Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

1
vote
1answer
24 views

How to detect if file with a .png extension contains code or an image?

I was in a trouble last few days since my web host was hacked for POST on PHP files. I've been dealing with files with .png extension that have PHP code inside. I can't even try to edit one-by-one to ...
1
vote
1answer
77 views

How to set permissions for DooPHP?

I have downloaded and installed DooPHP according the Installation instructions. However, there is no statement on how to set permissions. Also not in INSTALL.TXT which comes with the product. The ...
0
votes
1answer
25 views

AWS EBS Tomcat instance being hacked

I'm using AWS EBS instances with tomcat for my java web application. But somehow some guy manages to hack into my instances and all I can see are these processes being ran by tomcat: tomcat 26988 ...
0
votes
1answer
15 views

Malicious links to our site on Google's SERP redirecting to shady pages

Our website is being attacked in a curious way: on the Search Results Page, Google is showing links that look as if they were to pages on our site but they direct to some shady viagra-selling sites. ...
1
vote
0answers
3 views

.CA Domain registratrs for DNSSEC

We have a .ca (CIRA) domain that currently uses DNSSEC through the ISC DLV registry service. We are aware that DLV is shutting down by 2017. We have communicated with CIRA respecting .ca registrars ...
1
vote
1answer
63 views

How to setup an implicit FTPS encryption on cPanel server?

Currently my server is configured to use TLS encryption for FTP. It is explicit since it uses FTPES and on port 21. How can I switch to implicit FTPS that works on port 990? I'm using Pure_FTPd. I ...
3
votes
3answers
284 views

How to remove adware pop up?

I get an ad pop up that should not be on the site. It has only appeared once. The HTML code for the pop up window that appeared: http://pastie.org/5674909 Here is the full HTML pastie: ...
1
vote
1answer
25 views

Allow third party to use domain subdirectory without risk to your server

If you have a live site on example.com, is it possible to allow third-parties to set up their own site at example.com/project1, example.com/project2 etc without subjecting your server to risk? I ...
5
votes
1answer
77 views

Someone else set up a trial Google Apps account on my domain. How can I get Google to disable it?

I own my domain (say, mydomain.com) and administer it through my hosting provider. A couple of days ago, I started receiving mail from Google Apps addressed to jyotioffsetjsm01@mydomain.com. There's ...
3
votes
1answer
50 views

Can spambots access pages available to only registered, authenticated users?

I have a web application where users register and are activated via an email sent to the email address they supplied. Then there are pages that are only visible to registered users (non-user access ...
3
votes
1answer
42 views

Using .htaccess deny returning 302 and not 403 forbidden

I'm in the process of adding yet another layer of security to some of my WordPress installs, since some of my customers sites use shared hosting, and generally they do not ban users for brute force ...
1
vote
1answer
81 views

Use GPG keys in cPanel?

So, the cPanel web hosting management console has a GnuPG Keys area, which allows you to create or import GPG/PGP keys. However, it doesn't seem that the server actually does anything with them once ...
5
votes
3answers
94 views

Will data be encrypted if an HTTP page POSTs to a HTTPS handler that redirects back to HTTP?

My host gave me a subdomain of their domain that has HTTPS: https://mysite.example.com My own domain name has no SSL installed, so the only way I can take advantage of encryption is by using the ...
11
votes
4answers
2k views

HTTPS connection is “not safe” due to images

I am currently working on a website and I have successfully installed my SSL certificate. The GeoTrust SSL/TLS checker confirmed that the certificate chain (including CA) is properly installed. ...
4
votes
2answers
103 views

URL hijacked for spam [closed]

I'm the Webmaster and administrator for a site, built on Drupal 7. I've updated Drupal to the latest version. My issue is that it seems as if someone or somebot is using our url. Has my legitimate ...
5
votes
2answers
2k views

What is the BCSI-CS-**** cookie for?

