176

Fortunately, almost all PHP scripts can be deobfuscated with 4 simple methods. We're going to use these four methods to create a canonical answer. Before we begin, let's collect a list of common tools that assist in deobfuscating these malicious files so we can do the work ourselves. Common tools that aid in deobfuscation UnPHP. This greatly aids in de-...


119

Technically, browsers do not have to ask the user a question in order to use cookies. Furthermore, they are not technically bound to the answer given by the user. Legally, that is another matter. In the European Union, the websites are now required to ask the user for their consent before using tracking cookies or other means to collect personal data about ...


106

To start with the easy bit: you do not have to put real information as the answers to the questions. Random strings work best if you are really paranoid and store them in a password manager just like a password. The rest (no brute force protection, potentially outdated software) is a shame, but there is nothing that you can do, from a security perspective. ...


103

TL;DR: It's probably well-intentioned and not a scam, but just poorly written. I don't know of any kind of scam that would be based on this. Certainly there have been attempts to extort website owners for money based on knowledge of website vulnerabilities (and the implicit threat to exploit them), but that doesn't look like the case here. It's not a very ...


99

Most Denial-Of-Service (DOS) attacks rely on some asymmetry between the resources involved on attacker side and on target side. In other words, to be successful, a DOS needs an action to require very few resources client-side (so the each clients can send a lot of requests) while involving larger resources server-side (so the server(s) will be unable to ...


87

Not if you want to stay out of trouble. What you are suggesting is vigilante action, and most legal systems do not look kindly upon that. Even though you may feel you are protecting other, less tech-savvy people, it would probably still constitute a crime. What you could do, is try and find out if there are authorities to warn. This could be the hosting ...


79

A malicious website could harm you without you having to click on anything. However, the fact that the user clicked on a page element simplifies the task: for example, most browsers would automatically block unsolicited popus (which can e.g. trick users into installing malware), but allow a popup in response to a click. And yes, in my opinion, a ...


72

Since you asked specifically what the website will see, rather than any intermediary watching your network connection, we should think in terms of requests: Your old ("native") IP will disconnect any long-running requests, and stop making any new requests. Your new (VPN) IP will connect and start making requests. On their own, those two events will be ...


68

I'll extend on one point at a slightly more abstract level about why public authenticated spaces are preferable to hidden unprotected spaces. The other answers are all perfectly good and list multiple attacks one should know better to avoid. Everyone with formal training should've heard at some point of the Open Design security principle. It states that ...


68

This is not a sign of a problem for your server. There's an important detail here, which is: 104.27.182.86 is not your server. That IP belongs to cloudflare. Cloudflare provides a large number of services to websites and sits in between the public internet and a server. Someone who uses Cloudflare doesn't point their DNS to their own server - they point ...


66

That way the hacker won't know if they have got the login details correct or not. If the information presented after login has no relationship to the person who the login should be for, then most hackers will quickly recognize that the login is probably not the real one. But, in order to show information which looks like it fits the user, considerable ...


65

You should contact the hosting provider, their contact information can be found by a whois lookup of the IP address of the server. You should give the hosting provider logs with the evidence that the attacks originated from that IP. The hosting provider can inspect network traffic to find out if any attacks is still ongoing and take the host offline if ...


62

Okay, personal anecdote time. I'm a sysadmin in real life, working for an ISP that primarily caters to small to medium businesses. One of our larger customers operates, among other things, an exceptionally cheap and completely automated shared webhosting service. You sign up, pay a couple of bucks via credit card, and plonk your site down. No human ...


52

Since we're talking theoretically, here are several reasons why a random URL alone is not sufficient enough to protect confidential data: URLs can be bookmarked. URLs are recorded in the browser history (public kiosk). URLs are displayed in the address bar (shoulder surfers). URLs are logged (think 3rd party proxy). URLs can be leaked via Referrer headers ...


50

The concept you're describing is called Plausible Deniability and methods to provide it have indeed been implemented in some software, VeraCrypt being one example. One problem with implementing it in websites, as you suggest, is that it's very hard for the website developer to come up with fake data that is realistic enough to fool an attacker while not ...


