Block Compromised Passwords and High-Risk IP Addresses

ASP.NET, PHP, Security, Tutorials

PHPRunner and ASPRunner.NET already provide password policies, encrypted password storage, CAPTCHA, two-factor authentication, and user permissions. In this tutorial, we will add two more checks: reject passwords found in known data breaches and block visitors whose IP addresses have a very high abuse score.

During registration, haveibeenpwned.com checks whether the password has appeared in known data breaches. The password itself is never sent to the service, and this API does not require a key.

Before processing an application page, abuseipdb.com checks whether the visitor’s IP address has been associated with abusive activity. This service requires an API key. Section 6 explains how to create that key. The results are cached locally to reduce the number of external requests.

Continue Reading "Block Compromised Passwords and High-Risk IP Addresses" →

How I (almost) lost my domain name and how Bitcoin saved the day

Security

Our website xlinesoft.com was down from May 24, 2019 to May 30, 2019.

First, I noticed that I cannot logon to our online helpdesk. Then the website itself started showing ads that we never had. We assumed that our server was hacked but it turned out it simply points to a different IP address now. Hacker downloaded a static copy of our website, added some ads and tried to make some money via AdSense.

I tried to logon to GoDaddy account and check DNS settings. The login didn’t work and the password reset email never arrived. Our account at GoDaddy was hacked and attackers сhanged domain name ownership data. I was relieved though, dealing with GoDaddy should be easier than negotiating with a hacker, right?

Continue Reading "How I (almost) lost my domain name and how Bitcoin saved the day" →