5 ms·
It's the third time that I've read something about availability notifications on discord and other chats getting abused for timed attacks in the last few weeks.
by BoredPositron 6mo ago
It's the third time that I've read something about availability notifications on discord and other chats getting abused for timed attacks in the last few weeks.
- magicalhippo 6mo agoAfter my Wordpress site got hacked way back through an exploit in one of the WP files, I set up a cron job that compared the hash of the static files with expected hash, and would fire off an email if they differed. The script lived above the web root, so they'd have to escape that to tamper with it, and was generated by another script. Saved me a couple of times since, well worth the 15 minutes I spent on setting it up.
- embedding-shape 6mo ago> Saved me a couple of times since Wait, how often does your Wordpress site get successfully hacked like that?
- magicalhippo 6mo agoKeep in mind the first time was about 20 years ago. One time the hosting provider got compromised, FTP server exploit IIRC, they ran a recursive search and replace from root directory of the server.
- Beretta_Vexee 6mo agoIt depends on how long you've been using WordPress, whether you use plugins, whether they're well-maintained or not, and so on. Back around 2010, there were security vulnerabilities in WordPress or its popular plugins almost every month.
- michaelt 6mo agoBack in the 1990s, there was a tool called ‘tripwire’ that checked key files against expected checksums. As I recall, they recommended putting the expected values on a floppy disk and setting the ‘write protect’ tab, so the checksums couldn’t be changed.
- Terr_ 6mo agoBack in the 90s I fantasized about a hard drive bay with a physical write-protect switch on the cover plate.
- kqgnkqgn 6mo agoIn the mid-2000's I briefly worked for a company that did this at a firmware level ("write-blocked firmware") for USB drive adapters (IDE / SATA / whatever IDE variant laptops were using / etc). This was apparently very valuable for police and investigative services, so they could collect evidence, while being able to show that they did not tamper with the original drive.
- kjs3 6mo agoTenable makes some "read only" adapters for hard disks (SATA, PATA, SCSI & FW at least). They're usually sold as part of a forensic analysis kit. I have a couple and they definitely work. I believe there are a couple of other vendors (Wiebetech?) make similar devices. The alternative (tho not practical in many cases) would be RO media like RW-DVD.
- DarkUranium 6mo agoYou mean DVD-R? DVD-RW is rewritable, which means it's not really RO. The semi-obscure DVD-RAM takes this a step further by making it work a lot like a hard/flash drive (at the user level, not technical).
- kjs3 6mo agoI think it's clear what I meant, even with a typo.
- FuriouslyAdrift 6mo agotripwire was the orginal file integrity anti-virus/anti-tampering software from the security group (which turned into CERIAS) at Purdue led by Dr. Eugene "Spaff" Spafford. https://docs.lib.purdue.edu/cstech/1084/ https://docs.lib.purdue.edu/cstech/1084/
- daneel_w 6mo agoRelated: OpenBSD does this daily as part of running security(8) and its coverage can be expanded to include pretty much anything. https://man.openbsd.org/security https://man.openbsd.org/security
- Aurornis 6mo agoCan you share what those other attacks were? It's helpful to study additional attacks to know what to look for.