I'm undertaking an audit of the cookies we use on our external sites. There's one cookie that's used by all the sites, and by different domains within the sites. It starts BCSI-CS- and has random ...
1
vote
0answers
40 views

Suspicious Web Traffic from Amazon.com ISP

Just a few hours back I was checking my logs when I found a whole bunch of traffic from IP address 54.174.xx.xx and ISP Amazon.com (validated from Google analytics). It lasted for an hour and then ...
0
votes
0answers
27 views

What file permissions should I set before I give website project folder to hosting service?

I am using a CMS called Jekyll to build a website. My understanding of jekyll at this point is that it helps me to generate static web pages by providing me a simple boilerplate for a website and ...
4
votes
1answer
46 views

Are Commercial SSL Certificates (key file, and certificate file) portable when migrating between a new and old Apache2 server?

We have an SSL Certificate that's currently on our Apache2 server for transferring traffic over the https protocol. We are migrating away from this server to at another data center with a different ...
1
vote
0answers
31 views

What is infecting these networks between 10/25/15 and 11/1/15?

Just noticed a fancy new graphical threat dashboard in the Google malware scan systems. There seems to be a cleanup then subsequent spike in infected sites across various [less-than-high-quality] ...
3
votes
2answers
318 views

Website is under maintenance - how to restrict access?

Currently, my website is under maintenance. I want to be the only person who's able to access/view the website online until I finish maintenance. How to set restrictions to others? I hate stalkers.
5
votes
2answers
646 views

Trigger IP ban based on request of given file?

I run a website where "x.php" was known to have vulnerabilities. The vulnerability has been fixed and I don't have "x.php" on my site anymore. As such with major public vulnerabilities, it seems ...
1
vote
2answers
39 views

Is it insecure to make the CPanel username same as domain name?

If I set my cPanel username same as domain name, then everybody already knows my cPanel username. Does it pose security risk?
1
vote
3answers
60 views

Is SiteLock really beneficial in protecting medium sized websites (1k pages)? [closed]

My sites are hosted at a shared server at HostGator who have recently started sneakily pushing their customers to subscribe to SiteLock. I have a few client sites, and a sizable Wordpress site (1k+ ...
5
votes
2answers
88 views

WordPress security checklists on cPanel

I'm installing WordPress on a shared cPanel hosting for blogging. I'm planning to install it in a folder under public_html, that is, public_html/myblog. I am using WordPress application installer ...
1
vote
4answers
1k views

How to prevent Google from finding my admin index page?

I am running a website but for some days i stopped it and put the under-construction page because the Index of admin page is visible to the outside world through the Google search. One of my friend ...
4
votes
3answers
60 views

Securing images from browsers and humans

Particular parts of a website I'm working on will have pictures not intended for the general public. It is already behind a password protection and the page has no-index no-follow rules. I'm concerned ...
5
votes
1answer
984 views

Does MSIE recognise StartCom as an SSL Certificate Authority?

Ok, so I'm thinking about getting in on the SSL action, so that my sites can be secure etc, and after hours of shopping for the best priced certificate, I find out that StartSSL offer a free one. One ...
5
votes
1answer
170 views

Unable to locate phishing URL in CPanel file manager

I received an email from Google that there may be phishing pages on my website. Below are example URLs on my site which may be part of a phishing attack: ...
1
vote
4answers
46 views

part of a PHP file is missing, did I get hacked?

my website is built by jooml 3.4, today it gets a syntax error message like this: syntax error, unexpected 'if' (T_IF), expecting function (T_FUNCTION) in /public_html/libraries/cms/router/site.php ...
1
vote
0answers
78 views

Another Google-Based Test/Referrer Hitting Our Site, This Time it Hints We are a Test “Fuzz” Case

Noticing today that there is yet another strange visitor hitting our server/site from a Google IP. It came via a path to an old image that was never linked out to my knowledge. This disturbs me ...
0
votes
2answers
880 views

How to trace origin of script injected in my webpage

I was looking through a static site I created on my local server, in my web browser, and found a curious call to an external script <script ...
0
votes
0answers
34 views

Does Cloudflare use different authentication mechanisms across platforms?