48

You seem to fundamentally misunderstand what TLS does. TLS takes the regular plain HTTP traffic and encrypts it and adds integrity checks. Together with the certificate of the server, this ensures Confidentiality: An attacker who captures the network traffic can not read the content of the communication. Integrity: If an attacker modifies the network ...


40

As Polynomial mentioned, this is part of ICANN-mandated WHOIS verification. The reason it goes to domainadmin.com is that ICANN doesn't actually run the verification -- rather, like just about all ICANN things, they set policies that are then implemented by others (remember, your .com domain is in a registry operated by Verisign, and was registered by a ...


38

First, here I compare an up-to-date Android phone which receives regular updates with a Windows PC which receives regular updates. While this might be the normal case if you buy a PC with Windows 10 it is not guaranteed if you just buy a cheap Android phone. Thus, I assume that you use a vendor and product known for its good product support, like phones from ...


37

Many times the attacking website has no clue their site is attacking. I own a hosting company, and we're typically notified through our abuse email from the attacked. Upon investigation, we either find World writable folder where rogue scanning scripts have been installed poorly created websites that allow unrestricted uploading compromised FTP ...


36

The most important thing to do when you use 3rd party applications like Joomla! is to always keep them up-to-date. Most attacks are targeting vulnerabilities which were patched long ago and only hit those people who neglect updating. So create a regular reminder in your calendar to check if an update is available for Joomla (as well as any themes and plugins ...


36

Does not appear to be a scam, though it might be a type of mass-mailing due to lack of details. Maybe some guy needs money, runs Nessus on a bunch of sites and is now angling for a small reward from each? I'd run Nessus (or some other scanner) myself to check, then contact the guy and ask for details. Truthfully answer his question about bug rewards. If you ...


33

Only the TLS endpoints1 can read the the full URL because HTTPS provides end-to-end encryption. HTTPS wraps the full HTTP protocol, including the request line, request/response body and all the headers. The request URL is just one part of HTTP that gets encrypted together with all the other components. If any party was able to read the URL, they would ...


32

Because hackers don't attack login forms The flaw is that you assume hackers get into accounts by brute-forcing credentials against remote services. But that's futile anyway. Any website with decent security (the ones without decent security wouldn't care about your idea either) will have a limit imposed on how many failed login attempts can be made in a ...


31

This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "extended" in many ways. One of them, which has actually been around for a very long time, is to host multiple domains on a single server with a single IP address. A ...


30

VPN Virtual Machine View-Source for those who know Javascript [Tinfoil Hat (Mythic Warforged)] here. If you are handy with Javascript and the like, I've always appreciated view-source:http://www.webaddress.com/ from the URL bar. For added tinfoil, do it behind a VPN, and a Virtual Machine. The VPN is necessary just in case the attacker expects you to ...


29

I've heard that cookies is less secure than the session. You must have misinterpreted something. In fact HTTP sessions are usually implemented using cookies. I'm thinking that if I could get &^*Y()UIH|>Guho976879, I can still forge the cookie, right? Sure you can change the cookie, but will it be accepted by the server as valid? If you take an ...


29

To me this says you haven't investigated enough to confidently say it's insecure. You haven't shown any particular direct exploit nor really dug into their system (in a non-hacking, poking around kind of way). Your superiors may not be interested because of the lacking direct evidence of this. As an example, my work uses a 3rd party site for scheduling ...


25

Mark's excellent answer deals with the case where the obfuscation is relatively straightforward. This addresses 99% of cases, but once in a while you may come across something a bit more malicious, e.g. using encryption of the source code too. Executing the code (or at least part of it) can be a much quicker way to find out what the code is doing than ...


23

This is a serious security problem. URLs should never contain sensitive information. URLs show up in your browsing history. So even after logging out it will be trivial to access your account for anyone using the same computer. Commonly, web servers are logging incoming requests. Also, firewalls or proxies involved in processing your requests might maintain ...


21

The other answers cover the threats to your computer quite well. However there is a further threat that was not covered. It is possible that URL's are unique to each recipient, allowing the hacker to identify emails that are: Active Susceptible to social engineering (clicked a link from a friend) Not necessarily Computer Security savvy (clicked a link from ...


Only top voted, non community-wiki answers of a minimum length are eligible