The Stack Overflow podcast is back! Listen to an interview with our new CEO.
51

Yes, in theory by advertising vendor and version in the banner makes an attacker's job easier, but like only a little bit. Even if you don't advertise it, it can be figured out from the behaviour of the app. Take for example, the network scanning tool nmap: Nmap provides a number of features for probing computer networks, including host discovery and ...


28

Attackers just do not care. When you have a popular website, you find bots probing for every (vulnerable) version of phpmyadmin on every conceivable path, even when your site does not use a database at all. In the same manner, they probably probe for security holes in every version of, e.g., apache. Lying on or omitting the Server header does not buy you ...


14

I think you might be assuming that the kits are more complicated than they are. A kit is designed to exploit specific vulnerabilities. It is not necessary to 'fingerprint' and choose the best exploit. It can just attempt to exploit what it is designed to exploit. Some kits will attempt one method after another in series until something works. For ...


13

Once it starts, a BitTorrent client generates a 20-byte identifier called peer_id, it consists of ClientIdentifierClientVersion-RandomNumbers. Granted, ClientIdentifier and ClientVersion don't provide any identification, but the RandomNumbers could be used to identify a client, and there are some things that needs to be understood: The peer_id could be ...


13

An excellent slideshow on this topic (in my opinion) is the one from Marc Rogers. Basically, he says the following: Most fingerprint systems can be hacked Fingerprint security provides convenient security, not military grade security I also like the analogy in his explanation: Door locks have been defeated with increasing elaborate picking techniques as ...


13

Historically, many servers returned headers like this: Server: Apache/2.4.1 (Unix) mod_php/1.2 mod_ssl/0.9 This does give away a bit more information than you want, so most servers now default to headers like this: Server: Apache In fact, most web servers make it difficult to turn off this header. The reason? Marketing. They want to appear in surveys ...


10

Using nmap: sudo nmap -O <target> Or if they block your ping probes you can do: sudo nmap -O <target> -Pn Sometimes you still get fake results and you should try doing an aggressive scan (can be detected and blocked by the firewall). sudo nmap -A <target>


10

When you do not change anything, the Tor browser is already configured in a way that the fingerprint is identical to every other Tor browser (and is close to the most common fingerprint on the web). I recommend to rely on this instead of messing around with it by yourself since there are many possibilities to build a fingerprint. Have a look at the open and ...


9

No, I don't think photographs or HD camera footage of powerful people waving to cameras is a security flaw for several reasons: It's not trivial to get fingerprint patterns from HD cameras: it's highly unlikely that you could make a workable print from an HD camera. Even if the person in question held their finger up to the camera in perfect lighting ...


9

Are there ways to passively fingerprint (infer) the operating system or mail client that an email sender is using, based upon the headers of an email from that sender? Yes, but they are extremely prone to errors and very easy to spoof, either intentionally or unintentionally (e.g. some high-end firewall systems will "repack" a message after removing/...


9

Based on https://superuser.com/questions/363018/how-do-i-tell-what-version-and-edition-of-windows-is-on-the-filesystem you can find the Windows Version and Service pack in C:\Windows\System32\license.rtf for Windows 7. For Windows XP the information is in C:\Windows\System32\eula.txt. For Windows 10 licenses.rtf does not contain the version. Instead it ...


8

Firefox From Firefox 52, the battery API has been disabled and is only available to chrome/privileged code (I would assume add-ons fall into this category). For earlier versions, the battery API is enabled by default. It can be disabled by going to to about:config and setting the dom.battery.enabled to false. Changes take effect immediately on subsequent ...


7

This looks like a classical Canary Trap. Basicly I would suggest to hide encrypted information about the user in different ways: obvious QR-Code (as suggested by slugster) different colors (as suggested by Nick Wilde) page viewed as username - footer on each page replacing certain words with synonyms code information in spaces and interpunction within the ...


7

It sounds like you are interested in finger printing a CMS. This can be done similar to what is done with nmap. You would need to compromise a library of unique urls, etc and than scan a page to see if they exhibit these. You can use BuiltWith.com. Here are some examples of it is use: Joomla.org being positively identified as Joomla Wordpress.org being ...


