Hot answers tagged

4

In my experience I have never seen any storage devices that does this by themself. As others in the comments has mentioned: Some information like hours powered on, the number of timed powered on and some other information are stored in the hard drive and are accessible using SMART. However, many operating systems including Windows, macOS and Android will ...


3

I did not yet come across a device which does that (in an easy to recognize way*) but in theory they could. And in practice they sometimes do. In the end a harddrive is a cpu (often an ARM processor) + ram (cache) + bios/bootloader (on the CPU itself or the NAND or some other chip) + lots of attached storage (not everything of that being visible to the ...


3

What stops a nation state starting a “VPN service” to view its customers' logs? No technical hurdles stop anybody from starting such a VPN service, no matter if a government or private company. It is clearly technical possible to create a VPN service which logs data. The main point is to convince users to use the service, i.e. to convince them initially to ...


2

There is no "definition" of what logging in terms of a VPN covers or not covers. There might only be an expectation based on whatever information (like marketing), but expectation is not definition. VyPrVPN itself offers a more detailed explanation itself what they mean. From Our Commitment to Our Users: ... we don't track or retain any user ...


2

There are many different things that could possibly be logged. They are certainly able to define things how they want for advertising purposes; it sounds like while they log the who and when, they don't actually log what sites you are visiting (which is probably the privacy concern for most users). However, "no-log" would probably imply to most ...


2

You are right, it is not recommended to log sensitive information (passwords, session IDs, credit cards, etc) as log files may be handled less securely than storage that is specifically designed for this information. But it is also not recommended to run debug mode in production, as it may introduce security issues. Spring Security for example documents this:...


1

A centralized logging server like a SIEM which has regular backups would be a great place to start. This would also allow you to more easily analyze these logs for anomalies versus reading the raw event logs. There are a variety of open source solutions that cost no money that can perform this task.


1

Yes! Use auditd on the host. Docker containers are not VMs and you don’t log into them. You run commands in the context of the docker container (ie the commands you run think they are in a container but they are really running on the host OS). If you want to monitor the commands run on the container you can the same way you monitor the commands run on the ...


1

Well, that is difficult. If you "login" into a container (using docker exec) then technically you do not login into a container. You are simply opening a shell. Docker opens a window for you to enter commands and see their result. Then in the container you are usually able to run commands as the user which was chosen to run the application inside ...


1

In Android 5.1.1, all processes can be listed (ps command) through an App (tested on AVD). An Android application can be used as a background services that log (in logcat) all the processes that have a PPID the same as adbd process (recursively): fun adbMonitor(){ try { val process = Runtime.getRuntime().exec("/...


1

If you have search suggestions enabled, which sends each keystroke to Google so that it can provide you with a list of possible completions, then yes, they will know your IP. Otherwise you will only connect to them when you press enter. I do not know if Safari uses suggestions by default.


1

Many things in the security field are relative, means they depend on context. In your case the exception may contain some sensitive data. Only you can decide if this is a weakness or not. A few examples: If the exception text contains person names, addresses, account numbers, this may be a security issue in some cases. Normally we don't want to have such ...


1

What am I missing? Maybe just the fact that static analysis tools can give a lot of false positives. At first glance, your reasoning sounds good to me--unless there is some way for the user to inject data into the generic Exception.Message.


1

No vulnerabilities are typically not shared across different software or hardware platforms or even different versions of the affected software. What you posted appears to be a precursor or exploitation attempt for CVE-202-25078, a D-LINK router vulnerability. Typically any IP address on the internet receives a lot of nuisance traffic trying to collect ...


1

I do not believe Windows stores app credentials by default. But Windows CAN do almost anything you (or an attacker with sufficient access) tells it to. I think it is important to distinguish credentials (your password) and session management (access to the application). These patterns and advice apply to most client-server applications. Applications are ...


1

Hidden Assumptions I think you may have an underlying assumption here that is causing you to look in the wrong direction. Quoting you (emphasis mine) they are given personal users with read-only access to the machine This makes two assumptions: the application is run by a server that you can connect to, and there is only one of them. How do you propose ...


1

In general, I think there is recognition that operations engineers and sometimes developers (either internal or with the 3rd party vendor whose products you are using) will need to see production logs in order to debug issues. The number of hoops you need to jump through -- like type of authentication, audit logs, redacting sensitive data, etc -- will depend ...


1

Theoretically, any software running on your system could monitor socket activity if given the appropriate privileges. (It's not exactly clear from your question, as it stands, as to what you want an answer to.) I'll assume that you're asking whether a free VPN provider that you use is logging network activity of other applications running on the same host, ...


1

It depends on your outsider. A normal internet connection goes from your client (like a browser) to an endpoint (like a website). The ISP as well as the endpoint knows your IP address. However when connecting through the ISPs network through a website you often have additional routers on the path, big internet exchanges ... Just do a traceroute from your ...


Only top voted, non community-wiki answers of a minimum length are eligible