Tag Info

New answers tagged

-1

On my debian web-server i use fail2ban + bash + geoiplookup then you can draw diagram with you preffered tool I gather jail status(ssh in my case), gahter IP's, determine country with geoiplookup, and count them: fail2ban-client status ssh|grep -i IP\ list|awk -F: '{gsub(/^[ \t]+/, "", $2); print $2}'|awk '{for(i=1;i<=NF;i++) system("geoiplookup ...


1

Seems like a BGP update combined with default host choices¹. I had a trouble gathering data (due to a network I'd pay to upgrade) but here's what I got: The Route A2 Hosting's routes are under AS55293. You're covered by the /22 and /23 there. The ASN paths updated on April 17th, same day as your NUL attachment. From LookingGlass (enter your IP, choose ...


-2

This is a classical Shellshock spreading worm. If vulnerable, it download a .txt file (which is a downloader), run it, download a .tar file, extract it, run the inside binary which is a rootkit and a scanner. Here a quick study of this behavior : what-a-real-shellshock-attack-looks-like Mike.


0

I'd rather use a different approach. Accept these requests, but store these in a DB to deny these straight away through a security function of your website. If a firewall is installed, make sure the firewall also blocks the IP straight for 24Hours. Identification is pretty simple: Whatever is not a regular request, is bad. That is what I do and it works ...


0

A good introduction to DNS related threats are given in RFC3833. Basically DNSSEC is one way among others to be sure that the server you are connecting is really legitimate. However, it is just one layer of security and not satisfactory on its own: it does not prevent re-routing your traffic to somewhere else or interpret the packets it they are not ...


0

I would say it essentially boils down to what you already mentioned. If you have DNSSEC implemented on both ends (a validating resolver and a signed zone), then DNSSEC prevents a man in the middle from altering the response without detection as well as avoiding the risk that a non-MITM attacker may win the what, for unauthenticated data, is a simple race of ...



Top 50 recent answers are included