Hot answers tagged

91

Imagine a shopping mall. By definition, anybody can enter the mall and then browse the shops. It is public. The shops are expecting people to come by, look at the displays, maybe enter and then buy things. In the mall, there is a shopkeeper, who sells, say, computers. Let's call him Jim. He wants people to come by and see the computers and be enticed into ...


76

"No perfect defense is fundamentally possible." In chess, you have 64 squares, 2 people playing, and one set of immutable, commonly known rules. In server infrastructures, there are an untold number of assets and ways to approach those assets, an unknown number of people playing, and rules that change constantly with players purposely seeking to bend, ...


72

Physical access, in many, likely most, situations means a total loss of security - for a variety of reasons (this all assumes encrypted disks): Theft - An attacker could steal the server or disks, to attack at their pace. This allows an attacker to take their time, and you have no idea if they've actually gained access to data. Physical Modification - If I ...


54

You can use Match in sshd_config to select individual users to alter the PasswordAuthentication directive for. Enter these Match rules at the bottom of sshd_config file ( generally /etc/ssh/sshd_config ) Match User root,foo,bar PasswordAuthentication no Match User Rishee PasswordAuthentication yes This would give root, foo and bar key ...


54

When you host your data on other people's servers, then these people have full access to it. With a virtualized server, the data is written to the hard drive of the host system. The server administrators could look at that hard drive image at any time and thus get access to the data of your users. They can also monitor the network traffic. You could ...


52

This question is a bit broad, but I think an answer that is a little bit broad will still be helpful. The answer depends on the "kind" of hosting you are talking about. There are three main kinds which I will break down below, but just FYI the names I use are not necessarily industry-standard names. The concepts however are pretty common across the board: ...


49

There are basically two main ways an uploaded file can be harmful: by being executed (as a script or binary) or by being run/used in an application and abusing an exploit in it (e.g. an uploaded MP3 which is then opened by a specific player, abusing a known weakness in it). In other words, it all depends what happens with the file after uploading. If ...


47

With recent Fedora and RHEL 6 releases, you can use RequiredAuthentications2 pubkey,password to require both pubkey and password authentication. Usually this is done to require pubkey and 2-factor authentication token, not the user's password. Update: Now on RHEL / CentOS 7, and any system with a recent version of OpenSSH, you can use: ...


43

With SSL/TLS it's okay to use LOGIN / PLAIN. You should provide SMTP on top of an SSL-encrypted connection. While some schemes from your list (e.g. DIGEST-MD5) can keep a password secure even over an untrusted channel, they won't protect users from a man-in-the-middle attacker tampering with their session. (Commonly, email servers wrap SMTP via direct TLS ...


37

It is fundamentally impossible to validate a client on a system you don't control. That doesn't mean it can't be done to a sufficient degree. eBook readers, for example, generally try to ensure the client is authentic. They (seem to) do so in a manner that is secure enough to defend against their threat. Good enough to protect nuclear secrets? No. But ...


35

An essential part of security is to reduce the attack surface by removing any functionality which is not needed. Usually this is also functionality which is less well tested and thus might be a vector for unexpected attacks. For example there might be restrictions/authorizations in the web application which are specific for GET, POST and which ignore any ...


32

Physical access is total access. Kinda. Give me physical access to a server with an encrypted disk and the first thing I'd do is plug a key logger into the keyboard to take care of that pesky encryption. Show up at my door with an encrypted hard drive and I'll format it and dump movies on it. Encryption is most commonly defeated not by breaking it but ...


31

Security can be proven, but you have to understand what is proved https://sel4.systems/FAQ/proof.pml Our proof statement in high-level natural language is the following: The binary code of the seL4 microkernel correctly implements the behaviour described in its abstract specification and nothing more. Furthermore, the specification and the seL4 ...


30

(I haven't gone over the code, I'm speculating because your description fits the modus of some malware I've seen in the past.) It's probably a bot that is trying to build a network of backlinks to a known group of web assets. Basically they find a vulnerable site and pop it. From there the script does a search to find which of the attacker's assets are ...


