Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

3
votes
2answers
95 views

How to safely saving users' data and NOT get responsibility of users' data?

I am programming a website which will save up users' inputs for their next visits. For example, I might save their phone numbers. The user will know that I save their phone numbers. However, do I need ...
1
vote
2answers
674 views

GWT “Big traffic change for top URL”

I recently received an email from GWT saying that one of my URL's traffic has suddenly dropped. As it turned out the traffic to the whole site has drastically dropped, from some 300+ unique visitors ...
1
vote
1answer
28 views

Compromised private RSA key

What sorts of problems can be caused by a compromised private RSA key? Is this even that big of a deal? I'm getting very little specific info on Google. :(
1
vote
1answer
67 views

How to set a 1-order-per-PC limit on my website?

On my website people can order free coupons for my local service. I would like to set a limit of 1 coupon order per PC. Can someone suggest a way to implement this, even if the visitor would delete ...
7
votes
4answers
209 views

Webhosting company able to unhash passwords?

Tonight I was using the cPanel of a web-site I host and when I went to change the password I received a warning that I couldn't change the password to my desired password because it was too similar to ...
4
votes
3answers
296 views

Why do websites require retyping the password upon user error in a registration form?

Many times, when you fill out a registration form and miss a required field, the form reloads with all the fields filled out except for the password which you have to retype. I'm wondering if I ...
3
votes
1answer
2k views

What is the BCSI-CS-**** cookie for?

I'm undertaking an audit of the cookies we use on our external sites. There's one cookie that's used by all the sites, and by different domains within the sites. It starts BCSI-CS- and has random ...
1
vote
0answers
74 views

What is the most secure environment for multiple CMS sites? [closed]

I wish to run about 50 Joomla or WordPress low-traffic websites on 1 server, or part of a server. Each website will be managed by its own, naive owner who will have be able to access the Joomla or ...
5
votes
3answers
761 views

Disadvantages of a fake phpMyAdmin honeypot that causes ip blacklisting and robots.txt disallow/exclusion of the honeypot?

I'm trying to figure out whether I should set up a honeypot system with a fake phpMyAdmin (site gets hits all the time with people spidering for insecurities with that app). My thought was to create ...
4
votes
2answers
383 views

Combining a content management system with ASP.NET

I am going to be creating a site that seems like it requires a blend of a content management system (CMS) and some custom web development (which is done in ASP.NET MVC). I have plenty of web ...
7
votes
3answers
1k views

Important fields in HTTP header from security perspective

What are the Important fields in HTTP header from security perspective? I tried to google it but unable to find. Can anybody provide me a link to read about it? Thanks in advance.
10
votes
3answers
3k views

what is wwws.site.com

I know about https for securing important pages like login and such. But why would someone create a separate subdomain like wwws as well? for example https://wwws.site.com/login
1
vote
1answer
57 views

Multiple SSL certificates under one organization?

Now that I have my LLC formed, I intend to purchase several EV SSL certificates for a few of my popular online stores. My question is if it is possible to purchase and set up several EV SSL ...
0
votes
1answer
1k views

IIS7.5 + Wordpress + Restrict Access to wp-login.php by client IP address

I am moving from an Apache host to IIS. One of my sites in Wordpress (running Multi-site) which give me multiple blogs. I have moved all my rules from my .htaccess to the Microsoft URL ReWrite module. ...
2
votes
2answers
223 views

Phpmyadmin http password security

Is my password sent unencrypted when using Phpmyadmin through http? If not, is there any downside using http compared to https?
1
vote
2answers
46 views

Security risks posed by specifying technologies used

I am developing on-line tools for non-commercial use, which are hosted on dedicated hardware. I would like to include logos indicating the technologies I used (Apache or Python for example), at the ...
1
vote
0answers
26 views

open source plugins,scripts store information? [closed]

I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin. If so, is there any plugin which can detect which website ...
1
vote
1answer
157 views

Java/1.7.0_07 as user agent

almost every day something (it should be a bot) visits all of my pages on my website (amongst other things it doesn't correctly handle spaces in urls) with Java/1.7.0_07 (or different java versions) ...
4
votes
2answers
403 views

How would I tell if a prospective client website is under DDoS attack?

I have a person asking me whether the DDoS Mitigation Service they're using is worth it. This is out of my expertise, but clearly at some point someone sold this service to the client. Assuming I ...
1
vote
1answer
71 views

Website address hacked, emails created but not showing in manage your account

I have a website, thebleudoor.com. It is hosted by yahoo. It gets 2000-3000 hits a day and has been for at least 5 years. A few months ago, as admin of the website, I started getting bounced back ...
4
votes
1answer
205 views

Allowing temporary access to cpanel for freelancer

I'm currently using a2hosting's cpanel on a shared hosting account. I'd like to temporarly give access to a freelance developper so he can upload some php files, csv files and create tables in my ...
1
vote
2answers
41 views

Blocking path scanning

I'm seeing in my access log a number of request very suspicious: /i /im /imaa /imag /image /images /images/d /images/di /images/dis They part from a known resource (in the above example ...
4
votes
2answers
540 views

Number of page requests by any Bot in 5 secs

I am writing a script that will block any bot that requests page(s) for example X times in the past 5 secs. I need to find the X here. Do you guys know some approx values I can use?
7
votes
5answers
591 views

Better Spam Protection than reCAPTCHA?