7

This site describes the techniques used in canvas fingerprinting: The technique is based on the fact that the same canvas image may be rendered differently in different computers. This happens for several reasons. At the image format level – web browsers uses different image processing engines, image export options, compression level, the final images may ...


6

You could compare the Last-Modified HTTP headers for some static resources (e.g images, css), from each IP, and see whether they are different. If they are different I would assume the IPs are separate hosts. You could also make a request to both IPs at the exact same moment and compare the Date HTTP header in the responses - if they are different then the ...


6

This sounds like a Zombie Cookie. There are a large number of places a web site can store state: cookies, Flash local storage, ETags, etc. When you clear your cookies, you do not necessarily clear all these places. Web sites can store an identifier in some of these other places, and track users despite them clearing their cookies. If you use a dedicated ...


6

Likely not, but you can never be sure. First, why does a website "attempted to extract HTML5 canvas image data"? The HTML5 canvas element allows manipulations of 2d images with Javascript. Among many other operations, it can draw images or videos to the canvas and then manipulate them on a pixel-by-pixel level. While there are lots of legitimate uses for ...


6

Misuse of free accounts for spamming and similar is a big problem many providers face. Thus they try to detect early if an account creation is somehow unusual, like being automated by a computer or multiple accounts created by cheap labor. By using a fresh browser profile and trying to be as undedectable as possible you are essentially behaving similar to ...


5

Configured properly, you shouldn't be able to detect snort. "Properly" means on an unconfigured/no-address-assigned port in promiscuous mode. As PTW-105 mentioned, if snort is configured to send resets then maybe you can detect it, but more likely, you'd detect that something was blocking you. The same holds true if it's in inline mode. Two things I can ...


5

Yes, it's possible, but it's a lot harder than you think, and you'll end up breaking some things no matter what. To take your full-screen video example, it's not the website that asks for the screen size, it's Javascript running on a web page, and you can't know at the time of the request if it's going to use the size to adjust a video, or to fingerprint ...


5

Given that you're attempting to defend against a Google "all-seeing-eye" attack, (and not the NSA), this is a good start. I've added a couple suggestions below. Your search engine activity will be trackable through the generation of unique links. Consider using a privacy-oriented search engine, like DuckDuckGo. You have their word they aren't trying to ...


5

Try this echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256 The output should look like this: $ echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256 SHA256 Fingerprint=2B:53:3C:29:EF:1E:DD:62:5A:A0:2A:D6:45:99:3C:...


5

As said, it's not a security issue to leave it, and it's a useful information for some client programs. Take curl for instance: it uses the Server header value to check if HTTP pipelining can be enabled: Taken from https://serverfault.com/a/596560/347610 [curl shows this message when run in verbose mode -v]: * Server Apache/... is not blacklisted ...


4

This procedure is probably helpful in identifying and blocking a large number of bots, but people that want to steal your data, will customize and randomize as much as possible in order to avoid detection. Then No. This approach isn't the most effective against the more sophisticated scrapers. I've seen scrapers changing entirely their HTTP requests several ...


4

You asked about https, not tor which is a different question, so I'll address the https part. There's a lot of information sent in the clear to setup an https session. Probably the most obviously useful would be the client sending the cipher suites supported, cipher preferences, and SSL versions the client supports. Cipher suite support varies widely ...


4

It could, and it does, but not as much as you'd think. Your IP address can be unique or it can be different on a per-user bases. If you live alone and have your own cable model, then - for a while - you'll have a unique address. However, at some point, your lease will be up and you'll be assigned a new address and somebody else will be assigned yours. If ...


4

IP addresses were never designed as a secure means of identifying anyone, and you should be wary of trusting them to perform a security function. There are several reasons not to, but the main one is that IP addresses are not static, and are constantly changing. Network Address Translation (NAT) is used by network administrators everywhere to support ...


4

HPKP could be used for tracking in big scale since it has report URIs: Send HPKP header with includeSubdomains set and a report-uri with unique random generated parameter. Embed a hidden image from a subdomain that uses a invalid/not pinned certificate. Browser calls report-uri with unique parameter. Only issue I see is a new report-uri with new UID being ...


Only top voted, non community-wiki answers of a minimum length are eligible