3 ms·
Attackers can break into legitimate, low security, websites and use them as attack vectors. It's often easier that attacking the target directly and it's been d
by eeZah7Ux 8y ago
Attackers can break into legitimate, low security, websites and use them as attack vectors. It's often easier that attacking the target directly and it's been done for decades.
Also, botnets uses legitimate services to rely C&C traffic. Forums, pastebins, github gits, IRC and email gateways, VMs on AWS and other cloud services...
- yardstick 8y agoIn my original comment I referred to the need to only allow access to necessary services. No forums, email gateways, IRC, etc. Just whitelisted domains and IPs:ports (if dedicated hosting) of the services required to handle the payments aspect of a business. An attacker would have to break into the sites I whitelisted— in which case the liability falls on the site for not maintaining adequate security. It doesn’t alleviate the need for the merchant to have good security themselves.