I'm using Cloudflare flexible SSL for a website I made, and after investigating certificate properties, I realized different authentication mechanisms are being used. Chrome 45 for Windows desktop ...
1
vote
0answers
34 views

Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key

Is there a comparison between 4096 Bit RSA-Key and a 2048 Bit RSA-Key? Id like to know what impact on performance it has, if Im choosing a 4096-Bit key for ssl-encryption. Is there any info which ...
0
votes
1answer
113 views

Site speed when using ddos protection by cloudflare

I've recently noticed an increase of sites using ddos protection by cloudflare and wondering the effects on both user experience and SEO. I've notice these redirect messages last from anywhere from 2 ...
0
votes
1answer
17 views

Methods to provide user data to web application in URL?

I am aware that one method to provide user data to web application is to use query strings. For example http://www.example.com/get-page.php?home=aaa.html would set variable home value to aaa.html and ...
1
vote
2answers
49 views

Online Marketing company want me to share my Google Account login details? Is this normal practice?

We are a small business and use "Google Apps for Work" and my google apps account was used to set up the business's "Google My Business" and related Google+ pages We have now engaged an online ...
2
votes
1answer
182 views

Permissions & File Structure w/ nginx & multiple sites

I am using nginx for the first time as a long time Apache user. I setup a Linode to test everything and to eventually port over my websites. Previously I had /home/user/www (wwwroot) I am looking ...
13
votes
7answers
2k views

Are “trustmarks” such as McAfee Secure worth the cost?

There are a number of services that will scan a website for vulnerabilities and allow the display of a "trustmark" image if the site passes their tests. This allegedly increases the level of trust a ...
0
votes
3answers
74 views

WordPress Site Hacked? Phising scam?

We just got a note from CloudFlare that we got reported for phishing. The link they provided was (domain name removed): /wp-content/plugins/scure-bank/fea7b6cabec2fd724dd2d1b4ca7e898d/thankyou.php ...
3
votes
3answers
204 views

Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?

I'd like to submit my personal site into the Chrome HSTS preload list. The site there says: In order to be included on the HSTS preload list, your site must: Have a valid certificate. ...
0
votes
0answers
28 views

What kind of attack causes a JavaScript 'out of memory' on the attackers device?

We experienced a strange attack yesterday. Our error log picked up the same 'out of memory' JavaScript error from a single IP address every 10 seconds. The requests came from 6 client ports on the ...
5
votes
3answers
110 views

How do i make it difficult for users to make multiple accounts

I'm creating a website for my business and I want to offer free first deliveries for the first week but I'm afraid people will take advantage of that. I don't take any money or credit card info ...
1
vote
1answer
15 views

Disable ftp://hostname for my website [closed]

I'm hosting a page and I'm having a problem. If I write ftp://myhostname, the browser asks for FTP username and password and I think this may be a security problem because it doesn't happen with other ...
0
votes
0answers
36 views

Possible to leave proc_open() enabled on a shared host?

We are working on a PHP component that requires proc_open() for it to work. Because of this, we have trouble running on common shared hosts because proc_open() together with other functions like ...
1
vote
1answer
39 views

Looking for easy-to-maintain and secure directory structure for multipart site

I recently inherited an older custom PHP website that consists of three parts: a public section for all to see, a members section, and an administrator section. The directory section resembles the ...
1
vote
0answers
28 views

Database of hacking attempt strings? [closed]

I have a strange URL request that's showing up in my logs, and I want to see if it's a hacking attempt. Is there a database or resource out there somewhere where I can see if this url is a common ...
0
votes
0answers
41 views

Security in MVC code-first entity framework

I am new to ASP.NET MVC and to Azure (in which our application will be hosted). And I am new to security in general. So I'm wondering how secure the use of code-first entity framework in asp's ...
13
votes
2answers
4k views

How to find domain registrar and DNS hosting with good DNSSEC support?

Simplified problem I want to buy a domain and make a website that is fully secured with DNSSEC. I want to make sure that only the one right SSL certificate could be validated by the browsers and all ...
2
votes
1answer
65 views

Suspicious script loads ONLY when navigating to site via search engines

I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including ...