58

Yes. There is a tool on GitHub here that can change that information. It supports both 64-bit and 32-bit. The syntax I used: rcedit-x64.exe cmx.exe --set-version-string OriginalFilename "cmdx.exe" --set-version-string FileDescription "details are irrelevant" Therefore, your solution may be efficient against beginners, but not against people with IT ...


22

It is not clear from your description why you want block these files exactly. I see the following possibilities: You want to block files that might infect the server itself. Unfortunately this can be about anything: shell, perl, python, awk, ... and of course compiled binaries. But to get these files executed without explicitly calling them with an ...


14

Don't block any specific MIME types. Block any kind of execution of the uploaded files. A simple way is to store uploaded files outside of the web root and serve them via scripting. If that's not possible, store files in a subdirectory and configure your server not to execute any scripts in that directory. Remember to do this for any scripting language that ...


10

It's probably because of a couple of reasons: The IP block was earlier assigned to someone who used it to spam or spread malware. The IP Block belongs to a country that the site/company doesn't want connections from - generally done for countries that have a very high quantity of malicious traffic originating from them.


9

In order to answer your timing question it's important to understand how blacklists really help you. Blacklists are a great way to slow-down attackers and work great when triggered appropriately. Even a 30-minute blacklist can really have a huge impact against any type of automated attack. There are tools like fail2ban (link below) which can easily help you ...


8

It is not just a block of handful characters that you need to blacklist. In security we go by this dogma: "There are things we know that we know. There are known unknowns. That is to say there are things that we now know we don't know. But there are also unknown unknowns. There are things we do not know we don't know." Blacklist might help you ...


7

Also, why is whitelist approach better than blacklist approach as mentioned by OWASP. Why not just block a handfull of characters used in XSS like < , > , etc Blacklists are static in the sense, they prevent 'known bad' from happening. The problem with this is, there are new attack vectors found everyday and you would need to constantly update your ...


6

Are there any other filetype that I also should block? It doesn't matter, as finfo_file can be bypassed, see for example here: Encoding Web Shells in PNG IDAT chunks. mime_content_type doesn't seem to be more reliable either. You need to check for file extension in addition to the mimetype check, as it is a lot more reliable, as file names are a lot less ...


5

I have been involved with incidents where an attacker used a particular cloud service or VPS provider and their IP would rotate between an unpredictable range of IPs within a CIDR block. So, instead of blocking each IP as they appeared, we blocked the whole CIDR block until the attacker gave up. It is easy to imagine that someone used the same technique ...


4

I think you might have rejected ESAPI too quickly. To defend against XSS, I recommend you do output escaping: any place where you insert data dynamically into an HTML document, escape the data (in a way suitable for that parse context). ESAPI provides libraries for the escaping and is very useful. This does not involve "changing your input". For more, ...


4

Regsvr32 is a trusted Microsoft binary. The regsvr32 is a windows command line utility that is used to register and unregister .dll files and ActiveX controls into the registry. Casey Smith discovered that it is possible to bypass AppLocker script rules by calling the regsrv32 utility to execute a command or arbitrary code through .sct files. This utility ...


3

do input filtering No, no, no. By all means do input validation - accept or reject the input based on rules. Don't try to change the input data. If the interface between your webserver and your application language allows content through which compromises you application language then there's something very, very wrong. Certainly you can't handle this kind ...


3

According to several of these answers: https://serverfault.com/questions/381393/can-the-ip-address-for-an-http-request-be-spoofed It is really unlikely that you could indeed spoof the IP address and send a full HTTP request to a server. TCP requires a three-way handshake, which means sending one packet back to the sender and expecting a very specific ...


3

There are a LOT of blacklists. I use often this tool, and it currently shows 103 blacklists. You might need to check each of these: https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3astackexchange.com&run=toolpage#


3

I can't find any information on what the process is to get this notice removed. Your site was clearly visible blocked by Windows Defender SmartScreen. Your problem is addressed in the Windows Defender SmartScreen FAQ or your might just have looked further into the More Information part of the message. To cite from the FAQ: Q. If I am a website owner, ...


