Hot answers tagged

67

Welcome to the internet! This is the normal situation, business as usual. You don't have to do anything, but to harden your website. Probes like that occurs all the time, on every site, day and night. Some people call that "voluntary pen testing." Depending on your site, there are some tools that you can use to help you keep those kinds of probes out of ...


27

The problem with such attacks is that neither the attacker nor the defender have any incentives to claim responsibility of the attack. As such attacks can be done with small number of people and the internet also makes it possible to conceal the source of an attack, a well resourced attacker can even make it impossible for the defender to realise that an ...


12

Yes. The Russian government appears to be using attacks to destabilise the Ukraine - for some years now. There's a well researched Wired article that has a lot of details: https://www.wired.com/story/russian-hackers-attack-ukraine/ Then there's also NotPetya (which, you may remember, got a little out of hand): https://www.wired.com/story/notpetya-...


6

The attack vector here is disclosure of the token. The defense is not so much concerned with specifically how that token is disclosed, but addresses any method in which an attacker might obtain that value. If an attacker can obtain the token, that opens the possibility they can craft a CSRF attack. Again, the specific method of attack itself isn't the ...


5

The first step outside of immediately looking to a solution is to conduct a pentest of your own site and be actually aware of what weaknesses there are in your site. If you don't know what you are protecting, then how will you know to protect it? First, look at the infrastructure such as CMS. For example, if you are using Wordpress, then there are ...


4

What options do I have for preventing network services from allowing weak TLS ciphers? Changing the application or the applications configuration is one option, provided that the version of OpenSSL on the device actually supports the stronger ciphers you want. Changing OpenSSL and restricting the available ciphers is another one, but make sure that all ...


4

The idea that redteamers or pentesters are 'skilled up' from blueteamers is a misconception, plain and simple. In the same way that you can defend against XSS without necessarily knowing how to construct a complex XSS attack (which encompasses more than just the XSS code itself, i.e. the payload), you don't need to know how to write code to prevent XSS ...


3

All of the steps you listed can be boiled down into two simple rules: Keep all software, including AV, up to date. Do not download and run anything you don't fully trust. Now, in more detail: Install Antivirus software. You should install antivirus software to detect and block the low hanging fruit. I would recommend using Windows Defender, which is ...


3

The term "Cyber Warfare" is largely nonsense. There just isn't enough there to make a prolonged exchange of hostilities likely, not on the order of magnitude that you could call a "war". However, as we have seen already, there is quite a bit of critical infrastructure reachable (directly or indirectly) through the Internet. If an actual war would break out ...


3

I cannot quantify for you, but it can certainly be said that strategic cyber-warfare is increasingly feasible - with whole swathes of vital national infrastructure now completely dependent on digital integrity. It could be argued that the feasibility of strategic cyber-warfare is increasing with exponential. Especially so with the emergence of everyday ...


2

HTTPS is a defense against the man in the middle (MITM) attack you describe Being https, may be the attacker cannot decipher the response, but can certainly change the response content or redirect to some malicious site I don't see how a MITM could modify the response when the browser is expecting a https response. If you are worried about the ...


2

I have met various people who have worked both red and blue at some point, and they will pick one or the other for various reasons. Some enjoy the thrill and satisfaction of solving the puzzle and breaking in, while others may find it more enjoyable to be the one who gets to build an elaborate fortress and outsmart the attacker. Ideally, the skill set would ...


2

Work out what they are looking for, and ban their IP for a month or two if they try it on. You might also dummy up some PHP to slow them down. Do not refer them to other sites for huge downloads, and do not leave malware for them to find. 90% will be Wordpress, PHPMyAdmin, Telephony. If they are script kiddies the same old values pop up. Look into ...


2

The feature you named does not exist. What you're actually asking about is Windows Defender Credential Guard. This feature moves your passwords and derived credentials for Kerberos and NTLM used to communicate with services on the network into a separate secure virtual machine (VSM). The point of the feature is to make it more difficult for attackers to ...


2

It can't be changed globally in OpenSSL's configuration, but recompiling without certain ciphers is easy. Just give the no-[cipher-to-disable] parameter to ./configure. For example ./config no-ssl2 no-ssl3 no-tls1 no-tls1_1 no-dtls no-dtls1_1 no-ssl2-method no-ssl3-method no-tls1-method no-tls1_1-method no-dtls-method no-dtls1_1-method no-weak-ssl-ciphers ...


2

Fix your XSS Vulnerability! I'm really just repeating Ander's comment, but it is the only correct answer so I'm posting it as an answer. You are suffering from the X-Y problem. You don't want to stop an attacker from using window.location. You need to find and plug your XSS vulnerability, remove all stored XSS from your system, and hope he didn't use ...


1

There are multiple approaches an attacker can use for host discovery. I believe netdiscover uses ARP requests for host discovery, which operates on the Ethernet protocol (see https://github.com/alexxy/netdiscover). Other tools like nmap operate at higher protocol layers (ICMP, TCP/IP, UDP/IP, see https://nmap.org/book/man-host-discovery.html). A solution ...


1

Mitigations for XSS attacks are not typically restricted to input filtering as you’re describing and attempting, as you’re experiencing it’s like playing whackamole with possible filter bypasses. That’s why the Filter Evasion cheat sheet from OWASP exists. Any untrusted input that’s reflected in a browser response needs to be output encoded. For example ...


1

Compromised AV software is a pretty big deal, it often has all sorts of privileges to your system including control over your software firewall. If you are lucky, they will just use the access to install ransomware or something else that is obviously malicious. In this case, your best defense is good backups. When your machine show signs of infection, ...


1

I would say security "in-depth always". What you have read is what is public in a way. Wearing my tin-foil hat, it's a good idea to assume advanced and state sponsored groups have attacks on other security software too (you might have read how an Israeli group hacked Kaspersky and saw how a Russian group also hacked them and stole data a few years ago). The ...


1

Your server doesn't need to do anything to the Synchronizer Token on logout. It only needs to generate a new token on every login. The obvious condition for Syncrhronizer Token to work is: the attacker must not know the victim's CSRF Token. Else, the token becomes meaningless as the attacker can simply submit the token as part of the malicious request. If ...


1

No, there is no comprehensive checklist that you can just complete and be "secure". Security is not a destination, it's a mindset, and part of the product lifecycle. You need to re-evaluation as your product matures. There are common exploits. Check the OWASP top 10 list. Since software is so custom, it wouldn't be very useful to have a list where 99% of ...


1

This can be done by certificates on domain names that point to RFC1918 addresses. Each device gets its own subdomain (c12345.umbrellacams.com), and each subdomain has its own certificate. When installing the device in the network, it has to send its address to the server in order to update the DNS entry on the subdomain. When the user visits the camera in ...


1

You should have a different private key for each device. Here's the reason that i can think of : This keys are for authentication so if you share them, you won't be able to discrimate the different users/devices connecting to your server. Should a problem happens you'll probably want to know the device involved. The security of Public key authentication is ...


1

I would say it depends. In generall IP blocking is a good practice because the IP is the only identifier that exists for anonymous users. But keep in mind that a user can "switch" IPs using online proxy services AND on the other hand that maybe multiple users share an identical IP when they use a proxy server (which ist often the case in enterprise ...


1

The accepted answer already covers the important point, but it looks like you have some other misunderstandings that I'd like to help you clear up. We could replicate this scenario through our proxy tool. If you can modify HTTPS responses via a prozy (such as Fiddler, Burp, or ZAP), you must have either installed the browser's root certificate on your ...


1

As Edward Snowden said (Video): "Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say".


Only top voted, non community-wiki answers of a minimum length are eligible