Hot answers tagged

564

This attack is supposed to be presented 10 days from now, but my guess is that they use compression. SSL/TLS optionally supports data compression. In the ClientHello message, the client states the list of compression algorithms that it knows of, and the server responds, in the ServerHello, with the compression algorithm that will be used. Compression ...


171

The nice and educational way This is a bit similar to your third bullet point. Nobody else should know your password, not even people you trust. That is the only way you can be sure only you have access to your account. Let's say you give me your Facebook password and a week later rumors start spreading about what you did in Las Vegas last year. ...


152

This post is about communication with people that have absolutely no technical knowledge or interest; especially people afraid of technology. Don't explain, don't complain It is incredible hard to change other people, especially if they are IT laymen and you are the expert. This is the same issue as in general communications. Avoid all sentences that ...


140

Does it improve security to use obscure port numbers? If you're already using high entropy passwords or public key authentication, the answer is "not really". Mostly you're just getting rid of noise in logs. I worry about the unintended consequences of deviating from these recommendations. It depends on what port was picked. In Linux, by default all ...


118

No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied input unsafely in a query: http://example/index.php?id=1 => SELECT * from page where id = 1 In your example the attacker would use spaces: http://example/index....


98

Disclaimer: I work at a company developing security software to mitigate against targeted attacks. Some of the methods we use are similar to those used by attackers (when clients want to test their systems). For example, one client asked us to test their security by doing targeted [spear] phishing attacks. We emailed only the IT department with a ...


76

The potential impact of this is not low, regardless of how much information the thin client stores. Specifically the risk is that an attacker installs something like a rootkit or software keylogger in the operating system of the thin client, which you are unlikely to be able to discover by inspection. (This is a variant of the Evil Maid attack). Should ...


68

Funny enough, I actually don't accept your premise. As an IT professional you can read other people's emails and other communication, delete their directories etc. It is part of the professional code of conduct not to abuse your position. People trust your integrity, the same way they trust their bank's employees not to steal their money, although they could....


67

You don't need to lock your front door unless you're a thief. It's the same idea in all relevant respects. Each person needs to take reasonable measures to protect himself and his property from those who would harm him or his property, in accordance with his best judgment of the risks. You buy a lock and lock your front door if you live in a city, in ...


67

Welcome to the internet! This is the normal situation, business as usual. You don't have to do anything, but to harden your website. Probes like that occurs all the time, on every site, day and night. Some people call that "voluntary pen testing." Depending on your site, there are some tools that you can use to help you keep those kinds of probes out of ...


58

All of security can be boiled down to threat modeling, risk assessment, risk management, and risk mitigation. So no, defenses designed to protect against non-targeted attacks are not likely to do well against targeted attacks. What makes a targeted attacker (or what you call a "professional attacker") different? Simply the intelligence and money they're ...


55

Yes, it does. The real question is: By how much? Why it does? You already have basic security, so the everyday bot attacks don't worry you. But there could be a 0-day tomorrow and the attackers know it won't be long until a patch is out, so they scramble to use it and won't bother with something complicated - they will just hit as many machines as possible ...


52

To add to Thomas Pornin's outstanding answer, I wanted to point out some prior work on the subject of compression and cryptography. Take a look at the following research paper: John Kelsey. Compression and Information Leakage of Plaintext. FSE 2002. That paper describes chosen-plaintext attacks against systems that (a) compress data before encrypting it,...


48

We're in 2016! SQL injections are a thing of the past unless you use insecure code. Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other type of data binding. Prepared statements separate the query from the data, making it impossible for the data to affect the query. To directly answer your ...


46

It depends. Think of your IP address as the same kinda thing as a real address. If a criminal knows the address of a bank, what can they do? It completely depends on what security is in place. If you've got a firewall running (e.g. Windows Firewall) or are behind a NAT router, you're probably safe. Both of these will prevent arbitrary incoming traffic from ...


46

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner. That may not have helped you at all. The reason I'm saying this is because you connected that laptop to the corporate network after you brought it back to your country. This loaner had MS Outlook and was linked to my ...