2

You could always create a white-list of IP addresses or domain names validation like only accept from .example1.org or .example2.org. Either the domain name or the ip address. Black lists are bad because and attacker could use a different IP address. (i.e. tor or a bot net) managing that list would be a nightmare. A white list make it easier as you don't ...


2

Before the email is sent, you can grab all URLs with a regexp, and then submit them to Googles Safe Browsing API to check if they are known to be malicious. If so, just don't send the email or include a warning.


2

Simply put, there is no way to do this at a high volume that won't run against large email account providers' protection features and eventually get you blacklisted. You are better off with different strategies to maintain proper lists, such as handling error codes correctly when delivering actual messages to remove invalid addresses from the list, using a ...


2

While you might have a valid reason to do mass verification of e-mail addresses such validations are also done in preparation of spamming these users and thus are often considered misuse - which will quickly get you onto blacklists. No TLS will help you in this case, because TLS only protects the transport but says nothing about abuse or not.


2

I suggest a short-term quarantine of all uploaded files. You can use local systems scanning and AV tools in a temporary jail. This way you could add a routine to scan for malicious files and ignore all the different names of files. This stops the whack-a-mole game. This would add some latency to the application. I know this is not a coding solution but it ...


2

The Anti-Phishing Working Group (APWG) has statistics about how long it takes, after notification (e.g., through MarkMonitor or similar), for a dead-drop site (e.g., malware or botnet C2) to go down. Take it with a grain of salt though, the APWG tracks criminal actors, but nation-state actors have been found to keep their C2 running for 4-5 years, perhaps ...


2

If you are on one blacklist, you are likely to be on several now or in the next few days or weeks. You will need to check several times. Several services provide limited free ongoing periodic checks (more services for paid subscription). Here are three tools you can try in addition to delisting with Barracuda itself (per answer by Nicholas Leader). I ...


2

are there reasons for blacklisting some subdomains of a domain but not the whole domain? Yes. For example, a free domain hosting service such as http://000webhost.com would offer their users a domain address such as PICKYOURSUBDOMAIN.abc.com. Here the user using the free web hosting service could pick their own name for the subdomain and multiple users ...


2

Brief introduction to COM COM is a Microsoft standard for the binary layout of objects in memory. This standard is independent of the programming language used though is similar to the well-known C++ virtual dispatching through the vtables. Basically, COM consists of objects and interfaces. Object are abstract entities, they are a collection of ...


2

Why hashed? What security problem does that solve? I could imagine several reasons for this decision: Using the shorted hashes saves a lots of space. While it is possible to easily lookup specific URL's it is impossible to find out the whole list and then maybe reverse engineer parts on how Google creates this list in the first place. This makes it harder ...


2

Brightcloud makes a great product that gets update frequently: https://www.brightcloud.com/ There are a lot of open source lists, but I personally find that they tend to have a lot of stale data.


1

Entire string match when looking at domain makes a greater sense. Think about the pitfalls if this is not done. If the blacklist says block abc.amazonaws.com, blocking the entire Amazon AWS service could be detrimental to the business. Similarly, dynamic DNS based domains provide another level of difficulty when building the blacklist. Botnets and malicious ...


1

I don't think yahoo has been comprised. Not that I would expect them to tell us if they discover they were! I agree with the https everywhere scenario. Plus it could be that the IP is marked by these services as phishing because It's and IP rather than domain name on this IP is returning 'fake' copies of sites. Which is correct as they are cached but this ...


1

Knowledge-based is like a signature-based anti-virus: you populate a database of "badness" and look for those things. Behaviour-based learns what is normal for the network over time, then alerts on things that are "weird". Your whitelist approach is still "knowledge-based" because you populate the whitelist database. A behaviour-based approach would learn ...


Only top voted, non community-wiki answers of a minimum length are eligible