Hot answers tagged

73 votes
Accepted

Is physical security less important with disks on a server being encrypted?

Physical access, in many, likely most, situations means a total loss of security - for a variety of reasons (this all assumes encrypted disks): Theft - An attacker could steal the server or disks, to ...
Adam Caudill's user avatar
  • 1,814
52 votes
Accepted

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

This question is a bit broad, but I think an answer that is a little bit broad will still be helpful. The answer depends on the "kind" of hosting you are talking about. There are three main kinds ...
Conor Mancone's user avatar
50 votes
Accepted

Does changing an uploaded executable's file extension to .png render it safe?

There are basically two main ways an uploaded file can be harmful: by being executed (as a script or binary) or by being run/used in an application and abusing an exploit in it (e.g. an uploaded MP3 ...
Draugr's user avatar
  • 670
47 votes
Accepted

What is the most secured SMTP authentication type?

With SSL/TLS it's okay to use LOGIN / PLAIN. You should provide SMTP on top of an SSL-encrypted connection. While some schemes from your list (e.g. DIGEST-MD5) can keep a password secure even over an ...
Arminius's user avatar
  • 44.7k
41 votes

Is having the name of web server software in HTTP response header a serious problem?

Any competent vulnerability scanner won't check for headers or similar information; instead, it'll just try dozens or hundreds of known attacks and checks if one if them works. Why that? Because there'...
Guntram Blohm's user avatar
36 votes

Is allowing root login in SSH with "PermitRootLogin without-password" a secure method?

This is a common misunderstanding for the PermitRootLogin feature. The without-password option does not mean there is no authentication and anyone can get in without a password. All this option means ...
forest's user avatar
  • 66.6k
35 votes

Why should the OPTIONS method not be allowed on an HTTP server?

An essential part of security is to reduce the attack surface by removing any functionality which is not needed. Usually this is also functionality which is less well tested and thus might be a vector ...
Steffen Ullrich's user avatar
33 votes

Is physical security less important with disks on a server being encrypted?

Physical access is total access. Kinda. Give me physical access to a server with an encrypted disk and the first thing I'd do is plug a key logger into the keyboard to take care of that pesky ...
candied_orange's user avatar
31 votes
Accepted

PHP malware on server - but helpless in identifying the malicious code

(I haven't gone over the code, I'm speculating because your description fits the modus of some malware I've seen in the past.) It's probably a bot that is trying to build a network of backlinks to a ...
Ivan's user avatar
  • 6,338
29 votes
Accepted

Downloading a file from a server with a secret: in text or binary?

There isn't really a difference. If you use proper TLS encryption, neither can be read by a man in the middle, and if the server properly authenticates requests, nobody who is not allowed to will be ...
tim's user avatar
  • 29.6k
29 votes
Accepted

Are hacked email addresses a local network or web server problem?

Email addresses do not send spam. Email servers do. Anybody can forge your email address as the From address without hacking you at all. That's how you get spam all the time that says it comes from ...
Grant's user avatar
  • 1,056
27 votes

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

Is a firewall enough of a security measure for an Ubuntu server that hosts a website? Given the technologies you want to use you want to create a dynamic database-backed website without having any ...
Steffen Ullrich's user avatar
25 votes
Accepted

Is having the name of web server software in HTTP response header a serious problem?

Assuming that the server is fully patched and you're just talking about product name and not version, I wouldn't generally regard this as a serious problem. Essentially all security hardening is a ...
Rory McCune's user avatar
  • 62.2k
24 votes

What are the negative aspects of creating fake security footprints?

Note: I like honeypots a lot but to answer your question some negative aspects include: You are not reducing your workload. You are increasing the amount of signals you have to process. You are ...
Trey Blalock's user avatar
  • 14.2k
22 votes
Accepted

How to ensure identity for server-to-server communication over IP

Basically you are trying to re-invent certificate based authentication since you only have an IP address and not a domain. But certificate based authentication can be used without a domain too, for ...
Steffen Ullrich's user avatar
19 votes

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

Could one create a vulnerable website on purpose to attack a server of a hosting provider? Yes, this is definitely possible. Since I have only experienced this with Linux based hosting solutions, I ...
Jeroen's user avatar
  • 5,851
15 votes

PHP malware on server - but helpless in identifying the malicious code

Well, ill give you some more detail: Note, this is not malware that is trying to break deeper on your system, is a script that makes someone (italian i guess) earn money using your server in 2 ways (...
jmingov's user avatar
  • 874
13 votes

Does changing an uploaded executable's file extension to .png render it safe?

No. Renaming a file doesn't increase security. He says to me, that by making all files images no harm can be done to the server. for example evilscript.evil would become evilscript.png When you ...
enkryptor's user avatar
  • 323
12 votes

Is physical security less important with disks on a server being encrypted?

Disk encryption can be defeated by replacing the machine with a malicious one that looks and behaves exactly the same but its only purpose being to fool the legitimate user into typing in the FDE ...
André Borie's user avatar
  • 12.8k
12 votes

Downloading a file from a server with a secret: in text or binary?

No, If the type of file is specified then there is no added security at all. For example, unzipping a file is so trivial that it doesn't add any security. If you ask whether it's more secure to ...
Gudradain's user avatar
  • 6,991
12 votes
Accepted

Is a firewall enough of a security measure for an Ubuntu server that hosts a website?

A firewall is never enough, it is the bare minimum. Then having an IDS of some sort is desirable. For example if your SSH port is exposed you should block brute-force attacks, even if you have a ...
Kate's user avatar
  • 7,927
11 votes
Accepted

Hack my server, please?

You're looking for a penetration tester. You could also invite people on the net to try and hack your server, but that's a very risky business - you never know who's going after it. Telling the ...
S.L. Barth is on codidact.com's user avatar
11 votes
Accepted

How to use YubiKey through GnuPG on remote server?

GnuPG does not make use of any tokens generated by the Yubikey, but the stick implements the OpenPGP smart card protocol instead. The keys are stored on the YubiKey, which performs all public/private ...
Jens Erat's user avatar
  • 24.5k
11 votes
Accepted

Could one create a vulnerable website on purpose to attack a server of a hosting provider?

You wouldn't need the vulnerable website if you have an account on the shared hosting already. What you need is code execution on the host. A remote code execution vulnerability in one of the hosted ...
Anders's user avatar
  • 65.6k
10 votes

Is physical security less important with disks on a server being encrypted?

The Cold Boot Attack has been used on laptops to defeat disk encryption, and would certainly work on servers. There have also been RAM attacks using DMA via Thunderbolt, PCI Express, and other bus ...
John Deters's user avatar
  • 34.2k
10 votes
Accepted

Once established, are sockets on localhost secure?

You are safe regarding the described threat since in any case intercepting and altering network traffic at a low-level always requires the user to have elevated privileges on the local machine. An ...
WhiteWinterWolf's user avatar
10 votes

Jump Servers for security

What is the advantage of using jump servers for security reasons? Jump servers, or more accurately, bastion hosts, provide a segregation layer between the target network and the user. Consider a ...
h4ckNinja's user avatar
  • 3,056
10 votes

Is having the name of web server software in HTTP response header a serious problem?

On the long list of things you can do to protect a server on the internet, not exposing the name of the web server barely rates. The version number may be of more concern, since it may in theory help ...
thomasrutter's user avatar
  • 1,638
9 votes
Accepted

Authy: Does multi-device mode imply that all keys are stored on their servers?

At least in the latest versions of Authy's Android application authenticator tokens, such as your Gmail TOTP, are sent to api.authy.com only after being encrypted using an AES key derived from your ...
andres.riancho's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible