196 votes
Accepted

Is public Wi-Fi a threat nowadays?

Public WiFi is still insecure, and it will always be if not used together with something like a VPN. Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't. Only around 5 ...
user avatar
  • 64.2k
119 votes

Is public Wi-Fi a threat nowadays?

I'm a little surprised that nobody has pointed out that there's more to the internet than HTTP. Even if your claims about HTTP(S) and HSTS were correct (and other answers discuss that), you're ...
user avatar
  • 2,616
107 votes

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

This article might be important for you: https://ca.news.yahoo.com/armada-collective-ddos-threats-were-212413418.html Someone has been copying the Armada Collective's email content to scare people ...
user avatar
  • 123k
98 votes
Accepted

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

Based on the following article you may simply want to ignore it. This seems to be a common scam and your e-mail looks almost exactly like the one from the following article. http://arstechnica.com/...
user avatar
  • 14.1k
65 votes
Accepted

Should web applications that are only accessible from a LAN be held to the same security standards as publicly accessible websites?

Yes. Absolutely, yes. Your assumptions about your internal network have issues: you assume no attacker would ever gain control of any device in your network, which is a bad assumption to make (see ...
user avatar
53 votes

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

Ignore it. Cloudflare themselves have stated that these are fake - see https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/ I highly recommend that you read this article, as it ...
user avatar
48 votes
Accepted

What's the Impact of the CloudFlare Reverse Proxy Bug? ("#CloudBleed")

Compared to the famous HeartBleed bug leak, this is similar in some ways: the uninitialized memory exposure means unrelated private data is disclosed. The things that are better This only affected ...
user avatar
  • 38.1k
41 votes

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

What things can be done to prevent sudden rogue insiders from negatively impacting essential infrastructure using techniques they're privileged to do? In practice, very little. But to explain ...
user avatar
  • 71.9k
33 votes
Accepted

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

Two-man rule - configure your systems so that all privileged access requires two people. This could be a physical control - privileged access can only come from the NOC, and inside the NOC people ...
user avatar
  • 32.7k
27 votes
Accepted

Why does rfc6797 say "An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport."

This client behavior is prohibited by section 8.1 of the RFC: If an HTTP response is received over insecure transport, the UA MUST ignore any present STS header field(s). The spec prohibits severs ...
user avatar
  • 5,780
27 votes

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

One approach is to accept that rogue actions cannot be prevented and focus on making sure the damage can be repaired. For example, make sure the routers have a separate control plane via which they ...
user avatar
26 votes

Linux password changed. Is this an attack or a hardware glitch?

While browsing web pages, I can't seem to scroll down. My right hand was on my mouse, left eating food so I'm sure I'm not accidentally pressing any keys. I ran showkey and discovered that every ...
user avatar
  • 261
24 votes

Is public Wi-Fi a threat nowadays?

Another difficulty of public wifi access is that you are on the same local network as other unknown actors. Any misconfiguration of your local network permissions can lead to an intrusion into your ...
user avatar
  • 1,017
20 votes

Should web applications that are only accessible from a LAN be held to the same security standards as publicly accessible websites?

The attack surface on the internal network and external network is different which means that different security measures are appropriate. That does not mean that the attack surface in the internal ...
user avatar
18 votes

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

If you are in the UK please do this: Message sent by Action Fraud (Action Fraud, Administrator, National) Within the past 24 hours a number of businesses throughout the UK have received extortion ...
user avatar
  • 289
14 votes
Accepted

Linux password changed. Is this an attack or a hardware glitch?

You are right in asking the question. The situation as you describe it allows for both alternatives an attack and a hardware failure (i.e. keyboard failure). if you had some copies of /etc/shadow ...
user avatar
14 votes
Accepted

Could IOT Botnets be Stopped by Static IP addressing the Devices?

Almost all IoT devices of the sort we are talking here (ie, consumer level) are deployed behind home grade routers (or ARE home grade routers) and are using IPv4 and NAT/uPNP to reach the internet. ...
user avatar
  • 6,311
11 votes

Is public Wi-Fi a threat nowadays?

I would argue that any time you connect to a publicly accessible network you're putting yourself at risk, VPNs are great, but do nothing to firewall your machine against the threats on the local ...
user avatar
  • 189
9 votes

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

A CSRF attack can only happen when cookies (or other authentication mechanisms) are provided by the client automatically. That is, where the client has access to cookies from multiple domains (such as ...
user avatar
9 votes

Is public Wi-Fi a threat nowadays?

Some of the concern has to do with MiTM attacks and the tendency for laptops to be configured to blindly connect to open networks based on SSID after the initial connect. Nothing stops an unknown ...
user avatar
  • 211
8 votes
Accepted

How can I prevent myself from barcode payload attacks?

After going through the code, I'm not sure that it is supposed to exploit or attack anything. It looks like its only purpose is to encode a payload using barcodes. It would be a nice way to import ...
user avatar
  • 123k
7 votes

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

Pay and we will know its you. This is the thing: an empty threat looking exactly like what you have there has been going around, which always has the same bitcoin address in it. In other words: they ...
user avatar
7 votes

How can I prevent myself from barcode payload attacks?

This is remarkably similar to attacks like SQLi, and the remediation is the same. Wherever you allow a barcode to be scanned as input, validate it in the scanner and only allow input that matches ...
user avatar
  • 61.4k
7 votes

Is public Wi-Fi a threat nowadays?

About using public Wifi services, Tor and VPN still can leak information. Besides Tor and VPN security implications, you still have to get at least DHCP services from the public Wifi. Depending on ...
user avatar
7 votes
Accepted

What are the new MDS attacks, and how can they be mitigated?

My current understanding is that the microcode update changes the behavior of the obsolete VERW instruction so that it causes a flush of various internal processor buffers The new behavior of the ...
user avatar
6 votes

Why does rfc6797 say "An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport."

This may be to avoid the use of this header to cause a denial of service attack. Imagine an insecure HTTP-only website. Now imagine someone able to tamper with the HTTP headers sent by this site to ...
user avatar
6 votes

Is it unwise to use Redis to store PII, private keys, and other secrets?

The risk/issue is exactly the same and the mitigation as well. Regardless if it loads the database partially or completely into memory. There will be no way for you to tell which keys have been ...
user avatar
6 votes
Accepted

Having malicious code stored in your DB

In my opinion it is a bad way to have escaped data in the database. Since the escaping rules vary depending on the input an output medium (HTML, JSON, ...) they belong at the place where you input and ...
user avatar
6 votes

Could IOT Botnets be Stopped by Static IP addressing the Devices?

wouldn't it make since to start giving IOT devices a static IP No, because IPs only work in the proper network context. An device's IP needs to be routable, which is to say, sitting on a network ...
user avatar
  • 71.9k

Only top scored, non community-wiki answers of a minimum length are eligible