I hope this is a valid question to ask here... but knows anyone a better spam protection than reCAPTCHA? We've now using reCAPTCHA for some time but got now the situation that obviously more and more ...
1
vote
1answer
395 views

Good idea to use Google Sites for static content and custom PHP for dynamic

We have a site based upon Google Sites. Now we would like to create a login area (HTTPS) with a mixture of dynamic and static content. Is it a good idea to utilize Google Sites and use iFrames for the ...
4
votes
1answer
1k views

IIS Dynamic IP Restrictions Module and Googlebot

I consider using IIS Dynamic IP Restrictions Module in order to make it hard for DoS (Denial of Service) attacks. But I am not sure how that would work out for search engine bots like Googlebot. Any ...
1
vote
1answer
148 views

get mysql_real_escape is giving me errors when I try and add security to my website [closed]

I tried doing this: @ $db = new myConnectDB(); $beerName = mysql_real_escape_string($beerName); $beerID = mysql_real_escape_string($beerID); $brewery = mysql_real_escape_string($brewery); $style = ...
2
votes
3answers
91 views

suspicious crawler activity

I'm noticing that I get accesses 66.249.66.198 - - [01/Jul/2011:17:13:46 +0200] "GET /img/clip.incubus.torrent.phtml HTTP/1.1" 404 143 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; ...
1
vote
2answers
4k views

What kind of information can websites collect about a user/client?

This is a multi-part question: 1) What kind of information can websites collect about someone (someone's computer or device) when they visit your website? I know we log IP's, and can determine your ...
4
votes
4answers
910 views

PCI DSS compliance for a VPS using Centos

I have a VPS with linode, great hosting by the way. I am confident with centos apache ect but I know nothing about PCI DSS compliance, I usually let SagePay or PayPal deal with it. But I have a ...
2
votes
2answers
794 views

Is making my PHP files read-only a useful security measure?

Up until now I've been "protecting" my website's PHP files by making them read-only with chmod. Is this a useful security tactic? Or is it some "old wive's tale" and I'm wasting my time? I'm ...
3
votes
2answers
145 views

Where should I redirect (removed) phishing pages

I was unfortunately the victim of a PHP exploit. Looking through my webserver logs, people are still attempting to reach the URL used in the phish. I want to redirect them to a site that will educate ...
1
vote
1answer
250 views

MCrypt Module, Rijndael-256

An outside company is redoing our company Intranet. During some basic usage I disovered that the "User Edit" screens, with the "Password: *" boxes have the password in plain text, with the text box ...
3
votes
1answer
510 views

Is this safe? <a href=http://javascript:…>

I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://. For example, is it possible to append javascript: ... ...
0
votes
3answers
205 views

Need private personal access to ~three PHP pages

I would like secure access to the text output by three PHP scripts (the text output is JavaScript and html) . The security level is much less then financial data but important none-the-less. I have ...
7
votes
1answer
157 views

Is there any good reason I would want my website to be framed?

I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't ...
0
votes
2answers
519 views

How does one block unsupported web browsers?

Web browsers with an end of life no longer receive security updates which not only makes them vulnerable to the end user, but I imagine its not safe for the server's which receive visits by them ...
8
votes
2answers
305 views

Does the 'Server' header serve any purpose?

For example, when I dump the response header for my server I get: Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.5 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g Is this used for anything? Is ...
3
votes
1answer
810 views

Does MSIE recognise StartCom as an SSL Certificate Authority?

Ok, so I'm thinking about getting in on the SSL action, so that my sites can be secure etc, and after hours of shopping for the best priced certificate, I find out that StartSSL offer a free one. One ...
3
votes
3answers
258 views

Is there a way to scan websites externally for the recent PHP CGI flaw?

The recent PHP CGI flaw exposed (CVE-2012-1823) has me wondering if some of the legacy sites that I've inherited might be vulnerable. (see Physorg article) Does anybody know of a means to externally ...
1
vote
0answers
33 views

Security concerns for hosting a .NET website [closed]

Is the default configuration of Windows Server 2003 with IIS 6 and .NET 4 sufficient for security if I keep up to date with security updates? (assuming my code does not create any security holes).
5
votes
4answers
484 views

How to protect SHTML pages from crawlers/spiders/scrapers?

I have A LOT of SHTML pages I want to protect from crawlers, spiders & scrapers. I understand the limitations of SSIs. An implementation of the following can be suggested in conjunction with any ...
6
votes
1answer
107 views

What secure domain registry services exist?

I'm using a domain registry service that only requires a username and password to log in. Are there any domain registry services that require a second factor in addition to a password?
1
vote
2answers
184 views

Proper password handling for login

I have read a lot about PHP login security recently, but many questions on Stack Overflow regarding security are outdated. I understand bcrypt is one of the best ways of hashing passwords today. ...
1
vote
0answers
34 views

White hat security community [closed]

A while ago I remember there existed a community of savvy people who would probe a server for common vulnerabilities, this was a voluntary project but not even google can help me find it, I was hoping ...
4
votes
1answer
168 views

Best way to protect public facing development environments?

We're in the process of setting up individualized dev environments for our developers. All of our developers are remote and we don't have a VPN or anything to bring this in house. But here's the ...
0
votes
1answer
426 views

How to deal with attacks on Zend Framework web site? site currently down

This is my first question on this "forum" please be indulgent with me if my questions are somewhat too simplistic for you. i joined this community in order to improve myself and help others.Thank you. ...
2
votes
1answer
336 views

DNS name/host-header specific url-pattern/security-constraint, to not require SSL with Tomcat6

I am needing to enable SSL on an application hosted through Tomcat6 and I have added the following to the tomcat web.xml: <security-constraint> <web-resource-collection> ...
3
votes
1answer
108 views

SiteAdvisor advice?

At the time I submitted my site for testing with McAfee's Site Advisor as I noticed my site received a bad review as a spam/scam site. See here . From a development perspective, how important are ...
6
votes
2answers
157 views

Does https site needs extra configuration after installation of SSL certificate?

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data). ...