43

As for anything attached to public networks: Reduce your attack surface - can you remove the NAS from the Internet? Can you limit the IPs that are allowed to connect? Increase cost of attack - lockouts are great, but also make sure that you have a complex password and that you change it regularly Monitor access - keep your eye on who successfully logs in ...


38

Just change the password after you're done helping them, and send them a password reset link. They will soon learn that it's easier to keep their passwords safe than to restore them. Alternatively (e.g. for a primary e-mail account), simply change their password to a strong one and communicate it to them. Explain that changing passwords and using computer ...


36

There's a great short essay written by Bruce Schneier on the right of privacy: The most common retort against privacy advocates -- by those in favor of ID checks, cameras, databases, data mining and other wholesale surveillance measures -- is this line: "If you aren't doing anything wrong, what do you have to hide?" Some clever answers: "If I'm ...


33

A few years ago (2003), there was this worm called "Blaster" (or MSBlast, Lovesan etc. - read more on https://en.wikipedia.org/wiki/Blaster_(computer_worm)). It spread by using a vulnerability in an RPC service, running on Windows XP and 2000. At the time where it was "worst", you could get infected within minutes, if you didn't have a firewall set up. I ...


33

7-zip (or any other similar utilities) encryption is designed to protect archived files. So, as long as the tool designers did their job well, you are safe for the second case (somebody getting his hand on the encrypted file and trying to crack it). However, such utility are not designed to protect you against your first mentioned case (someone getting ...


31

No, it will not improve security. It may reduce log clutter, as automated attacks will only try default ports for e.g. ssh. But the port will still show up as SSH in a port scan, and shodan.io. Those automated attacks typically aim for low hanging fruit, with standard usernames such as root, smith and so forth, and weak passwords. If they succeed, you have ...


30

My first thought is to ask, “Do you have anything valuable that you don’t want someone else to have?” If the answer is Yes then follow up with “Are you doing anything to protect it?” From there you can suggest ways to protect what is valuable (do threat modeling, attack modeling, etc.).


30

Just to add to great Thomas answer, it seems that to successfully leak the cookie value the actual POST body sent should not only be the: Cookie: secret=.... but should contain much more text from the POST header, like so: POST / HTTP/1.1 Host: thebankserver.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (...


29

Positive reasons Instead of a beach holiday, we joined a Christian Mission this summer in Malawi. We're keeping quiet about it in case the children are teased at school. I leapt into the road and saved a toddler's life. I just walked away because I don't want any fuss. Controlling dissemination My wife is pregnant, great news! We want to tell close family ...


29

I don't believe you (or anyone else) is targeted by the US Department of Defense. More plausibly, AT&T screwed up something on their server. A very quick research on the number 1111301000 returns this article which seemingly sent by AT&T. Regarding the number 6.216.198.5, it's a coincidence that a substring of AT&T's IP address pointed to the ...


28

I think one of the main lessons learned is that the security services shouldn’t be hoarding zero days and tools to exploit them, (especially) if they can’t properly secure them. The thing to remember, however, is that WannaCrypt and Petya both had patches available before they hit and both also took advantage of poor configuration. Additionally, many ...


27

As the Miranda Rights say: "anything you say can and will be used against you in a court of law". Right after the police finish giving you the Miranda rights, they then say "but if you are innocent, why don't you talk to us?". This leads to many people getting convicted of crimes because it is indeed used against them in a court of law. This is a great video ...


27

The difference between a random attack and a targeted attack can be summarized nicely: The attacker want N number of remote nodes for DDoSing / Spamming / Phishing / etc. or The attacker wants XYZ data on user2174870's machine specifically. If the attacker is just looking to build a botnet (>>99% of attacks) then simply being harder to crack than the ...


27

The problem with such attacks is that neither the attacker nor the defender have any incentives to claim responsibility of the attack. As such attacks can be done with small number of people and the internet also makes it possible to conceal the source of an attack, a well resourced attacker can even make it impossible for the defender to realise that an ...


Only top voted, non community-wiki answers of a minimum length are eligible