29

There isn't really a difference. If you use proper TLS encryption, neither can be read by a man in the middle, and if the server properly authenticates requests, nobody who is not allowed to will be able to download the file. If you don't use proper TLS or do not properly authenticate users, an attacker could read the file in both cases. You definitely ...


29

Email addresses do not send spam. Email servers do. Anybody can forge your email address as the From address without hacking you at all. That's how you get spam all the time that says it comes from you. You can however tell from the email headers what servers it was sent through. Best thing to do would be to contact the third party that is hosting your ...


25

It's a lot of work. Not only that, but it's a lot of work that your (legitimate) users will never see or benefit from. Most people would be willing to trade off the nebulous risk of deterring a small subset of hackers (realize that APT hackers, in particular, wouldn't be dissuaded and might even find an extra way into your system if you do something wrong ...


24

Note: I like honeypots a lot but to answer your question some negative aspects include: You are not reducing your workload. You are increasing the amount of signals you have to process. You are increasing your operating costs. You are taking time away from other security activities which may otherwise help protect actual data & services. You may be ...


22

There are a number of defenses you can use to help prevent and recover from theft. The first thing you should look into is full-disk encryption, e.g. LUKS, TrueCrypt, or PGP. This will prevent an attacker from reading any data on the disk, even if they steal the hardware. You will need to enter the password at boot, though, so for unattended remote hardware ...


20

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult. Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...


19

No, it is not possible, in theory or practice. A well enough distributed DDoS attack is indistinguishable from legitimate traffic. Consider the "slashdot" or "reddit" or "digg" effects, where actual legitimate traffic takes down network services on the target website. Simply posting a link to the target website on slashdot is an effective DDoS in many cases....


19

Despite what others are saying, yes you can. Many major corporates have very effective solutions, and even the recent Spamhaus battle, which used DNS DDoS at a scale that hasn't been seen previously was covered rapidly once CloudFlare were brought on board. The solutions I have tested are very effective at transferring DDoS traffic, even when it is a ...


19

The more a private key is shared, the less private it becomes. This is just a generic assessment: in some situations, this can be harmless. What it means in the specific case of SSH servers is that the security of these three servers becomes an all-or-nothing system: Each server knows enough to impersonate any of the others. If one of the server is hacked ...


19

It is fundamentally impossible to validate that an unmodified version of your client connects to your server. ... unless you do what is necessary to ensure it. This means client-side tamper-resistant hardware. When your code runs on the client's computer, the computer owner can run a debugger and modify the client code at any point with arbitrary values. ...


19

Could one create a vulnerable website on purpose to attack a server of a hosting provider? Yes, this is definitely possible. Since I have only experienced this with Linux based hosting solutions, I can only share my experience in that scenario. On several occasions I have managed to compromise an entire shared hosting server which was running DirectAdmin / ...


18

You can have both public-key and password authentication on the same server. If public-key authentication fails, it will go to password authentication. As to requiring both, that's seems silly and counterproductive, and checking man sshd_config there isn't an option to do this. Your ssh private key should have a secure passphrase. So if an attacker ...


18

Giving non-obvious names to things is akin to security through obscurity which is usually frowned upon in these parts. Problem with that kind of security is not that it does not work; indeed, it has some value, which was demonstrated many times through History (e.g. that's why a tank is called "tank" and not "armored chariot"). But you cannot quantify ...


18

Nobody has found any particular reason to believe they have found such a system. You mention Chess, which is a nice game on a 8x8 grid. Consider that a modern server is slightly more complicated than that. Let's instead play in a 65536x65536 board, to make it more realistic. Also, in Chess, the more you play, the fewer positions are possible. Instead, a ...


17

Your forum accepts posts from anybody. That is your core problem. Connecting to your site from various IP throughout the world is trivial, if only by using Tor. Tor provides "high anonymity" in that not only the user's identity is hidden, but each request is anonymous -- you cannot, from the outside, make sure whether two distinct requests are from the same ...


15

There are 13 root name server addresses, each corresponding to a separate root name server system. The name server systems are not single machines - rather a collection of physical servers connected together as a distributed system. Each collection of servers is geographically distributed (a technique known as multihoming) such that a natural disaster is ...


Only top voted, non community-wiki answers of a minimum length are eligible