don't worry about the name. It isn't private because your employees probably know it and ...
Conor Mancone's user avatar
8 votes
Accepted

Do I need to associate my backend API server with a domain name to get an SSL certificate for it (HTTPS)?

It seems that it's not possible obtain a certificate from Lets Encrypt for a public IP address, without a domain name. See https://community.letsencrypt.org/t/certificate-for-public-ip-without-domain-...
mti2935's user avatar
  • 23.6k
7 votes

Best practices for managing AWS EC2 Key Pairs

Regarding the general managment of private/public keys, there are already other answered questions here on SE: What is the best practice: separate ssh-key per host and user VS one ssh-key for all ...
twobeers's user avatar
  • 1,099
7 votes

How can I kill minerd malware on an AWS EC2 instance?

Your first goal is (if you don't want to reinstall) is to determine how it managed to get there in the first place. If the attacker was crafty, they'd of run "timestomp" to modify the dates of ...
munkeyoto's user avatar
  • 8,692
7 votes

Pentesting against own web service hosted on 3rd party platform

You should also check with your ISP. Depending on government regulations and their own operating policies, they could be required to block your pentest actions if detected, or cancel your service ...
Mike Lane's user avatar
7 votes
Accepted

Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers

If the load balancer terminates TLS (like in Layer 7 load balancing) then this will mitigate these bugs in your application since there will be (depending on the configuration) no TLS spoken between ...
Steffen Ullrich's user avatar
6 votes

How AWS access key id and secret access key are generated internally

From the documentation [0][1], we see that you prove to AWS that you know the Secret Access Key using HMAC, not using Digital Signatures. This means that when verifying the authentication, AWS must be ...
Z.T.'s user avatar
  • 8,524
6 votes
Accepted

Security of setting access to S3 bucket only from a particular website

Your intuition is correct in the most important way -- this is not, in any meaningful sense, "secure." But the way it's defeated is not quite what you envision. When you click a link on a web page, ...
Michael - sqlbot's user avatar
6 votes
Accepted

How to set up a pentesting lab in Amazon Web Services?

First, a word of caution: AWS requires that you inform them of any security related test you plan on running to their infrastructure [link]. Second, Kali is not a vulnerable operating system, it is ...
Purefan's user avatar
  • 3,550

Only top scored, non community-wiki answers of a minimum length are eligible